Official Exam Details: (SAA-C03)

Exam Code:
SAA-C03

Passing Score:
70%

Total Question Bank:
638 Verified Questions

Exam Duration:
120 Minutes

Exam Format & Question Types

This certification exam features multiple-choice questions (single and multi-select), interactive Hotspots, Hot Areas, and Drag-and-Drop scenario configurations designed to test real-world technical competency.

AWS Certified Solutions Architect – Associate (SAA-C03) Study Guide & Architectural Master Blueprint

Welcome, aspiring Cloud Architects! This master blueprint is your definitive guide to excelling in the AWS Certified Solutions Architect – Associate (SAA-C03) exam. As an expert cloud architect and exam author, I’ve distilled the critical knowledge and strategic insights you need to confidently tackle this certification. Treat this as your essential roadmap to demonstrating advanced knowledge in designing robust, scalable, and cost-optimized solutions on AWS.

Exam Overview & Profile

The AWS Certified Solutions Architect – Associate (SAA-C03) certification validates your ability to effectively demonstrate knowledge of how to architect and deploy secure and robust applications on AWS technologies. This exam targets individuals with at least one year of hands-on experience designing available, cost-efficient, fault-tolerant, and scalable distributed systems on AWS. Expect approximately 65 questions, primarily multiple-choice and multiple-response, to be completed within 130 minutes. A scaled score of 720 out of 1000 is required to pass. The questions frequently present real-world scenarios, requiring you to apply architectural best practices.

Deep-Dive Domain Breakdown

Success on SAA-C03 hinges on a comprehensive understanding of core AWS services and architectural principles across four key domains:

1. Design Secure Architectures (30%)

Identity & Access Management (IAM): Master IAM Users, Groups, Roles, Policies (managed, inline, customer-managed), and the principle of least privilege. Understand Identity Federation with SAML 2.0 and OIDC, and how AWS Organizations Service Control Policies (SCPs) restrict permissions at an organizational level.
Networking Security: Differentiate between Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level). Implement VPC Endpoints (interface and gateway) for private access to AWS services like S3 and DynamoDB. Utilize AWS WAF, AWS Shield, Amazon Inspector, and Amazon GuardDuty for threat detection and protection.
Data Protection: Implement encryption at rest and in transit. Understand AWS Key Management Service (KMS) for symmetric and asymmetric encryption, envelope encryption, and Customer Master Key (CMK) types. Secure S3 buckets with SSE-S3, SSE-KMS, SSE-C, and enforce access policies. Encrypt EBS volumes and RDS instances. Understand AWS Secrets Manager and Systems Manager Parameter Store for sensitive data.

2. Design Resilient Architectures (26%)

High Availability & Fault Tolerance: Implement multi-AZ deployments for EC2, RDS, and ElastiCache. Configure Auto Scaling Groups with appropriate launch templates, health checks, and scaling policies. Leverage Elastic Load Balancers (ALB, NLB, GWLB) for distributing traffic and ensuring application availability. Master Amazon Route 53’s advanced routing policies (failover, weighted, latency, geolocation) for disaster recovery and global load balancing.
Decoupled Architectures: Utilize Amazon SQS for message queuing, understanding visibility timeouts and Dead-Letter Queues (DLQs). Implement Amazon SNS for pub/sub messaging and AWS EventBridge for serverless event routing to build loosely coupled systems.
Disaster Recovery (DR): Understand Recovery Time Objective (RTO) and Recovery Point Objective (RPO) and implement strategies like Backup & Restore, Pilot Light, Warm Standby, and Multi-Site Active/Active architectures.

3. Design High-Performing Architectures (24%)

Compute: Select appropriate EC2 instance types (On-Demand, Reserved Instances, Spot Instances, Savings Plans) and placement groups. Optimize AWS Lambda performance with memory allocation and provisioned concurrency. Understand container services like Amazon ECS, EKS, and AWS Fargate.
Storage: Choose optimal Amazon S3 storage classes (Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier, Deep Archive) based on access patterns and cost. Leverage S3 Transfer Acceleration and S3 Select. Understand EBS volume types (gp3, io2 Block Express) and their performance characteristics. Explore Amazon EFS for shared file storage and AWS Storage Gateway.
Databases: Select the right database for the workload: Amazon RDS (Multi-AZ, Read Replicas), Amazon Aurora (compatible with MySQL/PostgreSQL, Global Database), Amazon DynamoDB (on-demand/provisioned capacity, DAX for caching), Amazon ElastiCache (Redis, Memcached), and Amazon Redshift for data warehousing.
Networking & Content Delivery: Design efficient network connectivity using VPC peering, AWS Transit Gateway, Direct Connect, and VPN. Optimize global content delivery and caching with Amazon CloudFront, including origin groups, signed URLs/cookies, and Lambda@Edge.

4. Design Cost-Optimized Architectures (20%)

Cost-Effective Services: Identify opportunities to use Spot Instances, Reserved Instances, or Savings Plans for compute cost reduction. Implement S3 Lifecycle Policies to transition data between storage classes or delete old objects.
Managed Service Adoption: Leverage managed services like Lambda, RDS, and DynamoDB to reduce operational overhead and associated costs.
Network Cost Optimization: Minimize data transfer costs by utilizing VPC Endpoints for S3/DynamoDB instead of NAT Gateways when appropriate, and optimizing cross-AZ traffic.
Monitoring & Reporting: Understand AWS Budgets and AWS Cost Explorer for cost visibility and control.

High-Yield Exam Tips & Scenario Traps

Read Carefully: Pay close attention to keywords like “most cost-effective,” “highly available,” “least operational overhead,” “most secure,” or “fastest performance.” Each word guides you to the correct architectural decision.
Prioritize Serverless: For new applications or refactoring, serverless (Lambda, SQS, SNS, DynamoDB) is often the AWS-recommended, cost-effective, and operationally efficient solution, unless specific requirements dictate otherwise.
Security First: When security is a core requirement, always choose the most robust option that meets the need, adhering to the principle of least privilege and comprehensive encryption (at rest and in transit).
Decouple Components: Look for opportunities to decouple system components using SQS, SNS, or EventBridge to improve resilience and scalability.
Avoid Over-provisioning: In cost-optimization scenarios, scaling down resources or selecting the right instance/storage type is key. Don’t pay for what you don’t need.
Common Traps:
- Confusing Security Groups (instance firewall) with Network ACLs (subnet firewall).
- Recommending NAT Gateway for S3/DynamoDB access from private subnets when VPC Endpoints are the private, cost-effective alternative.
- Overlooking Multi-AZ for high availability in database and EC2 deployments.
- Not considering CloudFront for global content delivery and performance optimization.

Frequently Asked Questions (FAQ)

Q1: How should I structure my study time for SAA-C03?

A1: Allocate your study time proportionally to the domain weights, but ensure a solid understanding across all areas. Begin with foundational concepts (VPC, IAM, EC2, S3), then dive into advanced topics and service integrations. A balanced approach combines official AWS documentation, reputable online courses, and, crucially, hands-on practice. Dedicate at least 30-40% of your time to building small projects in a free-tier AWS account to solidify conceptual knowledge.

Q2: What’s the best approach to answer scenario-based questions?

A2: For scenario questions, first identify the core requirements and constraints (e.g., “high availability,” “lowest cost,” “minimal operational overhead,” “secure,” “performant”). Then, evaluate each answer option against *all* of these requirements. Often, several options might seem plausible, but only one will optimally address every aspect of the scenario. Eliminate answers that violate any explicit or implicit constraint or introduce unnecessary complexity.

Q3: Are there any services that are particularly important to master for this exam?

A3: Absolutely. A deep understanding of Amazon VPC (subnets, route tables, security groups, NACLs, gateways, endpoints), EC2 (instance types, purchasing options, Auto Scaling), S3 (storage classes, encryption, lifecycle), RDS (Multi-AZ, read replicas, Aurora), DynamoDB, Lambda, SQS, SNS, and IAM is non-negotiable. Additionally, familiarize yourself with Elastic Load Balancers (ALB, NLB), Route 53, CloudFront, and KMS. Understanding their interplay and typical use cases is key.

Q4: How important is hands-on experience for passing the SAA-C03?

A4: Hands-on experience is paramount. The SAA-C03 exam is highly practical, testing your ability to *design* solutions. Reading alone is insufficient. Actively configuring services, deploying sample applications, and troubleshooting issues will deeply embed the architectural patterns and service limitations in your mind, making scenario-based questions significantly easier to navigate. Treat your AWS Free Tier account as your personal sandbox for learning.

Free SAA-C03 Sample Practice Questions

Test your knowledge with these sample scenario questions complete with verified explanations:

General Practice Questions

QUESTION 1

A company uses Amazon RDS for PostgreSQL to run its applications in the us-east-1 Region. The company also uses machine learning (ML) models to forecast annual revenue based on near real-time reports. The reports are generated by using the same RDS for PostgreSQL database. The database performance slows during business hours. The company needs to improve database performance.

Which solution will meet these requirements MOST cost-effectively?

A. Create a cross-Region read replica. Configure the reports to be generated from the read replica.
B. Activate Multi-AZ DB instance deployment for RDS for PostgreSQL. Configure the reports to be generated from the standby database.
C. Use AWS DMS to logically replicate data to a new database. Configure the reports to be generated from the new database.
D. Create a read replica in us-east-1. Configure the reports to be generated from the read replica.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

✅ Option D (Correct)
Reasoning: Creating an Amazon RDS read replica in the same region (us-east-1) is the most cost-effective and appropriate solution. RDS read replicas are specifically designed to offload read-heavy workloads, such as reporting and analytics, from the primary database instance. By configuring the ML model reports to run against the read replica, the contention on the primary database during business hours is eliminated, significantly improving its performance for the main application. This solution is cost-effective as it leverages AWS’s native read scaling capabilities within the same region.

❌ Why the other choices are incorrect:
* Option A is incorrect: A cross-Region read replica would incur additional data transfer costs and potentially higher latency, making it less cost-effective and unnecessary for a performance issue that can be resolved within the same region.
* Option B is incorrect: A Multi-AZ standby instance is for high availability and disaster recovery; it is not directly accessible for read queries to offload workload. Its purpose is failover.
* Option C is incorrect: While AWS DMS can replicate data, using it for this specific read offloading scenario is generally more complex and less cost-effective than leveraging the native RDS read replica feature, which is purpose-built for read scaling.

Reference: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_ReadReplicas.html

QUESTION 2

A manufacturing company runs an order processing application in its VPC. The company wants to securely send messages from the application to an external Salesforce system that uses Open Authorization (OAuth).

A solutions architect needs to integrate the company’s order processing application with the external Salesforce system.

Which solution will meet these requirements?

A. Create an Amazon SNS topic in a fanout configuration that pushes data to an HTTPS endpoint. Configure the order processing application to publish messages to the SNS topic.
B. Create an Amazon SNS topic in a fanout configuration that pushes data to an Amazon Data Firehose delivery stream that has a HTTP destination. Configure the order processing application to publish messages to the SNS topic.
C. Create an Amazon EventBridge rule and configure an Amazon EventBridge API destination partner. Configure the order processing application to publish messages to Amazon EventBridge.
D. Create an Amazon Managed Streaming for Apache Kafka (Amazon MSK) topic that has an outbound MSK Connect connector. Configure the order processing application to publish messages to the MSK topic.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

✅ Option C (Correct)

Reasoning: Amazon EventBridge API Destinations are specifically designed for sending events to HTTP endpoints of external applications, including SaaS providers like Salesforce. API Destinations support various authorization types, including OAuth (Client Credentials or Authorization Code), through API Connections. This provides a secure and managed way to integrate with Salesforce using OAuth, satisfying the requirements.

❌ Why the other choices are incorrect:

Option A is incorrect: While Amazon SNS can push data to HTTPS endpoints, it does not natively handle complex authentication mechanisms like OAuth for external systems. Any OAuth logic would need to be custom-implemented at the receiving HTTPS endpoint, making the solution more complex than EventBridge API Destinations.
Option B is incorrect: Amazon Kinesis Data Firehose can deliver to HTTP destinations. However, similar to SNS, Firehose does not natively manage OAuth authentication for the target system. This would still require custom handling for authorization.
Option D is incorrect: Amazon Managed Streaming for Apache Kafka (Amazon MSK) is a powerful streaming platform, and MSK Connect can integrate with various sources and sinks. However, it’s a more complex and typically higher-overhead solution for simply sending messages to an external HTTP endpoint with OAuth compared to the purpose-built EventBridge API Destinations.

Reference: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-api-destinations.html

QUESTION 3 (Multi-Select)

A healthcare company is running an Amazon EMR cluster on Amazon EC2 instances to process data that is stored in Amazon S3. The company must ensure that the data processing jobs have access only to the relevant data in Amazon S3. Each job must have specific EMR runtime roles.

Which combination of steps will meet these requirements? (Select THREE.)

A. Set up security configurations in Amazon EMR, and set EnableApplicationScopedlAMRole to true.
B. Set up runtime roles to assume the EC2 instance profile of the Amazon EMR cluster.
C. Set up an EC2 instance profile for the Amazon EMR cluster to assume the runtime roles.
D. For each IAM role that serves as an EMR runtime role, set up a trust policy with the EC2 instance profile role.
E. Establish a trust policy between the EMR runtime roles and the EMR service role of the cluster.
F. Set up security configurations in Amazon EMR, and set EnablelnTransitEncryption to true.

Click to View Verified Solution & Explanation

Correct Option: A,C,D

Explanation:

To ensure EMR data processing jobs have access only to relevant data in Amazon S3 by using specific EMR runtime roles, three key steps are required:

✅ A: Set up security configurations in Amazon EMR, and set EnableApplicationScopedlAMRole to true. This setting in an EMR security configuration is a prerequisite for enabling and utilizing EMR runtime roles. It allows applications running on the cluster to assume specific IAM roles.

✅ C: Set up an EC2 instance profile for the Amazon EMR cluster to assume the runtime roles. This involves configuring the permissions policy of the EMR EC2 instance profile role (e.g., EMR_EC2_DefaultRole) to grant sts:AssumeRole permissions on the specific EMR runtime roles. This is crucial because the EC2 instances, operating under this instance profile, are the entities that will attempt to assume the runtime roles.

✅ D: For each IAM role that serves as an EMR runtime role, set up a trust policy with the EC2 instance profile role. The trust policy of each EMR runtime role must explicitly permit the EMR EC2 instance profile role (which the cluster instances use) to assume it. This establishes the necessary trust relationship for the assumption to occur successfully.

❌ Why the other choices are incorrect:

B: Set up runtime roles to assume the EC2 instance profile of the Amazon EMR cluster. This is incorrect. The EC2 instance profile role assumes the runtime roles, not the other way around.
E: Establish a trust policy between the EMR runtime roles and the EMR service role of the cluster. This is incorrect. The trust policy for runtime roles is established with the EMR EC2 instance profile role, not the EMR service role. The EMR service role is used by the EMR service itself for cluster management, not for job-specific data access.
F: Set up security configurations in Amazon EMR, and set EnablelnTransitEncryption to true. This is incorrect. Enabling in-transit encryption secures data moving within the EMR cluster, but it does not control job-specific access to S3 data through IAM roles.

Reference: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-runtime-roles.html

QUESTION 4

A solutions architect is investigating compute options for a critical analytics application. The application uses long-running processes to prepare and aggregate data. The processes cannot be interrupted. The application has a known baseline load. The application needs to handle occasional usage surges.

Which solution will meet these requirements MOST cost-effectively?

A. Create an Amazon EC2 Auto Scaling group. Set the Min capacity and Desired capacity parameters to the number of instances required to handle the baseline load. Purchase Reserved Instances for the Auto Scaling group.
B. Create an Amazon EC2 Auto Scaling group. Set the Min capacity, Max capacity, and Desired capacity parameters to the number of instances required to handle the baseline load. Use On-Demand Instances to address occasional usage surges.
C. Create an Amazon EC2 Auto Scaling group. Set the Min capacity and Desired capacity parameters to the number of instances required to handle the baseline load. Purchase Reserved Instances for the Auto Scaling group. Use the OnDemandPercentageAboveBaseCapacity parameter to configure the launch template to launch Spot Instances.
D. Re-architect the application to use AWS Lambda functions instead of Amazon EC2 instances. Purchase a one-year Compute Savings Plan to reduce the cost of Lambda usage.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

Why A is the MOST cost-effective and correct:

Long-running, non-interruptible processes → rules out Spot Instances (so C is out).

Known baseline load → best covered by Reserved Instances for steady, always-on capacity.

Occasional surges → Auto Scaling can add On-Demand Instances temporarily above the reserved baseline.

No need to re-architect to Lambda (D) for an analytics app with long-running jobs.

QUESTION 5

A company is developing a microservices-based application to manage the company’s delivery operations, The application consists of microservices that process orders, manage a fleet of delivery vehicles, and optimize delivery routes.

The microservices must be able to scale independently and must be able to handle bursts of traffic without any data loss.

Which solution will meet these requirements with the LEAST operational overhead?

A. Use Amazon API Gateway REST APIs to establish communication between microservices, Deploy the application on Amazon EC2 instances in Auto Scaling groups.
B. Use Amazon SQS to establish communication between microservices. Deploy the application on Amazon ECS containers on AWS Fargate.
C. Use WebSocket-based communication between microservices- Deploy the application on Amazon EC2 instances in Auto Scaling groups.
D. Use Amazon SNS to establish communication between microservices. Deploy the application on Amazon ECS containers on Amazon EC2 instances.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: The question asks for a solution that allows microservices to scale independently, handle bursts of traffic without data loss, and have the LEAST operational overhead.

Amazon SQS is a fully managed message queuing service that decouples microservices, buffers requests during traffic bursts, and guarantees message delivery, preventing data loss. This directly addresses the need to handle bursts without data loss and allows services to scale independently.

Amazon ECS containers on AWS Fargate provides a serverless compute engine for containers. With Fargate, you don’t need to provision, scale, or manage EC2 instances, significantly reducing operational overhead. It allows microservices to scale independently based on demand.

Combining SQS for communication and Fargate for deployment offers the optimal balance of scalability, data integrity, and minimal operational overhead.

Reference: https://aws.amazon.com/sqs/features/ | https://aws.amazon.com/fargate/

QUESTION 6

A company runs a container application on a Kubernetes cluster in the company’s data center. The application uses Advanced Message Queuing Protocol (AMQP) to communicate with a message queue. The data center cannot scale fast enough to meet the company’s expanding business needs. The company wants to migrate the workloads to AWS.

Which solution will meet these requirements with the LEAST operational overhead?

A. Migrate the container application to Amazon ECS. IJse Amazon SQS to retrieve the messages.
B. Migrate the container application to Amazon EKS. Use Amazon MQ to retrieve the messages.
C. Use highly available Amazon EC2 instances to run the application. Use Amazon MQ to retrieve the messages.
D. Use AWS Lambda functions to run the application. Use Amazon SQS to retrieve the messages.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

The company runs a container application on Kubernetes using AMQP. The goal is to migrate to AWS with the LEAST operational overhead.

Amazon EKS is a fully managed Kubernetes service. Migrating from an on-premises Kubernetes cluster to Amazon EKS allows the company to continue using Kubernetes for container orchestration, minimizing changes to the application’s deployment and operational model. EKS handles the Kubernetes control plane, significantly reducing operational overhead compared to self-managing Kubernetes.
Amazon MQ is a managed message broker service that supports industry-standard APIs and protocols, including AMQP (both 0-9-1 and 1.0). This allows the application to continue using its existing AMQP messaging protocol without requiring code changes or re-architecture for the message queue component.

This combination (EKS for compute, MQ for messaging) offers a direct lift-and-shift approach for both the application and its messaging dependency, resulting in the least operational overhead.

Reference: https://aws.amazon.com/eks/; https://aws.amazon.com/amazon-mq/

QUESTION 7

A company’s compliance archive holds 120 TB of objects in an Amazon S3 bucket in the Standard access tier. The company accesses the objects frequently during the first

30 days after creation. After the initial 30 days, the company rarely reads the objects. However, the objects must be retrievable in under 1 minute when the company needs

the objects.

Which solution will meet these requirements in the MOST cost-effective way?

A. Store objects in S3 Standard-Infrequent Access (Standard-IA) for the full retention period.
B. Use an S3 Lifecycle rule to transition objects to S3 Glacier Instant Retrieval after 30 days.
C. Use an S3 Lifecycle rule to transition objects to S3 Glacier Flexible Retrieval after 30 days,
D. Enable S3 Intelligent-Tiering. Configure S3 Intelligent-Tiering to store objects in S3 Glacier Deep Archive automatically after 30 days.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

The company’s requirements specify frequent access for the first 30 days, followed by rare access, but with a critical need for retrieval in under 1 minute after those 30 days. Objects are currently in S3 Standard.

Option B (Use an S3 Lifecycle rule to transition objects to S3 Glacier Instant Retrieval after 30 days) is the most cost-effective solution. Keeping objects in S3 Standard for the initial 30 days is appropriate for frequent access. After 30 days, S3 Glacier Instant Retrieval is specifically designed for rarely accessed data that requires immediate retrieval (milliseconds). This meets the ‘under 1 minute’ requirement while being highly cost-effective for archival data.

Why the other choices are incorrect:

Option A (Store objects in S3 Standard-Infrequent Access (Standard-IA) for the full retention period) is not cost-effective. Standard-IA has retrieval charges, and storing frequently accessed data (first 30 days) in this tier would incur unnecessary costs.
Option C (Use an S3 Lifecycle rule to transition objects to S3 Glacier Flexible Retrieval after 30 days) does not reliably meet the ‘under 1 minute’ retrieval requirement. S3 Glacier Flexible Retrieval (formerly S3 Glacier) typically has retrieval times of minutes to hours (e.g., Standard retrieval 3-5 hours, Expedited retrieval 1-5 minutes), making it less suitable than S3 Glacier Instant Retrieval for consistent sub-minute access.
Option D (Enable S3 Intelligent-Tiering. Configure S3 Intelligent-Tiering to store objects in S3 Glacier Deep Archive automatically after 30 days) fails the retrieval time requirement. S3 Glacier Deep Archive is designed for the lowest cost archival with retrieval times typically in hours (12-48 hours), far exceeding the ‘under 1 minute’ constraint. While S3 Intelligent-Tiering can manage tiers, the specified target tier (Deep Archive) is inappropriate.

Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html https://aws.amazon.com/s3/storage-classes/

QUESTION 8

A company runs a containerized data processing application. The company deploys the application on a Kubernetes cluster in a remote field office- The company experiences multiple hardware failures that disrupt operations.

The company needs a solution that can add resilience and deliver minimal latency for the company’s field equipment The solution must be highly available and resilient to temporary

network outages.

Which solution will meet these requirements?

A. Deploy an AWS Site-to-Site VPN connection from the field office to the nearest AWS Region. Deploy Amazon EKS across multiple Availability Zones in that Region.
B. Deploy an AWS Direct Connect connection from the field office to the nearest Direct Connect location. Deploy Amazon EKS in the nearest AWS Region across multipleAvailability Zones.
C. Order a single AWS Outposts server for the field office Deploy Amazon EKS With the extended cluster deployment option on the Outposts server
D. Order multiple AWS Outposts servers for the field office- Deploy Amazon EKS with the local cluster deployment option on the Outposts servers-

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

The company requires a solution that offers resilience against hardware failures, minimal latency for field equipment, high availability, and resilience to temporary network outages in a remote field office. AWS Outposts brings AWS infrastructure and services to on-premises locations, directly addressing the need for minimal latency by keeping compute and storage close to the field equipment.

Option D is correct: Ordering multiple AWS Outposts servers provides the necessary redundancy and high availability to withstand hardware failures, as workloads can be distributed across multiple instances on the Outposts. Deploying Amazon EKS with the local cluster deployment option on these Outposts servers ensures that both the EKS control plane and worker nodes run entirely on the Outposts. This configuration allows the Kubernetes cluster to continue operating autonomously and process data even during temporary network outages to the AWS Region, fulfilling all stated requirements for resilience and low latency.
Option A is incorrect: Deploying EKS in an AWS Region via a Site-to-Site VPN introduces significant latency for field equipment and is not resilient to network outages for local operations, as the application would depend on a continuous connection to the region.
Option B is incorrect: While AWS Direct Connect offers a dedicated, lower-latency connection than VPN, it still routes traffic to an AWS Region. This would not provide minimal latency for field equipment on-premises, nor would it allow operations to continue during a temporary loss of connectivity to the AWS Region.
Option C is incorrect: A single AWS Outposts server does not provide resilience against hardware failures, which the problem statement explicitly highlights as an issue. Furthermore, the EKS extended cluster deployment option places the control plane in the AWS Region, meaning the cluster would not be resilient to temporary network outages from the field office to the region.

Reference: https://docs.aws.amazon.com/outposts/latest/userguide/how-outposts-works.html, https://docs.aws.amazon.com/eks/latest/userguide/eks-outposts.html

QUESTION 9 (Multi-Select)

A company runs an application in the AWS Cloud. The company wants to improve the application’s resilience by using multiple AWS Regions. The application uses Amazon SNS topics to invoke AWS Lambda functions- The company must be able to deliver SNS notifications to the application’s Lambda functions across Regions.

Which combination of steps will meet these requirements? (Select TWO.)

A. Create additional Lambda functions in another Region where the application runs-
B. In each Region where the application runs, subscribe the Lambda functions from all Regions to the SNS notification in that Region.
C. In each Region where the application runs, subscribe the Lambda functions to the SNS notification in the original Region.
D. In each Region where the application runs, subscribe the Lambda function in that Region to the SNS notifications in all Regions.
E. Create a new AWS account Create Lambda functions across both accounts- Add code to call Amazon SNS across accounts.

Click to View Verified Solution & Explanation

Correct Option: A,D

Explanation:

The company wants to improve application resilience by using multiple AWS Regions and ensure Amazon SNS notifications can invoke AWS Lambda functions across Regions.

Here’s why options A and D are the correct combination:

✅ Option A: Create additional Lambda functions in another Region where the application runs.
For multi-Region resilience, it’s essential to have redundant application components in a secondary Region. If the primary Region experiences an outage, the application in the secondary Region can continue processing requests. Creating additional Lambda functions in another Region is a fundamental step to achieve this.
✅ Option D: In each Region where the application runs, subscribe the Lambda function in that Region to the SNS notifications in all Regions.
AWS Lambda functions can only directly subscribe to Amazon SNS topics within the same AWS Region. To deliver SNS notifications to Lambda functions across Regions for resilience, a common pattern involves:
1. Creating an SNS topic in each active Region.
2. Creating a Lambda function in each Region.
3. Subscribing the local Lambda function to its local SNS topic.
4. Implementing a cross-Region replication mechanism, typically using another Lambda function subscribed to the source SNS topic to publish messages to the SNS topic in the other Region.
Option D encapsulates this architecture by stating that each regional Lambda function should effectively receive
Reference: https://aws.amazon.com/blogs/compute/building-cross-region-serverless-applications/

QUESTION 10

A company uses AWS Direct Connect to connect its on-premises network to multiple VPCs. All VPCs are located in the same AWS account in one AWS Region. Each VPC uses its own private virtual interface (VIE) and virtual local area network (VLAN) on the Direct Connect connection.

The company is growing and needs to add more VPCs and private VlFs. The existing connections cannot support the additional VPCs and private VlFs. The company’s new VPCs must have connectivity to the on-premises network.

Which solution will meet these requirements in the MOST scalable way?

A. Provision a new Direct Connect connection to handle the additional VPCs and VIFs,
B. Create a virtual private gateway for each VPC that is over the connection service quota. Use AWS Site-to-Site VPN to connect the virtual private gateways to the on-premises network.
C. Create a Direct Connect gateway and add virtual private gateway associations to all of the VPCs, Configure a private VIF for each new VPC to connect each new VPC to the on-premises network.
D. Connect a transit gateway to all the VPCs. Associate a Direct Connect gateway with the transit gateway. Create a transit VIF for the Direct Connect gateway.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

The most scalable solution for connecting multiple VPCs to an on-premises network via AWS Direct Connect in a single account and Region is to use a Transit Gateway combined with a Direct Connect gateway and a Transit VIF.

Transit Gateway (TGW): Acts as a central hub, allowing all VPCs to connect to it. This eliminates the need for individual connections from each VPC to the on-premises network and centralizes routing.
Direct Connect Gateway (DXGW): The DXGW enables connectivity between your Direct Connect connection and multiple VPCs (via TGWs or VGWs) across different AWS accounts and Regions, but it also provides consolidation benefits within a single Region/account.
Transit VIF: This specific type of Virtual Interface is designed to connect a Direct Connect connection to a Direct Connect gateway, which is then associated with one or more Transit Gateways. This architecture allows a single Transit VIF to support connectivity for a large number of VPCs attached to the Transit Gateway, addressing the scalability issue of running out of private VIFs.

This approach simplifies network architecture, reduces the number of required VIFs, and provides a highly scalable and manageable solution for hybrid cloud connectivity.

Why other options are incorrect:

A is incorrect: Provisioning a new Direct Connect connection only defers the problem and adds physical infrastructure complexity. It doesn’t fundamentally solve the scalability of managing many VPCs and their individual VIFs in a centralized manner.
B is incorrect: Using AWS Site-to-Site VPN for new VPCs introduces a different connectivity method (VPN vs. Direct Connect), which typically has lower bandwidth and higher latency, and doesn’t leverage the existing Direct Connect investment for scaling.
C is incorrect: While creating a Direct Connect gateway and associating Virtual Private Gateways (VGWs) is a step towards consolidation, the instruction to “Configure a private VIF for each new VPC” directly contradicts the goal of improving scalability and reducing the number of VIFs. A DXGW with a single private VIF can connect to multiple VGWs, but the Transit Gateway solution with a Transit VIF is inherently more scalable for a large number of VPCs, especially in terms of routing complexity and limits.

Reference: https://aws.amazon.com/blogs/networking-and-content-delivery/create-a-scalable-and-cost-efficient-network-architecture-with-aws-transit-gateway-and-aws-direct-connect-gateway/

QUESTION 11

A company seeks a storage solution for its application. The solution must be highly available and scalable. The solution also must function as a file system, be mountable by multiple Linux instances in AWS and on premises through native protocols, and have no minimum size requirements. The company has set up a Site-to-Site VPN for access from its on premises network to its VPC.

Which storage solution meets these requirements?

A. Amazon FSx Multi-AZ deployments
B. Amazon EBS Multi-Attach volumes
C. Amazon EFS with multiple mount targets
D. Amazon EFS with a single mount target and multiple access points

Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

✅ Option C (Correct)

Reasoning: Amazon EFS (Elastic File System) with multiple mount targets is the ideal solution because it directly addresses all the stated requirements:

Highly available and scalable: EFS is designed for high availability and automatically scales storage capacity up or down as needed, with multiple mount targets ensuring resilience across Availability Zones.
Functions as a file system: EFS provides an NFSv4.1 file system that can be mounted by Linux instances.
Mountable by multiple Linux instances in AWS and on premises through native protocols: EFS can be mounted by EC2 instances in AWS and by on-premises servers over a Site-to-Site VPN (or Direct Connect) using the standard NFSv4.1 protocol. Multiple mount targets in different subnets provide network access points for the file system.
No minimum size requirements: EFS is elastic, meaning you only pay for the storage you use, and there are no minimum size or performance provisioning requirements for storage capacity.

❌ Why the other choices are incorrect:

Option A is incorrect: Amazon FSx Multi-AZ deployments (e.g., FSx for NetApp ONTAP or FSx for OpenZFS) could offer NFS and be highly available. However, FSx services typically require provisioning throughput capacity, which has associated costs and doesn’t fully align with the ‘no minimum size requirements’ characteristic of EFS’s elastic storage model. While they offer file systems, EFS is a more direct fit for the ‘no minimum size’ and general purpose shared file system for Linux.
Option B is incorrect: Amazon EBS Multi-Attach volumes are block storage, not a file system. While they allow attaching a single volume to multiple instances (within the same AZ) for concurrent read/write access, the instances would need a cluster-aware file system (like GPFS or OCFS2) to coordinate access, which is not what ‘native protocols’ usually implies for shared file systems. It also doesn’t inherently support on-premises access via native file system protocols.
Option D is incorrect: Amazon EFS with a single mount target would create a single point of failure within a specific Availability Zone, thus not meeting the ‘highly available’ requirement. While EFS access points are useful for managing application access, they do not mitigate the single point of failure issue of a lone mount target or contribute to cross-AZ availability.

Reference: https://docs.aws.amazon.com/efs/latest/ug/whatisefs.html, https://docs.aws.amazon.com/efs/latest/ug/on-premises-access.html

QUESTION 12

A company is using a loosely coupled serverless architecture on AWS. The architecture consists of multiple web applications and APIs distributed across multiple teams. The company uses AWS Control Tower to provision AWS accounts. The company’s development teams use AWS CloudFormation.

The company wants to improve trace monitoring and gain insight into how individual services in application stacks are performing.

Which solution will meet these requirements?

A. Enable AWS CloudTrail across all accounts by using AWS Control Tower.
B. Enable AWS X-Ray across all accounts by using AWS Control Tower.
C. Enable Amazon CloudWatch in the CloudFormation templates,
D. Enable AWS X-Ray in the CloudFormation templates.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

The company requires improved trace monitoring and insight into individual service performance within a loosely coupled serverless architecture. AWS X-Ray is specifically designed for distributed tracing to analyze and debug production applications, providing a visual service map, trace data, and performance insights across various services involved in a request. Since the company’s development teams use AWS CloudFormation, enabling AWS X-Ray directly within the CloudFormation templates for the relevant serverless resources (such as AWS Lambda functions or API Gateway stages) is the most direct and effective way to instrument these services to emit trace data. This ensures that detailed performance information and the flow of requests across individual services are captured and monitored.

Reference: https://aws.amazon.com/xray/

QUESTION 13

A company runs container applications by using Amazon Elastic Kubernetes Service (Amazon EKS) and the Horizontal Pod Auto scaler. The workload is not consistent throughout the day. A solutions architect notices that the number of nodes does not automatically scale out when the existing nodes have reached maximum capacity in the cluster, which causes performance issues.

Which solution will resolve this issue with the LEAST administrative overhead?

A. Scale out the nodes by tracking the memory usage.
B. Use the Kubernetes Cluster Autoscore to manage the number of nodes in the cluster.
C. Use an AWS Lambda function to resize the EKS cluster automatically.
D. Use an Amazon EC2 Auto Scaling group to distribute the workload.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Use the Kubernetes Cluster Autoscaler to manage the number of nodes in the cluster.

Description: The Kubernetes Cluster Autoscaler is an open-source tool that automatically adjusts the number of nodes in your Kubernetes cluster. It scales up the number of nodes when pods fail to schedule due to resource constraints and scales down when nodes are underutilized and their pods can be consolidated onto other nodes. It integrates with cloud providers like AWS to manage the underlying EC2 instances (nodes) via Auto Scaling groups.
Why this fits: For an Amazon EKS cluster, the Kubernetes Cluster Autoscaler is the recommended and most effective solution for dynamically managing the number of worker nodes based on the demands of the Kubernetes workloads (pods). It directly observes pod pending states and node utilization, making intelligent decisions about scaling the cluster’s capacity by interacting with the underlying EC2 Auto Scaling groups. This ensures that the cluster has enough resources to run all workloads efficiently without over-provisioning.

Reference: https://docs.aws.amazon.com/eks/latest/userguide/cluster-autoscaler.html

QUESTION 14

A company is building a new web application that serves static and dynamic content from an APL The company wants to minimize latency for users who access the application from around the world

Which solution will meet these requirements MOST cost-effectively?

A. Deploy the static content to an Amazon S3 bucket Use an Amazon API Gateway HTTP API to serve the dynamic content. Create an Amazon CloudFront distribution that uses the S3 bucket and the HTTP API as origins. Enable caching for static content.
B. Deploy the static content to an Amazon S3 bucket. Provide the bucket website endpoint to users. Use an Amazon API Gateway HTTP API with caching enabled to serve the dynamic content.
C. Deploy the static content to an Amazon S3 bucket Use two Amazon EC2 instances as web servers. Deploy an Application Load Balancer to distribute traffic. Create an Amazon CloudFront distribution in front of the S3 bucket to cache static content.
D. Deploy the static content to an Amazon S3 bucket Provide the bucket website endpoint to users. Create an Amazon CloudFront distribution in front of the S3 bucket to cache static content.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Deploy the static content to an Amazon S3 bucket Use an Amazon API Gateway HTTP API to serve the dynamic content. Create an Amazon CloudFront distribution that uses the S3 bucket and the HTTP API as origins. Enable caching for static content.

Description: This choice describes a highly scalable, performant, and cost-effective architecture for web applications with both static and dynamic content. Static content (e.g., HTML, CSS, JavaScript, images) is hosted in Amazon S3, known for its durability and cost-efficiency. Dynamic content (e.g., API calls, real-time data) is served via Amazon API Gateway HTTP API, a fully managed service for creating, publishing, and securing APIs. Both S3 and API Gateway are then placed behind an Amazon CloudFront distribution, which acts as a Content Delivery Network (CDN). CloudFront caches content at edge locations worldwide, reducing latency for users and offloading requests from the origins. Caching is explicitly enabled for static content, which is a primary benefit of using CloudFront with S3.
Why this fits: This solution aligns perfectly with AWS best practices for serving modern web applications.

S3 for Static Content: Amazon S3 is the industry standard for hosting static website content due to its high durability, availability, and cost-effectiveness.
API Gateway HTTP API for Dynamic Content: API Gateway provides a scalable, managed, and secure way to expose backend services for dynamic content. HTTP APIs are a faster and more cost-effective option for many use cases compared to REST APIs.
CloudFront for Unified Delivery and Performance: Using CloudFront in front of both S3 and API Gateway is crucial. It provides a single domain endpoint for users, caches static content (reducing S3 requests and improving load times), and can cache dynamic content (if configured for API Gateway), significantly reducing latency globally. This offloads traffic from the origin servers (S3 and API Gateway), improving resilience and reducing operational costs.
Caching: Explicitly enabling caching for static content leverages CloudFront’s core functionality, which is essential for performance and cost optimization.
This combination provides global reach, low latency, high scalability, and robust security for both types of content.

QUESTION 15

A company has an internet-facing application that runs on premises. The application contains mostly user-generated content. The data is stored in an on-premises network-attached storage system. The company wants to archive this data annually and has chosen to move the archival data to Amazon S3. The company needs a solution to migrate the archival data into an S3 bucket.

Which solution will meet these requirements?

A. Use AWS Storage Gateway Volume Gateway Cache the data, and then replicate the data from the on-premises environment to Amazon S3.
B. Use AWS DataSync. Create a configuration to replicate the data from the on-premises environment to Amazon S3.
C. Use AWS Transfer Family. Use an SFTP client to serially transfer the data from the on-premises environment to Amazon S3.
D. Use Amazon S3 Transfer Acceleration. Use a third-party backup utility to replicate the data from the on-premises environment to Amazon S3.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Use AWS DataSync. Create a configuration to replicate the data from the on-premises environment to Amazon S3.

Description: AWS DataSync is a data transfer service that simplifies, automates, and accelerates moving data between on-premises storage systems and AWS storage services such as Amazon S3, Amazon EFS, and Amazon FSx. It deploys an agent on-premises to read and write data and handles all aspects of the data transfer, including encryption, integrity validation, and network optimization.
Why this fits: DataSync is purpose-built for high-performance, secure, and automated data transfer and replication from on-premises environments directly to Amazon S3. It is designed to handle large datasets, manage network interruptions, and ensure data integrity, making it the ideal choice for migrating or regularly syncing on-premises data to S3. Other options are either not designed for this specific replication use case, or offer less efficient and automated solutions compared to DataSync.

QUESTION 16

A company runs an application by using on-premises servers. The application stores user data in a NoSQL database. The company wants to migrate the application to a decoupled architecture in the AWS Cloud. The company wants to be able to scale the different application components automatically

Which solution meets these requirements?

A. Migrate the application to a group of Amazon EC2 instances behind an Application Load Balancer- Migrate the database to an Amazon RDS for PostgreSQL database with read replicas.
B. Migrate the application to an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer Migrate the database to an Amazon DynamoDB table with on-demand capacity mode.
C. Migrate the application to an AWS Lambda function behind an Application Load Balancer. Migrate the database to an Amazon DynamoDB table with provisioned capacity mode.
D. Migrate the application to an AWS Lambda function behind an Amazon API Gateway REST API- Migrate the database to an Amazon Aurora PostgreSQL serverless database.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Migrate the application to an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer Migrate the database to an Amazon DynamoDB table with on-demand capacity mode.

Description: This solution proposes a highly scalable, fault-tolerant, and operationally simplified architecture.

Amazon EC2 Auto Scaling Group: Automatically adjusts the number of Amazon EC2 instances based on defined scaling policies (e.g., CPU utilization, network I/O, custom metrics). This ensures high availability by replacing unhealthy instances and scales application capacity up or down to meet demand, optimizing costs.
Application Load Balancer (ALB): Distributes incoming application traffic across multiple targets, such as EC2 instances, within an Auto Scaling group. It provides advanced routing features, SSL/TLS termination, and health checks, enhancing fault tolerance and availability.
Amazon DynamoDB: A fully managed, serverless NoSQL database service that delivers single-digit millisecond performance at any scale.
On-demand capacity mode: For DynamoDB, this mode automatically scales read and write capacity to accommodate workload changes, simplifying capacity management and optimizing costs for unpredictable traffic patterns by charging only for the data reads and writes your application performs.

Why this fits: This choice represents a common and highly effective modern migration strategy for many applications.

High Availability and Scalability (Application Layer): Using an Auto Scaling group with an ALB ensures the application layer is resilient to failures (instances are replaced automatically) and can handle varying loads efficiently by scaling compute resources up and down. This directly addresses common requirements for migrated applications.
Scalability and Operational Simplicity (Database Layer): DynamoDB with on-demand capacity mode offers immense scalability without requiring database administrators to provision and manage servers or set complex capacity plans. This significantly reduces operational overhead compared to traditional relational databases, making it an excellent choice for a wide range of applications that can leverage a NoSQL data model. For an Associate-level Solutions Architect, understanding how to leverage fully managed, scalable services is critical.
Cost-Effectiveness: Auto Scaling helps manage EC2 costs by only running necessary instances, and DynamoDB on-demand pays only for actual usage, leading to optimized cloud spend.

QUESTION 17

A company is building a news aggregation platform. The platform ingests news articles that need to be cleaned and categorized. The processed articles must be stored durably for one year The platform must handle up to thousands of incoming articles each minute during peaks. The platform must also provide independent, scalable processing for each article.

Which solution will meet these requirements?

A. Create a custom application to ingest articles and perform in-memory processing- Run the application on one large Amazon EC2 instance. Configure the application to store processed articles in an Amazon S3 bucket.
B. Create an AWS Lambda function to ingest articles. Send one message for each article to an Amazon Simple Queue Service (Amazon SQS) queue. Create a second Lambda function to consume the SQS queue- Configure the second Lambda function to process the articles and store the articles in an Amazon S3 bucket
C. Create an AWS Lambda function to ingest articles. Store the output in a shared Amazon ElastiCache (Memcached) cluster Deploy a fleet of Amazon EC2 instances in an Auto Scaling group. Configure the instances to retrieve the article data from the ElastiCache cluster, process the data, and write the data back to the ElastiCache cluster
D. Create an AWS Lambda function to ingest articles. Send one message for each article to an Amazon Simple Queue Service (Amazon SQS) queue. Create a second Lambda function to consume the SQS queue. Configure the second Lambda function to process the articles and store the articles in a second SQS queue.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Create an AWS Lambda function to ingest articles. Send one message for each article to an Amazon Simple Queue Service (Amazon SQS) queue. Create a second Lambda function to consume the SQS queue- Configure the second Lambda function to process the articles and store the articles in an Amazon S3 bucket

Description: This solution leverages a fully serverless, event-driven architecture. An initial AWS Lambda function handles the ingestion of articles. For each article, a message is sent to an Amazon SQS queue, providing a durable, highly available, and scalable buffer. A second AWS Lambda function is then triggered by messages in the SQS queue, allowing it to process the articles independently. Finally, the processed articles are stored durably and cost-effectively in an Amazon S3 bucket.
Why this fits: This design is highly aligned with AWS best practices for building scalable, decoupled, and cost-effective applications.

Serverless: Both ingestion and processing use AWS Lambda, eliminating the need to provision or manage servers. SQS and S3 are also serverless services.
Decoupling and Scalability: SQS acts as a buffer between the ingestion and processing stages. This decouples the components, allowing them to scale independently. If the processing load spikes, messages queue in SQS, preventing backpressure on the ingestor and ensuring data is not lost. Lambda automatically scales to handle the SQS queue depth.
Durability and Reliability: SQS guarantees message delivery and retention. S3 provides industry-leading durability for processed articles, making it an ideal long-term storage solution.
Cost-Effective: All services are pay-per-use, ensuring costs scale with actual usage and avoiding idle capacity charges.

Why other choices are less suitable:

Choice A (Single large EC2 instance): Introduces a single point of failure, lacks inherent scalability and high availability, and has higher operational overhead compared to serverless options.
Choice C (ElastiCache for processing and storage): ElastiCache (Memcached) is an in-memory cache, not a durable primary data store or message queue. Data can be lost, and it’s not suitable for reliable long-term storage of processed articles.
Choice D (Store processed articles in a second SQS queue): SQS is a message queue, not a durable storage solution for processed content. Messages have a maximum retention period of 14 days, and SQS is not designed for querying or archiving large volumes of processed data. S3 is the appropriate service for this purpose.

QUESTION 18

A company is developing a SaaS solution for customers. The solution runs on Amazon EC2 instances that have Amazon Elastic Block Store (Amazon EBS) volumes attached. Within the SaaS application, customers can request how much storage they need. The application needs to allocate the amount of block storage each customer requests.

A solutions architect must design an operationally efficient solution that meets the storage scaling requirement.

Which solution will meet these requirements MOST cost-effectively?

A. Migrate the data from the EBS volumes to an Amazon S3 bucket. Use the Amazon S3 Standard storage class.
B. Migrate the data from the EBS volumes to an Amazon Elastic File System (Amazon EFS) file system. Use the EFS Standard storage class. Invoke an AWS Lambda function to increase the EFS volume capacity based on user input.
C. Migrate the data from the EBS volumes to an Amazon FSx for Windows File Server file system. Invoke an AWS Lambda function to increase the capacity of the file system based on user input.
D. Invoke an AWS Lambda function to increase the size of EBS volumes based on user input by using EBS Elastic Volumes.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Invoke an AWS Lambda function to increase the size of EBS volumes based on user input by using EBS Elastic Volumes.

Description: EBS Elastic Volumes allow you to dynamically modify the size, type, and IOPS/throughput of an existing Amazon EBS volume without detaching it from the instance or requiring downtime. This capability enables you to scale your storage resources efficiently as application needs evolve. An AWS Lambda function can be used to automate this process by calling the AWS EC2 ModifyVolume API, triggered by various events, including user input (e.g., via an API Gateway endpoint).
Why this fits: This option directly addresses the need to increase storage capacity for an application that is already using EBS volumes. By leveraging EBS Elastic Volumes, you can expand the existing storage without migrating data to a different storage service, which would be a more complex and potentially disruptive operation. Using a Lambda function provides a serverless, scalable, and automated way to respond to user input and programmatically increase the EBS volume size, ensuring the application has the necessary storage without manual intervention.

QUESTION 19

A company has an Amazon S3 data lake that is governed by AWS Lake Formation. The company wants to create a visualization in Amazon QuickSight by joining the data in the data lake with operational data that is stored in an Amazon Aurora MySQL database. The company wants to enforce column-level authorization so that the company’s marketing team can access only a subset of columns in the database.

Which solution will meet these requirements with the LEAST operational overhead?

A. Use Amazon EMR to ingest the data directly from the database to the QuickSight SPICE engine. Include only the required columns.
B. Use AWS Glue Studio to ingest the data from the database to the S3 data lake. Attach an IAM policy to the QuickSight users to enforce column-level access control. Use Amazon S3 as the data source In QuickSight.
C. Use AWS Glue Elastic Mews to create a materialized view for the database in Amazon S3. Create an S3 bucket to enforce column-level access control for the QuickSight users. Use Amazon S3 as the data source in Quick Sight.
D. Use a Lake Formation blueprint to ingest the data from the database to the S3 data lake. use Lake Formation to enforce column-level access control for the QuickSight users. Use Amazon Athena as the data source in QuickSight.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Use a Lake Formation blueprint to ingest the data from the database to the S3 data lake. use Lake Formation to enforce column-level access control for the QuickSight users. Use Amazon Athena as the data source in QuickSight.

Description: This choice outlines a robust, serverless, and secure architecture for ingesting data into an S3 data lake, enforcing fine-grained access control, and making it available for analytics tools like QuickSight.
Why this fits:

Data Ingestion (Lake Formation blueprint): AWS Lake Formation blueprints automate the process of ingesting data from various sources, including relational databases, into an S3 data lake. This simplifies the creation of ETL jobs (often powered by AWS Glue) to move and prepare data.
Column-level access control (Lake Formation): AWS Lake Formation is the dedicated service for implementing centralized, fine-grained access control (database, table, column, and row-level) over data stored in an Amazon S3 data lake. It integrates with various analytics services to enforce these permissions.
QuickSight data source (Amazon Athena): Amazon Athena is a serverless query service that allows users to analyze data directly in S3 using standard SQL. Athena integrates seamlessly with AWS Glue Data Catalog and AWS Lake Formation, allowing it to enforce the column-level permissions defined in Lake Formation. QuickSight can then connect to Athena as a data source, inheriting these granular access controls for its users. This combination provides a scalable, secure, and cost-effective solution for the stated requirements.

QUESTION 20

A company wants to optimize costs for its AWS infrastructure. The company wants to receive notifications when actual costs or forecasted costs exceed a specified budget The company does not want to develop a custom solution.

Which solution will meet these requirements?

A. Use AWS Trusted Advisor to set up budget notifications. Configure Amazon CloudWatch to monitor costs. Export CloudWatch data to Amazon S3. Use machine learning (ML) to estimate future trends based on the CloudWatch data
B. Create a budget in AWS Budgets that has a specified cost threshold. Create an AWS Lambda function that sends a notification to the company when costs reach the specified threshold. Use AWS Billing and Cost Management reports to monitor costs.
C. Use AWS Cost Explorer to set a specified budget threshold. Create an AWS Lambda function to calculate cost estimates. Configure the Lambda function to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if estimated costs exceed the specified threshold.
D. Create a budget in AWS Budgets that has a specified cost threshold. Configure AWS Budgets to send budget alerts to an Amazon Simple Notification Service (Amazon SNS) topic. Use AWS Cost Explorer to monitor costs.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Create a budget in AWS Budgets that has a specified cost threshold. Configure AWS Budgets to send budget alerts to an Amazon Simple Notification Service (Amazon SNS) topic. Use AWS Cost Explorer to monitor costs.

Description: This choice leverages the primary AWS services designed specifically for cost management and alerting. AWS Budgets allows users to set custom budgets to track their cost and usage from a specific threshold, and natively integrates with Amazon SNS for real-time notifications when costs approach or exceed these thresholds. AWS Cost Explorer is a powerful tool for visualizing, understanding, and managing AWS costs and usage over time, providing detailed insights and forecasting capabilities.
Why this fits: This solution is the most appropriate and AWS-native approach for monitoring costs and receiving alerts.

AWS Budgets is explicitly designed for creating and managing cost and usage budgets.
Amazon SNS is the recommended service for delivering notifications from AWS Budgets to various subscribers (email, chat, other AWS services, etc.), ensuring prompt alerts.
AWS Cost Explorer provides an interactive interface for detailed cost analysis, reporting, and forecasting, making it the ideal tool for ongoing monitoring and understanding cost trends.
This combination provides a robust, integrated, and straightforward mechanism to achieve the desired outcome without unnecessary complexity or custom development.

QUESTION 21

A home security company is expanding its business globally. The company needs to encrypt customer data. The company does not want to manage its own keys. The company needs the keys to be usable in multiple AWS Regions and needs to control access to the keys.

Which solution will meet these requirements with the LEAST operational overhead?

A. Use AWS Key Management Service (AWS KMS) to create multi-Region keys- Apply tags to identify each key Use attribute-based access control (ABAC) condition keys tocontrol access to the keys.
B. Use AWS Key Management Service (AWS KMS) to create multiple keys by importing key material, Apply tags to identify each key. Use attribute-based access control (ABAC) condition keys to control access to the keys.
C. Use AWS CloudHSM to create a CloudHSM cluster in the company's primary Region. Synchronize the CloudHSM cluster to additional Regions by using the CloudHSM Management Utility (CMU).
D. Use AWS CloudHSM to create users. Use the CloudHSM Management Utility (CMU) to share keys with the users. Use the shareKey command to share or unshare the key with additional users in each Region.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Use AWS Key Management Service (AWS KMS) to create multi-Region keys. Apply tags to identify each key. Use attribute-based access control (ABAC) condition keys to control access to the keys.

Description: AWS Key Management Service (KMS) is a fully managed service that makes it easy for you to create and control the cryptographic keys used to encrypt your data. Multi-Region keys are a feature within KMS that allows you to encrypt data in one AWS Region and decrypt it in another AWS Region using related keys that share the same key material and key ID. This is crucial for disaster recovery and multi-Region applications, as it allows encrypted data to be moved across regions without needing to be re-encrypted or for separate keys to be managed. Tags are labels assigned to AWS resources, consisting of a user-defined key and value, used for organization, cost tracking, and access control. Attribute-Based Access Control (ABAC) uses attributes (like tags) of both the principal (user/role) and the resource to determine permissions, offering a scalable and flexible way to manage access policies using condition keys in IAM policies.
Why this fits: This solution directly addresses the likely need for cryptographic interoperability across multiple AWS Regions without complex key management.

Multi-Region Key Management: Multi-Region KMS keys are explicitly designed for scenarios where data encrypted in one Region needs to be decrypted in another, or for replicating encrypted data across Regions efficiently. This avoids the overhead of managing separate keys per Region or re-encrypting data.
Scalable Access Control: Using tags for identification combined with ABAC condition keys provides a highly scalable and manageable way to control access to keys. Instead of writing explicit policies for each key or principal, policies can be written once to grant access based on matching tags, which simplifies management as the number of keys and users grows.
Managed Service: KMS is a fully managed service, which significantly reduces operational overhead compared to self-managing cryptographic hardware (like CloudHSM).

QUESTION 22

A data science team requires storage for nightly log processing. The size and number of logs is unknown and will persist for 24 hours only

What is the MOST cost-effective solution?

A. Amazon S3 Glacier Deep Archive
B. Amazon S3 Standard
C. Amazon S3 Intelligent-Tiering
D. Amazon S3 One Zone-infrequent Access (S3 One Zone-IA)

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Amazon S3 Standard

Description: Amazon S3 Standard offers highly durable, highly available, and frequently accessed object storage. It is designed for general-purpose storage of frequently accessed data and is resilient to concurrent device failures by storing data redundantly across a minimum of three Availability Zones. It provides low-latency and high-throughput performance for a wide range of applications.
Why this fits: The term "general-purpose object storage" directly aligns with the primary use case for Amazon S3 Standard. It is the default S3 storage class and is suitable for most workloads where data is frequently accessed, requires high durability and availability (99.999999999% durability and 99.99% availability), and needs immediate retrieval. Other S3 storage classes are optimized for specific access patterns or cost requirements (e.g., infrequent access, archiving, single-AZ redundancy), whereas S3 Standard is the versatile, all-around solution.

Reference: https://aws.amazon.com/s3/storage-classes/

QUESTION 23

A company has an on-premises volume backup solution that has reached its end of life. The company wants to use AWS as part of a new backup solution and wants to maintain local access to all the data while it is backed up on AWS. The company wants to ensure that the data backed up on AWS is automatically and securely transferred.

Which solution meets these requirements?

A. Use AWS Snowball to migrate data out of the on-premises solution to Amazon S3. Configure on-premises systems to mount the Snowball S3 endpoint to provide local access to the data.
B. Use AWS Snowball Edge to migrate data out of the on-premises solution to Amazon S3. Use the Snowball Edge file interface to provide on-premises systems with local access to the data.
C. Use AWS Storage Gateway and configure a cached volume gateway. Run the Storage Gateway software appliance on premises and configure a percentage of data to cache locally. Mount the gateway storage volumes to provide local access to the data.
D. Use AWS Storage Gateway and configure a stored volume gateway run the Storage Gateway software appliance on premises and map the gateway storage volumes to on-premises storage Mount the gateway storage volumes to provide local access to the data.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Use AWS Storage Gateway and configure a stored volume gateway run the Storage Gateway software appliance on premises and map the gateway storage volumes to on-premises storage Mount the gateway storage volumes to provide local access to the data.

Description: AWS Storage Gateway’s Stored Volume mode allows you to maintain your primary data locally on your on-premises storage (e.g., SAN, DAS), while asynchronously backing up point-in-time snapshots of this data to Amazon S3. These snapshots are then stored as Amazon EBS snapshots, enabling recovery to an EC2 instance or conversion back to a gateway volume. It provides iSCSI block storage volumes that on-premises applications can mount.
Why this fits: This solution directly addresses all requirements.

Maintain local access to all the data: In Stored Volume mode, the entire dataset resides on your on-premises storage, providing local, low-latency access to all of it. The gateway acts as an iSCSI target mapping to this local storage.
Backed up on AWS: The gateway asynchronously creates point-in-time snapshots of your on-premises volumes and securely uploads them to Amazon S3 (and they appear as EBS snapshots). This fulfills the "backed up on AWS" requirement.
Automatically and securely transferred: AWS Storage Gateway handles the snapshot creation, transfer, and security (encryption in transit and at rest) automatically without manual intervention.

The other options are less suitable:

A & B (AWS Snowball/Snowball Edge): These are primarily for large-scale data migration (offline transfer) or edge computing, not for continuous, automatic, ongoing backup solutions that maintain a live, locally accessible primary copy of data. Once the Snowball device is returned, local access to that data (from the Snowball itself) is gone.
C (AWS Storage Gateway – Cached Volume): In Cached Volume mode, the primary copy of the data resides in Amazon S3, and only a frequently accessed subset is cached locally. This does not meet the requirement to "maintain local access to all the data" where the local copy is implicitly the primary, authoritative source. If the on-premises gateway or cache fails, full local access to all data is lost until the cache is repopulated from S3.

Reference: https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html

QUESTION 24

A company allows users to upload and store photos through its website. The website has users from all around the world. All images that users upload are stored in a centralized Amazon S3 bucket. The company wants to increase the speed in which its entire user base can upload photos through the website.

What should a solutions architect recommend to meet these requirements?

A. Create an Amazon CloudFront distribution. Use the Amazon S3 Standard storage class to store files.
B. Create an Amazon CloudFront distribution. Configure the distribution settings and origin.
C. Configure S3 Transfer Acceleration on the S3 bucket Use the standard S3 endpoint to upload files.
D. Configure S3 Transfer Acceleration on the S3 bucket Use the S3 Accelerate endpoint to upload files.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Configure S3 Transfer Acceleration on the S3 bucket Use the S3 Accelerate endpoint to upload files.

Description: Amazon S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between a client and an S3 bucket. It utilizes Amazon CloudFront’s globally distributed edge locations to ingest data. As data arrives at an edge location, it is routed to Amazon S3 over an optimized network path. To leverage this feature, you must enable Transfer Acceleration on the S3 bucket and then explicitly use the special S3 Accelerate endpoint (e.g., bucketname.s3-accelerate.amazonaws.com) for all upload operations.
Why this fits: This option correctly identifies both the necessary configuration step (enabling Transfer Acceleration on the bucket) and the crucial operational step (using the S3 Accelerate endpoint). Using the standard S3 endpoint, even with Transfer Acceleration enabled on the bucket, will bypass the acceleration feature. This is the precise mechanism designed by AWS to accelerate uploads to S3, especially beneficial for users located far from the S3 bucket’s region.

Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html

QUESTION 25

A company is upgrading its critical web-based application. The application is hosted on Amazon EC2 instances that are part of an Auto Scaling group behind an Application Load Balancer (ALB). The company wants to test the new configurations with a specific amount of traffic before the company begins to route all traffic to the upgraded application.

How should a solutions architect design the architecture to meet these requirements?

A. Create a new launch template. Associate the new launch template with the Auto Scaling group- Attach the Auto Scaling group to the ALB. Distribute traffic by using redirect rules.
B. Create a new launch template. Create an additional Auto Scaling group. Associate the new launch template with the additional Auto Scaling group. Attach the additional Auto Scaling group to the ALB. Distribute traffic by using weighted target groups.
C. Create a new launch template. Create an additional Auto Scaling group, Associate the new launch template with the additional Auto Scaling group. Create an additional ALB. Attach the additional Auto Scaling group to the additional ALB. Use an Amazon Route 53 failover routing policy to route traffic.
D. Create a new launch template. Create an additional Auto Scaling group. Associate the new launch template with the additional Auto Scaling group. Create an additional ALB. Attach the additional Auto Scaling group to the additional ALB. Use an Amazon Route 53 weighted routing policy to route traffic.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Create a new launch template. Create an additional Auto Scaling group. Associate the new launch template with the additional Auto Scaling group. Attach the additional Auto Scaling group to the ALB. Distribute traffic by using weighted target groups.

Description: This strategy describes a classic canary deployment or blue/green deployment pattern using AWS Application Load Balancers (ALB) and Auto Scaling Groups (ASG). A "launch template" defines the configuration for EC2 instances. "Additional Auto Scaling group" allows for a separate, isolated deployment of a new application version. "Weighted target groups" enable the Application Load Balancer to distribute incoming traffic across multiple target groups (each potentially hosting a different version of the application) based on specified percentages.
Why this fits: This approach is ideal for introducing a new application version with minimal risk and no downtime.

New Version Isolation: Creating a new launch template and an additional Auto Scaling group ensures the new application version runs independently of the existing one. This prevents conflicts and allows for testing the new version in production alongside the old one.
Zero-Downtime Deployment: Attaching both the old and new ASGs to the same ALB maintains a single entry point for clients, preventing service disruption.
Controlled Rollout (Canary/Blue-Green): Weighted target groups are the key mechanism for a gradual rollout. Initially, 100% of traffic can go to the existing ASG’s target group. As confidence in the new version grows, a small percentage (e.g., 5-10%) can be shifted to the new ASG’s target group. This allows for monitoring the new version with a subset of users before committing to a full rollout.
Easy Rollback: If issues are detected with the new version, traffic weights can be instantly reverted to 100% on the old ASG’s target group, effectively rolling back the deployment without affecting users.

QUESTION 26

A company deployed a three-tier web application in a single Availability Zone in the us-east-I Region on a single Amazon EC2 instance. Usage of the application is growing A solutions architect needs to ensure that the application can handle the growing amount of traffic. The solutions architect also needs to ensure the application is resilient

Which solution will meet these requirements MOST cost-effectively?

A. Create two additional EC2 instance spread across two separate Availability Zones- Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all three instances, Create an Amazon CloudWatch alarm to scale the EC2 instances vertically to handle the application traffic.
B. Create eight additional EC2 instances spread across in three separate Availability Zones. Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all nine instances- Create an Amazon CloudWatch alarm to scale the EC2 instances honzontally to handle the application traffic.
C. Create an EC2 Auto Scaling group that contains a minimum of three EC2 instances in the same Availability Zone. Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all the instances. Configure scheduled scaling for the Auto Scaling group.
D. Create an EC2 Auto Scaling group that contains a minimum of three EC2 instances spread across Availability Zones. Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all the instances- Create an Amazon CloudWatch alarm to scale the EC2 instances horizontally to handle the application traffic

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Create an EC2 Auto Scaling group that contains a minimum of three EC2 instances spread across Availability Zones. Create an Application Load Balancer (ALB). Configure the ALB to route traffic to a target group that contains all the instances- Create an Amazon CloudWatch alarm to scale the EC2 instances horizontally to handle the application traffic

Description: This choice describes a robust, highly available, fault-tolerant, and scalable architecture for a web application on AWS. It leverages EC2 Auto Scaling Groups (ASG) for automatic instance management and scaling, Application Load Balancers (ALB) for traffic distribution, and Amazon CloudWatch for monitoring and dynamic scaling.
Why this fits:

EC2 Auto Scaling group (ASG): Essential for both horizontal scalability (adding or removing instances based on demand) and high availability (automatically replacing unhealthy instances or instances in a failing Availability Zone).
Minimum of three EC2 instances spread across Availability Zones: This ensures fault tolerance. If one Availability Zone experiences an outage, instances in other AZs can continue to serve traffic, maintaining application availability. A minimum of three instances provides redundancy beyond just two.
Application Load Balancer (ALB): Distributes incoming web traffic across multiple instances in the ASG. ALBs offer advanced routing features, SSL termination, and health checks, ensuring traffic is only sent to healthy instances.
Target Group: The ALB routes traffic to a target group, which registers the EC2 instances launched by the ASG.
Amazon CloudWatch alarm to scale the EC2 instances horizontally: This is the standard and most effective method for dynamic scaling. CloudWatch alarms monitor metrics (e.g., CPU utilization, request count per target) and trigger scaling policies (add or remove instances) within the ASG to match current traffic demands, ensuring optimal performance and cost efficiency. Horizontal scaling (adding/removing instances) is generally preferred over vertical scaling (changing instance types) for web applications needing to handle variable load.

Let’s briefly look at why other options are less suitable:

Choice A: Suggests vertical scaling (increasing instance size), which is less flexible and more disruptive than horizontal scaling for handling variable web traffic, and lacks the automatic instance management of an ASG.
Choice B: Implies manual creation of instances ("Create eight additional EC2 instances"), which misses the automation and self-healing benefits of an Auto Scaling Group, even if it aims for horizontal scaling with an alarm. An alarm without an ASG cannot automatically provision/de-provision instances.
Choice C: Places instances "in the same Availability Zone," which is a single point of failure and violates best practices for high availability on AWS. It also focuses on scheduled scaling, which is less responsive to real-time traffic fluctuations than metric-based scaling.

QUESTION 27

A company that uses AWS Organizations runs 150 applications across 30 different AWS accounts. The company used AWS Cost and Usage Report to create a new report in the management account. The report is delivered to an Amazon S3 bucket that is replicated to a bucket in the data collection account.

The company’s senior leadership wants to view a custom dashboard that provides NAT gateway costs each day starting at the beginning of the current month.

Which solution will meet these requirements?

A. Share an Amazon QuickSight dashboard that includes the requested table visual. Configure QuickSight to use AWS DataSync to query the new report.
B. Share an Amazon QuickSight dashboard that includes the requested table visual. Configure QuickSight to use Amazon Athena to query the new report.
C. Share an Amazon CloudWatch dashboard that includes the requested table visual. Configure CloudWatch to use AWS DataSync to query the new report.
D. Share an Amazon CloudWatch dashboard that includes the requested table visual. Configure CloudWatch to use Amazon Athena to query the new report.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Share an Amazon QuickSight dashboard that includes the requested table visual. Configure QuickSight to use Amazon Athena to query the new report.

Description: Amazon QuickSight is a serverless, cloud-native business intelligence (BI) service that allows users to create interactive dashboards and visualizations from various data sources. Amazon Athena is an interactive query service that makes it easy to analyze data directly in Amazon S3 using standard SQL.
Why this fits: This choice leverages the strengths of both services for a common data analytics pattern. QuickSight is the ideal service for creating and sharing dashboards with table visuals for reporting. Amazon Athena is a perfect choice for querying "new reports" or analytical data often stored in Amazon S3 data lakes because it is serverless, scales automatically, and uses standard SQL. QuickSight can easily connect to Athena as a data source to visualize the query results, fulfilling the requirement to create and share a report with a table visual.

QUESTION 28

A healthcare company is designing a system to store and manage logs in the AWS Cloud- The system ingests and stores logs that are in JSON format The logs contain sensitive patient informatiom The company must identify any sensitive data. The company must be able to search the log data by using SQL queries.

Which solution Will meet these requirements?

A. Store the logs in an Amazon S3 bucket. Configure Amazon Macie to discover sensitive data. Use Amazon Athena to query the logs.
B. Store the logs in an Amazon Elastic Block Store (Amazon EBS) volume. Create an application that uses Amazon SageMakerAl to detect sensitive data. Use Amazon RDS to query the logs.
C. Store the logs in Amazon DynamoDB, Use AWS Key Management Service (AWS KMS) to discover sensitive data. Use Amazon Redshift Spectrum to query the logs
D. Store the logs in an Amazon S3 bucket Use Amazon Inspector to discover sensitive data. Use Amazon Athena to query the logs.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Store the logs in an Amazon S3 bucket. Configure Amazon Macie to discover sensitive data. Use Amazon Athena to query the logs.

Description: This option proposes a well-architected solution for log management, sensitive data discovery, and analysis on AWS. Amazon S3 provides highly durable, scalable, and cost-effective object storage for logs. Amazon Macie is a fully managed data security and privacy service specifically designed to discover, classify, and protect sensitive data (like PII) stored in Amazon S3 using machine learning and pattern matching. Amazon Athena is an interactive query service that allows you to analyze data directly in S3 using standard SQL, making it ideal for querying large log files without loading them into a separate database.
Why this fits: This combination of services directly addresses all aspects of the implicit problem:

Log Storage: Amazon S3 is the industry standard for scalable, durable, and cost-effective log storage on AWS.
Discover Sensitive Data: Amazon Macie is the dedicated AWS service for discovering sensitive data within S3 objects, perfectly fitting this requirement.
Query Logs: Amazon Athena is a powerful and serverless service for querying data stored directly in S3 using SQL, making it highly efficient for log analysis.
The synergy between these services makes this the most appropriate and AWS-recommended solution.

Reference: https://aws.amazon.com/macie/

QUESTION 29

A company has two AWS applications that are connected by using an Amazon Simple Queue Service (Amazon SQS) FIFO queue. The sending application creates requests as SQS messages that the receiving application needs to process on a first-come, first-served basis.

Which solution will ensure the processing order?

A. Configure the receiving application to combine the sequence number with the message deduplication ID to process queued messages.
B. Configure the receiving application to process messages based on the message deduplication ID.
C. Configure the receiving application to read the message group ID to process queued messages.
D. Configure the receiving application to combine the message group ID and sequence number to process queued messages.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Configure the receiving application to read the message group ID to process queued messages.

Description: In Amazon SQS FIFO (First-In, First-Out) queues, the MessageGroupId is a tag that specifies that a message belongs to a specific message group. SQS FIFO queues guarantee strict ordering of messages within a message group. All messages sent with the same MessageGroupId are delivered to consumers in the exact order they were sent. Different message groups can be processed in parallel.
Why this fits: For an application to correctly process messages in order from an SQS FIFO queue, it must identify the MessageGroupId. The MessageGroupId is the fundamental mechanism that allows SQS to maintain message order and allows the application to understand which messages form an ordered sequence. While SQS also assigns a SequenceNumber to each message within a group, the receiving application’s primary concern for managing ordered streams is the MessageGroupId. SQS guarantees that messages from a given MessageGroupId are delivered in SequenceNumber order, so by reading the MessageGroupId, the application ensures it is processing messages belonging to the same ordered stream correctly.

QUESTION 30

A company deployed an application in two AWS Regions. If the application becomes unavailable in one Region, the application must fail over to the second Region. The failover process must avoid stale DNS client caches. The company wants to use one endpoint to access both copies of the application.

Which solution will meet these requirements?

A. Use an Amazon CloudFront distribution that has multiple origins. Correlate each origin with the application in each Region.
B. Use an Amazon Route 53 weighted routing policy that uses equal weights to route client requests to the second Region if the application becomes unavailable in the original Region.
C. Use AWS Global Accelerator, and assign a static anycast IP address to the application endpoint.
D. Use an Amazon Route 53 IP-based routing policy to route requests to the second Region if the application becomes unavailable in the original Region.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Use AWS Global Accelerator, and assign a static anycast IP address to the application endpoint.

Description: AWS Global Accelerator is a networking service that improves the availability and performance of your applications with global users. It provides two static anycast IP addresses that act as a fixed entry point to your application. Traffic from your users is routed to the nearest AWS edge location and then traverses the AWS global network backbone, which is optimized to avoid internet congestion, to reach the healthy application endpoint in the target AWS Region.
Why this fits: By using Global Accelerator with static anycast IP addresses, client connections always connect to the same static IP addresses, regardless of the application’s actual location or failover event. Global Accelerator automatically routes traffic to the nearest healthy application endpoint, leveraging the AWS global network for improved performance and automatically handling failover between regions without DNS propagation delays or client-side changes. This ensures high availability, fault tolerance, and optimal performance for a global user base.

Reference: https://aws.amazon.com/global-accelerator/

QUESTION 31

An insurance company is creating an application to record personal user data. The data includes name, age, and health data about users. The company wants to run the application in a private subnet on AWS.

Because of data security requirements, the company must have access to the operating system of the compute resource that run the application tier. The company must use a low-latency NoSQL database to store the data.

Which solution will meet these requirements?

A. Use Amazon EC2 instances for the application tier use an Amazon DynamoDB table for the database tier Create a VPC endpoint for DynamoDB. Assign the instances an instance profile that has permission to access DynamoDB.
B. Use AWS Lambda functions for the application tier use an Amazon DynamoDB table for the database tier. Assign a Lambda function an appropriate IAM role to access the table.
C. Use AWS Fargate for the application tier Create an Amazon Aurora PostgreSQL instance inside in a private subnet for the database tier
D. Use Amazon EC2 instances for the application tier, Use an Amazon S3 bucket to store the data in JSON format. Configure the application to use Amazon Athena to read and write the data to and from the S3 bucket.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Use Amazon EC2 instances for the application tier use an Amazon DynamoDB table for the database tier Create a VPC endpoint for DynamoDB. Assign the instances an instance profile that has permission to access DynamoDB.

Description: This solution proposes a common three-tier architecture leveraging Amazon EC2 for compute, Amazon DynamoDB for a NoSQL database, and robust security/networking practices with VPC endpoints and IAM instance profiles.
Why this fits:

Amazon EC2 instances for the application tier: EC2 provides scalable compute capacity, offering flexibility in instance types and operating systems to host the application logic. It’s a foundational service for many application deployments.
Amazon DynamoDB table for the database tier: DynamoDB is a fully managed, serverless NoSQL database service that delivers single-digit millisecond performance at any scale. It’s ideal for applications requiring high performance, scalability, and flexibility with schemaless data.
Create a VPC endpoint for DynamoDB: DynamoDB is a public service, but a VPC endpoint allows EC2 instances (especially those in private subnets) to connect to DynamoDB directly within the AWS network, bypassing the public internet. This enhances security, reduces latency, and keeps traffic within the customer’s VPC.
Assign the instances an instance profile that has permission to access DynamoDB: Using IAM instance profiles is the recommended and secure way to grant AWS permissions to EC2 instances. Instead of embedding credentials directly on the instances, the instance assumes a role with specific permissions (e.g., dynamodb:PutItem, dynamodb:GetItem), adhering to the principle of least privilege and improving security posture.

QUESTION 32

A company has an online gaming application that has TCP and UDP multiplayer gaming capabilities. The company uses Amazon Route 53 to point the application traffic to multiple Network Load Balancers (NLBs) in different AWS Regions. The company needs to improve application performance and decrease latency for the online game in preparation for user growth.

Which solution will meet these requirements?

A. Add an Amazon CloudFront distribution in front of the NLBs. Increase the Cache-Control: max-age parameter.
B. Replace the NLBs with Application Load Balancers (ALBS). Configure Route 53 to use latency-based routing.
C. Add AWS Global Accelerator in front of the NLBSs. Configure a Global Accelerator endpoint to use the correct listener ports.
D. Add an Amazon API Gateway endpoint behind the NLBs. Enable API caching. Override method caching for the different stages.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Add AWS Global Accelerator in front of the NLBs. Configure a Global Accelerator endpoint to use the correct listener ports.

Description: AWS Global Accelerator is a networking service that improves the availability and performance of your applications with local and global users. It uses the AWS global network to route user traffic to the nearest healthy endpoint, bypassing congested public internet paths. Global Accelerator provides static IP addresses that act as fixed entry points to your application endpoints, such as Application Load Balancers, Network Load Balancers, or EC2 instances, across one or multiple AWS regions. It is particularly effective for non-HTTP/S traffic and for improving performance by directing traffic over the optimized AWS backbone from the edge.
Why this fits: Network Load Balancers (NLBs) operate at Layer 4 (TCP/UDP). Global Accelerator is designed to work effectively with NLBs and other load balancers, directing user traffic over the highly optimized AWS global network infrastructure from an edge location closest to the user to the AWS region where the NLBs reside. This significantly reduces latency and improves performance for users around the world by minimizing their exposure to the unpredictable public internet. Configuring the correct listener ports ensures that Global Accelerator properly forwards traffic to the NLBs.

Reference: https://aws.amazon.com/global-accelerator/

QUESTION 33

A company is building a solution to provide customers with an API that accesses financial data. The API backend needs to compute tax data for each request. The company anticipates greater demand to access the data during the last 3 months of each year. A solutions architect needs to design a scalable solution that can meet the regular demand and the peak demand at the end of each year.

Which solution will meet these requirements?

A. Host the API on an Amazon EC2 instance that runs third-party software. Configure the EC2 instance to perform tax computations.
B. Deploy an Amazon API Gateway REST API Create an AWS Lambda function to perform tax computations. Integrate the Lambda function with the REST API
C. Create an Application Load Balancer (ALB) in front of two Amazon EC2 instances. Configure the EC2 instances to perform tax computations.
D. Deploy an Amazon API Gateway REST API. Configure an Amazon EC2 instance to perform tax computations. Integrate the EC2 instance with the REST API-

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Deploy an Amazon API Gateway REST API. Create an AWS Lambda function to perform tax computations. Integrate the Lambda function with the REST API.

Description: This architecture represents a fully serverless solution for building and hosting an API. Amazon API Gateway acts as the front door for incoming API requests, handling routing, security, and throttling. AWS Lambda is a serverless compute service that executes the backend code (in this case, tax computations) in response to API Gateway requests, without requiring any server provisioning or management.
Why this fits: This approach aligns perfectly with AWS best practices for building scalable, cost-effective, and low-maintenance APIs.

Serverless: Both API Gateway and Lambda are serverless, meaning AWS handles all the underlying infrastructure, patching, and scaling. This significantly reduces operational overhead.
Scalability: API Gateway and Lambda automatically scale to handle varying loads, from a few requests to millions, without manual intervention.
Cost-effectiveness: You only pay for the API calls processed by API Gateway and the compute time consumed by Lambda functions (per-request and per-duration), making it very cost-efficient for event-driven workloads, as there are no costs for idle servers.
Performance: Lambda functions can execute quickly, providing a responsive API.
This combination is a foundational pattern for modern cloud-native application development on AWS.

QUESTION 34

A company is building a new application API that will be used in multiple AWS Regions. The application will run by using a computer service in a private subnet behind a load balancer.

The company wants to expose the application API by using a limited number of static IP addresses. The application requires low latency.

Which solution will meet these requirements?

A. Deploy the application on an AWS Lambda function behind an Application Load Balancer (ALB) in multiple Regions. Configure Amazon Route 53 to use latency-based routing as the entry point
B. Deploy the application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in multiple Regions. Configure AWS Global Accelerator as the entry point
C. Deploy the application on an AWS Lambda function behind an Application Load Balancer (ALB) in multiple Regions. Configure Amazon Route 53 weighted routing Associate an AWS WAF web ACL with each ALB.
D. Deploy the application on Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB) in multiple Regions. Configure Amazon Route 53 to use latency-based routing as the entry point.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Deploy the application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in multiple Regions. Configure AWS Global Accelerator as the entry point

Description: This architecture involves deploying a web application on Amazon EC2 instances, which provide configurable compute capacity. These instances are managed by an Auto Scaling group to ensure high availability and automatic scaling based on demand, distributing traffic across multiple Availability Zones within a Region. An Application Load Balancer (ALB) distributes incoming application traffic to targets, such as EC2 instances, across multiple Availability Zones, offering advanced routing features at the application layer (Layer 7). Deploying this setup in multiple AWS Regions provides disaster recovery capabilities and brings the application closer to global users. AWS Global Accelerator is a networking service that improves the availability and performance of applications for a global audience by directing traffic to optimal endpoints over the AWS global network, providing static Anycast IP addresses.

Why this fits:

EC2 in Auto Scaling Group: Provides the necessary compute power for a web application, coupled with the automatic scaling, self-healing, and high availability benefits of Auto Scaling. This ensures the application can handle varying loads and recover from instance failures.
Application Load Balancer (ALB): Offers advanced, application-layer (Layer 7) routing capabilities suitable for HTTP/HTTPS web applications. It can route traffic based on URL path, host header, etc., and integrates well with EC2 Auto Scaling groups.
Multiple Regions: This is a crucial design for high availability and disaster recovery, ensuring the application remains accessible even if an entire AWS Region becomes unavailable. It also allows for bringing the application closer to different geographic user bases.
AWS Global Accelerator as the Entry Point: This is the key differentiator for global performance. While Route 53 can do latency-based routing, Global Accelerator goes a step further by using the AWS global network backbone to route traffic from the edge location nearest to the user directly to the application endpoints. This bypasses congested public internet routes, significantly reducing latency and jitter for global users. It also provides static Anycast IP addresses, which simplify client configuration and failover.

QUESTION 35

A company’s application runs on Amazon EC2 instances that are in multiple Availability Zones. The application needs to ingest real-time data from third-party applications.

The company needs a data ingestion solution that places the ingested raw data in an Amazon S3 bucket.

Which solution will meet these requirements?

A. Create Amazon Kinesis data streams for data ingestion. Create Amazon Kinesis Data Firehose delivery streams to consume the Kinesis data streams. Specify the S3 bucket as the destination of the delivery streams.
B. Create database migration tasks in AWS Database Migration Service (AWS DMS). Specify replication instances of the EC2 instances as the source endpoints. Specify the S3 bucket as the target endpoint. Set the migration type to migrate existing data and replicate ongoing changes.
C. Create and configure AWS Data-Sync agents on the EC2 instances. Configure DataSync tasks to transfer data from the EC2 instances to the S3 bucket.
D. Create an AWS Direct Connect connection to the application for data ingestion. Create Amazon Kinesis Data Firehose delivery streams to consume direct PUT operations from the application. Specify the S3 bucket as the destination of the delivery streams.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Create Amazon Kinesis data streams for data ingestion. Create Amazon Kinesis Data Firehose delivery streams to consume the Kinesis data streams. Specify the S3 bucket as the destination of the delivery streams.

Description: Amazon Kinesis Data Streams is a highly scalable and durable real-time data streaming service capable of continuous data ingestion from various sources (e.g., application logs, IoT telemetry). Amazon Kinesis Data Firehose is a fully managed service that delivers real-time streaming data to destinations like Amazon S3, Amazon Redshift, Amazon OpenSearch Service, and generic HTTP endpoints. Firehose can consume data directly from Kinesis Data Streams.
Why this fits: This solution provides a robust, scalable, and managed architecture for real-time data ingestion. Kinesis Data Streams can ingest data from applications continuously, ensuring high availability and durability. Kinesis Data Firehose then automatically consumes these streams, buffers, compresses, and delivers the data efficiently to an S3 bucket with minimal operational overhead, making it ideal for streaming data analytics and storage.

QUESTION 36

A company is storing data that will not be frequently accessed in the AWS Cloud. If the company needs to access the data, the data needs to be retrieved within 12 hours. The company wants a solution that is cost-effective for storage costs for each gigabyte.

Which Amazon S3 storage class will meet these requirements?

A. S3 Standard
B. S3 Glacier Flexible Retrieval
C. S3 One Zone-Infrequent Access (S3 One Zone-IA)
D. S3 Standard-Infrequent Access (S3 Standard-IA)

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ S3 Glacier Flexible Retrieval

Description: Amazon S3 Glacier Flexible Retrieval (formerly S3 Glacier) is an extremely low-cost storage class designed for data archiving where data is accessed infrequently, and retrieval times of minutes to hours are acceptable. It offers flexible retrieval options, allowing you to balance cost and speed for your archival needs. Data is redundantly stored across multiple Availability Zones, offering high durability.
Why this fits: This storage class is ideal for scenarios requiring highly durable, very low-cost long-term archival storage with infrequent access needs. If the implicit question scenario involves data that needs to be retained for compliance, auditing, or historical purposes for extended periods (e.g., years) and is rarely accessed, but needs to be retrieved within a few hours when access is required, S3 Glacier Flexible Retrieval provides the most cost-effective solution while meeting retrieval requirements. Other options like S3 Standard-IA or S3 One Zone-IA are more expensive for deep archives, and S3 Standard is not suitable for infrequent access due to its higher cost.

Reference: https://aws.amazon.com/s3/storage-classes/

QUESTION 37

A company runs several applications on Amazon EC2 instances. The company stores configuration files in an Amazon S3 bucket A solutions architect must provide the company’s applications with access to the configuration files. The solutions architect must follow AWS best practices for security.

Which solution will meet these requirements?

A. Use the AWS account root user access keys.
B. Use the AWS access key ID and the EC2 secret access key
C. Use an IAM role to grant the necessary permissions to the applications.
D. Activate mufti-factor authentication (MFA) and versioning on the S3 bucket

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Use an IAM role to grant the necessary permissions to the applications.

Description: An IAM (Identity and Access Management) role is an AWS identity that has permission policies determining what the identity can and cannot do in AWS. Unlike an IAM user, a role does not have standard long-term credentials (like a password or access keys) associated with it. Instead, you can assume a role, and it provides temporary security credentials for your session. When an IAM role is assigned to an EC2 instance, applications running on that instance can automatically assume the role and inherit its permissions without needing to store AWS credentials directly on the instance.
Why this fits: This is the AWS best practice for granting permissions to applications running on EC2 instances. It ensures that applications do not need to store static AWS credentials (access keys and secret keys) on the instance, which significantly reduces the security risk of credential compromise. Instead, the applications receive temporary, frequently rotated credentials managed by the EC2 instance metadata service, adhering to the principle of least privilege and improving overall security posture.

QUESTION 38

A company is building a serverless application that processes large volumes of data from a mobile app. The application uses an AWS Lambda function to process the data and store the data in an Amazon DynamoDB table.

The company needs to ensure that the application can recover from failures and continue processing data without losing any records,

Which solution will meet these requirements?

A. Configure the Lambda function to use a dead-letter queue with an Amazon Simple Queue Service (Amazon SQS) queue. Configure Lambda to retry failed records from the dead-letter queue. Use a retry mechanism by implementing an exponential backoff algorithm.
B. Configure the Lambda function to read records from Amazon Data Firehose. Replay the Firehose records in case of any failures.
C. Use Amazon OpenSearch Service to store failed records. Configure AWS Lambda to retry failed records from OpenSearch Service. Use Amazon Event Bridge to orchestrate the retry logic.
D. Use Amazon Simple Notification Service (Amazon SNS) to store the failed records- Configure Lambda to retry failed records from the SNS topic- Use Amazon API Gateway to orchestrate the retry calls-

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Configure the Lambda function to use a dead-letter queue with an Amazon Simple Queue Service (Amazon SQS) queue. Configure Lambda to retry failed records from the dead-letter queue. Use a retry mechanism by implementing an exponential backoff algorithm.

Description: This choice outlines a robust, fault-tolerant error handling and retry strategy for AWS Lambda. A Dead-Letter Queue (DLQ) is a queue where Amazon Lambda sends events that it can’t process successfully after the maximum number of retries. Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications, making it an ideal choice for a DLQ. Exponential backoff is a standard strategy for retrying failed operations by progressively increasing the wait time between retries, which helps prevent overwhelming a temporarily unavailable service and reduces the chance of consecutive failures during a transient issue.
Why this fits: This solution directly addresses the need for reliable processing and robust error handling in serverless applications.

Dead-Letter Queue (DLQ) with SQS: Using an SQS queue as a DLQ ensures that any messages or events that fail to process successfully (even after Lambda’s built-in retries) are not lost. They are stored durably in the SQS queue, allowing for later inspection, analysis, or re-processing. This is a best practice for serverless error handling, guaranteeing data persistence even in the face of application or downstream service failures.
Retrying from the DLQ: The ability to retry failed records from the DLQ means that transient issues (e.g., temporary database unavailability, third-party API throttling) can be recovered from without manual intervention. A separate process (e.g., another Lambda function, a scheduled task) can consume messages from the DLQ and re-invoke the original (or a modified) processing logic.
Exponential Backoff Algorithm: Implementing exponential backoff is crucial for effective retry mechanisms. Instead of hammering a failing service repeatedly, which can exacerbate the problem, exponential backoff introduces increasing delays between retries. This gives the downstream service time to recover and prevents a "thundering herd" problem, improving the overall resilience of the system.
This combination provides a comprehensive and AWS-idiomatic solution for building highly available and fault-tolerant serverless architectures.

QUESTION 39

A company runs a backend service on Amazon EC2 instances that run Amazon Linux. The backend service depends on JSON documents that contain sensitive information, such as API keys stored locally on the file system of each instance.

A solutions architect needs to design a solution that stores this information securely the solution must provide rote-based and finance grained access to individual API keys. The company’s compliance policy requires that all sensitive information is available in more than one AWS Region.

Which solution will meet these requirements?

A. Mount the EC2 instance to an Amazon Elastic File System (Amazon EFS) file system distributed across two or more Availability Zones. Enable encryption of data at rest and data in transit
B. Transfer the documents to an Amazon DocumentDB database. Modify the backend service to read the secrets from the DocumentDB database.
C. Create individual secrets that contain each API key in AWS Secrets Manager Modify the backend service to read the secrets from Secrets Manager Replicate the secrets to another Region.
D. Copy the documents to an Amazon S3 bucket that has client-side encryption enabled. Modify the backend service to read the secrets from the S3 bucket Enable S3 Cross-Region Replication (CRR) on the S3 bucket

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Create individual secrets that contain each API key in AWS Secrets Manager Modify the backend service to read the secrets from Secrets Manager Replicate the secrets to another Region.

Description: AWS Secrets Manager is a fully managed service that helps you protect access to your applications, services, and IT resources. It enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. Secrets Manager encrypts secrets at rest and in transit, provides fine-grained access control via IAM, and integrates with AWS CloudTrail for auditing. It also supports automatic cross-region replication of secrets for disaster recovery and multi-region application architectures.
Why this fits: This solution directly addresses the best practice for managing sensitive API keys. Secrets Manager is purpose-built for securely storing, retrieving, and rotating such credentials. Modifying the backend service to retrieve secrets from Secrets Manager ensures that the application doesn’t hardcode sensitive information. Replicating the secrets to another region provides high availability and disaster recovery for the secrets themselves, which is crucial for a robust application architecture, aligning perfectly with the requirements of a Solutions Architect.

QUESTION 40

An events company has deployed a web application on Amazon Elastic Kubernetes Service (Amazon EKS). The application uses an Amazon DynamoDB table. The company has provisioned 1 ,000 read capacity units (RCUs) and 500 write capacity units (WCUs) for the DynamoDB table. The application performs eventually consistent reads against the table.

The application’s traffic is often low but it occasionally grows significantly During these sudden increases in traffic, DynamoDB returns throttling errors. The result is that error pages are displayed to end users.

What should a solutions architect do to reduce these errors?

A. Change the DynamoDB table to use on-command capacity mode.
B. Create a DynamoDB read replica to scale the read traffic horizontally
C. Purchase DynamoDB reserved capacity of 1 ,000 RCUs and 500 WCUs-
D. Configure the application to use strongly consistent reads for DynamoDB queries.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Change the DynamoDB table to use on-demand capacity mode.

Description: DynamoDB on-demand capacity mode allows you to pay per request for reads and writes, eliminating the need to specify provisioned throughput. DynamoDB automatically scales capacity up or down to accommodate your workload’s traffic, instantly adapting to sudden spikes and drops.
Why this fits: This mode is ideal for applications with unpredictable traffic patterns, sudden bursts, or highly variable workloads, where manually provisioning capacity (even with auto-scaling) can be complex, lead to throttling during peak times, or result in over-provisioning and wasted costs during off-peak times. By switching to on-demand, the application can handle fluctuating loads without manual intervention or pre-configuration, simplifying operational overhead and optimizing costs for non-steady-state workloads.

QUESTION 41

A company is building a data analysis platform on AWS by using AWS Lake Formation. The platform will ingest data from different sources such as Amazon S3 and Amazon RDS. The company needs a secure solution to prevent access to operations of the data that contain sensitive information.

Which solution will meet these requirements with the LEAST overhead?

A. Create an IAM role that includes permissions to access Lake Formation tables.
B. Create data fitters to implement row-level security and cell-level security.
C. Create an AWS Lambda function that removes sensitive information before Lake Formation ingests the data.
D. Create an AWS Lambda function that periodically queries and removes sensitive information from Lake Formation tables.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Create data filters to implement row-level security and cell-level security.

Description: AWS Lake Formation utilizes data filters as a core mechanism to implement fine-grained access control, including row-level security (RLS) and cell-level security (CLS). A data filter is a named resource that defines a subset of a table’s data based on a row filter expression (e.g., WHERE region = 'us-east-1') and/or a column filter (specifying which columns are accessible). These filters are then granted to specific principals (IAM users or roles) or groups, allowing them to see only the data that matches the filter’s criteria when querying the table.
Why this fits: For an AWS Certified Solutions Architect – Associate exam, understanding Lake Formation’s capabilities for data governance is crucial. Implementing row-level and cell-level security directly maps to Lake Formation’s data filter feature. This approach ensures that sensitive data remains within the Lake Formation table but is selectively visible to users based on their granted permissions and the defined data filters, without needing to create multiple copies of the data or pre-process it outside Lake Formation’s control plane. Choices A is a prerequisite but not the mechanism for RLS/CLS. Choices C and D involve data modification via Lambda, which is not Lake Formation’s native method for fine-grained access control but rather a data transformation or cleansing step.

QUESTION 42

A company is building an application. The application is composed of multiple microservices that communicate over HTTP To comply with disaster recovery requirements, the company must deploy the application across multiple AWS Regions. The application must maintain high availability and automatic fault recovery

Which solution will meet these requirements?

A. Deploy all microservices on a single large Amazon EC2 instance in one Region to simplify communication and reduce latency
B. Use AWS Fargate to run each microservice in separate containers. Deploy the containers across multiple Availability Zones in a single Region behind an Application Load Balancer.
C. Use Amazon Route 53 with latency-based routing. Deploy the microservices on Amazon EC2 instances in multiple Regions behind Application Load Balancers.
D. Implement each microservice by using AWS Lambda functions. Expose the microservices by using an Amazon API Gateway REST API.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Use Amazon Route 53 with latency-based routing. Deploy the microservices on Amazon EC2 instances in multiple Regions behind Application Load Balancers.

Description: This approach leverages Amazon Route 53’s latency-based routing policy to direct users to the AWS Region that provides the lowest latency from their geographic location. Within each chosen AWS Region, microservices are deployed on Amazon EC2 instances, distributing incoming traffic via Application Load Balancers (ALBs). Deploying across multiple Regions offers superior fault tolerance, disaster recovery capabilities, and enhanced global performance compared to a single-Region deployment.
Why this fits: This solution is highly robust and aligned with best practices for a globally distributed, highly available, and fault-tolerant microservices architecture.

Latency-Based Routing (Route 53): Optimizes the user experience by directing traffic to the AWS Region that offers the quickest response time, crucial for global applications.
Multiple Regions: Provides the highest level of fault tolerance. If an entire AWS Region becomes unavailable, the application remains accessible from other operational Regions, ensuring business continuity and disaster recovery.
Application Load Balancers (ALBs): Distribute incoming application traffic across multiple EC2 instances within a Region, ensuring high availability, scalability, and health checks for the microservices in that Region.
Amazon EC2 Instances: Offer granular control over the compute environment for microservices, allowing for customized runtime environments if needed.

The combination of these services addresses key architectural pillars such as high availability, fault tolerance, and performance optimization for a microservices-based application.

QUESTION 43

A company hosts a website on Amazon EC2 instances that run Amazon Linux. The instances are behind an Application Load Balancer (ALB) and are part of an Auto Scaling group. Each instance uses Amazon Elastic Block Store (Amazon EBS) volumes to store product manuals.

New instances often have outdated data The new instances occasionally take up to 30 minutes to receive updates from an external source. The company must ensure that all instances have up-to-date product manuals. The company needs a solution that can adapt quickly to increased demand. The solution must not require modifications for the application code

Which solution will meet these requirements?

A. Store the product manuals on instance store volumes that are attached to each EC2 instance.
B. Store the product manuals in an Amazon S3 bucket. Configure the EC2 instances to download updates from the S3 bucket
C. Store the product manuals in an Amazon Elastic File System (Amazon EFS) volume. Mount the EFS volume on the EC2 instances.
D. Store the product manuals in an Amazon S3 bucket. Use the S3 Standard-InfrequentAccess (S3 Standard-IA) storage class. Configure the EC2 instances to download updates from the S3 bucket

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Store the product manuals in an Amazon Elastic File System (Amazon EFS) volume. Mount the EFS volume on the EC2 instances.

Description: Amazon Elastic File System (EFS) provides a simple, scalable, elastic, shared, NFS (Network File System) file storage service for use with AWS cloud services and on-premises resources. It is designed to provide shared file system access to multiple EC2 instances concurrently. EFS is a fully managed service that automatically grows and shrinks as you add and remove files, and it offers high availability and durability.
Why this fits: The core requirement implied by "product manuals" that likely need to be accessible by "EC2 instances" is shared, concurrent file-level access. EFS is specifically designed for this use case, allowing multiple EC2 instances to mount the same file system and read from or write to the same files simultaneously. This eliminates the need to duplicate data on each instance or manage complex synchronization logic, making it ideal for centralized content or data that needs to be accessed and potentially updated by a fleet of instances. Instance store (Choice A) is ephemeral and not shared. S3 (Choices B and D) is object storage, not a file system, and while it can store data, it does not provide the same concurrent file system semantics as EFS, making operations like direct file edits or granular updates across multiple instances more complex.

QUESTION 44

A company is running a mission-critical application on Amazon EC2 instances behind an Application Load Balancer The instances run in an Auto Scaling group in a single AWS Region. The application is using a database in Amazon Aurora as the data tier A recent audit revealed that the current deployment of Aurora is not highly available.

What should a solutions architect do to improve the availability of the database?

A. Configure an Aurora Replica.
B. Configure storage replication.
C. Configure storage auto scaling.
D. Configure cross-Region replication.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Configure an Aurora Replica.

Description: An Amazon Aurora Replica is a standalone endpoint in the same AWS Region as the primary instance, or in a different Region (Global Database replica), that provides an exact copy of the data from the primary instance. Aurora Replicas are designed for high-performance read scaling and high availability. They can serve read-only traffic, reducing the load on the primary instance, and can be promoted to become the new primary instance in case of a primary instance failure, enabling fast failover.
Why this fits: For an AWS Certified Solutions Architect – Associate, understanding how to scale and provide high availability for databases is crucial. Aurora Replicas are the primary mechanism within Amazon Aurora to achieve read scalability, distribute query load, and enhance fault tolerance and high availability by allowing failover to a replica. They are a fundamental building block for resilient and performant Aurora deployments.

QUESTION 45

A solutions architect needs to design a new microservice for a company’s application. Clients must be able to call an HTTPS endpoint to reach the microservice. The microservice also must use AWS Identity and Access Management (IAM) to authenticate calls. The solutions architect will write the logic for this microservice by using a single AWS Lambda function that is written in Go 1.x.

Which solution will deploy the function in the MOST operationally efficient way?

A. Create an Amazon API Gateway REST API. Configure the method to use the Lambda function. Enable IAM authentication on the API.
B. Create a Lambda function URL for the function. Specify AWS_IAM as the authentication type.
C. Create an Amazon CloudFront distribution. Deploy the function to Lambda Edge. Integrate IAM authentication logic into the Lambda Edge function.
D. Create an Amazon CloudFront distribution. Deploy the function to CloudFront Functions. Specify AWS_IAM as the authentication type.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Create an Amazon API Gateway REST API. Configure the method to use the Lambda function. Enable IAM authentication on the API.

Description: Amazon API Gateway allows developers to create, publish, maintain, monitor, and secure APIs at any scale. It acts as a "front door" for applications to access data, business logic, or functionality from backend services, such as AWS Lambda functions. API Gateway natively supports various authentication mechanisms, including AWS Identity and Access Management (IAM) for securing API endpoints.
Why this fits: This is the standard and most robust solution for exposing an AWS Lambda function as an HTTP/S endpoint and securing it using AWS IAM authentication. By creating an API Gateway REST API, configuring it to integrate with the Lambda function, and then enabling IAM authentication on the API method, callers (AWS users or roles) must sign their API requests with AWS SigV4 credentials. API Gateway handles the authentication and authorization based on IAM policies attached to the calling identity, ensuring that only authorized AWS identities can invoke the Lambda function. This approach is highly scalable, secure, and provides features like throttling, caching, and custom domain names.

QUESTION 46

A solutions architect has designed an application that gives users the ability to access images that are stored in an Amazon S3 bucket. The application uses an Amazon EC2 instance hosted in a private VPC that has a VPC ID of vpc-11aabb22. The solutions architect enabled the block public access feature on the S3 bucket. The bucket is hosted in the us-west-2 Region of account 123456789012.

The solutions architect needs to ensure that only resources within the VPC that hosts the EC2 instance can access the S3 bucket.

Which solution will meet this requirement?

A. Create an S3 bucket policy statement that has a Deny effect and a Condition that includes "StringNotEquals": {"aws:SourceVpc" : "vpc-11aabb22"}.
B. Create an S3 bucket policy statement that has an Allow effect and a Resource of "arn:aws:ec2:us-west-2:123456789012: vpc/vpc-11aabb22".
C. Create an S3 bucket policy statement that has an Allow effect and a Condition that includes "StringNotEquals": {"aws:SourceVpc" : "vpc-11aabb22"}.
D. Create an S3 bucket policy statement that has a Deny effect and a Condition that includes "StringNotEquals": {"aws:PrincipalAccount" :"123456789012"}.<br />

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Create an S3 bucket policy statement that has a Deny effect and a Condition that includes "StringNotEquals": {"aws:SourceVpc" : "vpc-11aabb22"}.

Description: This choice describes an S3 bucket policy statement designed to restrict access. It uses a Deny effect, which explicitly forbids actions, and a condition that evaluates the aws:SourceVpc global condition key. The StringNotEquals operator in the condition means the policy will apply when the source VPC of the request does not match vpc-11aabb22.
Why this fits: This is the most secure and effective way to restrict S3 bucket access to a specific VPC.

Deny Effect: Deny statements in IAM policies always override Allow statements. By explicitly denying access to requests that do not originate from the specified VPC, you ensure that only requests from that VPC can access the bucket (assuming there are no other conflicting Deny policies).
aws:SourceVpc Condition Key: This global condition key is used to evaluate the VPC ID from which an AWS request originates. It is the correct key to use when restricting access based on the source VPC.
StringNotEquals Operator: When combined with a Deny effect, StringNotEquals: {"aws:SourceVpc" : "vpc-11aabb22"} effectively means "deny access if the source VPC is not vpc-11aabb22." This implicitly allows access only if the source VPC is vpc-11aabb22. This "Deny everything else" approach is a robust security pattern for access control.

QUESTION 47 (Multi-Select)

A company runs several Amazon RDS for Oracle On-Demand DB instances that have high utilization, The RDS DB instances run in member accounts that are in an organization in AWS Organizations,

The company’s finance team has access to the organization’s management account and member accounts. The finance team wants to find ways to optimize costs by using AWS Trusted Advisor

Which combination of steps will meet these requirements? (Select TWO)

A. Use the Trusted Advisor recommendations in the management account.
B. Use the Trusted Advisor recommendations in the member accounts where the RDS DB instances are running.
C. Review the Trusted Advisor checks for Amazon RDS Reserved Instance Optimization.
D. Review the Trusted Advisor checks for Amazon RDS Idle DB Instances.
E. Review the Trusted Advisor checks for compute optimization. Crosscheck the results by using AWS Compute Optimizer.

Click to View Verified Solution & Explanation

Correct Option: A,C

Explanation: ✅ Choice A: Use the Trusted Advisor recommendations in the management account.

Description: In an AWS Organizations setup, the management account (formerly master account) provides a consolidated view of billing and service usage across all member accounts. When AWS Business, Enterprise On-Ramp, or Enterprise Support plans are active, Trusted Advisor checks can be accessed and reviewed from the management account, offering an aggregated perspective across the entire organization.
Why this fits: For comprehensive cost optimization, especially in an AWS Organizations environment, reviewing Trusted Advisor recommendations from the management account allows for a centralized and consolidated view of potential savings across all member accounts. This is essential for identifying organization-wide optimization opportunities without needing to log into individual member accounts.

✅ Choice C: Review the Trusted Advisor checks for Amazon RDS Reserved Instance Optimization.

Description: AWS Trusted Advisor includes specific checks under the "Cost Optimization" category. One such check is dedicated to "Reserved Instance Optimization," which identifies opportunities to save money by purchasing Reserved Instances (RIs) or highlights underutilized RIs for services like Amazon RDS.
Why this fits: The core objective is often RDS cost optimization. Trusted Advisor’s specific check for "Amazon RDS Reserved Instance Optimization" directly addresses a significant cost-saving strategy for relational databases. By reviewing this particular check, an architect can quickly identify if current RDS instances could benefit from RI purchases or if existing RIs are not being fully utilized, leading to direct cost savings.

QUESTION 48

A company is building a data processing application that uses AWS Lambda functions. The application’s Lambda functions need to communicate with an Amazon RDS DB instance that is deployed within a VPC in the same AWS account.

Which solution meets these requirements in the MOST secure way?

A. Configure the DB instance to allow public access. Update the DB instance security group to allow access from the Lambda public address space for the AWS Region.
B. Deploy the Lambda functions inside the VPC. Attach a network ACL to the Lambda subnet Provide outbound rule access to the VPC CIDR range only Update the DB instance security group to allow traffic from.
C. Deploy the Lambda functions inside the VPC. Attach a security group to the Lambda functions. Provide outbound rule access to the VPC CIDR range only Update the DB instance security group to allow traffic from the Lambda security group.
D. Peer the Lambda default VPC With the VPC that hosts the DB instance to allow direct network access without the need for security groups

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Deploy the Lambda functions inside the VPC. Attach a security group to the Lambda functions. Provide outbound rule access to the VPC CIDR range only Update the DB instance security group to allow traffic from the Lambda security group.

Description: This solution involves configuring the Lambda function to operate within the same Amazon Virtual Private Cloud (VPC) as the RDS DB instance. It then assigns a security group to the Lambda function’s Elastic Network Interfaces (ENIs) for granular outbound control. Crucially, the inbound rules of the RDS DB instance’s security group are updated to explicitly allow traffic originating only from the security group associated with the Lambda functions.
Why this fits: This is the MOST secure approach for several reasons:

Private Connectivity: By deploying Lambda functions inside the VPC, they receive private IP addresses and can communicate directly with other private resources within the VPC (like RDS) without traversing the public internet. This significantly reduces the attack surface.
Security Groups (Stateful Firewall): Security groups act as a stateful firewall at the ENI/instance level.
- The Lambda function’s security group controls its outbound traffic, ensuring it can only initiate connections to resources within the VPC CIDR (or more specific targets).
- The RDS DB instance’s security group controls its inbound traffic.
Security Group Referencing: The key security advantage is allowing the RDS security group to accept inbound connections from the Lambda security group. This means that any resource (in this case, the Lambda ENIs) associated with the specified Lambda security group can connect to RDS. This approach is highly secure because:
- It doesn’t rely on specific IP addresses (which can change) but rather on the logical identity of the security group.
- It adheres to the principle of least privilege, allowing only authorized components to connect.
- Traffic is implicitly allowed to return from RDS to Lambda because security groups are stateful.

QUESTION 49

A company uses Amazon Route 53 as its DNS provider The company hosts a website both on premises and in the AWS Cloud. The company’s on-premises data center is near the us- west-I Region. The company hosts the website on AWS in the EU-central-l Region.

The company wants to optimize load times for the website as much as possible.

Which solution will meet these requirements?

A. Create a DNS record with a failover routing policy that routes all primary traffic to EU-central-l. Configure the routing policy to use the on-premises data center as the secondary location.
B. Create a DNS record with an IP-based routing policy Configure specific IP ranges to return the value for the EU-central-l website- Configure all other IP ranges to return the value for the on-premises website.
C. Create a DNS record with a latency-based routing policy Associate the record for the on-premises data center with us-west1
D. Create a DNS record with a weighted routing policy- Split the traffic evenly between EU-central-l and the on-premises data center

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Create a DNS record with a latency-based routing policy. Associate the record for the on-premises data center with us-west-1.

Description: Latency-based routing policy in Amazon Route 53 directs end-user requests to the AWS region that provides the lowest network latency for the user. Route 53 maintains a global latency database to make these decisions. For non-AWS resources (like an on-premises data center), you can associate the record with the closest AWS region. Route 53 then uses its latency measurements to that associated AWS region as a proxy for the latency to your on-premises resource.
Why this fits: This policy is explicitly designed to optimize user experience by directing traffic to the endpoint that offers the lowest network latency. By associating the on-premises data center with an AWS region (like us-west-1), Route 53 can effectively include it in its global latency calculations alongside AWS regions (like EU-central-1). This ensures that users are routed to whichever location (the AWS region or the on-premises data center) provides the fastest response time from their perspective, without requiring manual IP-to-location mapping or relying on failover scenarios.

Reference: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html#routing-policy-latency

QUESTION 50

A company wants to protect resources that the company hosts on AWS, including Application Load Balancers and Amazon CloudFront distributions. The company wants an AWS service that can provide near real-time visibility into attacks on the company’s resources. The service must also have a dedicated AWS team to assist with (DDoS) attacks.

Which AWS service will meet these requirements?

A. AWS WAF
B. AWS Shield Standard
C. Amazon Macie
D. AWS Shield Advanced

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ AWS Shield Advanced

Description: AWS Shield Advanced is a paid, managed DDoS protection service that provides enhanced safeguards for applications running on AWS. It offers increased protection against larger and more sophisticated distributed denial-of-service (DDoS) attacks compared to AWS Shield Standard. Key benefits include always-on detection and automatic inline mitigations, access to the 24/7 AWS DDoS Response Team (DRT), and most notably, DDoS cost protection.
Why this fits: In an SAA-C03 context, when a question implies the need for comprehensive protection against advanced DDoS attacks, proactive incident response from AWS experts, and financial guarantees against potential scaling costs incurred during an attack, AWS Shield Advanced is the definitive solution. The "cost protection" feature, which covers increased usage costs from services like EC2, ELB, CloudFront, and Route 53 due to a DDoS event, is a unique and significant differentiator of Shield Advanced over Shield Standard and other AWS security services like WAF. WAF, while useful, focuses on web application exploits at Layer 7 and doesn’t offer the same broad DDoS protection or cost guarantees. Amazon Macie is for data discovery and protection, unrelated to DDoS.

QUESTION 51

A company runs Amazon EC2 instances as web servers- Peak traffic load occurs on the web server at two consistent times each day. The web servers are idle for the remainder of the day.

A solutions architect needs to manage the web servers and maintain fault tolerance.

Which solution will meet these requirements in the MOST cost-effective way?

A. Use an EC2 Auto Scaling group to scale the instances based on demand.
B. Purchase Reserved Instances to ensure peak capacity at all times.
C. Use a corn job to stop the EC2 instances when the traffic demand is low.
D. Use a script to vertically scale the EC2 instances during peak traffic demand.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Use an EC2 Auto Scaling group to scale the instances based on demand.

Description: An EC2 Auto Scaling group (ASG) allows you to maintain application availability and automatically adjust the number of Amazon EC2 instances in your group up or down according to conditions you define, such as CPU utilization or network I/O. It enables horizontal scaling by adding or removing instances to match changes in demand.
Why this fits: This choice directly addresses the need to scale EC2 instances based on demand. When traffic demand increases, the ASG can automatically launch more instances to handle the load. Conversely, when demand decreases, it can terminate instances, thereby optimizing costs by only running the necessary resources. This is a core best practice for building elastic, cost-effective, and highly available applications on AWS.

QUESTION 52

A media company needs to migrate its Windows-based video editing environment to AWS. The company’s current environment processes 4K Video files that require sustained throughput of 2 GB per second across multiple concurrent users.

The company’s storage needs increase by 1 TB each week, The company needs a shared file system that supports SMB protocol and can scale automatically based on storage demands.

Which solution will meet these requirements?

A. Deploy an Amazon FSx for Windows File Server Multi-AZ file system with SSD storage.
B. Deploy an Amazon Elastic File System (Amazon EFS) file system in Max 1/0 mode. Provision mount targets in multiple Availability Zones.
C. Deploy an Amazon FSx for Luster file system with a Persistent 2 deployment type. Provision the file system with 2 TB of storage.
D. Deploy Amazon S3 File Gateway by using multiple cached gateway instances. Configure S3 Transfer Acceleration

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Deploy an Amazon FSx for Windows File Server Multi-AZ file system with SSD storage.

Description: Amazon FSx for Windows File Server provides a fully managed, highly reliable, and scalable file storage that is accessible via the Server Message Block (SMB) protocol. It is built on native Windows Server and offers full compatibility with Windows applications and services. A Multi-AZ deployment automatically replicates data synchronously across two Availability Zones (AZs) and provides automatic failover, ensuring high availability and durability. SSD storage options deliver high performance, low latency, and high IOPS, suitable for demanding workloads.
Why this fits: This solution is ideal for scenarios requiring shared file storage for Windows-based applications with high performance, high availability, and native SMB protocol support. The Multi-AZ deployment ensures business continuity by protecting against AZ failures, while SSD storage meets the low-latency and high-throughput demands of critical applications. It offers a fully managed service experience, reducing operational overhead.

QUESTION 53 (Multi-Select)

A company runs an application as a task in an Amazon Elastic Container Service (Amazon ECS) cluster The application must have read and write access to a specific group of Amazon S3 buckets. The S3 buckets are in the same AWS Region and AWS account as the ECS cluster. The company needs to grant the application access to the S3 buckets according to the principle of least privilege.

Which combination of solutions will meet these requirements? (Select TWO)

A. Add a tag to each bucket Create an IAM policy that includes a String Equals condition that matches the tags and values of the buckets.
B. Create an IAM policy that lists the full Amazon Resource Name (ARN) for each S3 bucket.
C. Attach the IAM policy to the instance role of the ECS task.
D. Create an IAM policy that includes a wildcard Amazon Resource Name (ARN) that matches all combinations of the S3 bucket names.
E. Attach the IAM policy to the task role of the ECS task.

Click to View Verified Solution & Explanation

Correct Option: B,E

Explanation: ✅ Create an IAM policy that lists the full Amazon Resource Name (ARN) for each S3 bucket.

Description: An AWS Identity and Access Management (IAM) policy uses JSON to define permissions. To grant access to specific S3 buckets, the Resource element in the policy statement must explicitly list the full Amazon Resource Names (ARNs) of those buckets. This practice adheres to the principle of least privilege, ensuring that access is granted only to the necessary resources.
Why this fits: When an application requires access to a limited, specific set of S3 buckets, explicitly listing their ARNs within the IAM policy is the most secure and precise method. This prevents the application from inadvertently or maliciously accessing other S3 buckets it is not authorized for.

✅ Attach the IAM policy to the task role of the ECS task.

Description: In Amazon Elastic Container Service (ECS), a task role is an IAM role that you can associate with an ECS task definition. When a task is launched with a task role, the containers within that task automatically assume the permissions defined by that role. This allows the application running in the containers to make authenticated API requests to AWS services (like S3) without requiring embedded credentials.
Why this fits: Attaching the IAM policy (which defines the S3 bucket access) to the ECS task’s task role is the recommended and most secure way to grant permissions to containerized applications running in ECS. This ensures that only the specific task requiring S3 access receives those permissions, adhering to the principle of least privilege and providing proper isolation between tasks. Attaching it to an instance role (Choice C) would grant permissions to all tasks on the host, which is less secure.

QUESTION 54

A company runs a custom application on Amazon EC2 On-Demand Instances. The application has frontend nodes that need to run 24 hours a day, 7 days a week The application has backend nodes that need to run only for a short time based on the workload The frontend nodes accept jobs and place the jobs in queues. The backend nodes process jobs from the queues. Job processing is asynchronous and can be restarted. The company wants to scale its infrastructure based on workload

Which solution will meet these requirements MOST cost-effectively?

A. Use Reserved Instances for the frontend nodes. Use AWS Fargate for the backend nodes.
B. Use Reserved Instances for the frontend nodes. Use Spot Instances for the backend nodes.
C. Use Spot Instances for the frontend nodes. Use Reserved Instances for the backend nodes.
D. Use Spot Instances for the frontend nodes. Use AWS Fargate for the backend nodes.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Choice B: Use Reserved Instances for the frontend nodes. Use Spot Instances for the backend nodes.

Description:

Reserved Instances (RIs): A billing discount applied to the use of On-Demand Instances in your account. They are purchased for a 1-year or 3-year term with potential savings of up to 75% compared to On-Demand pricing. RIs are suitable for applications with predictable, steady-state usage.
Spot Instances: Enable you to bid on unused EC2 capacity and can provide savings of up to 90% compared to On-Demand prices. However, Spot Instances can be interrupted by AWS with a two-minute warning if AWS needs the capacity back. They are ideal for fault-tolerant, flexible, and stateless applications, or workloads that can tolerate interruptions.
Why this fits: This choice represents a highly effective and common cost-optimization strategy for many multi-tier applications.
Frontend nodes are typically user-facing, require consistent availability, and often have predictable usage patterns. Using Reserved Instances for these ensures cost predictability and high availability at a significant discount for the committed term, which is crucial for a good user experience.
Backend nodes often handle internal processing, data manipulation, or asynchronous tasks. If these workloads are designed to be fault-tolerant (e.g., stateless microservices, batch jobs that can resume, containerized applications, or processes that can re-process requests), using Spot Instances can drastically reduce costs. This strategy leverages the maximum cost savings of Spot Instances for components that can tolerate interruption while securing predictable costs and high availability for the critical, user-facing parts of the application.

QUESTION 55

A company is planning to deploy a managed MySQL database solution for its non-production applications. The company plans to run the system for several years on AWS

Which solution will meet these requirements MOST cost-effectively?

A. Create an Amazon RDS for MySQL instance. Purchase a Reserved Instance.
B. Create an Amazon RDS for MySQL instance. Use the instance on an on-demand basis.
C. Create an Amazon Aurora MySQL cluster with writer and reader nodes. Use the cluster on an on-demand basis.
D. Create an Amazon EC2 instance. Manually install and configure MySQL Server on the instance.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Create an Amazon RDS for MySQL instance. Purchase a Reserved Instance.

Description: Amazon RDS (Relational Database Service) is a fully managed service that makes it easy to set up, operate, and scale a relational database in the cloud. It supports various database engines, including MySQL. A Reserved Instance (RI) provides a significant discount (up to 70% compared to on-demand pricing) for committing to use an instance type for a 1-year or 3-year term.
Why this fits: This choice combines the benefits of a fully managed database service (RDS), which significantly reduces operational overhead compared to self-managing a database on EC2, with the most cost-effective pricing model (Reserved Instances) for predictable, long-term database workloads. For a Solutions Architect Associate, recommending a managed service for ease of operations and using RIs for cost optimization on stable workloads are key best practices.

QUESTION 56

A company needs to migrate its customer transactions database from on premises to AWS. The database resides on an Oracle DB instance that runs on a Linux server According to a new security requirement, the company must rotate the database password each year.

Which solution will meet these requirements with the LEAST operational overhead?

A. Convert the database to Amazon DynamoDB by using AWS Schema Conversion Tool (AWS SCT). Store the password in AWS Systems Manager Parameter Store.
B. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function for yearly password rotation.
C. Migrate the database to Amazon RDS for Oracle. Store the password in AWS Secrets Manager Turn on automatic rotation Configure a yearly rotation schedule.
D. Migrate the database to an Amazon EC2 instance. Use AWS Systems Manager Parameter Store to keep and rotate the connection string by using an AWS Lambda function on a yearly schedule.
E. Migrate the database to Amazon Neptune by using AWS Schema Conversion Tool (AWS SCT)- Create an Amazon CloudWatch alarm to invoke an AWS Lambda function for yearly password rotation-

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Choice B: Create an Amazon CloudWatch alarm to invoke an AWS Lambda function for yearly password rotation.

Description: Amazon CloudWatch Alarms (specifically, CloudWatch Events, now largely replaced by Amazon EventBridge for scheduled events) can trigger AWS Lambda functions on a predefined schedule, such as a yearly interval using cron expressions. AWS Lambda is a serverless compute service that allows you to run custom code without provisioning or managing servers.
Why this fits: This choice describes a fundamental and highly flexible automation pattern in AWS.

Scheduled Execution: A CloudWatch Event rule (or an alarm configured as a scheduled event) can be set up to run on a yearly schedule (e.g., using a cron expression like cron(0 0 1 1 ? *) for January 1st every year).
Custom Logic: An AWS Lambda function can contain custom code written in various languages (Python, Node.js, Java, etc.) to perform the password rotation. This code can:
- Directly interact with a database’s API or command-line interface to change the password (applicable for self-managed databases on EC2 or even on-premises, assuming network connectivity).
- Call AWS Secrets Manager APIs to trigger the rotation of a secret stored within Secrets Manager, even if the database isn’t natively supported by Secrets Manager’s built-in rotators or requires custom pre/post-rotation steps.
- Update credentials stored in AWS Systems Manager Parameter Store or other credential vaults.
Broad Applicability: This approach is database-agnostic and can be used for virtually any type of database or credential that requires custom, scheduled rotation, providing a robust, serverless, and cost-effective solution.

QUESTION 57

A company has decoupled its application by using an Amazon Simple Queue Service (Amazon SQS) queue. The company has noticed increased costs, even when no orders are being processed. The company wants to reduce costs by optimizing the queue usage and configuration.

Which solution meets these requirements?

A. Consume messages by using short polling-
B. Programmatically decrease the polling interval based on queue depth
C. Increase the message visibility timeout on the SQS queue.
D. Consume messages by using long polling

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Consume messages by using long polling

Description: Amazon SQS long polling is a technique where a consumer client waits for messages to become available in an SQS queue for a specified period (up to 20 seconds) before returning an empty response. This differs from short polling, which immediately returns a response, even if the queue is empty, and might not return all available messages from all servers.
Why this fits: Long polling significantly improves the efficiency of message consumption by reducing the number of empty receives and the total number of API calls made to SQS. Instead of repeatedly polling and potentially receiving empty responses, the consumer waits for a message to arrive, thereby saving costs associated with API requests and reducing latency in message retrieval when messages arrive infrequently. This makes it the most effective method for efficient and cost-optimized message consumption from SQS.

Reference: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-short-long-polling.html

QUESTION 58

An application is experiencing performance issues based on increased demand. This increased demand is on historical records pulled from an Amazon RDS-hosted database with custom views and queries. A solutions architect must improve performance without changing the database structure.

Which approach will improve performance and MINIMIZE management overhead?

A. Deploy Amazon DynamoDB, move all the data, and point to DynamoDB.
B. Deploy Amazon ElastiCache (Redis OSS) and cache the data for the application.
C. Deploy Memcached on Amazon EC2 and cache the data for the application-
D. Deploy Amazon DynamoDB Accelerator (DAX) on Amazon RDS to improve cache performance.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Deploy Amazon ElastiCache (Redis OSS) and cache the data for the application.

Description: Amazon ElastiCache is a fully managed in-memory caching service provided by AWS. It supports two open-source in-memory engines: Redis (Redis OSS) and Memcached. Redis OSS offers advanced data structures, persistence, replication, and high availability capabilities, making it a versatile choice for caching, session management, and real-time analytics. By storing frequently accessed data in-memory, ElastiCache significantly reduces the load on backend databases and improves application response times.
Why this fits: In a typical application architecture, especially with a backend database, caching is a primary strategy to improve performance and reduce database load. Deploying Amazon ElastiCache with Redis OSS allows the application to store and retrieve frequently requested data directly from a fast, in-memory cache, bypassing the slower database for many read operations. This results in lower latency, higher throughput, and better overall application responsiveness. As a fully managed service, ElastiCache also reduces the operational overhead associated with managing a caching infrastructure.

Reference: https://aws.amazon.com/elasticache/redis/

QUESTION 59

A media publishing company is building an application on AWS to give users the ability to print their own books. The application frontend runs on a Docker container The amount of incoming orders vanes significantly The incoming orders can temporally exceed the throughput of the company’s book printing machines. Order-processing payloads are up to 4 MB in size.

The company needs to develop a solution that can scale to handle incoming orders.

Which Solution Will meet this requirement?

A. Use Amazon Simple Queue Service (Amazon SQS) to queue incoming orders. Create an AWS Lambda Edge function to process orders. Deploy the frontend application on Amazon Elastic Kubernetes Service (Amazon EKS).
B. Use Amazon Simple Notification Service (Amazon SNS) to queue incoming orders. Create an AWS Lambda function to process orders. Deploy the frontend application on AWS Fargate.
C. Use Amazon Simple Queue Service (Amazon SQS) to queue incoming orders. Create an AWS Lambda function to process orders. Deploy the frontend application on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type.
D. Use Amazon Simple Notification Service (Amazon SNS) to queue incoming orders. Create an AWS Lambda Edge function to process orders. Deploy the frontend application on Amazon EC2 instances.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Use Amazon Simple Queue Service (Amazon SQS) to queue incoming orders. Create an AWS Lambda function to process orders. Deploy the frontend application on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type.

Description: This choice outlines a highly scalable, serverless-first, and cost-effective architecture for an e-commerce application. It leverages key AWS services designed for decoupling, event-driven processing, and containerized deployments without server management.
Why this fits:

Amazon SQS for incoming orders: SQS is a fully managed message queuing service that allows for decoupling the frontend from the backend order processing. It handles spikes in traffic by reliably queuing orders, ensuring no orders are lost, and enabling asynchronous processing. This is a standard pattern for order intake in scalable e-commerce systems.
AWS Lambda function to process orders: Lambda is a serverless compute service that can be triggered directly by SQS messages. It automatically scales to process orders as they arrive in the queue, eliminating the need to provision or manage servers. This is ideal for event-driven backend processing, offering high scalability and pay-per-execution cost efficiency.
Amazon ECS with AWS Fargate launch type for frontend: ECS is a highly scalable container orchestration service. Using the Fargate launch type means that AWS manages the underlying EC2 instances, allowing you to run containers without provisioning or managing servers. This provides a fully managed, serverless container environment for the frontend application, offering excellent scalability, high availability, and reduced operational overhead compared to managing EC2 instances directly.

QUESTION 60

A company operates an online photo-sharing service and stores data in AWS Account A in a centralized Amazon S3 bucket. The company wants to grant a second AWS account named Account B access to the centralized S3 bucket. The company owns Account

B. Enable cross-Region replication between Account A and Account B to share the S3 bucket data.
C. Use Amazon CloudFront to distribute the S3 bucket contents. Grant Account B access the bucket contents through a signed URL-
D. Create a bucket policy that grants Account B permission to access the centralized S3 bucket in Account

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Create a bucket policy that grants Account B permission to access the centralized S3 bucket in Account A.

Description: An S3 bucket policy is a resource-based access policy written in JSON that specifies permissions for the bucket and its objects. It is attached directly to the S3 bucket and allows the bucket owner (Account A) to grant or deny access to specific AWS principals (like Account B’s users, roles, or even the entire Account B) for actions within that bucket.
Why this fits: This is the most direct, secure, and idiomatic AWS method for enabling cross-account access to an S3 bucket. By creating a bucket policy on Account A’s S3 bucket that specifies Account B as a Principal and grants specific S3 actions (e.g., s3:GetObject, s3:ListBucket), Account B’s IAM users or roles can then be configured with an IAM policy that allows them to access resources in Account A’s S3 bucket. This provides fine-grained control over the permissions and avoids replicating data or introducing unnecessary infrastructure.

Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-example-bucket-policies-for-aws-accounts.html

QUESTION 61

A company processes customer records in large batches. Each record must be enhanced with data from a customer data API that experiences overload, Records are identified by a unique identifier The customer data that the API retrieves is updated daily A solutions architect needs a solution to prevent the customer data API from becoming overloaded.

Which solution meets these requirements with the LEAST operational overhead?

A. Create an Amazon API Gateway REST API as a proxy to the customer data APL Enable API Gateway throttling to reduce the number of requests. Use the REST API in the message processor to enrich the messages.
B. Create an Amazon API Gateway REST API as a proxy to the customer data APL Enable API Gateway caching by using the customer identifier as the cache key Use the REST API in the message processor to enrich the messages.
C. Copy all customer data into an Amazon DynamoDB table. Create an Amazon API Gateway REST API as a proxy to perform the lookup in DynamoDBCreate an Amazon API Gateway REST API as a proxy to an AWS Lambda function. Configure the Lambda function to call the customer data API- Set a reservedconcurrency limit on the Lambda function-

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Create an Amazon API Gateway REST API as a proxy to the customer data APL Enable API Gateway throttling to reduce the number of requests. Use the REST API in the message processor to enrich the messages.

Description: This choice proposes using Amazon API Gateway as an intermediary for accessing an external customer data API (APL, likely a typo for API). API Gateway will act as a proxy, forwarding requests to the customer data API. Crucially, it recommends enabling API Gateway’s built-in throttling mechanism to manage the rate of requests. The message processor will then interact with this API Gateway endpoint instead of directly calling the backend customer data API.
Why this fits:
The scenario implies a message processing application that needs to enrich messages by calling an external customer data API. Such external APIs often have rate limits, stability concerns, or performance characteristics that need to be managed.

API Gateway as a Proxy: API Gateway is a highly scalable and robust service ideal for fronting backend services, whether internal or external. It provides a single, managed endpoint for the message processor.
Throttling for Protection: Enabling throttling on API Gateway is a critical best practice when integrating with backend services, especially external ones, that may have strict rate limits or limited capacity. It prevents the message processor from overwhelming the customer data API, ensuring its stability and preventing errors due to exceeding rate limits. This protects the backend and maintains the integrity of the overall system.
Decoupling: By placing API Gateway between the message processor and the customer data API, you decouple the two. The message processor interacts with a stable, managed API Gateway endpoint, and API Gateway handles the complexities of integrating with the external API, including rate limiting.

QUESTION 62 (Multi-Select)

A company uses a Microsoft SQL Server database. The company’s applications are connected to the database. The company wants to migrate to an Amazon Aurora PostgreSQL database with minimal changes to the application code.

Which combination of steps will meet these requirements? (Select TWO.)

A. Use the AWS Schema Conversion Tool (AWS SCT) to rewrite the SQL queries in the applications.
B. Enable Babelfish on Aurora PostgreSQL to run the SQL queries from the applications.
C. Migrate the database schema and data by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS).
D. Use Amazon RDS Proxy to connect the applications to Aurora PostgreSQL.
E. Use AWS Database Migration Service (AWS DMS) to rewrite the SQL queries in the applications.

Click to View Verified Solution & Explanation

Correct Option: B,C

Explanation: ✅ Enable Babelfish on Aurora PostgreSQL to run the SQL queries from the applications.

Description: Babelfish for Amazon Aurora PostgreSQL provides a SQL Server-compatible endpoint for Aurora PostgreSQL. It allows applications originally written for Microsoft SQL Server to communicate with Aurora PostgreSQL using the SQL Server’s Tabular Data Stream (TDS) protocol and supporting SQL Server’s SQL dialect, commands, and functions. This significantly reduces the need to rewrite application code when migrating from SQL Server.
Why this fits: When migrating a database from SQL Server to Aurora PostgreSQL, applications often contain SQL queries written specifically for SQL Server. Rewriting these queries can be a substantial effort. Babelfish directly addresses this by allowing the Aurora PostgreSQL database to understand and execute SQL Server-specific queries, enabling a "lift-and-shift" approach with minimal application code changes.

✅ Migrate the database schema and data by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS).

Description:

AWS Schema Conversion Tool (AWS SCT): This service converts your existing database schema from one database engine to another. It analyzes the source database, identifies objects (tables, stored procedures, functions, views, etc.), and converts them to a format compatible with the target database. It also highlights objects that cannot be automatically converted, requiring manual intervention.
AWS Database Migration Service (AWS DMS): This service helps migrate databases quickly and securely with minimal downtime. It supports both homogeneous (same engine) and heterogeneous (different engines) migrations. DMS can perform a full load of data, continuous data replication (Change Data Capture – CDC), or a combination of both.
Why this fits: This is the standard, comprehensive, and recommended approach for performing a heterogeneous database migration (e.g., from SQL Server to Aurora PostgreSQL). AWS SCT handles the conversion of the database schema and code objects, while AWS DMS handles the efficient and reliable migration of the actual data from the source to the target database, often with minimal downtime.

QUESTION 63

A company hosts dozens of multi-tier applications on AWS- The presentation layer and logic layer are comprised of Amazon EC2 Linux instances that use Amazon Elastic Block Store (Amazon EBS) volumes.

The company needs a solution to ensure that operating system vulnerabilities are not introduced to the EC2 instances when the company deploys new features. The company uses custom AMIS to deploy the EC2 instances in an Auto Scaling group.

The solution must scale to the handle all applications that the company hosts.

Which solution will meet these requirements?

A. Use Amazon Inspector to patch operating system vulnerabilities. Invoke Amazon Inspector when a new AMI is deployed
B. Use AWS Backup to back up the EBS volume of each updated instance. Use the EBS backup volumes to create new AMIs. Use the existing Auto Scaling group to deploy the new AMIs.
C. Use AWS Systems Manager Patch Manager to patch operating system vulnerabilities in the custom AMIs.
D. Use EC2 Image Builder to create new AMIS when the company deploys new features. Include the update-Linux component in the build components of the new AMIS. Use the existing Auto Scaling group to deploy the new AMIs.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Use EC2 Image Builder to create new AMIS when the company deploys new features. Include the update-Linux component in the build components of the new AMIS. Use the existing Auto Scaling group to deploy the new AMIs.

Description: EC2 Image Builder is a fully managed AWS service that makes it easier to automate the creation, management, and deployment of customized, secure, and up-to-date server images. It uses a component-based approach where "components" are scripts that define specific build, test, and validate steps. The update-Linux component is a pre-defined component that performs standard operating system updates. Image Builder can integrate with other services like Auto Scaling to automatically deploy new AMIs.
Why this fits: This solution directly addresses the need to consistently create new, updated AMIs (implied by "when the company deploys new features" which often requires base OS updates or custom software updates) in an automated and managed way. EC2 Image Builder’s core function is AMI lifecycle management, including patching through components like update-Linux. Integrating with an existing Auto Scaling group for deployment is the standard and most efficient way to roll out new AMIs to a fleet of instances without manual intervention, ensuring elasticity and high availability.

QUESTION 64

A company is creating a mobile financial app that gives users the ability to sign up and store personal information. The app uses an Amazon DynamoDB table to store user details and preferences

The app generates a credit score report by using the data that is stored in DynamoDB. The app sends credit score reports to users once every month. The company needs to provide users with an option to remove their data and preferences. The app must delete customer data within one month of receiving a request to delete the data.

Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AWS Lambda function to delete user information. Create an Amazon Event Bridge rule that runs when a specified TTL expires. Configure the Event Bridge rule to invoke the Lambda function.
B. Create a DynamoDB stream. Create an AWS Lambda function to delete user informatiom When a specified TTL expires, write user information to the DynamoDB stream from the DynamoDB table. Configure the DynamoDB stream to invoke the Lambda function to delete user information
C. Enable TTL in DynamoDB. Set the expiration date as an attribute. Create an AWS Lambda function to set the TTL based on the expiration date value. Invoke the Lambda function when a user requests to delete personal data
D. Enable TTL in DynamoDB. Create an AWS Lambda function to delete user information. Configure AWS Config to detect the DynamoDB stage change when TTL expires and to invoke the Lambda function.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Enable TTL in DynamoDB. Set the expiration date as an attribute. Create an AWS Lambda function to set the TTL based on the expiration date value. Invoke the Lambda function when a user requests to delete personal data

Description: Amazon DynamoDB Time To Live (TTL) is a feature that allows you to define a per-item timestamp to determine when an item is no longer needed. Once enabled, DynamoDB automatically deletes items shortly after the specified timestamp, without consuming any write throughput. To use TTL, you designate a numeric attribute (e.g., expirationTime) in your table to store a Unix epoch timestamp in seconds. A Lambda function can be used to update this attribute’s value, thereby scheduling the item’s deletion.
Why this fits: This solution leverages DynamoDB’s native TTL feature for automatic item deletion, which is the most efficient and cost-effective method for this use case. When a user requests data deletion, an AWS Lambda function is invoked. This Lambda function then updates the specific user’s item in the DynamoDB table, setting the designated TTL attribute to a future Unix timestamp (e.g., current time + a short buffer). DynamoDB’s TTL mechanism will then automatically delete the item from the table after that timestamp is reached. This approach ensures that the deletion is handled natively by DynamoDB’s background process, minimizing operational overhead and costs.

QUESTION 65

A company’s solutions architect is building a static website to be deployed in Amazon S3 for a production environment The website integrates with an Amazon Aurora PostgreSQL database by using an AWS Lambda function. The website that is deployed to production will use a Lambda alias that points to a specific version of the Lambda function.

The company must rotate the database credentials every 2 weeks. Lambda functions that the company deployed previously must be able to use the most recent credentials.

Which solution will meet these requirements?

A. Store the database credentials in AWS Secrets Manager Turn on rotation- Write code in the Lambda function to retrieve the credentials from Secrets Manager.
B. Include the database credentials as part of the Lambda function code. Update the credentials periodically and deploy the new Lambda function.
C. Use Lambda environment Venables- Update the environment variables when new credentials are available.
D. Store the database credentials in AWS Systems Manager Parameter Store. Tum on rotation. Write code in the Lambda function to retrieve the credentials from Systems Manager Parameter Store.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Store the database credentials in AWS Secrets Manager Turn on rotation- Write code in the Lambda function to retrieve the credentials from Secrets Manager.

Description: AWS Secrets Manager is a service that helps you protect access to your applications, services, and IT resources. It enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. It offers native integration for automatic rotation with several AWS database services (e.g., Amazon RDS, Amazon Redshift, Amazon DocumentDB). Lambda functions can securely retrieve these credentials at runtime.
Why this fits: This is the most secure and recommended approach for managing database credentials for applications, including Lambda functions. Storing credentials in Secrets Manager ensures they are never hardcoded or exposed in the Lambda function’s code or environment variables. Enabling automatic rotation is a critical security best practice, significantly reducing the risk associated with long-lived credentials. Retrieving credentials at runtime from Secrets Manager ensures that the function always uses the most current and securely managed credentials.

QUESTION 66

A disaster response team is using drones to collect images of recent storm damage. The response team’s laptops lack the storage and computer capacity to transfer the images and process the data. While the team has Amazon EC2 instances for processing and Amazon S3 buckets for storage, network connectivity is intermittent and unreliable. The images need to be processed to evaluate the damage,

What should a solutions architect recommend?

A. use AWS Snowball Edge devices to process and store the images.
B. Upload the images to Amazon Simple queue Service (Amazon SOS) during intermittent connectivity to EC2 instances.
C. Configure Amazon Data Firehose to create multiple delivery streams aimed separately at the S3 buckets tor storage and the EC2 instances for processing the images.
D. Use AWS Storage Gateway preinstalled on a hardware appliance to cache the images locally for Amazon $3 to process the images connectivity becomes available.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Choice A: use AWS Snowball Edge devices to process and store the images.

Description: AWS Snowball Edge is a rugged, portable device offering computing capabilities and storage. It allows customers to perform data migration to and from AWS and execute edge computing tasks (like running EC2-compatible instances or Lambda functions) even in environments with limited or no internet connectivity.
Why this fits: This choice directly addresses both the "process" and "store" requirements at the edge. Snowball Edge devices are designed for scenarios where large amounts of data (like images) need to be collected, processed locally (e.g., for filtering, anonymization, or preliminary analysis), and stored before being shipped back to AWS. This is particularly valuable in environments with intermittent or low-bandwidth connectivity, as it reduces the amount of data that needs to be transmitted and allows for immediate local processing without relying on constant cloud access.

QUESTION 67 (Multi-Select)

A company has a single AWS account. The company runs workloads on Amazon EC2 instances in multiple VPCs in one AWS Region. The company also runs workloads in an on- premises data center that connects to the company’s AWS account by using AWS Direct Connect The company needs all EC2 instances in the VPCs to resolve DNS queries for the internal example.com domain to the automatizes DNS server that is located in the on-premises data center The solution must use private communication between the VPCs and the on-premises network. All route tables, network ACLs, and security groups are configured correctly between AWS and the on-premises data center.

Which combination of actions will meet these requirements? (Select THREE)

A. Create an Amazon Route 53 inbound endpoint in all the workload VPCs
B. Create an Amazon Route 53 outbound endpoint in one of the workloads VPCs.
C. Create an Amazon Route 53 Resolver rule with the Forward type configured to forward queries for internalexamplecom to the on-premises DNS server.
D. Create an Amazon Route 53 Resolver rule with the System type configured to forward queries for internal example com to the on-premises DNS server
E. Associate the Amazon Route 53 Resolver rule with all the workload VPCs.
F. Associate the Amazon Route 53 Resolver rule with the workload VPC with the new Route 53 endpoint.

Click to View Verified Solution & Explanation

Correct Option: B,C,E

Explanation: ✅ Create an Amazon Route 53 outbound endpoint in one of the workloads VPCs.

Description: An Amazon Route 53 outbound endpoint enables DNS queries originating from your Amazon VPCs to be forwarded to on-premises DNS resolvers. It consists of multiple elastic network interfaces (ENIs) within the specified VPC and subnet(s), providing a target for Resolver rules.
Why this fits: To allow AWS resources to resolve DNS records hosted on-premises, Route 53 Resolver needs a way to send queries out of the AWS network to the on-premises DNS servers. An outbound endpoint serves this purpose by acting as the target for forwarding rules. It doesn’t need to be in every VPC, as a single outbound endpoint can be used by multiple rules associated with different VPCs.

✅ Create an Amazon Route 53 Resolver rule with the Forward type configured to forward queries for internalexamplecom to the on-premises DNS server.

Description: A Route 53 Resolver rule specifies how DNS queries for a particular domain name should be handled. A "Forward" type rule instructs Resolver to forward queries for the specified domain to a target IP address (e.g., your on-premises DNS server) using an associated outbound endpoint.
Why this fits: This rule defines the specific logic for hybrid DNS resolution. It tells Route 53 Resolver: "When you receive a query for internal.example.com, don’t try to resolve it within AWS, but instead send it to the specified on-premises DNS server(s) via the outbound endpoint." This is crucial for directing internal corporate DNS traffic correctly.

✅ Associate the Amazon Route 53 Resolver rule with all the workload VPCs.

Description: Associating a Route 53 Resolver rule with a VPC makes that rule active for any DNS queries originating from resources within that specific VPC.
Why this fits: If all workload VPCs need to resolve records for internal.example.com from the on-premises DNS server, the Resolver rule must be applied to (associated with) each of those VPCs. This ensures that any EC2 instances, Lambda functions, or other services within those VPCs can successfully make DNS queries that are then forwarded to on-premises. Without this association, the rule would not take effect for the respective VPCs.

QUESTION 68

A company has an ecommerce application that users access through multiple mobile apps and web applications. The company needs a solution that Will receive requests from the mobile apps and web applications through an API. Request traffic volume varies significantly throughout each day Traffic spikes during sales events. The solution must be loosely coupled and ensure that no requests are lost.

Which solution will meet these requirements?

A. Create an Application Load Balancer (ALB). Create an AWS Elastic Beanstalk endpoint to process the requests. Add the Elastic Beanstalk endpoint to the target group of the ALB
B. Set up an Amazon API Gateway REST API With an integration to an Amazon Simple Queue Service (Amazon SQS) queue- Configure a dead-letter queue. Create an AWS Lambda function to poll the queue to process the requests.
C. Create an Application Load Balancer (ALB). Create an AWS Lambda function to process the requests. Add the Lambda function as a target of the ALB.
D. Set up an Amazon API Gateway HTTP API With an integration to an Amazon Simple Notification Service (Amazon SNS) topic Create an AWS Lambda function to process the requests- Subscribe the function to the SNS topic to process the requests.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Set up an Amazon API Gateway REST API With an integration to an Amazon Simple Queue Service (Amazon SQS) queue- Configure a dead-letter queue. Create an AWS Lambda function to poll the queue to process the requests.

Description: This solution outlines a common serverless pattern for asynchronous, decoupled processing. An Amazon API Gateway REST API acts as the public entry point, directly integrating with an Amazon SQS queue. Incoming requests are placed as messages into this queue. A dead-letter queue (DLQ) is configured for SQS to handle messages that fail processing after a specified number of retries. An AWS Lambda function is then configured to automatically poll the SQS queue, retrieve messages, and execute the business logic to process them.
Why this fits: This architecture is ideal for scenarios requiring asynchronous processing, where the client doesn’t need an immediate response from the backend processing.

Decoupling and Scalability: API Gateway, SQS, and Lambda are all serverless, highly scalable services. SQS decouples the API frontend from the backend processing, allowing the system to handle spikes in traffic without overwhelming the Lambda function. Requests are simply queued, improving system resilience.
Reliability and Fault Tolerance: SQS provides message durability. Configuring a dead-letter queue (DLQ) is a critical best practice that ensures messages that cannot be successfully processed (due to errors in the Lambda function or malformed data) are not lost but moved to the DLQ for later investigation and handling, preventing data loss and "poison pill" scenarios.
Asynchronous Nature: The direct integration of API Gateway with SQS allows the API to respond immediately to the client (e.g., with a 202 Accepted status), while the actual processing happens asynchronously via the Lambda function, which is ideal for long-running or non-blocking tasks.
Cost-Effective: All components are pay-as-you-go, making it a very cost-effective solution for variable workloads.

QUESTION 69

A global ecommerce company is designing a there’re application on AWS, the application includes a web tier that serves static content. An application tier handles business logic. A database tier stores product information and user data. The application interacts with a relational database.

The company needs a highly available application architecture to serve global users with the Iow latency.

Which solution will meet those requirements with the LEAST operational overhead?

A. Deploy Amazon EC2 instances in an Auto Scaling group for the application tier and web tier in a single AWS Region- Use an Application Load Balancer to distribute web traffic. use an AmazonRDS database and multi-AZ deployments for the database tier-
B. Set up an Amazon CloudFront distribution that uses an Amazon S3 bucket as the origin. use Amazon Elastic Container Service (Amazon ECS) containers on AWS Faregate to deploy the application tier to each AWS Region where the company operates. use an Amazon Aurora global database for the database tier
C. Use an Amazon S3 bucket to store the static web content, Use Amazon EC2 Auto Scaling and EC2 Spot Instances for the application tier. Use Amazon RDS for MySQL with read replicas for thedatabase tier. Use AWS Database Migration Service (AWS DMS) to replicate data to secondary AWS Regions.
D. Use an Amazon S3 bucket to store static web content. use AWS Lambda functions to handle serverless backend logic in the application tier. Use Amazon API Gateway to invoke the Lambda functions for web requests. use an Amazon DynamoDB database for the database tier Deploy the DynamoDB data base across multiple AWS Regions.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Choice B: Set up an Amazon CloudFront distribution that uses an Amazon S3 bucket as the origin. use Amazon Elastic Container Service (Amazon ECS) containers on AWS Fargate to deploy the application tier to each AWS Region where the company operates. use an Amazon Aurora global database for the database tier

Description: This solution leverages Amazon CloudFront as a Content Delivery Network (CDN) with an Amazon S3 bucket for static content delivery, ensuring low latency globally. The application logic is containerized using Amazon ECS on AWS Fargate, providing a serverless container experience deployed across multiple AWS Regions. The database tier utilizes Amazon Aurora Global Database, a relational database designed for global applications with low-latency cross-region replication and fast disaster recovery.
Why this fits:

Global: Amazon CloudFront caches content at edge locations worldwide, providing low-latency access for users globally. Deploying Amazon ECS on AWS Fargate in "each AWS Region where the company operates" ensures regional presence and optimal performance for local users. Amazon Aurora Global Database is inherently designed for global, multi-region deployments, offering a single database spanning multiple AWS Regions.
Highly Available: CloudFront automatically routes requests to the nearest healthy edge location. ECS on Fargate is highly available within each region (spanning multiple Availability Zones) and deploying it across multiple regions provides inter-regional high availability and disaster recovery. Aurora Global Database provides fast cross-region recovery times (RTO) and minimal data loss (RPO), making it highly resilient against regional outages.
Scalable: CloudFront automatically scales to handle traffic spikes. ECS on Fargate offers serverless scaling, automatically adjusting compute capacity based on demand without managing underlying servers. Aurora Global Database supports multiple read replicas in secondary regions, allowing read scaling across geographies.
Cost-Effective: AWS Fargate is a pay-per-use serverless compute engine, reducing operational overhead and costs associated with managing EC2 instances. S3 and CloudFront are generally cost-effective for content delivery, and Aurora is optimized for performance and cost efficiency for relational databases.

QUESTION 70

A company manages an application that stores data on an Amazon RDS for PostgreSQL Multi-AZ DB instance. High traffic on the application is causing increased latency for many read queries.

A solutions architect must improve the performance of the application.

Which solution will meet this requirement?

A. Enable Amazon RDS Performance Insights. Configure storage capacity to scale automatically.
B. Configure the DB instance to use DynamoDB Accelerator (DAX).
C. Create a read replica of the DB instance. Serve read traffic from the read replica.
D. Use Amazon Data Firehose between the application and Amazon RDS to increase the concurrency of database requests.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Use Amazon Data Firehose between the application and Amazon RDS to increase the concurrency of database requests.

Description: Amazon Kinesis Data Firehose is a fully managed service for delivering real-time streaming data to various destinations. While it doesn’t directly insert into RDS, it acts as a buffer and batching mechanism. Applications send data to Firehose, which collects and batches it. This batched data can then be processed (e.g., delivered to S3 and then processed by an AWS Lambda function) and inserted into Amazon RDS.
Why this fits: When an application makes many small, concurrent requests directly to an Amazon RDS database, it can overwhelm the database’s connection limits, CPU, or I/O capacity, leading to performance bottlenecks and reduced throughput. By introducing Amazon Kinesis Data Firehose, the application is decoupled from the database. Firehose absorbs the high volume of incoming data, buffers it, and delivers it in larger, fewer batches to an intermediary (like S3) or a custom processor (like a Lambda function). This strategy significantly reduces the direct concurrent pressure on RDS. The database can then process fewer, larger, more efficient transactions from the intermediary, rather than many small, highly concurrent individual requests from the application. This effectively allows the database to handle a higher overall volume (concurrency) of data requests more efficiently without being overwhelmed. It smooths out bursty traffic and optimizes the interaction with the database.

QUESTION 71

A company has resources across multiple AWS Regions and accounts. A newly hired solutions architect discovers a previous employee did not provide details about the resources inventory. The solutions architect needs to build and map the relationship details of the various workloads across all accounts.

Which solution will meet these requirements in the MOST operationally efficient way?

A. Use AWS Systems Manager Inventory to generate a map view from the detailed view report.
B. Use AWS Step Functions to collect workload details. Build architecture diagrams of the workloads manually.
C. Use Workload Discovery on AWS to generate architecture diagrams of the workloads.
D. Use AWS X-Ray to view the workload details. Build architecture diagrams with relationships.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Use Workload Discovery on AWS to generate architecture diagrams of the workloads.

Description: Workload Discovery on AWS is an AWS Solution that helps customers automatically discover resources and their relationships within specific workloads in their AWS accounts. It leverages AWS Config to collect resource configuration data, processes this data, and then visualizes these resources and their connections as architecture diagrams, making it easier to understand and document complex environments.
Why this fits: The core requirement is to "generate architecture diagrams of the workloads." Workload Discovery on AWS is specifically designed to fulfill this need by automating the creation of these diagrams based on actual AWS resource configurations and their relationships, significantly reducing manual effort and improving accuracy compared to building them manually.

QUESTION 72

A company is developing an application that uses an Amazon Aurora MySQL database. The company plans to regularly make changes to the MySQL database schema to test new features. The tests must not affect the existing production database.

When the company finishes testing, a developer needs to replicate the changes to production database. The solution must cause minimal downtime.

Which solution will meet these requirements?

A. Create a new staging Aurora MySQL database cluster based on the existing database. Make the schema changes to the new staging database cluster to test the new features.
B. Create a read replica based on the existing Aurora MySQL database. Make the schema changes to the read replica. Promote the read replica to primary after successful testing.
C. Create a blue/green deployment of the Aurora MySQL database. Make schema changes in the staging environment to test new features. Direct traffic from the green environment to the blue environment when testing is complete.
D. Replicate the Aurora MySQL database to an Amazon DynamoDB table. Make the schema changes to the DynamoDB table to test the new features. Configure the application to use the DynamoDB table when testing is complete.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Create a blue/green deployment of the Aurora MySQL database. Make schema changes in the staging environment to test new features. Direct traffic from the green environment to the blue environment when testing is complete.

Description: AWS Aurora Blue/Green Deployments provide a safe, simple, and fast way to update your Amazon Aurora databases, including major and minor version upgrades, schema changes, or parameter modifications. It creates two identical environments: a production environment (blue) and a staging environment (green). The staging environment is kept in sync with the production environment. You can make your desired changes (like schema updates) on the staging environment, test them thoroughly, and then perform a switchover with minimal downtime, promoting the staging environment to become the new production. This process typically takes seconds, and the original production environment becomes the old environment, which can be used for rollback if needed.
Why this fits: This option perfectly addresses the requirements of testing new features that involve schema changes with minimal impact on the production database. Blue/Green deployments are specifically designed for this purpose:

Schema Changes: You can apply schema modifications directly to the staging environment without affecting the active production database.
Testing New Features: The entire staging environment can be used to fully test the new features, including how the application interacts with the modified schema, in an isolated but identical environment.
Minimal Downtime: The switchover process from the blue to the green environment (or vice-versa) is orchestrated by AWS, ensuring data synchronization and redirecting traffic with very low downtime, often just a few seconds.
Rollback Capability: In case of issues after the switch, you have the original production environment readily available for a quick and safe rollback.

Reference: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/blue-green-deployments.html

QUESTION 73

A company hosts its ecommerce application in the AWS Cloud. The application uses a mufti-Region active-active approach and many microservices. The company needs a solution to redirect traffic if resources in an AWS Region become unavailable. The company wants to ensure that the failover Region is ready to handle traffic in case of a failover.

Which solution provides application resiliency With the LEAST operational overhead?

A. Use the Amazon Route 53 Application Recovery Controller multi-Region recovery capability
B. Use Amazon Route 53 health checks to monitor the multj-Region endpoints to redirect traffic. Ensure that the failover Region is ready to handle traffic by scheduling occasional resource shutdowns in the primary Region by using Amazon Event Bridge Scheduler
C. Use AWS Fault Injection Service to reroute the traffic to another Region if resources in a Region become unavailable.
D. Deploy Amazon API Gateway HTTP APIs in each Region. Use an Amazon CloudFront distribution. Use Lambda Edge to query Amazon Route 53 for the Region to forward requests to based on the lowest latency

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Use the Amazon Route 53 Application Recovery Controller multi-Region recovery capability

Description: Amazon Route 53 Application Recovery Controller (ARC) is a service designed to help customers recover their applications quickly and reliably across AWS Regions or Availability Zones. It provides features like Readiness Checks to continuously verify that your standby resources are configured correctly and scaled appropriately to take over, and Routing Control to enable rapid, controlled failovers and failbacks by updating DNS records or other routing mechanisms with near-real-time propagation. Its multi-Region recovery capability specifically focuses on orchestrating and validating disaster recovery across geographically separate Regions.
Why this fits: The question implicitly asks for a solution that provides robust multi-Region recovery capabilities, including managing traffic redirection and ensuring that the failover Region is ready to handle traffic. Route 53 ARC is purpose-built for this exact scenario. It ensures that recovery readiness is maintained through continuous checks and allows for fast, reliable failovers by providing precise control over traffic routing. This is a superior and more specialized solution compared to general Route 53 health checks or manual shutdown scheduling for ensuring readiness.

QUESTION 74

A company has a website that handles dynamic traffic loads. The website architecture is based on Amazon EC2 instances in an Auto Scaling group that is configured to use scheduled scaling- Each EC2 instance runs code from an Amazon Elastic File System (Amazon EFS) volume and stores shared data back to the same volume.

The company wants to optimize costs for the website.

Which solution will meet this requirement?

A. Reconfigure the Auto Scaling group to set a desired number of instances- Turn off scheduled scaling.
B. Create a new launch template version for the Auto Scaling group that uses larger EC2 instances.
C. Reconfigure the Auto Scaling group to use a target tracking scaling policy.
D. Replace the EFS volume with instance store volumes.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Reconfigure the Auto Scaling group to use a target tracking scaling policy.

Description: A target tracking scaling policy allows an Auto Scaling group to automatically adjust its capacity to maintain a specified target value for a chosen metric. Examples include maintaining an average CPU utilization of 60%, an average network I/O of a certain throughput, or an average ALB request count per target. The Auto Scaling group adds or removes instances as needed to keep the metric as close as possible to the target value.
Why this fits: This is the most effective and recommended method for dynamically scaling an Auto Scaling group based on fluctuating demand while maintaining a desired performance level. Instead of reacting to individual thresholds (like step scaling), target tracking proactively adjusts capacity to maintain a specific utilization target, leading to smoother scaling and better resource optimization. This approach ensures the application has sufficient resources during peak loads without over-provisioning during idle times.

Reference: https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html

QUESTION 75

A solutions architect has an application contained an AWS Lambda function, and an Amazon Simple Queue Service (Amazon SQS) queue. The Lambda function uses the SQS queue as an event source. The Lambda function makes a call to a third-party machine learning (ML) API when the function is invoked. The response from the third-party API can take up to 60 seconds to return The Lambda function’s timeout value is currently 65 seconds. The solutions architect has noticed that the Lambda function sometimes processes duplicate messages from the SQS queue.

What should the solutions architect do to ensure that the Lambda function does not process duplicate messages?

A. Configure the Lambda function with a larger amount of memory
B. Configure an increase in the Lambda function's timeout value.
C. Configure the SQS queue's delivery delay value to be greater than the maximum time it takes to call the third-party API.
D. Configure the SQS queue's visibility timeout value to be greater than the maximum time it takes to call the third-party API.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Configure the SQS queue’s visibility timeout value to be greater than the maximum time it takes to call the third-party API.

Description: The SQS visibility timeout is a period during which SQS prevents other consumers from receiving and processing a message that has already been retrieved by one consumer. This timeout starts as soon as a message is delivered to a consumer. If the consumer processes the message and deletes it from the queue within this timeout period, the message is successfully handled. If the consumer fails to delete the message within the visibility timeout, the message becomes visible again in the queue and can be delivered to another consumer (or the same consumer), potentially leading to duplicate processing.
Why this fits: When a Lambda function processes an SQS message, and part of its task involves calling a potentially long-running third-party API, the total time required to process the message successfully (including the API call and any subsequent logic) can exceed the default SQS visibility timeout. If the visibility timeout is too short, the message will reappear in the queue before the Lambda function has finished its work and deleted the message. This can cause other Lambda invocations (or the same one if the original fails and retries) to pick up and process the same message again, leading to duplicate processing. By setting the visibility timeout to be greater than the maximum expected time for the entire processing task (including the third-party API call), you ensure that the Lambda function has sufficient time to complete its execution and delete the message from the SQS queue before it becomes visible to other consumers, thereby preventing duplicate processing.

QUESTION 76 (Multi-Select)

A company has an organization in AWS Organizations. The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit (OU). There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts. The company has created a service control policy (SCP) to deny access to launch instances that use the prohibited types.

Which solutions to deploy the SCP will meet these requirements? (Select TWO.)

A. Attach the SCP to the root OU for the organization.
B. Attach the SCP to the three nonproduction Organizations member accounts.
C. Attach the SCP to the Organizations management account.
D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU.
E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.

Click to View Verified Solution & Explanation

Correct Option: B,E

Explanation: ✅ Attach the SCP to the three nonproduction Organizations member accounts.

Description: Service Control Policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization or specific OUs/accounts. Directly attaching an SCP to an individual AWS account within an AWS Organization applies the policy’s restrictions to that specific account.
Why this fits: This choice directly addresses the requirement to apply the SCP only to the three non-production accounts. By attaching the SCP to each of these specific member accounts, you ensure that the policy’s restrictions are enforced precisely where needed, without affecting other accounts like production environments. This method is straightforward and effective for a limited number of target accounts.

✅ Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.

Description: An Organizational Unit (OU) is a container for accounts within a root or another OU in AWS Organizations. OUs allow you to group accounts together for easier management and to apply policies like SCPs to a collection of accounts. When an SCP is attached to an OU, all accounts within that OU, and any nested OUs, inherit the permissions defined by the SCP.
Why this fits: This choice represents the best practice and most scalable approach for managing policies in AWS Organizations. By creating a dedicated OU for non-production accounts, attaching the SCP to this OU, and then moving the non-production accounts into it, you achieve the goal of applying the SCP only to these specific accounts. This method ensures that all current and future non-production accounts added to this OU automatically inherit the SCP, simplifying management and preventing accidental application to production accounts.

QUESTION 77

A company is developing a social media application. The company anticipates rapid and unpredictable growth in users and data volume. The application needs to handle a continuous high volume of user requests. User requests include long-running processes that store large amounts of user-generated content and user profiles in a relational format. The processes must run in a specific order.

The company requires an architecture that can scale resources to meet demand spikes without downtime or performance degradation. The company must ensure that the components of the application can evolve independently without affecting other parts of the system.

Which combination of AWS services will meet these requirements?

A. Deploy the application on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Use Amazon RDS as the database. Use Amazon Simple Queue Service (Amazon SQS) to decouple message processing between components.
B. Deploy the application on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Use Amazon RDS as the database. Use Amazon Simple Notification Service (Amazon SNS) to decouple message processing Between components.
C. Use Amazon DynamoDB as the database. Use AWS Lambda functions to implement the application. Configure Amazon DynamoDB Streams to invoke the Lambda functions. Use AWS Step Functions to manage workflows between services.
D. Use an AWS Elastic Beanstalk environment with auto scaling to deploy the application. Use Amazon RDS as the database. Use Amazon Simple Notification Service (Amazon SNS) to decouple message processing between components.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Choice A: Deploy the application on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Use Amazon RDS as the database. Use Amazon Simple Queue Service (Amazon SQS) to decouple message processing between components.

Description: This option proposes a modern, containerized application architecture leveraging fully managed AWS services.

Amazon ECS with AWS Fargate: ECS is a highly scalable, high-performance container orchestration service that supports Docker containers. Fargate is a serverless compute engine for ECS that allows you to run containers without having to provision, scale, or manage underlying EC2 instances. This reduces operational overhead and provides built-in scalability and availability.
Amazon RDS: A fully managed relational database service that supports various database engines (e.g., MySQL, PostgreSQL, SQL Server, Oracle). RDS handles routine database tasks like patching, backups, replication, and scaling, providing high availability and durability.
Amazon SQS: A fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. SQS reliably stores messages until they can be processed, ensuring high availability and message durability, and allows for asynchronous processing.
Why this fits: This architecture aligns perfectly with best practices for building scalable, highly available, and fault-tolerant applications on AWS, a core focus of the Solutions Architect Associate exam.
Scalability & Elasticity: ECS with Fargate automatically scales container instances based on demand, while RDS supports scaling vertically and horizontally (with read replicas). SQS inherently handles large volumes of messages.
High Availability & Durability: Fargate distributes containers across Availability Zones. RDS offers multi-AZ deployments for automatic failover. SQS is highly durable and fault-tolerant.
Managed Services: All components (ECS Fargate, RDS, SQS) are fully managed by AWS, significantly reducing operational burden (e.g., server provisioning, patching, backups, software updates, scaling infrastructure).
Decoupling: SQS effectively decouples application components, allowing them to operate independently and asynchronously, improving resilience and scalability. If one component fails, messages queue up, preventing cascading failures.
This combination provides a robust and efficient solution for many common application requirements without needing to manage underlying servers for compute or database infrastructure.

QUESTION 78 (Multi-Select)

A company is designing a tightly coupled high performance computing (HPC) environment in the AWS Cloud. The company needs to include features that will optimize the HPC environment for networking and storage.

Which combination of solutions will meet these requirements? (Select TWO.)

A. Create an accelerator in AWS Global Accelerator. Configure custom routing for the accelerator.
B. Create an Amazon Fax for luster file system. Configure the file system with scratch storage.
C. Create an Amazon CloudFront distribution. Configure the viewer protocol policy to be HTTP and HTTPS.
D. Launch Amazon EC2 instances. Attach an Elastic Fabric Adapter (EFA) to the instances.
E. Create an AWS Elastic Beanstalk deployment to manage the environment.

Click to View Verified Solution & Explanation

Correct Option: B,D

Explanation: ✅ Create an Amazon FSx for Lustre file system. Configure the file system with scratch storage.

Description: Amazon FSx for Lustre provides a high-performance, cost-effective file system optimized for compute-intensive workloads such as high-performance computing (HPC), machine learning, and media processing. Lustre is a popular open-source parallel distributed file system. "Scratch storage" is optimized for temporary storage and throughput-intensive workloads where data is not required to persist long-term, offering very high throughput and low latency.
Why this fits: This solution directly addresses the need for a shared, high-throughput, and low-latency file system, which is critical for workloads that require fast access to large datasets, such as scientific simulations, big data analytics, and machine learning training. Scratch storage offers exceptional performance for these temporary, bursty workloads.

✅ Launch Amazon EC2 instances. Attach an Elastic Fabric Adapter (EFA) to the instances.

Description: An Elastic Fabric Adapter (EFA) is a network interface for Amazon EC2 instances that enables customers to run HPC applications requiring high levels of inter-node communication at scale on AWS. EFA provides lower and more consistent latency and higher throughput compared to traditional TCP networking by bypassing the operating system network stack, leveraging a custom-built operating system bypass technique.
Why this fits: For tightly coupled HPC applications, distributed machine learning, and other workloads sensitive to network latency and jitter between instances (e.g., those using Message Passing Interface – MPI), EFA is crucial. It significantly improves inter-instance communication performance, allowing these applications to scale more efficiently and achieve better overall performance.

QUESTION 79

A company wants to run a production database in the AWS Cloud. The database will collect billions of sensor readings from multiple locations across multiple AWS Regions. Data is written to the database at a sustained rate of 50,000 writes per second.

The company will run reports once every 3 months against the database. The company will run simple queries to retrieve data based on unique location IDs to run the reports. The query results will vary in size.

The company needs a solution that will optimize data storage costs. The solution must be highly durable and must not compromise database performance.

Which solution will meet these requirements?

A. Use Amazon Aurora Serverless v2 in one Region. Specify the desired capacity range.
B. Use Amazon DynamoDB Standard tables, and enable DynamoDB Accelerator (DAX).
C. Deploy an Amazon RDS for PostgreSQL DB instance, and create a read replica.
D. Use Amazon DynamoDB Standard-IA tables in multiple Regions. Configure DynamoDB to manage capacity.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Use Amazon DynamoDB Standard-IA tables in multiple Regions. Configure DynamoDB to manage capacity.

Description: Amazon DynamoDB Standard-IA (Infrequently Accessed) is a storage class optimized for data that is accessed less frequently but still requires high performance when needed. It offers lower storage costs compared to DynamoDB Standard tables, making it cost-effective for data with infrequent access patterns. Deploying tables "in multiple Regions" implies leveraging DynamoDB Global Tables, which provide fully managed, multi-Region, multi-master replication for high availability, disaster recovery, and low-latency global data access. "Configure DynamoDB to manage capacity" refers to using DynamoDB On-Demand capacity mode, where DynamoDB automatically scales read and write throughput based on actual traffic, eliminating the need for manual capacity planning and provisioning.
Why this fits: This solution combines several crucial architectural best practices. Standard-IA tables provide a cost-optimized storage solution for data that isn’t constantly accessed but still needs to be readily available. Deploying in multiple regions with Global Tables ensures high availability, fault tolerance, and disaster recovery, allowing the application to remain operational even during regional outages and providing low-latency access to users worldwide. Configuring DynamoDB to manage capacity (On-Demand mode) removes the operational overhead of capacity planning and scaling, making the solution highly adaptable to unpredictable workloads and simplifying management. This combination is highly suitable for architects seeking a globally distributed, highly available, cost-efficient, and low-maintenance database solution.

QUESTION 80

A company wants to use a custom distributed application that calculates various profit and loss scenarios. To achieve this goal, the company needs to provide a network connection between its Amazon EC2 instances. The connection must minimize latency and must maximize throughput.

Which solution will meet these requirements?

A. Provision the application to use EC2 Dedicated Hosts of the same instance type.
B. Configure a placement group for EC2 instances that have the same instance type.
C. Use multiple AWS elastic network interfaces and link aggregation.
D. Configure AWS PrivateLink for the EC2 instances.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Configure a placement group for EC2 instances that have the same instance type.

Description: A placement group is a logical grouping of instances within an Availability Zone. AWS offers different types of placement groups: Cluster (for low latency, high throughput), Spread (for high availability), and Partition (for distributed workloads with rack awareness). For applications requiring low-latency and high-throughput network performance between instances, a Cluster Placement Group is the appropriate choice. Instances within a Cluster Placement Group are launched close together within an Availability Zone, often on the same underlying hardware, to minimize network latency.
Why this fits: The core requirement of "low-latency and high-throughput communication between EC2 instances" directly aligns with the purpose of a Cluster Placement Group. By placing instances of the same type within such a group, the application can achieve the best possible network performance within AWS.

Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

QUESTION 81

A company wants to migrate 70 TB of data from its on-premises data center to AWS. The data is a mix of structured and unstructured data. The company wants to use a one-time migration strategy that is secure and cost-effective.

Which AWS service will meet these requirements?

A. Amazon Elastic File System (Amazon EFS)
B. AWS Storage Gateway
C. AWS Snowball Edge
D. AWS Database Migration Service (AWS DMS)

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ AWS Snowball Edge

Description: AWS Snowball Edge is a robust, secure, and portable data migration and edge computing device. It is designed to transfer large amounts of data (from tens of terabytes to petabytes) into and out of AWS, especially in environments with limited or no network connectivity. Beyond data transfer, Snowball Edge also offers on-device compute capabilities (using EC2 instances, Lambda functions) and storage (compatible with Amazon S3 APIs) for local processing, data collection, and machine learning inference at the edge, before or after data migration.
Why this fits: In the context of the SAA-C03 exam, AWS Snowball Edge is the optimal solution for scenarios involving massive data migration (petabytes) from on-premises data centers or remote locations where network bandwidth is insufficient, unreliable, or non-existent. It physically transports data, bypassing network bottlenecks. Its integrated compute capabilities make it particularly suitable for edge computing use cases, such as collecting and processing sensor data in disconnected environments, running analytics, or performing machine learning inference locally before shipping aggregated data to AWS for deeper analysis. This combination of large-scale data transfer and local processing makes it a versatile tool for hybrid cloud architectures and data ingest strategies.

QUESTION 82

A company runs a MySQL database on a single Amazon EC2 instance.

The company needs to improve availability of the database to prepare for power outages.

Which solution will meet this requirement?

A. Add an Application Load Balancer (ALB) in front of the EC2 instance.
B. Configure EC2 automatic instance recovery to move the instance to another Availability Zone.
C. Migrate the MySQL database to Amazon RDS and enable Multi-AZ deployment
D. Enable termination protection for the EC2 instance.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Migrate the MySQL database to Amazon RDS and enable Multi-AZ deployment

Description: Amazon Relational Database Service (RDS) Multi-AZ deployment provides enhanced availability and durability for database instances. When Multi-AZ is enabled, AWS automatically provisions and maintains a synchronous standby replica of your primary database instance in a different Availability Zone. In case of an infrastructure failure (e.g., instance failure, storage failure, or Availability Zone outage) affecting the primary instance, RDS automatically fails over to the standby replica, typically within 60-120 seconds, with no manual intervention required.
Why this fits: This solution directly addresses the high availability requirement for the database, which is often a single point of failure in traditional setups. By migrating the MySQL database to RDS Multi-AZ, the database becomes resilient to Availability Zone failures, ensuring that the application can continue operating even if the primary database AZ becomes unavailable. This is a fundamental best practice for achieving high availability for relational databases on AWS.

QUESTION 83

A company uses Amazon Redshift for its data warehouse. The company wants to ensure high durability for its data in case of any component failure.

What should a solutions architect recommend?

A. Enable concurrency scaling.
B. Enable cross-Region snapshots.
C. Increase the data retention period.
D. Deploy Amazon Redshift in Multi-AZ.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Enable cross-Region snapshots.

Description: Cross-Region snapshots involve automatically copying snapshots of your data (e.g., from Amazon EBS volumes, Amazon RDS databases, Amazon Aurora clusters, or Amazon DynamoDB tables) from a primary AWS Region to a designated secondary AWS Region. This creates an isolated, geographically distant copy of your critical data.
Why this fits: This solution directly addresses the need for disaster recovery and business continuity for data. By having a copy of your data in a separate AWS Region, you ensure that if the primary Region experiences a major outage or disaster, your data is still available and can be restored in the secondary Region. This is a fundamental strategy for achieving a low Recovery Point Objective (RPO) and Recovery Time Objective (RTO) for your data across AWS Regions. The other options either address intra-region availability (Multi-AZ for Redshift), performance (concurrency scaling), or single-region retention, none of which provide cross-region data resilience as effectively as cross-Region snapshots.

Reference: https://aws.amazon.com/blogs/storage/cross-region-copy-for-aws-backup-is-now-generally-available/

QUESTION 84

A solutions architect needs to optimize a large data analytics job that runs on an Amazon EMR cluster. The job takes 13 hours to finish. The cluster has multiple core nodes and worker nodes that are deployed on large, compute-optimized instances.

After reviewing EMR logs, the solutions architect discovers that several nodes are idle for more than 5 hours while the job is running. The solutions architect needs to optimize cluster performance.

Which solution will meet this requirement MOST cost-effectively?

A. Increase the number of core nodes to ensure there is enough processing power to handle the analytics job without any idle time.
B. Use the EMR managed scaling feature to automatically resize the cluster based on workload.
C. Migrate the analytics job to a set of AWS Lambda functions. Configure reserved concurrency for the functions.
D. Migrate the analytics job core nodes to a memory-optimized instance type to reduce the total job runtime.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Use the EMR managed scaling feature to automatically resize the cluster based on workload.

Description: Amazon EMR managed scaling is a feature that automatically resizes an EMR cluster based on predefined or intelligent metrics like YARN memory and CPU utilization. It dynamically adds or removes EC2 instances to optimize performance and cost for varying workloads, ensuring that sufficient resources are available during peak demand and scaling down during periods of lower activity to save costs.
Why this fits: For analytics jobs on EMR, workloads often fluctuate. Manually resizing a cluster is inefficient and can lead to either under-provisioning (poor performance) or over-provisioning (increased costs). EMR managed scaling directly addresses this challenge by automating the scaling process, ensuring the cluster has the right amount of compute capacity at any given time. This optimizes both performance and cost-efficiency without requiring constant manual intervention, making it the ideal solution for dynamically adjusting to varying workloads.

QUESTION 85

A financial services company plans to launch a new application on AWS to handle sensitive financial transactions. The company will deploy the application on Amazon EC2 instances. The company will use Amazon RDS for MySQL as the database. The company’s security policies mandate that data must be encrypted at rest and in transit.

Which solution will meet these requirements with the LEAST operational overhead?

A. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure AWS Certificate Manager (ACM) SSUTLS certificates for encryption in transit.
B. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure IPsec tunnels for encryption in transit.
C. Implement third-party application-level data encryption before storing data in Amazon RDS for MySQL. Configure AWS Certificate Manager (ACM) SSL/TLS certificates for encryption in transit.
D. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure a VPN connection to enable private connectivity to encrypt data in transit.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure AWS Certificate Manager (ACM) SSL/TLS certificates for encryption in transit.

Description: This choice outlines the standard and recommended AWS-native methods for ensuring both data at rest and data in transit are encrypted for Amazon RDS for MySQL databases.

Encryption at Rest (AWS KMS): Amazon RDS integrates with AWS Key Management Service (KMS) to encrypt database instances and snapshots at rest. When encryption is enabled for an RDS instance, data stored on the underlying storage, backups, read replicas, and snapshots are all encrypted using keys managed by KMS. This provides robust, transparent, and compliant encryption.
Encryption in Transit (SSL/TLS with Certificates): For data moving between clients and the Amazon RDS instance, SSL/TLS (Secure Sockets Layer/Transport Layer Security) is the standard protocol to encrypt the connection. Amazon RDS supports SSL/TLS connections, requiring clients to use a server certificate to authenticate the database instance. While RDS uses its own trusted Certificate Authority (CA) certificates for the database instance itself, AWS Certificate Manager (ACM) is the AWS service for provisioning, managing, and deploying public and private SSL/TLS certificates for use with other AWS services, enabling a secure end-to-end encrypted communication path.

Why this fits: This option provides the most appropriate and AWS-native solution for both encryption types for an Amazon RDS for MySQL database.

KMS for at-rest encryption is the best practice and fully integrated method for RDS, offering easy management and strong security.
SSL/TLS (managed by certificates, often via services like ACM or specific RDS CA certs) is the industry-standard and recommended protocol for encrypting database client-server communication. This ensures that data is protected from eavesdropping and tampering as it travels over the network. Other options like IPsec or VPNs are typically for network-level tunnel encryption between distinct networks or specific client types, whereas SSL/TLS specifically secures the application data stream to the database.

QUESTION 86

A company runs multiple Windows workloads on AWS. The company’s employees use Windows file shares that are hosted on two Amazon EC2 instances. The files hares synchronize data between themselves and maintain duplicate copies. The company wants a highly available and durable storage solution that preserves how users currently access the files.

What should a solutions architect do to meet these requirements?

A. Migrate all the data to Amazon S3. Set up IAM authentication for users to access files.
B. Set an Amazon S3 File Gateway. Mount the S3 File Gateway on the existing EC2 instances.
C. Extend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.
D. Extend the file Share environment to Amazon Elastic File System (Amazon EFS) with a Multi-AZ Migrate data to EFS.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Extend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.

Description: Amazon FSx for Windows File Server provides a fully managed, highly reliable, and scalable native Microsoft Windows file system. It’s built on Windows Server and provides full support for the Server Message Block (SMB) protocol, NTFS, and Active Directory integration, making it ideal for migrating or extending existing Windows-based file shares to AWS. A Multi-AZ configuration ensures high availability and automatic failover across different Availability Zones.
Why this fits: The question specifies an existing "Windows file share environment." FSx for Windows File Server is purpose-built for this exact scenario. It natively supports the SMB protocol, NTFS permissions, and integrates seamlessly with Active Directory, which are all fundamental requirements for a Windows file share. Extending the environment to FSx allows for a lift-and-shift of data and applications that rely on these Windows-specific file system features, ensuring compatibility and minimizing refactoring. The Multi-AZ configuration provides the necessary high availability and durability for a critical file share, aligning with best practices for production environments.

QUESTION 87

A database is on an Amazon RDS MySQL 5.6 Multi-AZ DB instance that experiences highly dynamic reads. Application developers notice a significant slowdown when testing read performance from a secondary AWS Region. The developers want a solution that provides less than 1 second of read replication latency.

What should the solutions architect recommend?

A. Install MySQL on Amazon EC2 in the secondary Region.
B. Migrate the database to Amazon Aurora with cross-Region replicas.
C. Create another RDS for MySQL read replica in the secondary Region.
D. Implement Amazon Elasti Cache to improve database query performance.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Migrate the database to Amazon Aurora with cross-Region replicas.

Description: Amazon Aurora is a fully managed, high-performance relational database service compatible with MySQL and PostgreSQL. Amazon Aurora Global Database is a feature that enables a single Aurora database to span multiple AWS regions, providing robust disaster recovery and low-latency global reads. It utilizes dedicated infrastructure for asynchronous replication between regions, allowing for a typical Recovery Point Objective (RPO) in seconds and a Recovery Time Objective (RTO) in under a minute for planned and unplanned regional failovers.
Why this fits: This option provides the most robust, highly available, and performant solution for a database requiring cross-Region resilience and potentially low-latency access from multiple geographies. Aurora Global Database is specifically designed for disaster recovery with minimal data loss and rapid recovery times, making it superior to standard RDS cross-region read replicas in demanding scenarios. Migrating to Aurora leverages a cloud-native database designed for extreme availability and performance, which is a common best practice for critical applications in a multi-region architecture on AWS.

Reference: https://aws.amazon.com/rds/aurora/global-database/

QUESTION 88

A company has a three-tier web application. An Application Load Balancer (ALB) is in front of Amazon EC2 instances that are in the ALB target group. An Amazon S3 bucket stores documents.

The company requires the application to meet a recovery time objective (RTO) of 60 seconds.

Which solution will meet this requirement?

A. Replicate S3 objects to a second AWS Region. Create a second ALB and a minimum set of EC2 instances in the second Region. Ensure that the EC2 instances are shut down until they are needed. Configure Amazon Route 53 to fail over to the second Region by using an IP-based routing policy.
B. use AWS Backup to take hourly backups of the EC2 instances. Back up the S3 data to a second AWS Region. use AWS CloudFormation to deploy the entire infrastructure in the second Region when needed.
C. Create daily snapshots of the EC2 instances in a second AWS Region. Use the snapshots to recreate the instances in the second Region. Back up the S3 data to the second Region. Perform a failover by modifying the application DNS record when needed.
D. Replicate S3 objects to a second AWS Region. Create a second ALB and a minimum set of EC2 instances in the second Region. Ensure that the EC2 instances in the second Region are running. Configure Amazon Route 53 to fail over to the secondary Region based on health checks.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Replicate S3 objects to a second AWS Region. Create a second ALB and a minimum set of EC2 instances in the second Region. Ensure that the EC2 instances in the second Region are running. Configure Amazon Route 53 to fail over to the secondary Region based on health checks.

Description: This choice describes a "Pilot Light" or "Warm Standby" disaster recovery (DR) strategy. S3 objects are continuously replicated (using Cross-Region Replication – CRR) to a secondary region, ensuring a low Recovery Point Objective (RPO). In the secondary region, essential infrastructure like an Application Load Balancer (ALB) and a scaled-down set of EC2 instances are already deployed and running. This minimizes the Recovery Time Objective (RTO) as the infrastructure is pre-provisioned and can quickly scale up to handle full production load. Amazon Route 53 is configured with health checks to automatically detect failures in the primary region and redirect traffic to the healthy secondary region, providing automated failover.
Why this fits: This is a best-practice, highly available, and resilient multi-region DR solution commonly recommended for critical applications.

S3 Replication: Achieves low RPO for data.
Running EC2 instances and ALB: Establishes a "warm" environment ready to take over, ensuring a low RTO. This is more effective than having instances shut down (which would incur startup time) or relying solely on backups/CloudFormation deployment on demand (which would have higher RTO).
Route 53 with Health Checks: Provides automated, robust, and fast failover based on the actual health of the application endpoints, which is crucial for minimizing downtime without manual intervention. This is superior to manual DNS record updates or simple IP-based routing without health checks for dynamic failover.

QUESTION 89

A company is building a web application. The company needs a load balancing solution that supports HTTPS header-based routing. The company’s security team also requires a rules- based method of blocking specific incoming requests to decrease the effects of malicious activity.

Which solution will meet these requirements?

A. Create an Application Load Balancer (ALB). Configure an HTTPS listener with mutual TLS enabled.
B. Create an Application Load Balancer (ALB). Integrate the ALB with AWS WAF. Configure the security team's required rules.
C. Create an Application Load Balancer (ALB). Integrate the ALB with AWS Config. Apply custom rules to all ALB resources.
D. Create a Network Load Balancer (NLB). Configure AWS Network Firewall with the security team's required rules.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Create an Application Load Balancer (ALB). Integrate the ALB with AWS WAF. Configure the security team’s required rules.

Description: An Application Load Balancer (ALB) operates at Layer 7 of the OSI model, making it suitable for advanced routing based on HTTP/HTTPS headers, hostnames, and paths. AWS WAF (Web Application Firewall) is a security service that protects web applications from common web exploits and bots by allowing you to create custom rules to filter, block, or monitor specific HTTP/S requests.
Why this fits: The scenario requires a load balancing solution that supports "HTTPS header-based routing," which is a key feature of an ALB operating at Layer 7. Furthermore, the need for a "rules-based method of blocking specific incoming requests to decrease the effects of malicious activity" directly points to the functionality provided by AWS WAF. Integrating AWS WAF with an ALB allows the security team to define rules (e.g., based on IP addresses, SQL injection patterns, cross-site scripting) to protect the web application from various threats, fulfilling all the requirements.

QUESTION 90 (Multi-Select)

A company is designing a web application with an internet-facing Application Load Balancer (ALB). The company needs the ALB to receive HTTPS web traffic from the public internet. The ALB must send only HTTPS traffic to the web application servers hosted on the Amazon EC2 instances on port 443. The ALB must perform a health check of the web application servers over HTTPS on port 8443.

Which combination of configurations of the security group that is associated with the ALB will meet these requirements? (Select THREE.)

A. Allow HTTPS inbound traffic from 0.0.0.0/0 for port 443.
B. Allow all outbound traffic to 0.0.0.0/0 for port 443.
C. Allow HTTPS outbound traffic to the web application instances for port 443.
D. Allow HTTPS inbound traffic from the web application instances for port 443.
E. Allow HTTPS outbound traffic to the web application instances for the health check on port 8443.
F. Allow HTTPS inbound traffic from the web application instances for the health check on port 8443.

Click to View Verified Solution & Explanation

Correct Option: A,C,E

Explanation: ✅ Choice A: Allow HTTPS inbound traffic from 0.0.0.0/0 for port 443.

Description: This security group rule permits incoming network connections using the HTTPS protocol (port 443) from any IP address on the internet (represented by 0.0.0.0/0).
Why this fits: For any public-facing web service, such as an Application Load Balancer (ALB) or a web server directly exposed to the internet, this rule is essential to allow external users to securely access the application via HTTPS.

✅ Choice C: Allow HTTPS outbound traffic to the web application instances for port 443.

Description: This security group rule permits outgoing network connections using the HTTPS protocol (port 443) from a source (e.g., an Application Load Balancer) to a set of target resources, specifically backend web application instances.
Why this fits: In a typical multi-tier architecture, an Application Load Balancer receives client requests and then forwards them to backend EC2 instances. If the communication between the ALB and these backend instances is encrypted using HTTPS on port 443, the ALB’s security group must have an outbound rule allowing this traffic to the security group of the web application instances.

✅ Choice E: Allow HTTPS outbound traffic to the web application instances for the health check on port 8443.

Description: This security group rule permits outgoing network connections using the HTTPS protocol to a specific set of target resources, primarily for health check purposes on a potentially non-standard or custom port, such as 8443.
Why this fits: Load balancers (like ALBs) and Auto Scaling Groups perform regular health checks on their registered instances to determine their availability and responsiveness. If these health checks are configured to use HTTPS on a specific custom port (e.g., 8443), the component initiating the health check (e.g., the ALB) needs an outbound security group rule to allow this traffic to the web application instances on that port. Correspondingly, the web application instances’ security group would need an inbound rule to permit this health check traffic.

QUESTION 91

A solutions architect is designing an application that helps users fill out and submit registration forms. The solutions architect plans to use a two-tier architecture that includes a web application server tier and a worker tier.

The application needs to process submitted forms quickly. The application needs to process each form exactly once. The solution must ensure that no data is lost.

Which solution will meet these requirements?

A. Use an Amazon Simple Queue Service (Amazon SQS) FIFO queue between the web application server tier and the worker tier to store and forward form data.
B. Use an Amazon API Gateway HTTP API between the web application server tier and the worker tier to store and forward form data.
C. Use an Amazon Simple Queue Service (Amazon SQS) standard queue between the web application server tier and the worker tier to store and forward form data.
D. Use an AWS Step Functions workflow. Create a synchronous workflow between the web application server tier and the worker tier that stores and forwards form data.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Use an Amazon Simple Queue Service (Amazon SQS) FIFO queue between the web application server tier and the worker tier to store and forward form data.

Description: Amazon SQS FIFO (First-In, First-Out) queues guarantee that messages are processed exactly once and in the exact order in which they are sent. This is crucial for scenarios where message order and prevention of duplicate processing are vital.
Why this fits: When handling "form data," it is often critical to maintain the order of submissions (e.g., sequential updates from a user) and to ensure that each submission is processed exactly once to prevent data inconsistencies or errors. An SQS FIFO queue provides these guarantees (ordered delivery and exactly-once processing), making it the most suitable choice for reliably storing and forwarding form data from a web application to a worker tier for asynchronous processing. This approach decouples the web tier from the worker tier, improving scalability and responsiveness of the web application.

Reference: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/FIFO-queues-versus-standard-queues.html

QUESTION 92

A company is hosting its website on Amazon S3 and is using Amazon CloudFront to cache content The company has an upcoming product launch. An employee accidentally published marketing content to the website before the official release of the product. The company needs to remove the marketing content from the website as quickly as possible.

Which solution will meet these requirements?

A. Deploy the updated version of the website to another S3 bucket. Update the origin for CloudFront.
B. Delete the marketing content in the existing S3 bucket. Invalidate the file path in CloudFront.
C. Create a new CloudFront cache policy with a low TTL. Associate the new policy with the existing CloudFront distribution.
D. Delete the marketing content in the existing S3 bucket. Update the S3 bucket policy to block requests to the file path.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Delete the marketing content in the existing S3 bucket. Invalidate the file path in CloudFront.

Description: This two-step process involves first removing the desired content from its origin storage (Amazon S3) and then immediately purging any cached copies of that content from CloudFront’s edge locations. Deleting the content from S3 ensures it’s no longer available at the source. Invalidating the file path in CloudFront tells CloudFront to remove its cached version of that specific object (or objects matching a path pattern) and fetch the latest version (or a 404 if deleted) from the origin on subsequent requests.
Why this fits: When content served via CloudFront needs to be removed or updated immediately, simply deleting it from the S3 origin is not enough. CloudFront caches content at its global edge locations, and it will continue to serve the cached, outdated version until its Time-To-Live (TTL) expires. To force CloudFront to stop serving the old content and recognize its removal (or fetch the new version), an invalidation request must be issued for the specific file path(s). This ensures that the change is reflected to end-users almost immediately, rather than waiting for cache expiration.

QUESTION 93

An international company needs to share data from an Amazon S3 bucket to employees who are located around the world. The company needs a secure solution to provide employees with access to the S3 bucket- The employees are already enrolled in AWS IAM Identity Center.

Which solution will meet these requirements with the LEAST operational overhead?

A. Create a help desk application to generate an Amazon S3 presigned URL for each employee- Configure the presigned URLs to have short expirations. Instruct employees to contact the company help desk to receive a presigned URL to access the S3 bucket.
B. Create a group for Amazon S3 access in IAM Identity Center. Add the employees who require access to the S3 bucket to the group. Create an IAM policy to allow Amazon S3 access from the group. Instruct employees to use the AWS access portal to access the AWS Management Console and navigate to the S3 bucket.
C. Create an Amazon S3 File Gateway. Create one share for data uploads and a second share for data downloads. Set up an SFTP service on an Amazon EC2 instance. Mount the shares to the EC2 instance. Instruct employees to use the SFTP server.
D. Configure AWS Transfer Family SFTP endpoints. Select the custom identity provider option. Use AWS Secrets Manager to manage the user credentials. Instruct employees to use Transfer Family SFTP

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Choice B: Create a group for Amazon S3 access in IAM Identity Center. Add the employees who require access to the S3 bucket to the group. Create an IAM policy to allow Amazon S3 access from the group. Instruct employees to use the AWS access portal to access the AWS Management Console and navigate to the S3 bucket.

Description: AWS IAM Identity Center (formerly AWS SSO) provides a centralized way to manage workforce access to multiple AWS accounts and cloud applications. By integrating with an existing corporate directory (or using its own directory), it allows users to sign in once to a user portal, from which they can access assigned AWS accounts with temporary, role-based credentials via the AWS Management Console. Permissions are managed by assigning permission sets (which contain IAM policies) to groups or users within specific AWS accounts.
Why this fits: This approach represents the AWS best practice for managing human user access to AWS resources. It provides several benefits:

Centralized Identity Management: IAM Identity Center simplifies managing access for a large number of employees by integrating with existing identity sources (e.g., Active Directory) or managing users directly.
Scalability and Manageability: Permissions are granted to groups, not individual users, making it easy to onboard/offboard employees or change their access by simply adding/removing them from groups.
Security: Employees access the S3 bucket (and the AWS Management Console) using temporary, federated credentials, eliminating the need to manage long-term IAM user credentials, which significantly reduces the risk associated with static credentials.
User Experience: Employees use a familiar AWS access portal for single sign-on, simplifying their interaction with AWS services. This allows them to browse and manage objects in S3 directly via the console, which is often a requirement for general employee access.
Granular Control: IAM policies attached to permission sets (assigned via groups) ensure that access to the S3 bucket is precisely controlled.

Reference: https://aws.amazon.com/identity-access-management/identity-center/

QUESTION 94

A company is migrating an application from an on-premises location to Amazon Elastic Kubernetes Service (Amazon EKS). The company must use a custom subnet for pods that are in the company’s VPC to comply with requirements. The company also needs to ensure that the pods can communicate securely within the pods’ VPC.

Which solution will meet these requirements?

A. Configure AWS Transit Gateway to directly manage custom subnet configurations for the pods in Amazon EKS.
B. Create an AWS Direct Connect connection from the company’s on-premises IP address ranges to the EKS pods.
C. Use the Amazon VPC CNI plugin for Kubernetes. Define custom subnets in the VPC cluster for the pods to use.
D. Implement a Kubernetes network policy that has pod anti-affinity rules to restrict pod placement to specific nodes that are within custom subnets.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Use the Amazon VPC CNI plugin for Kubernetes. Define custom subnets in the VPC cluster for the pods to use.

Description: The Amazon VPC CNI (Container Network Interface) plugin for Kubernetes is the default and recommended networking plugin for Amazon EKS. It assigns a private IPv4 address from the VPC’s subnet to each pod, making pods first-class citizens in the VPC network. This allows pods to directly communicate with other resources within the VPC (like EC2 instances, RDS databases, etc.) using standard VPC routing.
Why this fits: The core requirement is for EKS pods to use custom subnets. The Amazon VPC CNI plugin is precisely what enables this. By default, pods might get IPs from the same subnet as their host EC2 instances. However, the VPC CNI plugin can be configured, often in conjunction with custom networking configurations (e.g., using a custom CNI configuration, multiple ENIs, or prefix assignment), to allocate IP addresses to pods from specific, designated subnets within your VPC that are different from the node’s primary subnet. This approach directly addresses the need for pods to reside in and use IP addresses from custom subnets.

Reference: https://docs.aws.amazon.com/eks/latest/userguide/cni-options.html

QUESTION 95

A company has deployed a multiplayer game for mobile devices. The game requires live location tracking of players based on latitude and longitude. The data store for the game must support rapid updates and retrieval of locations.

The game uses an Amazon RDS for PostgreSQL DB instance with read replicas to store the location data. During peak usage periods, the database is unable to maintain the performance that is needed for reading and writing updates. The game’s user base is increasing rapidly.

What should a solutions architect do to improve the performance of the data tier?

A. Take a snapshot of the existing DB instance. Restore the snapshot with Multi-AZ enabled.
B. Migrate from Amazon RDS to Amazon Elasticsearch Service (Amazon ES) with Kibana.
C. Deploy Amazon DynamoDB Accelerator (DAX) in front of the existing DB instance. Modify the game to use DAX.
D. Deploy an Amazon ElastiCache for Redis cluster in front of the existing DB instance. Modify the game to use Redis.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Deploy an Amazon ElastiCache for Redis cluster in front of the existing DB instance. Modify the game to use Redis.

Description: Amazon ElastiCache for Redis is a fully managed, in-memory data store service that provides blazing-fast performance for read-heavy applications by caching frequently accessed data. It significantly reduces the load on the primary database and improves application response times.
Why this fits: For game applications, common performance bottlenecks often arise from high volumes of read requests for player data, leaderboards, session states, or item inventories. Deploying ElastiCache for Redis allows these frequent reads to be served from the low-latency cache instead of hitting the relational database instance directly. This offloads the primary database, improves read performance, and enhances scalability without requiring a fundamental redesign of the core database. Modifying the game to use Redis involves implementing caching logic in the application layer (e.g., check cache first, if not found, read from DB and populate cache).

QUESTION 96

A company needs a backup strategy for a multi-AZ deployment for Amazon RDS for SQL Server. The company must keep data available for 1 year to maintain compliance. The company must be able to restore the database from the backup.

Which solution will meet these requirements with the LEAST operational overhead?

A. Create an RDS automated snapshot backup daily Save the backup to an Amazon S3 bucket Configure the retention of the backup to be 1 year.
B. Manually take an RDS full database backup daily Save the backup to an Amazon S3 bucket. Configure the retention of the backup to be 1 year.
C. Take a SQL Server transaction backup daily Save the backup to an Amazon S3 bucket. Configure the retention of the backup to be 1 year.
D. Take an RDS backup by using AWS Backup daily Configure the retention of the backup to be 1 year.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Take an RDS backup by using AWS Backup daily Configure the retention of the backup to be 1 year.

Description: AWS Backup is a fully managed backup service that centralizes and automates data protection across AWS services. It allows you to define backup plans that include backup frequency (e.g., daily), retention policies (e.g., 1 year), and lifecycle management for various AWS resources, including Amazon RDS databases.
Why this fits: This option provides the most comprehensive, automated, and centralized solution for managing RDS backups according to the specified requirements. AWS Backup integrates directly with Amazon RDS to perform snapshots, ensuring data integrity and enabling point-in-time recovery where applicable. By using AWS Backup, an architect can easily define a daily backup schedule and a 1-year retention policy, making it the most suitable and recommended AWS-native approach for enterprise-grade backup strategies. The other options are either less automated, less centralized, or describe internal RDS mechanisms less directly managed by a separate backup policy.

QUESTION 97

A media company is using video conversion tools that run on Amazon EC2 instances. The video conversion tools run on a combination of Windows EC2 instances and Linux EC2 instances. Each video file is tens of gigabytes in size. The video conversion tools must process the video files in the shortest possible amount of time. The company needs a single, centralized file storage solution that can be mounted to all the EC2 instances that host the video conversion tools.

Which solution will meet these requirements?

A. Deploy Amazon FSx for Windows File Server with hard disk drive (HDD) storage.
B. Deploy Amazon FSx for Windows File Server with solid state drive (SSD) storage.
C. Deploy Amazon Elastic File System (Amazon EFS) with Max I/O performance mode.
D. Deploy Amazon Elastic File System (Amazon EFS) with General Purpose performance mode-

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Deploy Amazon Elastic File System (Amazon EFS) with Max I/O performance mode.

Description: Amazon EFS is a scalable, elastic, shared NFS file system designed to be used with AWS Cloud services and on-premises resources. It automatically grows and shrinks as you add and remove files, and it can be accessed concurrently by thousands of EC2 instances. The Max I/O performance mode is specifically optimized for applications that require the highest levels of aggregate throughput and IOPS across many clients, at the cost of slightly higher latency for individual file operations compared to the General Purpose mode.
Why this fits: While the specific question text is not provided, in the context of SAA-C03, choosing EFS with Max I/O performance mode is typically the correct answer when a scenario demands extremely high aggregate throughput and IOPS, often for massively parallel applications (e.g., big data analytics, machine learning training, media processing, content rendering farms) that access the file system from a large number of EC2 instances. It provides the highest scalability for read and write operations across many concurrent connections. Choices A and B (FSx for Windows File Server) are typically for Windows-native file shares (SMB protocol) and would not be the primary choice for high-performance, massively parallel Linux workloads requiring an NFS-based file system. Choice D (EFS General Purpose) is suitable for most applications requiring lower latency for individual operations but has lower aggregate throughput and IOPS limits than Max I/O, making it less ideal for the most demanding parallel workloads.

Reference: https://docs.aws.amazon.com/efs/latest/ug/performance-modes.html

QUESTION 98

An online gaming company hosts its platform on Amazon EC2 instances behind Network Load Balancers (NLBs) across multiple AWS Regions. The NLBs can route requests to targets over the internet. The company wants to improve the customer playing experience by reducing end-to-end load time for its global customer base.

Which solution will meet these requirements?

A. Create Application Load Balancers (ALBs) in each Region to replace the existing NLBs. Register the existing EC2 instances as targets for the ALBs in each Region.
B. Configure Amazon Route 53 to route equally weighted traffic to the NLBs in each Region.
C. Create additional NLBs and EC2 instances in other Regions where the company has large customer bases.
D. Create a standard accelerator in AWS Global Accelerator. Configure the existing NLBs as target endpoints.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Create a standard accelerator in AWS Global Accelerator. Configure the existing NLBs as target endpoints.

Description: AWS Global Accelerator is a networking service that improves the availability and performance of applications with global users. It uses the AWS global network infrastructure, routing user traffic through the optimal path to application endpoints in different AWS Regions. It provides two static Anycast IP addresses as a fixed entry point and supports various endpoint types, including Network Load Balancers (NLBs), Application Load Balancers (ALBs), EC2 instances, and Elastic IP addresses. A "standard accelerator" is the typical configuration for general internet-facing applications.
Why this fits: For applications fronted by Network Load Balancers (NLBs) in multiple AWS Regions, AWS Global Accelerator provides significant benefits for global users. By placing an accelerator in front of the existing NLBs, user traffic enters the AWS global network at an edge location closest to them. This traffic then traverses the highly optimized AWS backbone to the healthiest and closest NLB endpoint, significantly reducing latency and improving application performance and availability compared to routing directly over the public internet. This solution is specifically designed to optimize performance for applications that need to route traffic to multiple regional load balancers and is ideal for scenarios involving NLBs due to their Layer 4 nature.

QUESTION 99

A solutions architect is designing a scalable web application that runs on Amazon EC2. The application users must stay on the same server after login. The application must be protected from common exploits.

Which solution will meet these requirements?

A. Create an Application Load Balancer (ALB) with a target group. Attach the target group to an Auto Scaling group. Enable duration-based stickiness on the target group. Associate the ALB with an AWS Network Firewall firewall.
B. Create a Network Load Balancer (NLB) with a target group. Attach the target group to an Auto Scaling group. Associate the NLB with an AWS WAF web ACL.
C. Create an Application Load Balancer (ALB) with a target group. Attach the target group to an Auto Scaling group. Enable application-based stickiness on the target group. Associate the ALB with an AWS WAF web ACL.
D. Create a Network Load Balancer (NLB) with a target group. Attach the target group to an Auto Scaling group. Enable target group stickiness on the NLB. Associate the NLB with an AWS Network Firewall firewall.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Create a Network Load Balancer (NLB) with a target group. Attach the target group to an Auto Scaling group. Enable target group stickiness on the NLB. Associate the NLB with an AWS Network Firewall firewall.

Description: This option details a comprehensive and technically sound architecture for distributing Layer 4 (TCP/UDP) traffic, ensuring scalability, client affinity, and robust network-level security.
Why this fits:

Network Load Balancer (NLB): NLBs are designed for extreme performance, low latency, and high throughput for TCP, UDP, and TLS traffic at Layer 4 of the OSI model. This choice is appropriate when the application requires L4 load balancing rather than L7 (HTTP/S) capabilities.
Auto Scaling Group Integration: Attaching the target group to an Auto Scaling group is standard practice for achieving elasticity. It ensures that the application’s backend capacity scales automatically with demand, maintaining performance and availability.
Target Group Stickiness on NLB: NLBs provide target group stickiness based on the client’s source IP address. This feature ensures that all requests from a specific client IP are consistently routed to the same target instance, which is critical for applications that need to maintain session state at Layer 4.
AWS Network Firewall Association: AWS Network Firewall operates at Layers 3 (Network) and 4 (Transport). It provides stateful inspection, intrusion prevention, and web filtering capabilities for traffic flowing through your VPC. Associating an NLB with AWS Network Firewall is a valid and effective security measure for inspecting and filtering L3/L4 traffic before it reaches the backend targets. This contrasts with AWS WAF, which operates at Layer 7 and is not compatible with NLBs.

QUESTION 100

A company runs workloads in 20 private VPCs. Each VPC has interface VPC endpoints for many AWS services. The company wants to optimize costs for its network architecture. The company must not use public IP addresses.

Which solution will meet these requirements?

A. Create a NAT gateway in each workload VPC. Remove the interface VPC endpoints. Update the VPC route tables to add a default route to the NAT gateway.
B. Replace the interface VPC endpoints from each workload VPC with gateway endpoints. Update the VPC route tables to route traffic bound for the AWS services to the gateway endpoints.
C. Create interface VPC endpoints and a transit gateway in a new central VPC. Use the transit gateway to connect the workload VPCs to the central VPC. Remove the interface VPC endpoints from the workload VPCs. Set up private hosted zones in the workload VPCs to direct traffic to the central VPC.
D. Create gateway endpoints in a new central VPC. Use VPC peering to connect the workload VPCs to the central VPC. Remove the interface VPC endpoints from workload VPCs. Set up private hosted zones in the workload VPCs to direct traffic to the central VPC.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Create interface VPC endpoints and a transit gateway in a new central VPC. Use the transit gateway to connect the workload VPCs to the central VPC. Remove the interface VPC endpoints from the workload VPCs. Set up private hosted zones in the workload VPCs to direct traffic to the central VPC.

Description: This solution leverages a hub-and-spoke architecture with a Transit Gateway (TGW) in a central VPC. Interface VPC endpoints for various AWS services are provisioned in this central VPC. Workload VPCs connect to this central VPC via the TGW. DNS resolution is handled by private hosted zones (potentially integrated with Route 53 Resolver) in the workload VPCs to direct service traffic privately to the centralized endpoints.
Why this fits: This is a best practice for consolidating access to AWS services (via AWS PrivateLink/Interface Endpoints) across multiple VPCs.

Centralization and Cost Savings: By creating interface VPC endpoints in a central VPC, you reduce the number of endpoints (and associated costs) needed across many workload VPCs.
Scalability with Transit Gateway: A Transit Gateway is the ideal solution for connecting a large number of VPCs in a hub-and-spoke topology, providing scalable and manageable inter-VPC connectivity. It allows workload VPCs to communicate with the central VPC where the endpoints reside.
Private Connectivity: Interface VPC endpoints ensure that traffic to AWS services remains entirely within the AWS private network, enhancing security and performance.
DNS Resolution: Setting up private hosted zones in the workload VPCs (or using Route 53 Resolver rules) ensures that DNS queries for AWS service endpoints resolve to the private IP addresses of the interface endpoints located in the central VPC, rather than public IPs. This directs traffic through the TGW to the centralized endpoints.

QUESTION 101

A company receives data from several sources and stores the data in an Amazon S3 data lake. The company transforms the data and ingests it into multiple downstream data stores, including databases and data warehouses.

A solutions architect wants to design an extract, transform, and load (ETL) pipeline to orchestrate a process to prepare and load the data for analytics activities. The processed data must also be available for stakeholders through dashboards and visualizations.

Which solution will meet these requirements with the LEAST development effort?

A. Use Amazon EMR and a custom Scala script to create ETL pipelines. Use an AWS Lambda function to orchestrate the workflow. Use Amazon OpenSearch Service to generate dashboards and visualizations.
B. Use AWS Glue to create ETL pipelines. use AWS Step Functions to orchestrate the workflow. use Amazon Quick Sight to generate dashboards and visualizations.
C. Use an AWS Lambda function to create ETL pipelines. Use AWS Step Functions to orchestrate the workflow Use Amazon Quick Sight to generate dashboards and visualizations.Use custom scripts that run on Amazon EC2 instances to create ETL pipelines. Use AWS Glue to orchestrate the workflow.
D. Use custom scripts that run on Amazon EC2 instances to create ETL pipelines. Use AWS Glue to orchestrate the workflow. Use AWS Glue DataBrew to generate dashboards and visualizations.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

✅ Option B (Correct)

Reasoning: This solution leverages managed, serverless AWS services specifically designed for each requirement, minimizing development effort. AWS Glue provides serverless ETL capabilities, automatically generating Python/Scala code. AWS Step Functions offers robust, visual workflow orchestration for complex pipelines. Amazon QuickSight is a serverless BI service for creating interactive dashboards.

❌ Why the other choices are incorrect:

Option A is incorrect: Amazon EMR with custom Scala scripts requires significant development and operational overhead for managing clusters and coding. While OpenSearch Service is suitable for visualizations, the ETL part increases effort.
Option C is incorrect: Using AWS Lambda for the entire ETL pipeline is inefficient for large-scale data and complex transformations due to execution limits and required custom development.
Option D is incorrect: Custom scripts on Amazon EC2 instances involve high development effort for coding, managing infrastructure, and scaling. AWS Glue DataBrew is for data preparation, not generating end-user dashboards; Amazon QuickSight is better suited for visualizations.

Reference: https://aws.amazon.com/glue/features/etl/, https://aws.amazon.com/step-functions/features/, https://aws.amazon.com/quicksight/features/

QUESTION 102

A company deployed a serverless application that uses Amazon DynamoDB as a database layer. The application has experienced a large increase in users. The company wants to improve database response time from milliseconds to microseconds and to cache requests to the database.

Which solution will meet these requirements with the LEAST operational overhead?

A. Use DynamoDB Accelerator (DAX).
B. Migrate the database to Amazon Redshift.
C. Migrate the database to Amazon RDS
D. Use Amazon ElastiCache for Redis.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Use DynamoDB Accelerator (DAX).

Description: Amazon DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache for DynamoDB that delivers up to a 10x performance improvement for read-heavy workloads. DAX provides microsecond response times for cached data, significantly reducing read latency, and also helps reduce the consumption of read capacity units (RCUs) on your base DynamoDB tables. It is API-compatible with DynamoDB, meaning applications can often be updated to use DAX with minimal code changes.
Why this fits: While the specific question context is not provided, in a typical SAA-C03 scenario where an existing DynamoDB table needs to have its read performance significantly improved (e.g., to achieve microsecond latency for frequently accessed data) or to reduce read capacity costs for a read-intensive application, DAX is the most appropriate and purpose-built solution. It transparently caches data, handles cache invalidation for strongly consistent reads, and requires minimal application-side complexity compared to implementing a custom caching layer.

Reference: https://aws.amazon.com/dynamodb/dax/

QUESTION 103

A company is building a serverless application to process clickstream data from its website. The clickstream data is sent to an Amazon Kinesis Data Streams data stream from the application web servers.

The company wants to enrich the clickstream data by joining the clickstream data with customer profile data from an Amazon Aurora Multi-AZ database. The company wants to use Amazon Redshift to analyze the enriched data. The solution must be highly available.

Which solution will meet these requirements?

A. Use an AWS Lambda function to process and enrich the clickstream data. Use the same Lambda function to write the clickstream data to Amazon S3. Use Amazon Redshift Spectrum to query the enriched data in Amazon S3.
B. Use an Amazon EC2 Spot Instance to poll the data stream and enrich the clickstream data. Configure the EC2 instance to use the COPY command to send the enriched results to Amazon Redshift.
C. Use an Amazon Elastic Container Service (Amazon ECS) task with AWS Fargate Spot capacity to poll the data stream and enrich the clickstream data. Configure an Amazon EC2 instance to use the COPY command to send the enriched results to Amazon Redshift
D. Use Amazon Data Firehose to load the clickstream data from Kinesis Data Streams to Amazon S3. Use AWS Glue crawlers to infer the schema and populate the AWS Glue Data Catalog. Use Amazon Athena to query the raw data in Amazon S3.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Choice A: Use an AWS Lambda function to process and enrich the clickstream data. Use the same Lambda function to write the clickstream data to Amazon S3. Use Amazon Redshift Spectrum to query the enriched data in Amazon S3.

Description: This solution leverages serverless compute (AWS Lambda) for event-driven data processing and enrichment. It utilizes Amazon S3 as a highly scalable, durable, and cost-effective data lake for storing both raw and enriched data. Finally, it uses Amazon Redshift Spectrum, which allows running SQL queries directly against data stored in S3, eliminating the need to load data into a Redshift cluster.
Why this fits: This approach is highly scalable, cost-effective, and serverless, aligning with modern cloud best practices for data processing and analytics.

AWS Lambda: Provides a fully managed, serverless compute service that can automatically scale to handle varying volumes of clickstream data. It’s ideal for real-time or near real-time processing and enrichment tasks without managing servers.
Amazon S3: Offers virtually unlimited storage capacity at a low cost, making it perfect for a data lake where enriched clickstream data can be stored for long-term retention and subsequent analysis.
Amazon Redshift Spectrum: Enables powerful SQL querying capabilities directly on the enriched data residing in S3. This is highly cost-efficient for querying large datasets without incurring the costs of a continuously running Redshift cluster or needing to ingest all data into Redshift. You pay only for the data scanned, which is perfect for ad-hoc or analytical queries on a data lake.

QUESTION 104

A company runs a non-production Oracle database on an Amazon EC2 instance. The database contains 1 TB of data. The EC2 instance runs in a private subnet of a VPC. A backup of the EC2 instance is taken every day and uploaded to an Amazon S3 bucket. The current backup process uses a NAT gateway to access the S3 bucket.

The company does not want the backup process to use public IP addresses.

Which solution will meet this requirement MOST cost-effectively?

A. Create a gateway endpoint for Amazon S3 in the VPC. Update the route tables.
B. Enable S3 Transfer Acceleration on the S3 bucket. Compress the backup files and use multipart uploads.
C. Create an Amazon CloudFront distribution, and set the S3 bucket as the origin. Upload the backup files to the CloudFront distribution.
D. Use a third-party tool to mount the S3 bucket as a file share on the EC2 instance operating system. Use the file share as the backup target.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Create a gateway endpoint for Amazon S3 in the VPC. Update the route tables.

Description: A gateway endpoint for Amazon S3 allows instances within your Amazon Virtual Private Cloud (VPC) to privately access S3 buckets without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. When configured, traffic destined for S3 remains entirely within the AWS network. This setup requires updating the VPC’s route tables to direct S3-bound traffic through the endpoint’s prefix list.
Why this fits: This solution is the most appropriate and secure method for an EC2 instance within a private VPC to interact with an S3 bucket for tasks such as backups. By using a gateway endpoint, the backup traffic from the EC2 instance to S3 stays within the AWS network, avoiding the public internet. This enhances security, reduces potential latency, and can optimize data transfer costs as internal VPC to S3 endpoint traffic is generally more cost-effective than egress to the internet. This provides a direct, private, and high-performance path for backup operations.

QUESTION 105

An ecommerce company hosts an API that handles sales requests. The company hosts the API frontend on Amazon EC2 instances that run behind an Application Load Balancer (ALB). The company hosts the API backend on EC2 instances that perform the transactions. The backend tiers are loosely coupled by an Amazon Simple Queue Service (Amazon SQS) queue.

The company anticipates a significant increase in request volume during a new product launch event. The company wants to ensure that the API can handle increased loads successfully.

Which solution will meet these requirements?

A. Double the number of frontend and backend EC2 instances to handle the increased traffic during the product launch event. Create a dead-letter queue to retain unprocessed sales requests when the demand exceeds the system capacity.
B. Place the frontend EC2 instances into an Auto Scaling group. Create an Auto Scaling policy to launch new instances to handle the incoming network traffic.
C. Place the frontend EC2 instances into an Auto Scaling group. Add an Amazon ElastiCache cluster in front of the ALB to reduce the amount of traffic the API needs to handle.
D. Place the frontend and backend EC2 instances into separate Auto Scaling groups. Create a policy for the frontend Auto Scaling group to launch instances based on incoming network traffic.Create a policy for the backend Auto Scaling group to launch instances based the SQS queue backlog.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Place the frontend and backend EC2 instances into separate Auto Scaling groups. Create a policy for the frontend Auto Scaling group to launch instances based on incoming network traffic.Create a policy for the backend Auto Scaling group to launch instances based the SQS queue backlog.

Description: This solution implements a robust, elastic, and decoupled architecture using Auto Scaling groups for both frontend and backend EC2 instances. It leverages specific metrics relevant to each tier’s load: incoming network traffic for the frontend (handling user requests) and Amazon SQS queue backlog for the backend (processing asynchronous tasks).
Why this fits: This is the most comprehensive and effective solution for handling a significant and potentially unpredictable increase in traffic, as described in the scenario.

Separate Auto Scaling Groups (ASG) for Frontend and Backend: This allows each tier to scale independently based on its specific demand. The frontend might experience higher network traffic, while the backend’s bottleneck might be processing the accumulated work.
Frontend ASG based on Incoming Network Traffic: When the frontend (likely behind an Application Load Balancer) receives more requests, the network traffic increases. Scaling out the frontend EC2 instances based on this metric ensures that the application can handle a larger number of concurrent user connections without becoming overwhelmed.
Backend ASG based on SQS Queue Backlog: Using Amazon SQS to decouple the frontend from the backend is a critical best practice for handling spiky loads. The frontend can quickly put sales requests into the queue, returning a quick response to the user. The backend then asynchronously processes these requests. An SQS queue backlog metric is an excellent indicator of the amount of work waiting to be processed. If the backlog grows, it means the current backend capacity isn’t keeping up. Scaling out the backend instances based on this metric ensures that the queue is processed efficiently, preventing it from becoming too large and causing delays or timeouts for the backend processing. This directly addresses the concern about "current capacity for the backend might be exceeded, causing timeouts and failures."

QUESTION 106

A company runs an application on several Amazon EC2 instances. Multiple Amazon Block Store (Amazon EBS) volumes are attached to each EC2 instance. The company needs to back up the configurations and the data of the EC2 instances every night. The application must be recoverable in a secondary AWS Region.

Which solution will meet these requirements in the MOST operationally efficient way?

A. Configure an AWS Lambda function to take nightly snapshots of the application's EBS volumes and to copy the snapshots to a secondary Region.
B. Create a backup plan in AWS Backup to take nightly backups. Copy the backups to a secondary Region. Add the EC2 instances to a resource assignment as part of the backup plan.
C. Create a backup plan in AWS Backup to take nightly backups. Copy the backups to a secondary Region Add the EBS volumes to a resource assignment as part of the backup plan.
D. Configure an AWS Lambda function to take nightly snapshots of the application's EBS volumes and to copy the snapshots to a secondary Availability Zone.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Create a backup plan in AWS Backup to take nightly backups. Copy the backups to a secondary Region. Add the EC2 instances to a resource assignment as part of the backup plan.

Description: AWS Backup is a fully managed service that centralizes and automates data protection across AWS services. A backup plan defines the frequency, retention, and destination (e.g., secondary Region) for backups. Resource assignments specify which AWS resources (like EC2 instances, EBS volumes, RDS databases, etc.) are included in the backup plan.
Why this fits: This option directly addresses all requirements:

Nightly backups: A backup plan can be configured for this frequency.
Application running on EC2 instances: AWS Backup can create application-consistent backups of EC2 instances, capturing both the instance configuration and all attached EBS volumes. This provides a more complete backup than just individual EBS volumes.
Store in a secondary Region for disaster recovery: AWS Backup plans allow configuring copies of backups to secondary AWS Regions, which is a fundamental component of a disaster recovery strategy against regional outages.
Managed and automated: AWS Backup is a managed service, reducing operational overhead compared to custom scripting with Lambda.

QUESTION 107

A company is moving data from an on-premises data center to the AWS Cloud. The company must store all its data in an Amazon S3 bucket. To comply with regulations, the company must also ensure that the data will be protected against overwriting indefinitely.

Which solution will ensure that the data in the S3 bucket cannot overwritten?

A. Enable versioning for the S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3) to protect the data.
B. Disable versioning for the S3 bucket. Configure S3 Object Lock for the S3 bucket with a retention period of 1 year.
C. Enable versioning for the S3 bucket. Configure S3 Object Lock for the S3 bucket with a legal hold.
D. Configure S3 Storage Lens for the S3 bucket. Use server-side encryption with customer-provided keys (SSE-C) to protect the data.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

The company needs to protect data against overwriting indefinitely to comply with regulations. Amazon S3 Object Lock, when enabled on a versioned bucket, provides write-once-read-many (WORM) protection. A legal hold is a type of Object Lock retention that prevents an object from being deleted or overwritten until the legal hold is explicitly removed. This mechanism ensures indefinite protection against overwriting, aligning with regulatory compliance requirements.

Option A is incorrect: While versioning protects against accidental overwriting by keeping previous versions, it does not prevent the deletion of object versions (unless combined with MFA Delete) and does not inherently offer indefinite WORM protection for compliance purposes in the way Object Lock does. SSE-S3 is for encryption, not overwriting prevention.
Option B is incorrect: S3 Object Lock requires versioning to be enabled on the S3 bucket. Disabling versioning makes Object Lock ineffective. Additionally, a 1-year retention period is not ‘indefinitely’.
Option D is incorrect: S3 Storage Lens is an analytics and monitoring feature, not a data protection mechanism against overwriting. SSE-C is a server-side encryption method and does not prevent overwriting.

Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html

QUESTION 108

A retail company stores customer behavior and session activity in Amazon DynamoDB. The company wants to run SQL queries in Amazon Redshift to track customer trends with regular updates. The company needs to automatically replicate the data to Amazon Redshift without developing or managing extract, transform, and load (ETL) pipelines.

Which solution will meet these requirements with the LEAST operational overhead?

A. Use AWS Glue to run ETLjobs on a schedule that extracts data from DynamoDB and loads the data into Amazon Redshift.
B. Use DynamoDB Streams with AWS Lambda functions to send updates to Amazon Redshift in near real time.
C. Use Amazon Redshift Spectrum to query data exported from DynamoDB to Amazon S3.
D. Create a zero-ETL integration between DynamoDB and Amazon Redshift.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

✅ Create a zero-ETL integration between DynamoDB and Amazon Redshift.
Description: The zero-ETL integration between Amazon DynamoDB and Amazon Redshift is a feature that allows seamless, near real-time replication of data from DynamoDB tables to Amazon Redshift data warehouses. This integration eliminates the need for manual ETL (Extract, Transform, Load) processes, custom code, or third-party tools to move operational data to an analytics platform. Data changes in DynamoDB are automatically and continuously replicated to Redshift, making it immediately available for analytical queries. Why this fits: This option represents the most modern, efficient, and operationally simple solution for integrating DynamoDB with Amazon Redshift for analytical purposes. It directly addresses the common challenge of performing complex analytics on DynamoDB data, which is optimized for transactional workloads. By eliminating ETL, it significantly reduces development effort, operational overhead, and latency for data analysis compared to traditional methods involving AWS Glue, Lambda with DynamoDB Streams, or manual data exports. This makes it an ideal choice for a Solutions Architect looking for a scalable, low-maintenance, and cost-effective solution for near real-time analytics.

QUESTION 109

A company needs to use its on-premises LDAP directory service to authenticate Its users to the AWS Management Console. The directory service is not compatible with Security Assertion Markup Language (SAML).

Which solution meets these requirements?

A. Enable AWS IAM Identity Center (AWS Single Sign-On) between AWS and the on-premises LDAP.
B. Create an IAM policy that uses AWS credentials, and integrate the policy into LDAP.
C. Set up a process that rotates the IAM credentials whenever LDAP credentials are updated.
D. Develop an on-premises custom Identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-Ivied credentials.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Develop an on-premises custom Identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-lived credentials.

Description: An identity broker acts as an intermediary between your on-premises identity store (like LDAP) and AWS. When an on-premises user attempts to access AWS resources, they authenticate against the on-premises LDAP. Upon successful authentication, the identity broker application, running on-premises, calls AWS Security Token Service (STS) (e.g., using AssumeRole or a similar API, depending on the integration specifics) to request temporary security credentials (an access key ID, a secret access key, and a session token) for a specific IAM role in AWS. These short-lived credentials are then provided to the user, allowing them to make API calls to AWS without ever possessing long-term AWS credentials.
Why this fits: This approach is a standard, secure, and highly recommended pattern for federating on-premises users (especially from generic LDAP systems that might not be directly SAML 2.0 compliant or integrated with AWS IAM Identity Center) with AWS. It allows users to authenticate using their existing on-premises credentials, while AWS access is granted via temporary, short-lived credentials. This significantly reduces the security risk associated with managing and distributing long-term AWS credentials and aligns with the principle of least privilege and using temporary access.

Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#fed-scenarios-custom-broker

QUESTION 110

A company has a web application that user’s access from around the world. The company has web servers in multiple AWS Regions to support the traffic. A solutions architect must configure an Amazon Route 53 routing policy to send traffic to only the active web servers.

Which configuration meets this requirement?

A. Create a simple routing policy that uses health checks for each Region.
B. Create a multivalve answer routing policy that uses health checks for each Region.
C. Create a egophoricity routing policy with a health check bias of 99 for each Region.
D. Create a weighted routing policy with a health check weight of 100 for each Region.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Create a multivalve answer routing policy that uses health checks for each Region.

Description: An Amazon Route 53 Multivalue Answer routing policy allows you to respond to DNS queries with up to eight healthy records selected randomly. It’s designed to return multiple IP addresses for a domain name, allowing the client-side resolver to try each address in sequence until it finds a working one. Crucially, it integrates with Route 53 health checks to ensure that only the IP addresses of healthy resources are returned in the DNS response. (Note: "Multivalve" is a common typo for "Multivalue").
Why this fits: This policy directly addresses scenarios where you want to provide multiple healthy endpoints to a client (e.g., for client-side load balancing or failover). By using health checks, Route 53 automatically filters out any unhealthy resources and only returns the IP addresses of those that are currently operational. This ensures high availability by directing clients only to working resources without requiring Route 53 to manage the precise traffic distribution like a weighted policy would.

QUESTION 111

A research laboratory needs to process approximately 8 TB of data. The laboratory requires sub-millisecond latencies and a minimum throughput of 6 for the storage subsystem. Hundreds of EC2 instances that run Amazon Linux will distribute process data.

Which solution will meet the performance requirements?

A. Create an Amazon FSx for NetApp ONTAP Be system. Set each volume's policy to ALL. the raw data the file system. the file system the EC2 instances.
B. Create an Amazon S3 bucket to the raw data. Create an Amazon F SX Luster file system that uses persistent SSD option to data export data to Amazon S3. the file system EC2 instances.
C. Create an Amazon S3 bucket to store raw data. Create an Amazon FSX for Luster file system that uses persistent HDD storage. Select the option to import data from and export data to Amazon S3. the fie system the EC2 instances.
D. Create an Amazon FSx for NetApp ONTAP file system. Set each volumes tiering policy to NONE. Import raw data file system. Mount the ae system the EC2 instances.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Create an Amazon S3 bucket to store the raw data. Create an Amazon FSX for Luster file system that uses persistent SSD option to import data from and export data to Amazon S3. Mount the file system to the EC2 instances.

Description: This solution leverages Amazon S3 for durable, scalable, and cost-effective long-term storage of raw data. Amazon FSx for Lustre is a high-performance file system optimized for compute-intensive workloads like HPC, machine learning, and media processing. The "persistent SSD" option provides high throughput and low-latency access to data, and crucially, ensures that data persists even after the FSx file system is deleted (as it’s backed by S3). The ability to import data from S3 and export changes back to S3 creates a seamless, performant, and durable data pipeline. EC2 instances can then mount this high-performance Lustre file system for their processing needs.
Why this fits: This approach is ideal for scenarios requiring both cost-effective, scalable storage for large amounts of raw data (S3) and extremely high-performance, low-latency file system access for compute-intensive tasks (FSx for Lustre with SSD). The integration between FSx for Lustre and S3 via data import/export allows S3 to act as the durable "source of truth" while Lustre provides a fast, temporary working dataset. The "persistent SSD" option specifically caters to the need for high I/O performance and ensures data durability by syncing with S3. This combination is a common and recommended pattern for HPC/ML workloads on AWS.

QUESTION 112

A company has an application that uses Docker containers in its local data center. The application runs on a container host that stores persistent data in a volume on the host. The container instances use the stored persistent data.

The company wants to move the application to a fully managed service because the company does not want to manage any servers or storage infrastructure.

Which solution will meet these requirements?

A. Use Amazon Elastic Kubernetes Service (Amazon EKS) with self-managed nodes. Create an Amazon Elastic Block Store (Amazon EBS) volume attached to an Amazon EC2 instance. Use the EBS volume as a persistent volume mounted in the containers.
B. Use Amazon Elastic Container Service (Amazon ECS) With an AWS Fargate launch type. Create an Amazon Elastic File System (Amazon EFS) volume Add the EFS volume as a persistent storage volume mounted in the containers.
C. Use Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type. Create an Amazon S3 bucket. Map the S3 bucket as a persistent storage volume mounted in the containers.
D. Use Amazon Elastic Container Service (Amazon ECS) with an Amazon EC2 launch type. Create an Amazon Elastic File System (Amazon EFS) volume. Add the EFS volume as a persistent storage volume mounted in the containers.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Use Amazon Elastic Container Service (Amazon ECS) With an AWS Fargate launch type. Create an Amazon Elastic File System (Amazon EFS) volume Add the EFS volume as a persistent storage volume mounted in the containers.

Description: Amazon ECS is a fully managed container orchestration service. AWS Fargate is a serverless compute engine for ECS that allows you to run containers without provisioning or managing servers. Amazon EFS is a scalable, elastic, shared file system service designed to be easily integrated with AWS compute services.
Why this fits: This solution provides a fully serverless and highly scalable architecture for both compute (Fargate) and storage (EFS). Fargate eliminates the need to manage EC2 instances, reducing operational overhead. EFS offers a highly available, durable, and scalable POSIX-compliant file system that can be simultaneously accessed by multiple ECS tasks, making it ideal for persistent and shared data requirements within containerized applications. This combination delivers a modern, cost-effective, and low-maintenance approach to running stateful containerized applications.

QUESTION 113

A retail company runs Its application on AWS. The application uses Amazon EC2 for web servers, Amazon RDS for database services, and Amazon CloudFront for global content distribution. The company needs a solution to mitigate DDoS attacks.

Which solution Will meet this requirement?

A. Implement AWS WAF custom rules to limit the length of query requests Configure CloudFront to work with AWS WAF
B. Enable AWS Shield Advanced. Configure CloudFront to work With Shield Advanced.
C. Use Amazon Inspector to scan the EC2 instances. Enable Amazon Guard Duty.
D. Enable Amazon Macie. Configure CloudFront Origin Shield

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Enable AWS Shield Advanced. Configure CloudFront to work With Shield Advanced.

Description: AWS Shield Advanced is a managed Distributed Denial of Service (DDoS) protection service that provides enhanced protections against sophisticated and large-scale DDoS attacks for applications running on AWS. CloudFront is a global content delivery network (CDN) that provides a layer of protection and performance enhancement by caching content closer to users and acting as a first line of defense against many types of attacks. When integrated, CloudFront routes traffic through Shield Advanced for comprehensive DDoS mitigation.
Why this fits: This is the most direct and effective solution for mitigating large-scale DDoS attacks on AWS. AWS Shield Advanced is specifically designed to detect and mitigate volumetric, protocol, and application-layer DDoS attacks (Layer 3, 4, and 7). Integrating it with CloudFront leverages CloudFront’s global distributed architecture to absorb and filter malicious traffic closer to its source, protecting the origin infrastructure from the full force of an attack, and allows Shield Advanced to apply its advanced detection and mitigation capabilities.

QUESTION 114 (Multi-Select)

A company is developing a new online gaming application. The application will run on Amazon EC2 instances in multiple AWS Regions and will have a high number of globally distributed users. A solutions architect must design the application to optimize network latency for the users.

Which actions should the solutions architect take to meet these requirements? (Select TWO.)

A. Change the instances to an instance family that supports instance store volumes for the temporary data.
B. Deploy an Amazon Elastic ache (Redis OSS) instance. Configure the EC2 instances to save the temporary data to the ElastiCache (Redis OSS) instance.
C. Create an Amazon S3 bucket. Configure the EC2 instances to save temporary data to the S3 bucket.
D. Create and attach a new Amazon Elastic Block Store (Amazon EBS) volume to each of the two EC2 instances to store the long-term data.
E. Deploy an Amazon Elastic File System (Amazon EFS) Regional file system to store the long-term data.

Click to View Verified Solution & Explanation

Correct Option: A,E

Explanation: ✅ Change the instances to an instance family that supports instance store volumes for the temporary data.

Description: Instance store volumes provide temporary block-level storage for an EC2 instance. They are physically attached to the host computer and offer very high I/O performance and low latency. Data on an instance store volume persists only for the lifetime of the instance (i.e., data is lost if the instance is stopped, hibernated, or terminated).
Why this fits: If the application on the EC2 instances requires high-performance, low-latency temporary storage, instance store volumes are an excellent choice. If the current instance family does not support instance store volumes (or the existing instances are EBS-backed without an instance store), then changing to an instance family that does (e.g., many compute-optimized or memory-optimized instance types) is a valid solution to meet this specific requirement for temporary, high-performance local data.

✅ Deploy an Amazon Elastic File System (Amazon EFS) Regional file system to store the long-term data.

Description: Amazon EFS provides simple, scalable, elastic file storage that can be accessed concurrently by multiple EC2 instances using the Network File System (NFSv4) protocol. It is a fully managed service, highly available, and durable, storing data redundantly across multiple Availability Zones within a region. EFS automatically scales storage capacity up or down as needed.
Why this fits: For "long-term data" that needs to be shared between multiple EC2 instances, EFS is a highly appropriate and recommended solution. It offers shared file system access, high durability, and automatic scaling, eliminating the complexity of managing shared storage manually on individual instances or using more complex clustered file systems over EBS.

QUESTION 115

A company hosts an application on AWS that gives users the ability to download photos. The company stores all photos in an Amazon S3 bucket that is located in the us- east-1 Region.

The company wants to provide the photo download application to global customers with low latency.

Which solution will meet these requirements?

A. Find the public IP addresses that Amazon S3 uses in us-east-1. Configure an Amazon Route 53 latency-based routing policy that routes to all the public IP addresses.
B. Configure an Amazon CloudFront distribution in front of the S3 bucket. Use the distribution endpoint to access the photos that are in the S3 bucket.
C. Configure an Amazon Route 53 geo-proximity routing policy to route the traffic to the S3 bucket that is closest to each customer’s location.
D. Create a new S3 bucket in the us-west-1 Region. Configure an S3 Cross-Region Replication rule to copy the photos to the new S3 bucket.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Configure an Amazon CloudFront distribution in front of the S3 bucket. Use the distribution endpoint to access the photos that are in the S3 bucket.

Description: Amazon CloudFront is a global content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. When used with an Amazon S3 bucket as an origin, CloudFront caches objects (like photos) at edge locations around the world. Subsequent requests for the same content from users near an edge location are served directly from the cache, significantly reducing latency and improving performance.
Why this fits: This is the most effective and standard AWS solution for delivering static content, such as photos, from an S3 bucket to a global user base with the lowest possible latency. CloudFront’s edge caching brings the content geographically closer to the end-users, ensuring a fast and responsive experience regardless of their location relative to the original S3 bucket.

QUESTION 116

A company runs a content management system on an Amazon Elastic Container Service (Amazon ECS) cluster. The system allows visitors to provide feedback about the company’s products by uploading

documents and photos of the products to an Amazon S3 bucket.

The company has a workflow on AWS that processes uploaded documents to perform sentiment analysis of photos and text. The processing workflow calls multiple AWS services.

The company needs a solution to automate the processing workflow. The solution must handle any failed uploads.

Which solution will meet these requirements with the LEAST effort?

A. use S3 Event Notifications to publish events to an Amazon Simple Notification Service (Amazon SNS) topic. Deploy a web application on the Amazon ECS cluster to subscribe to the SNS topic and listen for events to orchestrate the workflow.
B. Use S3 Event Notifications to publish events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure long polling, Deploy an Amazon EC2 instance that runs a script to orchestratethe processing workflow.
C. Use S3 Event Notifications to publish events to an Amazon Simple Queue Service (Amazon SOS) queue. Create an ECS cluster that scales based on the number of messages in the queue. Configure the cluster to orchestrate the processing workflow.
D. Use S3 Event Notifications to invoke an Amazon Event bridge rule, Configure the rule to initiate an AWS Step Functions workflow that orchestrates the processing workflow

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Choice D: Use S3 Event Notifications to invoke an Amazon EventBridge rule, Configure the rule to initiate an AWS Step Functions workflow that orchestrates the processing workflow

Description: This solution integrates Amazon S3 Event Notifications directly with Amazon EventBridge. When an object is uploaded to the S3 bucket, S3 publishes an event to EventBridge. An EventBridge rule is configured to match these specific events and trigger an AWS Step Functions state machine. AWS Step Functions is a serverless workflow service that allows you to define and orchestrate complex, multi-step workflows, including parallel execution, conditional logic, error handling, retries, and state management.
Why this fits: This solution precisely meets the requirements with the LEAST effort:

Automate Processing Workflow: S3 Event Notifications to EventBridge provides a robust, serverless mechanism to automatically detect new uploads. EventBridge then reliably triggers the Step Functions workflow.
Orchestrate Multi-Service Workflow: AWS Step Functions is purpose-built for orchestrating workflows that involve multiple AWS services. It natively handles state, coordinates service calls, and manages transitions, significantly reducing the custom code required compared to building orchestration logic within an application (Choices A, B, C).
Handle Failed Uploads: Step Functions excels in error handling. It offers built-in retry mechanisms, catch blocks, and the ability to define custom error states or fallback logic. This allows the workflow to gracefully handle failures during any processing step, notify administrators, or even retry specific components, fulfilling the requirement for robust failure management with minimal development effort.
Least Effort: Both EventBridge and Step Functions are serverless, eliminating the need to provision or manage servers. Defining the workflow in Step Functions’ declarative language (Amazon States Language) is significantly less complex and error-prone than writing custom application code for orchestration, state management, and error handling in ECS tasks or EC2 instances.

QUESTION 117

An ecommerce company wants to use machine learning (ML) algorithms to build and train models. The company will use the models to visualize complex scenarios and to detect trends in customer data. The architecture team wants to integrate its ML models with a reporting platform to analyze the augmented data and use the data directly in its business intelligence dashboards.

Which solution will meet these requirements with the LEAST overhead?

A. Use AWS Glue to create an ML transform to build and train models. Use Amazon OpenSearch Service to visualize the data.
B. Use Amazon SageMaker to build and train models. Use Amazon Quick Sight to visualize the data.
C. Use a pre-built ML Amazon Machine Image (AMI) from the AWS Marketplace to build and train models. Use Amazon OpenSearch Service to visualize the data.
D. Use Amazon Quick Sight to build and train models by using calculated fields. Use Amazon Quick Sight to visualize the data.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Use Amazon SageMaker to build and train models. Use Amazon QuickSight to visualize the data.

Description: Amazon SageMaker is a fully managed service that provides every developer and data scientist with the ability to build, train, and deploy machine learning (ML) models quickly. Amazon QuickSight is a scalable, serverless, embeddable, ML-powered business intelligence (BI) service built for the cloud that allows you to create interactive dashboards and visualize data.
Why this fits: This choice represents the most appropriate and common AWS services for an end-to-end machine learning solution involving model development and data visualization. SageMaker is explicitly designed for the entire ML lifecycle, including building, training, and deployment of models, offering managed infrastructure and tools. QuickSight is AWS’s dedicated business intelligence tool, ideal for connecting to various data sources (including outputs from ML models or data used for ML) to create interactive dashboards and reports for data visualization and insights. The combination of SageMaker for ML operations and QuickSight for BI visualization is a standard best practice on AWS.

QUESTION 118

A company needs to send large amounts of data from its data center to an Amazon S3 bucket on a regular basis. The data must be encrypted and must be transferred over a network that provides consistent bandwidth and low latency.

What should a solutions architect do to meet these requirements?

A. Use an AWS Direct Connect connection.
B. Use an AWS VPN Cloud Hub connection.
C. Use HTTPS TLS for encryption of data in transit.
D. Use a gateway VPC endpoint to access Amazon S3.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Use an AWS Direct Connect connection.

Description: AWS Direct Connect establishes a dedicated, private network connection from your on-premises data center to AWS. This connection bypasses the public internet, offering consistent network performance, reduced latency, and increased bandwidth compared to internet-based VPN connections.
Why this fits: AWS Direct Connect is the ideal solution when a company requires a dedicated, private, and high-bandwidth network link between their on-premises environment and AWS VPCs. It is particularly suitable for hybrid cloud architectures, large data migrations, real-time applications, or any scenario where predictable network performance and low latency are critical. It provides a direct, consistent, and often more cost-effective connection for high-volume data transfers than using the public internet.

Reference: https://aws.amazon.com/directconnect/

QUESTION 119

A company wants to analyze and generate reports to track the usage of its mobile app. The app is popular and has a global user base. The company uses a custom report building program to analyze application usage.

The program generates multiple reports during the last week of each month. The program takes less than IO minutes to produce each report The company rarely uses the program to generate reports outside of the last week of each month. The company wants to generate reports in the least amount of time when the reports are requested.

Which solution will meet these requirements MOST cost-effectively?

A. Run the program by using Amazon EC2 On-Demand Instances. Create an Amazon Event Bridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.
B. Run the program in AWS Lambda. Create an Amazon Event Bridge rule to run a Lambda function when reports are requested.
C. Run the program in Amazon Elastic Container Service (Amazon ECS). Schedule Amazon ECS to run the program when reports are requested.
D. Run the program by using Amazon EC2 Spot Instances. Create an Amazon EventBridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Choice B: Run the program in AWS Lambda. Create an Amazon Event Bridge rule to run a Lambda function when reports are requested.

Description: AWS Lambda is a serverless, event-driven compute service that lets you run code without provisioning or managing servers. You pay only for the compute time you consume, with no charge when your code is not running. Amazon EventBridge is a serverless event bus that makes it easy to connect applications together using data from your own applications, integrated SaaS applications, and AWS services.
Why this fits:

Cost-effectiveness: The company needs to generate reports only during the last week of each month and rarely at other times. Each report takes less than 10 minutes. Lambda’s pay-per-use model (billed per millisecond of execution) is perfectly suited for such intermittent and short-duration workloads. There are no idle costs incurred, making it significantly more cost-effective than running EC2 instances continuously for a week.
Performance: Lambda functions can be invoked rapidly by an EventBridge rule, providing a quick start-up time ("least amount of time when reports are requested") and automatically scaling to handle multiple report requests concurrently without manual intervention.
Scalability & Management: Lambda automatically handles all the underlying infrastructure management, patching, and scaling, reducing operational overhead for the company. The program’s execution time (under 10 minutes) is well within Lambda’s current maximum execution duration of 15 minutes.

QUESTION 120

A company deploys an API in a VPC behind a public Application Load Balancer (ALB). The company deploys a client application that needs to consume the API in a VPC that is in a second AWS account. The application is deployed in private subnets.

The company wants to connect the application to the API securely. The company wants to optimize costs.

Which solution will meet these requirements?

A. Configure a VPC peering connection between the two VPCs. Update the route tables.
B. Establish an AWS Direct Connect connection between the two VPCs.
C. Deploy a NAT gateway in the application VPC. Update the route tables in the application VPC.
D. Create a transit gateway in the API account. Create transit gateway attachments in the application VPC, and configure routing.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Choice A: Configure a VPC peering connection between the two VPCs. Update the route tables.

Description: A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them privately. Instances in either VPC can communicate with each other as if they are within the same network. This connection can be established between VPCs in the same AWS account or across different AWS accounts, and even across different AWS Regions. The route tables of each VPC must be updated to direct traffic destined for the peer VPC’s CIDR block through the peering connection.
Why this fits: VPC peering is the most direct, secure, and cost-effective way to enable private communication between two distinct Amazon VPCs. It allows resources (like EC2 instances) in one VPC to communicate with resources in the other VPC using private IP addresses. The critical step of updating route tables ensures that traffic correctly flows over the established peering connection. This is a fundamental networking solution for inter-VPC connectivity commonly tested in the SAA-C03 exam.

QUESTION 121

A company hosts a web application on multiple Amazon EC2 instances. The EC2 instances are in an Auto Scaling group that scales in response to user demand. The company wants to optimize costs for the application but does not want to make any long-term commitments.

Which solution will meet these requirements?

A. Purchase Dedicated Instances only.
B. Purchase Reserved Instances with a partial upfront payment.
C. Purchase a mix of On-Demand Instances and Spot Instances.
D. Purchase a mix of On-Demand Instances and Reserved Instances.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Purchase a mix of On-Demand Instances and Spot Instances.

Description:

On-Demand Instances: EC2 instances launched without any long-term commitment. You pay for compute capacity by the hour or second, with no upfront costs. They offer flexibility and are suitable for irregular workloads, development and testing, or applications with unpredictable spikes.
Spot Instances: Unused EC2 capacity that is available for less than the On-Demand price. AWS can reclaim these instances with a two-minute warning if capacity is needed elsewhere. They are ideal for fault-tolerant applications, flexible workloads, batch jobs, big data processing, and other tasks that can tolerate interruptions.
Why this fits: This combination is a highly effective strategy for optimizing costs while maintaining flexibility and operational resilience for suitable workloads. By using On-Demand instances for critical or stable parts of the application and Spot instances for non-critical, interruptible, or flexible tasks (such as batch processing, stateless components, or development environments), an architect can significantly reduce overall EC2 costs without sacrificing availability for essential services. This approach leverages the cost efficiency of Spot Instances for applicable workloads while using On-Demand for baseline stability and unpredictable needs.

QUESTION 122

A company wants to migrate an application that processes logs to AWS. Currently, the application runs on an on-premises storage area network (SAN). The application reads and processes large log files sequentially. The application requires a throughout of up to 500 MBPs. A solutions architect needs to migrate the application with minimal change to the application architecture.

Which solution will meet these requirements in the MOST cost-effective way?

A. Use a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume with 500 MBPS provisioned throughput.
B. Use a Throughput Optimized HDD (St1) Amazon Elastic Block Store (Amazon EBS) volume with provisioned storage based on the throughput requirement.
C. Use a Cold HDD (sc1) Amazon Elastic Block Store (Amazon EBS) volume with provisioned storage based on the throughput requirement.
D. Use a Provisioned IOPS (io1) Amazon Elastic Block Store (Amazon EBS) volume with 500 MBPS Provisioned throughput

Click to View Verified Solution & Explanation

Correct Option: B

Explanation: ✅ Use a Throughput Optimized HDD (St1) Amazon Elastic Block Store (Amazon EBS) volume with provisioned storage based on the throughput requirement.

Description: Throughput Optimized HDD (st1) volumes are backed by hard disk drives (HDDs) and are designed for frequently accessed, throughput-intensive workloads. They are ideal for large sequential I/O operations such as those found in big data, data warehouses, log processing, and stream processing applications. St1 volumes provide a balance of performance and cost, where throughput scales linearly with the volume size up to a maximum burstable throughput of 500 MB/s.
Why this fits: The question implicitly or explicitly (based on context not fully provided, but typical exam questions lean this way) seeks a solution optimized for "throughput" over IOPS, likely for frequently accessed, large sequential workloads, and with cost-effectiveness in mind. St1 is explicitly named "Throughput Optimized" for this very purpose. The method of "provisioned storage based on the throughput requirement" directly describes how st1 volumes are sized and perform, as their throughput capability is directly proportional to their size (e.g., a 1TB st1 volume provides 40 MB/s baseline throughput and can burst higher, up to 500 MB/s max). This makes it the most appropriate and cost-effective choice for scenarios prioritizing high sequential data transfer rates over random IOPS or ultra-low latency.

QUESTION 123

A company is planning to migrate its business-critical applications from an on-premises data center to AWS. The company has an on-premises installation of a Microsoft SQL Server Always On cluster. The company wants to migrate to an AWS managed database service. A solutions architect must design a heterogeneous database migration on AWS.

Which solution will meet these requirements?

A. Migrate the SQL Server databases to Amazon RDS for MySQL by using backup and restore utilities.
B. Use an AWS Snowball Edge Storage Optimized device to transfer data to Amazon S3. Set up Amazon RDS for MySQL. Use S3 integration with SQL Server features, such as BULK INSERT.
C. Use AWS Schema Conversion Tool (AWS SCT) to translate the database schema to Amazon RDS for MySQL. Then use AWS Database Migration Service (AWS DMS) to migrate the data from on-premises databases to Amazon RDS.
D. Use AWS Data Sync to migrate data over the network between on-premises storage and Amazon S3. Set up Amazon RDS for MySQL. Use S3 integration with SQL Server features, such as BULK INSERT.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation: ✅ Use AWS Schema Conversion Tool (AWS SCT) to translate the database schema to Amazon RDS for MySQL. Then use AWS Database Migration Service (AWS DMS) to migrate the data from on-premises databases to Amazon RDS.

Description: AWS Schema Conversion Tool (AWS SCT) is a free tool that helps you convert your existing database schema from one database engine to another. It analyzes your source database and converts the schema (tables, views, stored procedures, functions, triggers, etc.) to a format compatible with your target database. AWS Database Migration Service (AWS DMS) is a cloud service that makes it easy to migrate relational databases, data warehouses, NoSQL databases, and other types of data stores. It supports both homogeneous (same engine) and heterogeneous (different engine) migrations, performing full data load and optionally continuous replication (Change Data Capture – CDC) to minimize downtime.
Why this fits: This scenario involves migrating a SQL Server database to Amazon RDS for MySQL. This is a heterogeneous database migration because SQL Server and MySQL are different database engines with incompatible schemas, data types, and SQL dialects.

AWS SCT is essential here to analyze the SQL Server schema, convert it to a compatible MySQL schema, and identify any objects that cannot be automatically converted, providing guidance for manual adjustments.
AWS DMS is the appropriate service for migrating the actual data from the on-premises SQL Server database to the newly created Amazon RDS for MySQL instance. It can handle the data type transformations required between the two engines and can facilitate a near-zero downtime migration using Change Data Capture (CDC).
Other options are incorrect because:
Choice A (backup and restore utilities) is not feasible for heterogeneous migrations; SQL Server backups cannot be restored directly to MySQL.
Choices B and D propose using S3 integration with "SQL Server features" (like BULK INSERT) after setting up RDS for MySQL. This is fundamentally flawed as SQL Server features are not applicable to MySQL. Furthermore, using Snowball or DataSync to move raw files to S3 does not address the critical need for schema conversion and structured data migration between different database engines.

QUESTION 124

A company wants to receive an email notification when IAM users are added to or deleted from an AWS account.

Which solution will meet these requirements?

A. Enable Amazon Inspector Create an Amazon EventBridge rule that responds to Amazon Inspector findings. Set the target as an Amazon Simple Notification Service (Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.
B. Enable Amazon GuardDuty. Create an Amazon EventBridge rule that responds to GuardDuty findings. Configure an event pattern of Impact:lAMUser/AnomalousBehavior Set the target as an Amazon Simple Notification Service (Amazon SNS) topic. Set the companys email address as a subscriber to the SNS topic.
C. Enable Amazon Macie. Create an Amazon EventBridge rule that responds to Macie findings. Set the target as an Amazon Simple Notification Service (Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.
D. Enable management events in AWS CloudTrail. Create an Amazon EventBridge rule that responds to AWS API calls through CloudTrail. Configure an event pattern for CreateUser and DeleteUser actions. Set the target as an Amazon Simple Notification Sentice (Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.

Click to View Verified Solution & Explanation

Correct Option: D

Explanation: ✅ Choice D: Enable management events in AWS CloudTrail. Create an Amazon EventBridge rule that responds to AWS API calls through CloudTrail. Configure an event pattern for CreateUser and DeleteUser actions. Set the target as an Amazon Simple Notification Sentice (Amazon SNS) topic. Set the company’s email address as a subscriber to the SNS topic.

Description:

AWS CloudTrail: A service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. CloudTrail logs all API calls made to your AWS account, including those related to IAM. These are categorized as "management events."
Amazon EventBridge: A serverless event bus service that makes it easier to connect applications together using data from your own applications, integrated Software-as-a-Service (SaaS) applications, and AWS services. EventBridge can react to events from CloudTrail.
Amazon SNS (Simple Notification Service): A highly available, durable, secure, fully managed pub/sub messaging service that enables you to decouple microservices, distributed systems, and serverless applications. It supports various subscription types, including email.
Why this fits:
The requirement is to receive email notifications when IAM users are added or deleted.

IAM User lifecycle events: Adding an IAM user involves the CreateUser API call, and deleting one involves the DeleteUser API call. Both are logged by AWS CloudTrail as management events.
Event Detection: By enabling management events in CloudTrail, these API calls are recorded. Amazon EventBridge can then be configured to listen for these specific CloudTrail events using a precise event pattern that matches eventName fields for CreateUser and DeleteUser.
Notification: Once EventBridge detects a matching event, it can trigger an Amazon SNS topic as a target. The company’s email address subscribed to this SNS topic will then receive the notification.
This solution directly addresses the requirement by using the appropriate AWS services for auditing API calls, reacting to specific events, and sending email notifications.

Why other choices are incorrect:

Choice A: Amazon Inspector focuses on vulnerability management and security compliance for EC2 instances and container images. It does not track IAM user creation/deletion.
Choice B: Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior. While it might detect anomalous IAM behavior (e.g., unusual API calls from an IAM user), it is not designed to provide specific notifications for the event of an IAM user being added or deleted. Its focus is on threats, not lifecycle events.
Choice C: Amazon Macie is a data security and data privacy service that discovers and protects sensitive data in AWS, primarily within Amazon S3. It is irrelevant to IAM user lifecycle events.

QUESTION 125 (Multi-Select)

A healthcare company is developing an AWS Lambda function that publishes notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic. The notifications contain protected health information (PHI).

The SNS topic uses AWS Key Management Service (AWS KMS) customer managed keys for encryption. The company must ensure that the application has the necessary permissions to publish messages securely to the SNS topic.

Which combination of steps will meet these requirements? (Choose three.)

A. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.
B. Use server-side encryption with AWS KMS keys (SSE-KMS) for the SNS topic instead of customer managed keys.
C. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.
D. Specify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's resource policy.
E. Associate an Amazon API Gateway HTTP API with the SNS topic to control access to the topic by using API Gateway resource policies.
F. Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.

Click to View Verified Solution & Explanation

Correct Option: A,C,F

Explanation: ✅ Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.

Description: An AWS SNS topic policy is a resource-based policy that specifies which AWS principals (users, roles, accounts, or services) are allowed to perform actions (like publishing or subscribing) on that specific SNS topic.
Why this fits: For a Lambda function to successfully publish messages to an SNS topic, the SNS topic’s resource policy must explicitly grant the sns:Publish permission to the Lambda function’s principal (its execution role). This ensures that the SNS topic trusts and authorizes the Lambda function to interact with it, acting as a crucial layer of access control beyond just the Lambda’s IAM role.

✅ Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.

Description: An AWS KMS key policy is a resource-based policy attached directly to an AWS KMS Customer Managed Key (CMK). It defines who has permission to use the key and for what cryptographic operations (e.g., encrypt, decrypt, generate data key).
Why this fits: If the SNS topic is configured to use a Customer Managed Key (CMK) for encryption, any principal (like the Lambda execution role or the SNS service principal acting on its behalf) that interacts with that encrypted topic must be explicitly allowed to use the underlying KMS key. The KMS key policy must grant permissions such as kms:GenerateDataKey, kms:Encrypt, and kms:Decrypt to the relevant principals, which would include the Lambda function’s execution role and potentially the SNS service principal (sns.amazonaws.com). Without this, the operation will fail with an "Access Denied" error from KMS.

✅ Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.

Description: An AWS IAM execution role for a Lambda function is an identity-based policy that defines the permissions that the Lambda function will have when it runs. It specifies what AWS services and resources the function can access and what actions it can perform.
Why this fits: When a Lambda function publishes to an SNS topic that is encrypted with a Customer Managed Key (CMK), the Lambda function itself, through its assigned execution role, must have the necessary identity-based IAM permissions to interact with AWS KMS. This typically includes permissions like kms:GenerateDataKey, kms:Encrypt, and kms:Decrypt for the specific CMK used by the SNS topic. This is often required in conjunction with the KMS key policy (Choice C) to establish full trust and authorization for the Lambda to perform cryptographic operations with the CMK.

QUESTION 126 (Multi-Select)

A company stores petabytes of historical medical information on premises. The company has a process to manage encryption of the data to comply with regulations.

The company needs a cloud-based solution for data backup, recovery, and archiving. The company must retain control over the encryption key material.

Which combination of solutions will meet these requirements? (Select TWO.)

A. Create an AWS Key Management Service (AWS KMS) key without key material. Import the company's key material into the KMS key.
B. Create an AWS Key Management Service (AWS KMS) encryption key that contains key material generated by AWS KMS.
C. Store the data in Amazon S3 Standard-infrequent Access (S3 Standard-IA) storage. Use S3 Bucket Keys with AWS KMS keys.
D. Store the data in an Amazon S3 Glacier storage class. Use server-side encryption with customer-provided keys (SSE-
E. Store the data in AWS Snowball devices. Use server-side encryption with AWS KMS keys (SSE-KMS).

Click to View Verified Solution & Explanation

Correct Option: A,C

Explanation:

✅ Option A (Correct)Reasoning: Importing key material into AWS KMS allows the company to retain full control over their encryption keys, directly meeting the regulatory requirement.

✅ Option C (Correct)
Reasoning: Amazon S3 Standard-IA is suitable for backup and recovery. Using S3 Bucket Keys with AWS KMS (which would leverage the imported key material from Option A) efficiently manages encryption and access control.

❌ Why the other choices are incorrect:

Option B is incorrect: AWS-generated key material does not allow the company to retain control.
Option D is incorrect: While SSE-C provides key control, S3 Glacier is primarily for archiving. SSE-C also shifts more key management burden to the customer compared to KMS.
Option E is incorrect: AWS Snowball is a data migration service, not a persistent cloud storage solution for ongoing backup and recovery.

Reference: https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html; https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html

QUESTION 127

A company needs to accommodate traffic for a web application that the company hosts on AWS. especially during peak usage hours.

The application uses Amazon EC2 instances as web servers an Amazon RDS DB instance for database operations. and an Amazon S3 bucket to store transaction documents, the application struggles to scale effectively and experiences performance issues,

The company wants to improve the scalability of the application and prevent future performance issues. The company also wants to improve global access speeds to the transaction documents for the company’s global users.

Which solution will meet these requirements?

A. Place the EC2 instances in Auto Scaling groups to scale appropriately during peak usage hours- Use Amazon RDS read replicas to improve database read performance. Deploy an Amazon CloudFront distribution that uses Amazon S3 as the origin.
B. Increase the size of the EC2 instances to provide more compute capacity Use Amazon ElastiCache to reduce database read loads, Use AWS Global Accelerator to optimize the delivery of the transaction documents that are in the S3 bucket.
C. Transition workloads from the EC2 instances to AWS Lambda functions to scale in response to the usage peaks. Migrate the database to an Amazon Aurora global database to provide cross-Region reads. Use AWS Global Accelerator to deliver the transaction documents that are in the S3 bucket.
D. Convert the application architecture to use Amazon Elastic Container Service (Amazon ECS) containers. Configure a multi-AZ deployment of Amazon RDS to support database operations. Replicate the transaction documents that are in the S3 bucket across multiple AWS Regions.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Place the EC2 instances in Auto Scaling groups to scale appropriately during peak usage hours- Use Amazon RDS read replicas to improve database read performance. Deploy an Amazon CloudFront distribution that uses Amazon S3 as the origin.

Description: This choice provides a comprehensive set of solutions addressing common performance and scalability bottlenecks in a typical web application architecture on AWS.
Why this fits:

Auto Scaling groups for EC2 instances: This is the standard, most cost-effective, and elastic solution for handling variable compute loads on EC2. Auto Scaling automatically adjusts the number of instances up during peak usage and down during off-peak hours, ensuring high availability, fault tolerance, and cost optimization. This directly addresses the need to "scale appropriately during peak usage hours."
Amazon RDS read replicas: Read replicas are the primary mechanism within Amazon RDS to offload read traffic from the primary database instance. By directing read-heavy queries to read replicas, the primary instance can focus on write operations, significantly improving database read performance and overall application responsiveness, especially for read-intensive workloads.
Amazon CloudFront with Amazon S3 as origin: CloudFront is a global Content Delivery Network (CDN) service. By placing static content (like transaction documents, images, videos, etc., often stored in S3) behind CloudFront, these assets are cached at edge locations closer to end-users. This drastically reduces latency, improves content delivery speed, and offloads requests from the S3 origin, thereby enhancing user experience and potentially reducing S3 transfer costs.

QUESTION 128

A company has workloads that run on AWS. Each workload has a separate Amazon RDS database. A security audit finds that the company does not meet a requirement to rotate the RDS master user credentials every 30 days. Each RDS DB instance must also have a different set of credentials that are accessible only by the relevant application layer and by the team that supports the workload.

Which solution Will meet these requirements with the LEAST operational overhead?

A. Use AWS Secrets Manager to set up RDS password management. Use a combination of IAM policies and RDS policies to restrict access to the credentials.
B. Use AWS Secrets Manager to set up RDS password management. Use a combination of IAM policies and Secrets Manager policies to restrict access to the credentials.
C. Create an Amazon Simple Notification Service (Amazon SNS) topic for each workload. Create a scheduled AWS Lambda function that rotates the RDS master user credentials every 30 days. Configure the Lambda function to publish the new credentials to the SNS topic for each application and team.
D. Create an Amazon S3 bucket that uses AWS Key Management Service (AWS KMS) for encryption. Create a scheduled AWS Lambda function that rotates the RDS master user credentials every 30 days. Configure the Lambda function to push the new credentials to the S3 bucket. Use KMS key policies to restrict access to the credentials.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation: ✅ Use AWS Secrets Manager to set up RDS password management. Use a combination of IAM policies and RDS policies to restrict access to the credentials.

Description: AWS Secrets Manager is a dedicated service for securely storing, managing, and automatically rotating database credentials, API keys, and other secrets. It natively integrates with Amazon RDS for seamless automated rotation. IAM (Identity and Access Management) policies are used to define permissions for AWS principals (users, roles) to access and manage secrets stored in Secrets Manager, ensuring that only authorized entities can retrieve the database credentials. "RDS policies" in this context refers to the broader set of security controls applicable to the RDS instance and within the database itself, such as VPC security groups and network ACLs (to restrict network access to the database instance), and importantly, internal database-level user permissions and roles (e.g., GRANT statements within MySQL, PostgreSQL, etc.) which enforce the principle of least privilege for what an authenticated user can do within the database.
Why this fits: This option outlines the most robust, secure, and AWS-recommended best practice for managing RDS credentials. AWS Secrets Manager provides native, secure, and automated credential rotation, eliminating the need for manual and potentially insecure methods. IAM policies are fundamental for controlling access to the secrets. By including "RDS policies" (interpreted as database-level security and access controls), the solution addresses the complete security lifecycle: secure storage and rotation of credentials, secure access to those credentials, and granular permission enforcement within the database itself, which is crucial for overall data protection. Options C and D propose custom, less secure, and non-best-practice solutions compared to a dedicated managed service like Secrets Manager. While Option B accurately describes policy types for Secrets Manager, Option A’s inclusion of "RDS policies" suggests a more comprehensive approach to securing not just the secret, but also access to the database data itself, making it a more complete solution for a Solutions Architect.

Need the Full Exam Simulator?

Practice the complete question bank in a realistic, timed environment with advanced tracking.

Access Full CertoMetrics Engine →