Question 0: A Solutions Architect is designing an application that will encrypt all data in an Amazon Redshift cluster. Which action will encrypt the data at rest?
Option A: Place the Redshift cluster in a private subnet.
Option B: Use the AWS KMS Default Customer master key.
Option C: Encrypt the Amazon EBS volumes.
Option D: Encrypt the data using SSL/TLS.

Question 1: A website experiences unpredictable traffic. During peak traffic times, the database is unable to keep up with the write request. Which AWS service will help decouple the web application from the database?
Option A: Amazon SQS
Option B: Amazon EFS
Option C: Amazon S3
Option D: AWS Lambda

Question 2: A legacy application needs to interact with local storage using iSCSI. A team needs to design a reliable storage solution to provision all new storage on AWS. Which storage solution meets the legacy application requirements?
Option A: AWS Snowball storage for the legacy application until the application can be re-architected.
Option B: AWS Storage Gateway in cached mode for the legacy application storage to write data to Amazon S3.
Option C: AWS Storage Gateway in stored mode for the legacy application storage to write data to Amazon S3.
Option D: An Amazon S3 volume mounted on the legacy application server locally using the File Gateway service

Question 3: A Solutions Architect is designing an architecture for a mobile gaming application. The application is expected to be very popular. The Architect needs to prevent the Amazon RDS MySQL database from becoming a bottleneck due to frequently accessed queries. Which service or feature should the Architect add to prevent a bottleneck?
Option A: Multi-AZ feature on the RDS MySQL Database
Option B: ELB Classic Load Balancer in front of the web application tier
Option C: Amazon SQS in front of RDS MySQL Database
Option D: Amazon ElastiCache in front of the RDS MySQL Database

Question 4: A company is launching an application that it expects to be very popular. The company needs a database that can scale with the rest of the application. The schema will change frequently. The application cannot afford any downtime for database changes. Which AWS service allows the company to achieve these objectives?
Option A: Amazon Redshift
Option B: Amazon DynamoDB
Option C: Amazon RDS MySQL
Option D: Amazon Aurora

Question 5: A Solution Architect is designing a disaster recovery solution for a 5 TB Amazon Redshift cluster. The recovery site must be at least 500 miles (805 kilometers) from the live site. How should the Architect meet these requirements?
Option A: Use AWS CloudFormation to deploy the cluster in a second region.
Option B: Take a snapshot of the cluster and copy it to another Availability Zone.
Option C: Modify the Redshift cluster to span two regions.
Option D: Enable cross-region snapshots to a different region.

Question 6: A customer has written an application that uses Amazon S3 exclusively as a data store. The application works well until the customer increases the rate at which the application is updating information. The customer now reports that outdated data occasionally appears when the application accesses objects in Amazon S3. What could be the problem, given that the application logic is otherwise correct?
Option A: The application is reading parts of objects from Amazon S3 using a range header.
Option B: The application is reading objects from Amazon S3 using parallel object requests.
Option C: The application is updating records by writing new objects with unique keys.
Option D: The application is updating records by overwriting existing objects with the same keys.

Question 7: A Solutions Architect is designing a new social media application. The application must provide a secure method for uploading profile photos. Each user should be able to upload a profile photo into a shared storage location for one week after their profile is created. Which approach will meet all of these requirements?
Option A: Use Amazon Kinesis with AWS CloudTrail for auditing the specific times when profile photos are uploaded.
Option B: Use Amazon EBS volumes with IAM policies restricting user access to specific time periods.
Option C: Use Amazon S3 with the default private access policy and generate pre-signed URLs each time a new site profile is created.
Option D: Use Amazon CloudFront with AWS CloudTrail for auditing the specific times when profile photos are uploaded.

Question 8: An application requires block storage for le updates.The data is 500 GB and must continuously sustain 100 MiB / s of aggregate read / write operations.Which storage option is appropriate for this application ?
Option A: Amazon S3
Option B: Amazon EFS
Option C: Amazon EBS
Option D: Amazon Glacier

Question 9: A mobile application serves scientific articles from individual files in an Amazon S3 bucket.Articles older than 30 days are rarely read.Articles older than 60 days no longer need to be available through the application,but the application owner would like to keep themfor historical purposes.Which cost - effective solution BEST meets these requirements ?
Option A: Create a Lambda function to move files older than 30 days to Amazon EBS and move files older than 60 days to Amazon Glacier.
Option B: Create a Lambda function to move files older than 30 days to Amazon Glacier and move files older than 60 days to Amazon EBS.
Option C: Create lifecycle rules to move files older than 30 days to Amazon S3 Standard Infrequent Access and move files older than 60 days to Amazon Glacier.
Option D: Create lifecycle rules to move files older than 30 days to Amazon Glacier and move files older than 60 days to Amazon S3 Standard

Question 10: An organization is currently hosting a large amount of frequently accessed data consisting of key-value pairs and semi-structured documents in their data center. They are planning to move this data to AWS. Which of one of the following services MOST effectively meets their needs?
Option A: Amazon Redshift
Option B: Amazon RDS
Option C: Amazon DynamoDB
Option D: Amazon Aurora

Question 11: A Lambda function must execute a query against an Amazon RDS database in a private subnet. Which steps are required to allow the Lambda function to access the Amazon RDS database? (Select two.)
Option A: Create a VPC Endpoint for Amazon RDS.
Option B: Create the Lambda function within the Amazon RDS VPC.
Option C: Change the ingress rules of Lambda security group, allowing the Amazon RDS security group.
Option D: Change the ingress rules of the Amazon RDS security group, allowing the Lambda security group.
Option E: Add an Internet Gateway (IGW) to the VPC, route the private subnet to the IGW.

Question 12: A Solutions Architect needs to build a resilient data warehouse using Amazon Redshift. The Architect needs to rebuild the Redshift cluster in another region. Which approach can the Architect take to address this requirement?
Option A: Modify the Redshift cluster and Configure cross-region snapshots to the other region.
Option B: Modify the Redshift cluster to take snapshots of the Amazon EBS volumes each day, sharing those snapshots with the other region.
Option C: Modify the Redshift cluster and Configure the backup and specify the Amazon S3 bucket in the other region.
Option D: Modify the Redshift cluster to use AWS Snowball in export mode with data delivered to the other region.

Question 13: A popular e-commerce application runs on AWS. The application encounters performance issues. The database is unable to handle the amount of queries and load during peak times. The database is running on the RDS Aurora engine on the largest instance size available. What should an administrator do to improve performance?
Option A: Convert the database to Amazon Redshift.
Option B: Create a CloudFront distribution.
Option C: Convert the database to use EBS Provisioned IOPS.
Option D: Create one or more read replicas.

Question 14: A Solutions Architect is designing the architecture for a new three-tier web-based e-commerce site that must be available 24/7. Requests are expected to range from 100 to 10,000 each minute. Usage can vary depending on time of day, holidays, and promotions. The design should be able to handle these volumes, with the ability to handle higher volumes if necessary. How should the Architect design the architecture to ensure the web tier is cost-optimized and can handle the expected traffic? (Select two.)
Option A: Launch Amazon EC2 instances in an Auto Scaling group behind an ELB.
Option B: Store all static files in a multi-AZ Amazon Aurora database.
Option C: Create an CloudFront distribution pointing to static content in Amazon S3.
Option D: Use Amazon Route 53 to route traffic to the correct region.
Option E: Use Amazon S3 multi-part uploads to improve upload times.

Question 15: A Solution Architect is designing a three-tier web application. The Architect wants to restrict access to the database tier to accept traffic from the application servers only. However, these application servers are in an Auto Scaling group and may vary in quantity. How should the Architect Configure the database servers to meet the requirements?
Option A: Configure the database security group to allow database traffic from the application server IP addresses.
Option B: Configure the database security group to allow database traffic from the application server security group.
Option C: Configure the database subnet network ACL to deny all inbound non-database traffic from the application-tier subnet.
Option D: Configure the database subnet network ACL to allow inbound database traffic from the application-tier subnet.

Question 16: An Internet-facing multi-tier web application must be highly available. An ELB Classic Load Balancer is deployed in front of the web tier. Amazon EC2 instances at the web application tier are deployed evenly across two Availability Zones.The database is deployed using RDS Multi-AZ. A NAT instance is launched for Amazon EC2 instances and database resources to access the Internet. These instances are not assigned with public IP addresses. Which component poses a potential single point of failure in this architecture?
Option A: Amazon EC2
Option B: NAT instance
Option C: ELB Classic Load Balancer
Option D: Amazon RDS

Question 17: A call center application consists of a three - tier application using Auto Scaling groups to automatically scale resources as needed. Users report that every morning at 9:00 AM the system becomes very slow for about 15 minutes.A Solution Architect determines that a large percentage of the call center staff starts work at 9:00 AM,so Auto Scaling does not have enough time to scale out to meet demand.How can the Architect x the problem?
Option A: Change the Auto Scaling group 's scale out event to scale based on network utilization.
Option B: Create an Auto Scaling scheduled action to scale out the necessary resources at 8: 30 AM every morning.
Option C: Use Reserved Instances to ensure the system has reserved the right amount of capacity for the scale-up events.
Option D: Permanently keep a steady state of instances that is needed at 9: 00 AM to guarantee available resources, but leverage Spot Instances.

Question 18: An e-commerce application is hosted in AWS. The last time a new product was launched, the application experienced a performance issue due to an enormous spike in traffic. Management decided that capacity must be doubled the week after the product is launched. Which is the MOST efficient way for management to ensure that capacity requirements are met?
Option A: Add a Step Scaling policy.
Option B: Add a Dynamic Scaling policy.
Option C: Add a Scheduled Scaling action.
Option D: Add Amazon EC2 Spot Instances.

Question 19: A customer owns a simple API for their website that receives about 1,000 requests each day and has an average response time of 50 ms. It is currently hosted on one c4.large instance. Which changes to the architecture will provide high availability at the LOWEST cost?
Option A: Create an Auto Scaling group with a minimum of one instance and a maximum of two instances, then use an Application Load Balancer to balance the traffic.
Option B: Recreate the API using Amazon API Gateway and use AWS Lambda as the service backend.
Option C: Create an Auto Scaling group with a maximum of two instances, then use an Application Load Balancer to balance the traffic.
Option D: Recreate the API using Amazon API Gateway and integrate the new API with the existing backend service.

Question 20: A Solution Architect is designing an application that uses Amazon EBS volumes. The volumes must be backed up to a different region. How should the Architect meet this requirement?
Option A: Create EBS snapshots directly from one region to another.
Option B: Move the data to an Amazon S3 bucket and enable cross-region replication.
Option C: Create EBS snapshots and then copy them to the desired region.
Option D: Use a script to copy data from the current Amazon EBS volume to the destination Amazon EBS volume.

Question 21: A company is using an Amazon S3 bucket located in us-west-2 to serve videos to their customers. Their customers are located all around the world and the videos are requested a lot during peak hours. Customers in Europe complain about experiencing slow downloaded speeds, and during peak hours, customers in all locations report experiencing HTTP 500 errors. What can a Solutions Architect do to address these issues?
Option A: Place an elastic load balancer in front of the Amazon S3 bucket to distribute the load during peak hours.
Option B: Cache the web content with Amazon CloudFront and use all Edge locations for content delivery.
Option C: Replicate the bucket in eu-west-1 and use an Amazon Route 53 failover routing policy to determine which bucket it should serve the request to.
Option D: Use an Amazon Route 53 weighted routing policy for the CloudFront domain name to distribute the GET request between CloudFront and the Amazon S3 bucket directly.

Question 22: A Solutions Architect is designing a solution that includes a managed VPN connection. To monitor whether the VPN connection is up or down, the Architect should use:
Option A: an external service to ping the VPN endpoint from outside the VPC.
Option B: AWS CloudTrail to monitor the endpoint.
Option C: the CloudWatch TunnelState Metric.
Option D: an AWS Lambda function that parses the VPN connection logs.

Question 23: A social networking portal experiences latency and throughput issues due to an increased number of users. Application servers use very large datasets from an Amazon RDS database, which creates a performance bottleneck on the database. Which AWS service should be used to improve performance?
Option A: Auto Scaling
Option B: Amazon SQS
Option C: Amazon ElastiCache
Option D: ELB Application Load Balancer

Question 24: A Solutions Architect is designing network architecture for an application that has compliance requirements. The application will be hosted on Amazon EC2 instances in a private subnet and will be using Amazon S3 for storing data. The compliance requirements mandate that the data cannot traverse the public Internet. What is the MOST secure way to satisfy this requirement?
Option A: Use a NAT Instance.
Option B: Use a NAT Gateway.
Option C: Use a VPC endpoint.
Option D: Use a Virtual Private Gateway.

Question 25: Developers are creating a new online transaction processing (OLTP) application for a small database that is very read-write intensive. A single table in the database is updated continuously throughout the day, and the developers want to ensure that the database performance is consistent. Which Amazon EBS storage option will achieve the MOST consistent performance to help maintain application performance?
Option A: Provisioned IOPS SSD
Option B: General Purpose SSD
Option C: Cold HDD
Option D: Throughput Optimized HDD

Question 26: A Solutions Architect is designing a log-processing solution that requires storage that supports up to 500 MB/s throughput. The data is sequentially accessed by an Amazon EC2 instance. Which Amazon storage type satisfies these requirements?
Option A: EBS Provisioned IOPS SSD (io1)
Option B: EBS General Purpose SSD (gp2)
Option C: EBS Throughput Optimized HDD (st1)
Option D: EBS Cold HDD (sc1)

Question 27: A company's development team plans to create an Amazon S3 bucket that contains millions of images.The team wants to maximize the read performance of Amazon S3.Which naming scheme should the company use
Option A: Add a date as the prefix.
Option B: Add a sequential id as the suffix.
Option C: Add a hexadecimal hash as the suffix.
Option D: Add a hexadecimal hash as the prefix.

Question 28: A Solutions Architect needs to design a solution that will enable a security team to detect,review,and perform root cause analysis of security incidents that occur in a cloud environment.The Architect must provide a centralized view of all API eventsfor current and future AWS regions.How should the Architect accomplish this task ?
Option A: Enable AWS CloudTrail logging in each individual region.Repeat thisfor all future regions.
Option B: Enable Amazon CloudWatch logs for all AWS services across all regions and aggregate them in a single Amazon S3 bucket.
Option C: Enable AWS Trusted Advisor security checks and report all security incidentsfor all regions.
Option D: Enable AWS CloudTrail by creating a new trail and apply the trail to all regions.

Question 29: A company has a legacy application using a proprietary le system and plans to migrate the application to AWS.Which storage service should the company use ?
Option A: Amazon DynamoDB
Option B: Amazon S3
Option C: Amazon EBS
Option D: Amazon EFS

Question 30: A company plans to use AWS for all new batch processing workloads.The company 's developers use Docker containers for the new batch processing. The system design must accommodate critical and non-critical batch processing workloads 24/7. How should a Solutions Architect design this architecture in a cost-efficient manner?
Option A: Purchase Reserved Instances to run all containers. Use Auto Scaling groups to schedule jobs.
Option B: Host a container management service on Spot Instances. Use Reserved Instances to run Docker containers.
Option C: Use Amazon ECS orchestration and Auto Scaling groups: one with Reserve Instances, one with Spot Instances.
Option D: Use Amazon ECS to manage container orchestration. Purchase Reserved Instances to run all batch workloads at the same time.

Question 31: A company is evaluating Amazon S3 as a data storage solution for their daily analyst reports. The company has implemented stringent requirements concerning the security of the data at rest. specifically, the CISO asked for the use of envelope encryption with separate permissions for the use of an envelope key, automated rotation of the encryption keys, and visibility into when an encryption key was used and by whom. Which steps should a Solutions Architect take to satisfy the security requirements requested by the CISO?
Option A: Create an Amazon S3 bucket to store the reports and use Server-Side Encryption with Customer-Provided Keys (SSE-C).
Option B: Create an Amazon S3 bucket to store the reports and use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).
Option C: Create an Amazon S3 bucket to store the reports and use Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS).
Option D: Create an Amazon S3 bucket to store the reports and use Amazon s3 versioning with Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).

Question 32: A customer has a production application that frequently overwrites and deletes data, the application requires the most up-to-date version of the data every time it is requested. Which storage should a Solutions Architect recommend to bet accommodate this use case?
Option A: Amazon S3
Option B: Amazon RDS
Option C: Amazon RedShift
Option D: AWS Storage Gateway

Question 33: A Solutions Architect is designing a photo application on AWS. Every time a user uploads a photo to Amazon S3, the Architect must insert a new item to a DynamoDB table. Which AWS-managed service is the BEST to insert the item?
Option A: Lambda@Edge
Option B: AWS Lambda
Option C: Amazon API Gateway
Option D: Amazon EC2 instances

Question 34: An application relies on messages being sent and received in order. The volume will never exceed more than 300 transactions each second. Which service should be used?
Option A: Amazon SQS
Option B: Amazon SNS
Option C: Amazon ECS
Option D: AWS STS

Question 35: A Solutions Architect is designing an application on AWS that uses persistent block storage. Data must be encrypted at rest. Which solution meets the requirement?
Option A: Enable SSL on Amazon EC2 instances.
Option B: Encrypt Amazon EBS volumes on Amazon EC2 instances.
Option C: Enable server-side encryption on Amazon S3.
Option D: Encrypt Amazon EC2 Instance Storage.

Question 36: A company is launching a static website using the zone apex (mycompany.com). The company wants to use Amazon Route 53 for DNS. Which steps should the company perform to implement a scalable and cost-effective solution? (Choose two.)
Option A: Host the website on an Amazon EC2 instance with ELB and Auto Scaling, and map a Route 53 alias record to the ELB endpoint.
Option B: Host the website using AWS Elastic Beanstalk, and map a Route 53 alias record to the Beanstalk stack.
Option C: Host the website on an Amazon EC2 instance, and map a Route 53 alias record to the public IP address of the Amazon EC2 instance.
Option D: Serve the website from an Amazon S3 bucket, and map a Route 53 alias record to the website endpoint.
Option E: Create a Route 53 hosted zone, and set the NS records of the domain to use Route 53 name servers.

Question 37: A manufacturing company captures data from machines running at customer sites. Currently, thousands of machines send data every 5 minutes, and this is expected to grow to hundreds of thousands of machines in the near future. The data is logged with the intent to be analyzed in the future as needed. What is the SIMPLEST method to store this streaming data at scale?
Option A: Create an Amazon Kinesis Firehouse delivery stream to store the data in Amazon S3.
Option B: Create an Auto Scaling group of Amazon EC2 servers behind ELBs to write the data into Amazon RDS.
Option C: Create an Amazon SQS queue, and have the machines write to the queue.
Option D: Create an Amazon EC2 server farm behind an ELB to store the data in Amazon EBS Cold HDD volumes.

Question 38: A bank is writing new software that is heavily dependent upon the database transactions for write consistency. The application will also occasionally generate reports on data in the database, and will do joins across multiple tables. The database must automatically scale as the amount of data grows. Which AWS service should be used to run the database?
Option A: Amazon S3
Option B: Amazon Aurora
Option C: Amazon DynamoDB
Option D: Amazon Redshift

Question 39: A Solutions Architect is designing a new application that needs to access data in a different AWS account located within the same region. The data must not be accessed over the Internet. Which solution will meet these requirements with the LOWEST cost?
Option A: Add rules to the security groups in each account.
Option B: Establish a VPC Peering connection between accounts.
Option C: Configure Direct Connect in each account.
Option D: Add a NAT Gateway to the data account.

Question 40: A Solutions Architect is designing a mobile application that will capture receipt images to track expenses. The Architect wants to store the images on Amazon S3. However, uploading images through the web server will create too much traffic. What is the MOST efficient method to store images from a mobile application on Amazon S3?
Option A: Upload directly to S3 using a pre-signed URL.
Option B: Upload to a second bucket, and have Lambda event copy the image to the primary bucket.
Option C: Upload to a separate Auto Scaling group of servers behind an ELB Classic Load Balancer, and have them write to the Amazon S3 bucket.
Option D: Expand the web server fleet with Spot Instances to provide the resources to handle the images.

Question 41: A company requires that the source, destination, and protocol of all IP packets be recorded when traversing a private subnet. What is the MOST secure and reliable method of accomplishing this goal.
Option A: Create VPC flow logs on the subnet.
Option B: Enable source destination check on private Amazon EC2 instances.
Option C: Enable AWS CloudTrail logging and specify an Amazon S3 bucket for storing log files.
Option D: Create an Amazon CloudWatch log to capture packet information.

Question 42: A Solutions Architect has a multi-layer application running in Amazon VPC. The application has an ELB Classic Load Balancer as the front end in a public subnet, and an Amazon EC2-based reverse proxy that performs content-based routing to two backend Amazon EC2 instances hosted in a private subnet. The Architect sees tremendous traffic growth and is concerned that the reverse proxy and current backend set up will be insu cient. Which actions should the Architect take to achieve a cost-effective solution that ensures the application automatically scales to meet traffic demand? (Select two.)
Option A: Replace the Amazon EC2 reverse proxy with an ELB internal Classic Load Balancer.
Option B: Add Auto Scaling to the Amazon EC2 backend eet.
Option C: Add Auto Scaling to the Amazon EC2 reverse proxy layer.
Option D: Use t2 burstable instance types for the backend fleet.
Option E: Replace both the frontend and reverse proxy layers with an ELB Application Load Balancer.

Question 43: A company is launching a marketing campaign on their website tomorrow and expects a significant increase in traffic. The website is designed as a multi-tiered web architecture, and the increase in traffic could potentially overwhelm the current design. What should a Solutions Architect do to minimize the effects from a potential failure in one or more of the tiers?
Option A: Migrate the database to Amazon RDS.
Option B: Set up DNS failover to a statistic website.
Option C: Use Auto Scaling to keep up with the demand.
Option D: Use both a SQL and a NoSQL database in the design.

Question 44: A web application experiences high compute costs due to serving a high amount of static web content. How should the web server architecture be designed to be the MOST cost-efficient?
Option A: Create an Auto Scaling group to scale out based on average CPU usage.
Option B: Create an Amazon CloudFront distribution to pull static content from an Amazon S3 bucket.
Option C: Leverage Reserved Instances to add additional capacity at a significantly lower price.
Option D: Create a multi-region deployment using an Amazon Route 53 geolocation routing policy.

Question 45: A Solutions Architect plans to migrate NAT instances to NAT gateway. The Architect has NAT instances with scripts to manage high availability. What is the MOST efficient method to achieve similar high availability with NAT gateway?
Option A: Remove source/destination check on NAT instances.
Option B: Launch a NAT gateway in each Availability Zone.
Option C: Use a mix of NAT instances and NAT gateway.
Option D: Add an ELB Application Load Balancer in front of NAT gateway.

Question 46: A Solutions Architect is designing a solution to store a large quantity of event data in Amazon S3. The Architect anticipates that the workload will consistently exceed 100 requests each second. What should the Architect do in Amazon S3 to optimize performance?
Option A: Randomize a key name prefix.
Option B: Store the event data in separate buckets.
Option C: Randomize the key name suffix.
Option D: Use Amazon S3 Transfer Acceleration.

Question 47: A user is testing a new service that receives location updates from 3,600 rental cars every hour. Which service will collect data and automatically scale to accommodate production workload?
Option A: Amazon EC2
Option B: Amazon Kinesis Firehose
Option C: Amazon EBS
Option D: Amazon API Gateway

Question 48: A Solutions Architect is designing a web application. The web and application tiers need to access the Internet, but they cannot be accessed from the Internet. Which of the following steps is required?
Option A: Attach an Elastic IP address to each Amazon EC2 instance and add a route from the private subnet to the public subnet.
Option B: Launch a NAT gateway in the public subnet and add a route to it from the private subnet.
Option C: Launch Amazon EC2 instances in the public subnet and change the security group to allow outbound traffic on port 80.
Option D: Launch a NAT gateway in the private subnet and deploy a NAT instance in the private subnet.

Question 49: An application stack includes an Elastic Load Balancer in a public subnet, a fleet of Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL cluster. Users connect to the application from the Internet. The application servers and database must be secure. How should a Solutions Architect perform this task?
Option A: Create a private subnet for the Amazon EC2 instances and a public subnet for the Amazon RDS cluster.
Option B: Create a private subnet for the Amazon EC2 instances and a private subnet for the Amazon RDS cluster.
Option C: Create a public subnet for the Amazon EC2 instances and a private subnet for the Amazon RDS cluster.
Option D: Create a public subnet for the Amazon EC2 instances and a public subnet for the Amazon RDS cluster.

Question 50: A Solutions Architect is designing a solution for a media company that will stream large amounts of data from an Amazon EC2 instance. The data streams are typically large and sequential, and must be able to support up to 500 MB/s. Which storage type will meet the performance requirements of this application?
Option A: EBS Provisioned IOPS SSD
Option B: EBS General Purpose SSD
Option C: EBS Cold HDD
Option D: EBS Throughput Optimized HDD

Question 51: A legacy application running in premises requires a Solutions Architect to be able to open a firewall to allow access to several Amazon S3 buckets. The Architect has a VPN connection to AWS in place. How should the Architect meet this requirement?
Option A: Create an IAM role that allows access from the corporate network to Amazon S3.
Option B: Configure a proxy on Amazon EC2 and use an Amazon S3 VPC endpoint.
Option C: Use Amazon API Gateway to do IP whitelisting.
Option D: Configure IP whitelisting on the customer's gateway.

Question 52: A Solutions Architect is designing a database solution that must support a high rate of random disk reads and writes.It must provide consistent performance,and requires long - term persistence.Which storage solution BEST meets these requirements ?
Option A: An Amazon EBS Provisioned IOPS volume
Option B: An Amazon EBS General Purpose volume
Option C: An Amazon EBS Magnetic volume
Option D: An Amazon EC2 Instance Store

Question 53: A Solutions Architect is designing solution with AWS Lambda where different environments require different database passwords.What should the Architect do to accomplish this in a secure and scalable way ?
Option A: Create a Lambda functionfor each individual environment.
Option B: Use Amazon DynamoDB to store environmental variables.
Option C: Use encrypted AWS Lambda environmental variables.
Option D: Implement a dedicated Lambda functionfor distributing variables.

Question 54: A news organization plans to migrate their 20 TB video archive to AWS.The files are rarely accessed,but when they are,a request is made in advance and a 3 to 5 - hour retrieval time frame is acceptable.However,when there is a breaking news story,the editors require access to archived footage within minutes.Which storage solution meets the needs of this organizationwhile providing the LOWEST cost of storage ?
Option A: Store the archive in Amazon S3 Reduced Redundancy Storage.
Option B: Store the archive in Amazon Glacier and use standard retrievalfor all content.
Option C: Store the archive in Amazon Glacier and pay the additional chargefor expedited retrieval when needed.
Option D: Store the archive in Amazon S3 with a lifecycle policy to move this to S3 Infrequent Access after 30 days.

Question 55: A Solutions Architect is building a multi - tier website.The web servers will be in a public subnet,and the database servers will be in a private subnet.Only the web servers can be accessed from the Internet.The database servers must have Internet accessfor software updates.Which solution meets the requirements ?
Option A: Assign Elastic IP addresses to the database instances.
Option B: Allow Internet traffic on the private subnet through the network ACL.
Option C: Use a NAT Gateway.
Option D: Use an egress - only Internet Gateway.

Question 56: A Solutions Architect is designing a Lambda function that calls an API to list all running Amazon RDS instances.How should the request be authorized ?
Option A: Create an IAM access and secret key,and store it in the Lambda function.
Option B: Create an IAM role to the Lambda function with permissions to list all Amazon RDS instances.
Option C: Create an IAM role to Amazon RDS with permissions to list all Amazon RDS instances.
Option D: Create an IAM access and secret key,and store it in an encrypted RDS database.

Question 57: A Solutions Architect is building an application on AWS that will require 20,000 IOPS on a particular volume to support a media event.Once the event ends,the IOPS need is no longer required.The marketing team asks the Architect to build the platform to optimize storage without incurring downtime.How should the Architect design the platform to meet these requirements ?
Option A: Change the Amazon EC2 instant types.
Option B: Change the EBS volume type to Provisioned IOPS.
Option C: Stop the Amazon EC2 instance and provision IOPS for the EBS volume.
Option D: Enable an API Gateway to change the endpoints for the Amazon EC2 instances.

Question 58: A Solutions Architect is building a new feature using a Lambda to create metadata when a user uploads a picture to Amazon S3. All metadata must be indexed.Which AWS service should the Architect use to store this metadata?
Option A: Amazon S3
Option B: Amazon DynamoDB
Option C: Amazon Kinesis
Option D: Amazon EFC

Question 59: An interactive, dynamic website runs on Amazon EC2 instances in a single subnet behind an ELB Classic Load Balancer. Which design changes will make the site more highly available?
Option A: Move some Amazon EC2 instances to a subnet in a different way.
Option B: Move the website to Amazon S3.
Option C: Change the ELB to an Application Load Balancer.
Option D: Move some Amazon EC2 instances to a subnet in the same Availability Zone.

Question 60: A Solutions Architect is designing a web application that is running on an Amazon EC2 instance. The application stores data in DynamoDB. The Architect needs to secure access to the DynamoDB table. What combination of steps does AWS recommend to achieve secure authorization? (Select two.)
Option A: Store an access key on the Amazon EC2 instance with rights to the Dynamo DB table.
Option B: Attach an IAM user to the Amazon EC2 instance.
Option C: Create an IAM role with permissions to write to the DynamoDB table.
Option D: Attach an IAM role to the Amazon EC2 instance.
Option E: Attach an IAM policy to the Amazon EC2 instance.

Question 61: A Solutions Architect is about to deploy an API on multiple EC2 instances in an Auto Scaling group behind an ELB. The support team has the following operational requirements: 1 They get an alert when the requests per second go over 50,000 2 They get an alert when latency goes over 5 seconds 3 They can validate how many times a day users call the API requesting highly-sensitive data Which combination of steps does the Architect need to take to satisfy these operational requirements? (Select two.)
Option A: Ensure that CloudTrail is enabled.
Option B: Create a custom CloudWatch metric to monitor the API for data access.
Option C: Configure CloudWatch alarms for any metrics the support team requires.
Option D: Ensure that detailed monitoring for the EC2 instances is enabled.
Option E: Create an application to export and save CloudWatch metrics for longer term trending analysis.

Question 62: A Solutions Architect is designing a highly-available website that is served by multiple web servers hosted outside of AWS. If an instance becomes unresponsive, the Architect needs to remove it from the rotation. What is the MOST efficient way to fulfill this requirement?
Option A: Use Amazon CloudWatch to monitor utilization.
Option B: Use Amazon API Gateway to monitor availability.
Option C: Use an Amazon Elastic Load Balancer.
Option D: Use Amazon Route 53 health checks.

Question 63: A company hosts a popular web application. The web application connects to a database running in a private VPC subnet. The web servers must be accessible only to customers on an SSL connection. The RDS MySQL database server must be accessible only from the web servers. How should the Architect design a solution to meet the requirements without impacting running applications?
Option A: Create a network ACL on the web server's subnet, and allow HTTPS inbound and MySQL outbound. Place both database and web servers on the same subnet.
Option B: Open an HTTPS port on the security group for web servers and set the source to 0.0.0.0/0. Open the MySQL port on the database security group and attach it to the MySQL instance. Set the source to Web Server Security Group.
Option C: Create a network ACL on the web server's subnet, and allow HTTPS inbound, and specify the source as 0.0.0.0/0. Create a network ACL on a database subnet, allow MySQL port inbound for web servers, and deny all outbound traffic.
Option D: Open the MySQL port on the security group for web servers and set the source to 0.0.0.0/0. Open the HTTPS port on the database security group and attach it to the MySQL instance. Set the source to Web Server Security Group.

Question 64: Which service should an organization use if it requires an easily managed and scalable platform to host its web application running on Nginx?
Option A: AWS Lambda
Option B: Auto Scaling
Option C: AWS Elastic Beanstalk
Option D: Elastic Load Balancing

Question 65: An Administrator is hosting an application on a single Amazon EC2 instance, which users can access by the public hostname. The administrator is adding a second instance, but does not want users to have to decide between many public hostnames. Which AWS service will decouple the users from specific Amazon EC2 instances?
Option A: Amazon SQS
Option B: Auto Scaling group
Option C: Amazon EC2 security group
Option D: Amazon ELB

Question 66: A Solutions Architect is designing a microservices based application using Amazon ECS. The application includes a WebSocket component, and the traffic needs to be distributed between microservices based on the URL. Which service should the Architect choose to distribute the workload?
Option A: ELB Classic Load Balancer
Option B: Amazon Route 53 DNS
Option C: ELB Application Load Balancer
Option D: Amazon CloudFront

Question 67: A Solutions Architect is designing the storage layer for a production relational database. The database will run on Amazon EC2. The database is accessed by an application that performs intensive reads and writes, so the database requires the LOWEST random I/O latency. Which data storage method fulfills the above requirements?
Option A: Store data in a filesystem backed by Amazon Elastic File System (EFS).
Option B: Store data in Amazon S3 and use a third-party solution to expose Amazon S3 as a filesystem to the database server.
Option C: Store data in Amazon Dynamo DB and emulate relational database semantics.
Option D: Stripe data across multiple Amazon EBS volumes using RAID 0.

Question 68: A Solutions Architect is designing a VPC. Instances in a private subnet must be able to establish IPv6 traffic to the Internet. The design must scale automatically and not incur any additional cost. This can be accomplished with:
Option A: an egress-only internet gateway
Option B: a NAT gateway
Option C: a custom NAT instance
Option D: a VPC endpoint

Question 69: A web application stores all data in an Amazon RDS Aurora database instance. A Solutions Architect wants to provide access to the data for a detailed report for the Marketing team, but is concerned that the additional load on the database will affect the performance of the web application. How can the report be created without affecting the performance of the application?
Option A: Create a read replica of the database.
Option B: Provision a new RDS instance as a secondary master.
Option C: Configure the database to be in multiple regions.
Option D: Increase the number of provisioned storage IOPS.

Question 70: A company has an application that stores sensitive data. The company is required by government regulations to store multiple copies of its data. What would be the MOST resilient and cost-effective option to meet this requirement?
Option A: Amazon EFS
Option B: Amazon RDS
Option C: AWS Storage Gateway
Option D: Amazon S3

Question 71: A company is using AWS Key Management Service (AWS KMS) to secure their Amazon RDS databases. An auditor has recommended that the company log all use of their AWS KMS keys. What is the SIMPLEST solution?
Option A: Associate AWS KMS metrics with Amazon CloudWatch.
Option B: Use AWS CloudTrail to log AWS KMS key usage.
Option C: Deploy a monitoring agent on the RDS instances.
Option D: Poll AWS KMS periodically with a scheduled job.

Question 72: A Solutions Architect is designing a stateful web application that will runfor one year(24 / 7) and then be decommissioned.Load on this platform will be constant,using a number of r4 .8 xlarge instances.Key driversfor this system include high availability,but elasticity is not required.What is the MOST cost - effective way to purchase computefor this platform ?
Option A: Scheduled Reserved Instances
Option B: Convertible Reserved Instances
Option C: Standard Reserved Instances
Option D: Spot Instances

Question 73: A media company asked a Solutions Architect to design a highly available storage solution to serve as a centralized document store for their Amazon EC2 instances. The storage solution needs to be POSIX - compliant, scale dynamically, and be able to serve up to 100 concurrent EC2 instances.Which solution meets these requirements ?
Option A: Create an Amazon S3 bucket and store all of the documents in this bucket.
Option B: Create an Amazon EBS volume and allow multiple users to mount that volume to their EC2 instance(s).
Option C: Use Amazon Glacier to store all of the documents.
Option D: Create an Amazon Elastic File System(Amazon EFS) to store and share the documents.

Question 74: A Solution Architect has a two - tier application with a single Amazon EC2 instance web server and Amazon RDS MySQL Multi - AZ DB instances.The Architect is re - architecting the applicationfor high availability by adding instances in a second Availability Zone.Which additional services will improve the availability of the application ? (Choose two.)
Option A: Auto Scaling group
Option B: AWS CloudTrail
Option C: ELB Classic Load Balancer
Option D: Amazon DynamoDB
Option E: Amazon ElastiCache

Question 75: A company is migrating its data center to AWS.As part of this migration,there is a three - tier web application that has strict data - at - rest encryption requirements.The customer deploys this application on Amazon EC2 using Amazon EBS,and now must provide encryption at - rest.How can this requirement be met without changing the application ?
Option A: Use AWS Key Management Service and move the encrypted data to Amazon S3.2
Option B: Use an application - specific encryption API with AWS server - side encryption.
Option C: Use encrypted EBS storage volumes with AWS - managed keys.
Option D: Use third - party tools to encrypt the EBS data volumes with Key Management Service Bring Your Own Keys.

Question 76: A Solutions Architect is developing software on AWS that requires access to multiple AWS services,including an Amazon EC2 instance.This is a security sensitive application,and AWS credentials such as Access Key ID and Secret Access Key need to be protected and cannot be exposed anywhere in the system.What security measure would satisfy these requirements ?
Option A: Store the AWS Access Key ID / Secret Access Key combination in software comments.
Option B: Assign an IAM user to the Amazon EC2 instance.
Option C: Assign an IAM role to the Amazon EC2 instance.
Option D: Enable multi - factor authenticationfor the AWS root account.

Question 77: An AWS workload in a VPC is running a legacy database on an Amazon EC2 instance. Data is stored on a 200GB Amazon EBS (gp2) volume. At peak load times, logs show excessive wait time. What solution should be implemented to improve database performance using persistent storage?
Option A: Migrate the data on the Amazon EBS volume to an SSD-backed volume.
Option B: Change the EC2 instance type to one with EC2 instance store volumes.
Option C: Migrate the data on the EBS volume to provisioned IOPS SSD (io1).
Option D: Change the EC2 instance type to one with burstable performance.

Question 78: A company's website receives 50,000 requests each second, and the company wants to use multiple applications to analyze the navigation patterns of the users on their website so that the experience can be personalized. What can a Solutions Architect use to collect page clicks for the website and process them sequentially for each user?
Option A: Amazon Kinesis Stream
Option B: Amazon SQS standard queue
Option C: Amazon SQS FIFO queue
Option D: AWS CloudTrail trail 2

Question 79: A company wants to migrate a highly transactional database to AWS. Requirements state that the database has more than 6 TB of data and will grow exponentially. Which solution should a Solutions Architect recommend?
Option A: Amazon Aurora
Option B: Amazon Redshift
Option C: Amazon DynamoDB
Option D: Amazon RDS MySQL

Question 80: A company hosts a two-tier application that consists of a publicly accessible web server that communicates with a private database. Only HTTPS port 443 traffic to the web server must be allowed from the Internet. Which of the following options will achieve these requirements? (Choose two.)
Option A: Security group rule that allows inbound Internet traffic for port 443.
Option B: Security group rule that denies all inbound Internet traffic except port 443.
Option C: Network ACL rule that allows port 443 inbound and all ports outbound for Internet traffic.
Option D: Security group rule that allows Internet traffic for port 443 in both inbound and outbound.
Option E: Network ACL rule that allows port 443 for both inbound and outbound for all Internet traffic.

Question 81: A Solutions Architect is designing an Amazon VPC. Applications in the VPC must have private connectivity to Amazon DynamoDB in the same AWS Region. The design should route DynamoDB traffic through:
Option A: VPC peering connection.
Option B: NAT gateway
Option C: VPC endpoint
Option D: AWS Direct Connect

Question 82: A Solutions Architect is architecting a workload that requires a performant object-based storage system that must be shared with multiple Amazon EC2 instances. Which AWS service meets this requirement?
Option A: Amazon EFS
Option B: Amazon S3
Option C: Amazon EBS
Option D: Amazon ElastiCache

Question 83: A Solutions Architect is developing a solution for sharing files in an organization. The solution must allow multiple users to access the storage service at once from different virtual machines and scale automatically. It must also support le-level locking. Which storage service meets the requirements of this use case?
Option A: Amazon S3
Option B: Amazon EFS
Option C: Amazon EBS
Option D: Cached Volumes

Question 84: A company runs a legacy application with a single-tier architecture on an Amazon EC2 instance. Disk I/O is low, with occasional small spikes during business hours. The company requires the instance to be stopped from 8 PM to 8 AM daily. Which storage option is MOST appropriate for this workload?
Option A: Amazon EC2 instance storage
Option B: Amazon EBS General Purpose SSD (gp2) storage
Option C: Amazon S3
Option D: Amazon EBS Provision IOPS SSD (io1) storage

Question 85: As part of securing an API layer built on Amazon API gateway,a Solutions Architect has to authorize users who are currently authenticated by an existing identity provider.The users must be denied accessfor a period of one hour after three unsuccessful attempts.How can the Solutions Architect meet these requirements ?
Option A: Use AWS IAM authorization and add least-privileged permissions to each respective IAM role.
Option B: Use an API Gateway custom authorizer to invoke an AWS Lambda function to validate each user's identity.
Option C: Use Amazon Cognito user pools to provide built-in user management.
Option D: Use Amazon Cognito user pools to integrate with external identity providers.

Question 86: An organization runs an online media site,hosted on - premises.An employee posted a product review that contained videos and pictures.The review went viral and the organization needs to handle the resulting spike in website traffic.What action would provide an immediate solution ?
Option A: Redesign the website to use Amazon API Gateway,and use AWS Lambda to deliver content.
Option B: Add server instances using Amazon EC2 and use Amazon Route 53 with a failover routing policy.
Option C: Serve the images and videos via an Amazon CloudFront distribution created using the news site as the origin.
Option D: Use Amazon ElasticCache for Redis for caching and reducing the load requests from the origin.

Question 87: A client notices that their engineers often make mistakes when creating Amazon SQS queues for their backend system.Which action should a Solutions Architect recommend to improve this process ?
Option A: Use the AWS CLI to create queues using AWS IAM Access Keys.
Option B: Write a script to create the Amazon SQS queue using AWS Lambda.
Option C: Use AWS Elastic Beanstalk to automatically create the Amazon SQS queues.
Option D: Use AWS CloudFormation Templates to manage the Amazon SQS queue creation.

Question 88: A development team is building an application with front - end and backend application tiers.Each tier consists of Amazon EC2 instances behind an ELB Classic Load Balancer.The instances run in Auto Scaling groups across multiple Availability Zones.The network team has allocated the 10.0 .0 .0 / 24 address space for this application. Only the front-end load balancer should be exposed to the Internet.There are concerns about the limited size of the address space and the ability of each tier to scale.What should the VPC subnet design be in each Availability Zone?
Option A: One public subnet for the load balancer tier,one public subnet for the front - end tier,and one private subnet for the backend tier.
Option B: One shared public subnet for all tiers of the application.
Option C: One public subnet for the load balancer tier and one shared private subnet for the application tiers.
Option D: One shared private subnet for all tiers of the application.

Question 89: A Solutions Architect must select the storage type for a big data application that requires very high sequential I / O. The data must persist if the instance is stopped.Which of the following storage types will provide the best at the LOWEST cost for the application?
Option A: An Amazon EC2 instance store local SSD volume.
Option B: An Amazon EBS provisioned IOPS SSD volume.
Option C: An Amazon EBS throughput optimized HDD volume.
Option D: An Amazon EBS general purpose SSD volume.

Question 90: Two Auto Scaling applications, Application A and Application B, currently run within a shared set of subnets. A Solutions Architect wants to make sure that Application A can make requests to Application B, but Application B should be denied from making requests to Application A. Which is the SIMPLEST solution to achieve this policy ?
Option A: Using security groups that reference the security groups of the other application
Option B: Using security groups that reference the application server's IP addresses
Option C: Using Network Access Control Lists to allow/deny tra􀂨c based on application IP addresses
Option D: Migrating the applications to separate subnets from each other

Question 91: Legacy applications currently send messages through a single Amazon EC2 instance, which then routes the messages to the appropriate destinations. The Amazon EC2 instance is a bottleneck and single point of failure, so the company would like to address these issues.Which services could address this architectural use case?(Choose two.)
Option A: Amazon SNS
Option B: AWS STS
Option C: Amazon SQS
Option D: Amazon Route 53
Option E: AWS Glue

Question 92: A Solutions Architect needs to design an architecture for a new, mission - critical batch processing billing application. The application is required to run Monday, Wednesday,and Friday from 5 AM to 11 AM.2 Which is the MOST cost-effective Amazon EC2 pricing model?
Option A: Amazon EC2 Spot Instances
Option B: On - Demand Amazon EC2 Instances
Option C: Scheduled Reserved Instances
Option D: Dedicated Amazon EC2 Instances

Question 93: A workload consists of downloading an image from an Amazon S3 bucket, processing the image, and moving it to another Amazon S3 bucket. An Amazon EC2 instance runs a scheduled task every hour to perform the operation.How should a Solutions Architect redesign the process so that it is highly available ?
Option A: Change the Amazon EC2 instance to compute optimized.
Option B: Launch a second Amazon EC2 instance to monitor the health of the rest.
Option C: Trigger a Lambda function when a new object is uploaded.
Option D: Initially copy the images to an attached Amazon EBS volume.

Question 94: An application is running on an Amazon EC2 instance in a private subnet. The application needs to read and write data onto Amazon Kinesis Data Streams, and corporate policy requires that this traffic should not go to the internet. How can these requirements be met?
Option A: Configure a NAT gateway in a public subnet and route all traffic to Amazon Kinesis through the NAT gateway.
Option B: Configure a gateway VPC endpoint for Kinesis and route all traffic to Kinesis through the gateway VPC endpoint.
Option C: Configure an interface VPC endpoint for Kinesis and route all traffic to Kinesis through the gateway VPC endpoint.
Option D: Configure an AWS Direct Connect private virtual interface for Kinesis and route all traffic to Kinesis through the virtual interface.

Question 95: A Solutions Architect is building an application that stores object data. Compliance requirements state that the data stored is immutable. Which service meets these requirements?
Option A: Amazon S3
Option B: Amazon Glacier
Option C: Amazon EFS
Option D: AWS Storage Gateway

Question 96: A Solutions Architect is designing a shared Amazon S3 bucket where corporate applications will save objects. How can the Architect ensure that when an application uploads an object to the Amazon S3 bucket, the object is encrypted?
Option A: Set a CORS configuration.
Option B: Set a bucket policy to encrypt all Amazon S3 objects.
Option C: Enable default encryption on the bucket.
Option D: Set permission for users.

Question 97: An application tier currently hosts two web services on the same set of instances, listening on different ports. Which AWS service should a Solutions Architect use to route traffic to the service based on the incoming request path?
Option A: AWS Application Load Balancer
Option B: Amazon CloudFront
Option C: Amazon Classic Load Balancer
Option D: Amazon Route 53

Question 98: A data analytics startup company asks a Solutions Architect to recommend an AWS data store options for indexed data. The data processing engine will generate and input more than 64 TB of processed data every day, with item sizes reaching up to 300 KB.The startup is flexible with data storage and is more interested in a database that requires minimal effort to scale with a growing dataset size. Which AWS data store service should the Architect recommend?
Option A: Amazon RDS
Option B: Amazon Redshift
Option C: Amazon DynamoDB
Option D: Amazon S3

Question 99: A Solutions Architect needs to allow developers to have SSH connectivity to web servers.The requirements are as follows : ✑Limit access to users origination from the corporate network. ✑Web servers cannot have SSH access directly from the Internet. ✑Web servers reside in a private subnet. Which combination of steps must the Architect complete to meet these requirements?(Choose two.)
Option A: Create a bastion host that authenticates users against the corporate directory.
Option B: Create a bastion host with security group rules that only allow traffic from the corporate network.
Option C: Attach an IAM role to the bastion host with relevant permissions.
Option D: Configure the web servers ' security group to allow SSH traffic from a bastion host.
Option E: Deny all SSH traffic from the corporate network in the inbound network ACL.

Question 100: A Solutions Architect needs to use AWS to implement pilot light disaster recovery for a three-tier web application hosted in an on-premises datacenter. Which solution allows rapid provision of working, fully-scaled production environment?
Option A: Continuously replicate the production database server to Amazon RDS. Use AWS CloudFormation to deploy the application and any additional servers if necessary.
Option B: Continuously replicate the production database server to Amazon RDS. Create one application load balancer and register on-premises servers. Configure ELB Application Load Balancer to automatically deploy Amazon EC2 instances for application and additional servers if the on-premises application is down.
Option C: Use a scheduled Lambda function to replicate the production database to AWS. Use Amazon Route 53 health checks to deploy the application automatically to Amazon S3 if production is unhealthy.
Option D: Use a scheduled Lambda function to replicate the production database to AWS. Register on-premises servers to an Auto Scaling group and deploy the application and additional servers if production is unavailable.

Question 101: A Solutions Architect notices slower response times from an application. The CloudWatch metrics on the MySQL RDS indicate Read IOPS are high and uctuate significantly when the database is under load. How should the database environment be re-designed to resolve the IOPS uctuation?
Option A: Change the RDS instance type to get more RAM.
Option B: Change the storage type to Provisioned IOPS.
Option C: Scale the web server tier horizontally.
Option D: Split the DB layer into separate RDS instances.

Question 102: A Solutions Architect is designing a solution that can monitor memory and disk space utilization of all Amazon EC2 instances running Amazon Linux and Windows. Which solution meets this requirement?
Option A: Default Amazon CloudWatch metrics.
Option B: Custom Amazon CloudWatch metrics.
Option C: Amazon Inspector resource monitoring.
Option D: Default monitoring of Amazon EC2 instances.

Question 103: A Solutions Architect is creating a new relational database. The Compliance team will use the database, and mandates that data content must be stored across three different Availability Zones. Which of the following options should the Architect Use?
Option A: Amazon Aurora
Option B: Amazon RDS MySQL with Multi-AZ enabled
Option C: Amazon DynamoDB
Option D: Amazon ElastiCache

Question 104: A company needs to quickly ensure that all files created in an Amazon S3 bucket in us-east-1 are also available in another bucket in ap-southeast2. Which option represents the SIMPLIEST way to implement this design?
Option A: Add an S3 lifecycle rule to move any files from the bucket in us-east-1 to the bucket in ap-southeast-2.
Option B: Create a Lambda function to be triggered for every new le in us-east-1 that copies the le to the bucket in ap-southeast-2.
Option C: Use SNS to notify the bucket in ap-southeast-2 to create a le whenever the le is created in the bucket in us-east-1.
Option D: Enable versioning and Configure cross-region replication from the bucket in us-east-1 to the bucket in ap-southeast-2.

Question 105: An organization has a long-running image processing application that runs on Spot Instances that will be terminated when interrupted. A highly available workload must be designed to respond to Spot Instance interruption notices. The solution must include a two-minute warning when there is not enough capacity. How can these requirements be met?
Option A: Use Amazon CloudWatch Events to invoke an AWS Lambda function that can launch On-Demand Instances.
Option B: Regularly store data from the application on Amazon DynamoDB. Increase the maximum number of instances in the AWS Auto Scaling group.
Option C: Manually place a bid for additional Spot Instances at a higher price in the same AWS Region and Availability Zone.
Option D: Ensure that the Amazon Machine Image associated with the application has the latest configurations for the launch configuration.

Question 106: A company has an Amazon RDS-managed online transaction processing system that has very heavy read and write. The Solutions Architect notices throughput issues with the system. How can the responsiveness of the primary database be improved?
Option A: Use asynchronous replication for standby to maximize throughput during peak demand.
Option B: Offload SELECT queries that can tolerate stale data to READ replica.
Option C: Offload SELECT and UPDATE queries to READ replica.
Option D: Offload SELECT query that needs the most current data to READ replica.

Question 107: A company is designing a failover strategy in Amazon Route 53 for its resources between two AWS Regions. The company must have the ability to route a user's traffic to the region with least latency, and if both regions are healthy, Route 53 should route traffic to resources in both regions.Which strategy should the Solutions Architect recommend ?
Option A: Configure active - active failover using Route 53 latency DNS records.
Option B: Configure active - passive failover using Route 53 latency DNS records.
Option C: Configure active - active failover using Route 53 failover DNS records.
Option D: Configure active - passive failover using Route 53 failover DNS records.

Question 108: A company is developing several critical long - running applications hosted on Docker.How should a Solutions Architect design a solution to meet the scalability and orchestration requirements on AWS ?
Option A: Use Amazon ECS and Service Auto Scaling.
Option B: Use Spot Instancesfor orchestration andfor scaling containers on existing Amazon EC2 instances.
Option C: Use AWS OpsWorks to launch containers in new Amazon EC2 instances.
Option D: Use Auto Scaling groups to launch containers on existing Amazon EC2 instances.

Question 109: A Solutions Architect is developing a new web application on AWS.The Architect expects the application to become very popular,so the application must scale to support the load.The Architect wants to focus on software development and deploying new features without provisioning or managing instances.What solution is appropriate ?
Option A: Amazon API Gateway and AWS Lambda
Option B: Elastic Load Balancing with Auto Scaling groups and Amazon EC2
Option C: Amazon API Gateway and Amazon EC2
Option D: Amazon CloudFront and AWS Lambda

Question 110: A Solutions Architect is deploying a new production MySQL database on AWS.It is critical that the database is highly available.What should the Architect do to achieve this goal with Amazon RDS ?
Option A: Create a read replica of the primary database and deploy it in a different AWS Region.
Option B: Enable multi - AZ to create a standby database in a different Availability Zone.
Option C: Enable multi - AZ to create a standby database in a different AWS Region.
Option D: Create a read replica of the primary database and deploy it in a different Availability Zone.

Question 111: An organization designs a mobile application for their customers to upload photos to a site. The application needs a secure login with MFA. The organization wants to limit the initial build time and maintenance of the solution. Which solution should a Solutions Architect recommend to meet the requirements?
Option A: Use Amazon Cognito Identity with SMS-based MFA.
Option B: Edit AWS IAM policies to require MFA for all users.
Option C: Federate IAM against corporate AD that requires MFA.
Option D: Use Amazon API Gateway and require SSE for photos.

Question 112: A Solutions Architect is designing a solution to monitor weather changes by the minute. The frontend application is hosted on Amazon EC2 instances. The backend must be scalable to a virtually unlimited size, and data retrieval must occur with minimal latency. Which AWS service should the Architect use to store the data and achieve these requirements?
Option A: Amazon S3
Option B: Amazon DynamoDB
Option C: Amazon RDS
Option D: Amazon EBS

Question 113: A company hosts a website on premises. The website has a mix of static and dynamic content, but users experience latency when loading static files. Which AWS service can help reduce latency?
Option A: Amazon CloudFront with on-premises servers as the origin
Option B: ELB Application Load Balancer
Option C: Amazon Route 53 latency-based routing
Option D: Amazon EFS to store and server static files

Question 114: A company wants to analyze all of its sales information aggregated over the last 12 months. The company expects there to be over 10TB of data from multiple sources. What service should be used?
Option A: Amazon DynamoDB
Option B: Amazon Aurora MySQL
Option C: Amazon RDS MySQL
Option D: Amazon Redshift

Question 115: A media company has deployed a multi-tier architecture on AWS. Web servers are deployed in two Availability Zones using an Auto Scaling group with a default Auto Scaling termination policy. The web servers' Auto Scaling group currently has 15 instances running. Which instance will be terminated rest during a scale-in operation?
Option A: The instance with the oldest launch configuration.
Option B: The instance in the Availability Zone that has most instances.
Option C: The instance closest to the next billing hour.
Option D: The oldest instance in the group.

Question 116: A retail company has sensors placed in its physical retail stores. The sensors send messages over HTTP when customers interact with in-store product displays. 3, A Solutions Architect needs to implement a systemfor processing those sensor messages;the results must be availablefor the Data Analysis team.Which architecture should be used to meet these requirements ?
Option A: Implement an Amazon API Gateway to server as the HTTP endpoint.Have the API Gateway trigger an AWS Lambdafunction to process the messages,and save the results to an Amazon DynamoDB table.
Option B: Create an Amazon EC2 instance to server as the HTTP endpoint and to process the messages.Save the results to Amazon S3for the Data Analysis team to download.
Option C: Use Amazon Route 53 to direct incoming sensor messages to a Lambdafunction to process the message and save the results to a Amazon DynamoDB table.
Option D: Use AWS Direct Connect to connect sensors to DynamoDB so that data can be written directly to a DynamoDB table where it can be accessed by the Data Analysis team.

Question 117: A client is migrating a legacy web application to the AWS Cloud.The current system uses an Oracle database as a relational database management system solution.Backups occur every night,and the data is stored on - premises.The Solutions Architect must automate the backups and identity a storage solutionwhile keeping costs low.Which AWS service will meet these requirements ?
Option A: Amazon RDS
Option B: Amazon RedShift
Option C: Amazon DynamoDB Accelerator
Option D: Amazon ElastiCache

Question 118: A company has an Amazon RDS database backing its production website.The Sales team needs to run queries against the database to track training program effectiveness.Queries against the production database cannot impact performance,and the solution must be easy to maintain.How can these requirements be met ?
Option A: Use an Amazon Redshift database.Copy the product database into Redshift and allow the team to query it.
Option B: Use an Amazon RDS read replica of the production database and allow the team to query against it.
Option C: Use multiple Amazon EC2 instances running replicas of the production database,placed behind a load balancer.
Option D: Use an Amazon DynamoDB table to store a copy of the data.

Question 119: A company must collect temperature data from thousands of remote weather devices.The company must also store this data in a data warehouse to run aggregations and visualizations.Which services will meet these requirements ? (Choose two.)
Option A: Amazon Kinesis Data Firehouse
Option B: Amazon SQS
Option C: Amazon Redshift
Option D: Amazon SNS E.Amazon DynamoDB

Question 120: A company has a legal requirement to store point - in -time copies of its Amazon RDS PostGreSQL database instance in facilities that are at least 200 miles apart.Use of which of the following provides the easiest way to comply with this requirement ?
Option A: Cross - region read replica
Option B: Multiple Availability Zone snapshot copy
Option C: Multiple Availability Zone read replica
Option D: Cross - region snapshot copy

Question 121: After reviewing their logs, a startup company noticed large, random spikes in traffic to their web application. The company wants to Configure a cost-efficient cient Auto Scaling solution to support high availability of the web application. Which scaling plan should a Solutions Architect recommend to meet the company's needs?
Option A: Dynamic
Option B: Scheduled
Option C: Manual
Option D: Lifecycle

Question 122: To meet compliance standards,a company must have encrypted archival data storage.Data will be accessed infrequently,with lead times well in advance of when archived data must be recovered.The company requires that the storage be secure,durable,and provided at the lowest price per 1 TB of data stored.What type of storage should be used ?
Option A: Amazon S3
Option B: Amazon EBS
Option C: Amazon Glacier
Option D: Amazon EFS

Question 123: An online company wants to conduct real-time sentiment analysis about its products from its social media channels using SQL. Which of the following solutions has the LOWEST cost and operational burden?
Option A: Set up a streaming data ingestion application on Amazon EC2 and connect it to a Hadoop cluster for data processing. Send the output to Amazon S3 and use Amazon Athena to analyze the data.
Option B: Configure the input stream using Amazon Kinesis Data Streams. Use Amazon Kinesis Data Analytics to write SQL queries against the stream.
Option C: Configure the input stream using Amazon Kinesis Data Streams. Use Amazon Kinesis Data Firehose to send data to an Amazon Redshift cluster, and then query directly against Amazon Redshift
Option D: Set up streaming data ingestion application on Amazon EC2 and send the output to Amazon S3 using Kinesis Data Firehose. Use Athena to analyze the data.

Question 124: An organization must process a stream of large - volume hashtag data in real time and needs to run custom SQL queries on the data to get insights on certain tags.The organization needs this solution to be elastic and does not want to manage clusters.Which of the following AWS services meets these requirements ?
Option A: Amazon Elasticsearch Service
Option B: Amazon Athena
Option C: Amazon Redshift
Option D: Amazon Kinesis Data Analytics

Question 125: Which requirements must be met in order for a Solutions Architect to specify that an Amazon EC2 instance should stop rather than terminate when its Spot Instance is interrupted? (Choose two.)
Option A: The Spot Instance request type must be one-time.
Option B: The Spot Instance request type must be persistent.
Option C: The root volume must be an Amazon EBS volume.
Option D: The root volume must be an instance store volume.
Option E: The launch Configuration is changed.

Question 126: An application hosted on AWS uses object storage for storing internal reports that are accessed daily by the CFO.Currently, these reports are publicly available.How should a Solutions Architect re - design this architecture to prevent unauthorized access to these reports ?
Option A: Encrypt the files on the client side and store the files on Amazon Glacier,then decrypt the reports on the client side.
Option B: Move the files to Amazon ElastiCache and provide a username and passwordfor downloading the reports.
Option C: Specify the use of AWS KMS server - side encryption at the time of an object creation on Amazon S3.
Option D: Store the files on Amazon S3 and use the application to generate S3 pre - signed URLs to users.

Question 127: A Solutions Architect is designing an application on AWS that will connect to the on - premise data center through a VPN connection.The solution must be able to log network traffic over the VPN.Which service logs this network traffic ?
Option A: AWS CloudTrail logs
Option B: Amazon VPC flow logs
Option C: Amazon S3 bucket logs
Option D: Amazon CloudWatch Logs

Question 128: A company wants to durably store data in 8 KB chunks.The company will access the data once every few months.However,when the company does access the data,it must be done with as little latency as possible.Which AWS service should a Solutions Architect recommendif cost is NOT a factor ?
Option A: Amazon DynamoDB
Option B: Amazon EBS Throughput Optimized HDD Volumes
Option C: Amazon EBS Cold HDD Volumes
Option D: Amazon ElastiCache

Question 129: A media company has more than 100 TB of data to be stored and retrieved infrequently.However,the company occasionally receives requestsfor data within an hour.The company needs a low - cost retrieval method to handle the requests.Which service meets this requirement ?
Option A: Amazon S3 Standard
Option B: Amazon Glacier standard retrievals
Option C: Amazon Glacier bulk retrievals D Amazon S3 Standard Infrequent Access 3
Option D: Amazon S3 Standard Infrequent Access

Question 130: An on-premises database is experiencing significant performance problems when running SQL queries. With 10 users, the lookups are performing as expected. As the number of users increases, the lookups take three times longer than expected to return values to an application. Which action should a Solutions Architect take to maintain performance as the user count increases?
Option A: Use Amazon SQS.
Option B: Deploy Multi-AZ RDS MySQL
Option C: Configure Amazon RDS with additional read replicas.
Option D: Migrate from MySQL to RDS Microsoft SQL Server.

Question 131: A team has an application that detects new objects being uploaded into an Amazon S3 bucket. The uploads trigger a Lambda function to write object metadata into an Amazon DynamoDB table and RDS PostgreSQL database. Which action should the team take to ensure high availability?
Option A: Enable cross-region replication in the Amazon S3 bucket.
Option B: Create a Lambda function for each Availability Zone the application is deployed in.
Option C: Enable multi-AZ on the RDS PostgreSQL database.
Option D: Create a DynamoDB stream for the DynamoDB table.

Question 132: A media company must store 10 TB of audio recordings. Retrieval happens infrequently and requestors agree on an 8-hour turnaround time. What is the MOST cost-effective solution to store the files?
Option A: Amazon S3 Standard / Ifrequent Access (Standard IA)
Option B: EBS Throughput Optimized HDD (st1)
Option C: EBS Cold HDD (sc1)
Option D: Amazon Glacier

Question 133: A company wants to improve the performance of their web application after receiving customer complaints. An analysis concluded that the same complex database queries were causing increased latency. What should a Solutions Architect recommend to improve the application's performance?
Option A: Migrate the database to MySQL.
Option B: Use Amazon RedShift to analyze the queries.
Option C: Integrate Amazon ElastiCache into the application.
Option D: Use a Lambda-triggered request to the backend database.

Question 134: Which tool analyzes account resources and provides a detailed inventory of changes over time?
Option A: AWS Con g
Option B: AWS CloudFormation
Option C: Amazon CloudWatch
Option D: AWS Service Catalog

Question 135: A Solutions Architect is designing a solution that will include a database in Amazon RDS. Corporate security policy mandates that the database, its logs, and its backups are all encrypted. Which is the MOST efficient option to fulfill the security policy using Amazon RDS?
Option A: Launch an Amazon RDS instance with encryption enabled. Enable encryption for logs and backups.
Option B: Launch an Amazon RDS instance. Enable encryption for database, logs and backups.
Option C: Launch an Amazon RDS instance with encryption enabled. Logs and backups are automatically encrypted.
Option D: Launch an Amazon RDS instance. Enable encryption for backups. Encrypt logs with a database-engine feature.

Question 136: A Solutions Architect is designing a public-facing web application for employees to upload images to their social media account. The application consists of multiple Amazon EC2 instances behind an elastic load balancer, an Amazon S3 bucket where uploaded images are stored, and an Amazon DynamoDB table for storing image metadata. Which AWS service can the Architect use to automate the process of updating metadata in the DynamoDB table upon image upload?
Option A: Amazon CloudWatch
Option B: AWS CloudFormation
Option C: AWS Lambda
Option D: Amazon SQS

Question 137: A company's policy requires that all data stored in Amazon S3 is encrypted. The company wants to use the option with the least overhead and does not want to manage any encryption keys. Which of the following options will meet the company's requirements?
Option A: AWS CloudHSM
Option B: AWS Trusted Advisor
Option C: Server Side Encryption (SSE-S3)
Option D: Server Side Encryption (SSE-KMS)

Question 138: A company has gigabytes of web log files stored in an Amazon S3 bucket. A Solutions Architect wants to copy those files into Amazon Redshift for analysis. The company's security policy mandates that data is encrypted at rest both in the Amazon Redshift cluster and the Amazon S3 bucket. Which process will fulfill the security requirements?
Option A: Enable server-side encryption on the Amazon S3 bucket. Launch an unencrypted Amazon Redshift cluster. Copy the data into the Amazon Redshift cluster.
Option B: Enable server-side encryption on the Amazon S3 bucket. Copy data from the Amazon S3 bucket into an unencrypted Redshift cluster. Enable encryption on the cluster.
Option C: Launch an encrypted Amazon Redshift cluster. Copy the data from the Amazon S3 bucket into the Amazon Redshift cluster. Copy data back to the Amazon S3 bucket in encrypted form.
Option D: Enable server-side encryption on the Amazon S3 bucket. Launch an encrypted Amazon Redshift cluster. Copy the data into the Amazon Redshift cluster.

Question 139: An application runs on Amazon EC2 instances in an Auto Scaling group. When instances are terminated, the Systems Operations team cannot determine the route cause, because the logs reside on the terminated instances and are lost. How can the root cause be determined?
Option A: Use ephemeral volumes to store the log files.
Option B: Use a scheduled Amazon CloudWatch Event to take regular Amazon EBS snapshots.
Option C: Use an Amazon CloudWatch agent to push the logs to Amazon CloudWatch Logs.
Option D: Use AWS CloudTrail to pull the logs from the Amazon EC2 instances.

Question 140: A Solutions Architect is designing a customer order processing application that will likely have high usage spikes. What should the Architect do to ensure that customer orders are not lost before being written to an Amazon RDS database? (Choose two.)
Option A: Use Amazon CloudFront to deliver the application front end.
Option B: Use Elastic Load Balancing with a round-robin routing algorithm.
Option C: Have the orders written into an Amazon SQS queue.
Option D: Scale the number of processing nodes based on pending order volume.
Option E: Have a standby Amazon RDS instance in a separate Availability Zone.

Question 141: Employees from several companies use an application once a year during a speci c 30-day period. The periods are different for each company. traffic to the application spikes during these 30-day periods. How can the application be designed to handle these traffic spikes?
Option A: Use an Amazon Route 53 latency routing policy to route traffic to an Amazon EC2 instance with the least lag time.
Option B: Use Amazon S3 to cache static elements of the website requests.
Option C: Use an Auto Scaling group to scale the number of EC2 instances to match the site traffic.
Option D: Use Amazon Cloud Front to serve static assets to decrease the load on the EC2 instances.

Question 142: A restaurant reservation application needs the ability to maintain a waiting list. When a customer tries to reserve a table, and none are available, the customer must be put on the waiting list, and the application must notify the customer when a table becomes free. What service should the Solutions Architect recommend to ensure that the system respects the order in which the customer requests are put onto the waiting list?
Option A: Amazon SNS
Option B: AWS Lambda with sequential dispatch
Option C: A FIFO queue in Amazon SQS
Option D: A standard queue in Amazon SQS

Question 143: A Solutions Architect is designing a solution for a dynamic website, 'example.com', that is deployed in two regions: Tokyo, Japan and Sydney, Australia. The 4 Architect wants to ensure that users located in Australia are directed to the website deployed in the Sydney region and users located in Japan are redirected to the website in the Tokyo region when they browse to 'example.com'. Which service should the Architect use to achieve this goal with the LEAST administrative effort?
Option A: Amazon CloudFront with geolocation routing
Option B: Amazon Route 53
Option C: Application Load Balancer
Option D: Network Load Balancer deployed across multiple regions

Question 144: A company has a popular multi-player mobile game hosted in its on-premises datacenter. The current infrastructure can no longer keep up with demand and the company is considering a move to the cloud. Which solution should a Solutions Architect recommend as the MOST scalable and cost-effective solution to meet these needs?
Option A: Amazon EC2 and an Application Load Balancer
Option B: Amazon S3 and Amazon CloudFront
Option C: Amazon EC2 and Amazon Elastic Transcoder
Option D: AWS Lambda and Amazon API Gateway

Question 145: A company has instances in private subnets that require outbound access to the internet. This requires:
Option A: Assigning a public IP address to the instance.
Option B: Updating the route table associated with the subnet to point internet traffic through a NAT gateway.
Option C: Updating the security group associated with the subnet to allow ingress on 0.0.0.0/0.
Option D: Routing traffic from the instance through a VPC endpoint that has internet access.

Question 146: An organization regularly backs up their application data. The application backups are required to be stored on Amazon S3 for a certain amount of time. The backups should be accessed instantly in the event of a disaster recovery. Which of the following Amazon S3 storage classes would be the MOST cost-effective option to meet the needs of this scenario?
Option A: Glacier Storage Class
Option B: Standard Storage Class
Option C: Standard Infrequent Access (IA)
Option D: Deep Glacier Storage Class

Question 147: An organization runs an online voting system for a television program. During broadcasts, hundreds of thousands of votes are submitted within minutes and sent to a front-end fleet of auto-scaled Amazon EC2 instances. The EC2 instances push the votes to an RDBMS database. The database is unable to keep up with the front-end connection requests. What is the MOST efficient and cost-effective way of ensuring that votes are processed in a timely manner?
Option A: Each front-end node should send votes to an Amazon SQS queue. Provision worker instances to read the SQS queue and process the message information into RDBMS database.
Option B: As the load on the database increases, horizontally-scale the RDBMS database with additional memory-optimized instances. When voting has ended, scale down the additional instances.
Option C: Re-provision the RDBMS database with larger, memory-optimized instances. When voting ends, re-provision the back-end database with smaller instances.
Option D: Send votes from each front-end node to Amazon DynamoDB. Provision worker instances to process the votes in DynamoDB into the RDBMS database.

Question 148: An application publishes Amazon SNS messages in response to several events. An AWS Lambda function subscribes to these messages. Occasionally the function will fail while processing a message, so the original event message must be preserved for root cause analysis. What architecture will meet these requirements without changing the work ow?
Option A: Subscribe an Amazon SQS queue to the Amazon SNS topic and trigger the Lambda function from the queue.
Option B: Configure Lambda to write failures to an SQS Dead Letter Queue.
Option C: Configure a Dead Letter Queue for the Amazon SNS topic.
Option D: Configure the Amazon SNS topic to invoke the Lambda function synchronously.

Question 149: An application uses an Amazon RDS MySQL cluster for the database layer. Database growth requires periodic resizing of the instance. Currently, administrators check the available disk space manually once a week. How can this process be improved?
Option A: Use the largest instance type for the database.
Option B: Use AWS CloudTrail to monitor storage capacity.
Option C: Use Amazon CloudWatch to monitor storage capacity.
Option D: Use Auto Scaling to increase storage size.

Question 150: A customer owns a MySQL database that is accessed by various clients who expect, at most, 100 ms latency on requests. Once a record is stored in the database, it rarely changed. Clients only access one record at a time. Database access has been increasing exponentially due to increased client demand. The resultant load will soon exceed the capacity of the most expensive hardware available for purchase. The customer wants to migrate to AWS, and is willing to change database systems. Which service would alleviate the database load issue and offer virtually unlimited scalability for the future?
Option A: Amazon RDS
Option B: Amazon DynamoDB
Option C: Amazon Redshift
Option D: AWS Data Pipeline

Question 151: A business team requires a structured storage solution to store all of a company's historical sales data. Currently there are 4 TB of data, which will grow to hundreds of terabytes within a few years. The team must be able to regularly run queries against the data using current business intelligence tools. Fast performance is required despite the dataset growth. Which solution should the company use?
Option A: Amazon Redshift
Option B: Amazon Aurora
Option C: Amazon DynamoDB
Option D: Amazon S3

Question 152: A prediction process requires access to a trained model that is stored in an Amazon S3 bucket. The process takes a few seconds to process an image and make a prediction. The process is not overly resource-intensive, does not require any specialized hardware, and takes filess than 512 MB of memory to run. What would be the MOST effective compute solution for this use case?
Option A: Amazon ECS
Option B: Amazon EC2 Spot instances
Option C: AWS Lambda functions
Option D: AWS Elastic Beanstalk

Question 153: An application that runs on an Amazon EC2 instance must make secure calls to Amazon S3 buckets. 4 Which steps can a Solutions Architect take to ensure that the calls are made without exposing credentials?
Option A: Generate an access key ID and a secret key, and assign an IAM role with least privilege.
Option B: Create an IAM policy granting access to all services and assign it to the Amazon EC2 instance pro le.
Option C: Create an IAM role granting least privilege and assign it to the Amazon EC2 instance pro le.
Option D: Generate temporary access keys to grant users temporary access to the Amazon EC2 instance.

Question 154: A Solutions Architect needs to design a centralized logging solution for a group of web applications running on Amazon EC2 instances. The solution requires minimal development effort due to budget constraints. Which of the following should the Architect recommend?
Option A: Create a crontab job script in each instance to push the logs regularly to Amazon S3.
Option B: Install and Configure Amazon CloudWatch Logs agent in the Amazon EC2 instances.
Option C: Enable Amazon CloudWatch Events in the AWS Management Console.
Option D: Enable AWS CloudTrail to map all API calls invoked by the applications.

Question 155: A company is using Amazon S3 as its local repository for weekly analysis reports. One of the company-wide requirements is to secure data at rest using encryption. The company chose Amazon S3 server-side encryption. The company wants to know how the object is decrypted when a GET request is issued. Which of the following answers this question?
Option A: The user needs to place a PUT request to decrypt the object.
Option B: The user needs to decrypt the object using a private key.
Option C: Amazon S3 manages encryption and decryption automatically.
Option D: Amazon S3 provides a server-side key for decrypting the object.

Question 156: A company is looking for a fully-managed solution to store its players' state information for a rapidly growing game. The application runs on multiple Amazon EC2 nodes, which can scale according to the incoming traffic. The request can be routed to any of the nodes, therefore, the state information must be stored in a centralized database. The players' state information needs to be read with strong consistency and needs conditional updates for any changes. Which service would be MOST cost-effective, and scale seamlessly?
Option A: Amazon S3
Option B: Amazon DynamoDB
Option C: Amazon RDS
Option D: Amazon Redshift 4

Question 157: An application is running on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. Four instances are required to handle a predictable traffic load. The Solutions Architect wants to ensure that the operation is fault-tolerant up to the loss of one Availability Zone. Which is the MOST cost-efficient cient way to meet these requirements?
Option A: Deploy two instances in each of three Availability Zones.
Option B: Deploy two instances in each of two Availability Zones.
Option C: Deploy four instances in each of two Availability Zones.
Option D: Deploy one instance in each of three Availability Zones.

Question 158: A Solutions Architect is designing a three-tier web application that includes an Auto Scaling group of Amazon EC2 instances running behind an ELB Classic Load Balancer. The security team requires that all web servers must be accessible only through the Load Balancer, and that none of the web servers are directly accessible from the Internet. How should the Architect meet these requirements?
Option A: Use a Load Balancer installed on an Amazon EC2 instance.
Option B: Configure the web servers' security group to deny traffic from the public Internet.
Option C: Create an Amazon CloudFront distribution in front of the ELB Classic Load Balancer.
Option D: Configure the web tier security group to allow only traffic from the ELB Classic Load Balancer.

Question 159: A Solutions Architect is designing a web application that will be hosted on Amazon EC2 instances in a public subnet. The web application uses a MySQL database in a private subnet. The database should be accessible to database administrators. Which of the following options should the Architect recommend? (Choose two.)
Option A: Create a bastion host in a public subnet, and use the bastion host to connect to the database.
Option B: Log in to the web servers in the public subnet to connect to the database.
Option C: Perform DB maintenance after using SSH to connect to the NAT Gateway in a public subnet.
Option D: Create an IPSec VPN tunnel between the customer site and the VPC, and use the VPN tunnel to connect to the database.
Option E: Attach an Elastic IP address to the database.

Question 160: A web application running on Amazon EC2 instances writes data synchronously to an Amazon DynamoDB table Configured for 60 write capacity units. During normal operation the application writes 50 KB/s to the tale, but can scale up to 500 KB/ s during peak hours. The application is currently throttling errors from the DynamoDB table during peak hours. What is the MOST cost-efficient cient change to support the increased traffic with minimal changes to the application?
Option A: Use Amazon SQS to manage the write operations to the DynamoDB table.
Option B: Change DynamoDB table Configuration to 600 write capacity units.
Option C: Increase the number of Amazon EC2 instances to support the traffic.
Option D: Configure Amazon DynamoDB Auto Scaling to handle the extra demand.

Question 161: One company wants to share the contents of their Amazon S3 bucket with another company. Security requirements mandate that only the other company's AWS accounts have access to the contents of the Amazon S3 bucket. Which Amazon S3 feature will allow secure access to the Amazon S3 bucket?
Option A: Bucket policy
Option B: Object tagging
Option C: CORS configuration
Option D: Lifecycle policy

Question 162: A Solutions Architect is designing a service that must have four Amazon EC2 instances running between 8 AM and 6 PM daily. The service requires one EC2 instance outside of those hours. What is the MOST cost-effective way to provide enough compute?
Option A: Use one Amazon EC2 Reserved Instance and use an Auto Scaling group to add and remove EC2 instances based on CPU utilization.
Option B: Use one Amazon EC2 On-Demand instance and use an Auto Scaling group to add and remove EC2 instances based on CPU utilization.
Option C: Use one Amazon EC2 On-Demand instance and use an Auto Scaling Group scheduled action to add three EC2 Spot instances at 7:30 AM and remove three instances at 6:10 PM.
Option D: Use one Amazon EC2 Reserved Instance and use an Auto Scaling Group scheduled action to add three EC2 On-Demand instances at 7:30 AM and remove three instances at 6:10 PM.

Question 163: A company plans to use an Amazon VPC to deploy a web application consisting of an elastic load balancer, a fleet of web and application servers, and an Amazon RDS MySQL database that should not be accessible from the Internet. The proposed design must be highly available and distributed over 4 two Availability Zones. What would be the MOST appropriate VPC design for this speci c use case?
Option A: Two public subnets for the elastic load balancer, two public subnets for the web servers, and two public subnets for Amazon RDS.
Option B: One public subnet for the elastic load balancer, two private subnets for the web servers, and two private subnets for Amazon RDS.
Option C: One public subnet for the elastic load balancer, one public subnet for the web servers, and one private subnet for the database.
Option D: Two public subnets for the elastic load balancer, two private subnets for the web servers, and two private subnets for RDS.

Question 164: A workload in an Amazon VPC consists of a single web server launched from a custom AMI. Session state is stored in a database. How should the Solutions Architect modify this workload to be both highly available and scalable?
Option A: Create a launch Configuration with a desired capacity of two web servers across multiple Availability Zones. Create an Auto Scaling group with the AMI ID of the web server image. Use Amazon Route 53 latency-based routing to balance traffic across the Auto Scaling group.
Option B: Create a launch Configuration with the AMI ID of the web server image. Create an Auto Scaling group using the newly-created launch configuration, and a desired capacity of two web servers across multiple regions. Use an Application Load Balancer (ALB) to balance traffic across the Auto Scaling group.
Option C: Create a launch Configuration with the AMI ID of the web server image. Create an Auto Scaling group using the newly-created launch configuration, and a desired capacity of two web servers across multiple Availability Zones. Use an ALB to balance traffic across the Auto Scaling group.
Option D: Create a launch Configuration with the AMI ID of the web server image. Create an Auto Scaling group using the newly-created launch configuration, and a desired capacity of two web servers across multiple Availability Zones. Use Amazon Route 53 weighted routing to balance traffic across the Auto Scaling group.

Question 165: A Solutions Architect is developing a new web application on AWS. The services must scale to support an increasing load. The Architect wants to focus on software development and deploying new features rather than provisioning or managing servers. Which AWS service is appropriate?
Option A: Auto Scaling
Option B: Elastic Beanstalk
Option C: EC2 Container Service
Option D: CloudFormation

Question 166: A company wants to migrate a three-tier web application to AWS. The company wants to control the placement of the instances and have visibility into underlying sockets and cores for licensing purposes. Which compute model should a Solutions Architect choose to accomplish this task?
Option A: EC2 Reserved Instances
Option B: EC2 Spot Instances
Option C: EC2 Dedicated Hosts
Option D: EC2 Placement Groups

Question 167: An application runs on multiple Amazon EC2 instances. Each running instance of the application must have access to a shared le system. Where should the data be stored?
Option A: Amazon S3
Option B: Amazon DynamoDB
Option C: Amazon EFS
Option D: Amazon EBS

Question 168: A Solutions Architect is designing a microservice to process records from Amazon Kinesis Streams. The metadata must be stored in Amazon DynamoDB. The microservice must be capable of concurrently processing 10,000 records daily as they arrive in the Kinesis stream. The MOST scalable way to design the microservice is:
Option A: As an AWS Lambda function.
Option B: As a process on an Amazon EC2 instance.
Option C: As a Docker container running on Amazon ECS.
Option D: As a Docker container on an EC2 instance.

Question 169: A university is running an internal web application on AWS that students can access from the university network to check their exam results. The web application runs on Amazon EC2 instances and pulls results from an Amazon DynamoDB table. Auto Scaling is currently Configured to add a new web server when CPU is greater than 80% for 5 minutes. DynamoDB is Configured to increase both read and write capacity units by ve when utilization is greater than 80%. Exam results are released at 9:00 a.m. each Monday, and 80% of students, attempt to access their unique result within the rest 30 minutes. Despite Auto Scaling being enabled, students are complaining of slow response times and errors when they view the site. There are no performance complaints after 9:30 a.m. on Monday. 56/29/2020 p p y Which recommendation should a Solutions Architect make to improve performance in a cost-effective manner?
Option A: Scale out the EC2 instances to ensure that the environment scales up and down based on the highest load.
Option B: Implement Amazon DynamoDB Accelerator to improve database performance and remove the need to scale the read/write units.
Option C: Use a scheduled job to scale out EC2 before 9:00 a.m. on Monday and to scale down after 9:30 a.m.
Option D: Use Amazon CloudFront to cache web request and reduce the load on EC2 and DynamoDB.

Question 170: As part of a migration strategy, a Solutions Architect needs to analyze workloads that can be optimized for performance and cost. The Solutions Architect has identified a stateless application that serves static content as a potential candidate to move to the cloud. The Solutions Architect has the exibility to choose an identity solution between Facebook, Twitter, and Amazon. Which AWS solution offers exibility and ease of use, and the LEAST operational overhead for this migration?
Option A: Use AWS Identity and Access Management (IAM) for managing identities, and migrate the application to run on Amazon S3, Amazon API Gateway, and AWS Lambda.
Option B: Use a third-party solution for managing identities, and migrate the application to run on Amazon S3, EC2 Spot Instances, and Amazon EC2.
Option C: Use Amazon Cognito for managing identities, and migrate the application to run on Amazon S3, Amazon API Gateway, and AWS Lambda.
Option D: Use Amazon Cognito for managing identities, and migrate the application to run on Amazon S3, EC2 Spot Instances, and Amazon EC2.

Question 171: A company needs to capture all client connection information from its Application Load Balancer every ve minutes. This data will be used to analyze traffic patterns and troubleshoot the application. How can a Solutions Architect meet this requirement?
Option A: Enable AWS CloudTrail for the Application Load Balancer.
Option B: Enable Access Logs on the Application Load Balancer.
Option C: Install CloudWatch Agent on the Application Load Balancer.
Option D: Enable CloudWatch metrics on the Application Load Balancer.

Question 172: An application runs on EC2 instances behind an Elastic Load Balancing Application Load Balancer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. The application provides a RESTful interface with both synchronous and asynchronous operations. The asynchronous operations require up to 5 minutes to complete. Although the application must remain available at all times, after business hours, the traffic going to the application is greatly reduced and often results in the Auto Scaling group running the minimum number of On-Demand Instances. What should the Solutions Architect recommend to optimize the cost of the environment after business hours?
Option A: Change the Availability Zones in which the instances were created to another Availability Zone in the same region with a lower cost.
Option B: Replace all On-Demand Instances with Spot Instances in the Auto Scaling group.
Option C: Purchase Reserved Instances for the minimum number of Auto Scaling instances. 5
Option D: Reduce the number of minimum instances to 0. New requests to the Application Load Balancer create new instances.

Question 173: A Solutions Architect is designing a web application for document sharing. The users will upload documents that are then made available to other users. There will be tens of thousands of these documents. What is the MOST cost-effective storage solution?
Option A: Amazon EFS
Option B: Amazon S3
Option C: Amazon Glacier
Option D: Amazon EBS

Question 174: A Solutions Architect was tasked with reviewing several templates that build VPCs and ensuring that they meet speci c security requirements. After reviewing the templates, the Architect realizes that all of the templates are missing important security best practices. What should the Architect do to implement security best practices in an efficient manner?
Option A: Use VPC peering to enforce network consistency
Option B: Restrict users from deploying an AWS CloudFormation template
Option C: Provide the teams a nested AWS CloudFormation template that builds the VPC correctly
Option D: Create AWS Identity and Access Management (IAM) policies that enforce the corporate VPC architecture standards

Question 175: A Solutions Architect has been given the following requirements for a company's VPC: ✑ The solution is a two-tiered application with a web tier and a database tier. ✑ All web traffic to the environment must be directed from the Internet to an Application Load Balancer. ✑ The web servers and the databases should not obtain public IP addresses or be directly accessible from the public Internet. ✑ Because of security requirements, databases may not share a route table or subnet with any other service. ✑ The environment must be highly available within the same VPC for all services. What is the minimum number of subnets that the Solutions Architect will need based on these requirements and best practices?
Option A: 2
Option B: 3
Option C: 4
Option D: 6

Question 176: An application currently stores objects in Amazon S3-Standard. The application accesses new objects frequently for one week. After one week, they are accessed occasionally for analysis batch jobs. A Solutions Architect has been asked to reduce storage costs for the application while allowing immediate access for batch jobs. How can costs be reduced without reducing data durability?
Option A: Create a lifecycle policy that moves Amazon S3 data to Amazon S3 One Zone-Infrequent Access storage after 7 days. After 30 days, move the data to Amazon Glacier.
Option B: Keep the data on Amazon S3, and create a lifecycle policy to move S3 data to Amazon Glacier after 7 days.
Option C: Move all Amazon S3 data to S3 Standard-Infrequent Access storage, and create a lifecycle policy to move the data to Amazon Glacier after 7 days.
Option D: Keep the data on Amazon S3, then create a lifecycle policy to move the data to S3 Standard-Infrequent Access storage after 7 days.

Question 177: A company is building a critical ingestion service on AWS that will receive 1000 incoming events per second. The events must be processed in order, and no events may be lost. Multiple applications will need to process each event.The company will expose the service as RESTful calls through an API Gateway.What should a Solutions Architect use to receive the events based on these requirements ?
Option A: Amazon Kinesis Data Stream
Option B: Amazon DynamoDB
Option C: Amazon SQS
Option D: Amazon SNS

Question 178: An AWS Lambda function requires access to an Amazon RDS for SQL Server instance. It is against company policy to store passwords in Lambda functions. How can a Solutions Architect enable the Lambda function to retrieve the database password without violating company policy?
Option A: Add an IAM policy for IAM database access to the Lambda execution role.
Option B: Store a one-way hash of the password in the Lambda function.
Option C: Have the Lambda function use the AWS Systems Manager Parameter Store.
Option D: Connect to the Amazon RDS for SQL Server instance by using a role assigned to the Lambda function.

Question 179: A company has two different types of reporting needs on their 200-GB data warehouse: ✑ Data scientists run a small number of concurrent ad hoc SQL queries that can take several minutes each to run. 5 ✑ Display screens throughout the company run many fast SQL queries to populate dashboards. Which design would meet these requirements with the LEAST cost?
Option A: Replicate relevant data between Amazon Redshift and Amazon DynamoDB. Data scientists use Redshift. Dashboards use DynamoDB.
Option B: Configure auto-replication between Amazon Redshift and Amazon RDS. Data scientists use Redshift. Dashboards use RDS.
Option C: Use Amazon Redshift for both requirements, with separate query queues Configured in workload management.
Option D: Use Amazon Redshift for Data Scientists. Run automated dashboard queries against Redshift and store the results in Amazon ElastiCache. Dashboards query ElastiCache.

Question 180: A company has an application that uses Amazon CloudFront for content that is hosted on an Amazon S3 bucket. After an unexpected refresh, the users are still seeing old content. Which step should the Solutions Architect take to ensure that new content is displayed?
Option A: Perform a cache refresh on the CloudFront distribution that is serving the content.
Option B: Perform an invalidation on the CloudFront distribution that is serving the content.
Option C: Create a new cache behavior path with the updated content.
Option D: Change the TTL value for removing the old objects.

Question 181: A company expects its user base to increase ve times over one year. Its application is hosted in one region and uses an Amazon RDS MySQL database, an ELB Application Load Balancer, and Amazon ECS to host the website and its microservices. Which design changes should a Solutions Architect recommend to support the expected growth? (Choose two.)
Option A: Move static files from ECS to Amazon S3
Option B: Use an Amazon Route 53 geolocation routing policy
Option C: Scale the environment based on real-time AWS CloudTrail logs
Option D: Create a dedicated Elastic Load Balancer for each microservice
Option E: Create RDS read replicas and change the application to use these replicas

Question 182: A company is rolling out a new web service, but is unsure how many customers the service will attract. However, the company is unwilling to accept any downtime. What could a Solutions Architect recommend to the company in order to keep track of customers' current session data?
Option A: Amazon EC2
Option B: Amazon RDS
Option C: AWS CloudTrail
Option D: Amazon DynamoDB 5

Question 183: A web application is running on Amazon EC2 instances behind an Elastic Load Balancing Application Load Balancer (ALB). The EC2 instances should receive no traffic, except for web requests to the application. Based on these requirements, what security group rules should be put on the Amazon EC2 instances?
Option A: An inbound rule allowing traffic from the security group attached to the ALB
Option B: An inbound rule allowing traffic from the network ACLs attached to the ALB
Option C: An outbound rule allowing traffic to the security group attached to the ALB
Option D: An outbound rule blocking all traffic to the Internet

Question 184: A Solutions Architect must migrate a monolithic on-premises application to AWS. It is a web application with a load balancer, web server, application server, and relational database. The key requirement driving the migration is that the application should perform better and be more elastic. Which of the following architectures would meet these requirements?
Option A: Re-host the application on Amazon EC2 with lift and shift of existing application code. Configure an Elastic Load Balancing load balancer to handle incoming requests. Use Amazon CloudWatch alarms to receive noti cation of scaling issues. Increase and decrease the size of the Amazon EC2 instances using AWS CLI or AWS Management Console as required.
Option B: Re-architect the application as a three-tier application. Move the database to Amazon RDS. Use read replicas and Amazon ElastiCache with RDS for better performance. Use an Application Load Balancer to forward incoming requests to web and application servers running onpremises.
Option C: Re-platform the application as a three-tier application. Use Elastic Load Balancing for incoming requests. Use EC2 for web and application tiers. Use RDS at the database tier. Use CloudWatch alarms and Auto Scaling for horizontal scaling at the web tier.
Option D: Re-architect the application as Service Oriented Architecture (SOA). Run database and application servers on-premises. Run web-facing EC2 servers. Use an Enterprise Service Bus to handle communications between different parts of the application running on-premises and in the cloud.

Question 185: A company has asked the Solutions Architect to modify its AWS-hosted internal application to allow for load balancing. The customer requests always come from the company domain (example.net). The company requires that incoming HTTP and HTTPS traffic is routed based on the path element of the URL in the request. Which implementation can satisfy all requirements?
Option A: Configure a Network Load Balancer with listeners for appropriate path patterns for the target groups.
Option B: Configure an Application Load Balancer with host-based routing based on the domain eld in the HTTP header.
Option C: Configure a Network Load Balancer and enable cross-zone load balancing to ensure that all EC2 instances are used.
Option D: Configure an Application Load Balancer with listeners for appropriate path patterns for the target group.

Question 186: A Solutions Architect is asked to improve the fault tolerance of an existing Python application. The web application places 1-MB images is an S3 bucket. The application then uses a single t2.large instance to transform the image to include a watermark with the company's brand before writing the image back to the S3 bucket. What should the Solutions Architect recommend to increase the fault tolerance of the solution?
Option A: Convert the code to a Lambda function triggered by scheduled Amazon CloudWatch Events.
Option B: Increase the instance size to m4.xlarge and Configure Enhanced Networking.
Option C: Convert the code to a Lambda function triggered by Amazon S3 events.
Option D: Create an Amazon SQS queue to send the images to the t2.large instance.

Question 187: A Solutions Architect has been asked to deliver video content stored on Amazon S3 to speci c users from Amazon CloudFront while restricting access by unauthorized users. How can the Architect implement a solution to meet these requirements?
Option A: Configure CloudFront to use signed-URLs to access Amazon S3.
Option B: Store the videos as private objects in Amazon S3, and let CloudFront serve the objects by using only Origin Access Identity (OAI).
Option C: Use Amazon S3 static website as the origin of CloudFront, and Configure CloudFront to deliver the videos by generating a signed URL for users.
Option D: Use OAI for CloudFront to access private S3 objects and select the Restrict Viewer Access option in CloudFront cache behavior to use signed URLs.

Question 188: A Solutions Architect needs to deploy a node.js-based web application that is highly available and scales automatically. The Marketing team needs to roll back on application releases quickly, and they need to have an operational dashboard. The Marketing team does not want to manage deployment of OS patches to the Linux servers. Use of which AWS service will satisfy these requirements?
Option A: Amazon EC2
Option B: Amazon API Gateway
Option C: AWS Elastic Beanstalk
Option D: Amazon EC2 Container Service

Question 189: A company has a website running on Amazon EC2. The application DNS name points to an Elastic IP address associated with the EC2 instance. In the event of an attack on the website coming from a speci c IP address, the company wants a way to block the offending IP address. Which tool or service should a Solutions Architect recommend to block the IP address?
Option A: Security groups
Option B: Network ACL
Option C: AWS WAF
Option D: AWS Shield

Question 190: A customer is looking for a storage archival solution for 1,000 TB of data. The customer requires that the solution be durable and data be available within a few hours of requesting it, but not exceeding a day. The solution should be as cost-effective as possible. To meet security compliance policies, data must be encrypted at rest. The customer expects they will need to fetch the data two times in a year. Which storage solution should a Solutions Architect recommend to meet these requirements?
Option A: Copy data to Amazon S3 buckets by using server-side encryption. Move data to Amazon S3 to reduce redundancy storage (RRS).
Option B: Copy data to encrypted Amazon EBS volumes, then store data into Amazon S3.
Option C: Copy each object into a separate Amazon Glacier vault, and let Amazon Glacier take care of encryption.
Option D: Copy data to Amazon S3 with server-side encryption. Configure lifecycle management policies to move data to Amazon Glacier after 0 days.

Question 191: A web application runs on 10 EC2 instances launched from a single customer Amazon Machine Image (AMI). The EC2 instances are behind an Internet Application Load Balancer. Amazon Route 53 provides DNS for the application. How should a Solutions Architect automate recovery when a web server instance stops replying to request?
Option A: Launch the instances in an Auto Scaling group with an Elastic Load Balancing health check.
Option B: Launch instances in multiple Availability Zones and set the load balancer to Multi-AZ.
Option C: Add CloudWatch alarm actions for each instance to restart if the Status Check (Any) fails.
Option D: Add Route 53 records for each instance with an instance health check.

Question 192: A company has a Node.js application running on Amazon EC2 that currently retrieves data for customers from a DynamoDB table. The company is seeing many repeat queries for the same items, and the number of queries is continuing to increase as the application gains popularity. What solution will reduce the number of read capacity units (RCUs) required while minimizing the amount of refactoring that must be done to the application? 5
Option A: Use Amazon ElastiCache to provide a caching layer
Option B: Use a Lambda function to make concurrent requests for caching
Option C: Use Amazon DynamoDB Accelerator (DAX) to provide a caching layer
Option D: Obtain Reserved Capacity for Amazon DynamoDB to manage the increased number of queries

Question 193: A company has an application that accesses a MySQL database installed on a single EC2 instance. The instance recently experienced a fault and brought down the entire application for several hours. The company wants to address the issue but is concerned about spending too much time modifying application code or managing the legacy application. What should the Solutions Architect recommend to remove this single point of failure with the FEWEST changes to the application code and the LEAST amount of administrative effort?
Option A: Implement a caching layer by using Amazon ElastiCache to store query results of frequently accessed information.
Option B: Deploy a second EC2 instance with MySQL installed, and Configure replication between this instance and the existing MySQL instance.
Option C: Migrate the database to an RDS MySQL Multi-AZ DB instance, and point the application servers to the new RDS instance.
Option D: Create a DynamoDB table to use as a cache layer, and update the application to query data from Amazon DynamoDB before querying MySQL.

Question 194: A team is launching a marketing campaign and the peak database read activity in Amazon Aurora for MySQL is expected to increase. A Solutions Architect decides to add two Read Replicas to the cluster. How should the Solutions Architect ensure that the connections for read activities are load balanced?
Option A: Reader endpoint for Amazon Aurora
Option B: Cluster endpoint for Amazon Aurora
Option C: Primary DB instance endpoint for Amazon Aurora
Option D: Replica DB instances endpoint for Aurora

Question 195: A company plans to migrate a website to AWS to use a serverless architecture. The website contains both static and dynamic content and is accessed by users across the world. The website should maintain sessions for returning users to improve the user experience. Which service should a Solutions Architect use for a cost-efficient cient solution with the LOWEST latency?
Option A: Amazon S3, AWS Lambda, Amazon API Gateway, and Amazon DynamoDB
Option B: Amazon CloudFront, AWS Lambda, API Gateway, and Amazon RDS
Option C: Amazon CloudFront, Elastic Load Balancing, Amazon EC2, and Amazon RDS
Option D: Amazon S3, Amazon CloudFront, AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. 5

Question 196: A Solutions Architect is helping a customer migrate an application to AWS. The application is composed of a fleet of Linux servers that currently use a shared le system to read and write data. One of the goals of moving this application to AWS is to increase the reliability of the storage tier. What solution would increase reliability while minimizing the operational overhead of managing this infrastructure?
Option A: Create an EBS volume and mount it to all the servers.
Option B: Create an EFS le system and mount it to all the servers.
Option C: Create an S3 bucket that can be accessed through an S3 VPC Endpoint.
Option D: Create two EC2 instances in separate Availability Zones that act as le servers.

Question 197: A Solution Architect is designing a two-tier application for maximum security, with a web tier running on EC2 instances and the data stored in an RDS DB instance. The web tier should accept user access only through HTTPS connections (port 443) from the Internet, and the data must be encrypted in transit to and from the database. What combination of steps will MOST securely meet the stated requirements? (Choose two.)
Option A: Create a security group for the web tier instances that allows inbound traffic only over port 443.
Option B: Enforce Transparent Data Encryption (TDE) on the RDS database.
Option C: Create a network ACL that allows inbound traffic only over port 443.
Option D: Configure the web servers to communicate with RDS by using SSL, and issue certificates to the web tier EC2 instances.
Option E: Create a customer master key in AWS KMS and apply it to encrypt the RDS instance.

Question 198: A credit card processing application, hosted on an on-premises server, needs to communicate directly with a database hosted on an Amazon EC2 instance running in a private subnet of a VPC. Compliance requirements state that end-to-end communication should be encrypted. Which solution will ensure that this requirement is met?
Option A: Use HTTPS for traffic over VPC peering between the VPC and the on-premises datacenter.
Option B: Use HTTPS for traffic over the Internet between the on-premises server and the Amazon EC2 instance.
Option C: Use HTTPS for traffic over a VPN connection between the VPC and the on-premises datacenter.
Option D: Use HTTPS for traffic over gateway VPC endpoints that have been Configured for the Amazon EC2 instance.

Question 199: A company has asked a Solutions Architect to ensure that data is protected during data transfer to and from Amazon S3. Use of which service will protect the data in transit?
Option A: AWS KMS
Option B: HTTPS
Option C: SFTP
Option D: FTPS

Question 200: A Solutions Architect is trying to bring a data warehouse workload to an Amazon EC2 instance. The data will reside in Amazon EBS volumes and full table scans will be executed frequently. What type of Amazon EBS volume would be most suitable in this scenario?
Option A: Throughput Optimized HDD (st1)
Option B: Provisioned IOPS SSD (io1)
Option C: General Purpose SSD (gp2)
Option D: Cold HDD (sc1)

Question 201: A Solutions Architect has a three-tier web application that serves customers worldwide. Analysis reveals that product images take more time to load than expected. Which action will improve the image load time?
Option A: Store product images on Amazon EBS-optimized storage volumes
Option B: Store product images in an Amazon S3 bucket
Option C: Use an Amazon CloudFront distribution for product images
Option D: Use an Auto Scaling group to add instances for product images

Question 202: A gaming application is heavily dependent on caching and uses Amazon ElastiCache for Redis. The application performance was recently degraded due to failure of the cache node. What should a Solutions Architect recommend to minimize performance degradation in the future?
Option A: Migrate from ElastiCache to Amazon RDS
Option B: Configure automatic backup to save cache data 6
Option C: Configure ElastiCache Multi-AZ with automatic failover
Option D: Use Auto Scaling to provision cache nodes based on CPU usage

Question 203: A client has set up an Auto Scaling group associated with a load balancer. The client has noticed that instances launched by the Auto Scaling group are reported unhealthy as the result of an Elastic Load Balancing (ELB) health check, but these unhealthy instances are not being terminated. What can a Solutions Architect do to ensure that the instances marked unhealthy will be terminated and replaced?
Option A: Increase the value for the health check interval set on the ELB load balancer.
Option B: Change the thresholds set on the Auto Scaling group health check.
Option C: Change the health check type to ELB for the Auto Scaling group.
Option D: Change the health check set on the ELB load balancer to use TCP rather than HTTP checks.

Question 204: A Solutions Architect must review an application deployed on EC2 instances that currently stores multiple 5-GB files on attached instance store volumes. The company recently experienced a significant data loss after stopping and starting their instances and wants to prevent the data loss from happening again. The solution should minimize performance impact and the number of code changes required. What should the Solutions Architect recommend?
Option A: Store the application data in Amazon S3
Option B: Store the application data in an EBS volume
Option C: Store the application data in Amazon ElastiCache
Option D: Store the application data in Amazon DynamoDB

Question 205: An organization is deploying Amazon ElastiCache for Redis and requires password protection to improve their data security posture. Which solution should a Solutions Architect recommend?
Option A: Redis Auth
Option B: AWS Single Sign-On
Option C: IAM database authentication
Option D: VPC security group for Redis 6

Question 206: A Solutions Architect is designing a solution to send Amazon CloudWatch Alarm noti cations to a group of users on a smartphone mobile application. What are the key steps to this solution? (Choose two.)
Option A: Configure the CloudWatch Alarm to send the noti cation to an Amazon SNS topic whenever there is an alarm.
Option B: Configure the CloudWatch Alarm to send the noti cation to a mobile phone number whenever there is an alarm.
Option C: Configure the CloudWatch Alarm to send the noti cation to the email addresses whenever there is an alarm.
Option D: Create the platform endpoints for mobile devices and subscribe the SNS topic with platform endpoints.
Option E: Subscribe the SNS topic with an Amazon SQS queue, and poll the messages continuously from the queue. Use each mobile platform's libraries to send the message to the mobile application.

Question 207: A company uses Amazon S3 for storing a variety of files. A Solutions Architect needs to design a feature that will allow users to instantly restore any deleted files within 30 days of deletion. Which is the MOST cost-efficient cient solution?
Option A: Create lifecycle policies that move the objects to Amazon Glacier and delete them after 30 days.
Option B: Enable cross-region replication. Empty the replica bucket every 30 days using an AWS Lambda function.
Option C: Enable versioning and create a lifecycle policy to remove expired versions after 30 days.
Option D: Enable versioning and MFA Delete. Using a Lambda function, remove MFA delete from objects more than 30 days old.

Question 208: An application running on Amazon EC2 has been experiencing performance issues when accessing an Amazon RDS for Oracle database. The database has been provisioned correctly for average workloads, but there are several usage spikes each day that have saturated the database, causing the application to time out. The application is write-heavy, updating information more often than reading information. A Solutions Architect has been asked to review the application design. What should the Solutions Architect recommend to improve performance?
Option A: Put an Amazon ElastiCache cluster in front of the database and use lazy loading to limit database access during peak periods.
Option B: Put an Amazon Elasticsearch domain in front of the database and use a Write-Through cache to reduce database access during peak periods.
Option C: Configure an Amazon RDS Auto Scaling group to automatically scale the RDS instance during load spikes.
Option D: Change the Amazon RDS instance storage type from General Purpose SSD to provisioned IOPS SSD.

Question 209: During performance testing of an application, the Amazon RDS database caused a performance bottleneck. What steps can be taken to improve the database performance? (Choose two.)
Option A: Change the RDS database instance to multiple Availability Zones.
Option B: Scale up to a larger RDS instance type.
Option C: Redirect read queries to RDS read replicas.
Option D: Scale out using an Auto Scaling group for RDS.
Option E: Use RDS in a separate AWS Region.

Question 210: A Solutions Architect must design an Amazon DynamoDB table to store data about customer activities. The data is used to analyze recent customer behavior, so data that is filess than a week old is heavily accessed and older data is accessed infrequently. Data that is more than one month old never needs to be referenced by the application, but needs to be archived for year-end analytics. What is the MOST cost-efficient cient way to meet these requirements? (Choose two.)
Option A: Use DynamoDB time-to-live settings to expire items after a certain time period.
Option B: Provision a higher write capacity unit to minimize the number of partitions.
Option C: Create separate tables for each week's data with higher throughput for the current week.
Option D: Pre-process data to consolidate multiple records to minimize write operations.,
Option E: Export the old table data from DynamoDB to Amazon S3 using AWS Data Pipeline, and delete the old table.

Question 211: A Solutions Architect is concerned that the current security group rules for a database tier are too permissive and may permit requests that should be restricted. Below are the current security group permissions for the database tier: ✑ Protocol: TCP ✑ Port Range: 1433 (MS SQL) ✑ Source: ALL Currently, the only identified resource that needs to connect to the databases is the application tier consisting of an Auto Scaling group of EC2 instances. What changes can be made to this security group that would offer the users LEAST privilege?
Option A: Change the source to -1 to remove source IP addresses previously unseen.
Option B: Change the source to the VPC CIDR block.
Option C: Change the source to the application instances IDs.
Option D: Change the source to the security group ID attached to the application instances. 6

Question 212: A large media site has multiple applications in Amazon ECS. A Solutions Architect needs to use content metadata and route traffic to speci c services. What is the MOST efficient method to perform this task?
Option A: Use an AWS Classic Load Balancer with a host-based routing option to route traffic to the correct service.
Option B: Use the AWS CLI to update Amazon Route 53 hosted zone to route traffic as services get updated.
Option C: Use an AWS Application Load Balancer with host-based routing option to route traffic to the correct service.
Option D: Use Amazon CloudFront to manage and route traffic to the correct service.

Question 213: A Solutions Architect must build a secure document storage platform that allows clients to access data stored on Amazon S3. Documents must be readily available for the rest 15 days. After that, documents need not be readily available, and storage costs should be reduced as much as possible. Which of the following approaches will satisfy these requirements?
Option A: Create a lifecycle rule to transition the documents from the STANDARD storage class to the STANDARD_IA storage class after 15 days, and then to the GLACIER storage class after an additional 15 days.
Option B: Create a lifecycle rule to transition the documents from the STANDARD storage class to the GLACIER storage class after 30 days.
Option C: Create a lifecycle rule to transition documents from the STANDARD storage class to the STANDARD_IA storage class after 30 days and then to the GLACIER storage class after an additional 30 days.
Option D: Create a lifecycle rule to transition the documents from the STANDARD storage class to the GLACIER storage class after 15 days.

Question 214: A Solutions Architect needs to Configure scaling policies based on Amazon CloudWatch metrics for an Auto Scaling group. The application running on the instances is memory intensive. How can the Architect meet this requirement?
Option A: Enable detailed monitoring on the Amazon EC2 instances.
Option B: Publish custom metrics to CloudWatch from the application.
Option C: Configuration lifecycle policies for the Amazon EC2 instances.
Option D: Set up high-resolution alarms for the Auto Scaling group

Question 215: A customer has a service based out of Oregon, U.S. and Paris, France. The application is storing data in an S3 bucket located in Oregon, and that data is updated frequently. The Paris o ce is experiencing slow response times when retrieving objects. What should a Solutions Architect do to resolve the slow response times for the Paris o ce?
Option A: Set up an S3 bucket based in Paris, and enable cross-region replication from the Oregon bucket to the Paris bucket.
Option B: Create an Application Load Balancer that load balances data retrieval between the Oregon S3 bucket and a new Paris S3 bucket.
Option C: Create an Amazon CloudFront distribution with the bucket located in Oregon as the origin and set the Maximum Time to Live (TTL) for cache behavior to 0.
Option D: Set up an S3 bucket based in Paris, and enable a lifecycle management rule to transition data from the Oregon bucket to the Paris bucket.

Question 216: A company uses AWS Elastic Beanstalk to deploy a web application running on c4.large instances. Users are reporting high latency and failed requests. Further investigation reveals that the EC2 instances are running at or near 100% CPU utilization. What should a Solutions Architect do to address the performance issues?
Option A: Use time-based scaling to scale the number of instances based on periods of high load.
Option B: Modify the scaling triggers in Elastic Beanstalk to use the CPUUtilization metric.
Option C: Swap the c4.large instances with the m4.large instance type.
Option D: Create an additional Auto Scaling group, and Configure Amazon EBS to use both Auto Scaling groups to increase the scaling capacity.

Question 217: A Solutions Architect is working on a PCI-compliant architecture that needs to call an external service provider's API. The external provider requires IP whitelisting to verify the calling party. How should the Solutions Architect provide the external party with the IP addresses for whitelisting?
Option A: Use an API Gateway in proxy mode, and provide the API Gateway's IP address to the external service provider.
Option B: Associate a public elastic network interface to a published stage/endpoint in API Gateway, exposing the AWS Lambda function, and provide the IP address for the public network interface to the external party to whitelist.
Option C: Deploy the Lambda function in private subnets and route outbound traffic through a NAT gateway. Provide the NAT gateway's Elastic IP address to the external service provider.
Option D: Provide the external party the allocated AWS IP address range for Lambda functions, and send change noti cations by using a subscription to the AmazonIpSpaceChanged SNS topic.

Question 218: A Solutions Architect is designing a shared le system for a company. Multiple users will be accessing it at any given time. Different teams will have their own directories, and the company wants to secure files so that users can access only files owned by their team. How should the Solutions Architect design this?
Option A: Use Amazon EFS and control permissions by using le-level permissions.
Option B: Use Amazon S3 and control permissions by using ACLs. 6
Option C: Use Amazon EFS and control permissions by using security groups.
Option D: Use AWS Storage Gateway and control permissions by using AWS Identity and Access Management (IAM)

Question 219: A company requires operating system permission on a relational database server. What should a Solutions Architect suggest as a Configuration for a highly available database architecture?
Option A: Multiple EC2 instances in a database replication Configuration that uses two Availability Zones.
Option B: A standalone Amazon EC2 instance with a selected database installed.
Option C: Amazon RDS in a Multi-AZ Configuration with Provisioned IOPS.
Option D: Multiple EC2 instances in a replication Configuration that uses two placement groups.

Question 220: An application has a web tier that runs on EC2 instances in a public subnet. The application tier instances run in private subnets across two Availability Zones. All traffic is IPv4 only, and each subnet has its own custom route table. A new feature requires that application tier instances can call an external service over the Internet; however, they must still not be accessible to Internet traffic. What should be done to allow the application servers to connect to the Internet, maintain high availability, and minimize administrative overhead?
Option A: Add an Amazon egress-only internet gateway to each private subnet. Alter each private subnet's route table to include a route from 0.0.0.0/0 to the egress-only internal gateway in the same Availability Zone.
Option B: Add an Amazon NAT Gateway to each public subnet. Alter each private subnet's route table to include a route from 0.0.0.0/0 to the NAT Gateway in the same Availability Zone.
Option C: Add an Amazon NAT instance to one of the public subnets Alter each private subnet's route table to include a route from 0.0.0.0/0 to the Internet gateway in the VPC.
Option D: Add an Amazon NAT Gateway to each private subnet. Alter each private subnet's route table to include a route from 0.0.0.0/0 to the NAT Gateway in the other Availability Zone.

Question 221: An application uses an Amazon SQS queue as a transport mechanism to deliver data to a group of EC2 instances for processing. The application owner wants to add a mechanism to archive the incoming data without modifying application code on the EC2 instances. How can this application be re-architected to archive the data without modifying the processing instances?
Option A: Trigger a Lambda function by using Amazon CloudWatch Events to retrieve messages from the SQS queue and archive to Amazon S3.
Option B: Use an Amazon SNS topic to fan out the data to the SQS queue in addition to a Lambda function that records the data to an S3 bucket.
Option C: Set up an Amazon Kinesis Data Stream so that multiple instances can receive data. Add a separate EC2 instance that is Configured to archive all data it receives.
Option D: Write the data to an S3 bucket, and use an SQS queue for S3 event noti cations to tell the instances where to retrieve the data. 6
Option D: Write the data to an S3 bucket, and use an SQS queue for S3 event noti cations to tell the instances where to retrieve the data.

Question 222: A Solutions Architect must select the most cost-efficient client architecture for a service that responds to web requests. These web requests are small and query a DynamoDB table. The request rate ranges from zero to several hundred each second, without any predictable patterns. What is the MOST cost-efficient cient architecture for this service?
Option A: Network Load Balancer/Amazon EC2
Option B: Application Load Balancer/Amazon ECS
Option C: API Gateway/AWS Lambda
Option D: AWS Elastic Beanstalk/AWS Lambda

Question 223: A company has a web application running in a Docker container that connects to a MySQL server in an on-premises data center. The deployment and maintenance of this application are becoming time-consuming and slowing down new feature releases. The company wants to migrate the application to AWS and use services that helps facilitate infrastructure management and deployment. Which architectures should the company consider on AWS? (Choose two.)
Option A: Amazon ECS for the web application, and an Amazon RDS for MySQL for the database.
Option B: AWS Elastic Beanstalk Docker Multi-container either for the web application or database.
Option C: AWS Elastic Beanstalk Docker Single Container for the web application, and an Amazon RDS for MySQL for the database.
Option D: AWS CloudFormation with Lambda Custom Resources without VPC for the web application, and an Amazon RDS for MySQL database.,
Option E: AWS CloudFormation with Lambda Custom Resources running in a VPC for the web application, and an Amazon RDS for MySQL database.

Question 224: A Solutions Architect has designed a VPC that meets all necessary security requirements for their organization. Any applications deployed in the organization must use this VPC design. How can project teams deploy, manage, and delete VPCs that meet this design with the LEAST administrative effort?
Option A: Deploy an AWS CloudFormation template that de nes components of the VPC.
Option B: Run a script that uses the AWS Command Line Interface to deploy the VPC.
Option C: Clone the existing authorized VPC for each new project.
Option D: Use AWS Elastic Beanstalk to deploy both the VPC and the application.

Question 225: What conditions could cause a Multi-AZ Amazon RDS failover to occur? (Choose two.)
Option A: The RDS instance is stopped manually
Option B: A replica of the RDS instance is created in a different region
Option C: An Availability Zone becomes unavailable
Option D: Another master user is created,
Option E: A failure of the primary database instance

Question 226: A solutions architect is designing a solution where users will be directed to a backup static error page if the primary website is unavailable. The primary website's DNS records are hosted in Amazon Route 53 where their domain is pointing to an Application Load Balancer (ALB). Which configuration should the solutions architect use to meet the company's needs while minimizing changes and infrastructure overhead?
Option A: Point a Route 53 alias record to an Amazon CloudFront distribution with the ALB as one of its origins. Then, create custom error pages for the distribution.
Option B: Set up a Route 53 active-passive failover configuration. Direct traffic to a static error page hosted within an Amazon S3 bucket when Route 53 health checks determine that the ALB endpoint is unhealthy.
Option C: Update the Route 53 record to use a latency-based routing policy. Add the backup static error page hosted within an Amazon S3 bucket to the record so the traffic is sent to the most responsive endpoints.
Option D: Set up a Route 53 active-active configuration with the ALB and an Amazon EC2 instance hosting a static error page as endpoints. Route 53 will only send requests to the instance if the health checks fail for the ALB.

Question 227: A Solutions Architect has ve web servers serving requests for a domain. Which of the following Amazon Route 53 routing policies can distribute traffic randomly among all healthy web servers?
Option A: Simple
Option B: Failover
Option C: Weighted
Option D: Multivalue Answer

Question 228: A web server will be provisioned on two Amazon EC2 instances with an Application Load Balancer. Which of the following configurations will allow traffic on HTTP and HTTPS when con guring a security group to apply to each of these servers?
Option A: Allow all inbound traffic, with explicit denies on non-HTTP and non-HTTPS ports.
Option B: Allow incoming traffic to HTTP and HTTPS ports.
Option C: Allow incoming traffic to HTTP and HTTPS ports, with explicit denies to all other ports.
Option D: Deny all traffic to non-HTTP and non-HTTPS ports

Question 229: A company wants to run a static website served through Amazon CloudFront. What is an advantage of storing the website content in an S3 bucket instead of an EBS volume?
Option A: S3 buckets are replicated globally, allowing for large scalability. EBS volumes are replicated only within a region.
Option B: S3 is an origin for CloudFront. EBS volumes would need EC2 instances behind an Elastic Load Balancing load balancer to be an origin.
Option C: S3 buckets can be encrypted, allowing for secure storage of the web files. EBS volumes cannot be encrypted.
Option D: S3 buckets support object-level read throttling, preventing abuse. EBS volumes do not provide object-level throttling.

Question 230: A company is moving to AWS. Management has identified a set of approved AWS services that meet all deployment requirements. The company would like to restrict access to all other unapproved services to which employees would have access. Which solution meets these requirements with the LEAST amount of operational overhead?
Option A: Configure the AWS Trusted Advisor service utilization compliance report. Subscribe to Amazon SNS noti cations from Trusted Advisor. Create a custom AWS Lambda function that can automatically remediate the use of unauthorized services.
Option B: Use AWS Con g to evaluate the Configuration settings of AWS resources. Subscribe to Amazon SNS noti cations from AWS Con g. Create a custom AWS Lambda function that can automatically remediate the use of unauthorized services.
Option C: Configure AWS Organizations. Create an organizational unit (OU) and place all AWS accounts into the OU. Apply a service control policy (SCP) to the OU that denies the use of certain services.
Option D: Create a custom AWS IAM policy. Deploy the policy to each account using AWS CloudFormation StackSets. Include deny statements in the policy to restrict the use of certain services. Attach the policies to all IAM users in each account.

Question 231: A customer is running a critical payroll system in a production environment in one data center and a disaster recovery (DR) environment in another. The application includes load-balanced web servers and failover for the MySQL database. The customer's DR process is manual and error-phone For this reason management has asked IT to migrate the application to AWS and make it highly available so that IT no longer has to 7 error phone. For this reason, management has asked IT to migrate the application to AWS and make it highly available so that IT no longer has to manually fail over the environment. How should a Solutions Architect migrate the system to AWS?
Option A: Migrate the production and DR environments to different Availability Zones within the same region. Let AWS manage failover between the environments.
Option B: Migrate the production and DR environments to different regions. Let AWS manage failover between the environments.
Option C: Migrate the production environment to a single Availability Zone, and set up instance recovery for Amazon EC2. Decommission the DR environment because it is no longer needed.
Option D: Migrate the production environment to span multiple Availability Zones, using Elastic Load Balancing and Multi-AZ Amazon RDS. Decommission the DR environment because it is no longer needed.

Question 232: A company is creating a web application that will run on an Amazon EC2 instance. The application on the instance needs access to an Amazon DynamoDB table for storage. What should be done to meet these requirements?
Option A: Create another AWS account root user with permissions to the DynamoDB table.
Option B: Create an IAM role and assign the role to the EC2 instance with permissions to the DynamoDB table.
Option C: Create an identity provider and assign the identity provider to the EC2 instance with permissions to the DynamoDB table.
Option D: Create identity federation with permissions to the DynamoDB table.

Question 233: A company is creating a web application that allows customers to view photos in their web browsers. The website is hosted in us-east-1 on Amazon EC2 instances behind an Application Load Balancer. Users will be located in many places around the world. Which solution should provide all users with the fastest photo viewing experience?
Option A: Implement an AWS Auto Scaling group for the web server instances behind the Application Load Balancer.
Option B: Enable Amazon CloudFront for the website and specify the Application Load Balancer as the origin.
Option C: Move the photos into an Amazon S3 bucket and enable static website hosting.
Option D: Enable Amazon ElastiCache in the web server subnet.

Question 234: A Solutions Architect is designing a highly available web application on AWS. The data served on the website is dynamic and is pulled from Amazon DynamoDB. All users are geographically close to one another. How can the Solutions Architect make the application highly available? 7
Option A: Host the website data on Amazon S3 and set permissions to enable public read-only access for users.
Option B: Host the web server data on Amazon CloudFront and update the objects in the Cloudfront distribution when they change.
Option C: Host the application on EC2 instances across multiple Availability Zones. Use an Auto Scaling group coupled with an Application Load Balancer.
Option D: Host the application on EC2 instances in a single Availability Zone. Replicate the EC2 instances to a separate region, and use an Application Load Balancer for high availability.

Question 235: A company is migrating on-premises databases to AWS. The company's backend application produces a large amount of database queries for reporting purposes, and the company wants to o oad some of those reads to Read Replica, allowing the primary database to continue performing efficiently. Which AWS database platforms will accomplish this? (Select TWO.)
Option A: Amazon RDS for Oracle
Option B: Amazon RDS for PostgreSQL
Option C: Amazon RDS for MariaDB
Option D: Amazon DynamoDB,
Option E: Amazon RDS for Microsoft SQL Server

Question 236: An application launched on Amazon EC2 instances needs to publish personally identi able information (PII) about customers using Amazon SNS. The application is launched in private subnets within an Amazon VPC. Which is the MOST secure way to allow the application to access service endpoints in the same region?
Option A: Use an internet gateway.
Option B: Use AWS PrivateLink.
Option C: Use a NAT gateway.
Option D: Use a proxy instance.

Question 237: A data-processing application runs on an i3.large EC2 instance with a single 100 GB EBS gp2 volume. The application stores temporary data in a small database (less than 30 GB) located on the EBS root volume. The application is struggling to process the data fast enough, and a Solutions Architect has determined that the I/O speed of the temporary database is the bottleneck. What is the MOST cost-efficient cient way to improve the database response times?
Option A: Enable EBS optimization on the instance and keep the temporary files on the existing volume.
Option B: Put the temporary database on a new 50-GB EBS gp2 volume.
Option C: Move the temporary database onto instance storage.
Option D: Put the temporary database on a new 50-GB EBS io1 volume with a 3-K IOPS provision.

Question 238: An application stores data in an Amazon RDS PostgreSQL Multi-AZ database instance. The ratio of read requests to write requests is about 2 to 1. Recent increases in traffic are causing very high latency. How can this problem be corrected?
Option A: Create a similar RDS PostgreSQL instance and direct all traffic to it.
Option B: Use the secondary instance of the Multiple Availability Zone for read traffic only.
Option C: Create a read replica and send half of all traffic to it.
Option D: Create a read replica and send all read traffic to it.

Question 239: A Solutions Architect is designing a system that will store Personally Identi able Information (PII) in an Amazon S3 bucket. Due to compliance and regulatory requirements, both the master keys and unencrypted data should never be sent to AWS. What Amazon S3 encryption technique should the Architect choose?
Option A: Amazon S3 client-side encryption with an AWS KMS-managed customer master key (CMK)
Option B: Amazon S3 server-side encryption with an AWS KMS-managed key
Option C: Amazon S3 client-side encryption with a client-side master key
Option D: Amazon S3 server-side encryption with a customer-provided key

Question 240: A Security team reviewed their company's VPC Flow Logs and found that traffic is being directed to the internet. The application in the VPC uses Amazon EC2 instances for compute and Amazon S3 for storage. The company's goal is to eliminate internet access and allow the application to continue to function. What change should be made in the VPC before updating the route table?
Option A: Create a NAT gateway for Amazon S3 access
Option B: Create a VPC endpoint for Amazon S3 access
Option C: Create a VPC endpoint for Amazon EC2 access
Option D: Create a NAT gateway for Amazon EC2 access

Question 241: A company is deploying a reporting application on Amazon EC2. The application is expected to generate 1,000 documents every hour and each document will be 800 MB. The company is concerned about strong data consistency and le locking, as various applications hosted on other EC2 instances will process the report documents in parallel when they become available. What storage solution will meet these requirements with the LEAST amount of administrative overhead?
Option A: Amazon EFS
Option B: Amazon S3
Option C: Amazon ElastiCache
Option D: Amazon EBS

Question 242: A Solutions Architect is building a WordPress-based web application hosted on AWS using Amazon EC2. This application serves as a blog for an international internet security company. The application must be geographically redundant and scalable. It must separate the public Amazon EC2 web servers from the private Amazon RDS database, it must be highly available, and it must support dynamic port routing. Which combination of AWS services or capabilities will meet these requirements?
Option A: AWS Auto Scaling with a Classic Load Balancer, and AWS CloudTrail
Option B: Amazon Route 53, Auto Scaling with an Application Load Balancer, and Amazon CloudFront
Option C: A VPC, a NAT gateway and Auto Scaling with a Network Load Balancer
Option D: CloudFront, Route 53, and Auto Scaling with a Classic Load Balancer

Question 243: An e-commerce application places orders in an Amazon SQS queue. When a message is received, Amazon EC2 worker instances process the request. The EC2 instances are in an Auto Scaling group. How should the architecture be designed to scale up and down with the LEAST amount of operational overhead?
Option A: Use an Amazon CloudWatch alarm on the EC2 CPU to scale the Auto Scaling group up and down.
Option B: Use an EC2 Auto Scaling health check for messages processed on the EC2 instances to scale up and down.
Option C: Use an Amazon CloudWatch alarm based on the number of visible messages to scale the Auto Scaling group up or down.
Option D: Use an Amazon CloudWatch alarm based on the CPU to scale the Auto Scaling group up or down.

Question 244: A customer is migrating to AWS and requires applications to access Network File System shares without code changes. Data is critical and accessed frequently. Which storage solution should a Solutions Architect recommend to maximize availability and durability?
Option A: Amazon EBS
Option B: Amazon S3
Option C: AWS Storage Gateway for files
Option D: Amazon EFS

Question 245: A company has many applications on Amazon EC2 instances running in Auto Scaling groups. Company policies require that data on the attached Amazon EBS volume must be retained. Which actions will meet this requirement without impacting performance?
Option A: Enable Termination Protection on the Amazon EC2 instances.
Option B: Disable DeleteOnTermination for the Amazon EBS volumes.
Option C: Use Amazon EC2 user data to set up a synchronization job for root volume data.
Option D: Change the auto scaling Health Check to point to a source on the root volume.

Question 246: A company wants to expand its web services from us-east-1 into ap-southeast-1. The company stores a large amount of static content on its website, and recently received complaints about slow loading speeds and the website timing out. What should be done to meet the expansion goal while also addressing the latency and timeout issues?
Option A: Store the static content in Amazon S3 and enable S3 Transfer Acceleration.
Option B: Store the static content in an Amazon EBS volume in the ap-southeast-1 region and provision larger Amazon EC2 instances for the website.
Option C: Use an Amazon Route 53 simple routing policy to distribute cached content across three regions.
Option D: Use Amazon S3 to store the static content and Configure an Amazon CloudFront distribution.

Question 247: An application is scanning an Amazon DynamoDB table that was created with default settings. The application occasionally reads stale data when it queries the table. How can this issue be corrected? 7
Option A: Increase the provisioned read capacity of the table.
Option B: Enable AutoScaling on the DynamoDB table.
Option C: Update the application to use strongly consistent reads.
Option D: Re-create the DynamoDB table with eventual consistency disabled.

Question 248: A company is setting up a new website for online sales. The company will have a web tier and a database tier. The web tier consists of loadbalanced, auto-scaled Amazon EC2 instances in multiple Availability Zones (AZs). The database tier is an Amazon RDS Multi-AZ deployment. The EC2 instances must connect securely to the database. How should the resources be launched?
Option A: EC2 instances: public subnet RDS database instances: public subnet Load balancer: public subnet
Option B: EC2 instances: public subnet RDS database instances: private subnet Load balancer: private subnet
Option C: EC2 instances: private subnet RDS database instances: public subnet Load balancer: public subnet
Option D: EC2 instances: private subnet RDS database instances: private subnet Load balancer: public subnet

Question 249: A customer set up an Amazon VPC with one private subnet and one public subnet with a NAT gateway. The VPC will contain a group of Amazon EC2 instances. All instances will Configure themselves at startup by downloading a bootstrap script from an Amazon S3 bucket with a policy that only allows access from the customer's Amazon EC2 instances and then deploys an application through GIT. A Solutions Architect has been asked to design a solution that provides the highest level of security regarding network connectivity to the Amazon EC2 instances. How should the Architect design the infrastructure?
Option A: Place the Amazon EC2 instances in the public subnet, with no EIPs; route outgoing traffic through the internet gateway.
Option B: Place the Amazon EC2 instances in a public subnet, and assign EIPs; route outgoing traffic through the NAT gateway.
Option C: Place the Amazon EC2 instances in a private subnet, and assign EIPs; route outgoing traffic through the internet gateway.
Option D: Place the Amazon EC2 instances in a private subnet, with no EIPs; route outgoing traffic through the NAT gateway

Question 250: A company processed 10 TB of raw data to generate quarterly reports. Although it is unlikely to be used again, the raw data needs to be preserved for compliance and auditing purposes. What is the MOST cost-effective way to store the data in AWS?
Option A: Amazon EBS Cold HDD (sc1)
Option B: Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)
Option C: Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
Option D: Amazon Glacier

Question 251: A Solutions Architect needs to design a solution that will allow Website Developers to deploy static web content without managing server infrastructure. All web content must be accessed over HTTPS with a custom domain name. The solution should be scalable as the company continues to grow. Which of the following will provide the MOST cost-effective solution?
Option A: Amazon EC2 instance with Amazon EBS
Option B: AWS Lambda function with Amazon API Gateway
Option C: Amazon CloudFront with an Amazon S3 bucket origin
Option D: Amazon S3 with a static website

Question 252: A company is running a series of national TV campaigns. These 30-second advertisements will introduce sudden traffic peaks targeted at a Node.js application. The company expects traffic to increase from ve requests each minute to more than 5,000 requests each minute. Which AWS service should a Solutions Architect use to ensure traffic surges can be handled?
Option A: AWS Lambda
Option B: Amazon ElastiCache
Option C: Size EC2 instances to handle peak load
Option D: An Auto Scaling group for EC2 instances

Question 253: An insurance company stores all documents related to annual policies for the duration of the policies.The documents are created once and then stored until they are required, typically at the end of the policy.A document must be capable of being retrieved immediately.The company is now moving their document management to the AWS Cloud.Which service should a Solutions Architect recommend as a cost - effective solution that meets the company 's requirements?
Option A: Amazon RDS MySQL
Option B: Amazon S3 Standard-Infrequent Access
Option C: Amazon Glacier
Option D: Amazon S3 Standard

Question 254: How can a user track memory usage in an EC2 instance ?
Option A: Call Amazon CloudWatch to retrieve the memory usage metric data that exists for the EC2 instance.
Option B: Assign an IAM role to the EC2 instance with an IAM policy granting access to the desired metric.
Option C: Use an instance type that supports memory usage reporting to a metric by default.
Option D: Place an agent on the EC2 instance to push memory usage to an Amazon CloudWatch custom metric.

Question 255: A Solutions Architect must design a storage solution for incoming billing reports in CSV format. The data does not need to be scanned frequently and is discarded after 30 days. Which service will be MOST cost-effective in meeting these requirements?
Option A: Import the logs into an RDS MySQL instance.
Option B: Use AWS Data Pipeline to import the logs into a DynamoDB table.
Option C: Write the files to an S3 bucket and use Amazon Athena to query the data.
Option D: Import the logs to an Amazon Redshift cluster

Question 256: A Solutions Architect needs to deploy an HTTP/HTTPS service on Amazon EC2 instances with support for WebSockets using load balancers. How can the Architect meet these requirements?
Option A: Configure a Network Load Balancer.
Option B: Configure an Application Load Balancer.
Option C: Configure a Classic Load Balancer.
Option D: Configure a Layer-4 Load Balancer.

Question 257: A Solution Architect is designing a web application that runs on Amazon EC2 instances behind a load balancer. All data in transit must be encrypted. Which solutions will meet the encryption requirement? (Select TWO.) 7
Option A: Use an Application Load Balancer (ALB) in passthrough mode, then terminate SSL on EC2 instances.
Option B: Use an Application Load Balancer (ALB) with a TCP listener, then terminate SSL on EC2 instances.
Option C: Use a Network Load Balancer (NLB) with a TCP listener, then terminate SSL on EC2 instances.
Option D: Use an Application Load Balancer (ALB) with an HTTPS listener, then install SSL certificates on the ALB and EC2 instances.,
Option E: Use a Network Load Balancer (NLB) with an HTTPS listener, then install SSL certificates on the NLB and EC2 instances.

Question 258: A user is designing a new service that receives location updates from 3,600 rental cars every hour. The cars upload their location to an Amazon S3 bucket. Each location must be checked for distance from the original rental location. Which services will process the updates and automatically scale?
Option A: Amazon EC2 and Amazon EBS
Option B: Amazon Kinesis Firehouse and Amazon S3
Option C: Amazon ECS and Amazon RDS
Option D: Amazon S3 events and AWS Lambda

Question 259: A company is writing a new service running on Amazon EC2 that must create thumbnail images of thousands of images in a large archive. The system will write scratch data to storage during the process. Which storage service is best suited for this scenario?
Option A: EC2 instance store
Option B: Amazon EFS
Option C: Amazon CloudSearch
Option D: Amazon EBS Throughput Optimized HDD (st1)

Question 260: A company's Amazon RDS MySQL DB instance may be rebooted for maintenance and to apply patches. This database is critical and potential user disruption must be minimized. What should the Solution Architect do in this scenario?
Option A: Set up an RDS MySQL cluster
Option B: Create an RDS MySQL Read Replica.
Option C: Set RDS MySQL to Multi-AZ.
Option D: Create an Amazon EC2 instance MySQL cluster.

Question 261: A retail company operates an e-commerce environment that runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group. Images are hosted in an Amazon S3 bucket using a custom domain name. During a ash sale with 10,000 simultaneous users, some images on the website are not loading. What should be done to resolve the performance issue?
Option A: Move the images to the EC2 instances in the Auto Scaling group.
Option B: Enable Transfer Acceleration for the S3 bucket.
Option C: Configure an Amazon CloudFront distribution with the S3 bucket as the origin.
Option D: Increase the number of minimum, desired, and maximum EC2 instances in the Auto Scaling group.

Question 262: A solutions Architect is designing a new workload where an AWS Lambda function will access an Amazon DynamoDB table. What is the MOST secure means of granting the Lambda function access to the DynamoDB table?
Option A: Create an identity and access management (IAM) role with the necessary permissions to access the DynamoDB table, and assign the role to the Lambda function.
Option B: Create a DynamoDB user name and password and give them to the Developer to use in the Lambda function.
Option C: Create an identity and access management (IAM) user, and create access and secret keys for the user. Give the user the necessary permissions to access the DynamoDB table. Have the Developer use these keys to access the resources.
Option D: Create an identity and access management (IAM) role allowing access from AWS Lambda and assign the role to the DynamoDB table.

Question 263: A web application runs on Amazon EC2 instances behind an ELB Application Load Balancer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. Every night, the Auto Scaling group doubles in size. traffic analysis shows that users in a particular region are requesting the same static content stored locally on the EC2 instances. How can a Solutions Architect reduces the need to scale and improve application performance for the users?
Option A: Re-deploy the application in a new VPC that is closer to the users making the requests.
Option B: Create an Amazon CloudFront distribution for the site and redirect user traffic to the distribution.
Option C: Store the contents on Amazon EFS instead of the EC2 root volume.
Option D: Implement Amazon Redshift to create a repository of the content closer to the users.

Question 264: A Solutions Architect is designing an application that will run on Amazon ECS behind an Application Load Balancer (ALB). For security reasons, 8 the Amazon EC2 host instances for the ECS cluster are in a private subnet. What should be done to ensure that the incoming traffic to the host instances is from the ALB only?
Option A: Create network ACL rules for the private subnet to allow incoming traffic on ports 32768 through 61000 from the IP address of the ALB only.
Option B: Update the EC2 cluster security group to allow incoming access from the IP address of the ALB only.
Option C: Modify the security group used by the EC2 cluster to allow incoming traffic from the security group used by the ALB only.
Option D: Enable AWS WAF on the ALB and enable the ECS rule.

Question 265: A company wants to improve latency by hosting images within a public Amazon S3 bucket fronted by an Amazon CloudFront distribution. The company wants to restrict access to the S3 bucket to include the CloudFront distribution only, while also allowing CloudFront to continue proper functionality. What should be done after making the bucket private to restrict access with the LEAST operational overhead?
Option A: Create a CloudFront origin access identity and create a security group that allows access from CloudFront.
Option B: Create a CloudFront origin access identity and update the bucket policy to grant access to it.
Option C: Create a bucket policy restricting all access to the bucket to include CloudFront IPs only.
Option D: Enable the CloudFront option to restrict viewer access and update the bucket policy to allow the distribution.

Question 266: A Solutions Architect is designing a new architecture that will use an Amazon EC2 Auto Scaling group. Which of the following factors determine the health check grace period? (Select TWO.)
Option A: How frequently the Auto Scaling group scales up or down.
Option B: How many Amazon CloudWatch alarms are Configured for status checks.
Option C: How much of the application code is embedded in the AMI.
Option D: How long it takes for the Auto Scaling group to detect a failure.,
Option E: How long the bootstrap script takes to run.

Question 267: A company plans to deploy a new application in AWS that reads and writes information to a database. The company wants to deploy the application in two different AWS Regions in an active-active configuration. The databases need to replicate to keep information in sync. What should be used to meet these requirements?
Option A: Amazon Athena with Amazon S3 cross-region replication
Option B: AWS Database Migration Service with change data capture
Option C: Amazon DynamoDB with global tables
Option D: Amazon RDS for PostgreSQL with a cross-region Read Replica

Question 268: A company is developing a data lake solution in Amazon S3 to analyze large-scale datasets. The solution makes infrequent SQL queries only. In addition, the company wants to minimize infrastructure costs. Which AWS service should be used to meet these requirements?
Option A: Amazon Athena
Option B: Amazon Redshift Spectrum
Option C: Amazon RDS for PostgreSQL
Option D: Amazon Aurora

Question 269: A company needs to store data for 5 years. The company will need to have immediate and highly available access to the data at any point in time, but will not require frequent access. What lifecycle action should be taked to meet the requirements while reducing costs?
Option A: Transition objects from Amazon S3 Standard to Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
Option B: Transition objects to expire after 5 years.
Option C: Transition objects from Amazon S3 Standard to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)
Option D: Transition objects from Amazon S3 Standard to the GLACIER storage class.

Question 270: A company wants to create an application that will transmit protected health information (PHI) to thousands of service consumers in different AWS accounts. The application servers will sit in private VPC subnets. The routing for the application must be fault tolerant. What should be done to meet these requirements?
Option A: Create a VPC endpoint service and grant permissions to speci c service consumers to create a connection.
Option B: Create a virtual private gateway connection between each pair of service provider VPCs and service consumer VPCs.
Option C: Create an internal Application Load Balancer in the service provider VPC and put application servers behind it.
Option D: Create a proxy server in the service provider VPC to route requests from service consumers to the application servers.

Question 271: A company hosts a website using Amazon API Gateway on the front end. Recently, there has been heavy traffic on the website and the company 8 wants to control access by allowing authenticated traffic only. How should the company limit access to authenticated users only? (Select TWO.)
Option A: Allow users that are authenticated through Amazon Cognito.
Option B: Limit traffic through API Gateway.
Option C: Allow X.509 certificates to authenticate traffic.
Option D: Deploy AWS KMS to identify users.,
Option E: Assign permissions in AWS IAM to allow users.

Question 272: A company needs to use AWS resources to expand capacity for a website hosted in an on-premises data center. The AWS resources will include load balancers, Auto Scaling, and Amazon EC2 instances that will access an on-premises database. Network connectivity has been established, but no traffic is going to the AWS environment. How should Amazon Route 53 be Configured to distribute load to the AWS environment? (Select TWO.)
Option A: Set up a weighted routing policy, distributing the workload between the load balancer and the on-premises environment.
Option B: Set up an A record to point the DNS name to the IP address of the load balancer.
Option C: Create multiple A records for the EC2 instances.
Option D: Set up a geolocation routing policy to distribute the workload between the load balancer and the on-premises environment.,
Option E: Set up a routing policy for failover using the on-premises environment as primary and the load balancer as secondary.

Question 273: Users submit requests to a service that takes several minutes to process. A Solutions Architect needs to ensure that these requests are processed at least once, and that the service has the ability to handle large increases in the number of requests. How should these requirements be met?
Option A: Put the requests into an Amazon SQS queue and Configure Amazon EC2 instances to poll the queue
Option B: Publish the message to an Amazon SNS topic that an Amazon EC2 subscriber can receive and process
Option C: Save the requests to an Amazon DynamoDB table with a DynamoDB stream that triggers an Amazon EC2 Spot Instance
Option D: Use Amazon S3 to store the requests and Configure an event noti cation to have Amazon EC2 instances process the new object

Question 274: A Solutions Architect is designing an Amazon VPC that requires access to a remote API server using IPv6. Resources within the VPC should not be accessed directly from the Internet. How should this be achieved?
Option A: Use a NAT gateway and deny public access using security groups
Option B: Attach an egress-only internet gateway and update the routing tables
Option C: Use a NAT gateway and update the routing tables 8
Option D: Attach an internet gateway and deny public access using security groups

Question 275: When designing an Amazon SQS message-processing solution, messages in the queue must be processed before the maximum retention time has elapsed. Which actions will meet this requirement? (Choose two.)
Option A: Use AWS STS to process the messages
Option B: Use Amazon EBS-optimized Amazon EC2 instances to process the messages
Option C: Use Amazon EC2 instances in an Auto Scaling group with scaling triggered based on the queue length
Option D: Increase the SQS queue attribute for the message retention period,
Option E: Convert the SQS queue to a rest-in rest-out (FIFO) queue

Question 276: A company deployed a three-tier web application on Amazon EBS backed Amazon EC2 instances for the web and application tiers, and Amazon RDS for the database tier. The company is concerned about loss of data in the web and application tiers. What is the MOST efficient way to prevent data loss?
Option A: Create an Amazon EFS le system and run a shell script to copy the data
Option B: Create an Amazon EBS snapshot using an Amazon CloudWatch Events rule
Option C: Create an Amazon S3 snapshot policy to back up the Amazon EBS volumes
Option D: Create a snapshot lifecycle policy that takes periodic snapshots of the Amazon EBS volumes

Question 277: A company is using Amazon S3 for backups from an on-premises environment. Regulatory requirements state that data must be retained for at least 7 years. The data is infrequently accessed for 35 days, but needs to be instantly available. After 35 days, the data is rarely accessed. Which combination of actions will provide the MOST cost-effective solution? (Choose two)
Option A: Change the backup so the data goes to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) directly
Option B: Create an S3 lifecycle policy that moves the data to the GLACIER storage class after 7 years
Option C: Change the backup so the data goes to Amazon Glacier directly
Option D: Create an S3 lifecycle policy that moves the data to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 35 days,
Option E: Creates an S3 lifecycle policy that moves the data to the GLACIER storage class after 35 days

Question 278: A Solutions Architect is building an online shopping application where users will be able to browse items, add items to a cart, and purchase the items. Images of items will be stored in Amazon S3 buckets organized by item category. When an item is no longer available for purchase, the item image will be deleted from the S3 bucket. Occasionally, during testing, item images deleted from the S3 bucket are still visible to some users. What is a aw in this design approach?
Option A: De ning S3 buckets by item may cause partition distribution errors, which will impact performance.
Option B: Amazon S3 DELETE requests are eventually consistent, which may cause other users to view items that have already been purchased
Option C: Amazon S3 DELETE requests apply a lock to the S3 bucket during the operation, causing other users to be blocked
Option D: Using Amazon S3 for persistence exposes the application to a single point of failure

Question 279: A Solution Architect is creating a serverless web application that must access mapping data in hundreds of data files, each containing approximately 30 KB of data. The storage required is expected to grow to hundreds of terabytes. Which storage solution is most cost-effective, yet still meets the requirements for this use case?
Option A: Amazon EFS
Option B: Amazon EBS Cold HDD (sc1)
Option C: Amazon S3 Standard
Option D: Amazon DynamoDB

Question 280: An application running on AWS Lambda requires an API key to access a third-party service. The key must be stored securely with audited access to the Lambda function only. What is the MOST secure way to store the key?
Option A: As an object in Amazon S3
Option B: As a secure string in AWS Systems Manager Parameter Store
Option C: Inside a le on an Amazon EBS volume attached to the Lambda function
Option D: Inside a secrets le stored on Amazon EFS

Question 281: An application produces monthly reports that must be immediately accessible for up to 7 days. After 7 days, the data can be archived. Compliance policies require that the archived data be retrievable within 24 hours of a request. What is the MOST cost-effective approach to satisfy the compliance requirement?
Option A: Store the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days, then transition to the GLACIER storage class after 30 days
Option B: Store the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days
Option C: Store the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to the GLACIER storage class after 30 days
Option D: Store the data in Amazon S3 Standard storage with a lifecycle rule to transition the data to the GLACIER storage class after 7 days

Question 282: A company is developing a new stateless web service with low memory requirements. The service needs to scale based on demand. What is the MOST cost-effective solution?
Option A: Deploy the application onto AWS Elastic Beanstalk
Option B: Deploy the application onto AWS Lambda with access through Amazon API Gateway
Option C: Deploy the application onto an Amazon EC2 Spot Fleet
Option D: Deploy the application onto a container with an Amazon ECS EC2 launch type

Question 283: A company has an application that generates invoices and makes the invoices available online. Invoices are stored as PDFs in an Amazon S3 bucket. Customers typically only view each invoice during the month it is issued. However, past invoices need to be immediately available. There are concerns over rising storage costs as the company gains more customers. What is the MOST cost-effective method to store the data?
Option A: Use Amazon S3 for current invoices. Set up lifecycle rules to migrate invoices to the GLACIER storage class after 30 days.
Option B: Store the invoices as text files. Use Amazon CloudFront to convert the invoices from text to PDF when customers download invoices.
Option C: Store the invoices as binaries in an Amazon RDS database instance. Retrieve them from the database when customers request invoices.
Option D: Use Amazon S3 for current invoices. Set up lifecycle rules to migrate invoices to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

Question 284: A company is running its application in a single region on Amazon EC2 with Amazon EBS and Amazon S3 part of the storage design. What should be done to reduce data transfer costs?
Option A: Create a copy of the compute environment in another region
Option B: Convert the application to run on Lambda@Edge
Option C: Create an Amazon CloudFront distribution with Amazon S3 as the origin
Option D: Replicate Amazon S3 data to buckets in regions closer to the requester 86/29/2020 p g q

Question 285: An application server needs to be in a private subnet without access to the Internet. The solution must retrieve and upload files to an Amazon S3 bucket. How should a Solutions Architect design a solution to meet these requirements?
Option A: Use Amazon S3 VPC endpoints
Option B: Deploy a proxy server
Option C: Use a NAT Gateway
Option D: Use a private Amazon S3 bucket

Question 286: A Solutions Architect must design a web application that will be hosted on AWS, allowing users to purchase access to premium, shared content that is stored in an S3 bucket. Upon payment, content will be available for download for 14 days before the user is denied access. Which of the following would be the LEAST complicated implementation?
Option A: Use an Amazon CloudFront distribution with an origin access identity (OAI). Configure the distribution with an Amazon S3 origin to provide access to the le through signed URLs. Design a Lambda function to remove data that is older than 14 days.
Option B: Use an S3 bucket and provide direct access to the le. Design the application to track purchases in a DynamoDB table. Configure a Lambda function to remove data that is older than 14 days based on a query to Amazon DynamoDB.
Option C: Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the le through signed URLs. Design the application to set an expiration of 14 days for the URI.
Option D: Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the le through signed URLs. Design the application to set an expiration of 60 minutes for the URL, and recreate the URL as necessary.

Question 287: A Solutions Architect plans to migrate a load balancer tier from a data center to AWS. Several websites have multiple domains that require secure load balancing. The Architect decides to use Elastic Load Balancing Application Load Balancers. What is the MOST efficient method for achieving secure communication?
Option A: Create a wildcard certificate and upload it to the Application Load Balancer
Option B: Create an SNI certificate and upload it to the Application Load Balancer
Option C: Create a secondary proxy server to terminate SSL traffic before the traffic reaches the Application Load Balancer
Option D: Let a third-party certificate Manager manage certificates required to all domains and upload them to the Application Load Balancer 8

Question 288: An application stores data in an Amazon RDS MySQL DB instance. The database traffic primarily consists of read queries, which are overwhelming the current database. A Solutions Architect wants to scale the database. What combination of steps will achieve the goal? (Choose two.)
Option A: Add the MySQL database instances to an Auto Scaling group
Option B: Migrate the MySQL database to Amazon Aurora
Option C: Migrate the MySQL database to a PostgreSQL database
Option D: Create read replicas in different Availability Zones,
Option E: Create an ELB Application Load Balancer

Question 289: A Solutions Architect is designing an elastic application that will have between 10 and 50 Amazon EC2 concurrent instances running, dependent on load. Each instance must mount storage that will read and write to the same 50 GB folder. Which storage type meets the requirements?
Option A: Amazon S3
Option B: Amazon EFS
Option C: Amazon EBS volumes
Option D: Amazon EC2 instance store

Question 290: A Solutions Architect is designing an application that is expected to have millions of users. The Architect needs options to store session data. Which option is the MOST performant?
Option A: Amazon ElastiCache
Option B: Amazon RDS
Option C: Amazon S3
Option D: Amazon EFS

Question 291: A company is launching a dynamic website, and the Operations team expects up to 10 times the traffic on the launch date. This website is hosted on Amazon EC2 instances and traffic is distributed by Amazon Route 53. A Solutions Architect must ensure that there is enough backend capacity to meet user demands. The Operations team wants to scale down as quickly as possible after the launch. What is the MOST cost-effective and fault-tolerant solution that will meet the company's customer demands? (Choose two.)
Option A: Set up an Application Load Balancer to distribute traffic to multiple EC2 instances
Option B: Set up an Auto Scaling group across multiple Availability Zones for the website, and create scale-out and scale-in policies
Option C: Create an Amazon CloudWatch alarm to send an email through Amazon SNS when EC2 instances experience higher loads
Option D: Create an AWS Lambda function to monitor website load time, run it every 5 minutes, and use the AWS SDK to create a new instance if website load time is longer than 2 seconds,
Option E: Use Amazon CloudFront to cache the website content during launch and set a TTL for cache content to expire after the launch date

Question 292: A customer has an application that is used by enterprise customers outside of AWS. Some of these customers use legacy rewalls that cannot whitelist by DNS name, but whitelist based only on IP address. The application is currently deployed in two Availability Zones, with one EC2 instance in each that has Elastic IP addresses. The customer wants to whitelist only two IP addresses, but the two existing EC2 instances cannot sustain the amount of traffic. What can a Solutions Architect do to support the customer and allow for more capacity? (Choose two.)
Option A: Create a Network Load Balancer with an interface in each subnet, and assign a static IP address to each subnet.
Option B: Create additional EC2 instances and put them on standby. Remap an Elastic IP address to a standby instance in the event of a failure.
Option C: Use Amazon Route 53 with a weighted, round-robin routing policy across the Elastic IP addresses to resolve one at a time.
Option D: Add additional EC2 instances with Elastic IP addresses, and register them with Amazon Route 53,
Option E: Switch the two existing EC2 instances for an Auto Scaling group, and register them with the Network Load Balancer.

Question 293: A company is storing application data in Amazon S3 buckets across multiple AWS regions. Company policy requires that encryption keys be generated at the company headquarters, but the encryption keys may be stored in AWS after generation. The Solutions Architect plans to Configure cross-region replication. Which solution will encrypt the data whole requiring the LEAST amount of operational overhead?
Option A: Configure the applications to write to an S3 bucket using client-side encryption
Option B: Configure S3 buckets to encrypt using AES-256
Option C: Configure S3 object encryption using AWS CLI with Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)
Option D: Configure S3 buckets to use Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) with imported key material in both regions

Question 294: A Solutions Architect must design a solution that encrypts data in Amazon S3. Corporate policy mandates encryption keys be generated and managed on premises. Which solution should the Architect use to meet the security requirements?
Option A: AWS CloudHSM
Option B: SSE-KMS: Server-side encryption with AWS KMS managed keys
Option C: SSE-S3: Server-side encryption with Amazon-managed master key
Option D: SSE-C: Server-side encryption with customer-provided encryption keys

Question 295: A Solutions Architect is considering possible options for improving the security of the data on an Amazon EBS volume attached to an Amazon EC2 instance. Which solution will improve the security of the data?
Option A: Use AWS KMS to encrypt the EBS volume
Option B: Create an IAM policy that restricts read and write access to the volume
Option C: Migrate the sensitive data to an instance store volume
Option D: Use Amazon single sign-on to control login access to the EC2 instance

Question 296: A Solutions Architect designed a system based on Amazon Kinesis Data Streams. After the work ow was put into production, the company noticed it performed slowly and identified Kinesis Data Streams as the problem. One of the streams has a total of 10 Mb/s throughput. What should the Solutions Architect recommend to improve performance?
Option A: Use AWS Lambda to preprocess the data and transform the records into a simpler format, such as CSV.
Option B: Run the MergeShard command to reduce the number of shards that the consumer can more easily process.
Option C: Change the work ow to use Amazon Kinesis Data Firehose to gain a higher throughput.
Option D: Run the UpdateShardCount command to increase the number of shards in the stream

Question 297: A Solutions Architect is designing an application that requires having six Amazon EC2 instances running at all times. The application will be deployed in the sa- east-1 region, which has three Availability Zones: sa-east-1a, sa-east-1b, and sa-east-1c. Which action will provide 100 percent fault tolerance and the LOWEST cost in the event that one Availability Zone in the region becomes unavailable?
Option A: Deploy six Amazon EC2 instances in sa-east-1a, six Amazon EC2 instances in sa-east-1b, and six Amazon EC2 instances in sa-east-1c
Option B: Deploy six Amazon EC2 instances in sa-east-1a, four Amazon EC2 instances in sa-east-1b, and two Amazon EC2 instances in sa-east-1c
Option C: Deploy three Amazon EC2 instances in sa-east-1a, three Amazon EC2 instances in sa-east-1b, and three Amazon EC2 instances in sa-east1c
Option D: Deploy two Amazon EC2 instances in sa-east-1a, two Amazon EC2 instances in sa-east-1b, and two Amazon EC2 instances in sa-east-1c

Question 298: A Solutions Architect is designing a three-tier web application that will allow customers to upload pictures from a mobile application. The application will then generate a thumbnail of the picture and return a message to the user con rming that the image was successfully uploaded. Generation of the thumbnail may take up to 5 seconds. To provide a sub second response time to the customers uploading the images, the Solutions Architect wants to separate the web tier from the application tier. Which service would allow the presentation tier to asynchronously dispatch the request to the application tier?
Option A: AWS Step Functions
Option B: AWS Lambda
Option C: Amazon SNS
Option D: Amazon SQS

Question 299: A Solutions Architect is designing an application in AWS. The Architect must not expose the application or database tier over the Internet for security reasons. The application must be low-cost and have a scalable front end. The databases and application tier must have only one-way Internet access to download software and patch updates. Which solution helps to meet these requirements?
Option A: Use a NAT Gateway as the front end for the application tier and to enable the private resources to have Internet access.
Option B: Use an Amazon EC2-based proxy server as the front end for the application tier, and a NAT Gateway to allow Internet access for private resources.
Option C: Use an ELB Classic Load Balancer as the front end for the application tier, and an Amazon EC2 proxy server to allow Internet access for private resources.
Option D: Use an ELB Classic Load Balancer as the front end for the application tier, and a NAT Gateway to allow Internet access for private resources.

Question 300: A Solutions Architect is designing a multi-tier application consisting of an Application Load Balancer, an Amazon RDS database instance, and an Auto Scaling group on Amazon EC2 instances. Each tier is in a separate subnet. There are some EC2 instances in the subnet that belong to another application. The RDS database instance should accept traffic only from the EC2 instances in the Auto Scaling group. What should be done to meet these requirements?
Option A: Configure the inbound network ACLs on the database subnet to accept traffic from the IP addresses of the EC2 instances only.
Option B: Configure the inbound rules on the security group associated with the RDS database instance. Set the source to the security group associated with instances in the Auto Scaling group.
Option C: Configure the outbound rules on the security group associated with the Auto Scaling group. Set the destination to the security group associated with the RDS database instance. 9
Option D: Configure the inbound network ACLs on the database subnet to accept traffic only from the CIDR range of the subnet used by the Auto Scaling group.

Question 301: An organization uses Amazon S3 to store video content served via its website. It only has rights to deliver this content to users within its own country and needs to restrict access. How can the organization ensure that these files are only accessible from within its country?
Option A: Use a custom Amazon S3 bucket policy to allow access only to users inside the organization's country
Option B: Use Amazon CloudFront and Geo Restriction to allow access only to users inside the organization's country
Option C: Use an Amazon S3 bucket ACL to allow access only to users inside the organization's country
Option D: Use le-based ACL permissions on each video le to allow access only to users inside the organization's country

Question 302: A company is storing data in an Amazon DynamoDB table and needs to take daily backups and retain them for 6 months. How should the Solutions Architect meet these requirements without impacting the production workload?
Option A: Use DynamoDB replication and restore the table from the replica
Option B: Use AWS Data Pipeline and create a scheduled job to back up the DynamoDB table daily
Option C: Use Amazon CloudWatch Events to trigger an AWS Lambda function that makes an on-demand backup of the table
Option D: Use AWS Batch to create a scheduled backup with the default template, then back up to Amazon S3 daily.

Question 303: A client reports that they want see an audit log of any changes made to AWS resources in their account. What can the client do to achieve this?
Option A: Set up Amazon CloudWatch monitors on services they own
Option B: Enable AWS CloudTrail logs to be delivered to an Amazon S3 bucket
Option C: Use Amazon CloudWatch Events to parse logs
Option D: Use AWS OpsWorks to manage their resources

Question 304: An application running in a private subnet accesses an Amazon DynamoDB table. There is a security requirement that the data never leave the AWS network. How should this requirement be met?
Option A: Configure a network ACL on DynamoDB to limit traffic to the private subnet
Option B: Enable DynamoDB encryption at rest using an AWS KMS key
Option C: Add a NAT gateway and Configure the route table on the private subnet
Option D: Create a VPC endpoint for DynamoDB and Configure the endpoint policy

Question 305: A three-tier application is being created to host small news articles. The application is expected to serve millions of users. When breaking news occurs, the site must handle very large spikes in traffic without significantly impacting database performance. Which design meets these requirements while minimizing costs?
Option A: Use Auto Scaling groups to increase the number of Amazon EC2 instances delivering the web application
Option B: Use Auto Scaling groups to increase the size of the Amazon RDS instances delivering the database
Option C: Use Amazon DynamoDB strongly consistent reads to adjust for the increase in traffic
Option D: Use Amazon DynamoDB Accelerator (DAX) to cache read operations to the database

Question 306: During a review of business applications, a Solutions Architect identi es a critical application with a relational database that was built by a business user and is running on the user's desktop. To reduce the risk of a business interruption, the Solutions Architect wants to migrate the application to a highly available, multi- tiered solution in AWS. What should the Solutions Architect do to accomplish this with the LEAST amount of disruption to the business?
Option A: Create an import package of the application code for upload to AWS Lambda, and include a function to create another Lambda function to migrate data into an Amazon RDS database
Option B: Create an image of the user's desktop, migrate it to Amazon EC2 using VM Import, and place the EC2 instance in an Auto Scaling group
Option C: Pre-stage new Amazon EC2 instances running the application code on AWS behind an Application Load Balancer and an Amazon RDS MultiAZ DB instance
Option D: Use AWS DMS to migrate the backend database to an Amazon RDS Multi-AZ DB instance. Migrate the application code to AWS Elastic Beanstalk

Question 307: A company has thousands of files stored in an Amazon S3 bucket that has a well-de ned access pattern. The files are accessed by an application multiple times a day for the rest 30 days. Files are rarely accessed within the next 90 days. After that, the files are never accessed again. During the rest 120 days accessing these files should never take more than a few seconds 9 the rest 120 days, accessing these files should never take more than a few seconds. Which lifecycle policy should be used for the S3 objects to minimize costs based on the access pattern?
Option A: Use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) storage for the rest 30 days. Then move the files to the GLACIER storage class for the next 90 days. Allow the data to expire after that.
Option B: Use Amazon S3 Standard storage for the rest 30 days. Then move the files to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) for the next 90 days. Allow the data to expire after that.
Option C: Use Amazon S3 Standard storage for rest 30 days. Then move the files to the GLACIER storage class for the next 90 days. Allow the data to expire after that.
Option D: Use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) for the rest 30 days. After that, move the data to the GLACIER storage class, where is will be deleted automatically.

Question 308: A company creates business-critical 3D images every night. The images are batch-processed every Friday and require an uninterrupted 48 hours to complete. What is the MOST cost-effective Amazon EC2 pricing model for this scenario?
Option A: On-Demand Instances
Option B: Scheduled Reserved Instances
Option C: Reserved Instances
Option D: Spot Instances

Question 309: An application generates audit logs of operational activities. Compliance requirements mandate that the application retain the logs for 5 years. How can these requirements be met?
Option A: Save the logs in an Amazon S3 bucket and enable Multi-Factor Authentication Delete (MFA Delete) on the bucket.
Option B: Save the logs in an Amazon EFS volume and use Network File System version 4 (NFSv4) locking with the volume.
Option C: Save the logs in an Amazon Glacier vault and use the Vault Lock feature.
Option D: Save the logs in an Amazon EBS volume and take monthly snapshots.

Question 310: A Solutions Architect is creating an application running in an Amazon VPC that needs to access AWS Systems Manager Parameter Store. Network security rules prohibit any route table entry with a 0.0.0.0/0 destination. What infrastructure addition will allow access to the AWS service while meeting the requirements?
Option A: VPC peering
Option B: NAT instance
Option C: NAT gateway
Option D: AWS PrivateLink 9

Question 311: A photo-sharing website running on AWS allows users to generate thumbnail images of photos stored in Amazon S3. An Amazon DynamoDB table maintains the locations of photos, and thumbnails are easily re-created from the originals if they are accidentally deleted. How should the thumbnail images be stored to ensure the LOWEST cost?
Option A: Amazon S3 Standard-Infrequent Access (S3 Standard-IA) with cross-region replication
Option B: Amazon S3
Option C: Amazon Glacier
Option D: Amazon S3 with cross-region replication

Question 312: A company is implementing a data lake solution on Amazon S3. Its security policy mandates that the data stored in Amazon S3 should be encrypted at rest. Which options can achieve this? (Select TWO.)
Option A: Use S3 server-side encryption with an Amazon EC2 key pair.
Option B: Use S3 server-side encryption with customer-provided keys (SSE-C).
Option C: Use S3 bucket policies to restrict access to the data at rest.
Option D: Use client-side encryption before ingesting the data to Amazon S3 using encryption keys.,
Option E: Use SSL to encrypt the data while in transit to Amazon S3.