AWS Certified Solutions Architect – Associate

Correct answer: B. Enable detailed monitoring on all EC2 instances and use Amazon CloudWatch metrics for analysis.

Enabling detailed monitoring gives CloudWatch metrics at one-minute granularity for EC2, which is exactly what the requirement specifies, and RDS already publishes one-minute metrics natively. Remember the exam cue: basic monitoring is five-minute intervals, so one-minute granularity means detailed monitoring.

Correct answer: A. Process and store the images using AWS Snowball Edge devices.

AWS Snowball Edge devices provide local storage and compute, so images can be processed and stored without any network connection. Every other option still requires uploading data over the unreliable network, which defeats the purpose of an offline edge processing solution.

Correct answer: C. Create an Amazon EFS file system with mount targets in each Availability Zone. Configure the application instances to mount the file system.

Amazon EFS is a managed NFS file system that multiple EC2 instances across Availability Zones can mount simultaneously. EBS Multi-Attach only works within a single Availability Zone, and S3 gateway endpoints do not support NFS, so those distractors fail.

Correct answer: D. Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure read replicas in ap-southeast-2

An Aurora global database replicates from the UK primary to a read-only secondary in Australia with sub-second latency, giving Australian users fast local reads. Multi-AZ only protects within a single Region and does nothing for cross-Region query latency.

Correct answer: A. Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure the application tier in Europe to use the local reader endpoint.

Aurora global database gives the European application tier a local reader endpoint for low-latency queries. Note that an RDS read replica can't be created from a database running on EC2, so that distractor fails on a technicality worth remembering.

Correct answer: D. Configure a static website using Amazon S3 and create a Route 53 failover routing policy.

A static S3 website is nearly free to host, and Route 53 failover routing with health checks sends users to it only when the primary is unhealthy. Weighted routing splits traffic continuously, which does not match the automatic failover requirement.

Correct answer: A. Use Amazon CloudFront with a custom origin pointing to the on-premises servers.

CloudFront with a custom origin can cache and accelerate content served from on-premises servers, improving latency for European users without moving the backend. Lambda@Edge is for processing requests at the edge, not routing to an origin, so it doesn't apply here.

Correct answer: D. Launch EC2 instances into multiple regions behind an NLB and use AWS Global Accelerator

AWS Global Accelerator provides two static anycast IP addresses and routes users to the closest healthy regional endpoint over the AWS network. A Route 53 failover policy doesn't route by latency, and CloudFront cannot be assigned static IP addresses.

Correct answer: B. Use AWS Application Migration Service to replicate the VMs to AWS. Install the AWS Replication Agent on each VM. · C. Complete the initial data replication from the VMs to AWS. Launch test instances to perform acceptance tests for the workloads. · F. Stop all operations on the VMs. Perform a cutover by launching the migrated instances in AWS.

AWS Application Migration Service with the Replication Agent, followed by test instances for acceptance testing and then a cutover, is the standard lift-and-shift workflow. AWS SMS is deprecated, so any option using it is automatically wrong on the current exam.

Correct answer: D. Create an SCP with a deny rule that denies all but the specific instance types

An SCP with a deny rule using a StringNotEquals condition on the instance type applies centrally across all accounts in the OU with least effort. An allow-list SCP only works if FullAWSAccess is removed, and IAM policies must be managed in every account separately.

Correct answer: D. Deploy a Gateway Load Balancer (GWLB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the GWLB by using a Gateway Load Balancer endpoint in each service account.

Gateway Load Balancer with GWLB endpoints in each account is the purpose-built pattern for routing traffic through a centralized security appliance. NLB and ALB are not designed for transparent inline packet inspection across accounts.

Correct answer: C. Create an EC2 Auto Scaling group and Application Load Balancer that spans across multiple AZs. · E. Create new public and private subnets in a different AZ. Migrate the database to an Amazon RDS multi-AZ deployment.

Spreading an Auto Scaling group and ALB across multiple Availability Zones removes the single-AZ failure point for the web tier. Migrating the database to RDS Multi-AZ provides automatic failover; leaving the database on EC2 in one AZ keeps it a single point of failure.

Correct answer: B. Create a VPC peering connection between VPC-TEST1 and VPC-TEST2.

VPC peering provides private, direct connectivity between the two VPCs with no bandwidth bottleneck or single point of failure. Gateway endpoints only serve S3 and DynamoDB, and VPN or Direct Connect options add unnecessary complexity here.

Correct answer: B. Set a password policy for the entire AWS account.

The account-level IAM password policy is the built-in way to enforce complexity and length rules for all IAM users. Remember, IAM identity policies control permissions, not password rules, and AWS Config cannot enforce password settings at user creation.

Correct answer: D. Provide an Amazon Simple Queue Service (Amazon SQS) queue for the sender and processor applications. Set up a dead-letter queue to collect failed messages.

SQS with a dead-letter queue decouples the applications, retains failed messages for later handling, and keeps them from blocking the main queue. SNS is pub-sub with no retention, and running Redis on EC2 adds unneeded operational overhead.

Correct answer: B. Use a separate SQS Standard queue for each tier. Configure Amazon EC2 instances to prioritize polling for the paid queue over the free queue.

SQS has no native per-message priority, so AWS recommends separate queues per priority with consumers polling the paid queue first. FIFO preserves order but cannot reorder messages, and polling modes and batching have nothing to do with prioritization.

Correct answer: A. Modify the Auto Scaling group to use two instances across each of three Availability Zones.

Spreading the Auto Scaling group across multiple Availability Zones delivers high availability with no application changes. Exam cue: an ASG cannot span Regions, and CloudFront accelerates content delivery rather than providing application high availability.

Correct answer: B. Create a route table entry for the endpoint · C. Create a gateway endpoint for DynamoDB

DynamoDB supports gateway VPC endpoints, which add a route to the subnet route table so traffic never leaves the AWS network. Key distinction: gateway endpoints use routes, while interface endpoints use ENIs, and you cannot peer a VPC with a public AWS service.

Correct answer: D. Launch the containers on Amazon Elastic Kubernetes Service (EKS) and EKS worker nodes.

EKS runs standard Kubernetes, so the same open-source tooling and configurations work both on premises and on AWS, keeping the company cloud agnostic. ECS is AWS proprietary, so it fails the portability requirement even though it is fully managed.

Correct answer: C. Create a snapshot of the existing RDS DB instance. Create an encrypted copy of the snapshot. Create a new RDS DB instance from the encrypted snapshot and update the application. Use AWS DMS to synchronize data between the source and destination RDS DBs.

Snapshot, copy with encryption, restore to a new instance, then use AWS DMS to replicate changes made during the migration so nothing is lost. Remember you cannot encrypt an existing instance, its read replica, or its Multi-AZ standby retroactively.

Correct answer: B. Use the AWS Database Migration Service (DMS) to directly migrate the database to RDS

AWS DMS can migrate SQL Server directly to Amazon RDS for SQL Server with continuous replication and minimal downtime. The Schema Conversion Tool is only needed when changing database engines, and DataSync and SMS add unnecessary steps for a like-to-like migration.

Correct answer: B. Using us-east-1 bucket as the primary bucket and ap-southeast-1 bucket as the secondary bucket, create a CloudFront origin group. · C. Add an origin for ap-southeast-1 to CloudFront.

Origin failover requires adding the second bucket as a CloudFront origin and then grouping both origins with a primary and secondary. Route 53 failover routing doesn't help here because CloudFront is already the user-facing endpoint.

Correct answer: A. Use an AWS Storage Gateway file gateway hardware appliance on premises to replicate the data to Amazon S3.

A file gateway hardware appliance presents NFS storage on premises and replicates it to Amazon S3, fitting the small rack with no spare compute. Volume gateways are block-based iSCSI storage, so they don't satisfy the NFS requirement.

Correct answer: C. Configure the job as a containerized task and run it on AWS Fargate using Amazon ECS. Schedule the task using Amazon EventBridge Scheduler.

Fargate runs containers serverlessly with no interruption risk, and EventBridge Scheduler handles the Friday run with minimal operational overhead. Lambda caps at fifteen minutes of execution, so a two-hour stateful job rules that option out immediately.

Correct answer: C. Create an Amazon S3 bucket in the us-east-1 Region. Set up an Amazon CloudFront distribution with the S3 bucket as the origin. Use signed URLs to download the software updates.

CloudFront caches the updates at edge locations worldwide, cutting download latency with almost no operational overhead, and signed URLs keep access secure. Cross-region replication needs multiple buckets and ongoing management, so it fails the least overhead requirement.

Correct answer: B. Update the permission policy on the SQS queue to grant the sqs:SendMessage permission to the partner's AWS account.

SQS supports queue resource-based policies, so granting sqs:SendMessage to the partner's account on that one queue is exact least privilege. Cross-account roles or shared IAM users over-scope access beyond the single queue the partner needs.

Correct answer: C. Use AWS Control Tower to automate account provisioning. Create a dedicated networking account with a centralized VPC. Use AWS Resource Access Manager (AWS RAM) to share subnets with project accounts. Enforce security guardrails by using AWS Control Tower guardrails.

Control Tower automates account factory provisioning and enforces mandatory guardrails, while RAM shares the centralized networking account's subnets with no manual routing. Options relying on manual setup or per-account VPCs with transit gateways add overhead.

Correct answer: B. Download the AWS-provided root certificates. Use the certificates when connecting to the RDS DB instance.

RDS already has a CA-signed certificate installed, so clients only need to download the AWS root certificate bundle and use it when connecting. There is no console toggle or KMS key for in-transit encryption, and self-signed certs are not supported.

Correct answer: A. Configure AWS PrivateLink to create a private connection between the VPC and the third-party SaaS provider's APIs.

PrivateLink provides private connectivity from a VPC to supported SaaS endpoints without traversing the public internet. A NAT gateway still sends traffic over the internet, and Direct Connect or VPN are for on-premises links, not SaaS APIs on AWS.

Correct answer: D. Resize the read replica to a smaller instance size and keep the primary instance unchanged.

The read replica sits at only 25% CPU after the peak, so downsizing it saves cost while still handling the workload. The primary consistently runs at 60%, so shrinking or removing anything there risks performance; the key cue is matching instance size to steady-state utilization.

Correct answer: D. Use Amazon EC2 Auto Scaling to scale out the middle tier instances based on the SQS queue depth.

Scaling the middle tier based on SQS queue depth matches processing capacity to order backlog, directly attacking the delay. Exam cue: delays in queue-driven tiers mean scale on queue depth; CloudFront caching helps read traffic, not asynchronous order processing.

Correct answer: B. Create an Amazon CloudFront distribution and set the price class to use only U.S, Canada and Mexico.

CloudFront price classes let you restrict edge location usage to a region, here US, Canada, and Mexico, cutting cost while keeping low latency for those users. Using all edge locations works but costs more when users are geographically concentrated.

Correct answer: A. Amazon FSx

Amazon FSx for Windows File Server provides managed SMB storage built on Windows Server and supports DFSR, making it a direct replacement. Exam cue: anything mentioning Windows, SMB, Active Directory, or DFSR points to FSx for Windows, not EFS.

Correct answer: C. AWS DataSync over AWS Direct Connect.

AWS DataSync automates scheduled transfers from a NAS to S3, and Direct Connect provides a private, reliable, fast link. Snowcone requires shipping time, and Transfer Acceleration over the public internet is less reliable for daily 5 TB transfers.

Correct answer: C. Deploy all the EC2 instances in the same Availability Zone to eliminate cross-AZ data transfer charges.

Data transfer between EC2 instances in the same Availability Zone is free, so co-locating the instances eliminates cross-AZ charges. EFA speeds up HPC networking but does not remove data transfer costs between instances.

Correct answer: C. Amazon FSx

Amazon FSx for Windows File Server natively supports SMB and DFS namespaces and replication, making it the direct replacement for a Windows file server farm. EFS uses NFS, and EBS is block storage attached to a single instance.

Correct answer: A. In AWS Organizations, create a service control policy (SCP) to deny the creation of EC2 instances if the compliance-level tag is not specified. Attach the SCP to the appropriate OU. · B. In AWS Organizations, create a tag policy to enforce the use of the compliance-level tag with the required values. Attach the tag policy to the appropriate OU to ensure EC2 instances adhere to the tagging requirements.

An SCP denies instance creation without the compliance tag, and a tag policy in Organizations enforces the allowed tag values across accounts. Config and Lambda remediation only detect or fix issues after the fact rather than preventing them.

Correct answer: C. Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage.

Instance store delivers the highest I/O performance for scratch video processing, S3 provides 11 nines of durability for the 400 TB tier, and Glacier handles the 800 TB archive cheaply. EBS cannot match instance store throughput, so options using it for maximum performance fail.

Correct answer: C. Use AWS Global Accelerator to route traffic through the closest AWS edge location to customers. Configure endpoint groups for the shipment tracking API to distribute traffic globally and reduce response times.

Global Accelerator routes users over the AWS backbone through the nearest edge location, cutting latency for real-time API traffic without duplicating infrastructure. CloudFront fails here because a real-time tracking API is not cacheable, and Direct Connect is far too costly and impractical.

Correct answer: D. Create an IAM role with permission to access the database. Attach this IAM role to the EC2 instance.

An IAM role attached to the EC2 instance eliminates static credentials entirely, supplying temporary credentials instead of a plaintext file. Moving or encrypting the file only hides the credentials, and TLS protects data in transit but not the stored secret.

Correct answer: D. Configure Amazon RDS automated backups. Set the retention period to 35 days and enable point-in-time recovery for the past 10 days. Use AWS Backup to retain additional backups for 120 days.

RDS automated backups give point-in-time recovery within the retention window, while AWS Backup extends retention to 120 days with minimal overhead. The distractor using only AWS Backup fails because point-in-time restore requires native RDS automated backups.

Correct answer: C. Use AWS Glue to create individual ETL jobs for each client. Attach a security configuration that uses client-specific AWS KMS keys for server-side encryption (SSE-KMS) during processing and storage in S3.

AWS Glue security configurations let each client's ETL job use a dedicated KMS key, encrypting data during processing and in S3 with minimal management. A single shared pipeline can't cleanly apply client-specific encryption keys, so per-client jobs are the intended design.

Correct answer: D. Implement an Amazon ElastiCache for Redis cluster to cache catalog queries. Configure the application to use lazy loading to populate the cache.

ElastiCache for Redis with lazy loading caches the infrequently updated catalog and removes the CPU spikes on the RDS instance. Read replicas help read-heavy workloads but add cost and lag; caching is the standard exam answer when data is static and queried often.

Correct answer: E. Use two Amazon Simple Queue Service (Amazon SQS) queues: one for data ingestion and one for route analysis. Configure the EC2 instances to poll their respective queues and scale the Auto Scaling groups based on the ApproximateNumberOfMessages metric in each queue.

SQS queues buffer the data durably, decouple ingestion from analysis, and pair naturally with target tracking on queue depth to scale each Auto Scaling group independently. EventBridge is an event router, not the standard scaling signal for queue backlogs.

Correct answer: A. Configure an Amazon SNS topic to receive payment events from an AWS Lambda function. Set up multiple subscribers, such as Lambda functions, to process the events.

SNS is the native managed pub/sub fan-out service, so one payment event can notify many Lambda subscribers cheaply. EventBridge would also work, but for straightforward topic-based fan-out the exam expects SNS as the lowest-cost answer.

Correct answer: A. On-Demand Capacity Reservations

On-Demand Capacity Reservations guarantee compute capacity in a specific Availability Zone with no term commitment, ensuring the instances are available each night. The trap here is Savings Plans and Reserved Instances, which give billing discounts but reserve no actual capacity.

Correct answer: D. Use IAM Roles Anywhere to issue temporary credentials to the application. Set up a trust relationship with IAM Identity Center and configure the application to assume the role using these credentials.

IAM Roles Anywhere lets on-premises workloads obtain temporary credentials using X.509 certificates and works with IAM Identity Center, avoiding long-term keys. Parameter Store fails because it stores static IAM access keys, which violates the no-long-term-credentials requirement.

Correct answer: D. Create separate IAM roles with policies for Amazon S3 and DynamoDB access. Use Kubernetes service accounts with IAM Role for Service Accounts (IRSA) to assign the AmazonS3FullAccess policy to the reporting service Pods and the AmazonDynamoDBFullAccess policy to the management dashboard Pods.

IRSA lets each Kubernetes service account assume a dedicated IAM role, giving Pod-level least-privilege access to only S3 or DynamoDB. Attaching policies to the EC2 instance profile grants all Pods on the node both services, and Kubernetes RBAC cannot enforce AWS permissions.

Correct answer: D. Send the API requests to an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that read messages from the queue. Use auto scaling for ECS to adjust capacity based on queue length.

SQS decouples the API from processing, and ECS services that scale on queue length absorb unpredictable spikes cost-effectively while supporting large ML models in memory. Lambda options fail because loading 500 MB models and long batch runs strain its limits.

Correct answer: A. Create a Nitro-based Amazon EC2 instance with an Amazon EBS Provisioned IOPS SSD (io1) volume attached. Provision 64,000 IOPS for the volume.

A single io1 volume on a Nitro-based instance can deliver up to 64,000 IOPS, meeting the single-volume requirement. Instance store is ephemeral, which fails the persistent database requirement, so option C is eliminated immediately.

Correct answer: C. Amazon EBS General Purpose SSD (gp2)

A 250 GB gp2 volume provides a 750 IOPS baseline and can burst to 3,000 IOPS, covering the morning and afternoon spikes at low cost. HDD types like st1 and sc1 cannot deliver 3,000 IOPS, and provisioned IOPS volumes cost far more than needed.

Correct answer: C. Use AWS Batch to run video processing jobs. Use AWS Step Functions to manage the workflow. Store the processed files in Amazon S3.

AWS Batch runs batch jobs without managing servers, and Step Functions handles orchestration cleanly, so together they minimize operational overhead. The Fargate option fails because SQS is a queue, not an orchestration engine, and ECS still requires task-level management.

Correct answer: A. Configure AWS Compute Optimizer to provide cost optimization recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.

Compute Optimizer natively produces right-sizing recommendations for EC2 instances, Auto Scaling groups, and EBS volumes in one managed service. Athena queries against Cost and Usage Reports require building and maintaining manual analysis, which fails the minimal-intervention requirement.

Correct answer: B. Use Amazon S3 Intelligent-Tiering to automatically adjust storage costs based on the frequency of data access while maintaining high durability.

S3 Intelligent-Tiering automatically moves objects between access tiers based on usage, optimizing cost with no retrieval fees and full durability. Glacier Instant Retrieval fails because daily-accessed data would incur per-GB retrieval charges on every read.

Correct answer: B. Kinesis Data Firehose can be connected to the VPC using AWS PrivateLink. Install a 1 Gbps AWS Direct Connect connection between the on-premises network and AWS. To send data from on-premises to Kinesis Data Firehose, use the PrivateLink endpoint.

A 1 Gbps Direct Connect link gives dedicated, low-latency bandwidth that exceeds the 100 Mbps internet line, and the PrivateLink endpoint keeps traffic on the AWS network. Site-to-Site VPN would still be capped by the shared 100 Mbps internet connection, limiting throughput.

Correct answer: A. Generate a presigned URL and ask the vendor to download the log file before the URL expires.

A presigned URL grants time-limited, scoped access to a single S3 object without creating any credentials. The IAM-user distractor is weaker because it over-provisions standing access to the account for one file transfer.

Correct answer: B. Create an Aurora Replica and use the replica endpoint for reporting.

An Aurora Replica offloads reporting reads to a separate reader endpoint without touching the primary. Redshift is overkill for monthly reports, and scaling the instance class costs more than needed. Exam cue: intermittent read spikes point to a read replica.

Correct answer: A. Migrate the file share to Amazon FSx for Windows File Server

FSx for Windows File Server provides SMB shared storage with multi-AZ resilience, backups, and Active Directory integration. EBS can't be shared across instances, and EFS doesn't natively support Windows SMB, making FSx the clear choice.

Correct answer: B. Amazon FSx for Lustre for high-performance parallel storage · D. Amazon S3 for cold data storage

FSx for Lustre delivers high-performance parallel storage for HPC and integrates natively with S3 for cold data. S3 alone isn't a parallel file system, and FSx for Windows or EFS don't fit the HPC and cold-tier pattern.

Correct answer: D. Update the script to copy data to an AWS Storage Gateway for File Gateway virtual appliance instead of the on-premises file server.

A File Gateway presents an SMB file share locally, caches recent files for low latency, and backs everything to S3 for disaster recovery. EBS, EFS, and Glacier can't deliver low-latency local file access on premises.

Correct answer: A. Amazon RDS for MySQL · C. AWS Fargate

RDS for MySQL manages the relational database with no instance administration, and Fargate runs containerized web and app tiers serverlessly. Spot Instances still require managing EC2, and DynamoDB would force a schema rewrite.

Correct answer: C. Apply a bucket policy to restrict access to the S3 endpoint. · E. Create a VPC endpoint for Amazon S3.

A gateway VPC endpoint for S3 keeps traffic on the private AWS network, and a bucket policy with an aws:SourceVpce condition restricts access to that endpoint only. Remember you cannot peer a VPC with S3 because it is not inside a VPC.

Correct answer: A. Create and use a custom endpoint that targets the three high-capacity replicas.

An Aurora custom endpoint groups a chosen subset of replicas and load balances connections across only them, which matches targeting the three high-capacity instances. The reader endpoint spreads queries across all replicas, not just the ones you want.

Correct answer: D. Configure Amazon Security Lake to automatically collect, normalize, and store security data in Amazon S3 for analysis.

Amazon Security Lake is purpose-built to centralize security data across accounts and Regions with automatic collection and normalization into OCSF, requiring no custom code. Options involving Glue, Lambda, or DMS all demand significant development effort compared with the managed service.

Correct answer: C. Deploy the DR infrastructure in a second AWS Region, including an ALB and an Auto Scaling group with desired and maximum capacities set to zero. Convert the Aurora PostgreSQL DB cluster into an Aurora global database. Use Amazon Route 53 to configure active-passive failover.

Pre-provisioned infrastructure with the Auto Scaling group scaled to zero plus Aurora global database and Route 53 failover meets the 30-minute RTO at minimal cost. The backup-and-rebuild option fails the RTO because creating infrastructure after failure takes too long.

Correct answer: A. Use AWS Storage Gateway Volume Gateway in cached mode. Configure cached volumes as iSCSI targets to store the primary dataset in AWS and cache frequently accessed imaging data locally.

Volume Gateway in cached mode keeps the primary data in AWS while caching frequently accessed blocks locally over iSCSI, fitting the block-storage requirement with low local latency. S3 File Gateway is the tempting distractor, but it serves files over NFS or SMB rather than block-level access for imaging applications.

Correct answer: B. Use the Amazon VPC CNI plugin for Kubernetes. Configure the custom subnets in the VPC and associate the subnets with the EKS cluster to allow pods to use them.

The Amazon VPC CNI plugin assigns pods real IP addresses from the custom subnets you configure, so they communicate natively and securely inside the VPC. Transit Gateway and VPN options are distractors because everything already lives in a single VPC.

Correct answer: A. Implement a scheduled action that sets the desired capacity to 10 before business hours begin.

A scheduled action that raises desired capacity to 10 right before business hours guarantees instances are ready with no reactive lag. Setting min and max is the trap; those define the allowed range, while desired capacity controls how many actually run.

Correct answer: A. Apply an EBS snapshot retention rule in Recycle Bin to retain snapshots for 7 days before permanent deletion.

A Recycle Bin retention rule recovers snapshots deleted by mistake for a set window, like 7 days, with no code. Data Lifecycle Manager automates creation and retention but cannot protect against an accidental or malicious deletion event.

Correct answer: A. Move the documents and media files to an Amazon FSx for Windows File Server file system.

FSx for Windows File Server natively supports SMB and integrates with your existing Active Directory for authentication and permissions. EFS with POSIX permissions is the key distractor because it requires a completely different access model.

Correct answer: C. Process each part using a separate ECS task. Create an Amazon SQS queue

SQS is the canonical AWS service for decoupling application components, letting the slow second stage process independently from the backend. SNS is a distractor; it pushes notifications to subscribers rather than buffering work the way a queue does.

Correct answer: A. Modify the Auto Scaling group to use four instances across each of two Availability Zones

Spreading the existing Auto Scaling group across two Availability Zones provides high availability with no application changes. The subnets distractor fails because two subnets could still sit in the same AZ, and Auto Scaling groups cannot span Regions.

Correct answer: C. Configure an AWS Storage Gateway file gateway.

A Storage Gateway file gateway presents an SMB/NFS file interface backed by Amazon S3, replacing the on-premises NAS while cutting the data center footprint. Volume gateway is the key distractor because it serves block storage, not file shares.

Correct answer: C. Copy the data from all EBS volumes to Amazon EFS. Modify the application to save new documents to Amazon EFS

Moving the documents to Amazon EFS gives every instance a shared file system, so all users see every document. Sticky sessions are the classic distractor; they keep a user on one instance instead of fixing the fragmented storage.

Correct answer: D. Configure a DataSync task to transfer the files to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Deep Archive after 1 year with a retention period of 7 years.

S3 Standard-IA fits infrequent but immediate access in year one, and a lifecycle rule to S3 Glacier Deep Archive gives the cheapest 7-year retention. Glacier Instant Retrieval costs more than Standard-IA here, and batching files adds overhead.

Correct answer: D. Deploy the database on Amazon Aurora Serverless v2 to automatically scale the database capacity based on actual usage and handle fluctuations in workload.

Aurora Serverless v2 scales capacity automatically for variable, read-heavy relational workloads and charges only for what's used. DynamoDB isn't relational, and RDS with a read replica costs more and requires sizing for peaks.

Correct answer: D. Use Amazon ElastiCache to cache the database layer.

ElastiCache caches frequent reads in memory, relieving the RDS instance with minimal architectural change. RDS Proxy manages connections, not read performance, and swapping to Lambda or DynamoDB means major rework the scenario forbids.

Correct answer: A. Set a permissions boundary on the developer IAM role that denies attaching administrator access.

A permissions boundary caps the maximum permissions a developer can receive even if they attach the administrator policy. An SCP denying all IAM activity would block every identity-based action in the account rather than solving the escalation concern.

Correct answer: C. Configure AWS Transit Gateway between the accounts. Assign Direct Connect to the transit gateway and route network traffic to the on-premises servers.

Transit Gateway acts as a central hub so new accounts attach once and share the existing Direct Connect link to on-premises. Buying a separate Direct Connect connection per account is far more expensive and adds provisioning delay.

Correct answer: D. Configure the route table for the private subnet so that it routes the outbound traffic to an AWS Network Firewall firewall then configure domain list rule groups.

Routing private subnet traffic through AWS Network Firewall with a domain list rule group allows only the approved repository domains and blocks everything else. Security groups and NACLs operate on IP and port only, so they cannot filter by URL or domain name.

Correct answer: C. Create an Auto Scaling group using an Amazon Machine Image (AMI) of the application. Use a launch template that configures the Auto Scaling group to scale out and in based on CPU utilization. Attach an Application Load Balancer to the Auto Scaling group to distribute traffic.

An Auto Scaling group with CPU-based scaling and an ALB gives automatic, elastic capacity for a stateless app while paying only for what is used. The Lambda redesign would work but requires major reengineering that is not the most cost-effective path here.

Correct answer: D. Set up Amazon S3 to use Multi-Region Access Points in an active-active configuration with a single global endpoint. Configure S3 Cross-Region Replication.

S3 Multi-Region Access Points provide one global endpoint that routes over the AWS backbone to the nearest bucket and supports managed failover. Combined with Cross-Region Replication, the app avoids handling routing logic itself, unlike using regional endpoints directly.

Correct answer: A. Set an IAM permissions boundary on the developer IAM role that explicitly denies attaching the administrator policy

A permissions boundary caps the maximum permissions a role can ever receive, so developers can attach policies but can never exceed the boundary, blocking administrator access. Disabling IAM entirely with an SCP would stop developers from working as intended.

Correct answer: A. Create a read replica of the primary database and instruct the business analysts to direct queries to the replica.

An RDS read replica offloads read-only analyst queries while staying asynchronously current with the primary, so no application changes are needed. Redshift, Athena, and ElastiCache all require copying or loading data, which risks stale data or code changes.

Correct answer: B. In a cluster placement group

A cluster placement group packs instances tightly in a single Availability Zone, delivering the lowest latency and highest throughput for HPC inter-node traffic. Spread and partition groups exist for fault isolation, not performance.

Correct answer: B. Enable an RDS Proxy instance on your RDS Database.

RDS Proxy pools and shares database connections, eliminating the connection exhaustion that causes timeouts when many Lambda functions spike, with almost no code changes. Resizing the instance or switching engines involves downtime or major rework.

Correct answer: D. Create an IAM role that has read/write permissions to the bucket and update the task definition to specify the role as the taskRoleArn.

ECS task roles, set as taskRoleArn in the task definition, give containers temporary credentials to call S3 without managing keys. Container instances cannot join IAM groups, and access keys are an anti-pattern the exam expects you to reject.

Correct answer: A. Transition to ONEZONE_IA after 30 days. After 90 days expire the objects

ONEZONE_IA is the cheapest valid target for infrequently accessed data, and expiration deletes objects when they are no longer needed. Reduced Redundancy is not a valid lifecycle transition target, and moving to Glacier or STANDARD_IA adds unnecessary cost.

Correct answer: D. Amazon EC2 instance store

Instance stores deliver the lowest latency block storage, and data loss is acceptable here because the database replicates across instances. EBS is block storage but cannot match physically attached NVMe drives for millions of transactions per second.

Correct answer: B. Configure DX connections at multiple DX locations.

Using Direct Connect connections at separate physical locations eliminates a single point of failure and delivers the highest resiliency. Multiple VIFs on one connection share the same underlying link, so they add no resilience.

Correct answer: D. Use client-side encryption with a master key stored in AWS KMS.

Client-side encryption with a KMS master key encrypts data before it leaves the customer environment, satisfying the requirement. Server-side options encrypt after upload, and S3-managed keys cannot be used for client-side encryption.

Correct answer: A. Move the website to an Amazon S3 bucket. Configure an Amazon CloudFront distribution for the S3 bucket.

S3 static website hosting with CloudFront is the cheapest, simplest pattern for static content at scale. ElastiCache cannot front an S3 bucket, and Amplify with EC2 caching or an ALB adds cost and complexity.

Correct answer: D. Configure encryption for the Amazon EBS volumes and Amazon RDS database with AWS KMS keys.

Encrypting both EBS volumes and the RDS storage with KMS keys protects the data at rest everywhere it lands. ACM and SSL/TLS only protect data in transit, and Data Lifecycle Manager manages snapshots rather than encryption.

Correct answer: C. Configure AWS Global Accelerator and configure the ALBs as targets

Global Accelerator routes users to the closest region over the AWS global network using static anycast IPs, with automatic health-check failover when you add the ALBs as endpoints. Route 53 latency routing also works but doesn't send traffic over the AWS backbone, which is the key requirement here.

Correct answer: A. Use Amazon Aurora Serverless v2 to store the data. Enable serverless auto-scaling and configure automated backups to Amazon S3 with a 7-day retention period.

Aurora Serverless v2 supports relational structured data with transactions and scales automatically to match unpredictable demand, with managed automated backups. DynamoDB on-demand handles spikes well but doesn't meet the transactional, relational requirement stated in the scenario.

Correct answer: D. Create a Route 53 alias record for an Amazon CloudFront distribution and specify the ALB as the origin. Create custom error pages for the distribution

CloudFront custom error pages automatically serve a static error file when the ALB origin fails, with no manual intervention. Route 53 failover to S3 also works, but it requires manual failback, so it doesn't meet the least operational overhead requirement.

Correct answer: D. Deploy Amazon FSx for Windows File Server in Multi-AZ mode. Configure a Windows Server failover cluster across two Amazon EC2 instances in different Availability Zones, using FSx for Windows File Server as the shared storage.

FSx for Windows File Server Multi-AZ provides fully managed, highly available shared storage that supports Windows failover clustering across Availability Zones. EFS and Storage Gateway options don't provide the Windows-compatible shared storage this clustering setup needs.

Correct answer: A. Order 10 AWS Snowball appliances and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier.

Snowball moves 750 TB offline without touching the poor internet connection, and a lifecycle policy then transitions objects into Glacier cheaply. Remember that Snowball can only target an S3 bucket, never a Glacier vault directly.

Correct answer: D. Create a new S3 bucket that uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Athena to query the data.

A new bucket with SSE-KMS multi-Region keys, cross-region replication, and Athena queries gives encryption, regional durability, and serverless SQL with the least overhead. Athena wins over Redshift Spectrum here because no cluster management is required.

Correct answer: A. Create an Amazon Machine Image (AMI) of the EC2 instance that runs the tasks. Create an Auto Scaling group with the AMI to run multiple copies of the instance.

Creating an AMI and an Auto Scaling group requires no code changes for the mixed-language tasks, giving the least operational overhead. AWS Batch would also work, but Lambda fails because its 15-minute limit is shorter than the one-hour tasks.

Correct answer: C. Use Amazon ECS Service Auto Scaling with target tracking policies to scale when an Amazon CloudWatch alarm is breached.

ECS Service Auto Scaling with target tracking automatically adjusts task count to hold a metric target, handling the launch spike and scaling in to cut costs. EC2 Auto Scaling is wrong here because Fargate has no instances for you to scale.

Correct answer: C. Put the JSON documents in an Amazon S3 bucket. As documents arrive in the S3 bucket, create an AWS Lambda function that runs Python code to process them. Use Amazon Aurora DB clusters to store the results.

S3 event notifications triggering a Python Lambda function, with Aurora storing results, scale automatically and eliminate server management. The SQS-plus-ECS option is the main distractor because queues are for decoupling, not durable document storage.

Correct answer: D. Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale vertically. · F. Create an Auto Scaling group and an Application Load Balancer to scale horizontally.

Compute Optimizer recommends a better instance type for vertical scaling, while an Auto Scaling group with an Application Load Balancer scales horizontally for availability. Auto Scaling and load balancers don't provide vertical scaling, so those distractors fail.

Correct answer: C. On the table, enable Amazon DynamoDB Streams. Subscriptions can be made to a single Amazon Simple Notification Service (Amazon SNS) topic using triggers.

DynamoDB Streams captures item-level changes natively, and a trigger can fan out notifications to a single SNS topic that all four teams subscribe to, with no impact on table performance. Cron-based scanning or multiple topics adds far more operational overhead.

Correct answer: D. Create an Amazon FSx for Lustre file system. Connect the file system to the origin server. Ensure that the file system is connected to the application server.

Amazon FSx for Lustre is the fully managed service that natively supports Lustre clients for shared high-performance storage. EFS only supports NFS, and Storage Gateway or DataSync do not expose a managed Lustre file system.

Correct answer: D. Use Amazon Kinesis Data Streams to ingest the data streams and process the data with AWS Lambda. Store the data in Amazon OpenSearch Service for search and analysis. Use Amazon Managed Grafana to create visual dashboards.

Kinesis Data Streams with Lambda provides near real-time ingestion, OpenSearch delivers search and analytics, and Managed Grafana handles dashboards. MSK with Redshift fails because Redshift is built for batch analytics rather than near real-time search.

Correct answer: E. Use Amazon Elastic File System (Amazon EFS) and configure it in General Purpose performance mode. Mount the EFS file system on all EC2 instances.

Amazon EFS gives concurrent shared access to the same data across all instances in the Auto Scaling group with no application code changes. The self-managed NFS server option creates a single point of failure, failing the high availability requirement.

Correct answer: C. Use an Amazon Simple Queue Service (Amazon SQS) queue to store the incoming GPS data. Modify the application to poll the queue for new messages and process the data.

An SQS queue buffers the incoming GPS messages so the application can pull and process them at its own pace, preventing loss during spikes with minimal management. Kinesis Data Streams also works for streaming data but adds more operational overhead than a simple queue for this scale.

Correct answer: B. Amazon FSx for Lustre with Amazon S3.

FSx for Lustre provides the native POSIX file system interface Linux HPC jobs need, and it integrates directly with S3 for cost-effective long-term output storage. FSx for Windows File Server is the common distractor, but it targets Windows workloads and does not link to S3.

Correct answer: C. Use AWS Secrets Manager to store the database credentials. Configure Secrets Manager to rotate the credentials automatically every 30 days. Update the game server application to retrieve credentials from Secrets Manager.

Secrets Manager natively rotates Aurora credentials on a 30-day schedule with no custom code, directly minimizing operational overhead. Parameter Store would require writing your own Lambda rotation function, which adds the complexity the question asks you to avoid.

Correct answer: B. Collect survey responses via an Amazon API Gateway endpoint integrated with Amazon Kinesis Data Firehose. Configure Firehose to stream the data to an Amazon S3 bucket. Use S3 Event Notifications to invoke an AWS Lambda function that calls Amazon Comprehend for sentiment analysis and writes results to an Amazon DynamoDB table with TTL configured to delete records after 12 months.

API Gateway with Kinesis Data Firehose ingests thousands of daily responses and lands them in S3 with zero servers, while Lambda plus Comprehend handles sentiment and DynamoDB TTL manages retention. The Step Functions option works but adds orchestration overhead the scenario does not need.

Correct answer: C. Configure an Amazon EC2 Auto Scaling target tracking policy for the processing tier instances. Use the SQS ApproximateNumberOfMessages metric to dynamically scale the tier based on queue length.

Target tracking on the SQS queue depth scales the processing tier based on actual backlog, which reacts to unpredictable peaks without overprovisioning. Predictive scaling fails here because the traffic pattern is not forecastable from historical data.

Correct answer: A. Configure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0 and to allow outbound traffic on port 1433 to the database tier · D. Configure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier

The web tier needs inbound HTTPS from the internet and outbound SQL on 1433 toward the database tier, while the database security group only accepts inbound 1433 referenced by the web tier's security group. Referencing security groups instead of CIDRs is the exam cue for least-privilege tiered access.

Correct answer: D. Configure the RDS backup retention policy to 30 days for automated backups. Use a script to identify and delete manual backups that are older than 30 days.

Native RDS retention handles automated backups, and a script for manual snapshot cleanup is the least costly and simplest approach. Options using AWS Backup, Lambda, or CloudWatch Events add services and operational overhead that the scenario does not require.

Correct answer: E. Use AWS Identity Center (AWS IAM Identity Center) integrated with AD Connector to link the on-premises Active Directory. Configure permission sets in IAM Identity Center to assign account-level and resource-level permissions based on Active Directory groups.

IAM Identity Center with AD Connector reuses the existing on-premises directory and centralizes permission sets across all accounts, minimizing operational overhead. AWS Managed Microsoft AD is the strongest distractor but adds directory and trust management overhead.

Correct answer: E. Configure AWS Transit Gateway to connect the Direct Connect gateway to the VPCs in the new accounts. Route network traffic from the new accounts to the on-premises data center through the transit gateway.

Transit Gateway with a Direct Connect gateway scales hybrid connectivity across many accounts with minimal overhead. Per-account VPNs or peering are operationally heavy, and extra Direct Connect connections are costly, so Transit Gateway is the exam-standard hub answer.

Correct answer: D. Use DynamoDB global tables to replicate data automatically across multiple Regions. Deploy the tables in on-demand capacity mode to handle workload variability.

DynamoDB global tables provide automatic multi-Region replication for low latency and regional failover, and on-demand mode suits unpredictable traffic cost-effectively. Custom replication via Streams or manual approaches adds operational overhead and does not deliver active-active global access.

Correct answer: B. Configure an Amazon CloudFront distribution for the S3 bucket to accelerate download performance. Enable S3 Transfer Acceleration to enhance upload performance.

CloudFront caches downloads at edge locations while S3 Transfer Acceleration speeds uploads over optimized AWS backbone routes, both being simple managed toggles. Global Accelerator cannot front an S3 bucket directly, and multi-Region bucket replication adds heavy complexity.

Correct answer: C. Use AWS Snowball.

With only 12.5 Mbps of usable bandwidth, transferring 30 TB over the internet would take far longer than 20 days, so Snowball is the only feasible option. Exam cue: whenever bandwidth math makes a deadline impossible, pick the Snow Family device.

Correct answer: D. Use Amazon Route 53 latency routing policy to direct students to the Region with the lowest network latency. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Region.

Route 53 latency routing sends each student to the Region with the lowest network latency, and an internet-facing Application Load Balancer distributes traffic across instances in that Region. Geolocation routing uses geography, which may not match actual network latency, so it is the strongest distractor but wrong here.

Correct answer: A. Use Amazon FSx for NetApp ONTAP to consolidate storage and enable multi-protocol access for both SMB and NFS.

Amazon FSx for NetApp ONTAP natively supports both SMB and NFS with multi-protocol access to the same data and multi-AZ redundancy. Splitting into FSx for Windows File Server and FSx for OpenZFS separates the protocols and adds complexity, failing the consolidation requirement.

Correct answer: B. Use Amazon Elastic File System (Amazon EFS) to provide an NFS-compatible shared file system that integrates with AWS services.

Amazon EFS is a fully managed, highly available NFS file system that scales automatically and requires no application changes. FSx for Windows File Server only speaks SMB, and File Gateway is mainly for hybrid on-premises access, not a native cloud NFS solution.

Correct answer: C. Deploy a NAT gateway in the public subnet. Modify the route table in the private subnet to direct all internet traffic to the NAT gateway.

A NAT gateway in the public subnet lets private instances reach the internet without inbound access and is fully managed, meeting both security and low overhead. Private subnets cannot route directly to an internet gateway because the instances lack public IP addresses.

Correct answer: D. Create an Amazon EFS file system. Configure a mount target in each Availability Zone. Attach each instance to the appropriate mount target.

Amazon EFS provides an NFS file system that many EC2 instances across multiple subnets and Availability Zones can mount simultaneously. S3 does not support NFS, and EBS volumes can only attach to one instance at a time.

Correct answer: B. Decouple the application components with an Amazon SQS queue. Configure a dead-letter queue to collect the requests that failed to process.

SQS with a dead-letter queue decouples the components, retains messages for up to 14 days, and captures failed requests for later handling. SNS is the strongest distractor, but it only pushes notifications and does not store or retain failed messages.

Correct answer: C. Amazon FSx for Lustre

Amazon FSx for Lustre is a high-performance file system that natively integrates with S3, letting you access S3 objects as files. EFS and EBS cannot present S3 objects as files, so they fail the integration requirement outright.

Correct answer: D. Amazon ElastiCache for Redis

ElastiCache for Redis is in-memory and supports replication and high availability. Memcached is the key distractor; it is also in-memory but offers no replication, persistence, or multi-AZ capability.

Correct answer: D. Enable the Requester Pays feature on the content provider's S3 bucket.

Requester Pays shifts the data transfer and request costs from the bucket owner to the downloading partner, directly minimizing the content provider's costs. Transfer Acceleration speeds transfers but the provider still pays, and Cross-Region Replication adds replication costs the provider incurs.

Correct answer: A. Recreate the database as an Aurora global database with the primary DB cluster in us-east-1 and a secondary DB cluster in us-west-2. Use an Amazon EventBridge rule that invokes an AWS Lambda function to promote the DB cluster in us-west-2 when failure is detected.

Aurora Global Database replicates across Regions with an RPO of about 1 second and promotion in under a minute, meeting both objectives. A cross-Region read replica can take longer than 10 minutes to promote for a 2 TB database, so it fails the RTO.

Correct answer: D. Set up AWS Global Accelerator and add endpoints

AWS Global Accelerator provides static anycast IP addresses and routes user traffic over the AWS global network to the best endpoint, cutting internet latency. The key cue is static public IPs; CloudFront cannot expose static IPs, and Route 53 routing still uses the public internet.

Correct answer: A. Deploy CloudFront with an S3 origin and configure an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the CloudFront distribution.

An origin access identity restricts the S3 bucket so content can only be served through CloudFront, and AWS WAF attaches directly to the distribution to inspect all traffic. Network ACLs do not apply to S3, and Route 53 cannot forward traffic to WAF.

Correct answer: A. Configure AWS DMS Serverless to create a replication task that scales its capacity automatically based on workload demand.

AWS DMS Serverless automatically scales replication capacity up and down with workload demand, minimizing operational overhead. For the exam, match variable load plus low overhead to serverless; provisioned Multi-AZ improves availability but does not scale capacity dynamically.

Correct answer: D. Add more Provisioned IOPS SSD (io1) EBS volumes. Use OS commands to create a Logical Volume Management (LVM) stripe.

Striping multiple io1 volumes with LVM aggregates IOPS beyond the 64,000 limit of a single volume, boosting storage throughput. Exam cue: when a single EBS volume hits its IOPS ceiling, add volumes and stripe at the OS level rather than resizing.

Correct answer: A. Configure a VPC peering connection between the two VPCs. Access the API using the private address · C. Configure a PrivateLink connection for the API into the client VPC. Access the API using the PrivateLink address

Both VPC peering and PrivateLink allow private cross-account connectivity to the internal NLB without traversing the internet. Direct Connect links on-premises networks to AWS, and ClassicLink is an obsolete EC2-Classic feature, so neither fits here.

Correct answer: C. Configure an Auto Scaling group to add or remove EC2 instances based on player traffic. · E. Add a Network Load Balancer in front of the EC2 instances to manage TCP traffic.

An Auto Scaling group handles demand-based scaling for cost efficiency, and a Network Load Balancer is the right fit for high-throughput TCP traffic across Availability Zones. Application Load Balancers target HTTP and HTTPS, and Route 53 routing provides no autoscaling.

Correct answer: A. Create an Amazon SQS FIFO queue to decouple the application. Configure an AWS Lambda function to process messages from the queue.

An SQS FIFO queue guarantees messages are processed in the exact order received while decoupling the producer from Lambda processing. Standard queues only offer best-effort ordering, and SNS delivers immediately rather than queuing ordered events.

Correct answer: A. Deploy AWS Systems Manager Agent (SSM Agent) to all instances. Assign an instance profile to the instances with the required Systems Manager policies. Grant contractors access to the AWS Management Console by configuring permission sets in AWS IAM Identity Center. Use Systems Manager Session Manager for secure instance access without requiring open network ports.

Session Manager provides audited, portless access to private instances, and IAM Identity Center centralizes console access for external contractors. The bastion host option fails because managing SSH keys and exposing ports increases the attack surface.

Correct answer: D. Create a web distribution on Amazon CloudFront pointing to an Amazon S3 origin. Create an ALIAS record in the Amazon Route 53 hosted zone that points to the CloudFront distribution, resolving to the application's URL domain name.

CloudFront caching at edge locations delivers low latency for global S3 downloads, with a Route 53 alias record pointing to the distribution. A CNAME would also work but alias records are free and preferred for AWS resources in Route 53.

Correct answer: E. Configure an S3 gateway endpoint. Update the route table of the private subnet to direct S3 traffic through the endpoint.

An S3 gateway endpoint routes traffic privately to S3 through the AWS network and is free of charge, making it the most cost-effective compliant option. The interface endpoint also works but incurs hourly and per-GB charges, so it is not the cheapest.

Correct answer: C. Transition the objects to the appropriate storage class by using an S3 Lifecycle configuration.

An S3 Lifecycle configuration automatically transitions objects to cheaper storage classes with almost no operational overhead. Trusted Advisor can only recommend cost optimizations, not move objects, and forcing everything into Glacier ignores mixed access patterns.

Correct answer: D. Create an Amazon SQS queue to store incoming requests. Configure the microservices to retrieve the requests from the queue for processing.

Decoupling with an SQS queue buffers incoming requests so the non-scaling microservices process them at their own pace. Monitoring and alarms only detect the problem, and a load balancer still needs targets that can handle the load.

Correct answer: E. Convert the Aurora cluster to an Aurora global database. Configure cross-Region replication and managed failover.

Aurora global database replicates across Regions with typically under a second of lag and supports managed failover, meeting both RPO and RTO with minimal operational effort. The cross-Region read replica option fails because manual promotion adds downtime and configuration work.

Correct answer: C. Create a service control policy in the root organizational unit to deny access to the services or actions

A service control policy attached at the root organizational unit provides a single, scalable guardrail that denies the specified services or actions across all accounts. Cross-account roles require per-account management, so they fail the centralized-control requirement.

Correct answer: C. Use AWS CloudTrail to create a new trail. Configure the trail to log read and write data events on the S3 bucket that houses the reports. Log these events to a new bucket, and enable log file validation

CloudTrail data events capture object-level access to the S3 bucket, and log file validation detects any tampering with the log files. Management events only cover control-plane operations, so they miss GetObject and PutObject activity on the reports.

Correct answer: B. Configure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console.

CloudWatch Container Insights collects, aggregates, and summarizes metrics and logs for EKS, including CPU and memory by namespace, service, and pod. The plain CloudWatch agent lacks the curated container dashboards the requirement specifies.

Correct answer: B. Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple Availability Zones.

A Network Load Balancer with an Auto Scaling group spanning multiple Availability Zones gives resilient, self-healing bastion access within one region. Auto Scaling groups cannot span regions, and a cluster placement group concentrates instances in a single AZ.

Correct answer: C. Use Amazon FSx for Windows File Server for the Windows instances and the Linux instances.

Amazon FSx for Windows File Server provides one SMB share that both Windows and Linux instances can mount simultaneously. EFS does not support native Windows mounts, and split file systems break the shared-file requirement.

Correct answer: E. Use Amazon S3 File Gateway to provide low-latency storage for the on-premises application. The File Gateway will cache frequently accessed data locally.

Amazon S3 File Gateway provides low-latency access by caching frequently accessed data on premises while keeping the primary data in S3, which is cost effective. DataSync is a batch transfer tool, not a continuous low-latency access solution, so it fails the performance requirement.

Correct answer: D. Create a gateway VPC endpoint for the S3 bucket. Update the VPC's route table to route all S3 traffic through the gateway endpoint.

A gateway VPC endpoint for S3 routes traffic privately through the AWS network, and the route table update sends all S3 traffic through it at no extra cost. A NAT gateway still sends traffic over the public internet, so it fails the privacy requirement.

Correct answer: D. Deploy an AWS DataSync agent for the on-premises environment. Configure a task to replicate the data and connect it to a VPC endpoint.

DataSync is fully managed and automates accelerated replication to AWS, and using a VPC endpoint keeps the traffic private over the Direct Connect connection. The public endpoint option sends data over the internet, violating the privacy requirement.

Correct answer: A. Create an Amazon Machine Image (AMI) for each application. Launch two EC2 instances for each application in different Availability Zones. Use an Application Load Balancer to distribute traffic evenly between the instances.

Creating an AMI and launching instances in two Availability Zones behind an Application Load Balancer delivers high availability with minimal architectural change for unmodified applications. Refactoring to microservices violates the requirement that the proprietary software cannot be changed.

Correct answer: C. Create a VPC with two private subnets. Deploy the RDS database in the private subnets. Establish connectivity between the on-premises office and AWS using AWS Site-to-Site VPN with a customer gateway.

Placing RDS in private subnets and connecting the office through a Site-to-Site VPN keeps the database off the internet while allowing direct, encrypted access. Options with public subnets expose the database, and security group rules alone do not provide private connectivity.

Correct answer: A. Deploy a Network Load Balancer in front of the EC2 instances in each Region. Use AWS Global Accelerator to route traffic to the most optimal Regional endpoint.

A Network Load Balancer in each Region handles UDP traffic with low latency, and Global Accelerator steers users to the best Regional endpoint over the AWS backbone. CloudFront only serves HTTP and HTTPS, so it cannot be used for UDP traffic.

Correct answer: C. Configure a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider associated with the EKS cluster. · D. Define an IAM role that includes the required permissions. Annotate the Kubernetes service accounts with the Amazon Resource Name (ARN) of the IAM role.

IRSA requires an OIDC provider trust relationship so IAM trusts the cluster's service account tokens, plus an IAM role annotated on the service account for permissions. Attaching policies to the worker node role grants every pod those permissions, breaking least privilege.

Correct answer: C. Use an AWS Storage Gateway file gateway to provide a locally accessible file system that replicates data to the cloud, then analyze the data in the AWS Cloud.

A Storage Gateway file gateway exposes an NFS mount on premises and replicates files to Amazon S3, where EC2 instances can analyze them. Tape and volume gateways do not provide an NFS file system, so they fail the core requirement.

Correct answer: B. Amazon S3

Because the logs are written via API calls, S3 fits naturally, offering indefinite retention, concurrent access, and the lowest cost. EFS also allows concurrent access but costs significantly more, making it the key distractor here.

Correct answer: A. Add a deny rule in the inbound table of the network ACL with a lower rule number than other rules

Only network ACLs support deny rules, and rules are evaluated from the lowest number up, so an inbound deny with a low rule number blocks the CIDR first. Remember security groups are allow-only, which eliminates both security group options.

Correct answer: D. Enable an Amazon Route 53 health check.

Route 53 health checks paired with a failover routing policy automatically switch DNS to the secondary ALB when the primary fails. The ALB health check option is the trap; it only checks targets behind the load balancer, not regional availability.

Correct answer: B. Create an Amazon SQS queue and custom CloudWatch metric to measure the number of messages in the queue. Configure the ASG to scale based on the number of messages in the queue

SQS decouples the layers, and scaling the ASG on queue depth via a CloudWatch metric tracks actual upload volume. CPU-based target tracking is the tempting distractor, but it reacts to load rather than the number of pending images.

Correct answer: A. Add additional VPNs to the Production VPC from a second customer gateway device.

The lone on-premises customer gateway device is the single point of failure, so adding a second customer gateway removes it. A second virtual private gateway is the classic distractor because the AWS side is already redundant by design.

Correct answer: A. AWS Lake Formation

AWS Lake Formation builds a centralized data lake and can ingest data directly from RDS MySQL databases, which fits the machine learning repository requirement. On the exam, remember Lake Formation is the glue for building secure data lakes; S3 alone is just storage and does not pull from databases.

Correct answer: A. An Amazon API Gateway REST API invokes an AWS Lambda function. The Lambda function reads data from the DynamoDB table. · B. An Amazon API Gateway REST API directly accesses the sales performance data in the DynamoDB table.

Both API Gateway patterns are fully managed: Lambda proxy integration reads DynamoDB, or API Gateway can proxy DynamoDB queries directly. EC2-based designs fail the minimal-maintenance requirement, and an ELB cannot target a DynamoDB table.

Correct answer: A. Encrypt the documents by using client-side encryption with customer managed keys and upload the encrypted files to S3.

Client-side encryption encrypts data before it leaves the agency's environment, satisfying the requirement to encrypt before storing in S3. SSE-KMS is secure but encrypts at the service side after upload, so it fails the explicit wording of the requirement.

Correct answer: D. Set up an ECS cluster behind an Application Load Balancer on AWS Fargate. Use Amazon Quantum Ledger Database (QLDB) to manage the storage layer.

QLDB provides an immutable, append-only journal with ACID transactions, matching the storage requirements, while ECS on Fargate offers containerized compute with minimal overhead. S3 lacks ACID properties, and ECS on EC2 adds instance management burden.

Correct answer: C. Enable S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the objects to reduce the cost of KMS requests.

Enabling an S3 Bucket Key with SSE-KMS cuts AWS KMS request costs by using a bucket-level key that wraps per-object keys. SSE-S3 would be cheaper but drops KMS entirely, violating the company's strict encryption requirements.

Correct answer: D. Enable an Amazon Route 53 health check

A Route 53 health check with a failover routing policy automatically detects primary failure and directs traffic to the secondary ALB. ALB health checks only probe registered targets, so they cannot trigger cross-region DNS failover.

Correct answer: D. Configure an API Gateway resource policy that denies access to any IP address that is not explicitly allowed.

An API Gateway resource policy with an IP-based deny condition restricts the REST API to the trusted office addresses. API Gateway is serverless with no security groups or subnets, so those distractors are architecturally impossible.

Correct answer: C. Implement the AWSEC2-PatchLoadBalancerInstance Systems Manager Automation document to manage the patching process for EC2 instances behind the ALB. · E. Use the Systems Manager Maintenance Windows feature to schedule patching and automatically deregister instances from the ALB during updates.

The AWSEC2-PatchLoadBalancerInstance Automation runbook deregisters instances, patches them, and re-registers them, while Maintenance Windows schedules the work safely. Relying on ALB health checks causes the traffic errors the company already experienced.

Correct answer: D. Use AWS Batch to orchestrate video editing jobs on Spot Instances. Store metadata in Amazon ElastiCache for Redis and processed video files in Amazon S3 Intelligent-Tiering.

AWS Batch with Spot Instances handles bursty, long-running batch jobs cheaply, and S3 Intelligent-Tiering keeps the processed videos accessible while optimizing costs over 90 days. Glacier Flexible Retrieval is for archives with retrieval delays, making that option fail the accessibility requirement.

Correct answer: B. Create a Network Load Balancer (NLB) · C. Use AWS PrivateLink to expose the application as an endpoint service

AWS PrivateLink exposes the application as an endpoint service backed by an NLB, giving consumers private access to only that application. VPC peering would open the entire VPC route space, requiring ongoing security group maintenance and greater administrative effort.

Correct answer: B. Set up an Application Load Balancer for cloud ECS services. · E. Set up an ECS cluster that uses the AWS Fargate launch type for the cloud application containers. Use an Amazon ECS Anywhere external launch type for the on-premises application containers.

Fargate handles the cloud containers, ECS Anywhere with the external launch type covers on-premises, and an ALB routes the HTTP traffic. The Network Load Balancer distractor fails because it is built for TCP and UDP, not HTTP.

Correct answer: A. Use Amazon FSx to create an SMB file share. Connect remote clients to the file share over a client VPN.

Amazon FSx for Windows File Server provides a fully managed SMB file share, and Client VPN gives remote workers secure access. Storage Gateway volume gateway uses iSCSI block storage, which is poorly suited for remote users, and DataSync only migrates data rather than replacing the service.

Correct answer: D. Setup a Virtual Private Gateway (VPG)

A virtual private gateway enables a site-to-site VPN that runs an IPsec tunnel over the Direct Connect link, encrypting the traffic. Direct Connect itself has no native encryption toggle, and BGP handles routing only, not security.

Correct answer: A. Use CloudFormation with scripts

AWS CloudFormation with scripts automates account creation, OU placement, and VPC and subnet provisioning repeatably. The Organizations API alone cannot create VPCs and subnets, and the CLI and console are not true automation approaches.

Correct answer: E. Use AWS IAM Identity Center integrated with the startup's existing Active Directory. Create permission sets with fine-grained permissions for RDS and S3. Assign team members to appropriate groups in Active Directory, which map to Identity Center permission sets.

IAM Identity Center with Active Directory integration gives centralized access control and permission sets that enforce least privilege with minimal overhead. The Organizations option is the strongest distractor, but multi-account and cross-account roles add far more complexity than required here.

Correct answer: A. Create a gateway VPC endpoint and add an entry to the route table

A gateway VPC endpoint for DynamoDB keeps traffic on the AWS network via a route table entry, with no internet gateway or VPN needed. Remember, only S3 and DynamoDB use gateway endpoints; interface endpoints use ENIs and are for other PrivateLink services.

Correct answer: A. Create an IAM policy with permissions to DynamoDB and assign It to a task using the taskRoleArn parameter

IAM roles for tasks, set with taskRoleArn in the task definition, grant permissions to only that specific task. The task execution role only covers pulling images and logs, and instance-level roles or security groups would apply too broadly or grant no IAM permissions.

Correct answer: A. Set up an AWS DataSync agent on the on-premises servers and sync the data to Amazon S3.

AWS DataSync is purpose-built for scheduled, automated synchronization between on-premises NFS shares and S3 at low cost. AWS Transfer Family lacks scheduling, Glue is an ETL service, and Direct Connect is far too expensive for small data volumes.

Correct answer: B. Use AWS Batch to deploy a multi-node parallel job

AWS Batch multi-node parallel jobs run tightly coupled workloads across many EC2 instances with MPI support, all fully managed. CloudFormation with a placement group could work but leaves you managing the instances yourself, which fails the low-operational-overhead requirement.

Correct answer: C. Create an Amazon SQS FIFO queue

Only SQS FIFO queues guarantee message ordering, and with batching they handle up to 3,000 messages per second, covering the 1,000 per second here. A Standard queue offers best-effort ordering only, and SNS is a notification service, not a decoupling queue.

Correct answer: B. Launch a new EC2 instance from an Amazon Machine Image (AMI) in the second Region · D. Copy an Amazon Machine Image (AMI) of an EC2 instance and specify the second Region for the destination

Copying the AMI to the second Region and then launching a new instance from it is the standard cross-Region DR pattern. Distractors fail because EBS volumes cannot be copied directly to or from Amazon S3 the way they describe.

Correct answer: D. Hibernate the instance outside business hours. Start the instance again when required.

Hibernation preserves RAM contents by writing them to the EBS root volume, so state survives while saving costs. Stopping is the key distractor but it loses memory content because the OS shuts down cleanly.

Correct answer: B. AWS DataSync

AWS DataSync automates online transfers from SMB/NFS file servers to S3 and works well over Direct Connect. Snowball is the classic distractor but it is a physical device for offline transfer, not automated network migration.

Correct answer: D. Configure the database security group to allow traffic only from the application security group

Referencing the application security group in the database security group automatically tracks changing Auto Scaling instances. Network ACL options fail because they filter by subnet or port, not by specific instance identity.

Correct answer: C. Elastic Fabric Adapter (EFA)

The Elastic Fabric Adapter supports the low-latency Message Passing Interface needed by tightly coupled HPC workloads. ENA is the distractor to watch because it offers enhanced networking but lacks OS-bypass MPI support.

Correct answer: D. Amazon MQ

Amazon MQ supports industry-standard protocols like MQTT, so the existing broker-based application can migrate without code changes. SQS and SNS are AWS-proprietary APIs and would require rewriting the messaging code.

Correct answer: A. Configure an AWS WAF ACL with rate-based rules. Enable the WAF ACL on the Application Load Balancer.

A WAF rate-based rule automatically counts requests per source IP and blocks IPs exceeding the threshold, which directly mitigates volumetric DDoS traffic at the ALB. The other options rely on reactive detection and cannot reliably block attacks, since security groups do not support deny rules.

Correct answer: C. Create Amazon Route 53 records with a geolocation routing policy.

Route 53 geolocation routing serves users from specific regions based on where DNS queries originate, which satisfies the content distribution rights requirement. Geoproximity routes based on resource location with bias, not user geography, so it fails the requirement.

Correct answer: C. Create an AWS WAF web ACL that includes the same IP restrictions that exist in the EC2 security group. Associate this new web ACL with the CloudFront distribution. · E. Create an origin access identity (OAI) and associate it with the distribution. Change the permissions in the bucket policy so that only the OAI can read the objects.

A WAF web ACL with IP restrictions associated with CloudFront enforces the IP allowlist at the edge, and an origin access identity with a restrictive bucket policy locks down the S3 origin. Security groups cannot attach to CloudFront, and web ACLs are not associated with S3 buckets.

Correct answer: A. Configure an Application Load Balancer in front of an Auto Scaling group to deploy instances to multiple Availability Zones

An Application Load Balancer in front of a Multi-AZ Auto Scaling group provides both high availability and demand-based scaling for cost efficiency. A single Auto Scaling group cannot span multiple Regions, which rules out the other options.

Correct answer: B. Use the Schema Conversion Tool (SCT) to extract and load the data to an AWS Snowball Edge device. Use the AWS Database Migration Service (DMS) to migrate the data to Amazon DynamoDB

The Schema Conversion Tool extracts the data locally onto a Snowball Edge device, which is shipped to AWS and loaded to S3, then DMS migrates it into DynamoDB. Direct Connect takes weeks to provision, and the other Snowball option incorrectly assigns the extraction step to DMS.

Correct answer: A. Migrate the account using the AWS Organizations console

An AWS account can be moved directly between organizations using the Organizations console, CLI, or API, keeping its resources intact. Creating a new account and migrating or sharing resources is unnecessary work for a divested business unit.

Correct answer: D. Store the credentials in Systems Manager Parameter Store and update the function code and execution role

Systems Manager Parameter Store securely stores the database credentials outside the function code, and the execution role grants the function permission to retrieve them. KMS manages encryption keys, not credentials, and IAM database auth was ruled out because the scenario requires credentials.

Correct answer: C. S3 Intelligent-Tiering

S3 Intelligent-Tiering automatically moves objects between access tiers when access patterns are unknown, minimizing cost without retrieval fees or operational overhead. The IA and Glacier classes charge retrieval fees, which get expensive if the logs turn out to be accessed frequently.

Correct answer: A. Amazon DynamoDB · C. AWS Lambda

DynamoDB natively handles key-value data and scales to any request rate, while Lambda scales automatically between zero and thousands of requests per second. RDS is relational, and EC2 or Fargate would keep running and incur cost when traffic drops to zero.

Correct answer: A. Associate the Direct Connect gateway to a transit gateway

Associating the Direct Connect gateway with a transit gateway, whose attachments include all three VPCs, shares both connections with minimal management. Exam cue: many VPCs plus Direct Connect means transit gateway; the transit VIF attaches to the DX gateway, not directly to each VPC.

Correct answer: A. At the Edge Location, run your code with CloudFront Functions.

CloudFront Functions run directly on edge hosts in every location, giving the lowest latency and roughly one-sixth the cost of Lambda@Edge for lightweight request-time scripting. Lambda@Edge works but runs in regional edge caches, so it loses on both latency and price here.

Correct answer: C. Create an Amazon SQS queue to hold the jobs that needs to be processed. Create an Amazon EC2 Auto Scaling group for the compute application. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of items in the SQS queue

Amazon SQS durably stores jobs and lets Auto Scaling scale on queue depth, matching the loosely coupled requirement. SNS distractors fail because SNS is push-based pub/sub, not a durable job buffer for workers.

Correct answer: A. Enable detailed monitoring on all EC2 instances. Use Amazon CloudWatch metrics to perform the analysis.

Detailed monitoring provides EC2 metrics at 1-minute granularity in CloudWatch, which basic monitoring does not. Distractors using CloudTrail or Athena fail because they analyze logs, not 1-minute performance metrics.

Correct answer: A. Migrate both public IP addresses to the AWS Global Accelerator · C. Create an AWS Global Accelerator and attach endpoints in each AWS Region

AWS Global Accelerator lets you bring your own /24 IP ranges and use them as static anycast entry points while routing users to the closest healthy regional endpoint. Route 53 geolocation routing would force new IP addresses, which the company wants to avoid.

Correct answer: A. Create an Amazon SQS queue and configure the front-end to add messages to the queue and the back-end to poll the queue for messages

An SQS queue decouples the front-end and back-end ECS tasks, letting each process messages independently without direct dependencies. Remember SQS is pull-based only; the option claiming SQS pushes messages to the back-end is invalid, and Firehose is for streaming to destinations.

Correct answer: C. Enable DynamoDB Streams. Configure an AWS Lambda function to poll the stream and record the modified item data to an Amazon S3 bucket

DynamoDB Streams captures item-level changes in near real time, and a Lambda function can process them and archive the data to S3. CloudTrail only records API calls, not the actual modified item data, so it cannot satisfy the compliance requirement.

Correct answer: A. Use Amazon CloudFront to serve the application and deny access to blocked countries

CloudFront geo restriction natively blocks or allows users by country with a simple whitelist or blacklist configuration. Security groups and NACLs operate on IP addresses, not geography, so managing country-level blocks with them is impractical.

Correct answer: B. Create a read replica as a Multi-AZ DB instance

RDS allows creating a read replica as a Multi-AZ DB instance, giving a standby copy for failover and scaling reads cost-effectively in one deployment. A single replica in a different AZ improves placement but provides no automatic failover for the replica itself.

Correct answer: A. Use Amazon CloudFront with the S3 bucket as its origin

CloudFront caches the static content at edge locations worldwide, reducing latency for a globally distributed audience with S3 as the origin. Cross-Region replication alone provides no mechanism to direct users to the nearest copy of the files.

Correct answer: C. Enable versioning on the bucket · E. Enable MFA Delete on the bucket

Versioning preserves every version of the documents, and MFA Delete requires an additional authentication factor to permanently remove objects, preventing accidental deletion. Read-only permissions would block required uploads, and encryption does not protect against deletes.

Correct answer: A. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address

AWS WAF is the right layer to block a specific malicious IP because it inspects requests at the edge before they reach the ALB. Security groups cannot create deny rules, and NACLs only see the load balancer IPs, so they cannot block the original client.

Correct answer: A. Deploy Amazon MQ with active/standby brokers configured across two Availability Zones. Create an Auto Scaling group for the consumer EC2 instances across two Availability Zones. Use an Amazon RDS MySQL database with Multi-AZ enabled.

Amazon MQ active/standby across two AZs, an Auto Scaling group, and Multi-AZ RDS together deliver high availability with the least operational overhead using managed services. The distractors either skip Auto Scaling or hand-manage MySQL replication, adding complexity without improving availability.

Correct answer: A. Enable versioning on the S3 bucket. · E. Enable MFA Delete on the S3 bucket.

Versioning keeps deleted objects as versions so accidental deletions can be recovered, and MFA Delete requires extra authentication for permanent deletions while still allowing intentional ones. Encryption, bucket policies, and lifecycle policies address other concerns but do not guard against accidental deletion.

Correct answer: C. Store the data in S3 Standard-IA for 3 months, then transition to S3 Glacier

Standard-IA is the cheapest fit for infrequent access during the first three months, and Glacier's standard retrieval completes well within 10 minutes for the long retention period. S3 Standard and Intelligent-Tiering cost more for data with known, infrequent access patterns.

Correct answer: B. Pilot light

Pilot light keeps only a minimal core of critical services running and synced while everything else stays off until disaster strikes. Warm standby is the closest distractor, but it runs a scaled-down yet fully functional environment at all times, which costs more.

Correct answer: A. Use AWS Lambda to manipulate the original images to the requested customization. Store the original and manipulated images in Amazon S3. Configure an Amazon CloudFront distribution with the S3 bucket as the origin

The fully serverless option with Lambda, S3, and CloudFront costs nothing when idle while remaining highly available. Options using EC2 or an Elastic Load Balancer incur continuous charges even without traffic, so they are less cost-effective.

Correct answer: A. Amazon Redshift with Amazon Redshift Spectrum

Redshift is a petabyte-scale data warehouse that works with standard SQL BI tools, and Redshift Spectrum queries data in S3 without loading it. DynamoDB and ElastiCache are not analytics services, and RDS MariaDB is built for OLTP workloads.

Correct answer: A. Migrate data using AWS Snowball. Provision an AWS VPN initially and order a Direct Connect link

Snowball meets the one-month migration deadline for 50 TB, while a VPN provides immediate private connectivity and Direct Connect can be ordered for the long term. Direct Connect alone fails because its provisioning lead time often exceeds one month.

Correct answer: A. Add an Amazon CloudFront distribution in front of the ALB · C. Add Amazon Aurora Replicas

CloudFront caches content at edge locations and offloads sudden request spikes from the ALB, while Aurora Replicas offload read traffic from the writer instance. WAF blocks malicious traffic but does not absorb load spikes, and Global Accelerator addresses latency, not scaling.

Correct answer: A. AWS Private 5G

AWS Private 5G is the managed service that lets you build and scale your own private cellular network with AWS supplying the hardware and software. For the exam, remember Wavelength extends AWS services into 5G networks for low-latency apps, rather than building a private network.

Correct answer: C. Ingest the data into an Amazon Kinesis Data Stream. Process the data with an AWS Lambda function and then store the data in Amazon DynamoDB.

Kinesis Data Streams ingests high-volume streaming data and Lambda processes it, while DynamoDB delivers single-digit millisecond performance. Redshift is a data warehouse without millisecond responsiveness, and SQS queuing doesn't match continuous near-real-time stream ingestion.

Correct answer: D. Encrypt a snapshot from the master DB instance, create a new encrypted master DB instance, and then create an encrypted cross-region Read Replica

You cannot encrypt an RDS instance after creation or make an encrypted replica of an unencrypted master, so you must encrypt a snapshot, restore a new encrypted master, then replicate. Remember the exam rule: unencrypted sources cannot produce encrypted targets directly.

Correct answer: B. On-demand capacity reservations for the development environment · C. Use Reserved instances for the production environment

On-Demand Capacity Reservations guarantee capacity for the nine-to-five dev workload with no commitment, while Reserved Instances suit the 24/7 production fleet. A test-taker could argue Spot suits dev workloads, but the question requires guaranteed capacity, which Spot cannot provide.

Correct answer: C. Use S3 Access Points to administer different access policies to each team, and control access points using Service Control Policies within AWS Organizations.

S3 Access Points give each team its own policy on a shared bucket, and SCPs in AWS Organizations can restrict which access points are usable. Splitting data into buckets or creating per-user roles creates far more operational overhead than access points.

Correct answer: B. Use Amazon SageMaker to build the machine learning part of the application and use AWS Data Exchange to gain access to the third-party telemetry data.

SageMaker is the managed ML service, and AWS Data Exchange is the marketplace for licensed third-party datasets such as telemetry data. A TensorFlow AMI means self-managed EC2, and DataSync is for storage migration, not acquiring third-party data.

Correct answer: A. Run the NoSQL database on Amazon Keyspaces, and the compute layer on Amazon ECS on Fargate. Use Amazon RDS for Microsoft SQL Server to host the second storage layer.

Amazon Keyspaces is the managed Cassandra-compatible service, so it migrates the NoSQL database with no schema conversion, and ECS on Fargate plus RDS for SQL Server keeps everything managed. DynamoDB would require converting the Cassandra schema, and Aurora cannot host SQL Server.

Correct answer: D. Use Amazon Kinesis Data Streams for real-time events with a partition for each equipment asset. Use Amazon Kinesis Data Firehose to save data to Amazon S3.

Kinesis Data Streams with a partition key per asset guarantees ordering per asset, and Firehose delivers the stream to S3 for durable storage. Exam cue: per-producer ordering means partition keys, and Firehose targets S3, not EBS, which is block storage tied to one instance.

Correct answer: D. Implement an IPSec VPN connection and use the same BGP prefix

A Site-to-Site VPN advertising the same BGP prefix as Direct Connect gives a low-cost failover where DX is preferred by BGP. A second Direct Connect connection is the strongest distractor but is costly and slow to provision.

Correct answer: B. Store the images in Amazon S3, behind a CloudFront distribution. Use S3 Object Lambda to transform and process the images whenever a GET request is initiated on an object.

S3 Object Lambda runs code on GET requests to transform objects in place, which fits dynamic image processing behind CloudFront. S3 Event Notifications is the main distractor because events fire on object actions, not on retrieval.

Correct answer: C. Amazon S3 Standard

S3 Standard is the best fit for short-lived data with unknown size and access patterns, with no retrieval fees or minimum object size charges. The IA classes carry per-GB retrieval fees and 128 KB minimum billing, and Glacier Deep Archive takes hours to retrieve.

Correct answer: A. AWS AppSync

AWS AppSync is the managed service purpose-built for serverless GraphQL APIs with a single endpoint across multiple data sources. API Gateway only supports REST and HTTP APIs, while Lambda and Athena do not provide GraphQL API management on their own.

Correct answer: A. Use AWS License Manager to manage the software licenses

AWS License Manager centrally tracks and enforces software license usage across AWS and on-premises environments, matching this hybrid need exactly. Secrets Manager and KMS protect credentials and encryption keys, not license entitlements, and S3 is not a license management tool.

Correct answer: C. Use an AWS Storage Gateway file gateway to replace the NFS storage. · E. Use an AWS Storage Gateway volume gateway to replace the block storage.

A Storage Gateway file gateway exposes NFS and a volume gateway exposes iSCSI block volumes, both with local caching, so applications need no changes. EFS uses NFS so it cannot replace block storage, and S3 buckets cannot be mounted with the standard NFS mount command.

Correct answer: A. Create an Amazon EC2 Auto Scaling group and Application Load Balancer (ALB) spanning multiple AZs · E. Create new public and private subnets in the same VPC, each in a new AZ. Migrate the database to an Amazon RDS multi-AZ deployment

An Auto Scaling group and ALB spanning multiple AZs protects the web tier, while new subnets in another AZ plus an RDS Multi-AZ deployment protects the database tier. Subnets within a single AZ add no high availability, and a database left on EC2 in one AZ stays a single point of failure.

Correct answer: C. Create an Amazon CloudWatch events rule that triggers an Amazon SNS topic

A CloudWatch Events rule (now EventBridge) captures GuardDuty findings and can target an SNS topic for email notification. There is no per-finding GuardDuty metric to alarm on, so the CloudWatch alarm option fails on the exam.

Correct answer: D. On-Demand Instances

The workload runs only 20 days per year, far too short to justify a one-year reservation, and Spot interruptions would break the uninterrupted five-hour processing requirement. Exam cue: interrupted workloads that run too briefly for reservations stay On-Demand, since Spot Blocks are deprecated.

Correct answer: B. Redis AUTH command

Redis AUTH tokens require a password before clients can run commands on the ElastiCache cluster, set via the auth token parameter. IAM and security groups operate at the AWS API and network layers and cannot enforce application-level password authentication for Redis.

Correct answer: A. Deploy a Landing Zone within AWS Control Tower. Allow department administrators to use the Landing Zone to create new member accounts and networking. Grant the department's AWS power user permissions on the created accounts.

AWS Control Tower provides a landing zone with an account factory that preconfigures new member accounts with guardrails and networking. The strongest distractor fails because landing zones are not deployed within AWS Organizations itself.

Correct answer: D. Create a VPC Security Group for the ELB and use AWS Lambda to automatically update the CloudFront internal service IP addresses when they change

A security group on the ELB restricted to CloudFront's published internal service IP ranges blocks direct access, with a Lambda function keeping the ranges current as AWS updates them. An OAI only works for S3 origins, not for ELB or EC2 origins.

Correct answer: A. Configure a Network Load Balancer in front of the EC2 instances · B. Configure an Auto Scaling group to add or remove instances in multiple Availability Zones automatically

A Network Load Balancer operates at Layer 4, matching the connection requirement, while an Auto Scaling group across multiple Availability Zones delivers high availability and cost efficiency. An Application Load Balancer works at Layer 7, so it does not fit the stated protocol.

Correct answer: D. Create an IAM role with least privilege permissions and attach it to the EC2 instance profile.

An IAM role attached to the EC2 instance profile delivers temporary, least-privilege credentials with no long-term keys stored on the instance. Exam cue: never store access keys on an EC2 instance, and always prefer roles with minimal permissions over IAM users or bucket ACLs.

Correct answer: E. Migrate the PostgreSQL database to Amazon RDS for PostgreSQL with a Multi-AZ DB instance deployment. Use Amazon ElastiCache for Redis with a replication group to manage session data and cache reads. Migrate the application server to an Auto Scaling group across three Availability Zones.

RDS Multi-AZ gives automated failover for the database, Redis replication provides durable session storage, and Auto Scaling across three AZs handles the traffic surge. The Aurora option fails because a single-AZ deployment sacrifices high availability, and Memcached lacks replication for session durability.

Correct answer: A. Create an AWS Transit Gateway and share it with each account using AWS Resource Access Manager

Transit Gateway provides hub-and-spoke connectivity with transitive routing across VPCs and accounts, and Resource Access Manager shares it easily. VPC peering fails because it is non-transitive, requiring a full mesh of connections.

Correct answer: A. Request a wildcard certificate that matches the custom domain name in AWS Certificate Manager (ACM) in the same Region. · B. Establish a custom domain name in API Gateway for the REST API. Import the corresponding certificate from AWS Certificate Manager (ACM). · C. Register the desired domain with a domain registrar. Set up a wildcard custom domain in a Route 53 hosted zone and create a record in the zone that points to the API Gateway endpoint.

A wildcard certificate in the same Region, a custom domain in API Gateway, and a wildcard record in Route 53 give each agent a secure unique URL with minimal management. Per-agent endpoints or hosted zones multiply operational overhead.

Correct answer: C. Create a new AWS Key Management Service (AWS KMS) key. Enable Amazon EKS KMS secrets encryption on the Amazon EKS cluster.

Enabling EKS secrets encryption with a KMS key encrypts Kubernetes Secrets at rest in etcd, directly meeting the requirement. Secrets Manager is the strongest distractor, but it does not encrypt data already stored in etcd ConfigMaps and Secrets.

Correct answer: C. Generate an API Gateway endpoint for the Lambda function. Provide the API Gateway endpoint to the third party for the webhook.

API Gateway provides a public HTTPS endpoint that a third party can call to invoke the Lambda function with minimal management effort. SNS and SQS cannot be invoked directly over the internet by an external webhook caller, so those options fail.

Correct answer: D. Use Amazon Aurora with MySQL compatibility. Direct the reporting functions to use one of the Aurora Replicas.

Aurora MySQL provides high availability across multiple AZs automatically, and directing reporting to an Aurora Replica offloads the primary with minimal management. Self-managed EC2 MySQL is the main distractor, but manual patching and backups create heavy operational overhead.

Correct answer: A. Configure a VPC peering connection between the us-west-2 VPC and the eu-central-1 VPC. Update the subnet route tables accordingly. Create an inbound rule in the eu-central-1 database security group that allows traffic from the us-west-2 application server IP addresses.

Inter-region VPC peering with updated route tables connects the two Regions, and the database security group must allow the application server IP addresses because security group IDs cannot be referenced across Regions. Any option referencing a security group ID from another Region is invalid.

Correct answer: C. Add the aws:PrincipalOrgID global condition key with a reference to the organization ID to the S3 bucket policy.

The aws:PrincipalOrgID condition key in the bucket policy restricts access to principals in accounts belonging to the organization and updates automatically as accounts join or leave. Tagging users or monitoring CloudTrail events requires ongoing manual policy maintenance.

Correct answer: A. Implement geographical restrictions on CloudFront content using a deny list and create a custom error message.

CloudFront geo restriction with a deny list blocks viewers in countries outside the released regions, and a custom error page handles blocked requests. Signed URLs and cookies control who can access content but do not factor in the user's geographic location, so they can't enforce a regional rollout.

Correct answer: A. Use Amazon Transcribe for multiple speaker recognition. Use Amazon Athena for transcript file analysis.

Amazon Transcribe supports multi-speaker recognition and generates transcript files, and Amazon Athena can query those files in S3 with standard SQL. Rekognition and Textract handle images and scanned documents, not audio, so they fail the core requirement.

Correct answer: C. Migrate the databases to Amazon Aurora Serverless (Aurora MySQL).

Aurora Serverless for MySQL is compatible with the existing databases and automatically scales compute with minimal operational effort. The PostgreSQL variant fails because changing database engines requires schema and code changes, while Auto Scaling EC2 still leaves manual database management.

Correct answer: B. Use AWS Config to track configuration changes and AWS CloudTrail to record API calls.

AWS Config tracks resource configuration changes, while CloudTrail records API call history, together meeting both requirements. The strongest distractor simply swaps the two services, so memorize the pairing: Config equals configuration, CloudTrail equals API calls.

Correct answer: B. Use the global key of AWS Organizations within a bucket policy using the aws:PrincipalOrgID key to allow access only to accounts which are part of the Organization.

The aws:PrincipalOrgID condition key in a bucket policy grants access to any principal in the organization without listing account IDs, and it updates automatically. Tag-based access control could work but requires maintaining accurate tags, which is far more effort.

Correct answer: B. Order 7 AWS Snowball appliances and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier

Snowball appliances move 500 TB offline without using the internet, then a lifecycle policy transitions objects into Glacier. Snowball can only target an S3 bucket, never a Glacier vault directly, and Global Accelerator does not optimize on-premises uploads.

Correct answer: A. Use AWS Config to track configuration changes and AWS CloudTrail to record API calls and track access patterns in the AWS Cloud.

AWS Config tracks configuration changes to resources, and CloudTrail logs API calls and login activity across the account. Macie finds sensitive data in S3, EventBridge routes events, and CloudWatch handles metrics, so none of them record API access history.

Correct answer: A. Use an API Gateway canary release deployment. Initially direct a small percentage of user traffic to the new API version. After API verification, promote the canary stage to the production stage.

API Gateway canary release deployments shift a small percentage of traffic to the new version for testing before promotion to production. Route 53 weighted DNS could work but is slower to propagate and far less integrated than the built-in canary feature.

Correct answer: A. Create a security group that allows inbound traffic from the security group that is assigned to instances in the private subnets. Attach the security group to the DB instances.

A security group rule referencing the application layer's security group ID restricts database access to only those instances. Security groups cannot contain deny rules, and removing routes would break VPC routing entirely.

Correct answer: A. Use AWS KMS encryption keys for the S3 bucket and use Amazon Athena to query the data

KMS keys encrypt the CSV data at rest, and Athena runs standard SQL queries directly against S3 with no infrastructure to manage. Redshift Spectrum needs a Redshift cluster, so it is not fully serverless.

Correct answer: B. Install an SMB client on to the on-premises servers and mount an Amazon FSx file system to the servers. Mount the same file system to the EC2 instances within the Amazon VPC. Use the existing Direct Connect connection to connect the on-premises data center to the Amazon VPC.

FSx for Windows File Server uses SMB, matching the Windows servers, and Direct Connect gives low-latency private access to the shared file system. EFS uses NFS, which is designed for Linux clients rather than Windows.

Correct answer: A. Create an Application Load Balancer. Put the web layer behind the load balancer and enable AWS WAF

AWS WAF attaches to an Application Load Balancer and can apply XSS match rules that block malicious scripts in web requests. WAF does not support Network or Classic Load Balancers, and Shield protects against DDoS, not XSS.

Correct answer: C. Use an encrypted Amazon EBS volume and use Data Lifecycle Manager to automate snapshots

EBS provides persistent encrypted block storage, and Data Lifecycle Manager automates scheduled EBS snapshots with no custom code. Instance store is ephemeral, and S3 and EFS are not block storage services.

Correct answer: D. Deploy AWS Directory Service and integrate it with the corporate directory service. Set up AWS Identity Center for authentication across accounts. · E. Create a new AWS Organizations entity with all features enabled. Create the new AWS accounts within the organization.

AWS Organizations with all features enabled structures the multi-account environment, while AWS Directory Service connects the corporate directory and Identity Center provides centralized single sign-on. Control Tower is the tempting distractor, but the question asks for directory integration plus account structure.

Correct answer: A. Configure a CloudWatch Logs subscription to stream the logs to Amazon OpenSearch Service (Amazon Elasticsearch Service).

A CloudWatch Logs subscription can stream logs directly to OpenSearch Service in near real time with the least configuration and no extra services. Kinesis Data Firehose works but adds another managed component, so it carries more operational overhead.

Correct answer: A. Establish an AWS Organization in the AWS account that purchased the RI and hosts the remaining active EC2 instances. Invite the other AWS accounts to join this organization from the management account. · B. Enable Reserved Instance sharing in the billing preferences section of the AWS Management Console for the account that purchased the existing RI.

Reserved Instance sharing requires the accounts to be in one AWS Organization, and sharing must be enabled in the billing preferences of the account that purchased the RI. AWS RAM is the classic distractor because RIs cannot be shared that way.

Correct answer: B. Create the MySQL user accounts to use the AWSAuthenticationPlugin with IAM

RDS MySQL supports IAM database authentication through the AWSAuthenticationPlugin, which generates short-lived authentication tokens instead of passwords. STS is the main distractor because MySQL cannot be configured to use STS directly for login.

Correct answer: B. Create Amazon Machine Images (AMIs) to back up the EC2 instances. Copy the AMIs to a secondary AWS Region. Automate infrastructure deployment in the secondary Region by using AWS CloudFormation.

Copying AMIs to the secondary Region and provisioning with CloudFormation implements a pilot-light DR pattern that meets a 4-hour RTO at minimal cost. Keeping standby instances running continuously would meet the RTO but wastes money compared with the minimal-resources requirement.

Correct answer: C. Set up a warm standby Amazon RDS for PostgreSQL database on AWS. Configure AWS Database Migration Service (AWS DMS) to use change data capture (CDC).

A warm standby RDS for PostgreSQL database with AWS DMS change data capture delivers near-real-time replication for an RPO under one minute and quick promotion for a two-hour RTO at moderate cost. Active-active multi-site would cost far more, and daily backups cannot meet the sub-minute RPO.

Correct answer: B. Take a snapshot of the RDS instance. Create an encrypted copy of the snapshot. Restore the RDS instance from the encrypted snapshot

You cannot enable encryption on an existing unencrypted RDS instance, so the standard path is snapshot, copy the snapshot with encryption, and restore a new encrypted instance. Encrypted read replicas cannot be created from unencrypted sources either.

Correct answer: A. Implement CloudFront signed cookies for authenticated students.

CloudFront signed cookies grant access to multiple restricted files or directories after a user authenticates, which fits restricting many course materials to enrolled students. S3 pre-signed URLs work per object and bypass CloudFront, making them inefficient for whole-directory access control.

Correct answer: D. Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Store data on Amazon EFS and mount a target on each instance

An Application Load Balancer with an Auto Scaling group across multiple Availability Zones plus Amazon EFS gives shared storage that any instance can mount, removing EBS as a single point of failure. Instance stores are ephemeral and S3 One Zone-IA is not suitable for active application files.

Correct answer: B. Extend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.

Amazon FSx for Windows File Server in a Multi-AZ deployment natively supports SMB, integrates with Active Directory, and delivers high throughput and IOPS with automatic failover. EFS is the trap here, since it only supports NFS for Linux clients, not Windows SMB workloads.

Correct answer: A. Write the log files to an Amazon S3 bucket. Create an event notification to invoke an AWS Lambda function that will process the files

S3 event notifications can directly trigger a Lambda function to process each uploaded log file, and a 40-second job fits comfortably within Lambda's 15-minute timeout. SQS tops out at 256 KB per message, so 1 GB files can't flow through a queue without extra handling.

Correct answer: C. Warm standby

Warm standby keeps a scaled-down but fully functional environment running, giving fast recovery at moderate cost. Pilot light is the closest distractor, but only core services run continuously, so its recovery time is longer.

Correct answer: C. Amazon ElastiCache Memcached

The Memcached engine supports multithreading across multiple cores, matching the multi-threaded in-memory cache requirement. ElastiCache Redis is single-threaded per core, so it does not fit the stated requirement here.

Correct answer: B. Migrate the web application to be hosted on AWS Fargate with Amazon Elastic Container Service (Amazon ECS). · C. Migrate the PostgreSQL database to Amazon Aurora.

AWS Fargate with Amazon ECS removes the need to manage underlying EC2 instances for containers, and Aurora is a managed PostgreSQL-compatible database with higher performance. Colocating app and database, CloudFront, and ElastiCache do not reduce the operational overhead the question targets.

Correct answer: B. Use AWS DataSync to migrate to Amazon FSx for Windows File Server

Amazon FSx for Windows File Server natively supports DFS Namespaces, and AWS DataSync automates migration to it. EFS is Linux-only, Server Migration Service migrates VMs rather than file data, and Lustre and S3 are unsuitable destinations for a Microsoft file share.

Correct answer: C. Set up an Amazon S3 bucket. The application should be updated to use S3 buckets to store documents. Store the object metadata in the existing database.

Moving large blobs to S3 while keeping only metadata in the database cuts cost and restores database performance, and S3 is inherently durable and available. Scaling up the RDS instance with Provisioned IOPS raises costs instead of lowering them.

Correct answer: C. Use AWS Systems Manager Run Command to run a custom command that installs the tool on all the EC2 instances.

Systems Manager Run Command executes a command across hundreds of managed instances at scale without SSH access, and it scales automatically as instances are added. Patch Manager is for OS patching, not arbitrary software installs.

Correct answer: A. Use Amazon Kinesis Data Firehose for data ingestion and Amazon Managed Service for Apache Flink for real-time analysis.

Kinesis Data Firehose loads streaming data straight into S3, and Managed Service for Apache Flink handles continuous real-time analytics with no infrastructure to run. Lambda with Data Streams requires you to manage consumers and scaling yourself.

Correct answer: B. Create an Amazon Elastic File System (Amazon EFS) file system and mount it on the individual Amazon EC2 instances

EFS mounts to multiple EC2 instances across Availability Zones and provides strong consistency for shared, frequently updated content. EBS multi-attach only works within a single Availability Zone, so it cannot span the Auto Scaling group.

Correct answer: B. Use Amazon Macie. Create an Amazon EventBridge rule to filter the 'SensitiveData:S3Object/Health' event type from Macie findings and trigger an Amazon Simple Email Service (Amazon SES) notification to the compliance team.

Amazon Macie detects PHI in S3, and an EventBridge rule on the SensitiveData:S3Object/Health finding type can notify the compliance team. Security Hub is the key distractor since it aggregates security alerts but does not detect specific sensitive data types in S3 objects.

Correct answer: B. Migrate the API to Amazon API Gateway and use AWS Lambda as the backend

API Gateway with a Lambda backend is fully serverless, giving high availability, automatic scaling, and pay-per-use pricing. EC2 with an Auto Scaling group is the closest distractor but costs more and requires more management than a serverless approach.

Correct answer: A. Use AWS Config to identify all untagged resources and tag them programmatically. Then, use AWS Backup to automate the backup of all AWS resources based on tags.

AWS Config identifies untagged resources so they can be tagged programmatically, and AWS Backup then automates backups by tag with minimal ongoing effort. The Lambda option is the closest distractor, but writing and maintaining a custom scan adds overhead Config avoids.

Correct answer: C. Create an analysis in Amazon QuickSight. Connect all the data sources and create new datasets. Publish dashboards to visualize the data. Share the dashboards with the appropriate users and groups.

Amazon QuickSight connects to both S3 and RDS for PostgreSQL, provides dashboards, and shares them with specific users and groups, matching the tiered access requirement. Athena and Glue options produce static reports in S3 and lack real visualization and per-user sharing controls.

Correct answer: B. Use Cost Explorer's granular filtering feature to perform an in-depth analysis of EC2 costs based on instance types.

Cost Explorer provides built-in filtering by service and instance type plus graphs across time periods, so it needs the least operational overhead. QuickSight with Cost and Usage Reports could work, but it requires building reports and data sources first.

Correct answer: C. Configure AWS Systems Manager Patch Manager to apply the patch to all EC2 instances.

Systems Manager Patch Manager automates scanning and installing patches across groups of instances using tags, making it the fastest managed approach. Run Command with a custom script could work, but Patch Manager is purpose-built for this remediation task.

Correct answer: A. Create a NAT gateway and attach an internet gateway to the VPC

A NAT gateway in a public subnet plus an attached internet gateway lets private instances initiate outbound traffic while blocking unsolicited inbound connections. Remember, internet gateways attach to the VPC, not to subnets.

Correct answer: D. Implement a target tracking action triggered at a lower CPU threshold, and decrease the cooldown period

Target tracking at a lower CPU threshold scales out before users feel slowdowns, and a shorter cooldown lets the group react faster while still tracking demand. Scheduled actions to 20 instances would fix performance but waste cost overnight when only 2 are needed.

Correct answer: B. Use Spot Instances in an Amazon Elastic Kubernetes Service (Amazon EKS) managed node group.

Spot Instances offer large discounts and suit stateless, re-triggerable batch workloads, and a managed EKS node group reduces operational overhead. However, an Auto Scaling group with Spot is equally defensible since the question never states the app is containerized or orchestrated with Kubernetes.

Correct answer: D. Set up an Amazon DynamoDB Accelerator (DAX) cluster in front of the DynamoDB table. · F. Create a CloudFront distribution and place it in front of the Application Load Balancer.

DAX provides microsecond caching for DynamoDB reads, and CloudFront caches content at edge locations close to global users. Both improve latency without rearchitecting; migrating to Aurora or Fargate would require major application changes the scenario forbids.

Correct answer: B. Order an AWS Snowball Edge Storage Optimized device. Copy the data to the device, and create a custom transformation job by using AWS Glue.

With saturated bandwidth, Snowball Edge Storage Optimized moves 45 TB offline quickly, and AWS Glue provides a managed serverless transformation job in the cloud. DataSync fails because it is an online transfer service that depends on network bandwidth you do not have.

Correct answer: E. Set up VPC endpoints for Amazon EKS and ECR to enable nodes to communicate with the control plane.

With private-only endpoint access, nodes in private subnets need interface VPC endpoints for EKS and ECR so they can reach the control plane and pull images without internet access. Moving nodes to public subnets violates the stated private-subnet security design.

Correct answer: E. Take EBS snapshots of the production EBS volumes. Turn on the EBS fast snapshot restore feature on the EBS snapshots. Restore the snapshots into new EBS volumes. Attach the new EBS volumes to EC2 instances in the test environment.

EBS fast snapshot restore creates volumes that are fully initialized, so the test environment gets full provisioned I/O performance immediately with no lazy-loading latency. Snapshots also give independent copies, whereas Multi-Attach shares live volumes and risks affecting production.

Correct answer: B. Set up AWS Firewall Manager in both Regions. Centrally configure AWS WAF rules.

AWS Firewall Manager lets you centrally manage AWS WAF rules across multiple accounts, Regions, and resources with the least administrative effort. WAF alone can block SQL injection and XSS, but managing separate web ACLs in each Region takes more work than a Firewall Manager policy.

Correct answer: D. Migrate the data to Amazon FSx for Windows File Server using AWS DataSync

Amazon FSx for Windows File Server is the managed SMB filesystem, and AWS DataSync automates migration from on-premises SMB shares. Remember the pairing cue: SMB or Windows workloads go to FSx for Windows File Server, while NFS or Linux workloads go to EFS.

Correct answer: B. Configure a Virtual Private Gateway

A virtual private gateway on the VPC paired with a customer gateway enables a Site-to-Site VPN that carries private IP traffic and provisions in minutes. Direct Connect also works but takes weeks to provision, and CloudFront is only a CDN for public content delivery.

Correct answer: E. Set up two Lambda functions. Configure one function to receive the information. Configure the other function to load the information into the database. Integrate the Lambda functions by using an Amazon Simple Queue Service (Amazon SQS) queue.

SQS decouples the two Lambda functions so incoming requests are queued and loaded into the database asynchronously, smoothing traffic spikes with minimal configuration. SNS is the closest distractor, but it is designed for fan-out delivery rather than reliable queued buffering.

Correct answer: A. Create an Amazon EventBridge rule for the CreateImage API call. Configure the target as an Amazon SNS topic to send an alert when a CreateImage API call is detected.

An EventBridge rule can trigger directly on the CreateImage API call via CloudTrail events and notify an SNS topic with no custom code. The Lambda-based options work but add operational overhead the question explicitly asks you to avoid.

Correct answer: D. Create an Amazon Kinesis Data Firehose delivery stream to ingest the alerts. Configure the Kinesis Data Firehose stream to deliver the alerts to an Amazon S3 bucket. Set up an S3 Lifecycle configuration to transition data to Amazon S3 Glacier after 14 days.

Kinesis Data Firehose is fully managed and delivers alerts straight to S3, where a lifecycle rule archives data to Glacier after 14 days. The EC2 and SQS options require managing servers or consumers, which the requirements rule out.

Correct answer: D. Search CloudTrail logs with Amazon QuickSight. Create a dashboard to identify the errors.

QuickSight can visualize CloudTrail logs directly from S3 and build a dashboard with minimal setup, meeting the least-effort requirement. The custom script options using Glue, Batch, or Redshift all involve far more configuration and maintenance.

Correct answer: E. Amazon Elastic File System (Amazon EFS) with the Standard storage class.

Amazon EFS provides a shared NFS filesystem with mount targets in every Availability Zone, and AWS Backup supports cross-Region backups with a configurable copy job schedule that meets a 2-hour RPO. The FSx options are workable but are more specialized, and EFS best matches the ECS and mount-target requirements here.

Correct answer: D. Amazon ElastiCache Redis

ElastiCache for Redis supports replication, automatic failover, and multi-AZ, which gives the caching layer high availability. Memcached offers neither replication nor failover, so reserve Redis whenever the question mentions HA, clustering, or persistence for caching.

Correct answer: A. Enable automatic storage scaling for the MySQL instance.

RDS storage autoscaling automatically grows allocated storage when free space runs low, with no interruption or manual work. Migrating to a larger instance is a one-time fix with heavy operational effort, while ElastiCache and lifecycle policies do not solve the storage-capacity problem.

Correct answer: B. Create new private subnets in the same VPC but in a different AZ. Migrate the database to an Amazon RDS multi-AZ deployment · C. Create an Amazon EC2 Auto Scaling group and Application Load Balancer (ALB) spanning multiple AZs

Spreading an Auto Scaling group and ALB across multiple AZs makes the web tier fault tolerant, while RDS multi-AZ in new subnets gives the database synchronous standby replication. Options that keep any component in a single AZ, such as an EC2 database, cannot survive an AZ failure.

Correct answer: D. Launch the EC2 instances in a private subnet and create an Application Load Balancer in a public subnet

Placing the EC2 instances in a private subnet with an ALB in a public subnet keeps the instances unreachable from the internet while the application stays publicly accessible. A NAT gateway only gives private instances outbound access, and WAF cannot hide instances in public subnets.

Correct answer: A. Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule

Scheduled scaling adds capacity just before the known monthly reporting window, preventing the slowdown entirely. A reactive CPU-based policy reacts too late because new instances launch only after utilization is already maxed, so memorize that predictable workloads call for scheduled scaling.

Correct answer: A. Use a target tracking policy that keeps the average aggregate CPU utilization at 40%

Target tracking scaling lets you set a desired metric value, like 40 percent average CPU, and it automatically adjusts capacity to maintain it. Simple and step scaling require you to define alarms and thresholds manually, so they don't hold a steady target.

Correct answer: A. Create gateway VPC endpoints for Amazon S3 and DynamoDB.

Gateway VPC endpoints for S3 and DynamoDB route traffic privately through the AWS backbone without internet traversal or cost. Interface endpoints exist for many services, but for S3 and DynamoDB the gateway endpoint is the standard exam answer.

Correct answer: D. Use the AWS Database Migration Service (DMS) to directly migrate the database to an Amazon RDS MySQL Multi-AZ deployment

AWS DMS migrates the MySQL database directly into a managed RDS Multi-AZ deployment, which provides automatic failover across Availability Zones. Schema Conversion Tool is unnecessary for same-engine migrations, and EC2 offers no managed Multi-AZ MySQL capability.

Correct answer: D. Create an organization in AWS Organizations that includes all accounts and create a service control policy (SCP) that denies the launch of large EC2 instances.

An SCP in AWS Organizations centrally enforces guardrails across all member accounts with one policy, giving the least operational overhead. Per-account IAM roles require repeated setup, and resource-based policies cannot be attached to EC2 itself.

Correct answer: B. Amazon Aurora Serverless

Aurora Serverless automatically starts, stops, and scales capacity based on demand, which suits an infrequently used database. Standard RDS MySQL, Aurora, and self-managed EC2 all keep instances running continuously, incurring unnecessary cost for intermittent workloads.

Correct answer: C. Launch the EC2 instances in a cluster placement group in one Availability Zone

A cluster placement group packs instances tightly in a single Availability Zone to deliver the low-latency, high-bandwidth network needed for HPC. Spread placement groups deliberately separate instances to reduce correlated failures, which hurts node-to-node performance.

Correct answer: D. Use a target tracking policy to dynamically scale the Auto Scaling group

A target tracking policy automatically adds or removes capacity to keep a chosen metric, such as CPU utilization, at a set target like 40%. Simple or scheduled scaling requires manual thresholds and cannot hold utilization near a target as smoothly.

Correct answer: D. Store the files on Amazon S3 with a lifecycle policy that moves objects older than 2 years to S3 Standard Infrequent Access (S3 Standard-IA)

S3 scales to any number of objects with high availability and durability, and a lifecycle policy can transition objects older than 2 years to Standard-IA. EBS volumes are attached to single instances, and EFS lifecycle policies are access-based rather than age-based.

Correct answer: A. Amazon DynamoDB

DynamoDB is a serverless key-value NoSQL database that scales seamlessly and pairs naturally with Lambda. EBS cannot be used by Lambda at all, and RDS MySQL imposes relational schema and scaling limits that don't fit key-value workloads.

Correct answer: A. Create a NAT gateway in the public subnet of each AZ. Update the route tables for each private subnet to direct internet-bound traffic to the NAT gateway

A NAT gateway in each AZ's public subnet, with private subnet route tables pointing to it, provides highly available outbound internet access for private instances. Remember the exam cue that NAT gateways live in public subnets, not VPCs, and one per AZ avoids a single point of failure.

Correct answer: C. Create an Amazon S3 bucket and host the website there.

S3 static website hosting is the most cost-effective option for purely static content like HTML, CSS, client-side JavaScript, and images. EC2 and Fargate add unnecessary compute cost, and an ALB with Lambda is overengineered for serving static files.

Correct answer: C. Create an additional S3 bucket with versioning in another Region and configure cross-Region replication

Cross-Region replication requires versioning enabled on both the source and destination buckets, so the option specifying versioning and replication is correct. CORS is a browser-based access mechanism and has nothing to do with disaster recovery replication.

Correct answer: D. Create an Amazon SQS queue and decouple the long-running API calls

Decoupling the long-running calls into an Amazon SQS queue lets workers process them asynchronously so they no longer block the rest of the API. On the exam, when one slow operation drags down overall latency, look for SQS decoupling rather than faster instances or balancer tuning.

Correct answer: B. Amazon CloudFront

Amazon CloudFront delivers both on-demand and real-time video streaming globally through its edge locations. S3 Transfer Acceleration only speeds uploads to S3, and Global Accelerator optimizes TCP or UDP traffic to specific endpoints, not content distribution for streaming.

Correct answer: A. AWS Lambda functions

AWS Lambda is the most cost-effective choice because the job is short, needs under 256 MB of memory, and you pay only per invocation and execution time. Fargate, Spot instances, and Elastic Beanstalk all involve paying for container or instance runtime even when idle.

Correct answer: B. Create AMIs of the instances and copy them to another Region · C. Launch instances in the second Region from the AMIs

Creating AMIs of the instances, copying them to the second Region, and launching instances there provides a working disaster recovery capability. Snapshot data cannot be accessed or replicated through the S3 API even though it is stored in S3, so the S3 replication options are traps.

Correct answer: C. Develop a WebSocket API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Establish a private VPC link for the API Gateway to securely access the Amazon EKS cluster.

A WebSocket API is required for persistent real-time connections, and a VPC link lets API Gateway reach the EKS-backed services privately without internet exposure. A security group alone cannot route traffic to instances in private subnets, so those options fail.

Correct answer: A. Create a snapshot of the database. Copy it to an encrypted snapshot. Restore the database from the encrypted snapshot

You cannot enable encryption on an existing unencrypted RDS instance, so snapshot, copy the snapshot with encryption, and restore to a new encrypted instance. Exam cue: there is no encryption checkbox for backups, and replicas inherit the source's encryption state.

Correct answer: D. Amazon GuardDuty

GuardDuty is a threat detection service that identifies EC2 instance compromise, account compromise, and S3 bucket compromise using intelligence feeds. Inspector scans for software vulnerabilities, and Macie only classifies sensitive data in S3.

Correct answer: B. Use Amazon Athena to directly query CloudTrail logs for failed logins and unauthorized activities.

Athena queries CloudTrail logs directly in S3 with standard SQL, requiring no infrastructure or custom scripts. Exam cue: for ad hoc log analysis with least effort, choose Athena over Lambda scripts or an Elasticsearch cluster.

Correct answer: A. Create an Amazon EFS file share and establish an IAM role that allows Fargate to communicate with Amazon EFS.

Amazon EFS provides shared, concurrent file access for multiple Fargate tasks with high performance and IAM-based control. EBS volumes cannot attach to Fargate tasks, and FSx for Lustre is not supported for Fargate.

Correct answer: A. Create AWS Service Catalog portfolios for the clients.

AWS Service Catalog lets you centrally manage portfolios of approved products that users can provision in a controlled self-service way. CloudFormation defines infrastructure but lacks the cataloging, permissions, and governance layer this scenario needs.

Correct answer: D. Multi-site

The multi-site, or active-active, strategy runs full environments in multiple Regions for near-zero downtime and minimal data loss. Warm standby and pilot light keep only partial capacity in the secondary site, so failover is slower.

Correct answer: D. Set up an Amazon API Gateway and use AWS Lambda functions

Lambda with API Gateway is serverless, scales automatically from zero to burst traffic, and you pay only per request, matching sporadic access. Options using EC2, ECS, or Elastic Beanstalk keep infrastructure running or add scaling overhead, so they fail the on-demand requirement.

Correct answer: A. Amazon DynamoDB

DynamoDB is a fully managed NoSQL key-value database with seamless scalability, so it fits perfectly. RDS is relational, Redshift is a data warehouse for analytics, and ElastiCache is an in-memory cache rather than a durable key-value database.

Correct answer: C. Store data in STANDARD for 90 days then transition the data to DEEP_ARCHIVE

Data that is frequently accessed belongs in S3 Standard for 90 days, then rarely accessed compliance data moves to Deep Archive for the cheapest retention. Expiring deletes required data, and lifecycle transitions into Reduced Redundancy or from Intelligent-Tiering to Standard-IA are not valid.

Correct answer: C. Set up S3 bucket policies to allow access from a VPC endpoint.

A gateway VPC endpoint lets EC2 instances in a private subnet reach S3 over private IP addresses without internet access. Bucket policies can restrict access to that endpoint only, while IAM policies, KMS encryption, or TLS certificates do not create a private network path.

Correct answer: D. Set up an Amazon S3 bucket. Configure an Amazon FSx for Lustre file system and integrate it with the S3 bucket after importing the data then access the FSx for Lustre file system from the HPC cluster instances.

FSx for Lustre integrates natively with S3 and delivers the low-latency, high-throughput shared storage that HPC clusters need. Snowball Edge data imports into S3, not directly into FSx for Lustre, so importing to S3 first and linking Lustre is the correct pattern.

Correct answer: C. Use Amazon API Gateway along with AWS Lambda functions with provisioned concurrency.

API Gateway with Lambda provides a fully managed, auto-scaling API layer, and provisioned concurrency keeps functions warm so cold starts don't hurt latency during traffic spikes. Beanstalk and Fargate add more operational overhead than the serverless option.

Correct answer: C. Migrate the data and applications to Amazon RDS instances. Enable encryption at rest using AWS Key Management Service (AWS KMS).

Amazon RDS handles backups, patching, and replication, lowering database operational overhead, and KMS encryption at rest secures the sensitive data. Running databases on EC2 requires you to manage all administration yourself, and GuardDuty provides threat detection, not data protection.

Correct answer: B. Configure Amazon EBS encryption and Amazon RDS encryption with AWS KMS keys to encrypt instance and database volumes.

Encryption at rest requires encrypting both the EBS volumes and the RDS storage, which KMS-backed EBS and RDS encryption handle together. SSL/TLS only protects data in transit, and CloudHSM is unnecessary complexity that also leaves the EBS volumes unencrypted.

Correct answer: D. Implement AWS Global Accelerator ahead of the NLBs and align the Global Accelerator endpoint to use the appropriate listener ports.

AWS Global Accelerator routes TCP and UDP traffic over the AWS global network to the closest healthy endpoint, which directly improves latency and performance for a gaming workload. CloudFront is the tempting distractor, but it is a CDN for content delivery and doesn't optimize raw TCP or UDP gaming traffic.

Correct answer: A. Update the application code to use an Amazon ElastiCache for Redis cluster

ElastiCache for Redis provides sub-millisecond latency and very high read throughput, making it the right caching layer in front of S3 for catalog updates. DAX is the classic trap here; it only accelerates DynamoDB, so it can't front S3 reads.

Correct answer: C. Create a service control policy in the root organizational unit to deny access to the services or actions

A service control policy attached at the root organizational unit centrally restricts the maximum available permissions across all member accounts. IAM policies in the root account don't affect other accounts, and network ACLs can't control API actions at all.