Exams Practice Exam Questions and Answers – Part 14/15

Answer: C. Use AWS DataSync to migrate existing data to Amazon S3 and then use File Gateway to retain access to the migrated data for ongoing updates from the on-premises applications

AWS DataSync accelerates and automates large-scale online data migrations to Amazon S3. File Gateway then provides low-latency, on-premises access to that migrated data for ongoing updates. Transfer Acceleration optimizes long-distance internet transfers but does not provide local cache access.

Answer: C. Configure the S3 bucket to send an event notification to an AWS Lambda function each time a new image is uploaded. Use the Lambda function to process the image, create a thumbnail, and store the thumbnail in the second S3 bucket

Amazon S3 event notifications can trigger an AWS Lambda function to process new objects automatically. This event-driven architecture is serverless, minimizes operational overhead, and is highly cost-effective for intermittent workloads compared to continuously polling with compute resources.

Answer: D. Create a gateway VPC endpoint for Amazon S3 in the VPC. Ensure that the EC2 instance's subnet route table is updated to route S3 traffic through the endpoint. Confirm that appropriate IAM policies are in place to permit access via the VPC endpoint

A gateway VPC endpoint routes Amazon S3 traffic over the private AWS network, keeping it completely off the public internet. Updating route tables directs traffic correctly. NAT gateways still route over the public internet, and S3 access points only manage permissions, not network paths.

Answer: C. Use batch messages

Using the API to batch multiple records into a single request dramatically increases throughput and prevents throttling exceptions. Increasing shards also works but raises costs, making it an inferior choice. Exponential backoff manages temporary errors but does not optimize overall shard efficiency.

Answer: A. The security group configuration for the database instance does not have the correct rules to allow inbound connections from the application servers

A connection timeout indicates that network traffic is blocked before reaching the database. The database security group must allow inbound traffic from the application servers' security group. Incorrect credentials or privileges result in access denied errors, which immediately confirms the network connection succeeded.

Answer: C. Take snapshots of the production EBS volumes. Enable EBS fast snapshot restore on the snapshots. Create new EBS volumes from the snapshots and attach them to EC2 instances in the test environment

EBS fast snapshot restore eliminates the initialization latency of new volumes, providing immediate high I/O performance for intensive workloads. Creating new volumes from snapshots safely clones the data. Using Multi-Attach breaks isolation requirements, while standard backups lack the required speed.

Answer: C. Install an Amazon CloudWatch Logs agents on the Amazon EC2 instances to send logs to Amazon CloudWatch

Installing the CloudWatch agent automatically streams logs from ephemeral instances to a centralized service before termination. This ensures logs survive instance deletion and removes the need for manual intervention. Taking snapshots or disabling termination introduces unnecessary operational overhead and reduces elasticity.

Answer: A. Use Enhanced Fanout feature of Amazon Kinesis Data Streams

Enhanced Fanout for Amazon Kinesis Data Streams provides each consumer with a dedicated two megabits per second throughput per shard. This eliminates the read bottleneck that occurs when multiple consumers share the default stream capacity.

Answer: A. Configure AWS Global Accelerator in front of the existing HTTPS API, create one endpoint group in us-west-2 for the current application endpoint, and use the accelerator's global edge network to improve performance for users connecting from Europe and Asia

AWS Global Accelerator routes traffic over the AWS global network to reduce latency for international users. Because this API serves real-time tracking data that cannot be cached, Global Accelerator is preferred over CloudFront.

Answer: B. Set up two Amazon SQS queues to decouple the job intake and job processing stages respectively. Assign one SQS queue to collect incoming jobs, and another to queue them for processing. Configure the EC2 instances to poll the relevant queue. Scale the Auto Scaling groups based on number of messages in each queue

Using Amazon SQS queues to decouple the intake and processing stages preserves job data during scaling events. You should scale your EC2 Auto Scaling groups based on the number of visible messages in each queue to handle demand.

Answer: C. Enable S3 Bucket Keys for server-side encryption with AWS KMS (SSE-KMS) so that new objects use a bucket-level key rather than requesting individual KMS data keys for every object

Amazon S3 Bucket Keys decrease AWS KMS request costs by generating a bucket-level data key for temporary use. This reduces the volume of API requests sent from S3 to KMS while maintaining standard encryption controls.

Answer: A. Use EC2 Instance Connect to inject a temporary public key and establish SSH access using the instance's public IP address

Amazon EC2 Instance Connect pushes a temporary SSH public key to the instance metadata for short-lived access. Without Session Manager, it requires instances to have a public IP address to establish the connection.

Answer: C. Feed the streaming transactions into Amazon Kinesis Data Streams. Leverage AWS Lambda integration to remove sensitive data from every transaction and then store the cleansed transactions in Amazon DynamoDB. The internal applications can consume the raw transactions off the Amazon Kinesis Data Stream

Amazon Kinesis Data Streams captures real-time transactions and allows multiple consumers, including AWS Lambda, to process the data simultaneously. Lambda can then remove sensitive details before storing records in Amazon DynamoDB.

Answer: C. Use AWS Identity and Access Management (IAM) Access Analyzer to evaluate resource-based and identity-based policies and identify resources shared outside the account or organization

AWS IAM Access Analyzer evaluates resource-based policies to identify resources shared with external entities. It uses automated reasoning to detect unintended access paths, whereas tools like Amazon Inspector focus on vulnerability scanning, not policy analysis.

Answer: D. Design a RESTful API with Amazon API Gateway that forwards incoming feedback data to an Amazon SQS queue. Set up an AWS Lambda function to process the queue messages, analyze sentiment using Amazon Comprehend, and store results in a DynamoDB table with a 365-day TTL configured on each item

Using Amazon API Gateway with an SQS queue decouples the ingestion of sudden traffic spikes from backend processing. AWS Lambda and Amazon Comprehend then provide automated sentiment analysis, while DynamoDB TTL handles the automatic one year data expiration.

Answer: B. Build an Amazon Machine Image (AMI) from the existing EC2 instance and configure a launch template. Create an Auto Scaling group using the launch template with Spot Instance pricing enabled. Attach an Application Load Balancer to distribute traffic across dynamically launched instances

An EC2 Auto Scaling group with an Application Load Balancer dynamically adjusts capacity to match unpredictable traffic spikes for stateless workloads. Utilizing Spot Instances significantly reduces compute costs compared to On-Demand, while the load balancer ensures fault tolerance.

Answer: A,B. Create a replica Aurora instance in another Availability Zone to improve the availability as the replica can serve as a failover target || Handle all read operations for your application by connecting to the reader endpoint of the Amazon Aurora cluster so that Aurora can spread the load for read-only connections across the Aurora replica

Adding Aurora Replicas improves high availability by providing automatic failover targets, and using the reader endpoint offloads read traffic to reduce CPU and memory spikes. Aurora does not use standby instances for failover, and increasing Lambda concurrency would worsen the database bottleneck.

Answer: D,E. The route table in the instance's subnet should have a route to an Internet Gateway || The network access control list (network ACL) associated with the subnet must have rules to allow inbound and outbound traffic

For an EC2 instance to reach the internet, its subnet's route table must include a route to the Internet Gateway. Additionally, the associated network ACL must permit the necessary inbound and outbound traffic.

Answer: C. The Auto Scaling group should be configured with the minimum capacity set to 4, with 2 instances each in two different Availability Zones. The maximum capacity of the Auto Scaling group should be set to 6

To guarantee high availability across an Availability Zone failure, an Auto Scaling group needs a minimum capacity of four instances spread evenly across two zones. This ensures two instances survive if one zone fails.

Answer: C. Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage

Amazon EC2 instance store delivers maximum IOPS for processing large video files. Amazon S3 provides highly durable storage for active media, and Amazon S3 Glacier offers low-cost archival storage for legacy data.

Answer: B. Set up AWS Site-to-Site VPN to connect the on-premises network to the AWS VPC. Use route tables to manage traffic flow and configure security groups and network ACLs to allow only authorized communication between systems

AWS Site-to-Site VPN encrypts traffic between on-premises networks and AWS VPCs using IPsec tunnels. Layering TLS satisfies the session encryption requirement, while route tables, security groups, and network ACLs provide the necessary granular access controls.

Answer: A. Set up an Amazon S3 bucket lifecycle policy to move files from Amazon S3 Standard to Amazon S3 Standard-IA 30 days after object creation. Delete the files 5 years after object creation

Amazon S3 Standard-IA provides immediate millisecond access for critical data while lowering costs for infrequently accessed objects. One Zone-IA is eliminated because it lacks multi-AZ durability for non-reproducible data, and Glacier lacks immediate access.