AWS Certified Solutions Architect Associate Practice Exams

Practice Test 6: AWS Certified Solutions Architect Associate
Open

Practice Test 5: AWS Certified Solutions Architect…

Finish course

Set a certification due date

AWS Certified Solutions Architect – Associate

Course content

AI Assistant

Practice tests

Start

Practice Test 1: AWS Certified Solutions Architect Associate

Start

Practice Test 2: AWS Certified Solutions Architect Associate

Start

Practice Test 3: AWS Certified Solutions Architect Associate

Start

Practice Test 4: AWS Certified Solutions Architect Associate

Start

Practice Test 5: AWS Certified Solutions Architect Associate

Start

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

2025 AWS Certified Solutions Architect Associate Practice Tests [SAA-C03] + Exam Simulator + Explanations + Cheat Sheets

Rating: 4.5 out of 54.5
12,930 ratings

117,520

Students

390 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified Solutions Architect Associate exam the first time with a great score

EXAM SIMULATION: All Practice Tests are timed and scored (passing score is 72%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

REFERENCE LINKS: To help you understand AWS concepts, all answers link to sections of our online Training Notes (Cheat Sheets) with exam-specific information

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

ALWAYS UP TO DATE: Covering the latest SAA-C03 exam blueprint, our question bank is constantly updated based on student feedback from the real exam

MASTER THE CLOUD: Learn how to answer challenging scenario-based questions

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: Our discussion board provides a platform for students to ask questions, share their recent exam experiences, and offer feedback on exam topics

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Show moreShow less

Description

Are you preparing for the AWS Certified Solutions Architect Associate exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS Solutions Architect Associate practice exams to assess your exam-readiness!

These 6 AWS practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy, as demonstrated by the fantastic reviews from thousands of happy students. With our comprehensive AWS certification training course, you'll be well-equipped to pass your AWS Solutions Architect exam with flying colors.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Don't just take our word for it – check out our reviews, which confirm that our AWS practice questions closely match the exam pattern and difficulty. These practice tests will prepare you thoroughly for the real exam giving you the confidence you need to take and pass the test!

This SAA-C03 practice test course includes:

390 exam-style questions with detailed answers and explanations to reinforce your understanding of the core concepts

Test report that highlights the areas you need to focus on

Regular updates to reflect the latest exam content

Realistic exam simulation to help you build confidence in your ability to pass your exam

Free bonus material to help you succeed in your exam

TOP REASONS WHY THESE PRACTICE EXAMS ARE THE KEY TO ACING YOUR AWS EXAM

100% ALIGNED WITH SAA-C03 EXAM: All practice tests are 100% scenario-based reflecting the current AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DEEP DIVE REFERENCE LINKS: Our practice tests offer more than just answers – they link to relevant sections of our online "Training Notes," providing you with a comprehensive collection of exam-specific information for the SAA-C03 exam

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized, making it more challenging to ensure you're learning and not memorizing

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

ADDITIONAL LEARNING RESOURCES: To help you succeed in your exam, we've included free learning material (optional, requires name/email) that complements the course content

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered

BEST VALUE FOR MONEY: When investing in these tests you get lifetime access to all 6 sets of practice questions

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

MONEY-BACK GUARANTEE: 30-day money-back guarantee - no questions asked

WHAT DO OTHER STUDENTS SAY?

Our practice tests are widely regarded as the best, providing you with the preparation you need to confidently pass your AWS Certified Solutions Architect Associate exam with a great score. But don't just take our word for it – check out the excellent course reviews from our happy students, who achieved an average passing score of over 850!

"Well Crafted Questionnaire material, which will help you to gain the confidence on taking the exam. I greatly recommend anyone to take this practice text before appearing for the exam."

"Just passed the exam with a surprisingly good score and found that these practice exams were very helpful. I tried some other courses too but these questions were most similar to the AWS exam and the free training notes on the website were invaluable."

"I've never worked in architecture before and had very little experience in AWS. However, I was able to pass the CSAA exam with 92%, and I have to say that most of the credit goes to these practice exams. If you only buy one practice course, make it this one. I can't recommend it enough."

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the actual AWS exam has a passing score of 72%, we recommend that you retake our AWS practice exams until you consistently score 80% or higher. It's important to put in the effort and study the online training notes in detail. Once you achieve the recommended score in our practice tests, you'll be well-prepared to sit the AWS exam and achieve a remarkable score.

COVERING AWS FUNDAMENTALS: Through our AWS practice exams and online training notes, we cover the fundamentals of AWS Architecture and how to create performant, cost-optimized, and fault-tolerant applications. We also deep dive into individual services including Amazon S3, Amazon CloudFront, Amazon Storage Gateway, Amazon EC2, Amazon ECS, AWS IAM, AWS Lambda, Amazon RDS, Route 53, DynamoDB, RedShift, ElastiCache, Amazon Aurora, VPC, SQS, SNS, SWF, ElasticTranscoder, Amazon Kinesis, API Gateway, Direct Connect, Snowball, CloudWatch, CloudTrail and many more.

UNDERSTANDING AWS ARCHITECTURE: The AWS Certified Solutions Architect Associate exam consists entirely of scenario-based questions that assess your knowledge and experience with Amazon Web Services. Knowing the correct use of a particular AWS service and understanding the cost, operational, security, and performance implications of different design choices are essential for success. Our AWS practice exams are specifically designed to help beginners master these concepts and answer these questions accurately.

GET FAMILIAR WITH AWS EXAM FORMAT: Our AWS Certified Solutions Architect Associate practice exams help you get familiar with the test question format and structure, giving you an edge in the actual AWS exam. While many practice tests in the market do not match the exam pattern format, you can trust that our practice tests will thoroughly prepare you for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS Solutions Architect practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified Solutions Architect certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our practice exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

Who this course is for:

Students preparing for the AWS Certified Solutions Architect - Associate exam [SAA-C03]

Candidates for the AWS Certified Solutions Architect - Associate exam who are keen to ace their exam the first time

Students who have completed the AWS Certified Solutions Architect Associate video course from Neal Davis and are looking for some final test preparation

Students who wish to evaluate their AWS exam readiness by testing their skills through an exam simulation

Anyone who wants to learn AWS through high-quality questions and answers, in-depth explanations, and helpful reference links

IT professionals who want to enter any AWS technical job interview with confidence

Anyone who is keen to take their career and salary to the next level with an AWS Certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Featured review

Vijay Srinivas V.

6 courses

4 reviews

Rating: 5.0 out of 5 4 years ago

Good to take the practice tests, I had taken Neals tests which instills much confidence and he covers all the topics with detail explanation and especially for the Load Balancing/VPC related with very clear picture explanation which makes people understand the practical scenarios very much. Sincere Thanks! Vijay

Show moreShow less

Was this review helpful?

See all reviews (12,930)

Requirements

Before assessing your exam readiness, we highly recommend completing the AWS Certified Solutions Architect - Associate video course by Neal Davis. These instructor-led video lectures from Digital Cloud Training build the solid knowledge foundation preparing students for the final step of their AWS certification journey

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 6: AWS Certified Solutions Architect Associate

AWS Certified Solutions Architect Associate - Results

Back to result overview
Attempt 1

All domains

All domains

AWS Storage

AWS Compute

AWS Application Integration

AWS Migration & Transfer

AWS Networking & Content Delivery

AWS Management & Governance

AWS Database

AWS Security, Identity, & Compliance

AWS Cloud Architecture & Design

AWS Machine Learning

AWS Analytics

65 all

0 correct

0 incorrect

65 skipped

0 marked

Collapse all questions

Question 1Skipped

A company is deploying an analytics application on AWS Fargate. The application requires connected storage that offers concurrent access to files and high performance.

Which storage option should the solutions architect recommend?

1. Create an Amazon EBS volume for the application and establish an IAM role that allows Fargate to communicate with Amazon EBS.

1. Create an Amazon FSx for Lustre file share and establish an IAM role that allows Fargate to communicate with FSx for Lustre.

Correct answer

1. Create an Amazon EFS file share and establish an IAM role that allows Fargate to communicate with Amazon EFS.

1. Create an Amazon S3 bucket for the application and establish an IAM role for Fargate to communicate with Amazon S3.

Overall explanation

The Amazon Elastic File System offers concurrent access to a shared file system and provides high performance. You can create file system policies for controlling access and then use an IAM role that is specified in the policy for access.

CORRECT: "Create an Amazon EFS file share and establish an IAM role that allows Fargate to communicate with Amazon EFS" is the correct answer.

INCORRECT: "Create an Amazon S3 bucket for the application and establish an IAM role for Fargate to communicate with Amazon S3" is incorrect. S3 uses a REST API not a file system API so access can be shared but is not concurrent.

INCORRECT: "Create an Amazon EBS volume for the application and establish an IAM role that allows Fargate to communicate with Amazon EBS" is incorrect. EBS volumes cannot be shared amongst Fargate tasks, they are used with EC2 instances.

INCORRECT: "Create an Amazon FSx for Lustre file share and establish an IAM role that allows Fargate to communicate with FSx for Lustre" is incorrect. It is not supported to connect Fargate to FSx for Lustre.

References:

https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-efs/

Domain

AWS Storage

Question 2Skipped

A cloud architect is assessing the resilience of a web application deployed on AWS. It was observed that the application experienced a downtime of about 3 minutes when a scheduled failover was performed on the application's Amazon RDS MySQL database as part of a scaling operation.

The organization wants to mitigate such downtime in future scaling exercises while minimizing operational overhead.

Which solution will be the MOST effective in achieving this?

Establish a secondary RDS MySQL cluster within the same AWS Region. During any future failover, modify the application to connect to the secondary cluster's writer endpoint.

Implement more RDS MySQL read replicas in the cluster to manage the load during the failover.

Implement an Amazon ElastiCache for Redis cluster to manage the load during the failover.

Correct answer

Configure an Amazon RDS Proxy for the database and modify the application to connect to the proxy endpoint.

Overall explanation

Amazon RDS Proxy is a fully managed, highly available database proxy for Amazon RDS that makes applications more scalable, more resilient to database failures, and more secure.

During a failover, RDS Proxy automatically connects to a standby database instance while preserving connections from your application and reducing failover times for RDS and Aurora multi-AZ databases. So, there is minimal downtime for the application.

CORRECT: "Configure an Amazon RDS Proxy for the database and modify the application to connect to the proxy endpoint" is the correct answer (as explained above.)

INCORRECT: "Implement more RDS MySQL read replicas in the cluster to manage the load during the failover" is incorrect.

Adding more read replicas to the cluster does not decrease the downtime during a failover. It only improves the database's ability to handle read-heavy workloads. Read replicas do not contribute to a faster failover process.

INCORRECT: "Establish a secondary RDS MySQL cluster within the same AWS Region. During any future failover, modify the application to connect to the secondary cluster's writer endpoint" is incorrect.

This approach is operationally heavy as it involves managing two separate RDS clusters and manually updating the application's database endpoint during a failover. Moreover, it does not necessarily reduce the downtime during a failover as there might be data inconsistency issues between the primary and secondary clusters, depending on the replication latency.

INCORRECT: "Implement an Amazon ElastiCache for Redis cluster to manage the load during the failover" is incorrect.

ElastiCache is an in-memory cache and not a relational database service. It is typically used to cache frequently accessed data to reduce latency and improve application performance, not for managing failovers.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Compute

Question 3Skipped

An application makes calls to a REST API running on Amazon EC2 instances behind an Application Load Balancer (ALB). Most API calls complete quickly. However, a single endpoint is making API calls that require much longer to complete and this is introducing overall latency into the system. What steps can a Solutions Architect take to minimize the effects of the long-running API calls?

Change the ALB to a Network Load Balancer (NLB) and use SSL/TLS termination

Correct answer

Create an Amazon SQS queue and decouple the long-running API calls

Change the EC2 instance to one with enhanced networking to reduce latency

Increase the ALB idle timeout to allow the long-running requests to complete

Overall explanation

An Amazon Simple Queue Service (SQS) can be used to offload and decouple the long-running requests. They can then be processed asynchronously by separate EC2 instances. This is the best way to reduce the overall latency introduced by the long-running API call.

CORRECT: "Create an Amazon SQS queue and decouple the long-running API calls" is the correct answer.

INCORRECT: "Change the EC2 instance to one with enhanced networking to reduce latency" is incorrect. This will not reduce the latency of the API call as network latency is not the issue here, it is the latency of how long the API call takes to complete.

INCORRECT: "Increase the ALB idle timeout to allow the long-running requests to complete" is incorrect. The issue is not the connection being interrupted, it is that the API call takes a long time to complete.

INCORRECT: "Change the ALB to a Network Load Balancer (NLB) and use SSL/TLS termination" is incorrect. SSL/TLS termination is not of benefit here as the problem is not encryption or processing of encryption. The issue is API call latency.

References:

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/welcome.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 4Skipped

A company operates a critical Python-based application that analyzes incoming real-time data. The application runs every 15 minutes and takes approximately 2 minutes to complete a run. It requires 1.5 GB of memory and uses the CPU intensively during its operation. The company wants to minimize the costs associated with running this application.

Which solution will meet these requirements?

Use AWS App2Container (A2C) to containerize the application. Run the application as an Amazon Elastic Container Service (Amazon ECS) task on AWS Fargate with 1 virtual CPU (vCPU) and 1.5 GB of memory.

Deploy the application on an Amazon EC2 instance and manually start and stop the instance in alignment with the schedule of the application run.

Use AWS App2Container (A2C) to containerize the application. Deploy the container on an Amazon EC2 instance, configure an Amazon CloudWatch alarm to stop the instance when the application is not running.

Correct answer

Implement the application as an AWS Lambda function configured with 1.5 GB of memory. Use Amazon EventBridge to schedule the function to run every 15 minutes.

Overall explanation

This is the most cost-effective solution. AWS Lambda is designed for running code in response to events or on a schedule, and you only pay for the compute time that you consume.

Configuring the function with 1.5GB memory would ensure the function has enough resources, and using Amazon EventBridge for scheduling would enable running the function every 15 minutes.

CORRECT: "Implement the application as an AWS Lambda function configured with 1.5 GB of memory. Use Amazon EventBridge to schedule the function to run every 15 minutes" is the correct answer (as explained above.)

INCORRECT: "Use AWS App2Container (A2C) to containerize the application. Run the application as an Amazon Elastic Container Service (Amazon ECS) task on AWS Fargate with 1 virtual CPU (vCPU) and 1.5 GB of memory" is incorrect.

This is not the most cost-effective solution. Even though AWS App2Container (A2C) would help in containerizing the application and AWS Fargate would abstract the need to manage underlying EC2 instances, it is still an overkill for an application that runs for short durations intermittently. It would still result in paying for unused compute resources.

INCORRECT: "Use AWS App2Container (A2C) to containerize the application. Deploy the container on an Amazon EC2 instance, configure an Amazon CloudWatch alarm to stop the instance when the application is not running" is incorrect.

AWS App2Container (A2C) is used to help containerize applications, but this does not optimize for cost because it requires running an EC2 instance continuously and stopping the instance when not in use can be complex and might not be timely, resulting in potential unnecessary costs.

INCORRECT: "Deploy the application on an Amazon EC2 instance and manually start and stop the instance in alignment with the schedule of the application run" is incorrect.

This solution involves significant manual intervention and managing EC2 instances. While it can work, it's not an optimized way, especially in terms of cost and operation overhead. It does not take advantage of the pay-per-use model and automatic scaling provided by AWS Lambda.

References:

https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-run-lambda-schedule.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Compute

Question 5Skipped

A company needs to store data from an application. Data in the application changes frequently. All levels of stored data must be audited under a new regulation which the company adheres to.

Application storage capacity is running out on the company's on-premises infrastructure. To comply with the new regulation, a solutions architect must offload some data securely to AWS to relieve the on-premises capacity issues.

Which solution will meet these requirements?

The existing data can be transferred to Amazon S3 with the help of Amazon S3 Transfer Acceleration. Log data events using AWS CloudTrail.

Correct answer

Use AWS Storage Gateway to move the existing data to Amazon S3. Use AWS CloudTrail to log management events.

Move existing data to Amazon S3 using AWS DataSync. Log data events using AWS CloudTrail.

Move the existing data to Amazon S3 with AWS Snowcone. Using AWS CloudTrail, you can log management events.

Overall explanation

AWS Storage Gateway is a set of hybrid cloud storage services that provide on-premises access to virtually unlimited cloud storage. Secondly AWS CloudTrail monitors and records account activity across your AWS infrastructure, giving you control over storage, analysis, and remediation actions.

CORRECT: "Use AWS Storage Gateway to move the existing data to Amazon S3. Use AWS CloudTrail to log management events" is the correct answer (as explained above.)

INCORRECT: "Move existing data to Amazon S3 using AWS DataSync. Log data events using AWS CloudTrail” is incorrect. AWS DataSync is a secure, online service that automates and accelerates moving data between on-premises and AWS storage service and is not designed as a hybrid storage service.

INCORRECT: "The existing data can be transferred to Amazon S3 with the help of Amazon S3 Transfer Acceleration. Log data events using AWS CloudTrail” is incorrect. Amazon S3 Transfer Acceleration is a bucket-level feature that enables fast, easy, and secure transfers of files over long distances between your client and an S3 bucket. Transfer Acceleration is designed to optimize transfer speeds from across the world into S3 buckets and is not a migration service.

INCORRECT: "Move the existing data to Amazon S3 with AWS Snowcone. Using AWS CloudTrail, you can log management events" is incorrect. AWS Snowcone is not suitable as a hybrid cloud service.

References:

https://aws.amazon.com/storagegateway/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-storage-gateway/

Domain

AWS Migration & Transfer

Question 6Skipped

A data analytics company is building a high-performance application that requires concurrent writes to a shared block storage volume from multiple Amazon EC2 instances.

The EC2 instances are Nitro-based and reside within the same Availability Zone. The company needs a storage solution that supports simultaneous connections to facilitate data resilience and high availability.

Which solution will meet these requirements?

Correct answer

Use Provisioned IOPS SSD (io2) EBS volumes with Amazon EBS Multi-Attach.

Use General Purpose SSD (gp2) EBS volumes with Amazon EBS Multi-Attach.

Use Amazon S3 with S3 Transfer Acceleration to enhance speed.

Use Amazon EFS with NFSv4.1 protocol across multiple EC2 instances.

Overall explanation

io2 volumes are designed for I/O-intensive workloads, particularly database workloads, that require high performance and low latency. io1 and io2 volumes support Multi-Attach, which enables you to attach a single volume to multiple EC2 instances in the same Availability Zone.

CORRECT: "Use Provisioned IOPS SSD (io2) EBS volumes with Amazon EBS Multi-Attach" is the correct answer (as explained above.)

INCORRECT: "Use Amazon EFS with NFSv4.1 protocol across multiple EC2 instances" is incorrect.

Amazon Elastic File System (EFS) is a scalable file storage for use with Amazon EC2. You can use an Amazon EFS file system as a common data source for workloads and applications running on multiple instances, but it does not provide the block-level storage required for high IOPS operations.

INCORRECT: "Use Amazon S3 with S3 Transfer Acceleration to enhance speed" is incorrect.

Amazon S3 is an object storage service. While S3 Transfer Acceleration does enhance the speed of in-transit file transfers, it is not a block storage solution, it is an object storage solution and is not suitable for this use case.

INCORRECT: "Use General Purpose SSD (gp2) EBS volumes with Amazon EBS Multi-Attach" is incorrect.

Amazon EBS Multi-Attach only supports io1 and io2 volumes, and it is not supported on gp2 volumes.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volumes-multi.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ebs/

Domain

AWS Compute

Question 7Skipped

A media company hosts several terabytes of multimedia content across multiple AWS accounts. The company uses AWS Lake Formation to manage its data lake. The company's marketing team needs to securely access and analyze selective data from various accounts for targeted advertisement campaigns.

Which solution will meet these requirements with the LEAST operational overhead?

Correct answer

Utilize Lake Formation tag-based access control to authorize and grant cross-account permissions for the required data to the marketing team accounts.

Use the Lake Formation permissions Grant command in each account where the data is stored to permit the required marketing team users to access the data.

Replicate the required data to a shared account. Create an IAM access role in that account. Grant access by defining a permission policy that includes users from the marketing team accounts as trusted entities.

Use AWS DataSync to synchronize the necessary data to the marketing team accounts.

Overall explanation

With Lake Formation tag-based access control, you can manage permissions using tags and grant cross-account permissions, which would meet the requirements with the least operational overhead.

CORRECT: "Utilize Lake Formation tag-based access control to authorize and grant cross-account permissions for the required data to the marketing team accounts" is the correct answer (as explained above.)

INCORRECT: "Replicate the required data to a shared account. Create an IAM access role in that account. Grant access by defining a permission policy that includes users from the marketing team accounts as trusted entities" is incorrect.

This solution involves the unnecessary replication of data, leading to increased storage costs and operational overhead.

INCORRECT: "Use the Lake Formation permissions Grant command in each account where the data is stored to permit the required marketing team users to access the data" is incorrect.

The Grant command would need to be manually executed in each account where data is stored, which could lead to increased operational overhead, particularly if the data is spread across many accounts.

INCORRECT: "Use AWS DataSync to synchronize the necessary data to the marketing team accounts" is incorrect.

AWS DataSync is designed for online data transfer, not for granting access permissions to data already stored in AWS, so this would not meet the requirement.

References:

https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html

Domain

AWS Storage

Question 8Skipped

A healthcare company is migrating its patient record system to AWS. The company receives thousands of encrypted patient data files every day through FTP. An on-premises server processes the data files twice a day. However, the processing job takes hours to finish.

The company wants the AWS solution to process incoming data files as soon as they arrive with minimal changes to the FTP clients that send the files. The solution must delete the incoming data files after the files have been processed successfully. Processing for each file needs to take around 10 minutes.

Which solution will meet these requirements in the MOST operationally efficient way?

Correct answer

Use AWS Transfer Family to create an SFTP server to store incoming files in Amazon S3 Standard. Create an AWS Lambda function to process the files and to delete the files after they are processed. Use an S3 event notification to invoke the Lambda function when the files arrive.

Use AWS Transfer Family to create an SFTP server to store incoming files in Amazon S3 Standard. Use Amazon EC2 instances managed by an Auto Scaling group to process the files. Set an S3 event notification to trigger an AWS Lambda function that launches the EC2 instances when the files arrive. Delete the files after they are processed.

Use AWS Transfer Family to create an SFTP server to store incoming files in Amazon S3 Glacier. Configure an Amazon EC2 instance to process the files. Use Amazon EventBridge rules to invoke the EC2 instance to process the files twice a day from S3 Glacier. Delete the objects after the job has processed the objects.

Use an Amazon EC2 instance that runs an SFTP server to store incoming files in Amazon S3 Standard. Configure a job queue in AWS Batch. Use Amazon EventBridge rules to invoke the job to process the files twice a day. Delete the files after the job has processed the files.

Overall explanation

AWS Transfer Family provides fully managed support for file transfers directly into and out of Amazon S3 using SFTP. Storing incoming files in S3 Standard offers high durability, availability, and performance object storage for frequently accessed data.

AWS Lambda can respond immediately to S3 events, which allows processing of files as soon as they arrive. Lambda can also delete the files after processing. This meets all requirements and is operationally efficient, as it requires minimal management and has low costs.

CORRECT: "Use AWS Transfer Family to create an SFTP server to store incoming files in Amazon S3 Standard. Create an AWS Lambda function to process the files and to delete the files after they are processed. Use an S3 event notification to invoke the Lambda function when the files arrive" is the correct answer (as explained above.)

INCORRECT: "Use AWS Transfer Family to create an SFTP server to store incoming files in Amazon S3 Glacier. Configure an Amazon EC2 instance to process the files. Use Amazon EventBridge rules to invoke the EC2 instance to process the files twice a day from S3 Glacier. Delete the objects after the job has processed the objects" is incorrect.

This option involves using Amazon S3 Glacier, which is primarily used for long-term archival storage. Accessing data for processing could take longer and be more expensive than using S3 Standard. In addition, EC2 instances need to be managed and are less efficient for this scenario compared to AWS Lambda.

INCORRECT: "Use AWS Transfer Family to create an SFTP server to store incoming files in Amazon S3 Standard. Use Amazon EC2 instances managed by an Auto Scaling group to process the files. Set an S3 event notification to trigger an AWS Lambda function that launches the EC2 instances when the files arrive. Delete the files after they are processed" is incorrect.

While this solution will work, it is less efficient operationally because managing EC2 instances and an Auto Scaling group is more complex and likely more expensive than simply using AWS Lambda for processing.

INCORRECT: "Use an Amazon EC2 instance that runs an SFTP server to store incoming files in Amazon S3 Standard. Configure a job queue in AWS Batch. Use Amazon EventBridge rules to invoke the job to process the files twice a day. Delete the files after the job has processed the files" is incorrect.

This option does not meet the requirement of processing incoming data files as soon as they arrive, as EventBridge rules would invoke the job only twice a day. It also involves managing an EC2 instance, which is less operationally efficient than the AWS Transfer Family and AWS Lambda option.

References:

https://aws.amazon.com/aws-transfer-family/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 9Skipped

Three AWS accounts are owned by the same company but in different regions. Account Z has two AWS Direct Connect connections to two separate company offices. Accounts A and B require the ability to route across account Z’s Direct Connect connections to each company office. A Solutions Architect has created an AWS Direct Connect gateway in account Z.

How can the required connectivity be configured?

Create a PrivateLink connection in Account Z and ENIs in accounts A and B

Correct answer

Associate the Direct Connect gateway to a virtual private gateway in account A and B

Create a VPC Endpoint to the Direct Connect gateway in account A and B

Associate the Direct Connect gateway to a transit gateway in each region

Overall explanation

You can associate an AWS Direct Connect gateway with either of the following gateways:

- A transit gateway when you have multiple VPCs in the same Region.

- A virtual private gateway.

In this case account Z owns the Direct Connect gateway so a VPG in accounts A and B must be associated with it to enable this configuration to work. After Account Z accepts the proposals, Account A and Account B can route traffic from their virtual private gateway to the Direct Connect gateway.

CORRECT: "Associate the Direct Connect gateway to a virtual private gateway in account A and B" is the correct answer.

INCORRECT: "Associate the Direct Connect gateway to a transit gateway in each region" is incorrect. This would be a good solution if the accounts were in VPCs within a region rather than across regions.

INCORRECT: "Create a VPC Endpoint to the Direct Connect gateway in account A and B" is incorrect. You cannot create a VPC endpoint for Direct Connect gateways.

INCORRECT: "Create a PrivateLink connection in Account Z and ENIs in accounts A and B" is incorrect. You cannot use PrivateLink connections to publish a Direct Connect gateway.

References:

https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-direct-connect/

Domain

AWS Networking & Content Delivery

Question 10Skipped

A telecommunication company has an API that allows users to manage their mobile plans and services. The API experiences significant traffic spikes during specific times such as end of the month and special offer periods. The company needs to ensure low latency response time consistently to ensure a good user experience. The solution should also minimize operational overhead.

Which solution would meet these requirements MOST efficiently?

Use Amazon API Gateway with AWS Fargate tasks to handle the API requests.

Correct answer

Use Amazon API Gateway along with AWS Lambda functions with provisioned concurrency.

Implement the API using AWS Elastic Beanstalk with auto-scaling groups.

Implement the API on an Amazon EC2 instance behind an Application Load Balancer with manual scaling.

Overall explanation

Amazon API Gateway and AWS Lambda together make a highly scalable solution for APIs. Provisioned concurrency in Lambda ensures that there is always a warm pool of functions ready to quickly respond to API requests, thereby guaranteeing low latency even during peak traffic times.

CORRECT: "Use Amazon API Gateway along with AWS Lambda functions with provisioned concurrency" is the correct answer (as explained above.)

INCORRECT: "Implement the API using AWS Elastic Beanstalk with auto-scaling groups" is incorrect.

Elastic Beanstalk is a viable option for deploying applications and auto-scaling and can help handle increased traffic, but it doesn't guarantee the low latency requirement during peak traffic times.

INCORRECT: "Use Amazon API Gateway with AWS Fargate tasks to handle the API requests" is incorrect.

API Gateway with Fargate can provide scalable compute, but this approach can result in higher operational overhead because of the need to manage the container lifecycle.

INCORRECT: "Implement the API on an Amazon EC2 instance behind an Application Load Balancer with manual scaling" is incorrect.

This solution does not scale automatically and would require manual intervention to ensure optimal performance during traffic spikes. Therefore, it doesn't satisfy the requirement of minimizing operational overhead.

References:

https://docs.aws.amazon.com/lambda/latest/dg/provisioned-concurrency.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-api-gateway/

Domain

AWS Networking & Content Delivery

Question 11Skipped

An application uses a MySQL database running on an Amazon EC2 instance. The application generates high I/O and constant writes to a single table on the database. Which Amazon EBS volume type will provide the MOST consistent performance and low latency?

Cold HDD (sc1)

Correct answer

Provisioned IOPS SSD (io1)

Throughput Optimized HDD (st1)

General Purpose SSD (gp2)

Overall explanation

The Provisioned IOPS SSD (io1) volume type will offer the most consistent performance and can be configured with the amount of IOPS required by the application. It will also provide the lowest latency of the options presented.

CORRECT: "Provisioned IOPS SSD (io1)" is the correct answer.

INCORRECT: "General Purpose SSD (gp2)" is incorrect. This is not the best solution for when you require high I/O, consistent performance and low latency.

INCORRECT: "Throughput Optimized HDD (st1)" is incorrect. This is a HDD type of disk and not suitable for low latency workloads that require consistent performance.

INCORRECT: "Cold HDD (sc1)" is incorrect. This is the lowest cost option and not suitable for frequently accessed workloads.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ebs/

Domain

AWS Compute

Question 12Skipped

A multinational organization has a distributed application that runs on Amazon EC2 instances, which are behind an Application Load Balancer in an Auto Scaling group. The application utilizes a MySQL database hosted on Amazon Aurora. The database cluster spans across multiple Availability Zones in a single region.

The organization plans to launch its services in a new geographical area and wants to ensure maximum availability with minimal service interruption.

Which strategy should the organization adopt?

Create a similar application layer in the new region. Establish a new Aurora MySQL database in this region. Use AWS Database Migration Service (AWS DMS) for ongoing replication from the primary database to the new region. Implement Amazon Route 53 health checks with a failover routing policy to the new region.

Expand the existing Auto Scaling group into the new Region. Utilize Amazon Aurora Global Database to extend the database across the primary and new regions. Implement Amazon Route 53 health checks with a failover routing policy directed towards the new region.

Correct answer

Establish the application layer in the new region. Use Amazon Aurora Global Database for deploying the database in the primary and new regions. Apply Amazon Route 53 health checks with a failover routing policy to the new region. Promote the secondary to primary as needed.

Replicate the application layer in the new region. Implement an Aurora MySQL Read Replica in the new region using Route 53 health checks and a failover routing policy. In case of primary failure, promote the Read Replica to primary.

Overall explanation

This solution involves creating an application layer in the new region and using Amazon Aurora Global Database, which supports replicating your databases across multiple regions with minimal impact on performance.

This configuration can enhance disaster recovery capabilities and can reduce the impact of planned maintenance. Amazon Route 53 health checks with a failover routing policy can automatically route traffic to the new region in the event of a failure in the primary region, thereby ensuring high availability.

With an Aurora global database, there are two different approaches to failover depending on the scenario. You can use manual unplanned failover (detach and promote) or managed planned failover.

CORRECT: "Establish the application layer in the new region. Use Amazon Aurora Global Database for deploying the database in the primary and new regions. Apply Amazon Route 53 health checks with a failover routing policy to the new region. Perform a manual failover as required" is the correct answer (as explained above.)

INCORRECT: "Replicate the application layer in the new region. Implement an Aurora MySQL Read Replica in the new region using Route 53 health checks and a failover routing policy. In case of primary failure, promote the Read Replica to primary" is incorrect.

This solution involves creating a Read Replica in the new region, which would indeed allow for the promotion of the Read Replica to a primary instance if necessary. However, this process isn't instantaneous and could lead to service interruption, which is not what the question asked for. Aurora Global Database provides a lower RTO/RPO.

INCORRECT: "Create a similar application layer in the new region. Establish a new Aurora MySQL database in this region. Use AWS Database Migration Service (AWS DMS) for ongoing replication from the primary database to the new region. Implement Amazon Route 53 health checks with a failover routing policy to the new region" is incorrect.

AWS Database Migration Service (AWS DMS) is primarily used for migrating databases to AWS from on-premises environments or for replicating databases for data warehousing and other use cases. It isn't as suitable for ongoing high-availability or failover scenarios as Amazon Aurora Global Database, which is specifically designed for these situations.

INCORRECT: "Expand the existing Auto Scaling group into the new Region. Utilize Amazon Aurora Global Database to extend the database across the primary and new regions. Implement Amazon Route 53 health checks with a failover routing policy directed towards the new region" is incorrect.

It is not possible to expand an Auto Scaling group across multiple Regions. ASGs operate within a Region only.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-disaster-recovery.html#aurora-global-database-failover

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Compute

Question 13Skipped

An e-commerce company operates a serverless web application that must interact with numerous Amazon DynamoDB tables to fulfill user requests. It is critical that the application's performance remains consistent and unaffected while interacting with these tables.

Which method provides the MOST operationally efficient way to fulfill these requirements?

AWS Lambda with Step Functions.

Amazon S3 with Lambda triggers.

Correct answer

AWS AppSync with multiple data sources and resolvers.

AWS Glue with a DynamoDB connector.

Overall explanation

AWS AppSync simplifies application development by letting you create a flexible API to securely access, manipulate, and combine data from one or more data sources. AppSync is a managed service that uses GraphQL to make it easy for applications to get exactly the data they need, including from multiple DynamoDB tables.

AWS AppSync is designed for real-time and offline data access which makes it an ideal solution for this scenario.

CORRECT: "AWS AppSync with multiple data sources and resolvers" is the correct answer (as explained above.)

INCORRECT: "AWS Lambda with Step Functions" is incorrect.

AWS Step Functions make it easy to coordinate the components of distributed applications and microservices using visual workflows. However, while you could theoretically build a flow to retrieve data from multiple tables, it's not the most efficient solution as it introduces additional complexity and potential latency.

INCORRECT: "Amazon S3 with Lambda triggers" is incorrect.

While you can use AWS Lambda to execute code in response to triggers like changes to data in an Amazon S3 bucket, this doesn't directly allow the application to retrieve data from multiple DynamoDB tables. This approach would also involve unnecessary data transfers and added latency.

INCORRECT: "AWS Glue with a DynamoDB connector" is incorrect.

AWS Glue is a fully managed extract, transform, and load (ETL) service that makes it easy to prepare and load your data for analytics. However, AWS Glue isn't meant for real-time data retrieval in an application. Using it for real-time data retrieval would likely be overcomplicated and inefficient.

References:

https://aws.amazon.com/appsync/product-details/

Domain

AWS Compute

Question 14Skipped

A company operates multiple AWS accounts under AWS Organizations. To better manage the costs, the company wants to allocate different budgets for each of these accounts. The company also wants to prevent additional resource provisioning in an AWS account if it reaches its allocated budget before the end of the budget period.

Which combination of solutions will meet these requirements? (Select THREE.)

Correct selection

Set up an IAM role with the necessary permissions that allow AWS Budgets to execute budget actions.

Create an IAM user with adequate permissions to allow AWS Budgets to enforce budget actions.

Correct selection

Configure alerts in AWS Budgets to notify the company when an account is about to reach its budget threshold. Then use a budget action that links to the IAM role to prevent additional resource provisioning.

Set up an alert in AWS Budgets to notify the company when a particular account meets its budget threshold. Enable real-time monitoring for immediate notification.

Correct selection

Use AWS Budgets to establish different budgets for each AWS account. Configure the budgets in the Billing and Cost Management console.

Use AWS Budgets in the AWS Management Console to set up budgets and specify the cost threshold for each AWS account.

Overall explanation

AWS Budgets is a tool that enables you to set custom cost and usage budgets. You can set your budget amount, and AWS provides you with estimated charges and forecasted costs for your AWS usage. Configuring the budgets in the Billing and Cost Management console is a recommended step.

AWS Budgets can execute budget actions (like preventing additional resource provisioning) using an IAM role with the necessary permissions.

Configuring alerts in AWS Budgets and linking a budget action to an IAM role for automatic prevention of additional resource provisioning is a correct and efficient way to manage costs.

CORRECT: "Use AWS Budgets to establish different budgets for each AWS account. Configure the budgets in the Billing and Cost Management console" is a correct answer (as explained above.)

CORRECT: "Set up an IAM role with the necessary permissions that allow AWS Budgets to execute budget actions" is also a correct answer (as explained above.)

CORRECT: "Configure alerts in AWS Budgets to notify the company when an account is about to reach its budget threshold. Then use a budget action that links to the IAM role to prevent additional resource provisioning" is also a correct answer (as explained above.)

INCORRECT: "Use AWS Budgets in the AWS Management Console to set up budgets and specify the cost threshold for each AWS account" is incorrect.

While AWS Budgets can indeed be set up in the AWS Management Console, the budgets aren't set in the context of cost thresholds for each AWS account. This option is not fully accurate.

INCORRECT: "Create an IAM user with adequate permissions to allow AWS Budgets to enforce budget actions" is incorrect.

Although you can create an IAM user with necessary permissions, using an IAM role is generally a better practice. An IAM user is an entity that you create in AWS to represent the person or service that uses it to interact with AWS, while an IAM role is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. A role does not have long-term credentials associated with it like an IAM user does.

INCORRECT: "Set up an alert in AWS Budgets to notify the company when a particular account meets its budget threshold. Enable real-time monitoring for immediate notification" is incorrect.

AWS Budgets doesn't allow for real-time monitoring; the data can be delayed up to 24 hours. The frequency of budget alert notifications is not customizable to the minute or hour; they are typically sent out daily, weekly, or when a certain threshold is crossed.

References:

https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-controls.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cost-management/

Domain

AWS Management & Governance

Question 15Skipped

The database layer of an on-premises web application is being migrated to AWS. The database currently uses an in-memory cache. A Solutions Architect must deliver a solution that supports high availability and replication for the caching layer.

Which service should the Solutions Architect recommend?

Amazon RDS Multi-AZ

Amazon ElastiCache Memcached

Amazon DynamoDB

Correct answer

Amazon ElastiCache Redis

Overall explanation

Amazon ElastiCache Redis is an in-memory database cache and supports high availability through replicas and multi-AZ. The table below compares ElastiCache Redis with Memcached:

CORRECT: "Amazon ElastiCache Redis" is the correct answer.

INCORRECT: "Amazon ElastiCache Memcached" is incorrect as it does not support high availability or multi-AZ.

INCORRECT: "Amazon RDS Multi-AZ" is incorrect. This is not an in-memory database and it not suitable for use as a caching layer.

INCORRECT: "Amazon DynamoDB" is incorrect. DynamoDB is a non-relational database. You would not use it for a caching layer. Also, the in-memory, low-latency caching for DynamoDB is implemented using DynamoDB Accelerator (DAX).

References:

https://aws.amazon.com/elasticache/redis-vs-memcached/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-elasticache/

Domain

AWS Database

Question 16Skipped

A High Performance Computing (HPC) application needs storage that can provide 135,000 IOPS. The storage layer is replicated across all instances in a cluster.

What is the optimal storage solution that provides the required performance and is cost-effective?

Use Amazon EBS Provisioned IOPS volume with 135,000 IOPS

Use Amazon EC2 Enhanced Networking with an EBS HDD Throughput Optimized volume

Correct answer

Use Amazon Instance Store

Use Amazon S3 with byte-range fetch

Overall explanation

Instance stores offer very high performance and low latency. As long as you can afford to lose an instance, i.e. you are replicating your data, these can be a good solution for high performance/low latency requirements. Also, the cost of instance stores is included in the instance charges so it can also be more cost-effective than EBS Provisioned IOPS.

CORRECT: "Use Amazon Instance Store" is the correct answer.

INCORRECT: "Use Amazon EBS Provisioned IOPS volume with 135,000 IOPS" is incorrect. In the case of a HPC cluster that replicates data between nodes you don’t necessarily need a shared storage solution such as Amazon EBS Provisioned IOPS – this would also be a more expensive solution as the Instance Store is included in the cost of the HPC instance.

INCORRECT: "Use Amazon S3 with byte-range fetch" is incorrect. Amazon S3 is not a solution for this HPC application as in this case it will require block-based storage to provide the required IOPS.

INCORRECT: "Enhanced networking provides higher bandwidth and lower latency and is implemented using an Elastic Network Adapter (ENA). However, using an ENA with an HDD Throughput Optimized volume is not recommended and the volume will not provide the performance required for this use case." is incorrect

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

https://digitalcloud.training/amazon-ebs/

Domain

AWS Storage

Question 17Skipped

A new application will be launched on an Amazon EC2 instance with an Elastic Block Store (EBS) volume. A solutions architect needs to determine the most cost-effective storage option. The application will have infrequent usage, with peaks of traffic for a couple of hours in the morning and evening. Disk I/O is variable with peaks of up to 3,000 IOPS.

Which solution should the solutions architect recommend?

Correct answer

Amazon EBS General Purpose SSD (gp2)

Amazon EBS Throughput Optimized HDD (st1)

Amazon EBS Cold HDD (sc1)

Amazon EBS Provisioned IOPS SSD (io1)

Overall explanation

General Purpose SSD (gp2) volumes offer cost-effective storage that is ideal for a broad range of workloads. These volumes deliver single-digit millisecond latencies and the ability to burst to 3,000 IOPS for extended periods of time.

Between a minimum of 100 IOPS (at 33.33 GiB and below) and a maximum of 16,000 IOPS (at 5,334 GiB and above), baseline performance scales linearly at 3 IOPS per GiB of volume size. AWS designs gp2 volumes to deliver their provisioned performance 99% of the time. A gp2 volume can range in size from 1 GiB to 16 TiB.

In this case the volume would have a baseline performance of 3 x 200 = 600 IOPS. The volume could also burst to 3,000 IOPS for extended periods. As the I/O varies, this should be suitable.

CORRECT: "Amazon EBS General Purpose SSD (gp2)" is the correct answer.

INCORRECT: "Amazon EBS Provisioned IOPS SSD (io1) " is incorrect as this would be a more expensive option and is not required for the performance characteristics of this workload.

INCORRECT: "Amazon EBS Cold HDD (sc1)" is incorrect as there is no IOPS SLA for HDD volumes and they would likely not perform well enough for this workload.

INCORRECT: "Amazon EBS Throughput Optimized HDD (st1)" is incorrect as there is no IOPS SLA for HDD volumes and they would likely not perform well enough for this workload.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ebs/

Domain

AWS Compute

Question 18Skipped

A company runs a streaming media service and the content is stored on Amazon S3. The media catalog server pulls updated content from S3 and can issue over 1 million read operations per second for short periods. Latency must be kept under 5ms for these updates. Which solution will provide the BEST performance for the media catalog updates?

Correct answer

Update the application code to use an Amazon ElastiCache for Redis cluster

Implement Amazon CloudFront and cache the content at Edge Locations

Update the application code to use an Amazon DynamoDB Accelerator cluster

Implement an Instance store volume on the media catalog server

Overall explanation

Some applications, such as media catalog updates require high frequency reads, and consistent throughput. For such applications, customers often complement S3 with an in-memory cache, such as Amazon ElastiCache for Redis, to reduce the S3 retrieval cost and to improve performance.

ElastiCache for Redis is a fully managed, in-memory data store that provides sub-millisecond latency performance with high throughput. ElastiCache for Redis complements S3 in the following ways:

- Redis stores data in-memory, so it provides sub-millisecond latency and supports incredibly high requests per second.

- It supports key/value based operations that map well to S3 operations (for example, GET/SET => GET/PUT), making it easy to write code for both S3 and ElastiCache.

- It can be implemented as an application side cache. This allows you to use S3 as your persistent store and benefit from its durability, availability, and low cost. Your applications decide what objects to cache, when to cache them, and how to cache them.

In this example the media catalog is pulling updates from S3 so the performance between these components is what needs to be improved. Therefore, using ElastiCache to cache the content will dramatically increase the performance.

CORRECT: "Update the application code to use an Amazon ElastiCache for Redis cluster" is the correct answer.

INCORRECT: "Implement Amazon CloudFront and cache the content at Edge Locations" is incorrect. CloudFront is good for getting media closer to users but in this case we’re trying to improve performance within the data center moving data from S3 to the media catalog server.

INCORRECT: "Update the application code to use an Amazon DynamoDB Accelerator cluster" is incorrect. DynamoDB Accelerator (DAX) is used with DynamoDB but is unsuitable for use with Amazon S3.

INCORRECT: "Implement an Instance store volume on the media catalog server" is incorrect. This will improve local disk performance but will not improve reads from Amazon S3.

References:

https://aws.amazon.com/blogs/storage/turbocharge-amazon-s3-with-amazon-elasticache-for-redis/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-elasticache/

Domain

AWS Database

Question 19Skipped

A software development company is deploying a microservices-based application on Amazon Elastic Kubernetes Service (Amazon EKS). The application's traffic fluctuates significantly throughout the day and the company wants to ensure that the EKS cluster scales up and down according to these traffic patterns.

Which combination of steps would satisfy these requirements with MINIMAL operational overhead? (Select TWO.)

Integrate Amazon SQS and connect it to Amazon EKS for workload management.

Implement the Kubernetes Vertical Pod Autoscaler to adjust the CPU and memory allocation for the pods.

Leverage AWS X-Ray to track and analyze the application's network activity.

Correct selection

Employ the Kubernetes Cluster Autoscaler for dynamically managing the quantity of nodes in the EKS cluster.

Correct selection

Utilize the Kubernetes Metrics Server to enable horizontal pod autoscaling based on resource utilization.

Overall explanation

The Metrics Server collects resource metrics like CPU and memory usage from each node and its pods and provides these metrics to the Kubernetes API server for use by the Horizontal Pod Autoscaler, which automatically scales the number of pods in a deployment, replication controller, replica set, or stateful set based on observed CPU utilization.

The Kubernetes Cluster Autoscaler automatically adjusts the size of the Kubernetes cluster when there are pods that failed to run in the cluster due to insufficient resources or when there are nodes in the cluster that have been underutilized for an extended period and their pods can be placed on other existing nodes.

CORRECT: "Utilize the Kubernetes Metrics Server to enable horizontal pod autoscaling based on resource utilization" is a correct answer (as explained above.)

CORRECT: "Employ the Kubernetes Cluster Autoscaler for dynamically managing the quantity of nodes in the EKS cluster" is also a correct answer (as explained above.)

INCORRECT: "Implement the Kubernetes Vertical Pod Autoscaler to adjust the CPU and memory allocation for the pods" is incorrect.

The Vertical Pod Autoscaler adjusts the resources of the pods and not the number of pods or nodes, which won't directly help with scaling according to traffic patterns.

INCORRECT: "Integrate Amazon SQS and connect it to Amazon EKS for workload management" is incorrect.

Amazon SQS is a message queuing service, and while it can be used to manage workloads by decoupling microservices, it doesn't directly help with autoscaling an EKS cluster based on traffic patterns.

INCORRECT: "Leverage AWS X-Ray to track and analyze the application's network activity" is incorrect.

AWS X-Ray provides insights into the behavior of your applications, but it doesn't directly help with autoscaling an EKS cluster.

References:

https://kubernetes.io/docs/tasks/debug/debug-cluster/resource-metrics-pipeline/#metrics-server

https://docs.aws.amazon.com/eks/latest/userguide/autoscaling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 20Skipped

An application runs on Amazon EC2 instances in a private subnet. The EC2 instances process data that is stored in an Amazon S3 bucket. The data is highly confidential and a private and secure connection is required between the EC2 instances and the S3 bucket.

Which solution meets these requirements?

Correct answer

Set up S3 bucket policies to allow access from a VPC endpoint.

Set up an IAM policy to grant read-write access to the S3 bucket.

Configure a custom SSL/TLS certificate on the S3 bucket.

Configure encryption for the S3 bucket using an AWS KMS key.

Overall explanation

A gateway VPC endpoint can be used to access an Amazon S3 bucket using private IP addresses. To further secure the solution an S3 bucket policy can be created that restricts access to the VPC endpoint so connections cannot be made to the bucket from other sources.

CORRECT: "Set up S3 bucket policies to allow access from a VPC endpoint" is the correct answer.

INCORRECT: "Set up an IAM policy to grant read-write access to the S3 bucket" is incorrect. This does not enable private access from EC2. A gateway VPC endpoint is required.

INCORRECT: "Configure encryption for the S3 bucket using an AWS KMS key" is incorrect. This will encrypt data at rest but does not secure the connection to the bucket or ensure private connections must be made.

INCORRECT: "Configure a custom SSL/TLS certificate on the S3 bucket" is incorrect. You cannot add a custom SSL/TLS certificate to Amazon S3.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Security, Identity, & Compliance

Question 21Skipped

A Solutions Architect has created an AWS Organization with several AWS accounts. Security policy requires that use of specific API actions are limited across all accounts. The Solutions Architect requires a method of centrally controlling these actions.

What is the SIMPLEST method of achieving the requirements?

Correct answer

Create a service control policy in the root organizational unit to deny access to the services or actions

Create an IAM policy in the root account and attach it to users and groups in each account

Create cross-account roles in each account to limit access to the services and actions that are allowed

Create a Network ACL that limits access to the services or actions and attach it to all relevant subnets

Overall explanation

Service control policies (SCPs) offer central control over the maximum available permissions for all accounts in your organization allowing you to ensure your accounts stay within your organization’s access control guidelines.

In the example below, a policy in OU1 restricts all users from launching EC2 instance types other than a t2.micro:

CORRECT: "Create a service control policy in the root organizational unit to deny access to the services or actions" is the correct answer.

INCORRECT: "Create a Network ACL that limits access to the services or actions and attach it to all relevant subnets" is incorrect. Network ACLs control network traffic - not API actions.

INCORRECT: "Create an IAM policy in the root account and attach it to users and groups in each account" is incorrect. This is not an efficient or centrally managed method of applying the security restrictions.

INCORRECT: "Create cross-account roles in each account to limit access to the services and actions that are allowed" is incorrect. This is another example of a complex and inefficient method of providing access across accounts and does not restrict API actions within the account.

References:

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_about-scps.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/certification-training/aws-solutions-architect-associate/security-identity-compliance/aws-accounts/

Domain

AWS Management & Governance

Question 22Skipped

A tool needs to analyze data stored in an Amazon S3 bucket. Processing the data takes a few seconds and results are then written to another S3 bucket. Less than 256 MB of memory is needed to run the process. What would be the MOST cost-effective compute solutions for this use case?

AWS Fargate tasks

Amazon Elastic Beanstalk

Correct answer

AWS Lambda functions

Amazon EC2 spot instances

Overall explanation

AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume. Lambda has a maximum execution time of 900 seconds and memory can be allocated up to 3008 MB. Therefore, the most cost-effective solution will be AWS Lambda.

CORRECT: "AWS Lambda functions" is the correct answer.

INCORRECT: "AWS Fargate tasks" is incorrect. Fargate runs Docker containers and is serverless. However, you do pay for the running time of the tasks so it will not be as cost-effective.

INCORRECT: "Amazon EC2 spot instances" is incorrect. EC2 instances must run continually waiting for jobs to process so even with spot this would be less cost-effective (and subject to termination).

INCORRECT: "Amazon Elastic Beanstalk" is incorrect. This services also relies on Amazon EC2 instances so would not be as cost-effective.

References:

https://aws.amazon.com/lambda/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-lambda/

Domain

AWS Compute

Question 23Skipped

A production application runs on an Amazon RDS MySQL DB instance. A solutions architect is building a new reporting tool that will access the same data. The reporting tool must be highly available and not impact the performance of the production application.

How can this be achieved?

Use Amazon Data Lifecycle Manager to automatically create and manage snapshots

Correct answer

Create a Multi-AZ RDS Read Replica of the production RDS DB instance

Create a cross-region Multi-AZ deployment and create a read replica in the second region

Create a Single-AZ RDS Read Replica of the production RDS DB instance. Create a second Single-AZ RDS Read Replica from the replica

Overall explanation

You can create a read replica as a Multi-AZ DB instance. Amazon RDS creates a standby of your replica in another Availability Zone for failover support for the replica. Creating your read replica as a Multi-AZ DB instance is independent of whether the source database is a Multi-AZ DB instance.

CORRECT: "Create a Multi-AZ RDS Read Replica of the production RDS DB instance" is the correct answer.

INCORRECT: "Create a Single-AZ RDS Read Replica of the production RDS DB instance. Create a second Single-AZ RDS Read Replica from the replica" is incorrect. Read replicas are primarily used for horizontal scaling. The best solution for high availability is to use a Multi-AZ read replica.

INCORRECT: "Create a cross-region Multi-AZ deployment and create a read replica in the second region" is incorrect as you cannot create a cross-region Multi-AZ deployment with RDS.

INCORRECT: "Use Amazon Data Lifecycle Manager to automatically create and manage snapshots" is incorrect as using snapshots is not the best solution for high availability.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_MySQL.Replication.ReadReplicas.html#USER_MySQL.Replication.ReadReplicas.MultiAZ

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 24Skipped

A company has refactored a legacy application to run as two microservices using Amazon ECS. The application processes data in two parts and the second part of the process takes longer than the first.

How can a solutions architect integrate the microservices and allow them to scale independently?

Implement code in microservice 1 to send data to an Amazon S3 bucket. Use S3 event notifications to invoke microservice 2

Implement code in microservice 1 to send data to Amazon Kinesis Data Firehose. Implement code in microservice 2 to read from Kinesis Data Firehose

Correct answer

Implement code in microservice 1 to send data to an Amazon SQS queue. Implement code in microservice 2 to process messages from the queue

Implement code in microservice 1 to publish data to an Amazon SNS topic. Implement code in microservice 2 to subscribe to this topic

Overall explanation

This is a good use case for Amazon SQS. The microservices must be decoupled so they can scale independently. An Amazon SQS queue will enable microservice 1 to add messages to the queue. Microservice 2 can then pick up the messages and process them. This ensures that if there’s a spike in traffic on the frontend, messages do not get lost due to the backend process not being ready to process them.

CORRECT: "Implement code in microservice 1 to send data to an Amazon SQS queue. Implement code in microservice 2 to process messages from the queue" is the correct answer.

INCORRECT: "Implement code in microservice 1 to send data to an Amazon S3 bucket. Use S3 event notifications to invoke microservice 2" is incorrect as a message queue would be preferable to an S3 bucket.

INCORRECT: "Implement code in microservice 1 to publish data to an Amazon SNS topic. Implement code in microservice 2 to subscribe to this topic" is incorrect as notifications to topics are pushed to subscribers. In this case we want the second microservice to pickup the messages when ready (pull them).

INCORRECT: "Implement code in microservice 1 to send data to Amazon Kinesis Data Firehose. Implement code in microservice 2 to read from Kinesis Data Firehose" is incorrect as this is not how Firehose works. Firehose sends data directly to destinations, it is not a message queue.

References:

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/welcome.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 25Skipped

A company runs a financial application using an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB). When running month-end reports on a specific day and time each month the application becomes unacceptably slow. Amazon CloudWatch metrics show the CPU utilization hitting 100%.

What should a solutions architect recommend to ensure the application is able to handle the workload and avoid downtime?

Correct answer

Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule

Configure Amazon ElastiCache to remove some of the workload from the EC2 instances

Configure an Amazon CloudFront distribution in front of the ALB

Configure an EC2 Auto Scaling simple scaling policy based on CPU utilization

Overall explanation

Scheduled scaling allows you to set your own scaling schedule. In this case the scaling action can be scheduled to occur just prior to the time that the reports will be run each month. Scaling actions are performed automatically as a function of time and date. This will ensure that there are enough EC2 instances to serve the demand and prevent the application from slowing down.

CORRECT: "Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule" is the correct answer.

INCORRECT: "Configure an Amazon CloudFront distribution in front of the ALB" is incorrect as this would be more suitable for providing access to global users by caching content.

INCORRECT: "Configure an EC2 Auto Scaling simple scaling policy based on CPU utilization" is incorrect as this would not prevent the slow-down from occurring as there would be a delay between when the CPU hits 100% and the metric being reported and additional instances being launched.

INCORRECT: "Configure Amazon ElastiCache to remove some of the workload from the EC2 instances" is incorrect as ElastiCache is a database cache, it cannot replace the compute functions of an EC2 instance.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/schedule_time.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 26Skipped

A web application in a three-tier architecture runs on a fleet of Amazon EC2 instances. Performance issues have been reported and investigations point to insufficient swap space. The operations team requires monitoring to determine if this is correct.

What should a solutions architect recommend?

Configure an Amazon CloudWatch SwapUsage metric dimension. Monitor the SwapUsage dimension in the EC2 metrics in CloudWatch

Use EC2 metadata to collect information, then publish it to Amazon CloudWatch custom metrics. Monitor SwapUsage metrics in CloudWatch

Enable detailed monitoring in the EC2 console. Create an Amazon CloudWatch SwapUtilization custom metric. Monitor SwapUtilization metrics in CloudWatch

Correct answer

Install an Amazon CloudWatch agent on the instances. Run an appropriate script on a set schedule. Monitor SwapUtilization metrics in CloudWatch

Overall explanation

You can use the CloudWatch agent to collect both system metrics and log files from Amazon EC2 instances and on-premises servers. The agent supports both Windows Server and Linux, and enables you to select the metrics to be collected, including sub-resource metrics such as per-CPU core.

There is now a unified agent and previously there were monitoring scripts. Both of these tools can capture SwapUtilization metrics and send them to CloudWatch. This is the best way to get memory utilization metrics from Amazon EC2 instnaces.

CORRECT: "Install an Amazon CloudWatch agent on the instances. Run an appropriate script on a set schedule. Monitor SwapUtilization metrics in CloudWatch" is the correct answer.

INCORRECT: "Enable detailed monitoring in the EC2 console. Create an Amazon CloudWatch SwapUtilization custom metric. Monitor SwapUtilization metrics in CloudWatch" is incorrect as you do not create custom metrics in the console, you must configure the instances to send the metric information to CloudWatch.

INCORRECT: "Configure an Amazon CloudWatch SwapUsage metric dimension. Monitor the SwapUsage dimension in the EC2 metrics in CloudWatch" is incorrect as there is no SwapUsage metric in CloudWatch. All memory metrics must be custom metrics.

INCORRECT: "Use EC2 metadata to collect information, then publish it to Amazon CloudWatch custom metrics. Monitor SwapUsage metrics in CloudWatch" is incorrect as performance related information is not stored in metadata.

References:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Install-CloudWatch-Agent.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Management & Governance

Question 27Skipped

A solutions architect is optimizing a website for real-time streaming and on-demand videos. The website’s users are located around the world and the solutions architect needs to optimize the performance for both the real-time and on-demand streaming.

Which service should the solutions architect choose?

AWS Global Accelerator

Amazon Route 53

Correct answer

Amazon CloudFront

Amazon S3 Transfer Acceleration

Overall explanation

Amazon CloudFront can be used to stream video to users across the globe using a wide variety of protocols that are layered on top of HTTP. This can include both on-demand video as well as real time streaming video.

CORRECT: "Amazon CloudFront" is the correct answer.

INCORRECT: "AWS Global Accelerator" is incorrect as this would be an expensive way of getting the content closer to users compared to using CloudFront. As this is a use case for CloudFront and there are so many edge locations it is the better option.

INCORRECT: "Amazon Route 53" is incorrect as you still need a solution for getting the content closer to users.

INCORRECT: "Amazon S3 Transfer Acceleration" is incorrect as this is used to accelerate uploads of data to Amazon S3 buckets.

References:

https://aws.amazon.com/cloudfront/streaming/

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/on-demand-streaming-video.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 28Skipped

An application runs on Amazon EC2 instances across multiple Availability Zones. The instances run in an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The application performs best when the CPU utilization of the EC2 instances is at or near 40%.

What should a solutions architect do to maintain the desired performance across all instances in the group?

Use scheduled scaling actions to scale up and scale down the Auto Scaling group

Use a simple scaling policy to dynamically scale the Auto Scaling group

Use an AWS Lambda function to update the desired Auto Scaling group capacity

Correct answer

Use a target tracking policy to dynamically scale the Auto Scaling group

Overall explanation

With target tracking scaling policies, you select a scaling metric and set a target value. Amazon EC2 Auto Scaling creates and manages the CloudWatch alarms that trigger the scaling policy and calculates the scaling adjustment based on the metric and the target value.

The scaling policy adds or removes capacity as required to keep the metric at, or close to, the specified target value. In addition to keeping the metric close to the target value, a target tracking scaling policy also adjusts to the changes in the metric due to a changing load pattern.

CORRECT: "Use a target tracking policy to dynamically scale the Auto Scaling group" is the correct answer.

INCORRECT: "Use a simple scaling policy to dynamically scale the Auto Scaling group" is incorrect as target tracking is a better way to keep the aggregate CPU usage at around 40%

INCORRECT: "Use an AWS Lambda function to update the desired Auto Scaling group capacity" is incorrect as this can be done automatically.

INCORRECT: "Use scheduled scaling actions to scale up and scale down the Auto Scaling group" is incorrect as dynamic scaling is required to respond to changes in utilization.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 29Skipped

A company operates a production web application that uses an Amazon RDS MySQL database. The database has automated, non-encrypted daily backups. To increase the security of the data, it has been recommended that encryption should be enabled for backups. Unencrypted backups will be destroyed after the first encrypted backup has been completed.

What should be done to enable encryption for future backups?

Modify the backup section of the database configuration to toggle the Enable encryption check box

Enable default encryption for the Amazon S3 bucket where backups are stored

Correct answer

Create a snapshot of the database. Copy it to an encrypted snapshot. Restore the database from the encrypted snapshot

Enable an encrypted read replica on RDS for MySQL. Promote the encrypted read replica to primary. Remove the original database instance

Overall explanation

Amazon RDS uses snapshots for backup. Snapshots are encrypted when created only if the database is encrypted and you can only select encryption for the database when you first create it. In this case the database, and hence the snapshots, ad unencrypted.

However, you can create an encrypted copy of a snapshot. You can restore using that snapshot which creates a new DB instance that has encryption enabled. From that point on encryption will be enabled for all snapshots.

CORRECT: "Create a snapshot of the database. Copy it to an encrypted snapshot. Restore the database from the encrypted snapshot" is the correct answer.

INCORRECT: "Enable an encrypted read replica on RDS for MySQL. Promote the encrypted read replica to primary. Remove the original database instance" is incorrect as you cannot create an encrypted read replica from an unencrypted master.

INCORRECT: "Modify the backup section of the database configuration to toggle the Enable encryption check box" is incorrect as you cannot add encryption for an existing database.

INCORRECT: "Enable default encryption for the Amazon S3 bucket where backups are stored" is incorrect because you do not have access to the S3 bucket in which snapshots are stored.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Compute

Question 30Skipped

An application runs on Amazon EC2 instances backed by Amazon EBS volumes and an Amazon RDS database. The application is highly sensitive and security compliance requirements mandate that all personally identifiable information (PII) be encrypted at rest.

Which solution should a Solutions Architect choose to this requirement?

Correct answer

Configure Amazon EBS encryption and Amazon RDS encryption with AWS KMS keys to encrypt instance and database volumes.

Enable encryption on Amazon RDS during creation. Use Amazon Macie to identify sensitive data.

Deploy AWS CloudHSM, generate encryption keys, and use the customer master key (CMK) to encrypt database volumes.

Configure SSL/TLS encryption using AWS KMS customer master keys (CMKs) to encrypt database volumes.

Overall explanation

The data must be encrypted at rest on both the EC2 instance’s attached EBS volumes and the RDS database. Both storage locations can be encrypted using AWS KMS keys. With RDS, KMS uses a customer master key (CMK) to encrypt the DB instance, all logs, backups, and snapshots.

CORRECT: "Configure Amazon EBS encryption and Amazon RDS encryption with AWS KMS keys to encrypt instance and database volumes" is the correct answer.

INCORRECT: "Enable encryption on Amazon RDS during creation. Use Amazon Macie to identify sensitive data" is incorrect. This does not encrypt the EBS volumes attached to the EC2 instance and Macie cannot be used with RDS.

INCORRECT: "Configure SSL/TLS encryption using AWS KMS customer master keys (CMKs) to encrypt database volumes" is incorrect. SSL encryption encrypts data in transit but not at rest.

INCORRECT: "Deploy AWS CloudHSM, generate encryption keys, and use the customer master key (CMK) to encrypt database volumes" is incorrect. CloudHSM is not required for this solution, and we need to encrypt the database volumes and the EBS volumes.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Security, Identity, & Compliance

Question 31Skipped

A Solutions Architect needs a solution for hosting a website that will be used by a development team. The website contents will consist of HTML, CSS, client-side JavaScript, and images.

Which solution is MOST cost-effective?

Create an Application Load Balancer with an AWS Lambda target.

Correct answer

Create an Amazon S3 bucket and host the website there.

Use a Docker container to host the website on AWS Fargate.

Launch an Amazon EC2 instance and host the website there.

Overall explanation

Amazon S3 can be used for hosting static websites and cannot be used for dynamic content. In this case the content is purely static with client-side code running. Therefore, an S3 static website will be the most cost-effective solution for hosting this website.

CORRECT: "Create an Amazon S3 bucket and host the website there" is the correct answer.

INCORRECT: "Launch an Amazon EC2 instance and host the website there" is incorrect. This will be more expensive as it uses an EC2 instances.

INCORRECT: "Use a Docker container to host the website on AWS Fargate" is incorrect. A static website on S3 is sufficient for this use case and will be more cost-effective than Fargate.

INCORRECT: "Create an Application Load Balancer with an AWS Lambda target" is incorrect. This is also a more expensive solution and unnecessary for this use case.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 32Skipped

A company runs an application on premises that stores a large quantity of semi-structured data using key-value pairs. The application code will be migrated to AWS Lambda and a highly scalable solution is required for storing the data.

Which datastore will be the best fit for these requirements?

Correct answer

Amazon DynamoDB

Amazon EBS

Amazon RDS MySQL

Amazon EFS

Overall explanation

Amazon DynamoDB is a no-SQL database that stores data using key-value pairs. It is ideal for storing large amounts of semi-structured data and is also highly scalable. This is the best solution for storing this data based on the requirements in the scenario.

CORRECT: "Amazon DynamoDB" is the correct answer.

INCORRECT: "Amazon EFS" is incorrect. The Amazon Elastic File System (EFS) is not suitable for storing key-value pairs.

INCORRECT: "Amazon RDS MySQL" is incorrect. Amazon Relational Database Service (RDS) is used for structured data as it is an SQL type of database.

INCORRECT: "Amazon EBS" is incorrect. Amazon Elastic Block Store (EBS) is a block-based storage system. You attach volumes to EC2 instances. It is not used for key-value pairs or to be used by Lambda functions.

References:

https://aws.amazon.com/dynamodb/features/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-dynamodb/

Domain

AWS Database

Question 33Skipped

A Solutions Architect is designing an application that will run on Amazon EC2 instances. The application will use Amazon S3 for storing image files and an Amazon DynamoDB table for storing customer information. The security team require that traffic between the EC2 instances and AWS services must not traverse the public internet.

How can the Solutions Architect meet the security team’s requirements?

Correct answer

Create gateway VPC endpoints for Amazon S3 and DynamoDB.

Create a virtual private gateway and configure VPC route tables.

Create a NAT gateway in a public subnet and configure route tables.

Create interface VPC endpoints for Amazon S3 and DynamoDB.

Overall explanation

A VPC endpoint enables private connections between your VPC and supported AWS services and VPC endpoint services powered by AWS PrivateLink. A gateway endpoint is used for Amazon S3 and Amazon DynamoDB. You specify a gateway endpoint as a route table target for traffic that is destined for the supported AWS services.

CORRECT: "Create gateway VPC endpoints for Amazon S3 and DynamoDB" is the correct answer.

INCORRECT: "Create a NAT gateway in a public subnet and configure route tables" is incorrect. A NAT gateway is used for enabling internet connectivity for instances in private subnets. Connections will traverse the internet.

INCORRECT: "Create interface VPC endpoints for Amazon S3 and DynamoDB" is incorrect. You should use a gateway VPC endpoint for S3 and DynamoDB.

INCORRECT: "Create a virtual private gateway and configure VPC route tables" is incorrect VGWs are used for VPN connections, they do not allow access to AWS services from a VPC.

References:

https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 34Skipped

A solutions architect is designing a high performance computing (HPC) application using Amazon EC2 Linux instances. All EC2 instances need to communicate to each other with low latency and high throughput network performance.

Which EC2 solution BEST meets these requirements?

Launch the EC2 instances in an Auto Scaling group in two Regions. Place a Network Load Balancer in front of the instances

Correct answer

Launch the EC2 instances in a cluster placement group in one Availability Zone

Launch the EC2 instances in an Auto Scaling group spanning multiple Availability Zones

Launch the EC2 instances in a spread placement group in one Availability Zone

Overall explanation

When you launch a new EC2 instance, the EC2 service attempts to place the instance in such a way that all of your instances are spread out across underlying hardware to minimize correlated failures. You can use placement groups to influence the placement of a group of interdependent instances to meet the needs of your workload. Depending on the type of workload, you can create a placement group using one of the following placement strategies:

Cluster – packs instances close together inside an Availability Zone. This strategy enables workloads to achieve the low-latency network performance necessary for tightly-coupled node-to-node communication that is typical of HPC applications.

Partition – spreads your instances across logical partitions such that groups of instances in one partition do not share the underlying hardware with groups of instances in different partitions. This strategy is typically used by large distributed and replicated workloads, such as Hadoop, Cassandra, and Kafka.

Spread – strictly places a small group of instances across distinct underlying hardware to reduce correlated failures.

For this scenario, a cluster placement group should be used as this is the best option for providing low-latency network performance for a HPC application.

CORRECT: "Launch the EC2 instances in a cluster placement group in one Availability Zone" is the correct answer.

INCORRECT: "Launch the EC2 instances in a spread placement group in one Availability Zone" is incorrect as the spread placement group is used to spread instances across distinct underlying hardware.

INCORRECT: "Launch the EC2 instances in an Auto Scaling group in two Regions. Place a Network Load Balancer in front of the instances" is incorrect as this does not achieve the stated requirement to provide low-latency, high throughput network performance between instances. Also, you cannot use an ELB across Regions.

INCORRECT: "Launch the EC2 instances in an Auto Scaling group spanning multiple Availability Zones" is incorrect as this does not reduce network latency or improve performance.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Compute

Question 35Skipped

A company has some statistical data stored in an Amazon RDS database. The company want to allow users to access this information using an API. A solutions architect must create a solution that allows sporadic access to the data, ranging from no requests to large bursts of traffic.

Which solution should the solutions architect suggest?

Set up an Amazon API Gateway and use Amazon EC2 with Auto Scaling

Set up an Amazon API Gateway and use Amazon ECS

Set up an Amazon API Gateway and use AWS Elastic Beanstalk

Correct answer

Set up an Amazon API Gateway and use AWS Lambda functions

Overall explanation

This question is simply asking you to work out the best compute service for the stated requirements. The key requirements are that the compute service should be suitable for a workload that can range quite broadly in demand from no requests to large bursts of traffic.

AWS Lambda is an ideal solution as you pay only when requests are made and it can easily scale to accommodate the large bursts in traffic. Lambda works well with both API Gateway and Amazon RDS.

CORRECT: "Set up an Amazon API Gateway and use AWS Lambda functions" is the correct answer.

INCORRECT: "Set up an Amazon API Gateway and use Amazon ECS" is incorrect

INCORRECT: "Set up an Amazon API Gateway and use AWS Elastic Beanstalk" is incorrect

INCORRECT: "Set up an Amazon API Gateway and use Amazon EC2 with Auto Scaling" is incorrect

References:

https://docs.aws.amazon.com/lambda/latest/dg/invocation-scaling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-lambda/

Domain

AWS Networking & Content Delivery

Question 36Skipped

A company has several AWS accounts that are used by developers for development, testing and pre-production environments. The company has received large bills for Amazon EC2 instances that are underutilized. A Solutions Architect has been tasked with restricting the ability to launch large EC2 instances in all accounts.

How can the Solutions Architect meet this requirement with the LEAST operational overhead?

Create a resource-based policy that denies the launch of large EC2 instances and attach it to Amazon EC2 in each account.

Create a service-linked role for Amazon EC2 and attach a policy the denies the launch of large EC2 instances.

Correct answer

Create an organization in AWS Organizations that includes all accounts and create a service control policy (SCP) that denies the launch of large EC2 instances.

Create an IAM role in each account that denies the launch of large EC2 instances. Grant the developers IAM group access to the role.

Overall explanation

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization. An SCP defines a guardrail, or sets limits, on the actions that the account's administrator can delegate to the IAM users and roles in the affected accounts.

In this case the Solutions Architect can use an SCP to define a restriction that denies the launch of large EC2 instances. The SCP can be applied to all accounts, and this will ensure that even those users with permissions to launch EC2 instances will be restricted to smaller EC2 instance types.

CORRECT: "Create an organization in AWS Organizations that includes all accounts and create a service control policy (SCP) that denies the launch of large EC2 instances" is the correct answer.

INCORRECT: "Create a service-linked role for Amazon EC2 and attach a policy the denies the launch of large EC2 instances" is incorrect. You cannot create service-linked roles yourself; they are created by AWS with predefined policies.

INCORRECT: "Create a resource-based policy that denies the launch of large EC2 instances and attach it to Amazon EC2 in each account" is incorrect. You cannot attach a resource-based policy to Amazon EC2.

INCORRECT: "Create an IAM role in each account that denies the launch of large EC2 instances. Grant the developers IAM group access to the role" is incorrect. This is much less operationally efficient compared to using SCPs with AWS Organizations.

References:

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-organizations/

Domain

AWS Management & Governance

Question 37Skipped

An on-premises server runs a MySQL database and will be migrated to the AWS Cloud. The company require a managed solution that supports high availability and automatic failover in the event of the outage of an Availability Zone (AZ).

Which solution is the BEST fit for these requirements?

Use the AWS Database Migration Service (DMS) to directly migrate the database to an Amazon EC2 MySQL Multi-AZ deployment

Create a snapshot of the MySQL database server and use AWS DataSync to migrate the data Amazon S3. Launch a new Amazon RDS MySQL Multi-AZ deployment from the snapshot

Use the AWS Database Migration Service (DMS) to directly migrate the database to Amazon RDS MySQL. Use the Schema Conversion Tool (SCT) to enable conversion from MySQL to Amazon RDS

Correct answer

Use the AWS Database Migration Service (DMS) to directly migrate the database to an Amazon RDS MySQL Multi-AZ deployment

Overall explanation

The AWS DMS service can be used to directly migrate the MySQL database to an Amazon RDS Multi-AZ deployment. The entire process can be online and is managed for you. There is no need to perform schema translation between MySQL and RDS (assuming you choose the MySQL RDS engine).

CORRECT: "Use the AWS Database Migration Service (DMS) to directly migrate the database to an Amazon RDS MySQL Multi-AZ deployment" is the correct answer.

INCORRECT: "Use the AWS Database Migration Service (DMS) to directly migrate the database to an Amazon EC2 MySQL Multi-AZ deployment" is incorrect as there is no such thing as “multi-AZ” on Amazon EC2 with MySQL, you must use RDS.

INCORRECT: "Create a snapshot of the MySQL database server and use AWS DataSync to migrate the data Amazon S3. Launch a new Amazon RDS MySQL Multi-AZ deployment from the snapshot" is incorrect. You cannot create a snapshot of a MySQL database server running on-premises.

INCORRECT: "Use the AWS Database Migration Service (DMS) to directly migrate the database to Amazon RDS MySQL. Use the Schema Conversion Tool (SCT) to enable conversion from MySQL to Amazon RDS" is incorrect. There is no need to convert the schema when migrating from MySQL to Amazon RDS (MySQL engine).

References:

https://aws.amazon.com/rds/features/multi-az/

https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Introduction.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 38Skipped

The Solutions Architect in charge of a critical application must ensure the Amazon EC2 instances are able to be launched in another AWS Region in the event of a disaster.

What steps should the Solutions Architect take? (Select TWO.)

Enable cross-region snapshots for the Amazon EC2 instances

Copy the snapshots using Amazon S3 cross-region replication

Launch instances in the second Region using the S3 API

Correct selection

Launch instances in the second Region from the AMIs

Correct selection

Create AMIs of the instances and copy them to another Region

Overall explanation

You can create AMIs of the EC2 instances and then copy them across Regions. This provides a point-in-time copy of the state of the EC2 instance in the remote Region.

Once you’ve created AMIs of EC2 instances and copied them to the second Region, you can then launch the EC2 instances from the AMIs in that Region.

This is a good DR strategy as you have moved stateful EC2 instances to another Region.

CORRECT: "Create AMIs of the instances and copy them to another Region" is the correct answer.

CORRECT: "Launch instances in the second Region from the AMIs" is also a correct answer.

INCORRECT: "Launch instances in the second Region using the S3 API" is incorrect. Though snapshots (and EBS-backed AMIs) are stored on Amazon S3, you cannot actually access them using the S3 API. You must use the EC2 API.

INCORRECT: "Enable cross-region snapshots for the Amazon EC2 instances" is incorrect. You cannot enable “cross-region snapshots” as this is not a feature that currently exists.

INCORRECT: "Copy the snapshots using Amazon S3 cross-region replication" is incorrect. You cannot work with snapshots using Amazon S3 at all including leveraging the cross-region replication feature.

References:

https://aws.amazon.com/blogs/aws/ebs-snapshot-copy/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Compute

Question 39Skipped

An application generates unique files that are returned to customers after they submit requests to the application. The application uses an Amazon CloudFront distribution for sending the files to customers. The company wishes to reduce data transfer costs without modifying the application.

How can this be accomplished?

Use AWS Global Accelerator to reduce application latency for customers.

Enable Amazon S3 Transfer Acceleration to reduce the transfer times.

Enable caching on the CloudFront distribution to store generated files at the edge.

Correct answer

Use Lambda@Edge to compress the files as they are sent to users.

Overall explanation

Lambda@Edge is a feature of Amazon CloudFront that lets you run code closer to users of your application, which improves performance and reduces latency. Lambda@Edge runs code in response to events generated by the Amazon CloudFront.

You simply upload your code to AWS Lambda, and it takes care of everything required to run and scale your code with high availability at an AWS location closest to your end user.

In this case Lambda@Edge can compress the files before they are sent to users which will reduce data egress costs.

CORRECT: "Use Lambda@Edge to compress the files as they are sent to users" is the correct answer.

INCORRECT: "Enable caching on the CloudFront distribution to store generated files at the edge" is incorrect. The files are unique to each customer request, so caching does not help.

INCORRECT: "Use AWS Global Accelerator to reduce application latency for customers" is incorrect. The aim is to reduce cost not latency and AWS GA uses the same network as CloudFront so does not assist with latency anyway.

INCORRECT: "Enable Amazon S3 Transfer Acceleration to reduce the transfer times" is incorrect. This does not lower costs.

References:

https://aws.amazon.com/lambda/edge/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 40Skipped

An international software firm provides its clients with custom solutions and tools designed for efficient data collection and analysis on AWS. The firm intends to centrally manage and distribute a standard set of solutions and tools for its clients' self-service needs.

Which solution would best satisfy these requirements?

Correct answer

Create AWS Service Catalog portfolios for the clients.

Create AWS CloudFormation stacks for the clients.

Create AWS Config rules for the clients.

Create AWS Systems Manager documents for the clients.

Overall explanation

AWS Service Catalog enables organizations to create and manage catalogs of IT services that are approved for use on AWS. It allows centrally managed service portfolios, which clients can use on a self-service basis.

AWS Service Catalog provides a single location where organizations can centrally manage catalogs of IT services, which simplifies the organizational process and helps ensure compliance.

CORRECT: "Create AWS Service Catalog portfolios for the clients" is the correct answer (as explained above.)

INCORRECT: "Create AWS CloudFormation stacks for the clients" is incorrect.

While AWS CloudFormation is a powerful service for infrastructure as code (IaC), it doesn't provide a straightforward way for clients to discover and use shared tools or solutions for self-service needs. It lacks the management features and access control mechanisms necessary for this scenario.

INCORRECT: "Create AWS Systems Manager documents for the clients" is incorrect.

AWS Systems Manager documents define the actions that Systems Manager performs on your managed instances. Although Systems Manager allows the central management of resources and applications, it doesn't provide an effective means for clients to self-discover and use shared tools or solutions.

INCORRECT: "Create AWS Config rules for the clients" is incorrect.

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It isn't designed to centrally manage and distribute software tools or solutions.

References:

https://aws.amazon.com/servicecatalog/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-service-catalog/

Domain

AWS Management & Governance

Question 41Skipped

A company needs to ensure that they can failover between AWS Regions in the event of a disaster seamlessly with minimal downtime and data loss. The applications will run in an active-active configuration.

Which DR strategy should a Solutions Architect recommend?

Backup and restore

Warm standby

Correct answer

Multi-site

Pilot light

Overall explanation

A multi-site solution runs on AWS as well as on your existing on-site infrastructure in an active- active configuration. The data replication method that you employ will be determined by the recovery point that you choose. This is either Recovery Time Objective (the maximum allowable downtime before degraded operations are restored) or Recovery Point Objective (the maximum allowable time window whereby you will accept the loss of transactions during the DR process).

CORRECT: "Multi-site" is the correct answer.

INCORRECT: "Backup and restore" is incorrect. This is the lowest cost DR approach that simply entails creating online backups of all data and applications.

INCORRECT: "Pilot light" is incorrect. With a pilot light strategy a core minimum of services are running and the remainder are only brought online during a disaster recovery situation.

INCORRECT: "Warm standby" is incorrect. The term warm standby is used to describe a DR scenario in which a scaled-down version of a fully functional environment is always running in the cloud.

References:

https://aws.amazon.com/blogs/publicsector/rapidly-recover-mission-critical-systems-in-a-disaster/

Domain

AWS Cloud Architecture & Design

Question 42Skipped

A company is creating a solution that must offer disaster recovery across multiple AWS Regions. The solution requires relational a database that can support a Recovery Point Objective (RPO) of 1 second and a Recovery Time Objective (RTO) of 1 minute.

Which AWS solution can achieve this?

Amazon RDS for with Multi-AZ enabled.

Amazon RDS for with a cross-Region replica.

Correct answer

Amazon Aurora Global Database.

Amazon DynamoDB global tables.

Overall explanation

Aurora Global Database lets you easily scale database reads across the world and place your applications close to your users. Your applications enjoy quick data access regardless of the number and location of secondary regions, with typical cross-region replication latencies below 1 second.

If your primary region suffers a performance degradation or outage, you can promote one of the secondary regions to take read/write responsibilities. An Aurora cluster can recover in less than 1 minute even in the event of a complete regional outage. This provides your application with an effective Recovery Point Objective (RPO) of 1 second and a Recovery Time Objective (RTO) of less than 1 minute, providing a strong foundation for a global business continuity plan.

CORRECT: "Amazon Aurora Global Database" is the correct answer.

INCORRECT: "Amazon RDS for with Multi-AZ enabled" is incorrect. RDS Multi-AZ is across availability zones, not across Regions.

INCORRECT: "Amazon RDS for with a cross-Region replica" is incorrect. A cross-Region replica for RDS cannot provide an RPO of 1 second as there is typically more latency. You also cannot achieve a minute RPO as it takes much longer to promote a replica to a master.

INCORRECT: "Amazon DynamoDB global tables" is incorrect. This is not a relational database; it is a non-relational database (NoSQL).

References:

https://aws.amazon.com/rds/aurora/global-database/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 43Skipped

A company has launched a multi-tier application architecture. The web tier and database tier run on Amazon EC2 instances in private subnets within the same Availability Zone.

Which combination of steps should a Solutions Architect take to add high availability to this architecture? (Select TWO.)

Correct selection

Create new private subnets in the same VPC but in a different AZ. Migrate the database to an Amazon RDS multi-AZ deployment

Correct selection

Create an Amazon EC2 Auto Scaling group and Application Load Balancer (ALB) spanning multiple AZs

Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer (ALB)

Create new private subnets in the same VPC but in a different AZ. Create a database using Amazon EC2 in one AZ

Create new public subnets in the same AZ for high availability and move the web tier to the public subnets

Overall explanation

The Solutions Architect can use Auto Scaling group across multiple AZs with an ALB in front to create an elastic and highly available architecture. Then, migrate the database to an Amazon RDS multi-AZ deployment to create HA for the database tier. This results in a fully redundant architecture that can withstand the failure of an availability zone.

CORRECT: "Create an Amazon EC2 Auto Scaling group and Application Load Balancer (ALB) spanning multiple AZs" is a correct answer.

CORRECT: "Create new private subnets in the same VPC but in a different AZ. Migrate the database to an Amazon RDS multi-AZ deployment" is also a correct answer.

INCORRECT: "Create new public subnets in the same AZ for high availability and move the web tier to the public subnets" is incorrect. If subnets share the same AZ they are not suitable for splitting your tier across them for HA as the failure of a an AZ will take out both subnets.

INCORRECT: "Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer (ALB)" is incorrect. The instances are in a single AZ so the Solutions Architect should create a new auto scaling group and launch instances across multiple AZs.

INCORRECT: "Create new private subnets in the same VPC but in a different AZ. Create a database using Amazon EC2 in one AZ" is incorrect. A database in a single AZ will not be highly available.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-increase-availability.html

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

https://digitalcloud.training/amazon-rds/

Domain

AWS Compute

Question 44Skipped

A company is planning to use Amazon S3 to store documents uploaded by its customers. The images must be encrypted at rest in Amazon S3. The company does not want to spend time managing and rotating the keys, but it does want to control who can access those keys.

What should a solutions architect use to accomplish this?

Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)

Server-Side Encryption with Customer-Provided Keys (SSE-C)

Server-Side Encryption with keys stored in an S3 bucket

Correct answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)

Overall explanation

SSE-KMS requires that AWS manage the data key but you manage the customer master key (CMK) in AWS KMS. You can choose a customer managed CMK or the AWS managed CMK for Amazon S3 in your account.

Customer managed CMKs are CMKs in your AWS account that you create, own, and manage. You have full control over these CMKs, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, rotating their cryptographic material, adding tags, creating aliases that refer to the CMK, and scheduling the CMKs for deletion.

For this scenario, the solutions architect should use SSE-KMS with a customer managed CMK. That way KMS will manage the data key but the company can configure key policies defining who can access the keys.

CORRECT: "Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)" is the correct answer.

INCORRECT: "Server-Side Encryption with keys stored in an S3 bucket" is incorrect as you cannot store your keys in a bucket with server-side encryption

INCORRECT: "Server-Side Encryption with Customer-Provided Keys (SSE-C)" is incorrect as the company does not want to manage the keys.

INCORRECT: "Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)" is incorrect as the company needs to manage access control for the keys which is not possible when they’re managed by Amazon.

References:

https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html#sse

https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

https://digitalcloud.training/aws-kms/

Domain

AWS Storage

Question 45Skipped

A legacy application is being migrated into AWS. The application has a large amount of data that is rarely accessed. When files are accessed they are retrieved sequentially. The application will be migrated onto an Amazon EC2 instance.

What is the LEAST expensive EBS volume type for this use case?

Provisioned IOPS SSD (io1)

Correct answer

Cold HDD (sc1)

General Purpose SSD (gp2)

Throughput Optimized HDD (st1)

Overall explanation

The cold HDD (sc1) EBS volume type is the lowest cost option that is suitable for this use case. The sc1 volume type is suitable for infrequently accessed data and use cases that are oriented towards throughput like sequential data access.

CORRECT: "Cold HDD (sc1)" is the correct answer.

INCORRECT: "Provisioned IOPS SSD (io1)" is incorrect. This is the most expensive option and used for use cases that demand high IOPS.

INCORRECT: "General Purpose SSD (gp2)" is incorrect. This is a more expensive SSD volume type that is used for general use cases.

INCORRECT: "Throughput Optimized HDD (st1)" is incorrect. This is also used for throughput-oriented use cases however it is higher cost than sc1 and better for frequently accessed data.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Compute

Question 46Skipped

A Solutions Architect needs to capture information about the traffic that reaches an Amazon Elastic Load Balancer. The information should include the source, destination, and protocol.

What is the most secure and reliable method for gathering this data?

Use Amazon CloudWatch Logs to review detailed logging information

Create a VPC flow log for the subnets in which the ELB is running

Correct answer

Create a VPC flow log for each network interface associated with the ELB

Enable Amazon CloudTrail logging and configure packet capturing

Overall explanation

You can use VPC Flow Logs to capture detailed information about the traffic going to and from your Elastic Load Balancer. Create a flow log for each network interface for your load balancer. There is one network interface per load balancer subnet.

CORRECT: "Create a VPC flow log for each network interface associated with the ELB" is the correct answer.

INCORRECT: "Enable Amazon CloudTrail logging and configure packet capturing" is incorrect. CloudTrail performs auditing of API actions, it does not do packet capturing.

INCORRECT: "Use Amazon CloudWatch Logs to review detailed logging information" is incorrect as this service does not record this information in CloudWatch logs.

INCORRECT: "Create a VPC flow log for the subnets in which the ELB is running" is incorrect as the more secure option is to use the ELB network interfaces.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-monitoring.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Networking & Content Delivery

Question 47Skipped

A solutions architect has created a new AWS account and must secure AWS account root user access.

Which combination of actions will accomplish this? (Select TWO.)

Store root user access keys in an encrypted Amazon S3 bucket

1. Delete the root user account

Correct selection

Ensure the root user uses a strong password

Add the root user to a group containing administrative permissions

Correct selection

Enable multi-factor authentication to the root user

Overall explanation

There are several security best practices for securing the root user account:

· Lock away root user access keys OR delete them if possible

· Use a strong password

· Enable multi-factor authentication (MFA)

The root user automatically has full privileges to the account and these privileges cannot be restricted so it is extremely important to follow best practice advice about securing the root user account.

CORRECT: "Ensure the root user uses a strong password" is the correct answer.

CORRECT: "Enable multi-factor authentication to the root user" is the correct answer.

INCORRECT: "Store root user access keys in an encrypted Amazon S3 bucket" is incorrect as the best practice is to lock away or delete the root user access keys. An S3 bucket is not a suitable location for storing them, even if encrypted.

INCORRECT: "Add the root user to a group containing administrative permissions" is incorrect as this does not restrict access and is unnecessary.

INCORRECT: "Delete the root user account" is incorrect as you cannot delete the root user account.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 48Skipped

A web application is running on a fleet of Amazon EC2 instances using an Auto Scaling Group. It is desired that the CPU usage in the fleet is kept at 40%.

How should scaling be configured?

Correct answer

Use a target tracking policy that keeps the average aggregate CPU utilization at 40%

Use a simple scaling policy that launches instances when the average CPU hits 40%

Use a custom CloudWatch alarm to monitor CPU usage and notify the ASG using Amazon SNS

Use a step scaling policy that uses the PercentChangeInCapacity value to adjust the group size as required

Overall explanation

This is a perfect use case for a target tracking scaling policy. With target tracking scaling policies, you select a scaling metric and set a target value. In this case you can just set the target value to 40% average aggregate CPU utilization.

CORRECT: "Use a target tracking policy that keeps the average aggregate CPU utilization at 40%" is the correct answer.

INCORRECT: "Use a simple scaling policy that launches instances when the average CPU hits 40%" is incorrect. A simple scaling policy will add instances when 40% CPU utilization is reached, but it is not designed to maintain 40% CPU utilization across the group.

INCORRECT: "Use a step scaling policy that uses the PercentChangeInCapacity value to adjust the group size as required" is incorrect. The step scaling policy makes scaling adjustments based on a number of factors. The PercentChangeInCapacity value increments or decrements the group size by a specified percentage. This does not relate to CPU utilization.

INCORRECT: "Use a custom CloudWatch alarm to monitor CPU usage and notify the ASG using Amazon SNS" is incorrect. You do not need to create a custom Amazon CloudWatch alarm as the ASG can scale using a policy based on CPU utilization using standard configuration.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-simple-step.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 49Skipped

An application uses an Amazon RDS database and Amazon EC2 instances in a web tier. The web tier instances must not be directly accessible from the internet to improve security.

How can a Solutions Architect meet these requirements?

Correct answer

Launch the EC2 instances in a private subnet and create an Application Load Balancer in a public subnet

Launch the EC2 instances in a public subnet and create an Application Load Balancer in a public subnet

Launch the EC2 instances in a private subnet with a NAT gateway and update the route table

Launch the EC2 instances in a public subnet and use AWS WAF to protect the instances from internet-based attacks

Overall explanation

To prevent direct connectivity to the EC2 instances from the internet you can deploy your EC2 instances in a private subnet and have the ELB in a public subnet. To configure this you must enable a public subnet in the ELB that is in the same AZ as the private subnet.

CORRECT: "Launch the EC2 instances in a private subnet and create an Application Load Balancer in a public subnet" is the correct answer.

INCORRECT: "Launch the EC2 instances in a private subnet with a NAT gateway and update the route table" is incorrect. This configuration will not allow the application to be accessible from the internet, the aim is to only prevent direct access to the EC2 instances.

INCORRECT: "Launch the EC2 instances in a public subnet and use AWS WAF to protect the instances from internet-based attacks" is incorrect. With the EC2 instances in a public subnet, direct access from the internet is possible. It only takes a security group misconfiguration or software exploit and the instance becomes vulnerable to attack.

INCORRECT: "Launch the EC2 instances in a public subnet and create an Application Load Balancer in a public subnet" is incorrect. The EC2 instances should be launched in a private subnet.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/public-load-balancer-private-ec2/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 50Skipped

A company is developing a web-based application that will be used for real-time chat functionality. The application should use WebSocket APIs to maintain a persistent connection with the client. The backend services of the application, hosted in containers within private subnets of a VPC, need to be accessed securely.

Which solution will meet these requirements?

Develop a WebSocket API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Create a security group that allows API Gateway to access the Amazon EKS cluster.

Develop a REST API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Create a security group that allows API Gateway to access the Amazon EKS cluster.

Correct answer

Develop a WebSocket API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Establish a private VPC link for the API Gateway to securely access the Amazon EKS cluster.

Develop a REST API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Establish a private VPC link for the API Gateway to securely access the Amazon EKS cluster.

Overall explanation

The requirement is for a real-time chat application, which makes the use of WebSocket APIs more suitable. Hosting the application in Amazon EKS within a private subnet allows secure and scalable management of the application. Creating a VPC link provides secure, private connectivity between API Gateway and the Amazon EKS service hosted inside the VPC.

CORRECT: "Develop a WebSocket API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Establish a private VPC link for the API Gateway to securely access the Amazon EKS cluster" is the correct answer (as explained above.)

INCORRECT: "Develop a REST API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Establish a private VPC link for the API Gateway to securely access the Amazon EKS cluster" is incorrect.

This solution does provide the secure hosting environment and private connectivity between API Gateway and the Amazon EKS cluster, but REST APIs are not suitable for real-time applications like a chat service. This is because REST APIs use request-response model which doesn't provide the continuous connection needed for real-time communication.

INCORRECT: "Develop a WebSocket API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Create a security group that allows API Gateway to access the Amazon EKS cluster" is incorrect.

This option, while correctly suggesting the use of WebSocket APIs and Amazon EKS, proposes the use of a security group for connectivity. However, security groups act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level, while access to services within VPCs is more securely managed through VPC links.

INCORRECT: "Develop a REST API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Create a security group that allows API Gateway to access the Amazon EKS cluster" is incorrect.

REST APIs are not suitable for a real-time chat application. Also, managing access via a security group is not the most secure method for accessing services hosted within private subnets in a VPC.

References:

https://docs.aws.amazon.com/whitepapers/latest/best-practices-api-gateway-private-apis-integration/websocket-api.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-api-gateway/

Domain

AWS Networking & Content Delivery

Question 51Skipped

A systems administrator of a company wants to detect and remediate the compromise of services such as Amazon EC2 instances and Amazon S3 buckets.

Which AWS service can the administrator use to protect the company against attacks?

Amazon Cognito

Amazon Inspector

Correct answer

Amazon GuardDuty

Amazon Macie

Overall explanation

Amazon GuardDuty gives you access to built-in detection techniques that are developed and optimized for the cloud. The detection algorithms are maintained and continuously improved upon by AWS Security. The primary detection categories include reconnaissance, instance compromise, account compromise, and bucket compromise.

Amazon GuardDuty offers HTTPS APIs, CLI tools, and Amazon CloudWatch Events to support automated security responses to security findings. For example, you can automate the response workflow by using CloudWatch Events as an event source to trigger an AWS Lambda function.

CORRECT: "Amazon GuardDuty" is the correct answer.

INCORRECT: "Amazon Cognito" is incorrect. Cognito provides sign up and sign services for mobiles apps.

INCORRECT: "Amazon Inspector" is incorrect. Inspector is more about identifying vulnerabilities and evaluating against security best practices. It does not detect compromise.

INCORRECT: "Amazon Macie" is incorrect. Macie is used for detecting and protecting sensitive data that is in Amazon S3.

References:

https://aws.amazon.com/guardduty/features/

Save time with our AWS cheat sheets:

https://digitalcloud.training/additional-aws-services/

Domain

AWS Security, Identity, & Compliance

Question 52Skipped

An application requires a MySQL database which will only be used several times a week for short periods. The database needs to provide automatic instantiation and scaling. Which database service is most suitable?

Amazon RDS MySQL

Amazon Aurora

Correct answer

Amazon Aurora Serverless

Amazon EC2 instance with MySQL database installed

Overall explanation

Amazon Aurora Serverless is an on-demand, auto-scaling configuration for Amazon Aurora. The database automatically starts up, shuts down, and scales capacity up or down based on application needs. This is an ideal database solution for infrequently-used applications.

CORRECT: "Amazon Aurora Serverless" is the correct answer.

INCORRECT: "Amazon RDS MySQL" is incorrect as this service requires an instance to be running all the time which is more costly.

INCORRECT: "Amazon EC2 instance with MySQL database installed" is incorrect as this service requires an instance to be running all the time which is more costly.

INCORRECT: "Amazon Aurora" is incorrect as this service requires an instance to be running all the time which is more costly.

References:

https://aws.amazon.com/rds/aurora/serverless/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 53Skipped

A company is planning to migrate a large quantity of important data to Amazon S3. The data will be uploaded to a versioning enabled bucket in the us-west-1 Region. The solution needs to include replication of the data to another Region for disaster recovery purposes.

How should a solutions architect configure the replication?

Create an additional S3 bucket with versioning in another Region and configure cross-origin resource sharing (CORS)

Correct answer

Create an additional S3 bucket with versioning in another Region and configure cross-Region replication

Create an additional S3 bucket in another Region and configure cross-Region replication

Create an additional S3 bucket in another Region and configure cross-origin resource sharing (CORS)

Overall explanation

Replication enables automatic, asynchronous copying of objects across Amazon S3 buckets. Buckets that are configured for object replication can be owned by the same AWS account or by different accounts. You can copy objects between different AWS Regions or within the same Region. Both source and destination buckets must have versioning enabled.

CORRECT: "Create an additional S3 bucket with versioning in another Region and configure cross-Region replication" is the correct answer.

INCORRECT: "Create an additional S3 bucket in another Region and configure cross-Region replication" is incorrect as the destination bucket must also have versioning enabled.

INCORRECT: "Create an additional S3 bucket in another Region and configure cross-origin resource sharing (CORS)" is incorrect as CORS is not related to replication.

INCORRECT: "Create an additional S3 bucket with versioning in another Region and configure cross-origin resource sharing (CORS)" is incorrect as CORS is not related to replication.

References:

https://docs.aws.amazon.com/AmazonS3/latest/dev/replication.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 54Skipped

A digital media company uses an Amazon RDS MySQL instance for its content management system. Recently, the company has observed that their RDS instance is nearing its storage capacity due to the constant influx of new data. The company wants to ensure there's always sufficient storage without any operational interruption or manual intervention.

Which solution should the company use to address this situation with the LEAST operational overhead?

Utilize Amazon ElastiCache to offload some read traffic and reduce database load.

Correct answer

Enable automatic storage scaling for the MySQL instance.

Implement a lifecycle policy to delete older data from the MySQL instance.

Migrate the database to a larger Amazon RDS MySQL instance.

Overall explanation

Amazon RDS's automatic storage scaling allows the database to automatically increase its storage capacity when the available storage is low. This feature helps to prevent out-of-storage situations and requires no operational overhead.

CORRECT: "Enable automatic storage scaling for the MySQL instance" is the correct answer (as explained above.)

INCORRECT: "Migrate the database to a larger Amazon RDS MySQL instance" is incorrect.

While this would provide more storage, it does not address the issue of potential future storage shortages and requires significant operational effort for the migration.

INCORRECT: "Implement a lifecycle policy to delete older data from the MySQL instance" is incorrect.

While this might help free up some storage, it might not be suitable if all data is essential for business operations. Also, this does not provide a long-term solution if data growth continues.

INCORRECT: "Utilize Amazon ElastiCache to offload some read traffic and reduce database load" is incorrect.

While ElastiCache can help to improve the database's read efficiency, it doesn't directly address the disk space concern for the RDS instance.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIOPS.StorageTypes.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 55Skipped

There are badge readers located at every entrance of an organization’s warehouses. A message is sent over HTTPS when badges are scanned to indicate who tried to access the entrance.

A solutions architect must design a system to process these messages. A highly available solution is required. The solution must store results in a durable data store for later analysis.

Which system architecture should the solutions architect recommend?

Direct incoming messages from the sensor to an AWS Lambda function using Amazon Route 53. Create a Lambda function that processes messages and saves results to Amazon DynamoDB.

Set up an Amazon S3 gateway endpoint in your VPC. Connect the facility network to the VPC via a Site-to-Site VPN connection so that sensor data can be written directly to an S3 bucket.

Correct answer

Set up an HTTPS endpoint in Amazon API Gateway. To process the messages and save the results to Amazon DynamoDB, configure an API Gateway endpoint to invoke an AWS Lambda function.

Create an Amazon EC2 instance to serve as the HTTPS endpoint and to process messages. An Amazon S3 bucket should be configured for the EC2 instance to save the results.

Overall explanation

Amazon API Gateway would be ideal for providing a secure entry point for your application, and for traffic to be sent via HTTPS. AWS Lambda would integrate seamlessly with API Gateway to process the data, as an event-driven solution like this would be perfect when designing a scalable system based on sporadic use. Finally, DynamoDB is highly scalable and is a perfect repository for data to be stored for future analysis.

CORRECT: "Set up an HTTPS endpoint in Amazon API Gateway. To process the messages and save the results to Amazon DynamoDB, configure an API Gateway endpoint to invoke an AWS Lambda function" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon EC2 instance to serve as the HTTPS endpoint and to process messages. An Amazon S3 bucket should be configured for the EC2 instance to save the results" is incorrect. As the action of a badge being read to initiate access to a warehouse should only take a few seconds, spinning up an EC2 instance to serve as a HTTPS endpoint would take minutes, and is not suitable for this use case.

INCORRECT: "Direct incoming messages from the sensor to an AWS Lambda function using Amazon Route 53. Create a Lambda function that processes messages and saves results to Amazon DynamoDB” is incorrect. Amazon Route 53 is a managed DNS service, and DNS is not required in this instance as the badge reader does not have a DNS name.

INCORRECT: "Set up an Amazon S3 gateway endpoint in your VPC. Connect the facility network to the VPC via a Site-to-Site VPN connection so that sensor data can be written directly to an S3 bucket" is incorrect. VPC endpoints are designed to facilitate traffic across the AWS backbone network between AWS services and are not used to create connections between external endpoints outside of the AWS network and an Amazon S3 bucket.

References:

https://docs.aws.amazon.com/lambda/latest/dg/services-apigateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Networking & Content Delivery

Question 56Skipped

There are badge readers located at every entrance of an organization’s warehouses. A message is sent over HTTPS when badges are scanned to indicate who tried to access the entrance.

A solutions architect must design a system to process these messages. A highly available solution is required. The solution must store results in a durable data store for later analysis.

Which system architecture should the solutions architect recommend?

Direct incoming messages from the sensor to an AWS Lambda function using Amazon Route 53. Create a Lambda function that processes messages and saves results to Amazon DynamoDB.

Create an Amazon EC2 instance to serve as the HTTPS endpoint and to process messages. An Amazon S3 bucket should be configured for the EC2 instance to save the results.

Correct answer

Set up an HTTPS endpoint in Amazon API Gateway. To process the messages and save the results to Amazon DynamoDB, configure an API Gateway endpoint to invoke an AWS Lambda function.

Set up an Amazon S3 gateway endpoint in your VPC. Connect the facility network to the VPC via a Site-to-Site VPN connection so that sensor data can be written directly to an S3 bucket.

Overall explanation

Amazon API Gateway would be ideal for providing a secure entry point for your application, and for traffic to be sent via HTTPS. AWS Lambda would integrate seamlessly with API Gateway to process the data, as an event-driven solution like this would be perfect when designing a scalable system based on sporadic use. Finally, DynamoDB is highly scalable and is a perfect repository for data to be stored for future analysis.

CORRECT: "Set up an HTTPS endpoint in Amazon API Gateway. To process the messages and save the results to Amazon DynamoDB, configure an API Gateway endpoint to invoke an AWS Lambda function" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon EC2 instance to serve as the HTTPS endpoint and to process messages. An Amazon S3 bucket should be configured for the EC2 instance to save the results" is incorrect. As the action of a badge being read to initiate access to a warehouse should only take a few seconds, spinning up an EC2 instance to serve as a HTTPS endpoint would take minutes, and is not suitable for this use case.

INCORRECT: "Direct incoming messages from the sensor to an AWS Lambda function using Amazon Route 53. Create a Lambda function that processes messages and saves results to Amazon DynamoDB” is incorrect. Amazon Route 53 is a managed DNS service, and DNS is not required in this instance as the badge reader does not have a DNS name.

INCORRECT: "Set up an Amazon S3 gateway endpoint in your VPC. Connect the facility network to the VPC via a Site-to-Site VPN connection so that sensor data can be written directly to an S3 bucket" is incorrect. VPC endpoints are designed to facilitate traffic across the AWS backbone network between AWS services and are not used to create connections between external endpoints outside of the AWS network and an Amazon S3 bucket.

References:

https://docs.aws.amazon.com/lambda/latest/dg/services-apigateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Networking & Content Delivery

Question 57Skipped

Health related data in Amazon S3 needs to be frequently accessed for up to 90 days. After that time the data must be retained for compliance reasons for seven years and is rarely accessed.

Which storage classes should be used?

Store data in INTELLIGENT_TIERING for 90 days then transition to STANDARD_IA

Store data in STANDARD for 90 days then expire the data

Store data in STANDARD for 90 days then transition to REDUCED_REDUNDANCY

Correct answer

Store data in STANDARD for 90 days then transition the data to DEEP_ARCHIVE

Overall explanation

In this case the data is frequently accessed so must be stored in standard for the first 90 days. After that the data is still to be kept for compliance reasons but is rarely accessed so is a good use case for DEEP_ARCHIVE.

CORRECT: "Store data in STANDARD for 90 days then transition the data to DEEP_ARCHIVE" is the correct answer.

INCORRECT: "Store data in INTELLIGENT_TIERING for 90 days then transition to STANDARD_IA" is incorrect. You cannot transition from INTELLIGENT_TIERING to STANDARD_IA.

INCORRECT: "Store data in STANDARD for 90 days then expire the data" is incorrect. Expiring the data is not possible as it must be retained for compliance.

INCORRECT: "Store data in STANDARD for 90 days then transition to REDUCED_REDUNDANCY" is incorrect. You cannot transition from any storage class to REDUCED_REDUNDANCY.

References:

https://docs.aws.amazon.com/AmazonS3/latest/dev/lifecycle-transition-general-considerations.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 58Skipped

A financial services company is migrating its sensitive customer data and applications to AWS. They want to ensure that the data is securely stored and managed while reducing the overall maintenance and operational overhead associated with managing databases.

Which solution will meet these requirements?

Migrate the data to Amazon RDS instances. Enable Amazon GuardDuty for data protection and threat detection.

Correct answer

Migrate the data and applications to Amazon RDS instances. Enable encryption at rest using AWS Key Management Service (AWS KMS).

Migrate the applications and data to Amazon EC2 instances. Utilize the AWS Key Management Service (AWS KMS) customer managed keys for encryption.

Store the data in Amazon S3. Utilize Amazon Macie for ongoing data security and threat detection.

Overall explanation

Amazon RDS makes it easy to go from project conception to deployment by managing time-consuming database administration tasks including backups, software patching, monitoring, scaling, and replication.

Amazon RDS supports encryption at rest, which ensures the security of sensitive data and meets regulatory compliance requirements. AWS Key Management Service (AWS KMS) is integrated with Amazon RDS to make it easier to create, control, and manage keys for encryption.

CORRECT: "Migrate the data and applications to Amazon RDS instances. Enable encryption at rest using AWS Key Management Service (AWS KMS)" is the correct answer (as explained above.)

INCORRECT: "Migrate the applications and data to Amazon EC2 instances. Utilize the AWS Key Management Service (AWS KMS) customer managed keys for encryption" is incorrect.

While this solution offers data encryption, it does not meet the requirement to reduce operational overhead. Managing databases on EC2 instances requires additional administrative tasks, such as managing backups and applying software patches, which Amazon RDS handles automatically.

INCORRECT: "Store the data in Amazon S3. Utilize Amazon Macie for ongoing data security and threat detection" is incorrect.

Amazon S3 and Macie are suitable for data storage and security analysis, respectively. However, Amazon S3 is not designed to serve as a transactional database for applications, which is a key requirement in this scenario.

INCORRECT: "Migrate the data to Amazon RDS instances. Enable Amazon GuardDuty for data protection and threat detection" is incorrect.

While Amazon RDS is a correct choice for database management and Amazon GuardDuty offers threat detection, GuardDuty is not specifically designed for data protection within databases. It's a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

https://digitalcloud.training/aws-kms/

Domain

AWS Database

Question 59Skipped

A corporation has a web-based multiplayer gaming service that operates using both TCP and UDP protocols. Amazon Route 53 is currently employed to direct application traffic to a set of Network Load Balancers (NLBs) in various AWS Regions. To prepare for an increase in user activity, the company must enhance application performance and reduce latency.

Which approach will best meet these requirements?

Correct answer

Implement AWS Global Accelerator ahead of the NLBs and align the Global Accelerator endpoint to use the appropriate listener ports.

Insert an Amazon API Gateway endpoint behind the NLBs, enable API caching, and customize method caching across different stages.

Incorporate Amazon CloudFront in front of the NLBs and extend the duration of the Cache-Control max-age directive.

Substitute the NLBs with Application Load Balancers (ALBs) and set Route 53 to utilize latency-based routing.

Overall explanation

AWS Global Accelerator is designed to improve the availability and performance of your applications for local and global users. It directs traffic to optimal endpoints over the AWS global network, thus enhancing the performance of your TCP and UDP traffic by routing packets through the AWS global network infrastructure, reducing jitter, and improving overall game performance.

CORRECT: "Implement AWS Global Accelerator ahead of the NLBs and align the Global Accelerator endpoint to use the appropriate listener ports" is the correct answer (as explained above.)

INCORRECT: "Incorporate Amazon CloudFront in front of the NLBs and extend the duration of the Cache-Control max-age directive" is incorrect.

Amazon CloudFront is a content delivery network (CDN) that speeds up the delivery of your static and dynamic web content. While it could potentially help with application performance, it doesn't directly improve TCP/UDP performance, which is the specific requirement in this case.

INCORRECT: "Substitute the NLBs with Application Load Balancers (ALBs) and set Route 53 to utilize latency-based routing" is incorrect.

Application Load Balancers (ALBs) are layer 7 load balancers and they do not support the handling of raw TCP and UDP traffic, which is a requirement for the gaming application in the question. NLBs, on the other hand, are suitable for extreme performance needs and for TCP/UDP traffic.

INCORRECT: "Insert an Amazon API Gateway endpoint behind the NLBs, enable API caching, and customize method caching across different stages" is incorrect.

While the API Gateway would add more control and security to the application, the caching feature is not necessarily beneficial for this real-time gaming scenario where the content is likely to change frequently and unpredictably.

References:

https://aws.amazon.com/global-accelerator/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-global-accelerator/

Domain

AWS Networking & Content Delivery

Question 60Skipped

An e-commerce web application needs a highly scalable key-value database. Which AWS database service should be used?

Amazon RedShift

Amazon ElastiCache

Amazon RDS

Correct answer

Amazon DynamoDB

Overall explanation

A key-value database is a type of nonrelational (NoSQL) database that uses a simple key-value method to store data. A key-value database stores data as a collection of key-value pairs in which a key serves as a unique identifier. Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability – this is the best database for these requirements.

CORRECT: "Amazon DynamoDB" is the correct answer.

INCORRECT: "Amazon RDS" is incorrect. Amazon RDS is a relational (SQL) type of database, not a key-value / nonrelational database.

INCORRECT: "Amazon RedShift" is incorrect. Amazon RedShift is a data warehouse service used for online analytics processing (OLAP) workloads.

INCORRECT: "Amazon ElastiCache" is incorrect. Amazon ElastiCache is an in-memory caching database. This is not a nonrelational key-value database.

References:

https://aws.amazon.com/nosql/key-value/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-dynamodb/

Domain

AWS Database

Question 61Skipped

An application runs on EC2 instances in a private subnet behind an Application Load Balancer in a public subnet. The application is highly available and distributed across multiple AZs. The EC2 instances must make API calls to an internet-based service. How can the Solutions Architect enable highly available internet connectivity?

Create a NAT gateway and attach it to the VPC. Add a route to the gateway to each private subnet route table

Configure an internet gateway. Add a route to the gateway to each private subnet route table

Correct answer

Create a NAT gateway in the public subnet of each AZ. Update the route tables for each private subnet to direct internet-bound traffic to the NAT gateway

Create a NAT instance in the private subnet of each AZ. Update the route tables for each private subnet to direct internet-bound traffic to the NAT instance

Overall explanation

The only solution presented that actually works is to create a NAT gateway in the public subnet of each AZ. They must be created in the public subnet as they gain public IP addresses and use an internet gateway for internet access.

The route tables in the private subnets must then be configured with a route to the NAT gateway and then the EC2 instances will be able to access the internet (subject to security group configuration).

CORRECT: "Create a NAT gateway in the public subnet of each AZ. Update the route tables for each private subnet to direct internet-bound traffic to the NAT gateway" is the correct answer.

INCORRECT: "Create a NAT gateway and attach it to the VPC. Add a route to the gateway to each private subnet route table" is incorrect. You do not attach NAT gateways to VPCs, you add them to public subnets.

INCORRECT: "Configure an internet gateway. Add a route to the gateway to each private subnet route table" is incorrect. You cannot add a route to an internet gateway to a private subnet route table (private EC2 instances don’t even have public IP addresses).

INCORRECT: "Create a NAT instance in the private subnet of each AZ. Update the route tables for each private subnet to direct internet-bound traffic to the NAT instance" is incorrect. You do not create NAT instances in private subnets, they must be created in public subnets.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Compute

Question 62Skipped

A financial institution wants to use machine learning (ML) algorithms to detect potential fraudulent transactions. They need to create ML models based on their vast financial transaction data and integrate these models into their business intelligence system for real-time decision-making. The solution should require minimal operational overhead.

Which solution will best meet these requirements?

Use a pre-built ML Amazon Machine Image (AMI) from the AWS Marketplace to build and train models and use AWS Athena for data visualization.

Correct answer

Use Amazon SageMaker to build, train, and deploy ML models, and use Amazon QuickSight for data visualization.

Use Amazon Comprehend for analyzing the transaction data and Amazon Elasticsearch for visualization.

1. Use AWS Glue to perform ETL jobs on the transaction data and use Amazon Forecast for predictive analytics.

Overall explanation

Amazon SageMaker is a fully managed service that provides every developer and data scientist with the ability to build, train, and deploy machine learning models quickly. It can directly connect with data sources and has built-in algorithms to ease the ML process.

Amazon QuickSight is a business intelligence tool that can be used to create dashboards for data visualization. This combination perfectly suits the requirement.

CORRECT: "Use Amazon SageMaker to build, train, and deploy ML models, and use Amazon QuickSight for data visualization" is the correct answer (as explained above.)

INCORRECT: "Use AWS Glue to perform ETL jobs on the transaction data and use Amazon Forecast for predictive analytics" is incorrect.

AWS Glue is primarily used for ETL jobs - cleaning, preparing, and moving data. Amazon Forecast is a fully managed service for time-series forecasting, which might not be a complete solution for detecting fraudulent transactions.

INCORRECT: "Use a pre-built ML Amazon Machine Image (AMI) from the AWS Marketplace to build and train models and use AWS Athena for data visualization" is incorrect.

AWS Marketplace ML AMIs can be used to create and train models, but this will require manual operational effort in terms of setting up and managing the instances. Athena is a query service and does not provide data visualization capabilities that a business intelligence tool like QuickSight provides.

INCORRECT: "Use Amazon Comprehend for analyzing the transaction data and Amazon Elasticsearch for visualization" is incorrect.

Amazon Comprehend is primarily used for natural language processing (NLP), which isn't suited for detecting fraudulent transactions. Elasticsearch is a search and analytics engine and might not be the best tool for the use case described here.

References:

https://aws.amazon.com/sagemaker/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-machine-learning-services/

Domain

AWS Machine Learning

Question 63Skipped

A company is looking for ways to incorporate its current AWS usage expenditure into its operational expense tracking dashboard. A solutions architect has been tasked with proposing a method that enables the company to fetch its current year's cost data and project the costs for the forthcoming 12 months programmatically.

Which approach would fulfill these needs with the MINIMUM operational burden?

Generate AWS Budgets reports on usage cost data and dispatch the data to the corporation through SMTP.

Set up AWS Budgets actions to transmit usage cost data to the corporation via FTP.

Correct answer

Leverage the AWS Cost Explorer API to retrieve usage cost-related data, using pagination for larger data sets.

Make use of downloadable AWS Cost Explorer report files in the .csv format to access usage cost-related data.

Overall explanation

AWS Cost Explorer API provides programmatic access to AWS cost and usage information. The user can query for aggregated data such as total monthly costs or total daily usage with this API.

Also, the Cost Explorer API supports pagination for managing larger data sets, making it efficient for larger queries.

CORRECT: "Leverage the AWS Cost Explorer API to retrieve usage cost-related data, using pagination for larger data sets" is the correct answer (as explained above.)

INCORRECT: "Make use of downloadable AWS Cost Explorer report files in the .csv format to access usage cost-related data" is incorrect.

While AWS Cost Explorer does allow you to download .csv reports of your cost data, this method would not be programmatically accessible and would involve manual steps to download and process the data.

INCORRECT: "Set up AWS Budgets actions to transmit usage cost data to the corporation via FTP" is incorrect.

AWS Budgets actions allow you to set custom cost and usage budgets that trigger actions (such as turning off EC2 instances) when the budget thresholds you set are breached. However, AWS Budgets does not support transmitting data via FTP.

INCORRECT: "Generate AWS Budgets reports on usage cost data and dispatch the data to the corporation through SMTP" is incorrect.

AWS Budgets does not support the dispatching of data through SMTP. AWS Budgets is primarily a tool for setting up alerts on your AWS costs or usage to control your costs, rather than a tool for exporting or transmitting cost data.

References:

https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_Operations_AWS_Cost_Explorer_Service.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-cost-management/

Domain

AWS Management & Governance

Question 64Skipped

An application allows users to upload and download files. Files older than 2 years will be accessed less frequently. A solutions architect needs to ensure that the application can scale to any number of files while maintaining high availability and durability.

Which scalable solutions should the solutions architect recommend?

Store the files in Amazon Elastic Block Store (EBS) volumes. Create a lifecycle policy to move files older than 2 years to Amazon S3 Glacier

Store the files in Amazon Elastic Block Store (EBS) volumes. Schedule snapshots of the volumes. Use the snapshots to archive data older than 2 years

Store the files on Amazon Elastic File System (EFS) with a lifecycle policy that moves objects older than 2 years to EFS Infrequent Access (EFS IA)

Correct answer

Store the files on Amazon S3 with a lifecycle policy that moves objects older than 2 years to S3 Standard Infrequent Access (S3 Standard-IA)

Overall explanation

S3 Standard-IA is for data that is accessed less frequently, but requires rapid access when needed. S3 Standard-IA offers the high durability, high throughput, and low latency of S3 Standard, with a low per GB storage price and per GB retrieval fee. This combination of low cost and high performance make S3 Standard-IA ideal for long-term storage, backups, and as a data store for disaster recovery files.

CORRECT: "Store the files on Amazon S3 with a lifecycle policy that moves objects older than 2 years to S3 Standard Infrequent Access (S3 Standard-IA)" is the correct answer.

INCORRECT: "Store the files on Amazon Elastic File System (EFS) with a lifecycle policy that moves objects older than 2 years to EFS Infrequent Access (EFS IA)" is incorrect. With EFS you can transition files to EFS IA after a file has not been accessed for a specified period of time with options up to 90 days. You cannot transition based on an age of 2 years.

INCORRECT: "Store the files in Amazon Elastic Block Store (EBS) volumes. Schedule snapshots of the volumes. Use the snapshots to archive data older than 2 years" is incorrect. You cannot identify the age of data and archive snapshots in this way with EBS.

INCORRECT: "Store the files in Amazon Elastic Block Store (EBS) volumes. Create a lifecycle policy to move files older than 2 years to Amazon S3 Glacier" is incorrect. You cannot archive files from an EBS volume to Glacier using lifecycle policies.

References:

https://aws.amazon.com/s3/storage-classes/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 65Skipped

A company is in the process of improving its security posture and wants to analyze and rectify a high volume of failed login attempts and unauthorized activities being logged in AWS CloudTrail.

What is the most efficient solution to help the company identify these security events with the LEAST amount of operational effort?

Leverage AWS Lambda to trigger on CloudTrail log updates and use a custom script to scan for failed logins and unauthorized actions.

Utilize AWS Data Pipeline to regularly extract CloudTrail logs and use a custom script to identify the required security events.

Implement Amazon Elasticsearch Service with Kibana to visualize the CloudTrail logs and manually search for these events.

Correct answer

Use Amazon Athena to directly query CloudTrail logs for failed logins and unauthorized activities.

Overall explanation

Amazon Athena can directly query data from S3 (where CloudTrail logs are stored) using standard SQL, making it a powerful and efficient tool for analyzing these logs. You don't need to manage any infrastructure or write custom scripts, and you can quickly write and run queries to identify the required security events.

CORRECT: "Use Amazon Athena to directly query CloudTrail logs for failed logins and unauthorized activities" is the correct answer (as explained above.)

INCORRECT: "Leverage AWS Lambda to trigger on CloudTrail log updates and use a custom script to scan for failed logins and unauthorized actions" is incorrect.

While Lambda functions can be triggered based on CloudTrail log updates and could theoretically be used to scan for security events, this would require substantial setup and ongoing maintenance of the script. It's not the most efficient choice.

INCORRECT: "Utilize AWS Data Pipeline to regularly extract CloudTrail logs and use a custom script to identify the required security events" is incorrect.

This solution could work, but the operational overhead of managing the extraction process and maintaining a custom script for analysis is not minimal.

INCORRECT: "Implement Amazon Elasticsearch Service with Kibana to visualize the CloudTrail logs and manually search for these events" is incorrect.

While Elasticsearch and Kibana provide powerful search and visualization capabilities, respectively, they require a fair amount of setup and management. This option would provide more in-depth analysis and real-time monitoring, but it wouldn't be the most efficient way to simply identify the security events mentioned.

References:

https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-athena/

Domain

AWS Analytics

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries