AWS Certified Solutions Architect Associate Practice Exams

Practice Test 3: AWS Certified Solutions Architect Associate
Open

Practice Test 2: AWS Certified Solutions Architect…

Practice Test 4: AWS Certified Solutions Architect…

Set a certification due date

AWS Certified Solutions Architect – Associate

Course content

AI Assistant

Practice tests

Start

Practice Test 1: AWS Certified Solutions Architect Associate

Start

Practice Test 2: AWS Certified Solutions Architect Associate

Start

Start

Practice Test 4: AWS Certified Solutions Architect Associate

Start

Practice Test 5: AWS Certified Solutions Architect Associate

Start

Practice Test 6: AWS Certified Solutions Architect Associate

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

2025 AWS Certified Solutions Architect Associate Practice Tests [SAA-C03] + Exam Simulator + Explanations + Cheat Sheets

Rating: 4.5 out of 54.5
12,930 ratings

117,520

Students

390 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified Solutions Architect Associate exam the first time with a great score

EXAM SIMULATION: All Practice Tests are timed and scored (passing score is 72%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

REFERENCE LINKS: To help you understand AWS concepts, all answers link to sections of our online Training Notes (Cheat Sheets) with exam-specific information

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

ALWAYS UP TO DATE: Covering the latest SAA-C03 exam blueprint, our question bank is constantly updated based on student feedback from the real exam

MASTER THE CLOUD: Learn how to answer challenging scenario-based questions

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: Our discussion board provides a platform for students to ask questions, share their recent exam experiences, and offer feedback on exam topics

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Show moreShow less

Description

Are you preparing for the AWS Certified Solutions Architect Associate exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS Solutions Architect Associate practice exams to assess your exam-readiness!

These 6 AWS practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy, as demonstrated by the fantastic reviews from thousands of happy students. With our comprehensive AWS certification training course, you'll be well-equipped to pass your AWS Solutions Architect exam with flying colors.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Don't just take our word for it – check out our reviews, which confirm that our AWS practice questions closely match the exam pattern and difficulty. These practice tests will prepare you thoroughly for the real exam giving you the confidence you need to take and pass the test!

This SAA-C03 practice test course includes:

390 exam-style questions with detailed answers and explanations to reinforce your understanding of the core concepts

Test report that highlights the areas you need to focus on

Regular updates to reflect the latest exam content

Realistic exam simulation to help you build confidence in your ability to pass your exam

Free bonus material to help you succeed in your exam

TOP REASONS WHY THESE PRACTICE EXAMS ARE THE KEY TO ACING YOUR AWS EXAM

100% ALIGNED WITH SAA-C03 EXAM: All practice tests are 100% scenario-based reflecting the current AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DEEP DIVE REFERENCE LINKS: Our practice tests offer more than just answers – they link to relevant sections of our online "Training Notes," providing you with a comprehensive collection of exam-specific information for the SAA-C03 exam

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized, making it more challenging to ensure you're learning and not memorizing

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

ADDITIONAL LEARNING RESOURCES: To help you succeed in your exam, we've included free learning material (optional, requires name/email) that complements the course content

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered

BEST VALUE FOR MONEY: When investing in these tests you get lifetime access to all 6 sets of practice questions

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

MONEY-BACK GUARANTEE: 30-day money-back guarantee - no questions asked

WHAT DO OTHER STUDENTS SAY?

Our practice tests are widely regarded as the best, providing you with the preparation you need to confidently pass your AWS Certified Solutions Architect Associate exam with a great score. But don't just take our word for it – check out the excellent course reviews from our happy students, who achieved an average passing score of over 850!

"Well Crafted Questionnaire material, which will help you to gain the confidence on taking the exam. I greatly recommend anyone to take this practice text before appearing for the exam."

"Just passed the exam with a surprisingly good score and found that these practice exams were very helpful. I tried some other courses too but these questions were most similar to the AWS exam and the free training notes on the website were invaluable."

"I've never worked in architecture before and had very little experience in AWS. However, I was able to pass the CSAA exam with 92%, and I have to say that most of the credit goes to these practice exams. If you only buy one practice course, make it this one. I can't recommend it enough."

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the actual AWS exam has a passing score of 72%, we recommend that you retake our AWS practice exams until you consistently score 80% or higher. It's important to put in the effort and study the online training notes in detail. Once you achieve the recommended score in our practice tests, you'll be well-prepared to sit the AWS exam and achieve a remarkable score.

COVERING AWS FUNDAMENTALS: Through our AWS practice exams and online training notes, we cover the fundamentals of AWS Architecture and how to create performant, cost-optimized, and fault-tolerant applications. We also deep dive into individual services including Amazon S3, Amazon CloudFront, Amazon Storage Gateway, Amazon EC2, Amazon ECS, AWS IAM, AWS Lambda, Amazon RDS, Route 53, DynamoDB, RedShift, ElastiCache, Amazon Aurora, VPC, SQS, SNS, SWF, ElasticTranscoder, Amazon Kinesis, API Gateway, Direct Connect, Snowball, CloudWatch, CloudTrail and many more.

UNDERSTANDING AWS ARCHITECTURE: The AWS Certified Solutions Architect Associate exam consists entirely of scenario-based questions that assess your knowledge and experience with Amazon Web Services. Knowing the correct use of a particular AWS service and understanding the cost, operational, security, and performance implications of different design choices are essential for success. Our AWS practice exams are specifically designed to help beginners master these concepts and answer these questions accurately.

GET FAMILIAR WITH AWS EXAM FORMAT: Our AWS Certified Solutions Architect Associate practice exams help you get familiar with the test question format and structure, giving you an edge in the actual AWS exam. While many practice tests in the market do not match the exam pattern format, you can trust that our practice tests will thoroughly prepare you for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS Solutions Architect practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified Solutions Architect certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our practice exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

Who this course is for:

Students preparing for the AWS Certified Solutions Architect - Associate exam [SAA-C03]

Candidates for the AWS Certified Solutions Architect - Associate exam who are keen to ace their exam the first time

Students who have completed the AWS Certified Solutions Architect Associate video course from Neal Davis and are looking for some final test preparation

Students who wish to evaluate their AWS exam readiness by testing their skills through an exam simulation

Anyone who wants to learn AWS through high-quality questions and answers, in-depth explanations, and helpful reference links

IT professionals who want to enter any AWS technical job interview with confidence

Anyone who is keen to take their career and salary to the next level with an AWS Certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Featured review

Vijay Srinivas V.

6 courses

4 reviews

Rating: 5.0 out of 5 4 years ago

Good to take the practice tests, I had taken Neals tests which instills much confidence and he covers all the topics with detail explanation and especially for the Load Balancing/VPC related with very clear picture explanation which makes people understand the practical scenarios very much. Sincere Thanks! Vijay

Show moreShow less

Was this review helpful?

See all reviews (12,930)

Requirements

Before assessing your exam readiness, we highly recommend completing the AWS Certified Solutions Architect - Associate video course by Neal Davis. These instructor-led video lectures from Digital Cloud Training build the solid knowledge foundation preparing students for the final step of their AWS certification journey

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 3: AWS Certified Solutions Architect Associate

AWS Certified Solutions Architect Associate - Results

Back to result overview
Attempt 2

All domains

All domains

AWS Storage

AWS Security, Identity, & Compliance

AWS Application Integration

AWS Compute

AWS Database

AWS Networking & Content Delivery

AWS Management & Governance

AWS Migration & Transfer

65 all

0 correct

0 incorrect

65 skipped

0 marked

Collapse all questions

Question 1Skipped

A Solutions Architect works for a company looking to centralize its Machine Learning Operations. Currently they have a large amount of existing cloud storage to store their operational data which is used for machine learning analysis. There is some data which exists within an Amazon RDS MySQL database, and they need a solution which can easily retrieve data from the database.

Which service can be used to build a centralized data repository to be used for Machine Learning purposes?

Correct answer

AWS Lake Formation

Amazon Neptune

Amazon S3

Amazon Quantum Ledger Database (QLDB)

Overall explanation

AWS Lake Formation is a service that makes it easy to set up a secure data lake in days. A data lake is a centralized, curated, and secured repository that stores all your data, both in its original form and prepared for analysis. With AWS Lake Formation, you can import data from MySQL, PostgreSQL, SQL Server, MariaDB, and Oracle databases running in Amazon Relational Database Service (RDS) or hosted in Amazon Elastic Compute Cloud (EC2). Both bulk and incremental data loading are supported.

CORRECT: "AWS Lake Formation" is the correct answer (as explained above.)

INCORRECT: "Amazon S3" is incorrect. Amazon Simple Storage Service (Amazon S3) is an object storage service offering industry-leading scalability, data availability, security, and performance. It is not however suitable for directly retrieving data from MySQL on RDS and using the data for a Machine learning use case.

INCORRECT: "Amazon Quantum Ledger Database" is incorrect. Amazon Quantum Ledger Database (QLDB) is a fully managed ledger database that provides a transparent, immutable, and cryptographically verifiable transaction log. It is not suitable for directly retrieving data from MySQL on RDS and using the data for a Machine learning use case.

INCORRECT: "Amazon Neptune" is incorrect. Amazon Neptune is a fast, reliable, fully managed graph database service that makes it easy to build and run applications. It is not suitable for directly retrieving data from MySQL on RDS and using the data for a Machine learning use case.

References:

https://aws.amazon.com/lake-formation/features/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-associate/aws-storage-saa/

Domain

AWS Storage

Question 2Skipped

A healthcare startup is building a cloud-based patient management system on AWS. The system processes sensitive health data and uses Amazon RDS for the database, Amazon S3 for storing medical reports, and AWS Lambda for processing event-driven workflows triggered by S3 Event Notifications.

The startup uses AWS IAM Identity Center to manage user authentication. The development, testing, and operations teams need secure access to RDS and S3 while ensuring compliance with healthcare regulations that mandate least privilege access and centralized access control.

Which solution meets these requirements with the LEAST operational overhead?

Use AWS Organizations to create separate accounts for development, testing, and operations teams. Apply Service Control Policies (SCPs) to restrict access at the account level. Use cross-account IAM roles to grant granular permissions for RDS and S3 based on team needs.

Create separate IAM users for all team members. Assign each user predefined managed policies with RDS and S3 permissions. Use IAM Access Analyzer to review permissions periodically to ensure compliance with least privilege principles.

Configure an Amazon Cognito user pool to authenticate team members. Use a custom Lambda function to generate temporary credentials for RDS and S3 access. Implement role-based access controls within the Lambda function to enforce least privilege.

Correct answer

Use AWS IAM Identity Center integrated with the startup's existing Active Directory. Create permission sets with fine-grained permissions for RDS and S3. Assign team members to appropriate groups in Active Directory, which map to Identity Center permission sets.

Overall explanation

Use AWS IAM Identity Center integrated with the startup's existing Active Directory. Create permission sets with fine-grained permissions for RDS and S3. Assign team members to appropriate groups in Active Directory, which map to Identity Center permission sets: This is correct because IAM Identity Center enables centralized user management and integrates seamlessly with Active Directory. It allows the creation of permission sets that enforce least privilege while minimizing operational overhead by using existing group structures.

Configure an Amazon Cognito user pool to authenticate team members. Use a custom Lambda function to generate temporary credentials for RDS and S3 access. Implement role-based access controls within the Lambda function to enforce least privilege: This is incorrect because Cognito is primarily designed for managing end-user authentication, not for managing internal team access to AWS resources. Using Cognito and a custom Lambda function would add unnecessary complexity and operational overhead.

Create separate IAM users for all team members. Assign each user predefined managed policies with RDS and S3 permissions. Use IAM Access Analyzer to review permissions periodically to ensure compliance with least privilege principles: This is incorrect because managing individual IAM users introduces significant administrative overhead. IAM Identity Center is a more scalable and centralized solution.

Use AWS Organizations to create separate accounts for development, testing, and operations teams. Apply Service Control Policies (SCPs) to restrict access at the account level. Use cross-account IAM roles to grant granular permissions for RDS and S3 based on team needs: This is incorrect because creating separate accounts and managing cross-account IAM roles adds unnecessary complexity. IAM Identity Center provides a more efficient solution for centralized access control within a single account.

References:
https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html
https://aws.amazon.com/cognito/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 3Skipped

A company is deploying an application that produces data that must be processed in the order it is received. The company requires a solution for decoupling the event data from the processing layer. The solution must minimize operational overhead.

How can a Solutions Architect meet these requirements?

Create an Amazon SNS topic to decouple the application. Configure an Amazon SQS queue as a subscriber.

Create an Amazon SQS standard queue to decouple the application. Set up an AWS Lambda function to process messages from the queue independently.

Create an Amazon SNS topic to decouple the application. Configure an AWS Lambda function as a subscriber.

Correct answer

Create an Amazon SQS FIFO queue to decouple the application. Configure an AWS Lambda function to process messages from the queue.

Overall explanation

Amazon SQS can be used to decouple this application using a FIFO queue. With a FIFO queue the order in which messages are sent and received is strictly preserved. You can configure an AWS Lambda function to poll the queue, or you can configure a Lambda function as a destination to asynchronously process messages from the queue.

CORRECT: "Create an Amazon SQS FIFO queue to decouple the application. Configure an AWS Lambda function to process messages from the queue" is the correct answer.

INCORRECT: "Create an Amazon SQS standard queue to decouple the application. Set up an AWS Lambda function to process messages from the queue independently" is incorrect. A standard queue only offers best-effort ordering so it may not preserve the order of the data.

INCORRECT: "Create an Amazon SNS topic to decouple the application. Configure an AWS Lambda function as a subscriber" is incorrect. Amazon SQS is better for this use case as there are a sequence of events for which the order must be maintained, and these events can be queued for processing whereas SNS delivers them for immediate processing.

INCORRECT: "Create an Amazon SNS topic to decouple the application. Configure an Amazon SQS queue as a subscriber" is incorrect. As above an SQS queue would be preferred for queuing the messages.

References:

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-configure-lambda-function-trigger.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 4Skipped

An application runs on a fleet of Amazon EC2 instances in an Amazon EC2 Auto Scaling group behind an Elastic Load Balancer. The operations team has determined that the application performs best when the CPU utilization of the EC2 instances is at or near 60%.

Which scaling configuration should a Solutions Architect use to optimize the applications performance?

Correct answer

Use a target tracking policy to dynamically scale the Auto Scaling group.

Use a simple scaling policy to dynamically scale the Auto Scaling group.

Use a step scaling policy to dynamically scale the Auto Scaling group.

Use a scheduled scaling policy to dynamically the Auto Scaling group.

Overall explanation

With target tracking scaling policies, you select a scaling metric and set a target value. Amazon EC2 Auto Scaling creates and manages the CloudWatch alarms that trigger the scaling policy and calculates the scaling adjustment based on the metric and the target value.

The scaling policy adds or removes capacity as required to keep the metric at, or close to, the specified target value. In addition to keeping the metric close to the target value, a target tracking scaling policy also adjusts to changes in the metric due to a changing load pattern.

The following diagram shows a target tracking policy set to keep the CPU utilization of the EC2 instances at or close to 60%.

CORRECT: "Use a target tracking policy to dynamically scale the Auto Scaling group" is the correct answer.

INCORRECT: "Use a simple scaling policy to dynamically scale the Auto Scaling group" is incorrect. Simple scaling is not used for maintaining a target utilization. It is used for making simple adjustments up or down based on a threshold value.

INCORRECT: "Use a step scaling policy to dynamically scale the Auto Scaling group" is incorrect. Step scaling is not used for maintaining a target utilization. It is used for making step adjustments that vary based on the size of the alarm breach.

INCORRECT: "Use a scheduled scaling policy to dynamically the Auto Scaling group" is incorrect. Scheduled scaling is not used for maintaining a target utilization. It is used for scheduling changes at specific dates and times.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 5Skipped

A retail company runs an on-premises application that uses Java Spring Boot on Windows servers. The application is resource-intensive and handles customer-facing operations. The company wants to modernize the application by migrating it to a containerized environment running on AWS. The new solution must automatically scale based on Amazon CloudWatch metrics and minimize operational overhead for managing infrastructure.

Which solution will meet these requirements with the LEAST operational overhead?

Use AWS App2Container to containerize the application. Deploy the containerized application to Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 instances by using an AWS CloudFormation template.

Use AWS App2Container to containerize the application. Deploy the containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate by using an AWS CloudFormation template.

Use AWS App Runner to containerize the application. Deploy the containerized application to Amazon Elastic Kubernetes Service (Amazon EKS) on Amazon EC2 instances.

Correct answer

Use AWS App Runner to containerize the application. Use App Runner to automatically deploy and manage the application without using ECS or EC2.

Overall explanation

Use AWS App Runner to containerize the application. Use App Runner to automatically deploy and manage the application without using ECS or EC2: This is correct because App Runner simplifies deployment and management of containerized applications. It automatically scales based on demand and integrates with CloudWatch, minimizing operational overhead.

Use AWS App2Container to containerize the application. Deploy the containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate by using an AWS CloudFormation template: This is incorrect because while Fargate reduces operational overhead by eliminating the need to manage EC2 instances, using ECS still requires more configuration and maintenance compared to App Runner.

Use AWS App2Container to containerize the application. Deploy the containerized application to Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 instances by using an AWS CloudFormation template: This is incorrect because running ECS on EC2 requires managing the underlying EC2 instances, which increases operational overhead.

Use AWS App Runner to containerize the application. Deploy the containerized application to Amazon Elastic Kubernetes Service (Amazon EKS) on Amazon EC2 instances: This is incorrect because EKS involves additional complexity in managing Kubernetes clusters and EC2 instances, making it less suitable for reducing operational overhead.

References:

https://aws.amazon.com/apprunner/

https://aws.amazon.com/app2container/

Domain

AWS Compute

Question 6Skipped

A web app allows users to upload images for viewing online. The compute layer that processes the images is behind an Auto Scaling group. The processing layer should be decoupled from the front end and the ASG needs to dynamically adjust based on the number of images being uploaded.

How can this be achieved?

Create a target tracking policy that keeps the ASG at 70% CPU utilization

Create an Amazon SNS Topic to generate a notification each time a message is uploaded. Have the ASG scale based on the number of SNS messages

Correct answer

Create an Amazon SQS queue and custom CloudWatch metric to measure the number of messages in the queue. Configure the ASG to scale based on the number of messages in the queue

Create a scheduled policy that scales the ASG at times of expected peak load

Overall explanation

The best solution is to use Amazon SQS to decouple the front end from the processing compute layer. To do this you can create a custom CloudWatch metric that measures the number of messages in the queue and then configure the ASG to scale using a target tracking policy that tracks a certain value.

CORRECT: "Create an Amazon SQS queue and custom CloudWatch metric to measure the number of messages in the queue. Configure the ASG to scale based on the number of messages in the queue" is the correct answer.

INCORRECT: "Create an Amazon SNS Topic to generate a notification each time a message is uploaded. Have the ASG scale based on the number of SNS messages" is incorrect. The Amazon Simple Notification Service (SNS) is used for sending notifications using topics. Amazon SQS is a better solution for this scenario as it provides a decoupling mechanism where the actual images can be stored for processing. SNS does not provide somewhere for the images to be stored.

INCORRECT: "Create a target tracking policy that keeps the ASG at 70% CPU utilization" is incorrect. Using a target tracking policy with the ASG that tracks CPU utilization does not allow scaling based on the number of images being uploaded.

INCORRECT: "Create a scheduled policy that scales the ASG at times of expected peak load" is incorrect. Using a scheduled policy is less dynamic as though you may be able to predict usage patterns, it would be better to adjust dynamically based on actual usage.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-using-sqs-queue.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Application Integration

Question 7Skipped

An application runs on-premises and produces data that must be stored in a locally accessible file system that servers can mount using the NFS protocol. The data must be subsequently analyzed by Amazon EC2 instances in the AWS Cloud.

How can these requirements be met?

Correct answer

Use an AWS Storage Gateway file gateway to provide a locally accessible file system that replicates data to the cloud, then analyze the data in the AWS Cloud.

Use an AWS Storage Gateway volume gateway in cached mode to back up all the local storage in the AWS Cloud, then perform analytics on this data in the cloud.

Use an AWS Storage Gateway volume gateway in stored mode to regularly take snapshots of the local data, then copy the data to AWS.

Use an AWS Storage Gateway tape gateway to take a backup of the local data and store it on AWS, then perform analytics on this data in the AWS Cloud.

Overall explanation

The best solution for this requirement is to use an AWS Storage Gateway file gateway. This will provide a local NFS mount point for the data and a local cache. The data is then replicated to Amazon S3 where it can be analyzed by the Amazon EC2 instances in the AWS Cloud.

CORRECT: "Use an AWS Storage Gateway file gateway to provide a locally accessible file system that replicates data to the cloud, then analyze the data in the AWS Cloud" is the correct answer.

INCORRECT: "Use an AWS Storage Gateway tape gateway to take a backup of the local data and store it on AWS, then perform analytics on this data in the AWS Cloud" is incorrect. A tape gateway does not provide a local NFS mount point, it is simply a backup solution not a file system.

INCORRECT: "Use an AWS Storage Gateway volume gateway in stored mode to regularly take snapshots of the local data, then copy the data to AWS" is incorrect. Volume gateways use block-based protocols not NFS.

INCORRECT: "Use an AWS Storage Gateway volume gateway in cached mode to back up all the local storage in the AWS Cloud, then perform analytics on this data in the cloud" is incorrect. Volume gateways use block-based protocols not NFS.

References:

https://aws.amazon.com/storagegateway/file/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-efs/

Domain

AWS Storage

Question 8Skipped

A research organization is planning to migrate its simulation analysis platform to AWS. The platform stores simulation results and logs on an on-premises NFS server. The platform's codebase is legacy and cannot be modified to use any protocol other than NFS to store and retrieve data. The organization needs a storage solution on AWS that supports NFS and is highly available and scalable.

Which storage solution should a solutions architect recommend for use after the migration?

Correct answer

Use Amazon Elastic File System (Amazon EFS) to provide an NFS-compatible shared file system that integrates with AWS services.

Use AWS Storage Gateway File Gateway to provide an NFS interface backed by Amazon S3 for storing and retrieving data.

Use Amazon FSx for Windows File Server to create a shared file system for data storage and access through the SMB protocol.

Use Amazon Elastic Block Store (Amazon EBS) volumes attached to each EC2 instance for storage. Use NFS software on the EC2 instances to create a shared file system.

Overall explanation

Use Amazon Elastic File System (Amazon EFS) to provide an NFS-compatible shared file system that integrates with AWS services: This is correct because Amazon EFS is a fully managed, scalable, and highly available file storage service that supports NFS. It is designed to work seamlessly with applications requiring NFS without additional setup or modifications.

Use AWS Storage Gateway File Gateway to provide an NFS interface backed by Amazon S3 for storing and retrieving data: This is incorrect because File Gateway is typically used to integrate on-premises environments with AWS. It is not as suitable for applications entirely migrated to AWS, especially when a native NFS solution like EFS is available.

Use Amazon Elastic Block Store (Amazon EBS) volumes attached to each EC2 instance for storage. Use NFS software on the EC2 instances to create a shared file system: This is incorrect because using EBS requires additional configuration and management to implement an NFS-based shared file system. EFS provides a simpler, fully managed solution.

Use Amazon FSx for Windows File Server to create a shared file system for data storage and access through the SMB protocol: This is incorrect because FSx for Windows File Server supports the SMB protocol, not NFS. The application explicitly requires NFS, making FSx for Windows File Server unsuitable.

References:
https://aws.amazon.com/efs/
https://aws.amazon.com/storagegateway/file/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-efs/

Domain

AWS Storage

Question 9Skipped

An online store uses an Amazon Aurora database. The database is deployed as a Multi-AZ deployment. Recently, metrics have shown that database read requests are high and causing performance issues which result in latency for write requests.

What should the solutions architect do to separate the read requests from the write requests?

Enable read through caching on the Amazon Aurora database

Create a read replica and modify the application to use the appropriate endpoint

Create a second Amazon Aurora database and link it to the primary database as a read replica

Correct answer

Update the application to read from the Aurora Replica

Overall explanation

Aurora Replicas are independent endpoints in an Aurora DB cluster, best used for scaling read operations and increasing availability. Up to 15 Aurora Replicas can be distributed across the Availability Zones that a DB cluster spans within an AWS Region.

The DB cluster volume is made up of multiple copies of the data for the DB cluster. However, the data in the cluster volume is represented as a single, logical volume to the primary instance and to Aurora Replicas in the DB cluster.

As well as providing scaling for reads, Aurora Replicas are also targets for multi-AZ. In this case the solutions architect can update the application to read from the Aurora Replica

CORRECT: "Update the application to read from the Aurora Replica" is the correct answer.

INCORRECT: "Create a read replica and modify the application to use the appropriate endpoint" is incorrect. An Aurora Replica is both a standby in a Multi-AZ configuration and a target for read traffic. The architect simply needs to direct traffic to the Aurora Replica.

INCORRECT: "Enable read through caching on the Amazon Aurora database." is incorrect as this is not a feature of Amazon Aurora.

INCORRECT: "Create a second Amazon Aurora database and link it to the primary database as a read replica" is incorrect as an Aurora Replica already exists as this is a Multi-AZ configuration and the standby is an Aurora Replica that can be used for read traffic.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Replication.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 10Skipped

A streaming service company runs its video recommendation engine on an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB) in a single AWS Region. The service generates personalized recommendations based on user activity and serves dynamic content to millions of users worldwide.

The company needs a cost-optimized solution to improve performance and scalability while ensuring that users across the globe experience low latency when accessing personalized recommendations.

Which solution will meet these requirements?

Deploy additional EC2 instances and ALBs in multiple Regions. Use Amazon Route 53 latency-based routing to direct users to the Region with the lowest latency.

Migrate the recommendation engine to Amazon S3 and enable static website hosting. Use an Amazon CloudFront distribution to cache the content globally.

Configure AWS Global Accelerator to route traffic to the existing ALB and EC2 instances in the Region closest to each user.

Correct answer

Set up an Amazon CloudFront distribution and configure the existing ALB as the origin. Use dynamic cache settings to reduce latency for global users.

Overall explanation

Set up an Amazon CloudFront distribution and configure the existing ALB as the origin. Use dynamic cache settings to reduce latency for global users: This is correct because CloudFront provides a global content delivery network (CDN) that reduces latency by caching content closer to users. For dynamic content, CloudFront can still improve performance by optimizing requests and routing through its edge locations. This solution is cost-effective and requires minimal architectural changes.

Configure AWS Global Accelerator to route traffic to the existing ALB and EC2 instances in the Region closest to each user: This is incorrect because Global Accelerator improves performance for static and dynamic content, but it requires additional costs and does not cache dynamic content at the edge like CloudFront. It is better suited for multi-Region deployments.

Deploy additional EC2 instances and ALBs in multiple Regions. Use Amazon Route 53 latency-based routing to direct users to the Region with the lowest latency: This is incorrect because deploying and managing resources across multiple Regions increases cost and operational overhead. For a cost-optimized solution, CloudFront is more efficient as it uses its global edge locations without requiring additional infrastructure.

Migrate the recommendation engine to Amazon S3 and enable static website hosting. Use an Amazon CloudFront distribution to cache the content globally: This is incorrect because the recommendation engine serves dynamic content, which cannot be hosted on Amazon S3. S3 is designed for static content like images or HTML files and is not appropriate for processing user-specific dynamic data.

References:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
https://aws.amazon.com/global-accelerator/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 11Skipped

A company has on-premises file servers that include both Windows SMB and Linux NFS protocols. The company plans to migrate to AWS and consolidate these file servers into a managed cloud solution. The chosen solution must support both NFS and SMB access, provide protocol sharing, and offer redundancy at the Availability Zone level.

Which solution will meet these requirements?

Deploy Amazon FSx for Windows File Server for SMB access and Amazon FSx for OpenZFS for NFS access.

Create two Amazon EC2 instances with locally attached storage: one instance for SMB access and the other instance for NFS access.

Use Amazon S3 for storage and deploy an Amazon S3 File Gateway for on-premises access to both SMB and NFS clients.

Correct answer

Use Amazon FSx for NetApp ONTAP to consolidate storage and enable multi-protocol access for both SMB and NFS.

Overall explanation

Use Amazon FSx for NetApp ONTAP to consolidate storage and enable multi-protocol access for both SMB and NFS: This is correct because Amazon FSx for NetApp ONTAP supports both SMB and NFS protocols with multi-protocol sharing and redundancy across Availability Zones.

Deploy Amazon FSx for Windows File Server for SMB access and Amazon FSx for OpenZFS for NFS access: This is incorrect because this approach separates SMB and NFS access, does not provide protocol sharing, and introduces additional complexity.

Use Amazon S3 for storage and deploy an Amazon S3 File Gateway for on-premises access to both SMB and NFS clients: This is incorrect because Amazon S3 File Gateway does not natively support SMB or NFS protocols for simultaneous access.

Create two Amazon EC2 instances with locally attached storage: one instance for SMB access and the other instance for NFS access: This is incorrect because this solution is not a managed service, lacks redundancy at the Availability Zone level, and increases operational overhead.

References:
https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/what-is-fsx-ontap.html
https://aws.amazon.com/fsx/netapp-ontap/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 12Skipped

A company has deployed an API in a VPC behind an internal Network Load Balancer (NLB). An application that consumes the API as a client is deployed in a second account in private subnets.

Which architectural configurations will allow the API to be consumed without using the public Internet? (Select TWO.)

Configure a ClassicLink connection for the API into the client VPC. Access the API using the ClassicLink address

Configure an AWS Direct Connect connection between the two VPCs. Access the API using the private address

Configure an AWS Resource Access Manager connection between the two accounts. Access the API using the private address

Correct selection

Configure a VPC peering connection between the two VPCs. Access the API using the private address

Correct selection

Configure a PrivateLink connection for the API into the client VPC. Access the API using the PrivateLink address

Overall explanation

You can create your own application in your VPC and configure it as an AWS PrivateLink-powered service (referred to as an endpoint service). Other AWS principals can create a connection from their VPC to your endpoint service using an interface VPC endpoint. You are the service provider, and the AWS principals that create connections to your service are service consumers.

This configuration is powered by AWS PrivateLink and clients do not need to use an internet gateway, NAT device, VPN connection or AWS Direct Connect connection, nor do they require public IP addresses.

Another option is to use a VPC Peering connection. A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network. You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account.

CORRECT: "Configure a VPC peering connection between the two VPCs. Access the API using the private address" is a correct answer.

CORRECT: "Configure a PrivateLink connection for the API into the client VPC. Access the API using the PrivateLink address" is also a correct answer.

INCORRECT: "Configure an AWS Direct Connect connection between the two VPCs. Access the API using the private address" is incorrect. Direct Connect is used for connecting from on-premises data centers into AWS. It is not used from one VPC to another.

INCORRECT: "Configure a ClassicLink connection for the API into the client VPC. Access the API using the ClassicLink address" is incorrect. ClassicLink allows you to link EC2-Classic instances to a VPC in your account, within the same Region. This is not relevant to sending data between two VPCs.

INCORRECT: "Configure an AWS Resource Access Manager connection between the two accounts. Access the API using the private address" is incorrect. AWS RAM lets you share resources that are provisioned and managed in other AWS services. However, APIs are not shareable resources with AWS RAM.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-service.html

https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 13Skipped

A company operates a production environment on Amazon EC2 instances. The instances are required to run continuously from Tuesday to Sunday without interruptions. On Mondays, the instances are needed for only 8 hours, and they also cannot tolerate interruptions. The company wants to implement a cost-effective solution to optimize EC2 usage while meeting these requirements.

Which solution will provide the MOST cost-effective results?

Purchase Convertible Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday. Use Spot Instances for the EC2 instances that run for 8 hours on Mondays.

Purchase Standard Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday. Use Convertible Reserved Instances for the EC2 instances that run for 8 hours on Mondays.

Use Spot Instances for the EC2 instances that run for 8 hours on Mondays. Purchase Standard Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday.

Correct answer

Purchase Standard Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday. Use Scheduled Reserved Instances for the EC2 instances that run for 8 hours on Mondays.

Overall explanation

Purchase Standard Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday. Use Scheduled Reserved Instances for the EC2 instances that run for 8 hours on Mondays: This is correct because Standard Reserved Instances provide cost savings for long-term, predictable workloads, like the continuous operation from Tuesday to Sunday. Scheduled Reserved Instances are ideal for predictable workloads with fixed schedules, like the 8-hour workload on Mondays, offering savings while ensuring uninterrupted operation.

Use Spot Instances for the EC2 instances that run for 8 hours on Mondays. Purchase Standard Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday: This is incorrect because Spot Instances, while cost-effective, are not suitable for workloads that cannot tolerate interruptions. Spot Instances may be terminated unexpectedly, which does not meet the requirement for uninterrupted operation.

Purchase Convertible Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday. Use Spot Instances for the EC2 instances that run for 8 hours on Mondays: This is incorrect because Convertible Reserved Instances, while flexible, are not the most cost-effective option for predictable and consistent workloads like continuous operation from Tuesday to Sunday. Additionally, Spot Instances are unsuitable for workloads requiring uninterrupted operation.

Purchase Standard Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday. Use Convertible Reserved Instances for the EC2 instances that run for 8 hours on Mondays: This is incorrect because Convertible Reserved Instances are not as cost-effective as Scheduled Reserved Instances for fixed and predictable schedules, such as the 8-hour Monday workload.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Compute

Question 14Skipped

A company has experienced malicious traffic from some suspicious IP addresses. The security team discovered the requests are from different IP addresses under the same CIDR range.

What should a solutions architect recommend to the team?

Add a rule in the outbound table of the security group to deny the traffic from that CIDR range

Add a rule in the inbound table of the security group to deny the traffic from that CIDR range

Add a deny rule in the outbound table of the network ACL with a lower rule number than other rules

Correct answer

Add a deny rule in the inbound table of the network ACL with a lower rule number than other rules

Overall explanation

You can only create deny rules with network ACLs, it is not possible with security groups. Network ACLs process rules in order from the lowest numbered rules to the highest until they reach and allow or deny. The following table describes some of the differences between security groups and network ACLs:

Therefore, the solutions architect should add a deny rule in the inbound table of the network ACL with a lower rule number than other rules.

CORRECT: "Add a deny rule in the inbound table of the network ACL with a lower rule number than other rules" is the correct answer.

INCORRECT: "Add a deny rule in the outbound table of the network ACL with a lower rule number than other rules" is incorrect as this will only block outbound traffic.

INCORRECT: "Add a rule in the inbound table of the security group to deny the traffic from that CIDR range" is incorrect as you cannot create a deny rule with a security group.

INCORRECT: "Add a rule in the outbound table of the security group to deny the traffic from that CIDR range" is incorrect as you cannot create a deny rule with a security group.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 15Skipped

A company has a Production VPC and a Pre-Production VPC. The Production VPC uses VPNs through a customer gateway to connect to a single device in an on-premises data center. The Pre-Production VPC uses a virtual private gateway attached to two AWS Direct Connect (DX) connections. Both VPCs are connected using a single VPC peering connection.

How can a Solutions Architect improve this architecture to remove any single point of failure?

Add a set of VPNs between the Production and Pre-Production VPCs.

Correct answer

Add additional VPNs to the Production VPC from a second customer gateway device.

Add a second virtual private gateway and attach it to the Production VPC.

Add an additional VPC peering connection between the two VPCs.

Overall explanation

The only single point of failure in this architecture is the customer gateway device in the on-premises data center. A customer gateway device is the on-premises (client) side of the connection into the VPC. The customer gateway configuration is created within AWS, but the actual device is a physical or virtual device running in the on-premises data center. If this device is a single device, then if it fails the VPN connections will fail. The AWS side of the VPN link is the virtual private gateway, and this is a redundant device.

CORRECT: "Add additional VPNs to the Production VPC from a second customer gateway device" is the correct answer.

INCORRECT: "Add an additional VPC peering connection between the two VPCs" is incorrect. VPC peering connections are already redundant, you do not need multiple connections.

INCORRECT: "Add a set of VPNs between the Production and Pre-Production VPCs" is incorrect. You cannot create VPN connections between VPCs (using AWS VPNs).

INCORRECT: "Add a second virtual private gateway and attach it to the Production VPC" is incorrect. Virtual private gateways (VGWs) are redundant devices so a second one is not necessary.

References:

https://docs.aws.amazon.com/vpn/latest/s2svpn/your-cgw.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 16Skipped

A research institute uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to run machine learning workloads. The institute must ensure that Kubernetes service accounts within the EKS cluster have secure, fine-grained access to specific AWS resources for model training and data processing. The solution must use IAM roles for service accounts (IRSA) to meet these requirements.

Which combination of solutions will meet these requirements? (Select TWO.)

Implement pod security policies in the EKS cluster to restrict pods from accessing unauthorized AWS resources.

Correct selection

Configure a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider associated with the EKS cluster.

Correct selection

Define an IAM role that includes the required permissions. Annotate the Kubernetes service accounts with the Amazon Resource Name (ARN) of the IAM role.

Create an IAM policy that defines the necessary permissions for AWS resources. Attach the policy directly to the IAM role of the EKS worker nodes.

Modify the EKS cluster's worker node IAM role to include permissions for Kubernetes service accounts. Ensure all service accounts map to a single IAM role.

Overall explanation

Define an IAM role that includes the required permissions. Annotate the Kubernetes service accounts with the Amazon Resource Name (ARN) of the IAM role: This is correct because IRSA enables Kubernetes service accounts to securely assume IAM roles with the necessary permissions for accessing specific AWS resources.

Configure a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider associated with the EKS cluster: This is correct because OIDC integration is required for IRSA to allow the EKS service accounts to assume the associated IAM roles securely.

Create an IAM policy that defines the necessary permissions for AWS resources. Attach the policy directly to the IAM role of the EKS worker nodes: This is incorrect because attaching the policy to the worker node role gives broad permissions to all pods running on those nodes, violating the principle of least privilege.

Implement pod security policies in the EKS cluster to restrict pods from accessing unauthorized AWS resources: This is incorrect because pod security policies manage pod-level security but do not directly control access to AWS resources via IAM.

Modify the EKS cluster's worker node IAM role to include permissions for Kubernetes service accounts. Ensure all service accounts map to a single IAM role: This is incorrect because mapping all service accounts to a single IAM role does not provide the granularity required for secure access.

References:
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 17Skipped

A company’s staff connect from home office locations to administer applications using bastion hosts in a single AWS Region. The company requires a resilient bastion host architecture that requires minimal ongoing operational overhead.

How can a Solutions Architect best meet these requirements?

Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple AWS Regions.

Correct answer

Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple Availability Zones.

Create a Network Load Balancer backed by the existing servers in different Availability Zones.

Create a Network Load Balancer backed by Reserved Instances in a cluster placement group.

Overall explanation

Bastion hosts (aka “jump hosts”) are EC2 instances in public subnets that administrators and operations staff can connect to from the internet. From the bastion host they are then able to connect to other instances and applications within AWS by using internal routing within the VPC.

All answers use a Network Load Balancer which is acceptable for forwarding incoming connections to targets. The differences are in where the connections are forwarded to. The best option is to create an Auto Scaling group with EC2 instances in multiple Availability Zones. This creates a resilient architecture within a single AWS Region which is exactly what the question asks for.

CORRECT: "Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple Availability Zones" is the correct answer.

INCORRECT: "Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple AWS Regions" is incorrect. You cannot have instances in an ASG across multiple Regions and you can’t have an NLB distribute connections across multiple Regions.

INCORRECT: "Create a Network Load Balancer backed by Reserved Instances in a cluster placement group" is incorrect. A cluster placement group packs instances close together inside an Availability Zone. This strategy enables workloads to achieve the low-latency network performance necessary for tightly coupled node-to-node communication that is typical of HPC applications.

INCORRECT: "Create a Network Load Balancer backed by the existing servers in different Availability Zones" is incorrect. An Auto Scaling group is required to maintain instances in different AZs for resilience.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/auto-scaling-benefits.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 18Skipped

An educational content provider has accumulated several terabytes of learning resources in an Amazon S3 bucket located in a specific AWS Region. A partner organization, based in a different AWS Region, has been granted access to the S3 bucket to retrieve the resources for integration into its own platform. The content provider wants to minimize its data transfer costs when the partner organization accesses the S3 bucket.

Which solution will meet these requirements?

Use S3 Transfer Acceleration to allow the partner organization to retrieve data from the bucket.

Configure the bucket to use S3 Standard-IA storage to reduce access costs for the partner organization.

Set up S3 Cross-Region Replication (CRR) to copy the learning resources to the partner organization’s S3 bucket.

Correct answer

Enable the Requester Pays feature on the content provider’s S3 bucket.

Overall explanation

Enable the Requester Pays feature on the content provider’s S3 bucket: This is correct because the Requester Pays feature shifts the data transfer costs from the content provider to the partner organization, thereby minimizing the content provider’s expenses.

Use S3 Transfer Acceleration to allow the partner organization to retrieve data from the bucket: This solution optimizes data transfer speeds but does not specifically address minimizing the content provider's data transfer costs.

Set up S3 Cross-Region Replication (CRR) to copy the learning resources to the partner organization’s S3 bucket: While this enables data availability in the partner organization’s Region, it introduces additional costs for cross-Region replication, which the content provider would incur.

Configure the bucket to use S3 Standard-IA storage to reduce access costs for the partner organization: Changing the storage class to Standard-IA focuses on storage cost optimization and does not directly address minimizing data transfer costs for the content provider.

References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/RequesterPaysBuckets.html
https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 19Skipped

An Architect needs to find a way to automatically and repeatably create many member accounts within an AWS Organization. The accounts also need to be moved into an OU and have VPCs and subnets created.

What is the best way to achieve this?

Use the AWS CLI

Use the AWS Management Console

Correct answer

Use CloudFormation with scripts

Use the AWS Organizations API

Overall explanation

The best solution is to use a combination of scripts and AWS CloudFormation. You will also leverage the AWS Organizations API. This solution can provide all of the requirements.

CORRECT: "Use CloudFormation with scripts" is the correct answer.

INCORRECT: "Use the AWS Organizations API" is incorrect. You can create member accounts with the AWS Organizations API. However, you cannot use that API to configure the account and create VPCs and subnets.

INCORRECT: "Use the AWS Management Console" is incorrect. Using the AWS Management Console is not a method of automatically creating the resources.

INCORRECT: "Use the AWS CLI" is incorrect. You can do all tasks using the AWS CLI but it is better to automate the process using AWS CloudFormation.

References:

https://aws.amazon.com/blogs/security/how-to-use-aws-organizations-to-automate-end-to-end-account-creation/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-organizations/

Domain

AWS Management & Governance

Question 20Skipped

A research organization runs its photo analysis application on AWS. The application processes images uploaded by field scientists and stores them temporarily on an Amazon EC2 instance's locally attached Amazon Elastic Block Store (Amazon EBS) volume. Every evening, the processed images are uploaded to an Amazon S3 bucket for long-term storage.

The solutions architect has discovered that the images are being uploaded to S3 through the public internet. The organization wants to ensure that the upload traffic to Amazon S3 remains private and does not use the public internet.

Which solution will meet these requirements?

Use an Amazon S3 access point for the EC2 instance. Configure the photo analysis application to upload files to the bucket through the access point.

Correct answer

Create a gateway VPC endpoint for the S3 bucket. Update the VPC's route table to route all S3 traffic through the gateway endpoint.

Deploy a NAT gateway in the VPC. Configure the EC2 instance's security group to allow outbound traffic to the NAT gateway, which will route traffic to the S3 bucket.

Configure a VPC peering connection between the VPC containing the EC2 instance and Amazon S3. Update the route table to use the peering connection for traffic to S3.

Overall explanation

Create a gateway VPC endpoint for the S3 bucket. Update the VPC's route table to route all S3 traffic through the gateway endpoint: This is correct because a gateway VPC endpoint establishes a private connection to Amazon S3 without using the public internet. Updating the route table ensures all traffic to S3 is routed through this private endpoint. This solution is secure and cost-effective.
Use an Amazon S3 access point for the EC2 instance. Configure the photo analysis application to upload files to the bucket through the access point: This is incorrect because while S3 access points simplify access management for specific applications, they do not provide private connectivity. A gateway VPC endpoint is required to route traffic privately.
Configure a VPC peering connection between the VPC containing the EC2 instance and Amazon S3. Update the route table to use the peering connection for traffic to S3: This is incorrect because VPC peering does not provide connectivity to AWS services like Amazon S3. Gateway VPC endpoints are the correct mechanism for private S3 connectivity.
Deploy a NAT gateway in the VPC. Configure the EC2 instance's security group to allow outbound traffic to the NAT gateway, which will route traffic to the S3 bucket: This is incorrect because a NAT gateway routes traffic to the internet, and S3 traffic would still use public endpoints. This does not meet the requirement of avoiding the public internet.

References:
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html
https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 21Skipped

A media streaming company stores user activity logs in an Amazon S3 bucket. The logs are accessed frequently for real-time analytics and reporting. The company enforces strict encryption requirements for data stored in S3 and currently uses AWS Key Management Service (AWS KMS) for encryption.

The company wants to reduce costs related to encrypting objects in the S3 bucket while maintaining compliance with its encryption requirements and minimizing the number of AWS KMS calls.

Which solution will meet these requirements?

Correct answer

Enable S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the objects to reduce the cost of KMS requests.

Use server-side encryption with Amazon S3 managed keys (SSE-S3) to eliminate AWS KMS usage.

Use server-side encryption with customer-provided encryption keys (SSE-C) and store the keys in AWS Secrets Manager.

Use client-side encryption with AWS KMS customer-managed keys to encrypt the data before uploading it to S3.

Overall explanation

Enable S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the objects to reduce the cost of KMS requests: This is correct because enabling S3 Bucket Key reduces the number of AWS KMS calls required for object encryption. S3 Bucket Key caches the encryption keys at the bucket level, significantly lowering the cost of encryption for frequently accessed objects while meeting encryption requirements.

Use server-side encryption with Amazon S3 managed keys (SSE-S3) to eliminate AWS KMS usage: This is incorrect because SSE-S3 does not use AWS KMS, but it does not meet the strict encryption requirements specified by the company, which mandate the use of AWS KMS.

Use client-side encryption with AWS KMS customer-managed keys to encrypt the data before uploading it to S3: This is incorrect because client-side encryption increases operational complexity and does not optimize costs associated with AWS KMS calls.

Use server-side encryption with customer-provided encryption keys (SSE-C) and store the keys in AWS Secrets Manager: This is incorrect because SSE-C requires the company to manage its own encryption keys, introducing operational overhead. Additionally, this approach does not optimize costs related to AWS KMS.

References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html
https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-kms/

Domain

AWS Security, Identity, & Compliance

Question 22Skipped

An application consists of a web tier in a public subnet and a MySQL cluster hosted on Amazon EC2 instances in a private subnet. The MySQL instances must retrieve product data from a third-party provider over the internet. A Solutions Architect must determine a strategy to enable this access with maximum security and minimum operational overhead.

What should the Solutions Architect do to meet these requirements?

Create a virtual private gateway and attach it to the VPC. Modify the private subnet route table to direct internet traffic to the virtual private gateway.

Deploy a NAT instance in the private subnet. Direct all internet traffic to the NAT instance.

Correct answer

Deploy a NAT gateway in the public subnet. Modify the route table in the private subnet to direct all internet traffic to the NAT gateway.

Create an internet gateway and attach it to the VPC. Modify the private subnet route table to direct internet traffic to the internet gateway.

Overall explanation

The MySQL clusters instances need to access a service on the internet. The most secure method of enabling this access with low operational overhead is to create a NAT gateway. When deploying a NAT gateway, the gateway itself should be deployed in a public subnet whilst the route table in the private subnet must be updated to point traffic to the NAT gateway ID.

The configuration can be seen in the diagram below:

CORRECT: "Deploy a NAT gateway in the public subnet. Modify the route table in the private subnet to direct all internet traffic to the NAT gateway" is the correct answer.

INCORRECT: "Deploy a NAT instance in the private subnet. Direct all internet traffic to the NAT instance" is incorrect. NAT instances require more operational overhead and need to be deployed in a public subnet.

INCORRECT: "Create an internet gateway and attach it to the VPC. Modify the private subnet route table to direct internet traffic to the internet gateway" is incorrect. You cannot point the instances in the private subnet to an internet gateway as they do not have public IP addresses which is required to use an internet gateway.

INCORRECT: "Create a virtual private gateway and attach it to the VPC. Modify the private subnet route table to direct internet traffic to the virtual private gateway" is incorrect. A virtual private gateway (VGW) is used with a VPN connection, not for connecting instances in private subnets to the internet.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 23Skipped

An online education company is launching a new e-learning platform on AWS. The platform will run on Amazon EC2 instances deployed across multiple Availability Zones in multiple AWS Regions. Students worldwide will access the platform through the internet to stream educational content. The company wants to ensure that each student is directed to the EC2 instances in the Region that is geographically closest to their location. The solution must provide high availability and efficient traffic routing.

Which solution will meet these requirements?

Correct answer

Use Amazon Route 53 latency routing policy to direct students to the Region with the lowest network latency. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Region.

Use Amazon Route 53 geoproximity routing policy to route students to the geographically closest Region. Configure an internet-facing Network Load Balancer to distribute traffic across the EC2 instances within each Availability Zone.

Use Amazon Route 53 geolocation routing policy to direct students to the closest Region. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Region.

Use Amazon Route 53 weighted routing policy to balance traffic across Regions. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Availability Zone.

Overall explanation

Use Amazon Route 53 latency routing policy to direct students to the Region with the lowest network latency. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Region: This is correct because the latency routing policy dynamically routes users to the Region with the lowest latency. The Application Load Balancer ensures traffic is evenly distributed across all EC2 instances within the Region.

Use Amazon Route 53 geolocation routing policy to direct students to the closest Region. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Region: This is incorrect because the geolocation routing policy routes users based on their geographic location, which may not always align with the Region with the lowest latency. For example, users in a region geographically close to a Region with high latency may not experience the best performance.

Use Amazon Route 53 geoproximity routing policy to route students to the geographically closest Region. Configure an internet-facing Network Load Balancer to distribute traffic across the EC2 instances within each Availability Zone: This is incorrect because while geoproximity routing directs users based on proximity, it requires manual adjustments for bias, which increases operational complexity. Additionally, a Network Load Balancer is less suitable for HTTP/HTTPS workloads compared to an Application Load Balancer.

Use Amazon Route 53 weighted routing policy to balance traffic across Regions. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Availability Zone: This is incorrect because a weighted routing policy does not guarantee that users are directed to the closest Region or the one with the lowest latency.

References:
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html
https://aws.amazon.com/elasticloadbalancing/application-load-balancer/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-route-53/

Domain

AWS Networking & Content Delivery

Question 24Skipped

A company recently performed a lift and shift migration of its on-premises Oracle database workload to run on an Amazon EC2 memory-optimized Linux instance. The EC2 Linux instance uses a 1 TB Provisioned IOPS SSD (io1) EBS volume with 64,000 IOPS. The database storage performance after the migration is slower than the performance of the on-premises database.

Which solution will improve storage performance?

Correct answer

Add more Provisioned IOPS SSD (io1) EBS volumes. Use OS commands to create a Logical Volume Management (LVM) stripe.

Change the EC2 Linux instance to a storage-optimized instance type. Do not change the Provisioned IOPS SSD (io1) EBS volume.

Increase the size of the Provisioned IOPS SSD (io1) EBS volume to 2 TB.

Increase the Provisioned IOPS SSD (io1) EBS volume to more than 64,000 IOPS.

Overall explanation

Add more Provisioned IOPS SSD (io1) EBS volumes. Use OS commands to create a Logical Volume Management (LVM) stripe: This is correct because creating a striped volume using multiple io1 EBS volumes allows you to aggregate performance and exceed the performance limits of a single volume, resulting in better storage performance.

Increase the Provisioned IOPS SSD (io1) EBS volume to more than 64,000 IOPS: This is incorrect because 64,000 IOPS is the maximum performance for a single io1 volume attached to an EC2 instance. Increasing the IOPS would not be effective.

Increase the size of the Provisioned IOPS SSD (io1) EBS volume to 2 TB: This is incorrect because the volume size does not directly affect the IOPS beyond the already configured value of 64,000 IOPS.

Change the EC2 Linux instance to a storage-optimized instance type. Do not change the Provisioned IOPS SSD (io1) EBS volume: This is incorrect because changing the instance type does not address the bottleneck at the EBS volume level.

References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ebs/

Domain

AWS Storage

Question 25Skipped

A company is deploying a solution for sharing media files around the world using Amazon CloudFront with an Amazon S3 origin configured as a static website. The company requires that all traffic for the website must be inspected by AWS WAF.

Which solution meets these requirements?

Create an S3 bucket policy with a condition that only allows requests that originate from AWS WAF.

Use an Amazon Route 53 Alias record to forward traffic for the website to AWS WAF. Configure AWS WAF to inspect traffic and attach the CloudFront distribution.

Create a Network ACL that limits access to the S3 bucket to the CloudFront IP addresses. Attach a WebACL to the CloudFront distribution.

Correct answer

Deploy CloudFront with an S3 origin and configure an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the CloudFront distribution.

Overall explanation

The AWS Web Application Firewall (WAF) can be attached to an Amazon CloudFront distribution to enable protection from web exploits. In this case the distribution uses an S3 origin, and the question is stating that all traffic must be inspected by AWS WAF. This means we need to ensure that requests cannot circumvent AWS WAF and hit the S3 bucket directly.

This can be achieved by configuring an origin access identity (OAI) which is a special type of CloudFront user that is created within the distribution and configured in an S3 bucket policy. The policy will only allow requests that come from the OAI which means all requests must come via the distribution and cannot hit S3 directly.

CORRECT: "Deploy CloudFront with an S3 origin and configure an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the CloudFront distribution" is the correct answer.

INCORRECT: "Create a Network ACL that limits access to the S3 bucket to the CloudFront IP addresses. Attach a WebACL to the CloudFront distribution" is incorrect. Network ACLs restrict traffic in/out of subnets but S3 is a public service.

INCORRECT: "Use an Amazon Route 53 Alias record to forward traffic for the website to AWS WAF. Configure AWS WAF to inspect traffic and attach the CloudFront distribution" is incorrect. You cannot direct traffic to AWS WAF using an Alias record.

INCORRECT: "Create an S3 bucket policy with a condition that only allows requests that originate from AWS WAF" is incorrect. This cannot be done. Instead use an OAI in the bucket policy.

References:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 26Skipped

A Solutions Architect created the following policy and associated to an AWS IAM group containing several administrative users:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": "ec2:TerminateInstances",

"Resource": "*",

"Condition": {

"IpAddress": {

"aws:SourceIp": "10.1.2.0/24"

}

}

},

{

"Effect": "Deny",

"Action": "ec2:*",

"Resource": "*",

"Condition": {

"StringNotEquals": {

"ec2:Region": "us-east-1"

}

}

}

]

}

What is the effect of this policy?

Correct answer

Administrators can terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.1.2.28.

Administrators can terminate an EC2 instance in any AWS Region except us-east-1.

Administrators cannot terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.1.2.28.

Administrators can terminate an EC2 instance with the IP address 10.1.2.5 in the us-east-1 Region.

Overall explanation

The Condition element (or Condition block) lets you specify conditions for when a policy is in effect. The Condition element is optional. In the Condition element, you build expressions in which you use condition operators (equal, less than, etc.) to match the condition keys and values in the policy against keys and values in the request context.

In this policy statement the first block allows the "ec2:TerminateInstances" API action only if the IP address of the requester is within the "10.1.2.0/24" range. This is specified using the "aws:SourceIp" condition.

The second block denies all EC2 API actions with a conditional operator (StringNotEquals) that checks the Region the request is being made in ("ec2:Region"). If the Region is any value other than us-east-1 the request will be denied. If the Region the request is being made in is us-east-1 the request will not be denied.

CORRECT: "Administrators can terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.1.2.28" is the correct answer.

INCORRECT: "Administrators cannot terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.1.2.28" is incorrect. This is not true; the conditions allow this action.

INCORRECT: "Administrators can terminate an EC2 instance in any AWS Region except us-east-1" is incorrect. The API action to terminate instances only has a condition of the source IP. If the source IP is in the range it will allow. The second block only denies API actions if the Region is NOT us-east-1. Therefore, the user can terminate instances in us-east-1

INCORRECT: "Administrators can terminate an EC2 instance with the IP address 10.1.2.5 in the us-east-1 Region" is incorrect. The aws:SourceIp condition is checking the IP address of the requester (where you’re making the call from), not the resource you want to terminate.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 27Skipped

A financial services company manages its web application on Amazon EC2 instances. The EC2 instances are registered in an IP address-type target group behind an Application Load Balancer (ALB). The company uses AWS Systems Manager for patching and routine maintenance of the instances.

To meet security compliance requirements, the company must ensure that EC2 instances are temporarily removed from service during patching to prevent serving traffic. During a recent patching attempt, the company experienced application errors and traffic disruptions.

Which combination of solutions will resolve these issues? (Select TWO.)

Correct selection

Use the Systems Manager Maintenance Windows feature to schedule patching and automatically deregister instances from the ALB during updates.

Use Systems Manager State Manager to schedule patching jobs and ensure instances are deregistered and re-registered with the ALB after patching is complete.

Correct selection

Implement the AWSEC2-PatchLoadBalancerInstance Systems Manager Automation document to manage the patching process for EC2 instances behind the ALB.

Configure ALB health checks to automatically remove unhealthy instances during patching. Use Systems Manager Run Command to apply the patches manually.

Change the target type of the target group from IP address type to instance type and re-register the instances.

Overall explanation

Use the Systems Manager Maintenance Windows feature to schedule patching and automatically deregister instances from the ALB during updates: This is correct because Maintenance Windows coordinate the patching process, including removing instances from the ALB during updates, ensuring compliance and preventing traffic disruptions.

Implement the AWSEC2-PatchLoadBalancerInstance Systems Manager Automation document to manage the patching process for EC2 instances behind the ALB: This is correct because this Automation document automates the removal of instances from the ALB, applies patches, and re-registers the instances after patching. This eliminates manual errors and ensures seamless updates without disrupting application traffic.

Change the target type of the target group from IP address type to instance type and re-register the instances: This is incorrect because changing the target type does not address the root cause of the errors. The patching process itself requires proper management of instance removal and re-registration.

Configure ALB health checks to automatically remove unhealthy instances during patching. Use Systems Manager Run Command to apply the patches manually: This is incorrect because relying on ALB health checks for patching introduces unnecessary delays. Manually applying patches with Run Command is operationally inefficient compared to using Automation documents.

Use Systems Manager State Manager to schedule patching jobs and ensure instances are deregistered and re-registered with the ALB after patching is complete: This is incorrect because State Manager is not designed to dynamically handle instance deregistration and re-registration with load balancers. Automation documents like AWSEC2-PatchLoadBalancerInstance are more appropriate.

References:
https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-awsec2-patch-load-balancer-instance.html
https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-maintenance.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

Domain

AWS Management & Governance

Question 28Skipped

A company manages several applications that run in different AWS accounts within an AWS Organizations setup. The company has outsourced the management of certain applications to external contractors. The contractors require secure access to the AWS Management Console and operating system access to Amazon Linux-based Amazon EC2 instances in private subnets for troubleshooting. The company must ensure all activities are logged and minimize the risk of unauthorized access.

Which solution will meet these requirements MOST securely?

Configure a bastion host in a public subnet. Restrict SSH access to the bastion host by using security groups to allow connections only from the contractors' IP address ranges. Provide contractors with IAM user credentials for Management Console access and SSH key pairs for accessing private instances via the bastion host.

Set up AWS VPN or Direct Connect to create a private network connection to the contractors’ office. Allow access to the AWS Management Console by creating IAM user credentials in each AWS account. Use security groups to allow SSH access from the contractors' office to the private EC2 instances.

Use AWS Systems Manager Agent (SSM Agent) with an attached instance profile to manage EC2 access. Provide contractors with temporary local IAM user credentials in each AWS account for console access. Require contractors to use Systems Manager Session Manager for instance access.

Correct answer

Deploy AWS Systems Manager Agent (SSM Agent) to all instances. Assign an instance profile to the instances with the required Systems Manager policies. Grant contractors access to the AWS Management Console by configuring permission sets in AWS IAM Identity Center. Use Systems Manager Session Manager for secure instance access without requiring open network ports.

Overall explanation

Deploy AWS Systems Manager Agent (SSM Agent) to all instances. Assign an instance profile to the instances with the required Systems Manager policies. Grant contractors access to the AWS Management Console by configuring permission sets in AWS IAM Identity Center. Use Systems Manager Session Manager for secure instance access without requiring open network ports:

This is correct because Systems Manager Session Manager provides secure, auditable access to instances without requiring SSH keys or open ports. IAM Identity Center enables centralized management of console access for contractors.

Configure a bastion host in a public subnet. Restrict SSH access to the bastion host by using security groups to allow connections only from the contractors' IP address ranges. Provide contractors with IAM user credentials for Management Console access and SSH key pairs for accessing private instances via the bastion host:

This is incorrect because it increases operational overhead and requires managing SSH key pairs while leaving an exposed attack surface with the bastion host.

Use AWS Systems Manager Agent (SSM Agent) with an attached instance profile to manage EC2 access. Provide contractors with temporary local IAM user credentials in each AWS account for console access. Require contractors to use Systems Manager Session Manager for instance access:

This is incorrect because creating local IAM users for console access increases the risk of credential management issues and does not align with centralized access management best practices.

Set up AWS VPN or Direct Connect to create a private network connection to the contractors’ office. Allow access to the AWS Management Console by creating IAM user credentials in each AWS account. Use security groups to allow SSH access from the contractors' office to the private EC2 instances:

This is incorrect because using VPN or Direct Connect introduces unnecessary complexity and cost. SSH access also increases the risk of mismanagement and security vulnerabilities.

References:
https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html
https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-systems-manager/

Domain

AWS Management & Governance

Question 29Skipped

A government agency is moving its document management system to AWS. The application will store classified documents in Amazon S3. The agency must encrypt the documents before storing them in S3 to ensure compliance with strict data security regulations.

Which solution will meet these requirements?

Encrypt the documents by using server-side encryption with customer-provided keys (SSE-C).

Encrypt the documents by using server-side encryption with AWS KMS keys (SSE-KMS) configured with custom key policies for access control.

Correct answer

Encrypt the documents by using client-side encryption with customer managed keys and upload the encrypted files to S3.

Encrypt the documents by using client-side encryption with Amazon S3 managed keys and upload the encrypted files to S3.

Overall explanation

Encrypt the documents by using client-side encryption with Amazon S3 managed keys and upload the encrypted files to S3:

This is correct because client-side encryption means the data is encrypted before it ever leaves the client system, giving maximum control over the encryption process. Using customer managed keys (CMKs) from AWS Key Management Service (KMS), the agency retains full ownership and control over key policies, rotation, and access, which is often a requirement for handling classified or sensitive government data. This approach ensures compliance with strict regulations by minimizing trust in the cloud provider to protect unencrypted data.

Encrypt the documents by using server-side encryption with AWS KMS keys (SSE-KMS) configured with custom key policies for access control: This is incorrect because while secure and easy to manage, SSE-KMS means AWS handles the encryption after data reaches S3

Encrypt the documents by using client-side encryption with customer managed keys and upload the encrypted files to S3: This is incorrect because while client-side encryption can ensure security before data reaches S3, it increases operational complexity since the customer must manage key creation, storage, and rotation independently.

Encrypt the documents by using server-side encryption with customer-provided keys (SSE-C): This is incorrect because SSE-C requires the customer to provide the encryption keys for every S3 operation, which can increase operational overhead and risks if key management is not handled correctly.

References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingEncryption.html
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-kms/

Domain

AWS Security, Identity, & Compliance

Question 30Skipped

A company runs its critical payment processing application on an Amazon Aurora MySQL cluster in the ap-southeast-1 Region. As part of its disaster recovery (DR) strategy, the company has selected the ap-northeast-1 Region for failover capabilities.

The company requires a recovery point objective (RPO) of less than 5 minutes and a recovery time objective (RTO) of no more than 15 minutes. The company also wants to minimize operational overhead and ensure failover happens with minimal downtime and configuration.

Which solution will meet these requirements with the MOST operational efficiency?

Create a new Aurora MySQL cluster in ap-northeast-1 and use AWS Database Migration Service (AWS DMS) to replicate data between clusters.

Use Amazon S3 Cross-Region Replication to replicate database backups from ap-southeast-1 to ap-northeast-1. Restore the backups to a new Aurora cluster during failover.

Create an Aurora read replica in ap-northeast-1 to replicate data from the primary Aurora cluster. Promote the read replica manually in the event of a failover.

Correct answer

Convert the Aurora cluster to an Aurora global database. Configure cross-Region replication and managed failover.

Overall explanation

Convert the Aurora cluster to an Aurora global database. Configure cross-Region replication and managed failover: This is correct because Aurora global databases are purpose-built for disaster recovery and can achieve an RPO of under 5 seconds with automated failover, meeting the company’s stringent RPO and RTO requirements.

Create an Aurora read replica in ap-northeast-1 to replicate data from the primary Aurora cluster. Promote the read replica manually in the event of a failover: While this approach provides DR capabilities, it involves manual intervention during failover, which increases downtime and operational complexity, making it less efficient for meeting the RTO goal.

Create a new Aurora MySQL cluster in ap-northeast-1 and use AWS Database Migration Service (AWS DMS) to replicate data between clusters: AWS DMS is not ideal for low-latency replication of high-throughput transactional databases, and it does not natively provide automated failover capabilities.

Use Amazon S3 Cross-Region Replication to replicate database backups from ap-southeast-1 to ap-northeast-1. Restore the backups to a new Aurora cluster during failover: Restoring backups to create a new Aurora cluster involves significant downtime and is not suitable for the given RPO and RTO requirements.

References:
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html
https://aws.amazon.com/rds/aurora/global-database/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 31Skipped

A company needs to migrate a large quantity of data from an on-premises environment to Amazon S3. The company is connected via an AWS Direct Connect (DX) connection. The company requires a fully managed solution that will keep the data private and automate and accelerate the replication of the data to AWS storage services.

Which solution should a Solutions Architect recommend?

Deploy an AWS DataSync agent for the on-premises environment. Configure a task to replicate the data and connect it to a public endpoint.

Correct answer

Deploy an AWS DataSync agent for the on-premises environment. Configure a task to replicate the data and connect it to a VPC endpoint.

Deploy an AWS Storage Gateway file gateway with a local cache and store the primary data set in Amazon S3.

Deploy an AWS Storage Gateway volume gateway in stored volume mode and take point-in-time copies of the volumes using AWS Backup.

Overall explanation

AWS DataSync can be used to automate and accelerate the replication of data to AWS storage services. Note that Storage Gateway is used for hybrid scenarios where servers need local access to data with various options for storing and synchronizing the data to AWS storage services. Storage Gateway does not accelerate replication of data.

To deploy DataSync an agent must be installed. Then a task must be configured to replicated data to AWS. The task requires a connection to a service endpoint. To keep the data private and send it across the DX connection, a VPC endpoint should be used.

CORRECT: "Deploy an AWS DataSync agent for the on-premises environment. Configure a task to replicate the data and connect it to a VPC endpoint" is the correct answer.

INCORRECT: "Deploy an AWS DataSync agent for the on-premises environment. Configure a task to replicate the data and connect it to a public endpoint" is incorrect. A public endpoint will send data over the public internet which should be avoided in this scenario.

INCORRECT: "Deploy an AWS Storage Gateway volume gateway in stored volume mode and take point-in-time copies of the volumes using AWS Backup" is incorrect. Storage Gateway will not accelerate replication and a volume gateway will create EBS snapshots (not S3 objects).

INCORRECT: "Deploy an AWS Storage Gateway file gateway with a local cache and store the primary data set in Amazon S3" is incorrect. Storage Gateway will not accelerate replication and a file gateway should be used for providing NFS or CIFS/SMB access to data locally which is not required.

References:

https://docs.aws.amazon.com/datasync/latest/userguide/choose-service-endpoint.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Storage

Question 32Skipped

A shared services VPC is being setup for use by several AWS accounts. An application needs to be securely shared from the shared services VPC. The solution should not allow consumers to connect to other instances in the VPC.

How can this be setup with the least administrative effort? (Select TWO.)

Correct selection

Use AWS PrivateLink to expose the application as an endpoint service

Setup VPC peering between each AWS VPC

Configure security groups to restrict access

Use AWS ClassicLink to expose the application as an endpoint service

Correct selection

Create a Network Load Balancer (NLB)

Overall explanation

VPCs can be shared among multiple AWS accounts. Resources can then be shared amongst those accounts. However, to restrict access so that consumers cannot connect to other instances in the VPC the best solution is to use PrivateLink to create an endpoint for the application. The endpoint type will be an interface endpoint and it uses an NLB in the shared services VPC.

CORRECT: "Create a Network Load Balancer (NLB)" is a correct answer.

CORRECT: "Use AWS PrivateLink to expose the application as an endpoint service" is also a correct answer.

INCORRECT: "Use AWS ClassicLink to expose the application as an endpoint service" is incorrect. ClassicLink allows you to link EC2-Classic instances to a VPC in your account, within the same region. This solution does not include EC2-Classic which is now deprecated (replaced by VPC).

INCORRECT: "Setup VPC peering between each AWS VPC" is incorrect. VPC peering could be used along with security groups to restrict access to the application and other instances in the VPC. However, this would be administratively difficult as you would need to ensure that you maintain the security groups as resources and addresses change.

INCORRECT: "Configure security groups to restrict access" is incorrect. This could be used in conjunction with VPC peering but better method is to use PrivateLink for this use case.

References:

https://aws.amazon.com/about-aws/whats-new/2018/12/amazon-virtual-private-clouds-can-now-be-shared-with-other-aws-accounts/

https://aws.amazon.com/blogs/networking-and-content-delivery/vpc-sharing-a-new-approach-to-multiple-accounts-and-vpc-management/

https://d1.awsstatic.com/whitepapers/aws-privatelink.pdf

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Networking & Content Delivery

Question 33Skipped

A company wants to use Amazon Elastic Container Service (Amazon ECS) to run its containerized application in a hybrid environment. The company needs to ensure that the application can scale across both on-premises and AWS environments. It also requires a load balancer to handle HTTP traffic for the new containers that will run in the AWS Cloud.

Which combination of actions will meet these requirements? (Select TWO.)

Set up a Network Load Balancer for cloud ECS services.

Correct selection

Set up an Application Load Balancer for cloud ECS services.

Correct selection

Set up an ECS cluster that uses the AWS Fargate launch type for the cloud application containers. Use an Amazon ECS Anywhere external launch type for the on-premises application containers.

Set up an ECS cluster that uses the Amazon EC2 launch type for the cloud application containers. Use Amazon ECS Anywhere with an AWS Fargate launch type for the on-premises application containers.

Set up an ECS cluster that uses the AWS Fargate launch type. Use Fargate for the cloud application containers and the on-premises application containers.

Overall explanation

Set up an ECS cluster that uses the AWS Fargate launch type for the cloud application containers. Use an Amazon ECS Anywhere external launch type for the on-premises application containers: This meets the requirement of a hybrid environment by running containers in AWS Fargate for cloud workloads and Amazon ECS Anywhere for on-premises workloads. ECS Anywhere enables on-premises servers to join ECS clusters.

Set up an Application Load Balancer for cloud ECS services: This is the appropriate load balancer for handling HTTP traffic, ensuring proper routing and scalability for the cloud-based application containers.

Set up a Network Load Balancer for cloud ECS services: This is incorrect because a Network Load Balancer is primarily used for TCP or UDP traffic, not HTTP traffic.

Set up an ECS cluster that uses the AWS Fargate launch type. Use Fargate for the cloud application containers and the on-premises application containers: This is incorrect because Fargate cannot be used to run containers in an on-premises environment.

Set up an ECS cluster that uses the Amazon EC2 launch type for the cloud application containers. Use Amazon ECS Anywhere with an AWS Fargate launch type for the on-premises application containers: This is incorrect because ECS Anywhere uses external instances, not AWS Fargate, for on-premises environments.

References:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/what-is-ecs.html
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-anywhere.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 34Skipped

A solutions architect is designing a microservices architecture. AWS Lambda will store data in an Amazon DynamoDB table named Orders. The solutions architect needs to apply an IAM policy to the Lambda function’s execution role to allow it to put, update, and delete items in the Orders table. No other actions should be allowed.

Which of the following code snippets should be included in the IAM policy to fulfill this requirement whilst providing the LEAST privileged access?

Correct answer

"Sid": "PutUpdateDeleteOnOrders",

"Effect": "Allow",

"Action": [

"dynamodb:PutItem",

"dynamodb:UpdateItem",

"dynamodb:DeleteItem"

],

"Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/Orders"

"Sid": "PutUpdateDeleteOnOrders",

"Effect": "Allow",

"Action": "dynamodb:* ",

"Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/Orders"

"Sid": "PutUpdateDeleteOnOrders",

"Effect": "Allow",

"Action": [

"dynamodb:PutItem",

"dynamodb:UpdateItem",

"dynamodb:DeleteItem"

],

"Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/*"

"Sid": "PutUpdateDeleteOnOrders",

"Effect": "Deny",

"Action": "dynamodb:* ",

"Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/Orders"

Overall explanation

The key requirements are to allow the Lambda function the put, update, and delete actions on a single table. Using the principle of least privilege the answer should not allow any other access.

CORRECT: The following answer is correct:

"Sid": "PutUpdateDeleteOnOrders",

"Effect": "Allow",

"Action": [

"dynamodb:PutItem",

"dynamodb:UpdateItem",

"dynamodb:DeleteItem"

],

"Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/Orders"

This code snippet specifies the exact actions to allow and also specified the resource to apply those permissions to.

INCORRECT: the following answer is incorrect:

"Sid": "PutUpdateDeleteOnOrders",

"Effect": "Allow",

"Action": [

"dynamodb:PutItem",

"dynamodb:UpdateItem",

"dynamodb:DeleteItem"

],

"Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/*"

This code snippet specifies the correct list of actions but it provides a wildcard “*” instead of specifying the exact resource. Therefore, the function will be able to put, update, and delete items on any table in the account.

INCORRECT: the following answer is incorrect:

"Sid": "PutUpdateDeleteOnOrders",

"Effect": "Allow",

"Action": "dynamodb:* ",

"Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/Orders"

This code snippet allows any action on DynamoDB by using a wildcard “dynamodb:*”. This does not follow the principle of least privilege.

INCORRECT: the following answer is incorrect:

"Sid": "PutUpdateDeleteOnOrders",

"Effect": "Deny",

"Action": "dynamodb:* ",

"Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/Orders"

This code snippet denies any action on the table. This does not have the desired effect.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 35Skipped

A video editing company processes high-resolution footage for its clients. Each video file is several terabytes in size and needs to undergo intensive editing, such as applying filters and color grading, before delivery. Processing each video takes up to 25 minutes.

The company needs a solution that can scale to handle increased demand during peak periods while remaining cost-effective. The processed videos must be accessible for a minimum of 90 days.

Which solution will meet these requirements?

Correct answer

Use AWS Batch to orchestrate video editing jobs on Spot Instances. Store metadata in Amazon ElastiCache for Redis and processed video files in Amazon S3 Intelligent-Tiering.

Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate to run containerized video editing tasks. Store metadata in Amazon DynamoDB and processed video files in Amazon S3 Standard-IA for reduced costs.

Use an on-premises video processing server connected to AWS Storage Gateway to store and retrieve video files from Amazon S3. Use Amazon RDS for metadata and configure Storage Gateway for caching frequently accessed data.

Deploy Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). Use Amazon Simple Queue Service (Amazon SQS) to queue incoming video processing jobs. Store metadata in Amazon RDS, and store processed videos in Amazon S3 Glacier Flexible Retrieval for long-term storage.

Overall explanation

Use AWS Batch to orchestrate video editing jobs on Spot Instances. Store metadata in Amazon ElastiCache for Redis and processed video files in Amazon S3 Intelligent-Tiering: This is correct because AWS Batch handles batch processing workloads efficiently, and Spot Instances reduce compute costs. ElastiCache ensures low-latency metadata access during processing, and S3 Intelligent-Tiering reduces storage costs while keeping processed videos accessible.

Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate to run containerized video editing tasks. Store metadata in Amazon DynamoDB and processed video files in Amazon S3 Standard-IA for reduced costs: This is incorrect because while ECS with Fargate is scalable and serverless, AWS Batch is better suited for batch processing workloads like video editing.

Deploy Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). Use Amazon Simple Queue Service (Amazon SQS) to queue incoming video processing jobs. Store metadata in Amazon RDS, and store processed videos in Amazon S3 Glacier Flexible Retrieval for long-term storage: This is incorrect because S3 Glacier Flexible Retrieval is designed for archival data and is not suitable for videos that need to be accessed within 90 days. Additionally, managing EC2 instances increases operational overhead compared to serverless options.

Use an on-premises video processing server connected to AWS Storage Gateway to store and retrieve video files from Amazon S3. Use Amazon RDS for metadata and configure Storage Gateway for caching frequently accessed data: This is incorrect because managing on-premises infrastructure introduces significant complexity and overhead. AWS-native services like Batch provide a more scalable and cost-effective solution for this workload.

References:

https://aws.amazon.com/batch/

https://aws.amazon.com/s3/storage-classes/

Domain

AWS Compute

Question 36Skipped

A company runs a containerized application on an Amazon Elastic Kubernetes Service (EKS) using a microservices architecture. The company requires a solution to collect, aggregate, and summarize metrics and logs. The solution should provide a centralized dashboard for viewing information including CPU and memory utilization for EKS namespaces, services, and pods.

Which solution meets these requirements?

Migrate the containers to Amazon ECS and enable Amazon CloudWatch Container Insights. View the metrics and logs in the CloudWatch console.

Correct answer

Configure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console.

Run the Amazon CloudWatch agent in the existing EKS cluster. View the metrics and logs in the CloudWatch console.

Configure AWS X-Ray to enable tracing for the EKS microservices. Query the trace data using Amazon Elasticsearch.

Overall explanation

Use CloudWatch Container Insights to collect, aggregate, and summarize metrics and logs from your containerized applications and microservices. Container Insights is available for Amazon Elastic Container Service (Amazon ECS), Amazon Elastic Kubernetes Service (Amazon EKS), and Kubernetes platforms on Amazon EC2.

With Container Insights for EKS you can see the top contributors by memory or CPU, or the most recently active resources. This is available when you select any of the following dashboards in the drop-down box near the top of the page:

•  ECS Services

•  ECS Tasks

•  EKS Namespaces

•  EKS Services

•  EKS Pods

CORRECT: "Configure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console" is the correct answer.

INCORRECT: "Run the Amazon CloudWatch agent in the existing EKS cluster. View the metrics and logs in the CloudWatch console" is incorrect. Container Insights is the best way to view the required data.

INCORRECT: "Migrate the containers to Amazon ECS and enable Amazon CloudWatch Container Insights. View the metrics and logs in the CloudWatch console" is incorrect. There is no need to migrate containers to ECS as EKS is supported for Container Insights.

INCORRECT: "Configure AWS X-Ray to enable tracing for the EKS microservices. Query the trace data using Amazon Elasticsearch" is incorrect. X-Ray will not deliver the required statistics to a centralized dashboard.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ContainerInsights.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 37Skipped

A Solutions Architect working for a large financial institution is building an application to manage their customers financial information and their sensitive personal information. The Solutions Architect requires that the storage layer can store immutable data out of the box, with the ability to encrypt the data at rest and requires that the storage layer provides ACID properties. They also want to use a containerized solution to manage the compute layer.

Which solution will meet these requirements with the LEAST amount of operational overhead?

Create a cluster of ECS instances on AWS Fargate within an Auto Scaling Group behind an Application Load Balancer. To manage the storage layer, use Amazon S3.

Correct answer

Set up an ECS cluster behind an Application Load Balancer on AWS Fargate. Use Amazon Quantum Ledger Database (QLDB) to manage the storage layer.

Create an Auto Scaling Group with EC2 instances behind an Application Load Balancer. To manage the storage layer, use Amazon S3.

Configure an ECS cluster on EC2 behind an Application Load Balancer within an Auto Scaling Group. Store data using Amazon DynamoDB.

Overall explanation

The solution requires that the storage layer be immutable. This immutability can only be delivered by Amazon Quantum Ledger Database (QLDB), as Amazon QLDB has a built-in immutable journal that stores an accurate and sequenced entry of every data change. The journal is append-only, meaning that data can only be added to a journal, and it cannot be overwritten or deleted.
Secondly the compute layer needs to not only be containerized, and implemented with the least possible operational overhead. The option that best fits these requirements is Amazon ECS on AWS Fargate, as AWS Fargate is a Serverless, containerized deployment option.

CORRECT: "Set up an ECS cluster behind an Application Load Balancer on AWS Fargate. Use Amazon Quantum Ledger Database (QLDB) to manage the storage layer” is the correct answer (as explained above.)

INCORRECT: "Create an Auto Scaling Group with EC2 instances behind an Application Load Balancer. To manage the storage layer, use Amazon S3” is incorrect. EC2 instances are virtual machines, not a container product and Amazon S3 is an object storage service which does not act as an immutable storage layer.

INCORRECT: "Configure an ECS cluster on EC2 behind an Application Load Balancer within an Auto Scaling Group. Store data using Amazon DynamoDB” is incorrect. ECS on EC2 provides a higher level of operational overhead than using AWS Fargate, as Fargate is a Serverless service.

INCORRECT: "Create a cluster of ECS instances on AWS Fargate within an Auto Scaling Group behind an Application Load Balancer. To manage the storage layer, use Amazon S3” is incorrect. Although Fargate would be a suitable deployment option, Amazon S3 is not suitable for the storage layer as it is not immutable by default.

References:

https://aws.amazon.com/qldb/features/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-associate/aws-database-saa/

Domain

AWS Compute

Question 38Skipped

A security officer requires that access to company financial reports is logged. The reports are stored in an Amazon S3 bucket. Additionally, any modifications to the log files must be detected.

Which actions should a solutions architect take?

Use AWS CloudTrail to create a new trail. Configure the trail to log read and write management events on the S3 bucket that houses the reports. Log these events to a new bucket, and enable log file validation

Use S3 server access logging on the bucket that houses the reports with the read and write management events and log file validation options enabled

Correct answer

Use AWS CloudTrail to create a new trail. Configure the trail to log read and write data events on the S3 bucket that houses the reports. Log these events to a new bucket, and enable log file validation

Use S3 server access logging on the bucket that houses the reports with the read and write data events and the log file validation options enabled

Overall explanation

Amazon CloudTrail can be used to log activity on the reports. The key difference between the two answers that include CloudTrail is that one references data events whereas the other references management events.

Data events provide visibility into the resource operations performed on or within a resource. These are also known as data plane operations. Data events are often high-volume activities.

Example data events include:

• Amazon S3 object-level API activity (for example, GetObject, DeleteObject, and PutObject API operations).

• AWS Lambda function execution activity (the Invoke API).

Management events provide visibility into management operations that are performed on resources in your AWS account. These are also known as control plane operations. Example management events include:

• Configuring security (for example, IAM AttachRolePolicy API operations)

• Registering devices (for example, Amazon EC2 CreateDefaultVpc API operations).

Therefore, to log data about access to the S3 objects the solutions architect should log read and write data events.

Log file validation can also be enabled on the destination bucket:

CORRECT: "Use AWS CloudTrail to create a new trail. Configure the trail to log read and write data events on the S3 bucket that houses the reports. Log these events to a new bucket, and enable log file validation" is the correct answer.

INCORRECT: "Use AWS CloudTrail to create a new trail. Configure the trail to log read and write management events on the S3 bucket that houses the reports. Log these events to a new bucket, and enable log file validation" is incorrect as data events should be logged rather than management events.

INCORRECT: "Use S3 server access logging on the bucket that houses the reports with the read and write data events and the log file validation options enabled" is incorrect as server access logging does not have an option for choosing data events or log file validation.

INCORRECT: "Use S3 server access logging on the bucket that houses the reports with the read and write management events and log file validation options enabled" is incorrect as server access logging does not have an option for choosing management events or log file validation.

References:

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cloudtrail/

Domain

AWS Management & Governance

Question 39Skipped

A company has created an application that stores sales performance data in an Amazon DynamoDB table. A web application is being created to display the data. A Solutions Architect must design the web application using managed services that require minimal operational maintenance.

Which architectures meet these requirements? (Select TWO.)

An Amazon Route 53 hosted zone routes requests to an AWS Lambda endpoint to invoke a Lambda function that reads data from the DynamoDB table.

An Elastic Load Balancer forwards requests to a target group of Amazon EC2 instances. The EC2 instances run an application that reads data from the DynamoDB table.

Correct selection

An Amazon API Gateway REST API directly accesses the sales performance data in the DynamoDB table.

Correct selection

An Amazon API Gateway REST API invokes an AWS Lambda function. The Lambda function reads data from the DynamoDB table.

An Elastic Load Balancer forwards requests to a target group with the DynamoDB table configured as the target.

Overall explanation

There are two architectures here that fulfill the requirement to create a web application that displays the data from the DynamoDB table.

The first one is to use an API Gateway REST API that invokes an AWS Lambda function. A Lambda proxy integration can be used, and this will proxy the API requests to the Lambda function which processes the request and accesses the DynamoDB table.

The second option is to use an API Gateway REST API to directly access the sales performance data. In this case a proxy for the DynamoDB query API can be created using a method in the REST API.

CORRECT: "An Amazon API Gateway REST API invokes an AWS Lambda function. The Lambda function reads data from the DynamoDB table" is a correct answer.

CORRECT: "An Amazon API Gateway REST API directly accesses the sales performance data in the DynamoDB table" is also a correct answer.

INCORRECT: "An Amazon Route 53 hosted zone routes requests to an AWS Lambda endpoint to invoke a Lambda function that reads data from the DynamoDB table" is incorrect. An Alias record could be created in a hosted zone but a hosted zone itself does not route to a Lambda endpoint. Using an Alias, it is possible to route to a VPC endpoint that uses a Lambda function however there would not be a web front end so a REST API would be preferable.

INCORRECT: "An Elastic Load Balancer forwards requests to a target group with the DynamoDB table configured as the target" is incorrect. You cannot configure DynamoDB as a target in a target group.

INCORRECT: "An Elastic Load Balancer forwards requests to a target group of Amazon EC2 instances. The EC2 instances run an application that reads data from the DynamoDB table" is incorrect. This would not offer low operational maintenance as you must manage the EC2 instances.

References:

https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-api-as-simple-proxy-for-lambda.html

https://aws.amazon.com/blogs/compute/using-amazon-api-gateway-as-a-proxy-for-dynamodb/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-dynamodb/

https://digitalcloud.training/aws-lambda/

Domain

AWS Networking & Content Delivery

Question 40Skipped

A security team wants to limit access to specific services or actions in all of the team's AWS accounts. All accounts belong to a large organization in AWS Organizations. The solution must be scalable and there must be a single point where permissions can be maintained.

What should a solutions architect do to accomplish this?

Correct answer

Create a service control policy in the root organizational unit to deny access to the services or actions

Create cross-account roles in each account to deny access to the services or actions

Create an ACL to provide access to the services or actions

Create a security group to allow accounts and attach it to user groups

Overall explanation

Service control policies (SCPs) offer central control over the maximum available permissions for all accounts in your organization, allowing you to ensure your accounts stay within your organization’s access control guidelines.

SCPs alone are not sufficient for allowing access in the accounts in your organization. Attaching an SCP to an AWS Organizations entity (root, OU, or account) defines a guardrail for what actions the principals can perform. You still need to attach identity-based or resource-based policies to principals or resources in your organization's accounts to actually grant permissions to them.

CORRECT: "Create a service control policy in the root organizational unit to deny access to the services or actions" is the correct answer.

INCORRECT: "Create an ACL to provide access to the services or actions" is incorrect as access control lists are not used for permissions associated with IAM. Permissions policies are used with IAM.

INCORRECT: "Create a security group to allow accounts and attach it to user groups" is incorrect as security groups are instance level firewalls. They do not limit service actions.

INCORRECT: "Create cross-account roles in each account to deny access to the services or actions" is incorrect as this is a complex solution and does not provide centralized control

References:

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-organizations/

Domain

AWS Management & Governance

Question 41Skipped

An application is deployed on multiple AWS regions and accessed from around the world. The application exposes static public IP addresses. Some users are experiencing poor performance when accessing the application over the Internet.

What should a solutions architect recommend to reduce internet latency?

Set up an Amazon Route 53 geoproximity routing policy to route traffic

Correct answer

Set up AWS Global Accelerator and add endpoints

Set up AWS Direct Connect locations in multiple Regions

Set up an Amazon CloudFront distribution to access an application

Overall explanation

AWS Global Accelerator is a service in which you create accelerators to improve availability and performance of your applications for local and global users. Global Accelerator directs traffic to optimal endpoints over the AWS global network. This improves the availability and performance of your internet applications that are used by a global audience. Global Accelerator is a global service that supports endpoints in multiple AWS Regions, which are listed in the AWS Region Table.

By default, Global Accelerator provides you with two static IP addresses that you associate with your accelerator. (Or, instead of using the IP addresses that Global Accelerator provides, you can configure these entry points to be IPv4 addresses from your own IP address ranges that you bring to Global Accelerator.)

The static IP addresses are anycast from the AWS edge network and distribute incoming application traffic across multiple endpoint resources in multiple AWS Regions, which increases the availability of your applications. Endpoints can be Network Load Balancers, Application Load Balancers, EC2 instances, or Elastic IP addresses that are located in one AWS Region or multiple Regions.

CORRECT: "Set up AWS Global Accelerator and add endpoints" is the correct answer.

INCORRECT: "Set up AWS Direct Connect locations in multiple Regions" is incorrect as this is used to connect from an on-premises data center to AWS. It does not improve performance for users who are not connected to the on-premises data center.

INCORRECT: "Set up an Amazon CloudFront distribution to access an application" is incorrect as CloudFront cannot expose static public IP addresses.

INCORRECT: "Set up an Amazon Route 53 geoproximity routing policy to route traffic" is incorrect as this does not reduce internet latency as well as using Global Accelerator. GA will direct users to the closest edge location and then use the AWS global network.

References:

https://docs.aws.amazon.com/global-accelerator/latest/dg/what-is-global-accelerator.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-global-accelerator/

Domain

AWS Networking & Content Delivery

Question 42Skipped

A gaming company recently launched a multiplayer gaming platform for its users. The platform runs on multiple Amazon EC2 instances across two Availability Zones. Players use TCP to communicate with the platform in real time. The platform must be highly available and automatically scale as the number of players increases, while remaining cost-effective.

Which combination of steps will meet these requirements MOST cost-effectively? (Select TWO.)

Configure Amazon Route 53 to implement latency-based routing across multiple EC2 instances.

Use an Application Load Balancer to distribute TCP traffic to the EC2 instances.

Correct selection

Configure an Auto Scaling group to add or remove EC2 instances based on player traffic.

Deploy an Amazon ECS cluster to replace the EC2 instances and handle player traffic.

Correct selection

Add a Network Load Balancer in front of the EC2 instances to manage TCP traffic.

Overall explanation

Configure an Auto Scaling group to add or remove EC2 instances based on player traffic: This is correct because an Auto Scaling group automatically adjusts the number of EC2 instances in response to traffic changes. This ensures cost efficiency by scaling out during high demand and scaling in during low demand.

Add a Network Load Balancer in front of the EC2 instances to manage TCP traffic: This is correct because a Network Load Balancer is optimized for handling TCP traffic with low latency. It provides the required scalability and high availability across multiple Availability Zones.

Use an Application Load Balancer to distribute TCP traffic to the EC2 instances: This is incorrect because Application Load Balancers are optimized for HTTP/HTTPS traffic, not TCP. A Network Load Balancer is more cost-effective and appropriate for this use case.

Deploy an Amazon ECS cluster to replace the EC2 instances and handle player traffic: This is incorrect because switching to Amazon ECS introduces operational complexity and higher costs. The question specifies using EC2 instances, so Auto Scaling and a Network Load Balancer are more cost-effective and aligned with the scenario.

Configure Amazon Route 53 to implement latency-based routing across multiple EC2 instances: This is incorrect because Route 53 latency-based routing is not designed to provide automatic scaling or load balancing. Instead, it is used for directing traffic across endpoints in different Regions or locations.

References:
https://aws.amazon.com/elasticloadbalancing/network-load-balancer/
https://docs.aws.amazon.com/autoscaling/ec2/userguide/what-is-amazon-ec2-auto-scaling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Compute

Question 43Skipped

A company requires a fully managed replacement for an on-premises storage service. The company’s employees often work remotely from various locations. The solution should also be easily accessible to systems connected to the on-premises environment.

Which solution meets these requirements?

Use AWS DataSync to synchronize data between the on-premises service and Amazon S3.

Use AWS Transfer Acceleration to replicate files to Amazon S3 and enable public access.

Correct answer

Use Amazon FSx to create an SMB file share. Connect remote clients to the file share over a client VPN.

Use AWS Storage Gateway to create a volume gateway to store and transfer files to Amazon S3.

Overall explanation

Amazon FSx for Windows File Server (Amazon FSx) is a fully managed, highly available, and scalable file storage solution built on Windows Server that uses the Server Message Block (SMB) protocol. It allows for Microsoft Active Directory integration, data deduplication, and fully managed backups, among other critical enterprise features.

An Amazon FSx file system can be created to host the file shares. Clients can then be connected to an AWS Client VPN endpoint and gateway to enable remote access. The protocol used in this solution will be SMB.

CORRECT: "Use Amazon FSx to create an SMB file share. Connect remote clients to the file share over a client VPN" is the correct answer.

INCORRECT: "Use AWS Transfer Acceleration to replicate files to Amazon S3 and enable public access" is incorrect. This is simply a way of improving upload speeds to S3, it is not suitable for enabling internal and external access to a file system.

INCORRECT: "Use AWS DataSync to synchronize data between the on-premises service and Amazon S3" is incorrect. The on-premises solution is to be replaced so this is not a satisfactory solution. Also, DataSync syncs one way, it is not bidirectional.

INCORRECT: "Use AWS Storage Gateway to create a volume gateway to store and transfer files to Amazon S3" is incorrect. Storage Gateway volume gateways are mounted using block-based protocols (iSCSI), so this would not be workable as block-based protocols cannot be used over long distances such as by the workers in remote locations.

References:

https://aws.amazon.com/blogs/storage/accessing-smb-file-shares-remotely-with-amazon-fsx-for-windows-file-server/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 44Skipped

A company has created a duplicate of its environment in another AWS Region. The application is running in warm standby mode. There is an Application Load Balancer (ALB) in front of the application. Currently, failover is manual and requires updating a DNS alias record to point to the secondary ALB.

How can a solutions architect automate the failover process?

Correct answer

Enable an Amazon Route 53 health check

Create a latency based routing policy on Amazon Route 53

Enable an ALB health check

Create a CNAME record on Amazon Route 53 pointing to the ALB endpoint

Overall explanation

You can use Route 53 to check the health of your resources and only return healthy resources in response to DNS queries. There are three types of DNS failover configurations:

1. Active-passive: Route 53 actively returns a primary resource. In case of failure, Route 53 returns the backup resource. Configured using a failover policy.

2. Active-active: Route 53 actively returns more than one resource. In case of failure, Route 53 fails back to the healthy resource. Configured using any routing policy besides failover.

3. Combination: Multiple routing policies (such as latency-based, weighted, etc.) are combined into a tree to configure more complex DNS failover.

In this case an alias already exists for the secondary ALB. Therefore, the solutions architect just needs to enable a failover configuration with an Amazon Route 53 health check.

The configuration would look something like this:

CORRECT: "Enable an Amazon Route 53 health check" is the correct answer.

INCORRECT: "Enable an ALB health check" is incorrect. The point of an ALB health check is to identify the health of targets (EC2 instances). It cannot redirect clients to another Region.

INCORRECT: "Create a CNAME record on Amazon Route 53 pointing to the ALB endpoint" is incorrect as an Alias record already exists and is better for mapping to an ALB.

INCORRECT: "Create a latency based routing policy on Amazon Route 53" is incorrect as this will only take into account latency, it is not used for failover.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/route-53-dns-health-checks/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-route-53/

Domain

AWS Networking & Content Delivery

Question 45Skipped

An organization is extending a secure development environment into AWS. They have already secured the VPC including removing the Internet Gateway and setting up a Direct Connect connection. What else needs to be done to add encryption?

Configure an AWS Direct Connect Gateway

Enable IPSec encryption on the Direct Connect connection

Setup the Border Gateway Protocol (BGP) with encryption

Correct answer

Setup a Virtual Private Gateway (VPG)

Overall explanation

A VPG is used to setup an AWS VPN which you can use in combination with Direct Connect to encrypt all data that traverses the Direct Connect link. This combination provides an IPsec-encrypted private connection that also reduces network costs, increases bandwidth throughput, and provides a more consistent network experience than internet-based VPN connections.

CORRECT: "Setup a Virtual Private Gateway (VPG)" is the correct answer.

INCORRECT: "Enable IPSec encryption on the Direct Connect connection" is incorrect. There is no option to enable IPSec encryption on the Direct Connect connection.

INCORRECT: "Setup the Border Gateway Protocol (BGP) with encryption" is incorrect. The BGP protocol is not used to enable encryption for Direct Connect, it is used for routing.

INCORRECT: "Configure an AWS Direct Connect Gateway" is incorrect. An AWS Direct Connect Gateway is used to connect to VPCs across multiple AWS regions. It is not involved with encryption.

References:

https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-plus-vpn-network-to-amazon.html

https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 46Skipped

An application has multiple components for receiving requests that must be processed and subsequently processing the requests. The company requires a solution for decoupling the application components. The application receives around 10,000 requests per day and requests can take up to 2 days to process. Requests that fail to process must be retained.

Which solution meets these requirements most efficiently?

Decouple the application components with an Amazon SQS Topic. Configure the receiving component to subscribe to the SNS Topic.

Use an Amazon Kinesis data stream to decouple application components and integrate the processing component with the Kinesis Client Library (KCL).

Correct answer

Decouple the application components with an Amazon SQS queue. Configure a dead-letter queue to collect the requests that failed to process.

Create an Amazon DynamoDB table and enable DynamoDB streams. Configure the processing component to process requests from the stream.

Overall explanation

The Amazon Simple Queue Service (SQS) is ideal for decoupling the application components. Standard queues can support up to 120,000 in flight messages and messages can be retained for up to 14 days in the queue.

To ensure the retention of requests (messages) that fail to process, a dead-letter queue can be configured. Messages that fail to process are sent to the dead-letter queue (based on the redrive policy) and can be subsequently dealt with.

CORRECT: "Decouple the application components with an Amazon SQS queue. Configure a dead-letter queue to collect the requests that failed to process" is the correct answer.

INCORRECT: "Decouple the application components with an Amazon SQS Topic. Configure the receiving component to subscribe to the SNS Topic" is incorrect. SNS does not store requests, it immediately forwards all notifications to subscribers.

INCORRECT: "Use an Amazon Kinesis data stream to decouple application components and integrate the processing component with the Kinesis Client Library (KCL)" is incorrect. This is a less efficient solution and will likely be less cost-effective compared to using Amazon SQS. There is also no option for retention of requests that fail to process.

INCORRECT: "Create an Amazon DynamoDB table and enable DynamoDB streams. Configure the processing component to process requests from the stream" is incorrect. This solution does not offer any way of retaining requests that fail to process of removal of items from the table and is therefore less efficient.

References:

https://aws.amazon.com/sqs/faqs/

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 47Skipped

A Solutions Architect has been tasked with migrating 30 TB of data from an on-premises data center within 20 days. The company has an internet connection that is limited to 25 Mbps and the data transfer cannot use more than 50% of the connection speed.

What should a Solutions Architect do to meet these requirements?

Use AWS Storage Gateway.

Use AWS DataSync.

Correct answer

Use AWS Snowball.

Use a site-to-site VPN.

Overall explanation

This is a simple case of working out roughly how long it will take to migrate the data using the 12.5 Mbps of bandwidth that is available for transfer and seeing which options are feasible. Transferring 30 TB of data across a 25 Mbps connection could take upwards of 200 days.

Therefore, we know that using the Internet connection will not meet the requirements and we can rule out any solution that will use the internet (all options except for Snowball). AWS Snowball is a physical device that is shipped to your office or data center. You can then load data onto it and ship it back to AWS where the data is uploaded to Amazon S3.

Snowball is the only solution that will achieve the data migration requirements within the 20-day period.

CORRECT: "Use AWS Snowball" is the correct answer.

INCORRECT: "Use AWS DataSync" is incorrect. This uses the internet which will not meet the 20-day deadline.

INCORRECT: "Use AWS Storage Gateway" is incorrect. This uses the internet which will not meet the 20-day deadline.

INCORRECT: "Use a site-to-site VPN" is incorrect. This uses the internet which will not meet the 20-day deadline.

References:

https://aws.amazon.com/snowball/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 48Skipped

A company has deployed an application that consists of several microservices running on Amazon EC2 instances behind an Amazon API Gateway API. A Solutions Architect is concerned that the microservices are not designed to elastically scale when large increases in demand occur.

Which solution addresses this concern?

Use Amazon CloudWatch alarms to notify operations staff when the microservices are suffering high CPU utilization.

Use an Elastic Load Balancer to distribute the traffic between the microservices. Configure Amazon CloudWatch metrics to monitor traffic to the microservices.

Correct answer

Create an Amazon SQS queue to store incoming requests. Configure the microservices to retrieve the requests from the queue for processing.

Spread the microservices across multiple Availability Zones and configure Amazon Data Lifecycle Manager to take regular snapshots.

Overall explanation

The individual microservices are not designed to scale. Therefore, the best way to ensure they are not overwhelmed by requests is to decouple the requests from the microservices. An Amazon SQS queue can be created, and the API Gateway can be configured to add incoming requests to the queue. The microservices can then pick up the requests from the queue when they are ready to process them.

CORRECT: "Create an Amazon SQS queue to store incoming requests. Configure the microservices to retrieve the requests from the queue for processing" is the correct answer.

INCORRECT: "Use Amazon CloudWatch alarms to notify operations staff when the microservices are suffering high CPU utilization" is incorrect. This solution requires manual intervention and does not help the application to elastically scale.

INCORRECT: "Spread the microservices across multiple Availability Zones and configure Amazon Data Lifecycle Manager to take regular snapshots" is incorrect. This does not automate the elasticity of the application.

INCORRECT: "Use an Elastic Load Balancer to distribute the traffic between the microservices. Configure Amazon CloudWatch metrics to monitor traffic to the microservices" is incorrect. You cannot use an ELB spread traffic across many different individual microservices as the requests must be directed to individual microservices. Therefore, you would need a target group per microservice, and you would need Auto Scaling to scale the microservices.

References:

https://aws.amazon.com/blogs/compute/understanding-asynchronous-messaging-for-microservices/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Compute

Question 49Skipped

A company needs to implement a new data retention policy for regulatory compliance. As part of this policy, sensitive documents that are stored in an Amazon S3 bucket must be protected from deletion or modification for a fixed period of time.

Which solution will meet these requirements?

Activate S3 Object Lock in compliance mode on the bucket. Configure a WORM (Write Once, Read Many) policy.

Create an Amazon S3 bucket with versioning enabled. Use a lifecycle rule to automatically delete older versions after the retention period.

Correct answer

Enable S3 Object Lock on the required objects and set compliance mode.

Use AWS Backup to create immutable backups of the S3 objects and enforce a retention policy.

Overall explanation

Enable S3 Object Lock on the required objects and set compliance mode: This is correct because compliance mode ensures that no user, including the root user, can delete or modify objects during the retention period, making it suitable for regulatory requirements.

Activate S3 Object Lock in compliance mode on the bucket. Configure a WORM (Write Once, Read Many) policy: This is incorrect because S3 Object Lock applies to specific objects, not the entire bucket, and there is no WORM-specific configuration required beyond compliance mode.

Create an Amazon S3 bucket with versioning enabled. Use a lifecycle rule to automatically delete older versions after the retention period: This is incorrect because versioning and lifecycle policies do not provide protection against modification or deletion during the retention period.

Use AWS Backup to create immutable backups of the S3 objects and enforce a retention policy: This is incorrect because AWS Backup does not integrate directly with S3 Object Lock to meet regulatory compliance needs for immutability.

References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html
https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-object-lock.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 50Skipped

A scientific research organization runs an on-premises simulation application that processes large datasets. The organization has migrated all simulation data to Amazon S3 to reduce costs. The simulation application requires low-latency storage access for seamless performance during processing tasks.

The organization needs to design a storage solution that minimizes costs while maintaining the performance requirements of the application.

Which storage solution will meet these requirements in the MOST cost-effective way?

Use AWS DataSync to copy frequently accessed data from Amazon S3 to an on-premises storage system. Configure the application to use the local storage for low-latency access.

Deploy a high-speed internet connection and configure the on-premises application to access the data directly from Amazon S3 using the S3 API for storage operations.

Copy the data from Amazon S3 to Amazon FSx for Lustre. Use an Amazon FSx File Gateway to provide low-latency access for the on-premises application.

Correct answer

Use Amazon S3 File Gateway to provide low-latency storage for the on-premises application. The File Gateway will cache frequently accessed data locally.

Overall explanation

Use Amazon S3 File Gateway to provide low-latency storage for the on-premises application. The File Gateway will cache frequently accessed data locally: This is correct because S3 File Gateway provides a seamless and cost-effective way to access data stored in Amazon S3. It locally caches frequently accessed data, reducing latency while still leveraging the cost benefits of S3 storage.

Use AWS DataSync to copy frequently accessed data from Amazon S3 to an on-premises storage system. Configure the application to use the local storage for low-latency access: This is incorrect because DataSync is designed for batch data transfer and is not suitable for providing continuous, low-latency access to S3 data. It introduces additional complexity and costs for managing on-premises storage systems.

Copy the data from Amazon S3 to Amazon FSx for Lustre. Use an Amazon FSx File Gateway to provide low-latency access for the on-premises application: This is incorrect because FSx for Lustre is optimized for high-performance workloads but is more expensive and introduces unnecessary complexity compared to S3 File Gateway. Additionally, copying all data to FSx increases storage costs.

Deploy a high-speed internet connection and configure the on-premises application to access the data directly from Amazon S3 using the S3 API for storage operations: This is incorrect because accessing data directly from S3 over the internet does not meet the low-latency requirements for the application. While cost-effective, it will degrade performance for latency-sensitive workloads.

References:
https://docs.aws.amazon.com/storagegateway/latest/userguide/WhatIsStorageGateway.html
https://docs.aws.amazon.com/datasync/latest/userguide/what-is-datasync.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-storage-gateway/

Domain

AWS Storage

Question 51Skipped

An application runs on Amazon EC2 Linux instances. The application generates log files which are written using standard API calls. A storage solution is required that can be used to store the files indefinitely and must allow concurrent access to all files.

Which storage service meets these requirements and is the MOST cost-effective?

Amazon EC2 instance store

Amazon EBS

Amazon EFS

Correct answer

Amazon S3

Overall explanation

The application is writing the files using API calls which means it will be compatible with Amazon S3 which uses a REST API. S3 is a massively scalable key-based object store that is well-suited to allowing concurrent access to the files from many instances.

Amazon S3 will also be the most cost-effective choice. A rough calculation using the AWS pricing calculator shows the cost differences between 1TB of storage on EBS, EFS, and S3 Standard.

CORRECT: "Amazon S3" is the correct answer.

INCORRECT: "Amazon EFS" is incorrect as though this does offer concurrent access from many EC2 Linux instances, it is not the most cost-effective solution.

INCORRECT: "Amazon EBS" is incorrect. The Elastic Block Store (EBS) is not a good solution for concurrent access from many EC2 instances and is not the most cost-effective option either. EBS volumes are mounted to a single instance except when using multi-attach which is a new feature and has several constraints.

INCORRECT: "Amazon EC2 instance store" is incorrect as this is an ephemeral storage solution which means the data is lost when powered down. Therefore, this is not an option for long-term data storage.

References:

https://docs.aws.amazon.com/AmazonS3/latest/dev/optimizing-performance.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 52Skipped

A company hosts statistical data in an Amazon S3 bucket that users around the world download from their website using a URL that resolves to a domain name. The company needs to provide low latency access to users and plans to use Amazon Route 53 for hosting DNS records.

Which solution meets these requirements?

Create an A record in Route 53, use a Route 53 traffic policy for the web application, and configure a geolocation rule. Configure health checks to check the health of the endpoint and route DNS queries to other endpoints if an endpoint is unhealthy.

Correct answer

Create a web distribution on Amazon CloudFront pointing to an Amazon S3 origin. Create an ALIAS record in the Amazon Route 53 hosted zone that points to the CloudFront distribution, resolving to the application's URL domain name.

Create a web distribution on Amazon CloudFront pointing to an Amazon S3 origin. Create a CNAME record in a Route 53 hosted zone that points to the CloudFront distribution, resolving to the application's URL domain name.

Create an A record in Route 53, use a Route 53 traffic policy for the web application, and configure a geoproximity rule. Configure health checks to check the health of the endpoint and route DNS queries to other endpoints if an endpoint is unhealthy.

Overall explanation

This is a simple requirement for low latency access to the contents of an Amazon S3 bucket for global users. The best solution here is to use Amazon CloudFront to cache the content in Edge Locations around the world. This involves creating a web distribution that points to an S3 origin (the bucket) and then create an Alias record in Route 53 that resolves the applications URL to the CloudFront distribution endpoint.

CORRECT: "Create a web distribution on Amazon CloudFront pointing to an Amazon S3 origin. Create an ALIAS record in the Amazon Route 53 hosted zone that points to the CloudFront distribution, resolving to the application's URL domain name" is the correct answer.

INCORRECT: "Create a web distribution on Amazon CloudFront pointing to an Amazon S3 origin. Create a CNAME record in a Route 53 hosted zone that points to the CloudFront distribution, resolving to the application's URL domain name" is incorrect. An Alias record should be used to point to an Amazon CloudFront distribution.

INCORRECT: "Create an A record in Route 53, use a Route 53 traffic policy for the web application, and configure a geolocation rule. Configure health checks to check the health of the endpoint and route DNS queries to other endpoints if an endpoint is unhealthy" is incorrect. There is only a single endpoint (the Amazon S3 bucket) so this strategy would not work. Much better to use CloudFront to cache in multiple locations.

INCORRECT: "Create an A record in Route 53, use a Route 53 traffic policy for the web application, and configure a geoproximity rule. Configure health checks to check the health of the endpoint and route DNS queries to other endpoints if an endpoint is unhealthy" is incorrect. Again, there is only one endpoint so this strategy will simply not work.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/RoutingToS3Bucket.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

https://digitalcloud.training/amazon-route-53/

Domain

AWS Networking & Content Delivery

Question 53Skipped

A company is migrating its legacy customer support applications from an on-premises data center to AWS. Each application runs on a dedicated virtual machine and relies on proprietary software that cannot be modified. The applications must remain highly available and continue to operate in the event of a single Availability Zone failure. The company wants to minimize changes to its architecture and operational overhead.

Which solution will meet these requirements?

Use AWS Elastic Disaster Recovery (AWS DRS) to replicate the on-premises virtual machines to AWS. Launch the virtual machines in an Auto Scaling group configured to span multiple Availability Zones.

Correct answer

Create an Amazon Machine Image (AMI) for each application. Launch two EC2 instances for each application in different Availability Zones. Use an Application Load Balancer to distribute traffic evenly between the instances.

Use AWS Backup to configure hourly backups of each EC2 instance. Store backups in Amazon S3 Glacier. In case of failure, restore the latest backup to a new EC2 instance in another Availability Zone.

Refactor the applications into microservices and deploy them on Amazon ECS with Fargate. Use a Network Load Balancer to route traffic to the Fargate tasks.

Overall explanation

Create an Amazon Machine Image (AMI) for each application. Launch two EC2 instances for each application in different Availability Zones. Use an Application Load Balancer to distribute traffic evenly between the instances: This is the correct solution as it provides high availability by deploying instances across Availability Zones and distributes traffic using a load balancer.

Use AWS Backup to configure hourly backups of each EC2 instance. Store backups in Amazon S3 Glacier. In case of failure, restore the latest backup to a new EC2 instance in another Availability Zone: While backups help in disaster recovery, this solution does not provide high availability or fault tolerance in real-time.

Use AWS Elastic Disaster Recovery (AWS DRS) to replicate the on-premises virtual machines to AWS. Launch the virtual machines in an Auto Scaling group configured to span multiple Availability Zones: While AWS DRS is useful for disaster recovery, this approach introduces unnecessary complexity for an already migrated application.

Refactor the applications into microservices and deploy them on Amazon ECS with Fargate. Use a Network Load Balancer to route traffic to the Fargate tasks: This is incorrect because the requirement explicitly states that the proprietary applications cannot be modified.

References:
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html
https://docs.aws.amazon.com/auto-scaling/index.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Compute

Question 54Skipped

A high-performance file system is required for a financial modelling application. The data set will be stored on Amazon S3 and the storage solution must have seamless integration so objects can be accessed as files.

Which storage solution should be used?

Amazon Elastic File System (EFS)

Correct answer

Amazon FSx for Lustre

Amazon Elastic Block Store (EBS)

Amazon FSx for Windows File Server

Overall explanation

Amazon FSx for Lustre provides a high-performance file system optimized for fast processing of workloads such as machine learning, high performance computing (HPC), video processing, financial modeling, and electronic design automation (EDA). Amazon FSx works natively with Amazon S3, letting you transparently access your S3 objects as files on Amazon FSx to run analyses for hours to months.

CORRECT: "Amazon FSx for Lustre" is the correct answer.

INCORRECT: "Amazon FSx for Windows File Server" is incorrect. Amazon FSx for Windows File Server provides a fully managed native Microsoft Windows file system so you can easily move your Windows-based applications that require shared file storage to AWS. This solution integrates with Windows file shares, not with Amazon S3.

INCORRECT: "Amazon Elastic File System (EFS)" is incorrect. EFS and EBS are not good use cases for this solution. Neither storage solution is capable of presenting Amazon S3 objects as files to the application.

INCORRECT: "Amazon Elastic Block Store (EBS)" is incorrect. EFS and EBS are not good use cases for this solution. Neither storage solution is capable of presenting Amazon S3 objects as files to the application.

References:

https://aws.amazon.com/fsx/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 55Skipped

A financial services company runs a credit evaluation system in a private subnet behind an Application Load Balancer (ALB) in a VPC. The VPC includes a NAT gateway and an internet gateway. The system analyzes customer credit data and uploads the results to Amazon S3 for reporting.

The company has strict regulatory requirements stating that all data traffic must remain within AWS’s private network and must not traverse the public internet. Additionally, the company wants to implement a cost-effective solution while ensuring compliance.

Which solution will meet these requirements MOST cost-effectively?

Configure an S3 interface endpoint. Attach a security group to the endpoint that allows the application to send traffic to Amazon S3 securely.

Correct answer

Configure an S3 gateway endpoint. Update the route table of the private subnet to direct S3 traffic through the endpoint.

Create a VPN connection between the VPC and Amazon S3 to ensure secure communication without public internet traffic.

Enable S3 Transfer Acceleration for faster uploads and downloads while restricting access to trusted IP addresses.

Overall explanation

Configure an S3 gateway endpoint. Update the route table of the private subnet to direct S3 traffic through the endpoint: This is correct because an S3 gateway endpoint enables private and secure communication between the VPC and Amazon S3, ensuring no traffic leaves the AWS network. It is also a cost-effective solution because gateway endpoints do not require additional infrastructure like NAT gateways.

Configure an S3 interface endpoint. Attach a security group to the endpoint that allows the application to send traffic to Amazon S3 securely: This is incorrect because S3 interface endpoints are designed for use cases involving VPC security group control but are typically more expensive than gateway endpoints. Gateway endpoints are purpose-built for S3 and DynamoDB, offering a simpler and more cost-effective solution.

Enable S3 Transfer Acceleration for faster uploads and downloads while restricting access to trusted IP addresses: This is incorrect because S3 Transfer Acceleration is designed to improve performance for global uploads and downloads but does not ensure that traffic avoids the public internet. This does not meet the regulatory requirement of keeping traffic private.

Create a VPN connection between the VPC and Amazon S3 to ensure secure communication without public internet traffic: This is incorrect because Amazon S3 does not support direct VPN connections. Gateway endpoints are the proper mechanism for secure, private communication with S3.

References:

https://docs.aws.amazon.com/vpc/latest/privatelink/concepts.html

https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Storage

Question 56Skipped

A financial services company needs to set up an Amazon RDS Multi-AZ database to store customer transaction records. The database will serve as the backend for an on-premises financial analysis application. The company requires the on-premises application to connect directly to the RDS database when employees are working from the office.

The company must ensure the connection is established securely and efficiently.

Which solution provides the required connectivity MOST securely?

Correct answer

Create a VPC with two private subnets. Deploy the RDS database in the private subnets. Establish connectivity between the on-premises office and AWS using AWS Site-to-Site VPN with a customer gateway.

Create a VPC with two private subnets. Deploy the RDS database in the private subnets. Configure RDS security groups to allow the on-premises office IP ranges to access the database directly over the internet.

Create a VPC with two public subnets. Deploy the RDS database in the public subnets. Use AWS Client VPN to establish secure connectivity between employees’ desktops and the database.

Create a VPC with two public subnets. Deploy the RDS database in the public subnets. Configure an AWS Direct Connect connection between the on-premises office and the VPC for low-latency access.

Overall explanation

Create a VPC with two private subnets. Deploy the RDS database in the private subnets. Establish connectivity between the on-premises office and AWS using AWS Site-to-Site VPN with a customer gateway:

This is correct because placing the RDS database in private subnets ensures it is not publicly accessible. Using AWS Site-to-Site VPN securely connects the on-premises office to the VPC, allowing direct connectivity to the database while maintaining security.

Create a VPC with two public subnets. Deploy the RDS database in the public subnets. Configure an AWS Direct Connect connection between the on-premises office and the VPC for low-latency access:

This is incorrect because placing the RDS database in public subnets exposes it to the internet, violating security best practices. While Direct Connect provides low latency, public subnets do not meet the company's security requirements.

Create a VPC with two private subnets. Deploy the RDS database in the private subnets. Configure RDS security groups to allow the on-premises office IP ranges to access the database directly over the internet:

This is incorrect because private subnets do not have direct internet access, and accessing the database over the internet introduces security vulnerabilities, even with security group rules.

Create a VPC with two public subnets. Deploy the RDS database in the public subnets. Use AWS Client VPN to establish secure connectivity between employees’ desktops and the database:

This is incorrect because deploying the database in public subnets unnecessarily exposes it to potential threats. Client VPN is a good solution for employee access but does not address the requirement to connect securely from an on-premises office.

References:
https://docs.aws.amazon.com/vpn/latest/s2svpn/VPN_Overview.html
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 57Skipped

A logistics company needs to replicate ongoing data changes from an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. The volume of data to replicate varies throughout the day due to periodic spikes in activity. The company plans to use AWS Database Migration Service (AWS DMS) for this task. The solution must dynamically allocate capacity based on workload demand while keeping operational overhead low.

Which solution will meet these requirements?

Use Amazon EC2 Spot Instances to host the AWS DMS replication instance and manually scale up or down based on replication needs.

Deploy AWS DMS in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster and use an autoscaler to adjust compute capacity during data spikes.

Create an AWS DMS replication instance with provisioned capacity in a Multi-AZ deployment to improve availability and fault tolerance.

Correct answer

Configure AWS DMS Serverless to create a replication task that scales its capacity automatically based on workload demand.

Overall explanation

Configure AWS DMS Serverless to create a replication task that scales its capacity automatically based on workload demand: This is correct because AWS DMS Serverless dynamically adjusts replication capacity in response to data volume changes, providing cost efficiency and reducing manual management.

Deploy AWS DMS in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster and use an autoscaler to adjust compute capacity during data spikes: This is incorrect because AWS DMS does not support deployment on Amazon EKS. Additionally, this solution introduces unnecessary complexity.

Use Amazon EC2 Spot Instances to host the AWS DMS replication instance and manually scale up or down based on replication needs: This is incorrect because manually scaling replication tasks increases operational overhead and Spot Instances could be interrupted, affecting replication stability.

Create an AWS DMS replication instance with provisioned capacity in a Multi-AZ deployment to improve availability and fault tolerance: This is incorrect because while Multi-AZ deployment enhances availability, it does not dynamically adjust capacity to match workload demand.

References:
https://docs.aws.amazon.com/dms/latest/userguide/what-is-dms.html
https://aws.amazon.com/dms/serverless/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 58Skipped

A company runs a business-critical application in the us-east-1 Region. The application uses an Amazon Aurora MySQL database cluster which is 2 TB in size. A Solutions Architect needs to determine a disaster recovery strategy for failover to the us-west-2 Region. The strategy must provide a recovery time objective (RTO) of 10 minutes and a recovery point objective (RPO) of 5 minutes.

Which strategy will meet these requirements?

Create a multi-Region Aurora MySQL DB cluster in us-east-1 and us-west-2. Use an Amazon Route 53 health check to monitor us-east-1 and fail over to us-west-2 upon failure.

Recreate the database as an Aurora multi master cluster across the us-east-1 and us-west-2 Regions with multiple writers to allow read/write capabilities from all database instances.

Create a cross-Region Aurora MySQL read replica in us-west-2 Region. Configure an Amazon EventBridge rule that invokes an AWS Lambda function that promotes the read replica in us-west-2 when failure is detected.

Correct answer

Recreate the database as an Aurora global database with the primary DB cluster in us-east-1 and a secondary DB cluster in us-west-2. Use an Amazon EventBridge rule that invokes an AWS Lambda function to promote the DB cluster in us-west-2 when failure is detected.

Overall explanation

Amazon Aurora Global Database is designed for globally distributed applications, allowing a single Amazon Aurora database to span multiple AWS regions. It replicates your data with no impact on database performance, enables fast local reads with low latency in each region, and provides disaster recovery from region-wide outages

If your primary region suffers a performance degradation or outage, you can promote one of the secondary regions to take read/write responsibilities. An Aurora cluster can recover in less than 1 minute even in the event of a complete regional outage.

This provides your application with an effective Recovery Point Objective (RPO) of 1 second and a Recovery Time Objective (RTO) of less than 1 minute, providing a strong foundation for a global business continuity plan

CORRECT: "Recreate the database as an Aurora global database with the primary DB cluster in us-east-1 and a secondary DB cluster in us-west-2. Use an Amazon EventBridge rule that invokes an AWS Lambda function to promote the DB cluster in us-west-2 when failure is detected" is the correct answer.

INCORRECT: "Create a multi-Region Aurora MySQL DB cluster in us-east-1 and us-west-2. Use an Amazon Route 53 health check to monitor us-east-1 and fail over to us-west-2 upon failure" is incorrect. You cannot create a multi-Region Aurora MySQL DB cluster. Options are to create MySQL Replicas (may meet the RTO objectives), or to use global database.

INCORRECT: "Create a cross-Region Aurora MySQL read replica in us-west-2 Region. Configure an Amazon EventBridge rule that invokes an AWS Lambda function that promotes the read replica in us-west-2 when failure is detected" is incorrect. This may not meet the RTO objectives as large databases may well take more than 10 minutes to promote.

INCORRECT: "Recreate the database as an Aurora multi master cluster across the us-east-1 and us-west-2 Regions with multiple writers to allow read/write capabilities from all database instances" is incorrect. Multi master only works within a Region it does not work across Regions.

References:

https://aws.amazon.com/rds/aurora/global-database/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 59Skipped

A company has created a disaster recovery solution for an application that runs behind an Application Load Balancer (ALB). The DR solution consists of a second copy of the application running behind a second ALB in another Region. The Solutions Architect requires a method of automatically updating the DNS record to point to the ALB in the second Region.

What action should the Solutions Architect take?

Configure an alarm on a CloudTrail trail.

Correct answer

Enable an Amazon Route 53 health check.

Use Amazon EventBridge to cluster the ALBs.

Enable an ALB health check.

Overall explanation

Amazon Route 53 health checks monitor the health and performance of your web applications, web servers, and other resources. Each health check that you create can monitor one of the following:

•  The health of a specified resource, such as a web server

•  The status of other health checks

•  The status of an Amazon CloudWatch alarm

Health checks can be used with other configurations such as a failover routing policy. In this case a failover routing policy will direct traffic to the ALB of the primary Region unless health checks fail at which time it will direct traffic to the secondary record for the DR ALB.

CORRECT: "Enable an Amazon Route 53 health check" is the correct answer.

INCORRECT: "Enable an ALB health check" is incorrect. This will simply perform health checks of the instances behind the ALB, rather than the ALB itself. This could be used in combination with Route 53 health checks.

INCORRECT: "Use Amazon EventBridge to cluster the ALBs" is incorrect. You cannot cluster ALBs in any way.

INCORRECT: "Configure an alarm on a CloudTrail trail" is incorrect. CloudTrail records API activity so this does not help.

References:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-route-53/

Domain

AWS Networking & Content Delivery

Question 60Skipped

A media company is building a video content distribution platform on AWS. The platform uses an REST API hosted on Amazon API Gateway to serve metadata about the videos, such as titles and descriptions. The metadata is confidential and must be accessible only from a specific set of trusted IP addresses belonging to the company’s office network.

Which solution will meet these requirements?

Set up API Gateway with a private integration and restrict access to the trusted IP addresses using a VPC endpoint policy.

Modify the API Gateway security group to allow inbound requests only from the trusted IP addresses.

Deploy the API Gateway in a private subnet and configure a network ACL to permit traffic only from the trusted IP addresses.

Correct answer

Configure an API Gateway resource policy that denies access to any IP address that is not explicitly allowed.

Overall explanation

Configure an API Gateway resource policy that denies access to any IP address that is not explicitly allowed: This is correct because resource policies in API Gateway allow you to restrict access to APIs by specifying conditions, such as IP addresses. By creating a resource policy with a condition that permits traffic only from the trusted IP range, you can ensure that the API is accessible only from the company’s internal network.

Deploy the API Gateway in a private subnet and configure a network ACL to permit traffic only from the trusted IP addresses: This is incorrect because API Gateway cannot be directly deployed within a private subnet. Instead, it is a managed service that operates outside of VPCs. To use a private network, you would need a VPC endpoint, but this does not fully meet the requirements without additional configuration.

Set up API Gateway with a private integration and restrict access to the trusted IP addresses using a VPC endpoint policy: This is incorrect because private integrations in API Gateway are used to route traffic to resources within a VPC, such as an application running on Amazon EC2. While you can use a VPC endpoint policy for restricting access, this setup is more complex than using a resource policy and does not directly fulfill the requirement of limiting IP addresses for the API.

Modify the API Gateway security group to allow inbound requests only from the trusted IP addresses: This is incorrect because API Gateway is not associated with security groups. Security groups are used for resources like EC2 instances or load balancers, not for API Gateway endpoints.

References:
https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies.html
https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-privatelink.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-api-gateway/

Domain

AWS Networking & Content Delivery

Question 61Skipped

A gaming company collects real-time data and stores it in an on-premises database system. The company are migrating to AWS and need better performance for the database. A solutions architect has been asked to recommend an in-memory database that supports data replication.

Which database should a solutions architect recommend?

Amazon ElastiCache for Memcached

Amazon RDS for MySQL

Amazon RDS for PostgreSQL

Correct answer

Amazon ElastiCache for Redis

Overall explanation

Amazon ElastiCache is an in-memory database. With ElastiCache Memcached there is no data replication or high availability. As you can see in the diagram, each node is a separate partition of data:

Therefore, the Redis engine must be used which does support both data replication and clustering. The following diagram shows a Redis architecture with cluster mode enabled:

CORRECT: "Amazon ElastiCache for Redis" is the correct answer.

INCORRECT: "Amazon ElastiCache for Memcached" is incorrect as Memcached does not support data replication or high availability.

INCORRECT: "Amazon RDS for MySQL" is incorrect as this is not an in-memory database.

INCORRECT: "Amazon RDS for PostgreSQL" is incorrect as this is not an in-memory database.

References:

https://aws.amazon.com/elasticache/redis/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-elasticache/

Domain

AWS Database

Question 62Skipped

A Solutions Architect must design a solution to allow many Amazon EC2 instances across multiple subnets to access a shared data store. The data must be accessed by all instances simultaneously and access should use the NFS protocol. The solution must also be highly scalable and easy to implement.

Which solution best meets these requirements?

Configure an additional EC2 instance as a file server. Create a role in AWS IAM that grants permissions to the file share and attach the role to the EC2 instances.

Correct answer

Create an Amazon EFS file system. Configure a mount target in each Availability Zone. Attach each instance to the appropriate mount target.

Create an Amazon S3 bucket and configure a Network ACL. Grant the EC2 instances permission to access the bucket using the NFS protocol.

Create an Amazon EBS volume and create a resource-based policy that grants an AWS IAM role access to the data. Attach the role to the EC2 instances.

Overall explanation

The Amazon Elastic File System (EFS) is a perfect solution for this requirement. Amazon EFS filesystems are accessed using the NFS protocol and can be mounted by many instances across multiple subnets simultaneously. EFS filesystems are highly scalable and very easy to implement.

CORRECT: "Create an Amazon EFS file system. Configure a mount target in each Availability Zone. Attach each instance to the appropriate mount target" is the correct answer.

INCORRECT: "Configure an additional EC2 instance as a file server. Create a role in AWS IAM that grants permissions to the file share and attach the role to the EC2 instances" is incorrect. You cannot use IAM roles to grant permissions to a file share created within the operating system of an EC2 instance. Also, this solution is not as highly scalable or easy to implement as Amazon EFS.

INCORRECT: "Create an Amazon S3 bucket and configure a Network ACL. Grant the EC2 instances permission to access the bucket using the NFS protocol" is incorrect. A Network ACL is created to restrict traffic in and out of subnets, it is not used to control access to S3 buckets (use a bucket policy or bucket ACL instead). You cannot grant permission to access an S3 bucket using a protocol, and NFS is not supported for S3 as it is an object-based storage system.

INCORRECT: "Create an Amazon EBS volume and create a resource-based policy that grants an AWS IAM role access to the data. Attach the role to the EC2 instances" is incorrect. You cannot configure a resource-based policy on an Amazon EBS volume.

References:

https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-efs/

Domain

AWS Storage

Question 63Skipped

A company requires a high-performance file system that can be mounted on Amazon EC2 Windows instances and Amazon EC2 Linux instances. Applications running on the EC2 instances perform separate processing of the same files and the solution must provide a file system that can be mounted by all instances simultaneously.

Which solution meets these requirements?

Use Amazon Elastic File System (Amazon EFS) with General Purpose performance mode for the Windows instances and the Linux instances.

Correct answer

Use Amazon FSx for Windows File Server for the Windows instances and the Linux instances.

Use Amazon FSx for Windows File Server for the Windows instances. Use Amazon FSx for Lustre for the Linux instances. Link both Amazon FSx file systems to the same Amazon S3 bucket.

Use Amazon FSx for Windows File Server for the Windows instances. Use Amazon Elastic File System (Amazon EFS) with Max I/O performance mode for the Linux instances.

Overall explanation

Amazon FSx for Windows File Server provides a fully managed native Microsoft Windows file system so you can easily move your Windows-based applications that require shared file storage to AWS. You can easily connect Linux instances to the file system by installing the cifs-utils package. The Linux instances can then mount an SMB/CIFS file system.

CORRECT: "Use Amazon FSx for Windows File Server for the Windows instances and the Linux instances" is the correct answer.

INCORRECT: "Use Amazon FSx for Windows File Server for the Windows instances. Use Amazon Elastic File System (Amazon EFS) with Max I/O performance mode for the Linux instances" is incorrect. This solution results in two separate file systems and a shared file system is required.

INCORRECT: "Use Amazon Elastic File System (Amazon EFS) with General Purpose performance mode for the Windows instances and the Linux instances" is incorrect. You cannot use Amazon EFS for Windows instances as this is not supported.

INCORRECT: "Use Amazon FSx for Windows File Server for the Windows instances. Use Amazon FSx for Lustre for the Linux instances. Link both Amazon FSx file systems to the same Amazon S3 bucket" is incorrect. Amazon FSx for Windows File Server does not use Amazon S3 buckets, so this is another solution that results in separate file systems.

References:

https://docs.aws.amazon.com/fsx/latest/WindowsGuide/using-file-shares.html#map-shares-linux

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 64Skipped

A Solutions Architect is designing a solution for an application that requires very low latency between the client and the backend. The application uses the UDP protocol, and the backend is hosted on Amazon EC2 instances. The solution must be highly available across multiple Regions and users around the world should be directed to the most appropriate Region based on performance.

How can the Solutions Architect meet these requirements?

Deploy an Application Load Balancer in front of the EC2 instances in each Region. Use AWS WAF to direct traffic to the most optimal Regional endpoint.

Deploy an Amazon CloudFront distribution with a custom origin pointing to Amazon EC2 instances in multiple Regions.

Deploy Amazon EC2 instances in multiple Regions. Create a multivalue answer routing record in Amazon Route 53 that includes all EC2 endpoints.

Correct answer

Deploy a Network Load Balancer in front of the EC2 instances in each Region. Use AWS Global Accelerator to route traffic to the most optimal Regional endpoint.

Overall explanation

An NLB is ideal for latency-sensitive applications and can listen on UDP for incoming requests. As Elastic Load Balancers are region-specific it is necessary to have an NLB in each Region in front of the EC2 instances.

To direct traffic based on optimal performance, AWS Global Accelerator can be used. GA will ensure traffic is routed across the AWS global network to the most optimal endpoint based on performance.

CORRECT: "Deploy a Network Load Balancer in front of the EC2 instances in each Region. Use AWS Global Accelerator to route traffic to the most optimal Regional endpoint" is the correct answer.

INCORRECT: "Deploy an Application Load Balancer in front of the EC2 instances in each Region. Use AWS WAF to direct traffic to the most optimal Regional endpoint" is incorrect. You cannot use WAF to direct traffic to endpoints based on performance.

INCORRECT: "Deploy an Amazon CloudFront distribution with a custom origin pointing to Amazon EC2 instances in multiple Regions" is incorrect. CloudFront cannot listen on UDP, it is used for HTTP/HTTPS.

INCORRECT: "Deploy Amazon EC2 instances in multiple Regions. Create a multivalue answer routing record in Amazon Route 53 that includes all EC2 endpoints" is incorrect. This configuration would not route incoming requests to the most optimal endpoint based on performance, it would provide multiple records in answers and traffic would be distributed across multiple Regions.

References:

https://docs.aws.amazon.com/global-accelerator/latest/dg/introduction-how-it-works.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-global-accelerator/

Domain

AWS Networking & Content Delivery

Question 65Skipped

A Financial Services company currently stores data in Amazon S3. Each bucket contains items which have different access patterns. The Chief Financial officer of the organization wants to reduce costs, as they have noticed a sharp increase in their S3 bill. The Chief Financial Officer wants to reduce the S3 spend as quickly as possible.

What is the quickest way to reduce the S3 spend with the LEAST operational overhead?

Automate the move of your S3 objects to the best storage class with AWS Trusted Advisor.

Place all objects in S3 Glacier Instant Retrieval.

Create a Lambda function to scan your S3 buckets, check which objects are stored in the appropriate buckets, and move them there.

Correct answer

Transition the objects to the appropriate storage class by using an S3 Lifecycle configuration.

Overall explanation

An S3 Lifecycle configuration is a set of rules that define actions that Amazon S3 applies to a group of objects. There are two types of actions:

● Transition actions – These actions define when objects transition to another storage class. For example, you might choose to transition objects to the S3 Standard-IA storage class 30 days after creating them, or archive objects to the S3 Glacier Flexible Retrieval storage class one year after creating them. For more information, see Using Amazon S3 storage classes.

● Expiration actions – These actions define when objects expire. Amazon S3 deletes expired objects on your behalf.

CORRECT: "Transition the objects to the appropriate storage class by using an S3 Lifecycle configuration” is the correct answer (as explained above.)

INCORRECT: "Automate the move of your S3 objects to the best storage class with AWS Trusted Advisor” is incorrect. Trusted Advisor does not automatically transfer objects into the most appropriate buckets. You can use Trusted Advisor to review cost optimization options, and check for public access to your buckets but you cannot automatically transition objects.

INCORRECT: "Create a Lambda function to scan your S3 buckets, check which objects are stored in the appropriate buckets, and move them there” is incorrect. You could perhaps build a Lambda function to do this, however the easiest way to do this would be to use an S3 Lifecycle configuration.

INCORRECT: "Place all objects in S3 Glacier Instant Retrieval” is incorrect. It states in the question that each bucket contains items which have different access patterns, therefore S3 Glacier is not a suitable use case.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries