Exams Practice Exam Questions and Answers – Part 3/3

Answer: B. Ingest the sensor data in an Amazon Simple Queue Service (Amazon SQS) standard queue, which is polled by an AWS Lambda function in batches and the data is written into an auto-scaled Amazon DynamoDB table for downstream processing

Amazon SQS and AWS Lambda create a fully serverless, auto-scaling architecture for ingesting and processing sensor data. Options using Amazon EC2 require manual capacity planning, and Kinesis Data Firehose cannot write directly to Amazon DynamoDB.

Answer: D. Amazon API Gateway creates RESTful APIs that enable stateless client-server communication and Amazon API Gateway also creates WebSocket APIs that adhere to the WebSocket protocol, which enables stateful, full-duplex communication between client and server

Amazon API Gateway creates stateless RESTful APIs using standard HTTP methods and stateful WebSocket APIs for full-duplex communication. The distractors incorrectly assign stateful characteristics to REST APIs or stateless characteristics to WebSocket APIs, contradicting core protocol behaviors.

Answer: A. Use permissions boundary to control the maximum permissions employees can grant to the IAM principals

Permissions boundaries control the maximum permissions employees can grant to IAM principals, preventing excessive access. Removing all database access or relying on manual CTO reviews are impractical, and the root user should never perform daily administration.

Answer: B. Leverage multi-AZ configuration of Amazon RDS Custom for Oracle that allows the Database Administrator (DBA) to access and customize the database environment and the underlying operating system

Amazon RDS Custom for Oracle provides managed database high availability while permitting administrative access to the underlying operating system. Standard Amazon RDS restricts OS access, and deploying on EC2 instances violates the requirement to minimize maintenance.

Answer: D,E. Enable Multi Factor Authentication (MFA) for the AWS account root user account || Create a strong password for the AWS account root user

Securing the AWS account root user requires enabling multi-factor authentication and setting a strong password. Root access keys should never be created or shared, and sending credentials via email introduces severe security vulnerabilities, eliminating those distractors.

Answer: B. AWS Global Accelerator

AWS Global Accelerator improves non-HTTP UDP traffic performance and provides fast regional failover without requiring DNS changes. Route 53 is a DNS service, which contradicts the requirement to keep the custom DNS provider.

Answer: B. Use Amazon GuardDuty to monitor any malicious activity on data stored in Amazon S3. Use security assessments provided by Amazon Inspector to check for vulnerabilities on Amazon EC2 instances

Amazon GuardDuty continuously monitors accounts and S3 data for malicious activity using threat intelligence and machine learning. Amazon Inspector specifically assesses EC2 instances for unintended network accessibility and software vulnerabilities. The correct option pairs each service with its exact intended use case.

Answer: B. The Amazon EC2 instances should be deployed in a cluster placement group so that the underlying workload can benefit from low network latency and high network throughput

High Performance Computing workloads require tightly coupled node-to-node communication. A cluster placement group logically packs instances close together inside an Availability Zone to deliver the necessary low latency and high network throughput. Spread and partition groups prioritize isolation instead of network performance.

Answer: C. Push score updates to Amazon Kinesis Data Streams which uses an AWS Lambda function to process these updates and then store these processed updates in Amazon DynamoDB

Amazon Kinesis Data Streams seamlessly handles massive ingestion while maintaining strict record ordering. Using an AWS Lambda consumer abstracts polling complexities and pairs perfectly with Amazon DynamoDB for zero-administration processing. EC2-based alternatives violate the constraint to minimize operational overhead.

Answer: B,D. As the resources are unbalanced in the Availability Zones, Amazon EC2 Auto Scaling will compensate by rebalancing the Availability Zones. When rebalancing, Amazon EC2 Auto Scaling launches new instances before terminating the old ones, so that rebalancing does not compromise the performance or availability of your application || Amazon EC2 Auto Scaling creates a new scaling activity for terminating the unhealthy instance and then terminates it. Later, another scaling activity launches a new instance to replace the terminated instance

Amazon EC2 Auto Scaling compensates for unbalanced Availability Zones by launching new instances before terminating old ones to maintain availability. Conversely, when responding to an unhealthy instance, Auto Scaling creates a scaling activity to terminate it before launching a replacement.

Answer: C. Instruct the partner to create a Network Load Balancer (NLB) in front of the Amazon RDS for MySQL instance. Use AWS PrivateLink to expose the NLB as an interface VPC endpoint in the research company's VPC

AWS PrivateLink provides private connectivity between VPCs without requiring internet gateways, VPN connections, or Direct Connect. By placing a Network Load Balancer in front of the database, the partner can securely expose the RDS instance as an interface endpoint.

Answer: C. Configure AWS Web Application Firewall (AWS WAF) on the Application Load Balancer in a Amazon Virtual Private Cloud (Amazon VPC)

AWS Web Application Firewall provides geographic match conditions that allow or block web requests based on the viewer's geographic location. Security groups only filter IP addresses, and CloudFront geo restriction cannot attach directly to an Application Load Balancer inside a VPC.

Answer: C,E. Use an IAM policy to control access for clients who can mount your file system with the required permissions || Use VPC security groups to control the network traffic to and from your file system

Security groups restrict network access to the EFS mount targets. IAM policies evaluate identity-based authorization when mounting the file system. Network ACLs operate at the subnet boundary and lack the instance-level specificity required here.

Answer: C,D. When you apply a retention period to an object version explicitly, you specify a Retain Until Date for the object version || Different versions of a single object can have different retention modes and periods

S3 Object Lock applies retention settings to individual object versions. You can specify an explicit retain until date for specific versions, and explicit settings override bucket default configurations.

Answer: B. Use Amazon SQS FIFO (First-In-First-Out) queue in batch mode of 4 messages per operation to process the messages at the peak rate

Amazon SQS FIFO queues support up to 3000 messages per second via batching, maintaining strict ordering. A standard queue offers best-effort ordering rather than strict ordering, failing the processing requirement, while a basic FIFO queue maxes out at 300 messages per second.

Answer: D. The spreadsheet on the Amazon Elastic File System (Amazon EFS) can be accessed in other AWS regions by using an inter-region VPC peering connection

Amazon EFS supports access across AWS regions via inter-region VPC peering, maintaining a single collaborative file system. Moving the spreadsheet to object storage or relational databases introduces significant operational overhead and requires custom application logic to simulate collaboration.

Answer: C. Configure your Auto Scaling group by creating a scheduled action that kicks-off at the designated hour on the last day of the month. Set the desired capacity of instances to 10. This causes the scale-out to happen before peak traffic kicks in at the designated hour

Scheduled actions proactively adjust Auto Scaling group capacity for known recurring peaks by modifying the desired instance count. Target tracking policies react to metrics in real-time and cannot guarantee capacity ahead of designated schedule hours.

Answer: B. Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

Amazon S3 Standard-IA is intended for data accessed less frequently but requiring rapid access when needed, offering millisecond latency at a lower storage price. Since the workflow includes built-in retry logic, the slightly lower SLA of Standard-IA is completely acceptable for this use case.

Answer: C. Install an AWS Outposts rack in the company's data center. Use Amazon EKS Anywhere on Outposts to run containerized workloads locally while integrating with AWS APIs

AWS Outposts brings native AWS infrastructure and services directly into your on-premises data center. This allows you to run local compute and data while integrating with AWS APIs. However, option C is technically imprecise because EKS Anywhere is distinct from EKS on Outposts.

Answer: A. The junior scientist does not need to pay any transfer charges for the image upload

Amazon S3 Transfer Acceleration does not charge for uploads that are not accelerated. Data transferred into S3 from the internet is free, so you only pay standard or acceleration fees when the service functions correctly.