AWS Certified Solutions Architect - Associate SAA-C03 Real Dumps

AWS Certified Solutions Architect – Associate SAA-C03 Real Dumps

test2022-09-02T06:31:14+00:00

Looking for easy way to pass your SAA-C03 AWS Certified Solutions Architect – Associate Exam? FreeTestShare SAA-C03 Real Dumps are the best material for you to pass the test. You can use the free SAA-C03 practice tests to familiarize yourself with our product. Our SAA-C03 Real Dumps contain actual Questions and Answers to help you practice well in your AWS Certified Solutions Architect – Associate exam! It enables you to study for the SAA-C03 exam using actual exam questions and pass the first test. If you prepare using AWS Certified Solutions Architect – Associate SAA-C03 Real Dumps, you will pass on the first try.

Try SAA-C03 free demo to test yourself!

Page 1 of 11

1. A company needs to set up a cost-effective architecture for a log processing application that has frequently accessed, throughput-intensive workloads with large, sequential I/O operations. The application should be hosted in an already existing On-Demand EC2 instance in the VPC. You have to attach a new EBS volume that will be used by the application.

Which of the following is the most suitable EBS volume type that you should use in this scenario?

EBS Cold HDD (sc1)

EBS Provisioned IOPS SSD (io1)

EBS General Purpose SSD (gp2)

EBS Throughput Optimized HDD (st1)

2. A healthcare company stores sensitive patient health records in their on-premises storage systems. These records must be kept indefinitely and protected from any type of modifications once they are stored. Compliance regulations mandate that the records must have granular access control and each data access must be audited at all levels. Currently, there are millions of obsolete records that are not accessed by their web application, and their on-premises storage is quickly running out of space. The Solutions Architect must design a solution to immediately move existing records to AWS and support the ever-growing number of new health records.

Which of the following is the most suitable solution that the Solutions Architect should implement to meet the above requirements?

Set up AWS DataSync to move the existing health records from the on-premises network to the AWS Cloud. Launch a new Amazon S3 bucket to store existing and new records. Enable AWS CloudTrail with Data Events and Amazon S3 Object Lock in the bucket.

Set up AWS Storage Gateway to move the existing health records from the on-premises network to the AWS Cloud. Launch an Amazon EBS-backed EC2 instance to store both the existing and new records. Enable Amazon S3 server access logging and S3 Object Lock in the bucket.

Set up AWS DataSync to move the existing health records from the on-premises network to the AWS Cloud. Launch a new Amazon S3 bucket to store existing and new records. Enable AWS CloudTrail with Management Events and Amazon S3 Object Lock in the bucket.

Set up AWS Storage Gateway to move the existing health records from the on-premises network to the AWS Cloud. Launch a new Amazon S3 bucket to store existing and new records. Enable AWS CloudTrail with Management Events and Amazon S3 Object Lock in the bucket.

3. A company has an application architecture that stores both the access key ID and the secret access key in a plain text file on a custom Amazon Machine Image (AMI). The EC2 instances, which are created by using this AMI, are using the stored access keys to connect to a DynamoDB table .

What should the Solutions Architect do to make the current architecture more secure?

Do nothing. The architecture is already secure because the access keys are already in the Amazon Machine Image.

Put the access keys in Amazon Glacier instead.

Put the access keys in an Amazon S3 bucket instead.

Remove the stored access keys in the AM

Create a new IAM role with permissions to access the DynamoDB table and assign it to the EC2 instances.

4. A start-up company has an EC2 instance that is hosting a web application. The volume of users is expected to grow in the coming months and hence, you need to add more elasticity and scalability in your AWS architecture to cope with the demand.

Which of the following options can satisfy the above requirement for the given scenario? (Select TWO.)

Set up two EC2 instances and use Route 53 to route traffic based on a Weighted Routing Policy.

Set up two EC2 instances and then put them behind an Elastic Load balancer (ELB).

Set up an AWS WAF behind your EC2 Instance.

Set up two EC2 instances deployed using Launch Templates and integrated with AWS Glue.

Set up an S3 Cache in front of the EC2 instance.

5. A local bank has an in-house application that handles sensitive financial data in a private subnet. After the data is processed by the EC2 worker instances, they will be delivered to S3 for ingestion by other services.

How should you design this solution so that the data does not pass through the public Internet?

Configure a VPC Endpoint along with a corresponding route entry that directs the data to S3.

Create an Internet gateway in the public subnet with a corresponding route entry that directs the data to S3.

Provision a NAT gateway in the private subnet with a corresponding route entry that directs the data to S3.

Configure a Transit gateway along with a corresponding route entry that directs the data to S3.

6. A tech company is currently using Auto Scaling for their web application. A new AMI now needs to be

used for launching a fleet of EC2 instances.

Which of the following changes needs to be done?

Create a new target group.

Create a new launch configuration.

Do nothing. You can start directly launching EC2 instances in the Auto Scaling group with the same launch configuration.

Create a new target group and launch configuration.

7. A global online sports betting company has its popular web application hosted in AWS. They are planning to develop a new online portal for their new business venture and they hired you to implement the cloud architecture for a new online portal that will accept bets globally for world sports. You started to design the system with a relational database that runs on a single EC2 instance, which requires a single EBS volume that can support up to 30,000 IOPS.

In this scenario, which Amazon EBS volume type can you use that will meet the performance requirements of this new online portal?

EBS Cold HDD (sc1)

EBS Throughput Optimized HDD (st1)

EBS Provisioned IOPS SSD (io1)

EBS General Purpose SSD (gp2)

8. A company plans to build a data analytics application in AWS which will be deployed in an Auto Scaling group of On-Demand EC2 instances and a MongoDB database. It is expected that the database will have high-throughput workloads performing small, random I/O operations. As the Solutions Architect, you are required to properly set up and launch the required resources in AWS .

Which of the following is the most suitable EBS type to use for your database?

Provisioned IOPS SSD (io1)

Throughput Optimized HDD (st1)

General Purpose SSD (gp2)

Cold HDD (sc1)

9. A company has a global online trading platform in which the users from all over the world regularly upload terabytes of transactional data to a centralized S3 bucket.

What AWS feature should you use in your present system to improve throughput and ensure consistently fast data transfer to the Amazon S3 bucket, regardless of your user's location?

AWS Direct Connect

Use CloudFront Origin Access Identity

Amazon S3 Transfer Acceleration

FTP

10. A tech startup is launching an on-demand food delivery platform using Amazon ECS cluster with an AWS Fargate serverless compute engine and Amazon Aurora. It is expected that the database read queries will significantly increase in the coming weeks ahead. A Solutions Architect recently launched two Read Replicas to the database cluster to improve the platform's scalability.

Which of the following is the MOST suitable configuration that the Architect should implement to load balance all of the incoming read requests equally to the two Read Replicas?

Use the built-in Cluster endpoint of the Amazon Aurora database.

Create a new Network Load Balancer to evenly distribute the read queries to the Read Replicas of the Amazon Aurora database.

Use the built-in Reader endpoint of the Amazon Aurora database.

Enable Amazon Aurora Parallel Query.

Page 2 of 11

11. A company has an OLTP (Online Transactional Processing) application that is hosted in an Amazon ECS cluster using the Fargate launch type. It has an Amazon RDS database that stores data of its production website. The Data Analytics team needs to run queries against the database to track and audit all user transactions. These query operations against the production database must not impact application performance in any way.

Which of the following is the MOST suitable and cost-effective solution that you should implement?

Set up a new Amazon Redshift database cluster. Migrate the product database into Redshift and allow the Data Analytics team to fetch data from it.

Set up a new Amazon RDS Read Replica of the production database. Direct the Data Analytics team to query the production data from the replica.

Set up a Multi-AZ deployments configuration of your production database in RD

Direct the Data Analytics team to query the production data from the standby instance.

Upgrade the instance type of the RDS database to a large instance.

12. As part of the Business Continuity Plan of your company, your IT Director instructed you to set up an automated backup of all of the EBS Volumes for your EC2 instances as soon as possible.

What is the fastest and most cost-effective solution to automatically back up all of your EBS Volumes?

Set your Amazon Storage Gateway with EBS volumes as the data source and store the backups in your on-premises servers through the storage gateway.

Use an EBS-cycle policy in Amazon S3 to automatically back up the EBS volumes.

For an automated solution, create a scheduled job that calls the "create-snapshot" command via the AWS CLI to take a snapshot of production EBS volumes periodically.

Use Amazon Data Lifecycle Manager (Amazon DLM) to automate the creation of EBS snapshots.

13. A company needs to accelerate the performance of its AI-powered medical diagnostic application by running its machine learning workloads on the edge of telecommunication carriers' 5G networks. The application must be deployed to a Kubernetes cluster and have role-based access control (RBAC) access to IAM users and roles for cluster authentication.

Which of the following should the Solutions Architect implement to ensure single-digit millisecond latency for the application?

Launch the application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. Create node groups in Wavelength Zones for the Amazon EKS cluster via the AWS Wavelength service. Apply the AWS authenticator configuration map (aws-auth ConfigMap) to your cluster.

Launch the application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. Create VPC endpoints for the AWS Wavelength Zones and apply them to the Amazon EKS cluster. Install the AWS IAM Authenticator for Kubernetes (aws-iam-authenticator) to your cluster.

Host the application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. Set up node groups in AWS Wavelength Zones for the Amazon EKS cluster. Attach the Amazon EKS connector agent role (AmazonECSConnectorAgentRole) to your cluster and use AWS Control Tower for RBAC access.

Host the application to an Amazon EKS cluster and run the Kubernetes pods on AWS Fargate. Create node groups in AWS Wavelength Zones for the Amazon EKS cluster. Add the EKS pod execution IAM role (AmazonEKSFargatePodExecutionRole) to your cluster and ensure that the Fargate profile has the same IAM role as your Amazon EC2 node groups.

14. A company is running a batch job on an EC2 instance inside a private subnet. The instance gathers input data from an S3 bucket in the same region through a NAT Gateway. The company is looking for a solution that will reduce costs without imposing risks on redundancy or availability .

Which solution will accomplish this?

Re-assign the NAT Gateway to a lower EC2 instance type.

Remove the NAT Gateway and use a Gateway VPC endpoint to access the S3 bucket from the instance.

Deploy a Transit Gateway to peer connection between the instance and the S3 bucket.

Replace the NAT Gateway with a NAT instance hosted on a burstable instance type.

15. A company needs to design an online analytics application that uses Redshift Cluster for its data warehouse .

Which of the following services allows them to monitor all API calls in Redshift instance and can also provide secured data for auditing and compliance purposes?

Amazon Redshift Spectrum

AWS CloudTrail

AWS X-Ray

Amazon CloudWatch

16. A web application requires a minimum of six Amazon Elastic Compute Cloud (EC2) instances running at all times. You are tasked to deploy the application to three availability zones in the EU Ireland region (eu-west-1a, eu-west-1b, and eu-west-1c). It is required that the system is fault-tolerant up to the loss of one Availability Zone.

Which of the following setup is the most cost-effective solution which also maintains the fault-tolerance of your system?

6 instances in eu-west-1a, 6 instances in eu-west-1b, and no instances in eu-west-1c

2 instances in eu-west-1a, 2 instances in eu-west-1b, and 2 instances in eu-west-1c

6 instances in eu-west-1a, 6 instances in eu-west-1b, and 6 instances in eu-west-1c

3 instances in eu-west-1a, 3 instances in eu-west-1b, and 3 instances in eu-west-1c

17. A company has a serverless application made up of AWS Amplify, Amazon API Gateway and a Lambda

function. The application is connected to an Amazon RDS MySQL database instance inside a private

subnet. A Lambda Function URL is also implemented as the dedicated HTTPS endpoint for the function,

which has the following value:

https://12june1898pil1pinas.lambda-url.us-west-2.on.aws/

There are times during peak loads when the database throws a “too many connections” error preventing the users from accessing the application.

Which solution could the company take to resolve the issue?

Increase the memory allocation of the Lambda function

Provision an RDS Proxy between the Lambda function and RDS database instance

Increase the concurrency limit of the Lambda function

Increase the rate limit of API Gateway

18. A company has a requirement to move 80 TB data warehouse to the cloud. It would take 2 months to transfer the data given their current bandwidth allocation.

Which is the most cost-effective service that would allow you to quickly upload their data into AWS?

AWS Direct Connect

Amazon S3 Multipart Upload

AWS Snowball Edge

AWS Snowmobile

19. An insurance company plans to implement a message filtering feature in their web application. To implement this solution, they need to create separate Amazon SQS queues for each type of quote request. The entire message processing should not exceed 24 hours.

As the Solutions Architect of the company, which of the following should you do to meet the above requirement?

Create one Amazon SNS topic and configure the Amazon SQS queues to subscribe to the SNS topic. Publish the same messages to all SQS queues. Filter the messages in each queue based on the quote request type.

Create multiple Amazon SNS topics and configure the Amazon SQS queues to subscribe to the SNS topics. Publish the message to the designated SQS queue based on the quote request type.

Create a data stream in Amazon Kinesis Data Streams. Use the Amazon Kinesis Client Library to deliver all the records to the designated SQS queues based on the quote request type.

Create one Amazon SNS topic and configure the Amazon SQS queues to subscribe to the SNS topic. Set the filter policies in the SNS subscriptions to publish the message to the designated SQS queue based on its quote request type.

20. An IT consultant is working for a large financial company. The role of the consultant is to help the development team build a highly available web application using stateless web servers.

In this scenario, which AWS services are suitable for storing session state data? (Select TWO.)

ElastiCache

Redshift Spectrum

RDS

Glacier

DynamoDB

Page 3 of 11

21. All objects uploaded to an Amazon S3 bucket must be encrypted for security compliance. The bucket will use server-side encryption with Amazon S3-Managed encryption keys (SSE-S3) to encrypt data using 256-bit Advanced Encryption Standard (AES-256) block cipher .

Which of the following request headers must be used?

x-amz-server-side-encryption-customer-key

x-amz-server-side-encryption-customer-algorithm

x-amz-server-side-encryption-customer-key-MD5

x-amz-server-side-encryption

22. A media company has two VPCs: VPC-1 and VPC-2 with peering connection between each other. VPC-1 only contains private subnets while VPC-2 only contains public subnets. The company uses a single AWS Direct Connect connection and a virtual interface to connect their on-premises network with VPC-1.

Which of the following options increase the fault tolerance of the connection to VPC-1? (Select TWO.)

Establish a hardware VPN over the Internet between VPC-1 and the on-premises network.

Establish another AWS Direct Connect connection and private virtual interface in the same AWS region as VPC-1.

Establish a new AWS Direct Connect connection and private virtual interface in the same region as VPC-2.

Use the AWS VPN CloudHub to create a new AWS Direct Connect connection and private virtual interface in the same region as VPC-2.

Establish a hardware VPN over the Internet between VPC-2 and the on-premises network.

23. A company has a hybrid cloud architecture that connects their on-premises data center and cloud infrastructure in AWS. They require a durable storage backup for their corporate documents stored on-premises and a local cache that provides low latency access to their recently accessed data to reduce data egress charges. The documents must be stored to and retrieved from AWS via the Server Message Block (SMB) protocol. These files must immediately be accessible within minutes for six months and archived for another decade to meet the data compliance.

Which of the following is the best and most cost-effective approach to implement in this scenario?

Launch a new file gateway that connects to your on-premises data center using AWS Storage Gateway. Upload the documents to the file gateway and set up a lifecycle policy to move the data into Glacier for data archival.

Launch a new tape gateway that connects to your on-premises data center using AWS Storage Gateway. Upload the documents to the tape gateway and set up a lifecycle policy to move the data into Glacier for archival.

Establish a Direct Connect connection to integrate your on-premises network to your VP

Upload the documents on Amazon EBS Volumes and use a lifecycle policy to automatically move the EBS snapshots to an S3 bucket, and then later to Glacier for archival.

Use AWS Snowmobile to migrate all of the files from the on-premises network. Upload the documents to an S3 bucket and set up a lifecycle policy to move the data into Glacier for archival.

24. A company has an enterprise web application hosted on Amazon ECS Docker containers that use an Amazon FSx for Lustre filesystem for its high-performance computing workloads. A warm standby environment is running in another AWS region for disaster recovery. A Solutions Architect was assigned to design a system that will automatically route the live traffic to the disaster recovery (DR) environment only in the event that the primary application stack experiences an outage .

What should the Architect do to satisfy this requirement?

Set up a Weighted routing policy configuration in Route 53 by adding health checks on both the primary stack and the DR environment. Configure the network access control list and the route table to allow Route 53 to send requests to the endpoints specified in the health checks. Enable the Evaluate Target Health option by setting it to Yes.

Set up a failover routing policy configuration in Route 53 by adding a health check on the primary service endpoint. Configure Route 53 to direct the DNS queries to the secondary record when the primary resource is unhealthy. Configure the network access control list and the route table to allow Route 53 to send requests to the endpoints specified in the health checks. Enable the Evaluate Target Health option by setting it to Yes.

Set up a CloudWatch Events rule to monitor the primary Route 53 DNS endpoint and create a custom Lambda function. Execute the ChangeResourceRecordSets API call using the function to initiate the failover to the secondary DNS record.

Set up a CloudWatch Alarm to monitor the primary Route 53 DNS endpoint and create a custom Lambda function. Execute the ChangeResourceRecordSets API call using the function to initiate the failover to the secondary DNS record.

25. A technology company is building a new cryptocurrency trading platform that allows the buying and selling of Bitcoin, Ethereum, Ripple, Tether, and many others. You were hired as a Cloud Engineer to build the required infrastructure needed for this new trading platform. On your first week at work, you started to create CloudFormation YAML scripts that define all of the needed AWS resources for the application. Your manager was shocked that you haven't created the EC2 instances, S3 buckets, and other AWS resources straight away. He does not understand the text-based scripts that you have done and has asked for your clarification.

In this scenario, what are the benefits of using the Amazon CloudFormation service that you should tell your manager to clarify his concerns? (Select TWO.)

Allows you to model your entire infrastructure in a text file

Provides highly durable and scalable data storage

Using CloudFormation itself is free, including the AWS resources that have been created.

A storage location for the code of your application

Enables modeling, provisioning, and version-controlling of your entire AWS infrastructure

26. A company has several unencrypted EBS snapshots in their VPC. The Solutions Architect must ensure that all of the new EBS volumes restored from the unencrypted snapshots are automatically encrypted .

What should be done to accomplish this requirement?

Launch new EBS volumes and specify the symmetric customer master key (CMK) for encryption.

Enable the EBS Encryption By Default feature for the AWS Region.

Enable the EBS Encryption By Default feature for specific EBS volumes.

Launch new EBS volumes and encrypt them using an asymmetric customer master key (CMK).

27. A global IT company with offices around the world has multiple AWS accounts. To improve efficiency and drive costs down, the Chief Information Officer (CIO) wants to set up a solution that centrally manages their AWS resources. This will allow them to procure AWS resources centrally and share resources such as AWS Transit Gateways, AWS License Manager configurations, or Amazon Route 53 Resolver rules across their various accounts.

As the Solutions Architect, which combination of options should you implement in this scenario? (Select TWO.)

Consolidate all of the company's accounts using AWS ParallelCluster.

Use the AWS Resource Access Manager (RAM) service to easily and securely share your resources with your AWS accounts.

Use the AWS Identity and Access Management service to set up cross-account access that will easily and securely share your resources with your AWS accounts.

Consolidate all of the company's accounts using AWS Organizations.

Use AWS Control Tower to easily and securely share your resources with your AWS accounts.

28. A company installed sensors to track the number of people who visit the park. The data is sent every day to an Amazon Kinesis stream with default settings for processing, in which a consumer is configured to process the data every other day. You noticed that the S3 bucket is not receiving all of the data that is being sent to the Kinesis stream. You checked the sensors if they are properly sending the data to Amazon Kinesis and verified that the data is indeed sent every day .

What could be the reason for this?

There is a problem in the sensors. They probably had some intermittent connection hence, the data is not sent to the stream.

By default, the data records are only accessible for 24 hours from the time they are added to a Kinesis stream.

By default, Amazon S3 stores the data for 1 day and moves it to Amazon Glacier.

Your AWS account was hacked and someone has deleted some data in your Kinesis stream.

29. In a startup company you are working for, you are asked to design a web application that requires a NoSQL database that has no limit on the storage size for a given table. The startup is still new in the market and it has very limited human resources who can take care of the database infrastructure.

Which is the most suitable service that you can implement that provides a fully managed, scalable and highly available NoSQL service?

SimpleDB

Amazon Aurora

Amazon Neptune

DynamoDB

30. A company is hosting EC2 instances that are on non-production environment and processing non-priority batch loads, which can be interrupted at any time.

What is the best instance purchasing option which can be applied to your EC2 instances in this case?

On-Demand Instances

Spot Instances

Reserved Instances

On-Demand Capacity Reservations

Page 4 of 11

31. A Solutions Architect is managing a three-tier web application that processes credit card payments and online transactions. Static web pages are used on the front-end tier while the application tier contains a single Amazon EC2 instance that handles long-running processes. The data is stored in a MySQL database. The Solutions Architect is instructed to decouple the tiers to create a highly available application.

Which of the following options can satisfy the given requirement?

Move all the static assets and web pages to Amazon S3. Re-host the application to Amazon Elastic Container Service (Amazon ECS) containers and enable Service Auto Scaling. Migrate the database to Amazon RDS with Multi-AZ deployments configuration.

Move all the static assets, web pages, and the backend application to a larger instance. Use Auto Scaling in Amazon EC2 instance. Migrate the database to Amazon Aurora.

Move all the static assets and web pages to Amazon CloudFront. Use Auto Scaling in Amazon EC2 instance. Migrate the database to Amazon RDS with Multi-AZ deployments configuration.

Move all the static assets to Amazon S3. Set concurrency limit in AWS Lambda to move the application to a serverless architecture. Migrate the database to Amazon DynamoD

32. A multinational company has been building its new data analytics platform with high-performance computing workloads (HPC) which requires a scalable, POSIX-compliant storage service. The data need to be stored redundantly across multiple AZs and allows concurrent connections from thousands of EC2 instances hosted on multiple Availability Zones.

Which of the following AWS storage service is the most suitable one to use in this scenario?

Amazon ElastiCache

Amazon S3

Amazon Elastic File System

Amazon EBS Volumes

33. A company plans to implement a hybrid architecture. They need to create a dedicated connection from their Amazon Virtual Private Cloud (VPC) to their on-premises network. The connection must provide high bandwidth throughput and a more consistent network experience than Internet-based solutions .

Which of the following can be used to create a private connection between the VPC and the company's

on-premises network?

AWS Direct Connect

AWS Site-to-Site VPN

Transit VPC

Transit Gateway with equal-cost multipath routing (ECMP)

34. A company has an application hosted in an Auto Scaling group of Amazon EC2 instances across multiple Availability Zones behind an Application Load Balancer. There are several occasions where some instances are automatically terminated after failing the HTTPS health checks in the ALB and then purges all the ephemeral logs stored in the instance. A Solutions Architect must implement a solution that collects all of the application and server logs effectively. She should be able to perform a root cause analysis based on the logs, even if the Auto Scaling group immediately terminated the instance.

What is the EASIEST way for the Architect to automate the log collection from the Amazon EC2 instances?

Add a lifecycle hook to your Auto Scaling group to move instances in the Terminating state to the Terminating:Wait state to delay the termination of the unhealthy Amazon EC2 instances. Configure a CloudWatch Events rule for the EC2 Instance Terminate Successful Auto Scaling Event with an associated Lambda function. Set up the AWS Systems Manager Run Command service to run a script that collects and uploads the application logs from the instance to a CloudWatch Logs group. Resume the instance termination once all the logs are sent.

Add a lifecycle hook to your Auto Scaling group to move instances in the Terminating state to the Terminating:Wait state to delay the termination of the unhealthy Amazon EC2 instances. Set up AWS Step Functions to collect the application logs and send them to a CloudWatch Log group. Configure the solution to resume the instance termination as soon as all the logs were successfully sent to CloudWatch Logs.

Add a lifecycle hook to your Auto Scaling group to move instances in the Terminating state to the Terminating:Wait state to delay the termination of unhealthy Amazon EC2 instances. Configure a CloudWatch Events rule for the EC2 Instance-terminate Lifecycle Action Auto Scaling Event with an associated Lambda function. Trigger the CloudWatch agent to push the application logs and then resume the instance termination once all the logs are sent to CloudWatch Logs.

Add a lifecycle hook to your Auto Scaling group to move instances in the Terminating state to the Pending:Wait state to delay the termination of the unhealthy Amazon EC2 instances. Configure a CloudWatch Events rule for the EC2 Instance-terminate Lifecycle Action Auto Scaling Event with an associated Lambda function. Set up an AWS Systems Manager Automation script that collects and uploads the application logs from the instance to a CloudWatch Logs group. Configure the solution to only resume the instance termination once all the logs were successfully sent.

35. Both historical records and frequently accessed data are stored on an on-premises storage system. The amount of current data is growing at an exponential rate. As the storage’s capacity is nearing its limit, the company’s Solutions Architect has decided to move the historical records to AWS to free up space for the active data.

Which of the following architectures deliver the best solution in terms of cost and operational management?

Use AWS Storage Gateway to move the historical records from on-premises to AW

Choose Amazon S3 Glacier Deep Archive to be the destination for the data.

Use AWS DataSync to move the historical records from on-premises to AW

Choose Amazon S3 Glacier Deep Archive to be the destination for the data.

Use AWS Storage Gateway to move the historical records from on-premises to AW

Choose Amazon S3 Glacier to be the destination for the data. Modify the S3 lifecycle configuration to move the data from the Standard tier to Amazon S3 Glacier Deep Archive after 30 days.

Use AWS DataSync to move the historical records from on-premises to AW

Choose Amazon S3 Standard to be the destination for the data. Modify the S3 lifecycle configuration to move the data from the Standard tier to Amazon S3 Glacier Deep Archive after 30 days.

36. A company is running a dashboard application on a Spot EC2 instance inside a private subnet. The dashboard is reachable via a domain name that maps to the private IPv4 address of the instance’s network interface. A solutions architect needs to increase network availability by allowing the traffic flow to resume in another instance if the primary instance is terminated .

Which solution accomplishes these requirements?

Set up AWS Transfer for FTPS service in Implicit FTPS mode to automatically disable the source/destination checks on the instance’s primary elastic network interface and reassociate it to another instance.

Attach an elastic IP address to the instance’s primary network interface and point its IP address to the application’s domain name. Automatically move the EIP to a secondary instance if the primary instance becomes unavailable using the AWS Transit Gateway.

Create a secondary elastic network interface and point its private IPv4 address to the application’s domain name. Attach the new network interface to the primary instance. If the instance goes down, move the secondary network interface to another instance.

Use the AWS Network Firewall to detach the instance’s primary elastic network interface and move it to a new instance upon failure.

37. A company has an e-commerce application that saves the transaction logs to an S3 bucket. You are instructed by the CTO to configure the application to keep the transaction logs for one month for troubleshooting purposes, and then afterward, purge the logs .

What should you do to accomplish this requirement?

Create a new IAM policy for the Amazon S3 bucket that automatically deletes the logs after a month

Configure the lifecycle configuration rules on the Amazon S3 bucket to purge the transaction logs after a month

Enable CORS on the Amazon S3 bucket which will enable the automatic monthly deletion of data

Add a new bucket policy on the Amazon S3 bucket.

38. A company plans to set up a cloud infrastructure in AWS. In the planning, it was discussed that you need to deploy two EC2 instances that should continuously run for three years. The CPU utilization of the EC2 instances is also expected to be stable and predictable.

Which is the most cost-efficient Amazon EC2 Pricing type that is most appropriate for this scenario?

Spot instances

On-Demand instances

Reserved Instances

Dedicated Hosts

39. The company that you are working for has a highly available architecture consisting of an elastic load balancer and several EC2 instances configured with auto-scaling in three Availability Zones. You want to monitor your EC2 instances based on a particular metric, which is not readily available in CloudWatch .

Which of the following is a custom metric in CloudWatch which you have to manually set up?

Disk Reads activity of an EC2 instance

Memory Utilization of an EC2 instance

Network packets out of an EC2 instance

CPU Utilization of an EC2 instance

40. A news company is planning to use a Hardware Security Module (CloudHSM) in AWS for secure key storage of their web applications. You have launched the CloudHSM cluster but after just a few hours, a support staff mistakenly attempted to log in as the administrator three times using an invalid password in the Hardware Security Module. This has caused the HSM to be zeroized, which means that the encryption keys on it have been wiped. Unfortunately, you did not have a copy of the keys stored anywhere else.

How can you obtain a new copy of the keys that you have stored on Hardware Security Module?

Restore a snapshot of the Hardware Security Module.

Use the Amazon CLI to get a copy of the keys.

The keys are lost permanently if you did not have a copy.

Contact AWS Support and they will provide you a copy of the keys.

Page 5 of 11

41. An organization plans to run an application in a dedicated physical server that doesn’t use virtualization.

The application data will be stored in a storage solution that uses an NFS protocol. To prevent data loss, you need to use a durable cloud storage service to store a copy of your data .

Which of the following is the most suitable solution to meet the requirement?

Use an AWS Storage Gateway hardware appliance for your compute resources. Configure Volume Gateway to store the application data and backup data.

Use an AWS Storage Gateway hardware appliance for your compute resources. Configure File Gateway to store the application data and create an Amazon S3 bucket to store a backup of your data.

Use an AWS Storage Gateway hardware appliance for your compute resources. Configure Volume Gateway to store the application data and create an Amazon S3 bucket to store a backup of your data.

Use AWS Storage Gateway with a gateway VM appliance for your compute resources. Configure File Gateway to store the application data and backup data.

42. An on-premises server is using an SMB network file share to store application data. The application produces around 50 MB of data per day but it only needs to access some of it for daily processes. To save on storage costs, the company plans to copy all the application data to AWS, however, they want to retain the ability to retrieve data with the same low-latency access as the local file share. The company does not have the capacity to develop the needed tool for this operation .

Which AWS service should the company use?

AWS Storage Gateway

AWS Snowball Edge

Amazon FSx for Windows File Server

AWS Virtual Private Network (VPN)

43. A financial firm is designing an application architecture for its online trading platform that must have high availability and fault tolerance. Their Solutions Architect configured the application to use an Amazon S3 bucket located in the us-east-1 region to store large amounts of intraday financial data. The stored financial data in the bucket must not be affected even if there is an outage in one of the Availability Zones or if there's a regional service failure.

What should the Architect do to avoid any costly service disruptions and ensure data durability?

Copy the S3 bucket to an EBS-backed EC2 instance.

Create a Lifecycle Policy to regularly backup the S3 bucket to Amazon Glacier.

Enable Cross-Region Replication.

Create a new S3 bucket in another region and configure Cross-Account Access to the bucket located in us-east-1.

44. A construction company has an online system that tracks all of the status and progress of their projects. The system is hosted in AWS and there is a requirement to monitor the read and write IOPs metrics for their MySQL RDS instance and send real-time alerts to their DevOps team.

Which of the following services in AWS can you use to meet the requirements? (Select TWO.)

Amazon Simple Queue Service

Amazon Simple Notification Service

CloudWatch

Route 53

SWF

45. A company plans to develop a custom messaging service that will also be used to train their AI for an automatic response feature which they plan to implement in the future. Based on their research and tests, the service can receive up to thousands of messages a day, and all of these data are to be sent to Amazon EMR for further processing. It is crucial that none of the messages are lost, no duplicates are produced, and that they are processed in EMR in the same order as their arrival .

Which of the following options can satisfy the given requirement?

Create an Amazon Kinesis Data Stream to collect the messages.

Set up a default Amazon SQS queue to handle the messages.

Create a pipeline using AWS Data Pipeline to handle the messages.

Set up an Amazon SNS Topic to handle the messages.

46. A company developed a meal planning application that provides meal recommendations for the week as well as the food consumption of the users. The application resides on an EC2 instance which requires access to various AWS services for its day-to-day operations.

Which of the following is the best way to allow the EC2 instance to access the S3 bucket and other AWS services?

Store the API credentials in a bastion host.

Store the API credentials in the EC2 instance.

Create a role in IAM and assign it to the EC2 instance.

Add the API Credentials in the Security Group and assign it to the EC2 instance.

47. A tech startup has recently received a Series A round of funding to continue building their mobile forex trading application. You are hired to set up their cloud architecture in AWS and to implement a highly available, fault tolerant system. For their database, they are using DynamoDB and for authentication, they have chosen to use Cognito. Since the mobile application contains confidential financial transactions, there is a requirement to add a second authentication method that doesn't rely solely on user name and password.

How can you implement this in AWS?

Add multi-factor authentication (MFA) to a user pool in Cognito to protect the identity of your users.

Add a new IAM policy to a user pool in Cognito.

Develop a custom application that integrates with Cognito that implements a second layer of authentication.

Integrate Cognito with Amazon SNS Mobile Push to allow additional authentication via SM

48. A tech company is running two production web servers hosted on Reserved EC2 instances with EBS-backed root volumes. These instances have a consistent CPU load of 90%. Traffic is being distributed to these instances by an Elastic Load Balancer. In addition, they also have Multi-AZ RDS MySQL databases for their production, test, and development environments.

What recommendation would you make to reduce cost in this AWS environment without affecting availability and performance of mission-critical systems? Choose the best answer.

Consider using On-demand instances instead of Reserved EC2 instances

Consider removing the Elastic Load Balancer

Consider not using a Multi-AZ RDS deployment for the development and test database

Consider using Spot instances instead of reserved EC2 instances

49. A company wishes to query data that resides in multiple AWS accounts from a central data lake. Each account has its own Amazon S3 bucket that stores data unique to its business function. Users from different accounts must be granted access to the data lake based on their roles.

Which solution will minimize overhead and costs while meeting the required access patterns?

Use AWS Kinesis Firehose to consolidate data from multiple accounts into a single account.

Use AWS Central Tower to centrally manage each account's S3 buckets.

Create a scheduled Lambda function for transferring data from multiple accounts to the S3 buckets of a central account

Use AWS Lake Formation to consolidate data from multiple accounts into a single account.

50. A popular social media website uses a CloudFront web distribution to serve their static contents to their millions of users around the globe. They are receiving a number of complaints recently that their users take a lot of time to log into their website. There are also occasions when their users are getting HTTP 504 errors. You are instructed by your manager to significantly reduce the user's login time to further optimize the system.

Which of the following options should you use together to set up a cost-effective solution that can improve your application's performance? (Select TWO.)

Deploy your application to multiple AWS regions to accommodate your users around the world. Set up a Route 53 record with latency routing policy to route incoming traffic to the region that provides the best latency to the user.

Set up an origin failover by creating an origin group with two origins. Specify one as the primary origin and the other as the second origin which CloudFront automatically switches to when the primary origin returns specific HTTP status code failure responses.

Configure your origin to add a Cache-Control max-age directive to your objects, and specify the longest practical value for max-age to increase the cache hit ratio of your CloudFront distribution.

Use multiple and geographically disperse VPCs to various AWS regions then create a transit VPC to connect all of your resources. In order to handle the requests faster, set up Lambda functions in each region using the AWS Serverless Application Model (SAM) service.

Customize the content that the CloudFront web distribution delivers to your users using Lambda@Edge, which allows your Lambda functions to execute the authentication process in AWS locations closer to the users.

Page 6 of 11

51. A large financial firm needs to set up a Linux bastion host to allow access to the Amazon EC2 instances running in their VPC. For security purposes, only the clients connecting from the corporate external public IP address 175.45.116.100 should have SSH access to the host .

Which is the best option that can meet the customer's requirement?

Network ACL Inbound Rule: Protocol C TCP, Port Range-22, Source 175.45.116.100/0

Security Group Inbound Rule: Protocol C UDP, Port Range C 22, Source 175.45.116.100/32

Security Group Inbound Rule: Protocol C TC

Port Range C 22, Source 175.45.116.100/32

Network ACL Inbound Rule: Protocol C UDP, Port Range C 22, Source 175.45.116.100/32

52. A financial application is composed of an Auto Scaling group of EC2 instances, an Application Load Balancer, and a MySQL RDS instance in a Multi-AZ Deployments configuration. To protect the confidential data of your customers, you have to ensure that your RDS database can only be accessed using the profile credentials specific to your EC2 instances via an authentication token.

As the Solutions Architect of the company, which of the following should you do to meet the above requirement?

Configure SSL in your application to encrypt the database connection to RD

Create an IAM Role and assign it to your EC2 instances which will grant exclusive access to your RDS instance.

Use a combination of IAM and STS to restrict access to your RDS instance via a temporary token.

Enable the IAM DB Authentication.

53. A company needs to use Amazon S3 to store irreproducible financial documents. For their quarterly reporting, the files are required to be retrieved after a period of 3 months. There will be some occasions when a surprise audit will be held, which requires access to the archived data that they need to present immediately.

What will you do to satisfy this requirement in a cost-effective way?

Use Amazon Glacier Deep Archive

Use Amazon S3 Standard - Infrequent Access

Use Amazon S3 -Intelligent Tiering

Use Amazon S3 Standard

54. An On-Demand EC2 instance is launched into a VPC subnet with the Network ACL configured to allow all inbound traffic and deny all outbound traffic. The instance’s security group has an inbound rule to allow SSH from any IP address and does not have any outbound rules.

In this scenario, what are the changes needed to allow SSH connection to the instance?

The network ACL needs to be modified to allow outbound traffic.

Both the outbound security group and outbound network ACL need to be modified to allow outbound traffic.

No action needed. It can already be accessed from any IP address using SS

The outbound security group needs to be modified to allow outbound traffic.

55. A computer animation film studio has a web application running on an Amazon EC2 instance. It uploads 5 GB video objects to an Amazon S3 bucket. Video uploads are taking longer than expected, which impacts the performance of your application.

Which method will help improve the performance of the application?

Enable Enhanced Networking with the Elastic Network Adapter (ENA) on your EC2 Instances.

Use Amazon S3 Multipart Upload AP

Leverage on Amazon CloudFront and use HTTP POST method to reduce latency.

Use Amazon Elastic Block Store Provisioned IOPS and an Amazon EBS-optimized instance.

56. A company wants to streamline the process of creating multiple AWS accounts within an AWS Organization. Each organization unit (OU) must be able to launch new accounts with preapproved configurations from the security team which will standardize the baselines and network configurations for all accounts in the organization.

Which solution entails the least amount of effort to implement?

Set up an AWS Config aggregator on the root account of the organization to enable multi-account, multi-region data aggregation. Deploy conformance packs to standardize the baselines and network configurations for all accounts.

Set up an AWS Control Tower Landing Zone. Enable pre-packaged guardrails to enforce policies or detect violations.

Configure AWS Resource Access Manager (AWS RAM) to launch new AWS accounts as well as standardize the baselines and network configurations for each organization unit

Centralized the creation of AWS accounts using AWS Systems Manager OpsCenter. Enforce policies and detect violations to all AWS accounts using AWS Security Hub.

57. A company hosts multiple applications in their VPC. While monitoring the system, they noticed that multiple port scans are coming in from a specific IP address block that is trying to connect to several AWS resources inside their VPC. The internal security team has requested that all offending IP addresses be denied for the next 24 hours for security purposes.

Which of the following is the best method to quickly and temporarily deny access from the specified IP addresses?

Configure the firewall in the operating system of the EC2 instances to deny access from the IP address block.

Add a rule in the Security Group of the EC2 instances to deny access from the IP Address block.

Modify the Network Access Control List associated with all public subnets in the VPC to deny access from the IP Address block.

Create a policy in IAM to deny access from the IP Address block.

58. A government agency plans to store confidential tax documents on AWS. Due to the sensitive information in the files, the Solutions Architect must restrict the data access requests made to the storage solution to a specific Amazon VPC only. The solution should also prevent the files from being deleted or overwritten to meet the regulatory requirement of having a write-once-read-many (WORM) storage model.

Which combination of the following options should the Architect implement? (Select TWO.)

Create a new Amazon S3 bucket with the S3 Object Lock feature enabled. Store the documents in the bucket and set the Legal Hold option for object retention.

Configure an Amazon S3 Access Point for the S3 bucket to restrict data access to a particular Amazon VPC only.

Set up a new Amazon S3 bucket to store the tax documents and integrate it with AWS Network Firewall. Configure the Network Firewall to only accept data access requests from a specific Amazon VP

Store the tax documents in the Amazon S3 Glacier Instant Retrieval storage class to restrict fast data retrieval to a particular Amazon VPC of your choice.

Enable Object Lock but disable Object Versioning on the new Amazon S3 bucket to comply with the write-once-read-many (WORM) storage model requirement.

59. A company runs a messaging application in the ap-northeast-1 and ap-southeast-2 region. A Solutions Architect needs to create a routing policy wherein a larger portion of traffic from the Philippines and North India will be routed to the resource in the ap-northeast-1 region .

Which Route 53 routing policy should the Solutions Architect use?

Latency Routing

Weighted Routing

Geoproximity Routing

Geolocation Routing

60. A solutions architect is managing an application that runs on a Windows EC2 instance with an attached Amazon FSx for Windows File Server. To save cost, management has decided to stop the instance during off-hours and restart it only when needed. It has been observed that the application takes several minutes to become fully operational which impacts productivity.

How can the solutions architect speed up the instance’s loading time without driving the cost up?

Migrate the application to a Linux-based EC2 instance.

Disable the Instance Metadata Service to reduce the things that need to be loaded at startup.

Enable the hibernation mode on the EC2 instance.

Migrate the application to an EC2 instance with hibernation enabled.

Page 7 of 11

61. A Solutions Architect designed a real-time data analytics system based on Kinesis Data Stream and Lambda. A week after the system has been deployed, the users noticed that it performed slowly as the data rate increases. The Architect identified that the performance of the Kinesis Data Streams is causing this problem.

Which of the following should the Architect do to improve performance?

Improve the performance of the stream by decreasing the number of its shards using the MergeShard command.

Increase the number of shards of the Kinesis stream by using the UpdateShardCount command.

Implement Step Scaling to the Kinesis Data Stream.

Replace the data stream with Amazon Kinesis Data Firehose instead.

62. A social media company needs to capture the detailed information of all HTTP requests that went through their public-facing Application Load Balancer every five minutes. The client's IP address and

network latencies must also be tracked. They want to use this data for analyzing traffic patterns and for troubleshooting their Docker applications orchestrated by the Amazon ECS Anywhere service.

Which of the following options meets the customer requirements with the LEAST amount of overhead?

Enable AWS CloudTrail for their Application Load Balancer. Use the AWS CloudTrail Lake to analyze and troubleshoot the application traffic.

Enable access logs on the Application Load Balancer. Integrate the Amazon ECS cluster with Amazon CloudWatch Application Insights to analyze traffic patterns and simplify troubleshooting.

Install and run the AWS X-Ray daemon on the Amazon ECS cluster. Use the Amazon CloudWatch ServiceLens to analyze the traffic that goes through the application.

Integrate Amazon EventBridge (Amazon CloudWatch Events) metrics on the Application Load Balancer to capture the client IP address. Use Amazon CloudWatch Container Insights to analyze traffic patterns.

63. An intelligence agency is currently hosting a learning and training portal in AWS. Your manager instructed you to launch a large EC2 instance with an attached EBS Volume and enable Enhanced Networking .

What are the valid case scenarios in using Enhanced Networking? (Select TWO.)

When you need a dedicated connection to your on-premises data center

When you need high latency networking

When you need a low packet-per-second performance

When you need a higher packet per second (PPS) performance

When you need a consistently lower inter-instance latencies

64. A game company has a requirement of load balancing the incoming TCP traffic at the transport level (Layer 4) to their containerized gaming servers hosted in AWS Fargate. To maintain performance, it should handle millions of requests per second sent by gamers around the globe while maintaining ultra-low latencies.

Which of the following must be implemented in the current architecture to satisfy the new requirement?

Launch a new Application Load Balancer.

Create a new record in Amazon Route 53 with Weighted Routing policy to load balance the incoming traffic.

Launch a new microservice in AWS Fargate that acts as a load balancer since using an ALB or NLB with Fargate is not possible.

Launch a new Network Load Balancer.

65. A company has a set of Linux servers running on multiple On-Demand EC2 Instances. The Audit team wants to collect and process the application log files generated from these servers for their report .

Which of the following services is best to use in this case?

A single On-Demand Amazon EC2 instance for both storing and processing the log files

Amazon S3 Glacier Deep Archive for storing the application log files and AWS ParallelCluster for processing the log files.

Amazon S3 Glacier for storing the application log files and Spot EC2 Instances for processing them.

Amazon S3 for storing the application log files and Amazon Elastic MapReduce for processing the log files.

66. A company plans to migrate all of their applications to AWS. The Solutions Architect suggested to store all the data to EBS volumes. The Chief Technical Officer is worried that EBS volumes are not appropriate for the existing workloads due to compliance requirements, downtime scenarios, and IOPS performance.

Which of the following are valid points in proving that EBS is the best service to use for migration? (Select TWO.)

EBS volumes can be attached to any EC2 Instance in any Availability Zone.

Amazon EBS provides the ability to create snapshots (backups) of any EBS volume and write a copy of the data in the volume to Amazon RDS, where it is stored redundantly in multiple Availability Zones

When you create an EBS volume in an Availability Zone, it is automatically replicated on a separate AWS region to prevent data loss due to a failure of any single hardware component.

EBS volumes support live configuration changes while in production which means that you can modify the volume type, volume size, and IOPS capacity without service interruptions.

An EBS volume is off-instance storage that can persist independently from the life of an instance.

67. A company is planning to deploy a High Performance Computing (HPC) cluster in its VPC that requires a scalable, high-performance file system. The storage service must be optimized for efficient workload processing, and the data must be accessible via a fast and scalable file system interface. It should also work natively with Amazon S3 that enables you to easily process your S3 data with a high-performance POSIX interface.

Which of the following is the MOST suitable service that you should use for this scenario?

Amazon FSx for Windows File Server

Amazon FSx for Lustre

Amazon Elastic Block Storage (EBS)

Amazon Elastic File System (EFS)

68. A company recently launched an e-commerce application that is running in eu-east-2 region, which strictly requires six EC2 instances running at all times. In that region, there are 3 Availability Zones (AZ) that you can use - eu-east-2a, eu-east-2b, and eu-east-2c.

Which of the following deployments provide 100% fault tolerance if any single AZ in the region becomes unavailable? (Select TWO.)

eu-east-2a with four EC2 instances, eu-east-2b with two EC2 instances, and eu-east-2c with two EC2 instances

eu-east-2a with six EC2 instances, eu-east-2b with six EC2 instances, and eu-east-2c with no EC2 instances

eu-east-2a with two EC2 instances, eu-east-2b with four EC2 instances, and eu-east-2c with two EC2 instances

eu-east-2a with three EC2 instances, eu-east-2b with three EC2 instances, and eu-east-2c with three EC2 instances

eu-east-2a with two EC2 instances, eu-east-2b with two EC2 instances, and eu-east-2c with two EC2 instances

69. A new online banking platform has been re-designed to have a microservices architecture in which complex applications are decomposed into smaller, independent services. The new platform is using Docker considering that application containers are optimal for running small, decoupled services. The new solution should remove the need to provision and manage servers, let you specify and pay for resources per application, and improve security through application isolation by design.

Which of the following is the MOST suitable service to use to migrate this new platform to AWS?

Amazon EFS

Amazon EBS

Amazon EKS

AWS Fargate

70. A company has stored 200 TB of backup files in Amazon S3. The files are in a vendor-proprietary format. The Solutions Architect needs to use the vendor's proprietary file conversion software to retrieve the files from their Amazon S3 bucket, transform the files to an industry-standard format, and re-upload the files back to Amazon S3. The solution must minimize the data transfer costs .

Which of the following options can satisfy the given requirement?

Deploy the EC2 instance in a different Region. Install the conversion software on the instance. Perform data transformation and re-upload it to Amazon S3.

Install the file conversion software in Amazon S3. Use S3 Batch Operations to perform data transformation.

Deploy the EC2 instance in the same Region as Amazon S3. Install the file conversion software on the instance. Perform data transformation and re-upload it to Amazon S3.

Export the data using AWS Snowball Edge device. Install the file conversion software on the device. Transform the data and re-upload it to Amazon S3.

Page 8 of 11

71. An accounting application uses an RDS database configured with Multi-AZ deployments to improve availability .

What would happen to RDS if the primary database instance fails?

The IP address of the primary DB instance is switched to the standby DB instance.

The primary database instance will reboot.

A new database instance is created in the standby Availability Zone.

The canonical name record (CNAME) is switched from the primary to standby instance.

72. A company plans to use a durable storage service to store on-premises database backups to the AWS cloud. To move their backup data, they need to use a service that can store and retrieve objects through standard file storage protocols for quick recovery.

Which of the following options will meet this requirement?

Use the AWS Storage Gateway volume gateway to store the backup data and directly access it using Amazon S3 API actions.

Use Amazon EBS volumes to store all the backup data and attach it to an Amazon EC2 instance.

Use AWS Snowball Edge to directly backup the data in Amazon S3 Glacier.

Use the AWS Storage Gateway file gateway to store all the backup data in Amazon S3.

73. A Solutions Architect needs to ensure that all of the AWS resources in Amazon VPC don’t go beyond their respective service limits. The Architect should prepare a system that provides real-time guidance in provisioning resources that adheres to the AWS best practices.

Which of the following is the MOST appropriate service to use to satisfy this task?

Amazon Inspector

AWS Trusted Advisor

AWS Cost Explorer

AWS Budgets

74. An online trading platform with thousands of clients across the globe is hosted in AWS. To reduce latency, you have to direct user traffic to the nearest application endpoint to the client. The traffic should be routed to the closest edge location via an Anycast static IP address. AWS Shield should also be integrated into the solution for DDoS protection.

Which of the following is the MOST suitable service that the Solutions Architect should use to satisfy the above requirements?

AWS WAF

AWS Global Accelerator

AWS PrivateLink

Amazon CloudFront

75. An application is loading hundreds of JSON documents into an Amazon S3 bucket every hour which is registered in AWS Lake Formation as a data catalog. The Data Analytics team uses Amazon Athena to run analyses on these data, but due to the volume, most queries take a long time to complete .

What change should be made to improve the query performance while ensuring data security?

Convert the JSON documents into CSV format. Provide fine-grained named resource access control to specific databases or tables in AWS Lake Formation.

Transform the JSON data into Apache Parque format. Ensure that the user has an lakeformation:GetDataAccess IAM permission for underlying data access control.

Apply minification on the data and implement the Lake Formation tag-based access control (LF-TBAC) authorization strategy to ensure security.

Compress the data into GZIP format before storing it in the S3 bucket. Apply an IAM policy with aws:SourceArn and aws:SourceAccount global condition context keys in Lake Formation that prevents cross-service confused deputy problems and other security issues.

76. A top university has recently launched its online learning portal where the students can take e-learning courses from the comforts of their homes. The portal is on a large On-Demand EC2 instance with a single Amazon Aurora database.

How can you improve the availability of your Aurora database to prevent any unnecessary downtime of the online portal?

Enable Hash Joins to improve the database query performance.

Deploy Aurora to two Auto-Scaling groups of EC2 instances across two Availability Zones with an elastic load balancer which handles load balancing.

Use an Asynchronous Key Prefetch in Amazon Aurora to improve the performance of queries that join tables across indexes.

Create Amazon Aurora Replicas.

77. A company plans to migrate its suite of containerized applications running on-premises to a container service in AWS. The solution must be cloud-agnostic and use an open-source platform that can automatically manage containerized workloads and services. It should also use the same configuration and tools across various production environments.

What should the Solution Architect do to properly migrate and satisfy the given requirement?

Migrate the application to Amazon Container Registry (ECR) with Amazon EC2 instance worker nodes.

Migrate the application to Amazon Elastic Container Service with ECS tasks that use the AWS Fargate launch type.

Migrate the application to Amazon Elastic Container Service with ECS tasks that use the Amazon EC2 launch type.

Migrate the application to Amazon Elastic Kubernetes Service with EKS worker nodes.

78. A commercial bank has a forex trading application. They created an Auto Scaling group of EC2 instances that allow the bank to cope with the current traffic and achieve cost-efficiency. They want the Auto Scaling group to behave in such a way that it will follow a predefined set of parameters before it scales down the number of EC2 instances, which protects the system from unintended slowdown or unavailability.

Which of the following statements are true regarding the cooldown period? (Select TWO.)

Its default value is 300 seconds.

It ensures that the Auto Scaling group launches or terminates additional EC2 instances without any downtime.

Its default value is 600 seconds.

It ensures that before the Auto Scaling group scales out, the EC2 instances have ample time to cooldown.

It ensures that the Auto Scaling group does not launch or terminate additional EC2 instances before the previous scaling activity takes effect.

79. A software development company needs to connect its on-premises infrastructure to the AWS cloud .

Which of the following AWS services can you use to accomplish this? (Select TWO.)

NAT Gateway

Amazon Connect

VPC Peering

AWS Direct Connect

IPsec VPN connection

80. A company plans to implement a network monitoring system in AWS. The Solutions Architect launched an EC2 instance to host the monitoring system and used CloudWatch to monitor, store, and access the log files of the instance.

Which of the following provides an automated way to send log data to CloudWatch Logs from the Amazon EC2 instance?

AWS Transfer for SFTP

CloudTrail with log file validation

CloudTrail Processing Library

CloudWatch Logs agent

Page 9 of 11

81. 0.0.0/0

D. In the Network ACL, update the rule to allow both inbound and outbound TCP connection on port

443 from source 0.0.0.0/0 and to destination 0.0.0.0/0

E. In the Security Group, add a new rule to allow TCP connection on port 443 from source 0.0.0.0/0

82. An investment bank is working with an IT team to handle the launch of the new digital wallet system. The applications will run on multiple EBS-backed EC2 instances which will store the logs, transactions, and billing statements of the user in an S3 bucket. Due to tight security and compliance requirements, the IT team is exploring options on how to safely store sensitive data on the EBS volumes and S3.

Which of the below options should be carried out when storing sensitive data on AWS? (Select TWO.)

Migrate the EC2 instances from the public to private subnet.

Enable Amazon S3 Server-Side or use Client-Side Encryption

Use AWS Shield and WAF

Create an EBS Snapshot

Enable EBS Encryption

83. A data analytics company keeps a massive volume of data that they store in their on-premises data center. To scale their storage systems, they are looking for cloud-backed storage volumes that they can mount using Internet Small Computer System Interface (iSCSI) devices from their on-premises application servers. They have an on-site data analytics application that frequently accesses the latest data subsets locally while the older data are rarely accessed. You are required to minimize the need to scale the on-premises storage infrastructure while still providing their web application with low-latency access to the data.

Which type of AWS Storage Gateway service will you use to meet the above requirements?

Volume Gateway in cached mode

Volume Gateway in stored mode

Tape Gateway

File Gateway

84. A top IT Consultancy has a VPC with two On-Demand EC2 instances with Elastic IP addresses. You were notified that the EC2 instances are currently under SSH brute force attacks over the Internet. The IT Security team has identified the IP addresses where these attacks originated. You have to immediately implement a temporary fix to stop these attacks while the team is setting up AWS WAF, GuardDuty, and AWS Shield Advanced to permanently fix the security vulnerability .

Which of the following provides the quickest way to stop the attacks to the instances?

Place the EC2 instances into private subnets

Assign a static Anycast IP address to each EC2 instance

Block the IP addresses in the Network Access Control List

Remove the Internet Gateway from the VPC

85. A startup is building IoT devices and monitoring applications. They are using IoT sensors to monitor the traffic in real-time by using an Amazon Kinesis Stream that is configured with default settings. It then sends the data to an Amazon S3 bucket every 3 days. When you checked the data in S3 on the 3rd day, only the data for the last day is present and no data is present from 2 days ago .

Which of the following is the MOST likely cause of this issue?

Someone has manually deleted the record in Amazon S3.

The access of the Kinesis stream to the S3 bucket is insufficient.

By default, data records in Kinesis are only accessible for 24 hours from the time they are added to a stream.

Amazon S3 bucket has encountered a data loss.

86. A company is using an Auto Scaling group which is configured to launch new t2.micro EC2 instances when there is a significant load increase in the application. To cope with the demand, you now need to replace those instances with a larger t2.2xlarge instance type .

How would you implement this change?

Create another Auto Scaling Group and attach the new instance type.

Change the instance type of each EC2 instance manually.

Just change the instance type to t2.2xlarge in the current launch configuration

Create a new launch configuration with the new instance type and update the Auto Scaling Group.

87. A company needs to launch an Amazon EC2 instance with persistent block storage to host its application. The stored data must be encrypted at rest.

Which of the following is the most suitable storage solution in this scenario?

Amazon EBS volume with server-side encryption (SSE) enabled.

Encrypted Amazon EBS volume using AWS KM

Encrypted Amazon EC2 Instance Store using AWS KM

Amazon EC2 Instance Store with SSL encryption.

88. A disaster recovery team is planning to back up on-premises records to a local file server share through SMB protocol. To meet the company’s business continuity plan, the team must ensure that a copy of

data from 48 hours ago is available for immediate access. Accessing older records with delay is tolerable.

Which should the DR team implement to meet the objective with the LEAST amount of configuration effort?

Create an AWS Backup plan to copy data backups to a local SMB share every 48 hours.

Use an AWS Storage File gateway with enough storage to keep data from the last 48 hours. Send the backups to an SMB share mounted as a local disk.

Create an SMB file share in Amazon FSx for Windows File Server that has enough storage to store all backups. Access the file share from on-premises.

Mount an Amazon EFS file system on the on-premises client and copy all backups to an NFS share.

89. A company is designing a banking portal that uses Amazon ElastiCache for Redis as its distributed session management component. Since the other Cloud Engineers in your department have access to your ElastiCache cluster, you have to secure the session data in the portal by requiring them to enter a password before they are granted permission to execute Redis commands.

As the Solutions Architect, which of the following should you do to meet the above requirement?

Authenticate the users using Redis AUTH by creating a new Redis Cluster with both the --transit-encryption-enabled and --auth-token parameters enabled.

Set up a Redis replication group and enable the AtRestEncryptionEnabled parameter.

Set up an IAM Policy and MFA which requires the Cloud Engineers to enter their IAM credentials and token before they can access the ElastiCache cluster.

Enable the in-transit encryption for Redis replication groups.

90. An Intelligence Agency developed a missile tracking application that is hosted on both development and production AWS accounts. The Intelligence agency’s junior developer only has access to the development account. She has received security clearance to access the agency’s production account but the access is only temporary and only write access to EC2 and S3 is allowed.

Which of the following allows you to issue short-lived access tokens that act as temporary security credentials to allow access to your AWS resources?

Use AWS SSO

Use AWS Cognito to issue JSON Web Tokens (JWT)

All of the given options are correct.

Use AWS STS

Page 10 of 11

91. A software development company has hundreds of Amazon EC2 instances with multiple Application Load Balancers (ALBs) across multiple AWS Regions. The public applications hosted in their EC2

instances are accessed on their on-premises network. The company needs to reduce the number of IP addresses that it needs to regularly whitelist on the corporate firewall device .

Which of the following approach can be used to fulfill this requirement?

Use AWS Global Accelerator and create an endpoint group for each AWS Region. Associate the Application Load Balancer from each region to the corresponding endpoint group.

Create a new Lambda function that tracks the changes in the IP addresses of all ALBs across multiple AWS Regions. Schedule the function to run and update the corporate firewall every hour using Amazon CloudWatch Events.

Use AWS Global Accelerator and create multiple endpoints for all the available AWS Regions. Associate all the private IP addresses of the EC2 instances to the corresponding endpoints.

Launch a Network Load Balancer with an associated Elastic IP address. Set the ALBs in multiple Regions as targets.

92. A company needs to collect gigabytes of data per second from websites and social media feeds to gain insights into its product offerings and continuously improve the user experience. To meet this design requirement, an application is deployed on an Auto Scaling group of Spot EC2 instances which processes the data and stores the results to DynamoDB and Redshift. The solution should have a built-in enhanced fan-out feature.

Which fully-managed AWS service can you use to collect and process large streams of data records in real-time with the LEAST amount of administrative overhead?

Amazon Kinesis Data Streams

Amazon S3 Access Points

Amazon Managed Streaming for Apache Kafka (Amazon MSK)

AWS Data Exchange

93. A mobile application stores pictures in Amazon Simple Storage Service (S3) and allows application sign-in using an OpenID Connect-compatible identity provider.

Which AWS Security Token Service approach to temporary access should you use for this scenario?

AWS Identity and Access Management roles

SAML-based Identity Federation

Cross-Account Access

Web Identity Federation

94. A Solutions Architect created a brand new IAM User with a default setting using AWS CLI. This is intended to be used to send API requests to Amazon S3, DynamoDB, Lambda, and other AWS resources of the company’s cloud infrastructure.

Which of the following must be done to allow the user to make API calls to the AWS resources?

Create a set of Access Keys for the user and attach the necessary permissions.

Do nothing as the IAM User is already capable of sending API calls to your AWS resources.

Enable Multi-Factor Authentication for the user.

Assign an IAM Policy to the user to allow it to send API calls.

95. A web application, which is hosted in your on-premises data center and uses a MySQL database, must be migrated to AWS Cloud. You need to ensure that the network traffic to and from your RDS database instance is encrypted using SSL. For improved security, you have to use the profile credentials specific to your EC2 instance to access your database, instead of a password .

Which of the following should you do to meet the above requirement?

Launch a new RDS database instance with the Backtrack feature enabled.

Set up an RDS database and enable the IAM DB Authentication.

Launch the mysql client using the --ssl-ca parameter when connecting to the database.

Configure your RDS database to enable encryption.

96. A leading media company has recently adopted a hybrid cloud architecture which requires them to migrate their application servers and databases in AWS. One of their applications requires a heterogeneous database migration in which you need to transform your on-premises Oracle database to PostgreSQL in AWS. This entails a schema and code transformation before the proper data migration starts.

Which of the following options is the most suitable approach to migrate the database in AWS?

First, use the AWS Schema Conversion Tool to convert the source schema and application code to match that of the target database, and then use the AWS Database Migration Service to migrate data from the source database to the target database.

Configure a Launch Template that automatically converts the source schema and code to match that of the target database. Then, use the AWS Database Migration Service to migrate data from the source database to the target database.

Use Amazon Neptune to convert the source schema and code to match that of the target database in RD

Use the AWS Batch to effectively migrate the data from the source database to the target database in a batch process.

Heterogeneous database migration is not supported in AW

You have to transform your database first to PostgreSQL and then migrate it to RD

97. There are a few, easily reproducible but confidential files that your client wants to store in AWS without worrying about storage capacity. For the first month, all of these files will be accessed frequently but after that, they will rarely be accessed at all. The old files will only be accessed by developers so there is no set retrieval time requirement. However, the files under a specific tdojo-finance prefix in the S3 bucket will be used for post-processing that requires millisecond retrieval time.

Given these conditions, which of the following options would be the most cost-effective solution for your client's storage needs?

Store the files in S3 then after a month, change the storage class of the tdojo-finance prefix to S3-IA while the remaining go to Glacier using lifecycle policy.

Store the files in S3 then after a month, change the storage class of the tdojo-finance prefix to One Zone-IA while the remaining go to Glacier using lifecycle policy.

Store the files in S3 then after a month, change the storage class of the bucket to Intelligent-Tiering using lifecycle policy.

Store the files in S3 then after a month, change the storage class of the bucket to S3-IA using lifecycle policy.

98. A company deployed several EC2 instances in a private subnet. The Solutions Architect needs to ensure the security of all EC2 instances. Upon checking the existing Inbound Rules of the Network ACL, she saw this configuration:

If a computer with an IP address of 110.238.109.37 sends a request to the VPC, what will happen?

It will be allowed.

Initially, it will be allowed and then after a while, the connection will be denied.

Initially, it will be denied and then after a while, the connection will be allowed.

It will be denied.

99. A company has a cryptocurrency exchange portal that is hosted in an Auto Scaling group of EC2 instances behind an Application Load Balancer and is deployed across multiple AWS regions. The users can be found all around the globe, but the majority are from Japan and Sweden. Because of the compliance requirements in these two locations, you want the Japanese users to connect to the servers in the ap-northeast-1 Asia Pacific (Tokyo) region, while the Swedish users should be connected to the servers in the eu-west-1 EU (Ireland) region.

Which of the following services would allow you to easily fulfill this requirement?

Use Route 53 Geolocation Routing policy.

Use Route 53 Weighted Routing policy.

Set up an Application Load Balancers that will automatically route the traffic to the proper AWS region.

Set up a new CloudFront web distribution with the geo-restriction feature enabled.

100. A company plans to conduct a network security audit. The web application is hosted on an Auto Scaling group of EC2 Instances with an Application Load Balancer in front to evenly distribute the incoming traffic. A Solutions Architect has been tasked to enhance the security posture of the company’s cloud infrastructure and minimize the impact of DDoS attacks on its resources.

Which of the following is the most effective solution that should be implemented?

Configure Amazon CloudFront distribution and set a Network Load Balancer as the origin. Use Amazon GuardDuty to block suspicious hosts based on its security findings. Set up a custom AWS Lambda function that processes the security logs and invokes Amazon SNS for notification.

Configure Amazon CloudFront distribution and set Application Load Balancer as the origin. Create a rate-based web ACL rule using AWS WAF and associate it with Amazon CloudFront.

Configure Amazon CloudFront distribution and set a Network Load Balancer as the origin. Use VPC Flow Logs to monitor abnormal traffic patterns. Set up a custom AWS Lambda function that processes the flow logs and invokes Amazon SNS for notification.

Configure Amazon CloudFront distribution and set an Application Load Balancer as the origin. Create a security group rule and deny all the suspicious addresses. Use Amazon SNS for notification.

Page 11 of 11

101. A company has a web application hosted on a fleet of EC2 instances located in two Availability Zones that are all placed behind an Application Load Balancer. As a Solutions Architect, you have to add a health check configuration to ensure your application is highly-available .

Which health checks will you implement?

HTTP or HTTPS health check

FTP health check

TCP health check

ICMP health check

102. An organization needs a persistent block storage volume that will be used for mission-critical workloads. The backup data will be stored in an object storage service and after 30 days, the data will be stored in a data archiving storage service.

What should you do to meet the above requirement?

Attach an instance store volume in your existing EC2 instance. Use Amazon S3 to store your backup data and configure a lifecycle policy to transition your objects to Amazon S3 Glacier.

Attach an instance store volume in your EC2 instance. Use Amazon S3 to store your backup data and configure a lifecycle policy to transition your objects to Amazon S3 One Zone-I

Attach an EBS volume in your EC2 instance. Use Amazon S3 to store your backup data and configure a lifecycle policy to transition your objects to Amazon S3 Glacier.

Attach an EBS volume in your EC2 instance. Use Amazon S3 to store your backup data and configure a lifecycle policy to transition your objects to Amazon S3 One Zone-I

103. A company is building an internal application that processes loans, accruals, and interest rates for their clients. They require a storage service that is able to handle future increases in storage capacity of up to 16 TB and can provide the lowest-latency access to their data. The web application will be hosted in a single m5ad.24xlarge Reserved EC2 instance that will process and store data to the storage service .

Which of the following storage services would you recommend?

EBS

Storage Gateway

EFS