AWS Certified Solutions Architect Professional (SAP-C02) Practice Test – 258 Free Exam Questions with Answers

Correct answer: A. Set the DeletionPolicy on the RDS resource to snapshot and set the S3 bucket to retain.

Setting the DeletionPolicy to Snapshot for RDS creates a final backup, while Retain on the S3 bucket preserves the objects during stack deletion. Remember that S3 does not support the Snapshot DeletionPolicy, only Retain or Delete.

Correct answer: B. Provision a table in DynamoDB containing an item for each user having the necessary attributes to hold the user preferences. The mobile app will query the user preferences directly from the table. Use STS, Web Identity Federation, and DynamoDB's Fine-Grained Access Control for authentication and authorization.

Using DynamoDB with web identity federation and fine-grained access control provides a highly scalable, secure, and cost-effective solution for small user preference data. RDS is not as cost-effective for simple key-value profile lookups across millions of users.

Correct answer: B. SCPs do not affect any service-linked role. Service-linked roles enable other AWS services to integrate with AWS Organizations and can't be restricted by SCPs.

Service Control Policies explicitly do not affect service-linked roles because these roles are integral to AWS service functionality. If you need to restrict an action performed directly by an AWS service, you must block the user or role invoking the service instead.

Correct answer: C. Use the AWS Schema Conversion Tool (SCT) to convert the source schema to match that of the target database. Migrate the data using the AWS Database Migration Service (DMS) from the source database to an Amazon RDS for PostgreSQL database.

For heterogeneous migrations, the AWS Schema Conversion Tool automatically converts the source database schema and code to match the target PostgreSQL database. AWS Database Migration Service then securely migrates the actual data. Other tools do not handle schema transformations natively.

Correct answer: A. Use AWS Serverless Application Model (AWS SAM) and set up AWS CodeBuild, AWS CodeDeploy, and AWS CodePipeline to build a CI/CD pipeline.

The AWS Serverless Application Model seamlessly integrates with AWS CodePipeline, CodeBuild, and CodeDeploy to build, test, and deploy serverless applications. It natively supports gradual deployment strategies like canary and linear deployments for Lambda functions. Elastic Beanstalk is intended for EC2 workloads, not serverless architectures.

Correct answer: B. Use the awsvpc network mode in the task definition in your Amazon ECS Cluster. Attach security groups to the ECS tasks then use IAM roles for tasks to access other resources.

Using the awsvpc network mode assigns each task its own elastic network interface, allowing granular security group attachments directly to containers. IAM roles for tasks grant temporary database credentials without hardcoding sensitive information. The bridge network mode restricts this container-level security visibility.

Correct answer: C. Use AWS Organizations and Service Control Policies to control the list of AWS services that can be used by each member account.

AWS Organizations combined with Service Control Policies provides centralized governance to restrict available AWS services across multiple accounts. SCPs act as guardrails affecting all accounts within an Organizational Unit, while IAM policies manage granular resource access within those accounts.

Correct answer: D. Enable the Requester Pays feature in all of the startup's S3 buckets to make the media company pay the cost of the data transfer from the buckets.

Enabling Requester Pays on the S3 buckets shifts the data transfer and request costs to the media company accessing the data. Standard cross-account access alone still charges the bucket owner for all data transfer out of the bucket.

Correct answer: B. Set up a patch baseline that defines which patches are approved for installation on your instances using AWS Systems Manager Patch Manager. · D. Use the AWS Config Managed Rule which automatically checks whether your running EC2 instances are using approved AMIs. Set up CloudWatch Alarms to notify you if there are any non-compliant instances running in your VPC.

Systems Manager Patch Manager handles the automated security patching, while AWS Config rules monitor for unapproved AMIs. GuardDuty is a threat detection service and does not evaluate patch levels or approved AMIs.

Correct answer: D. Create an AWS Snowball import job to request for a Snowball Edge device. Use the AWS Schema Conversion Tool (SCT) to process the on-premises data warehouse and load it to the Snowball Edge device. Install the extraction agent on a separate on-premises server and register it with AWS SCT. Once the Snowball Edge imports data to the S3 bucket, use AWS SCT to migrate the data to Amazon Redshift. Configure a local task and AWS DMS task to replicate the ongoing updates to the data warehouse. Monitor and verify that the data migration is complete.

Using AWS Snowball Edge with the AWS Schema Conversion Tool extracts the massive dataset offline, bypassing the slow connection. AWS DMS then replicates the ongoing daily changes to Amazon Redshift to complete the migration within the window.

Correct answer: C. Launch a Spot Fleet using a diversified allocation strategy, with Auto Scaling enabled on each AZ to handle the peak load instead of On-Demand instances. Retain the current setup for handling the steady state load.

A Spot Fleet with a diversified allocation strategy provides the most cost-effective scaling for unpredictable peak loads across multiple Availability Zones. Reserved Instances are ideal for steady-state traffic but lack the cost savings of Spot for peaks.

Correct answer: A. Convert the Python script cron job to an AWS Lambda function. Configure the S3 bucket event notifications to trigger the Lambda function whenever an object is uploaded to the bucket.

Configuring S3 event notifications to trigger an AWS Lambda function processes each file immediately upon upload with minimal operational overhead. Using EventBridge or CloudTrail for S3 upload events adds unnecessary complexity for this specific use case.

Correct answer: D. Go to the Auto Scaling Groups section in the AWS console and suspend the "Terminate" process for the ASG. Log in to one of the unhealthy instances using AWS Systems Manager Session Manager.

Suspending the Terminate process for the Auto Scaling group stops the replacement cycle, keeping the failing instance alive so you can log in via Systems Manager. Relying on termination protection fails because the Auto Scaling group can override it to maintain capacity.

Correct answer: A. Set up a cloud-based contact center using the Amazon Connect service. Create a conversational chatbot using Amazon Lex with automatic speech recognition and natural language understanding to recognize the intent of the caller then integrate it with Amazon Connect. Connect the solution to various business applications and other internal systems using AWS Lambda functions.

Amazon Connect provides a cloud-based contact center, while Amazon Lex integrates conversational AI to handle automatic speech recognition and intent understanding. Lambda then executes the backend business logic to fulfill user requests. Comprehend lacks ASR and Polly only provides text-to-speech.

Correct answer: B. Use AWS Config to monitor the compliance of your AWS Organizations. Set up an SNS Topic or Amazon EventBridge that will send alerts to you for any changes. · D. Create a trail in Amazon CloudTrail to capture all API calls to your AWS Organizations, including calls from the AWS Organizations console and from code calls to the AWS Organizations APIs. Use Amazon EventBridge and SNS to raise events when administrator-specified actions occur in an organization and send a notification to you.

CloudTrail captures AWS Organizations API calls, which Amazon EventBridge can monitor to trigger SNS notifications for unauthorized actions. AWS Config records resource configurations, ensuring continuous compliance monitoring across the organization. Systems Manager does not track these events.

Correct answer: B. Use CloudFront to cache and distribute the high resolution images and other static assets of the website. Deploy AWS WAF on the Amazon CloudFront distribution to protect the website from common web attacks.

Using Amazon CloudFront offloads traffic by caching heavy static assets directly at the edge, significantly reducing the load on the on-premises origin. Deploying AWS WAF on the CloudFront distribution blocks malicious requests before they ever reach the origin network.

Correct answer: A. Create the same resources of Auto Scaling group of EC2 instances for web and application tiers on both regions using AWS CloudFormation StackSets. Enable Amazon S3 cross-Region on the S3 bucket to asynchronously replicate the contents to the secondary region. Create Amazon Route 53 DNS zone entries with a failover routing policy and set the us-west-1 region as the secondary site. For the database tier, create a DynamoDB global table spanning both regions.

DynamoDB global tables provide multi-active, multi-region replication ensuring quick failover and failback for NoSQL workloads. CloudFormation StackSets deploy infrastructure consistently, while Route 53 failover routing and S3 cross-region replication handle traffic and static assets. Avoid RDS MySQL since the scenario specifies NoSQL.

Correct answer: C. Create a CloudFront distribution with Geo-Restriction enabled to block all of the blacklisted countries from accessing the trading platform.

CloudFront geo restriction blocks access from specific countries directly at the edge, fulfilling compliance while maintaining low latency. Route 53 geolocation cannot actively block traffic or provide edge caching, and managing network ACLs across dynamic IP ranges is unmanageable.

Correct answer: A. In each new AWS Region, request for SSL/TLS certificates using the AWS Certificate Manager for each FQDN. Associate the new certificates to the corresponding Application Load Balancer of the same AWS Region.

ACM certificates used by Application Load Balancers are regional resources, meaning you must request a new certificate in every region where you deploy. Global CloudFront distributions can use a single certificate from US East, but regional load balancing requires regional certificates. KMS does not issue certificates.

Correct answer: A. Download and install the Amazon CloudWatch agent in the on-premises servers and send the logs to Amazon CloudWatch Logs. Create a metric filter in CloudWatch to turn log data into numerical metrics to identify and measure application errors. Create a CloudWatch Alarm that monitors the metric filter and immediately notify the IT Operations team for any issues.

The CloudWatch agent securely pushes on-premises logs to CloudWatch Logs, where metric filters extract errors into actionable data. CloudWatch alarms then monitor these metrics to trigger immediate notifications. QuickSight is an analytics tool, not a real-time alerting system.

Correct answer: B. Deploy the Docker containers using Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 Spot Instances. Ensure that Spot Instance draining is enabled on the ECS agent config. Use Reserved instance for the Amazon RDS database and its read replicas. Create an encrypted Amazon S3 bucket to store the company documents. Create a bucket lifecycle policy that will move the documents to S3 Glacier after three months and will delete objects older than five years.

Using ECS on Spot Instances provides low-cost compute for containers, while Spot Instance draining ensures graceful task migration during interruptions. RDS Reserved Instances optimize database pricing, and an S3 lifecycle policy transitions older documents to Glacier, minimizing storage costs. EFS and On-Demand options are more expensive.

Correct answer: A. Create two Patch Groups with unique tags that you will assign to all of your EC2 Windows Instances. Associate the predefined AWS-DefaultPatchBaseline baseline on both patch groups. Set up two non-overlapping maintenance windows and associate each with a different patch group. Using Patch Group tags, register targets with specific maintenance windows and lastly, assign the AWS-RunPatchBaseline document as a task within each maintenance window which has a different processing start time.

Creating two patch groups and associating them with non-overlapping maintenance windows ensures instances are patched and rebooted in staggered shifts. Assigning the AWS-RunPatchBaseline document within these windows fulfills the automated patching requirement. Using State Manager or Run Command lacks built-in reboot scheduling control.

Correct answer: D. Set up a private hosted zone with a domain name of tutorialsdojo.com and specify the VPCs that you want to associate with the hosted zone. Create an A record with a value of database.tutorialsdojo.com which maps to the IP address of the EC2 instance of your database server. Modify the enableDnsHostNames attribute of your VPC to true and the enableDnsSupport attribute to true

A Route 53 private hosted zone resolves internal domain names exclusively within your associated VPCs. By creating an A record mapped to the private IP address of the database, you ensure it remains internally accessible. Avoid public hosted zones or Elastic IPs for internal resources.

Correct answer: C. Remove the SCPs on the organization's root and apply them to the Production OU instead. Create a temporary Onboarding OU that has an attached SCP allowing changes to Config. Add the new account to this temporary OU and make the required changes before moving it to the Production OU.

Moving service control policies from the root to the Production organizational unit prevents them from applying to a temporary Onboarding unit. This allows the new account to configure AWS Config rules before moving into production. Root-level explicit denies cannot be overridden by child-level allows.

Correct answer: D. Using the current Direct Connect connection, create a new public virtual interface and input the network prefixes that you want to advertise. Create a new site-to-site VPN connection to the VPC with the BGP protocol using the DX connection. Configure the company network to route employee traffic to this VPN.

Establishing a site-to-site VPN over a public virtual interface on your Direct Connect connection encrypts the traffic while maintaining consistent network performance. A private virtual interface does not support VPN attachments for AWS public endpoints. Remember this public VIF requirement for encrypted Direct Connect.

Correct answer: A. Launch an AWS CloudFormation stack that contains an Auto Scaling Group of Amazon EC2 instances spanning multiple Availability Zones that are behind an Application Load Balancer. Use the stack to launch an Amazon Aurora MySQL database cluster in a Multi-AZ configuration with a "retain" deletion policy. Create an Amazon Route 53 zone entry for the company's domain name with an Alias record pointed to the ALB.

Using CloudFormation to deploy a multi-AZ Auto Scaling group behind an Application Load Balancer provides the required scalability and availability for the web tier. Pairing this with an Amazon Aurora MySQL cluster offers high database availability. Multi-region deployments add unnecessary costs for this single global product launch.

Correct answer: C. Configure the CloudFront distribution to enforce secure end-to-end connections to origin servers by using HTTPS and field-level encryption. Configure your origin to add a Cache-Control max-age directive to your objects, and specify the longest practical value for max-age to increase your cache hit ratio.

CloudFront field-level encryption securely encrypts specific sensitive data fields like credit card numbers at the edge before reaching your origin servers. Setting a long Cache-Control max-age directive keeps objects at edge locations longer, directly improving the cache hit ratio.

Correct answer: B. On AWS Resource Access Manager (RAM), set up a shared services VPC on your central account. Set up VPC peering from this VPC to each VPC on the other accounts. On Amazon Route 53, create a private hosted zone associated with the shared services VPC. Manage all domains and subdomains on this zone. Programmatically associate the VPCs from other accounts with this hosted zone.

Using Route 53 private hosted zones with cross-account VPC associations allows you to share private DNS resolution seamlessly across different AWS accounts. This centralized approach keeps DNS architecture simple and easily queried by participating VPCs. Manually updating name server records across accounts is an anti-pattern that breaks private zone resolution.

Correct answer: D. Deny access from the IP Address block in the Network ACL. Use AWS Shield Advanced to protect your cloud resources.

Network ACLs provide an immediate stateless block for the offending IP address, and AWS Shield Advanced protects against network and transport layer DDoS attacks. Security groups cannot explicitly deny traffic, making Network ACLs the necessary choice.

Correct answer: D. Upload the database credentials with a Secure String data type in AWS Systems Manager Parameter Store. Install the AWS SSM agent on all servers. Set up a new IAM role that enables access and decryption of the database credentials from SSM Parameter Store. Associate this role to the EC2 instances. Create an IAM Service Role that will be associated with the on-premises servers. Deploy the application packages to the EC2 instances and on-premises servers using AWS CodeDeploy.

Storing credentials as a Secure String in Systems Manager Parameter Store ensures encryption, while specific IAM roles grant instances least-privilege decryption access. Using AWS CodeDeploy automates the rollout across both EC2 instances and on-premises servers. Elastic Beanstalk cannot deploy to on-premises infrastructure.

Correct answer: C. On Account A, create an authorization to associate its private hosted zone to the new VPC in Account B. · E. On Account B, associate the VPC to the private hosted zone in Account A. Delete the association authorization after the association is created.

Associating a cross-account VPC with a private hosted zone requires explicit authorization from the hosted zone owner. Account A must authorize Account B, then Account B associates its VPC. Deleting the authorization afterward prevents unauthorized re-associations while maintaining the active link.

Correct answer: D. Turn off the Reserved Instance (RI) sharing on the master account for all of the member accounts in the Baby products business unit.

The payer account can disable Reserved Instance discount sharing for specific member accounts within AWS Organizations. This prevents the Baby products unit's reservations from applying to other business units. Member accounts cannot configure this directly, and removing them breaks consolidated billing.

Correct answer: C. Establish VPN tunnels from your on-premises data center to each of the 10 VPCs. Terminate each VPN tunnel connection at the virtual private gateway (VGW) of the respective VPC. Configure BGP for route management.

Establishing Site-to-Site VPN tunnels from your data center to the virtual private gateways provides a highly available, lower-cost backup. BGP manages routing, automatically failing over if the Direct Connect link drops. Provisioning a second Direct Connect is expensive and often unnecessary for simple failover.

Correct answer: C. Register the domain name on Route 53 and enable DNSSEC validation for all public hosted zones to ensure that all DNS requests have not been tampered with during transit. Use AWS Certificate Manager (ACM) to generate a valid TLS/SSL certificate for the domain name. Configure the Application Load Balancer with an HTTPS listener to use the ACM TLS/SSL certificate. Use Server Name Identification and HTTP to HTTPS redirection on CloudFront.

Enabling Route 53 DNSSEC signing and validation protects against DNS spoofing by ensuring responses have not been tampered with in transit. Using an AWS Certificate Manager certificate on the Application Load Balancer prevents SSL hijacking by encrypting the connection. Avoid third-party DNS providers since Route 53 natively supports DNSSEC.

Correct answer: A. Configure your application tier to run on an Auto Scaling group of smaller sized EC2 instances behind an Application Load Balancer. Purchase Reserved EC2 instances for fixed capacity and let the Auto Scaling instances run on demand. Migrate the MySQL database to Amazon Aurora. Create a read-replica on another Availability Zone of the Aurora instance for high availability.

Migrating to Amazon Aurora provides automatic storage scaling up to 128 tebibytes, easily accommodating the database growth. Combining reserved instances for baseline capacity with on-demand instances in an Auto Scaling group optimizes compute costs while maintaining high availability. Managing databases on EC2 requires excessive manual overhead.

Correct answer: D. Create a new AWS CloudTrail trail in a new S3 bucket using the AWS CLI and also pass both the –is-multi-region-trail and –include-global-service-events parameters then encrypt log files using KMS encryption. Enable Multi-Factor Authentication (MFA) Delete on the S3 bucket and ensure that only authorized users can access the logs by configuring the bucket policies.

Creating a multi-region AWS CloudTrail trail captures regional service events across all specified regions for accounting systems. Including global service events ensures that actions from global services like IAM and CloudFront are logged. Encrypting the S3 bucket with KMS and enabling MFA Delete secures the log data.

Correct answer: C. Re-platform the environment on the AWS Cloud platform by running the Docker containers on Amazon ECS. Test the new OpenJDK Docker containers and upload them on Amazon Elastic Container Registry. Migrate the MySQL database to Amazon RDS using AWS Database Migration Service.

Replatforming shifts existing Docker containers to Amazon ECS and the database to Amazon RDS, achieving cloud agility without fundamentally altering the architecture. Refactoring to Lambda or DynamoDB is incorrect because it violates the requirement to avoid major application changes.

Correct answer: A. Tag each instance based on its environment and OS. Create a patch baseline in AWS Systems Manager Patch Manager for each environment. Categorize EC2 instances based on their tags using Patch Groups and apply the patches specified in the corresponding patch baseline to each Patch Group.

AWS Systems Manager Patch Manager uses patch groups based on resource tags to selectively apply different patch baselines across environments. This natively isolates production instances from development and test servers without writing custom Run Command scripts.

Correct answer: D. Link each of the teams' VPCs to the central VPC using VPC Peering. Create VPC Flow Logs on each VPC to capture rejected traffic requests, including the source IPs, that will be delivered to an Amazon CloudWatch Logs group. Set up a CloudWatch Logs subscription that streams the log data to the IT Security account.

VPC peering provides a private, fully isolated route directly between the departmental VPCs and the central application. VPC Flow Logs then records rejected traffic and source IPs for CloudWatch to alert the security team without using a VPN.

Correct answer: C. Store the database credentials using the AWS Secrets Manager and then encrypt them using AWS KMS. Create an IAM Role for your Amazon ECS task execution role and reference it with your task definition which allows access to both KMS and AWS Secrets Manager. Within your container definition, specify secrets with the name of the environment variable to set in the container and the full ARN of the Secrets Manager secret which contains the sensitive data, to present to the container.

AWS Secrets Manager directly integrates with ECS task definitions to securely inject credentials as environment variables during task startup. It also natively provides the requested lifecycle management and automated rotation, unlike Systems Manager Parameter Store.

Correct answer: D. Utilize AWS Direct Connect Gateway for inter-region VPC access. Create a virtual private gateway in each VPC, then create a private virtual interface for each AWS Direct Connect connection to the Direct Connect gateway.

An AWS Direct Connect gateway easily links a dedicated on-premises connection to multiple regional VPCs via private virtual interfaces. This setup guarantees traffic avoids the public internet while minimizing BGP management overhead across regions.

Correct answer: C. Register the web application with a Web Identity Provider such as Google, Facebook, Amazon, or from any other popular social sites and use the AssumeRoleWithWebIdentity API of STS to generate temporary credentials. Create an IAM role for that web provider and set up permissions for the IAM role to allow GET and PUT operations in Amazon S3 and DynamoDB. Serve your web app out of an S3 bucket enabled as a website.

Hosting a React application in Amazon S3 provides a highly scalable and cost-effective static frontend. Using web identity federation to assume an IAM role grants the browser temporary credentials to securely write directly to DynamoDB.

Correct answer: A. Create a new Amazon S3 bucket to store and serve the scanned image files using an Amazon CloudFront web distribution. Launch a new AWS Elastic Beanstalk environment to host the website across multiple Availability Zones and set up an Amazon OpenSearch Service for query processing, which the website can use. Use Amazon Textract to detect and recognize text from scanned old newspapers.

Using Amazon S3 with CloudFront and Elastic Beanstalk provides a scalable, highly available web tier. Amazon Textract replaces the expiring optical character recognition software, and OpenSearch handles the full-text search queries. Avoid options that rely on unsupported image searches or migrating the expiring software.

Correct answer: E. Set up an AWS Global Accelerator, which has several endpoint groups that target specific endpoints and ALBs on the required AWS Regions. Create a public alias record in Amazon Route 53 that points your custom domain name to the DNS name assigned to your accelerator.

AWS Global Accelerator routes traffic to the regional Application Load Balancers over the AWS global network, providing static IPs and high availability. You then create an Amazon Route 53 alias record pointing your apex domain to the accelerator DNS. Remember that Transit Gateway does not route public internet traffic to ALBs.

Correct answer: B. Utilize AWS Batch with Managed Compute Environments to create a fleet using Spot Instances. Store the raw data on an Amazon S3 bucket. Create jobs on AWS Batch Job Queues that will pull objects from the Amazon S3 bucket and temporarily store them to the EC2 EBS volumes for processing. Send the processed images back to another Amazon S3 bucket.

AWS Batch with managed compute environments automatically provisions Spot Instances, dynamically scaling to process thousands of parallel jobs efficiently. Storing raw and processed images in Amazon S3 provides the necessary durability with minimal management overhead. Avoid custom autoscaling setups that require extensive infrastructure maintenance.

Correct answer: H. Install OS patches and create a new AMI using AWS Systems Manager. Use this new AMI for the Auto Scaling group of EC2 instances and replace the existing instances. Deploy the new version of the application to the instances using AWS CodeDeploy. Mount an Amazon EFS volume containing the static dataset on the instances upon boot up.

Using AWS Systems Manager to patch instances and create a fresh Amazon Machine Image ensures rapid, compliant deployments within the Auto Scaling group. Mounting an Amazon EFS volume provides shared, immediate access to the large static dataset. Downloading massive datasets from S3 during boot increases startup times and costs.

Correct answer: D. Set up and configure a unified Amazon CloudWatch Logs agent in each On-Demand EC2 instance that will automatically collect and push data to CloudWatch Logs. Analyze the log data with CloudWatch Logs Insights.

The unified CloudWatch agent collects both system metrics and logs from Windows and Linux servers for centralized analysis. CloudWatch Logs Insights then interactively queries this log data to troubleshoot issues effectively. Avoid custom scripts when Systems Manager can deploy the managed agent natively.

Correct answer: A. Use an Application Load Balancer (ALB) to reduce the risk of overloading your application by distributing traffic across many backend instances. Integrate AWS WAF and the ALB to protect your web applications from common web exploits that could affect application availability. · D. Use an Amazon CloudFront distribution for both static and dynamic content of your web applications. Add CloudWatch alerts to automatically look and notify the Operations team for high CPUUtilization and NetworkIn metrics, as well as to trigger Auto Scaling of your EC2 instances.

Using Amazon CloudFront and an Application Load Balancer distributes and absorbs malicious traffic, protecting backend instances from being overwhelmed. Adding AWS WAF further inspects and filters web requests, ensuring application availability without needing Shield Advanced.

Correct answer: C. Use trusted access by running the enable-sharing-with-aws-organization command in the AWS RAM CLI. Mirror the configuration changes that was performed by the account that previously managed this service.

Enabling trusted access with AWS Organizations allows AWS RAM to perform tasks on your behalf by automatically creating the necessary service-linked role. This is the simplest and most native way to integrate the services. Manually configuring roles or using Systems Manager introduces unnecessary operational overhead.

Correct answer: A. Upgrade your architecture to use an S3 bucket with cross-region replication (CRR) enabled, as the storage service. Set up an SQS queue to distribute the tasks to a group of EC2 instances with Auto Scaling to dynamically increase or decrease the group of EC2 instances depending on the length of the SQS queue. Use CloudFormation to replicate your architecture to another region.

Using Amazon S3 for object storage easily handles the ever-growing data uploads while an SQS queue decouples the processing tasks. EC2 Auto Scaling then uses the queue length to dynamically adjust compute capacity, resolving the surge issues. EBS volumes are block storage and are difficult to synchronize across scaled instances.

Correct answer: A. The S3 bucket does not have public read access which blocks the website visitors from seeing the content.

Amazon S3 buckets must explicitly grant public read access to successfully serve static website content to visitors. Without this permission, the bucket blocks all anonymous HTTP requests, resulting in access denied errors. Route 53 alias records route traffic correctly, but the bucket policies dictate actual visibility.

Correct answer: G. Configure the application to receive the records and set the storage to a DynamoDB table. Configure proper scaling on the DynamoDB table and enable the DynamoDB table Time to Live (TTL) setting to delete records after 120 days.

DynamoDB easily handles massive ingest rates while providing single-digit millisecond latency, and its Time to Live feature automatically deletes expired items at no extra cost. Amazon S3 lacks the low-latency retrieval needed here, and Kafka is not optimized for direct low-latency item lookups.

Correct answer: B. Purchase Compute Savings Plans for the EC2 nodes of the EKS cluster to be used for regular traffic. Scale the node cluster with Spot instances during peak demands. Handle the predicted database load with a 1-year All Upfront Reserved Instance and vertically scale up the DB instance on scheduled high usage.

Compute Savings Plans handle the predictable baseline, while Spot Instances cheaply absorb the flexible peak loads for containerized workloads. For the database, an All Upfront Reserved Instance yields the maximum discount, and scheduled vertical scaling accommodates the temporary surges.

Correct answer: B. Distribute traffic to a set of web servers using an Elastic Load Balancer that performs TCP load balancing. Use CloudHSM deployed to two Availability Zones to perform the SSL transactions and deliver your application logs to a private Amazon S3 bucket using server-side encryption.

Deploying CloudHSM across two Availability Zones ensures the highly available termination of SSL transactions entirely within dedicated hardware. Uploading logs to S3 with server-side encryption meets the durability requirement while restricting access to authorized staff.

Correct answer: G. Use AWS Transform MGN to migrate the virtual machines to AWS. Install the AWS Replication Agent on each server in the application tiers to continuously replicate the root volumes and data volumes to AWS. Launch test instances from the replicated servers, validate the application, and then perform a cutover to launch updated Amazon EC2 instances.

AWS Application Migration Service continuously replicates root and data volumes using an agent, ensuring minimal downtime during the cutover. VM Import/Export lacks continuous synchronization capabilities, resulting in heavy operational overhead for incremental updates.

Correct answer: D. Set up cross-account access with a resource-based Policy. Use AWS Config rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration.

Resource-based policies attached directly to services like S3 or KMS allow cross-account access without assuming a role, preserving the user's original permissions. AWS Config continuously audits these policy changes to maintain compliance. Remember that roles require surrendering original session permissions.

Correct answer: B. Reduce the load on the database tier by creating an Amazon ElastiCache cluster to cache frequently requested database queries. Configure the application to use this cache when querying the RDS MySQL instance. · D. Change the target group health check to a simple HTML page instead of a page that queries the database. Create an Amazon Route 53 health check for the database dummy item web page to ensure that the application works as expected. Set up an Amazon CloudWatch alarm to send a notification to Admins when the health check fails.

Using Amazon ElastiCache offloads read-heavy database queries, directly relieving CPU bottlenecks on the RDS instance. Target group health checks should query a simple HTML page instead of a database, preventing unnecessary scaling churn during outages. Route 53 health checks monitor the critical application endpoints externally.

Correct answer: A. Use AWS WAF to add a web access control list (web ACL) in front of the API Gateway to block requests that contain malicious SQL code. Use AWS Config to track changes to your web access control lists (web ACLs) such as the creation and deletion of rules including the updates to the WAF rule configurations.

AWS WAF attaches directly to API Gateway to inspect incoming requests and block malicious SQL injection patterns at the edge. AWS Config records the configuration changes to web ACLs, allowing you to track historical rule modifications. Firewall Manager manages rules globally across accounts, while Config tracks individual resource configurations.

Correct answer: H. Create a geolocation routing policy on Amazon Route 53 to point the global users to their designated regions. Combine this with a failover answer routing policy with health checks to direct users to a healthy region at any given time.

Amazon Aurora Global Database provides multi-region read scalability and disaster recovery without sacrificing relational semantics or single-region write availability. Route 53 geolocation routing ensures users hit their local healthy endpoints while safely failing over regionally.

Correct answer: C. Use Amazon CloudWatch to monitor service quotas published in the AWS/Usage metric namespace. Set up an alarm when the math expression metricId/SERVICE_QUOTA(metricId)*100 is greater than 75. Configure Amazon SNS to send notifications to the operations team.

CloudWatch tracks usage in the AWS/Usage namespace, enabling a math expression using the SERVICE_QUOTA function to calculate quota consumption directly. Avoid creating custom metrics when native Service Quotas integration can trigger alerts natively.

Correct answer: F. Update the AWS Fargate task definition and set the auto-assign public IP option to DISABLED. Launch a NAT gateway on the public subnet of the VPC and update the route table of the private subnet to route requests to the Internet.

Fargate tasks in private subnets need a route to the internet to pull container images from Amazon ECR. Deploying a NAT Gateway in a public subnet and updating the private subnet route table provides this outbound access securely. A NAT Gateway must reside in a public subnet to reach the internet gateway.

Correct answer: F. Reconfigure the SQS redrive policy and set maxReceiveCount to 10. This will allow the consumers to retry the messages before sending them to the dead-letter queue.

Setting maxReceiveCount to a low value like one triggers immediate dead-letter routing for transient hiccups. Raising the count to ten allows consumers multiple attempts before discarding messages. The current one-hour visibility timeout correctly covers processing, proving the issue is overly strict retries, not timeouts.

Correct answer: A. Create an Amazon S3 bucket to host the static contents. Set this bucket as the origin for an Amazon CloudFront distribution. Write a Lambda@Edge function to parse the User-Agent HTTP header and serve the appropriate contents based on the user's device type.

Using an S3 bucket with CloudFront and Lambda@Edge offloads static content delivery and dynamically routes traffic based on device headers. Caching based on the raw User-Agent header is an anti-pattern due to cache fragmentation, and Network Load Balancers cannot inspect Layer 7 headers.

Correct answer: B. Create a forwarding rule inside the endpoint to forward any queries for private.tutorialsdojo.com to the IP addresses of the two domain controllers. · E. Create an outbound endpoint on the Amazon Route 53 console. Set the AmazonProvidedDNS as the DNS resolver for the VPC.

A Route 53 Outbound Resolver endpoint forwards DNS queries from your VPC to your Managed Microsoft AD domain controllers. Associate it with a forwarding rule so instances using AmazonProvidedDNS can seamlessly resolve both custom domains and VPC interface endpoints.

Correct answer: B. Generate a migration readiness assessment report with the AWS Cloud Adoption Readiness Tool (CART) to highlight gaps in organizational skills and processes. · E. Use the AWS Transform discovery tool to gather information about the running virtual machines and running applications inside the servers. · F. Use AWS Transform migration assessment jobs and workspaces to estimate migration costs, generate right-sizing recommendations, produce reports, and support migration planning.

AWS Transform automates discovery and calculates migration cost estimates, while CART highlights organizational readiness gaps. On the exam, avoid confusing planning tools like these with execution services like Migration Hub or monitoring tools like X-Ray.

Correct answer: C. Use AWS Organizations to centrally manage all of your accounts. Group your accounts, which belong to a specific business unit, to individual Organization Units (OU). Create an IAM Role in the production account which has a policy that allows access to the EC2 instances including resource-level permission to terminate the instances owned by a particular business unit. Provide the cross-account access and the IAM policy to every member accounts of the OU.

Service Control Policies only set the maximum allowable permissions guardrails but never grant access. To actually allow specific business units to terminate their own resources, you must use IAM roles with resource-level permissions. This grants precise cross-account access.

Correct answer: A. Set up an IAM role with permissions to list and write objects to the S3 bucket. Attach the IAM role to the EC2 instance which will enable it to retrieve temporary security credentials from the instance metadata and use that access to upload the photos to the S3 bucket.

Attaching an IAM role to an EC2 instance allows applications to retrieve temporary credentials securely from instance metadata. This avoids embedding static credentials. User data is merely a launch script and cannot provide rotating credentials.

Correct answer: A. Replatform

The replatform strategy involves making a few cloud optimizations to achieve benefits without changing the core architecture. Moving to managed services like RDS perfectly fits this lift, tinker, and shift approach. Rehosting requires no architectural changes.

Correct answer: A. Modify the associated IAM Role assigned to the developers by removing the policy that allows them to terminate EC2 instances in production. · E. Add tags to the EC2 instances in the production environment and assign the developers a role with a policy that denies terminating the instance based on the tag.

Removing EC2 termination permissions directly enforces least privilege, while applying resource tags combined with an explicit deny IAM policy scales securely across environments. Remember that security groups manage network traffic, MFA only gates authentication, and PowerUserAccess still grants broad destructive permissions.

Correct answer: A. Create an IAM Role and assign the required permissions to read and write from the DynamoDB table. Have the instance profile property of the application instance reference the role.

Assigning an IAM role to an instance profile securely grants temporary credentials to applications running on EC2 instances. Never embed long-term IAM user access keys in user data or attempt to pass role ARNs through Systems Manager for authentication.

Correct answer: C. Generate a Public Certificate in ACM. Configure the Application Load Balancer to use the Public Certificate to handle HTTPS requests.

Public certificates provisioned in AWS Certificate Manager are free and integrate natively with Application Load Balancers to terminate HTTPS. Private certificates incur hourly operational costs for the certificate authority and public certificates cannot be exported to EC2 instances.

Correct answer: A. Enable S3 Transfer Acceleration on the central S3 bucket. Use the s3-accelerate endpoint to upload the images.

Amazon S3 Transfer Acceleration leverages Amazon CloudFront edge locations to route uploads over an optimized AWS network path, significantly improving global transfer speeds. CloudFront POST limits and basic multipart uploads fail to address continental latency effectively.

Correct answer: D. Set up a new S3 bucket with standard storage to store and serve the scanned files. Use Amazon OpenSearch Service for query processing and use Elastic Beanstalk to host the website across multiple availability zones.

Amazon S3 provides highly durable storage for the scanned files, while Amazon OpenSearch handles robust querying. Elastic Beanstalk simplifies web hosting across multiple availability zones. Option A fails because S3 alone lacks robust native search indexing capabilities.

Correct answer: B. Use CloudFront as a Content Delivery Network to load the articles much faster anywhere in the globe. · C. Use Amazon RDS Multi-AZ deployments with Read Replicas. Use S3 to store the static data such as the cover images and other media.

CloudFront provides low-latency global content delivery for readers. Amazon RDS Multi-AZ with Read Replicas offers high availability and read scaling, while S3 stores static media. Option D fails because EBS volumes lack the durability and scalability of S3.

Correct answer: B. On the CloudFormation template, create an AWS Secrets Manager secret resource for the database password. Modify the application to retrieve the database password from Secrets Manager when it launches. Use a dynamic reference for the secret resource to be placed as the value of the MasterUserPassword property of the AWS::RDS::DBInstance resource.

AWS Secrets Manager secures the password and handles automatic rotation. Using a dynamic reference in CloudFormation safely passes the value to RDS without exposing it. Option C fails because passing plain text parameters is highly insecure.

Correct answer: A. Authenticate using your on-premises SAML 2.0-compliant identity provider (IDP), retrieve temporary credentials using STS, and grant federated access to the AWS console via the AWS IAM Identity Center.

SAML 2.0 federation integrates on-premises identities with AWS via IAM Identity Center for console access. This avoids creating duplicate IAM users while maintaining secure single sign-on. Option B fails because AssumeRoleWithWebIdentity targets public identity providers, not corporate directories.

Correct answer: D. Use an SSL/TLS certificate provided by AWS Certificate Manager (ACM). · E. Configure the CloudFront origin to add a Cache-Control max-age directive to your objects and specify the longest practical value for max-age.

Using an SSL certificate from ACM secures custom domain traffic over HTTPS, while configuring Cache-Control max-age directives increases the cache hit ratio for better performance. Remember that Lambda@Edge customizes content but does not directly increase the cache hit ratio.

Correct answer: B. Create an Origin Access Control (OAC) and associate it with your CloudFront distribution. Change the permissions on your Amazon S3 bucket so that only the origin access control has read permission.

Creating an Origin Access Control and associating it with your CloudFront distribution ensures users can only access the S3 content via CloudFront. OAC is the modern replacement for Origin Access Identity and is the recommended best practice for securing S3 origins.

Correct answer: C. Create an Application Load Balancer (ALB) in the us-west-1 region that spans multiple Availability Zones (AZs) of the VPC. Create an Auto Scaling group that will deploy EC2 instances across the multiple AZs and place it behind the ALB. Set up the same configuration to the us-east-1 region VPC. Create record entries in Amazon Route 53 pointing to the ALBs with health check enabled and a failover routing policy.

Configuring a standalone Application Load Balancer and Auto Scaling group in each region with Route 53 failover routing properly establishes a passive backup. Remember that Auto Scaling groups and load balancers cannot span across multiple AWS regions.

Correct answer: D. Use CloudFront to add a custom header to all origin requests. Using AWS WAF, create a web rule that denies all requests without this custom header. Associate the web ACL to the Application Load Balancer. · E. Create a special CloudFront user called an origin access control (OAC) and associate it with your distribution. Configure the S3 bucket policy to only access from the OAC.

Use CloudFront Origin Access Control to restrict direct public access to the private S3 bucket. For the Application Load Balancer, configure CloudFront to pass a custom secret header, and use AWS WAF to block any requests missing it.

Correct answer: C. The third-party account should create an External ID that will be given to OrganizationA. The logistics company should then create an IAM role with the required access and put the External ID in the IAM role's trust policy. The third-party account should use the IAM role's ARN and External ID when requesting access to OrganizationA's AWS resources.

Using an External ID in the IAM role trust policy securely delegates cross-account access, preventing unauthorized third-party accounts from assuming the role. Sharing static IAM user credentials violates security best practices, and standard STS assumption lacks the required contextual verification.

Correct answer: B. Pull the messages from the on-premises Apache Kafka cluster by using a fleet of Amazon EC2 instances in an Auto Scaling Group. Send the data into an Amazon Kinesis Data Stream by using the Kinesis Producer Library. · C. To have consistent performance, request for an AWS Direct Connect connection from the on-premises data center to the AWS VPC. · F. Write an AWS Lambda function to process the Amazon Kinesis data stream and create a WebSocket API in Amazon API Gateway to invoke the function. Send the callback messages to connected clients by using the @connections command for the API.

Direct Connect provides the consistent, high-performance network required for critical production workloads. For the exam, remember that Kinesis Producer Library ingests data, while WebSocket APIs push real-time updates to clients, unlike AppSync GraphQL.

Correct answer: C. Use an AWS CloudFormation template to launch an Auto Scaling group of Amazon EC2 instances across multiple Availability Zones, which are all connected via an ELB to handle the load balancing. Leverage Amazon CloudFront for distributing your static content and an Amazon RDS instance with a Multi-AZ deployment configuration.

An Auto Scaling group across multiple Availability Zones with a load balancer provides the required scalability and high availability. For OLTP workloads, Multi-AZ RDS provides synchronous standby replication for fault tolerance, whereas Read Replicas only improve performance.

Correct answer: B. Use Amazon Macie to automatically discover, classify, and protect personally identifiable information (PII) data in the Amazon S3 bucket. Use a lifecycle policy in S3 to move the old photos to Infrequent Access storage class after a month. Re-configure the existing database to use RDS Multi-AZ Deployments.

Amazon Macie is the correct service to automatically discover and protect sensitive personally identifiable information in S3. RDS Multi-AZ provides high availability, and an S3 lifecycle policy to Standard-IA optimizes storage costs for less frequently accessed images.

Correct answer: D. Push web clicks by session to Amazon Kinesis and analyze behavior using Amazon Kinesis workers.

Kinesis Data Streams ingests massive real-time clickstream data, allowing workers to analyze user behavior instantly. Remember for the exam that batch-oriented services like SQS or EMR cannot provide the immediate sub-second response needed to dynamically alter page layouts.

Correct answer: C. Ensure that the NACL associated with the logging service subnet allows communication to and from the NLB subnets. Ensure that the NACL associated with the NLB subnets allows communication to and from the EC2 instances subnets running the logging service. · D. Ensure that the security group attached to the EC2 instances hosting the logging service allows inbound traffic from the NLB's security group. Also, ensure that the security group attached to the NLB allows inbound traffic from the interface endpoint subnet.

For AWS PrivateLink, the Network Load Balancer masks the original client IP, meaning target security groups must allow traffic from the NLB. Network ACLs are stateless and must explicitly allow bidirectional traffic between the endpoint, NLB, and target subnets.

Correct answer: D. Use AWS Directory Service to integrate your AWS resources with the existing Active Directory using trust relationship. Enable single sign-on using Managed Microsoft AD.

Managed Microsoft AD integrates with on-premises Active Directory by establishing forest trusts to extend single sign-on capabilities. While IAM Identity Center handles AWS access, AWS Directory Service is required to connect your existing domain. Cognito is for public apps.

Correct answer: B. In your VPC, launch a new web proxy server that only allows outbound access to the URLs provided by the proprietary e-commerce platform.

Proxy servers act as relays to filter outbound web requests based on specific URLs. This meets the requirement without breaking inbound connectivity. NAT gateways operate at the IP layer and cannot filter domain names or URLs.

Correct answer: D. First, create IAM users in the master account. Then in the Dev and Test accounts, generate cross-account roles that have full admin permissions while granting access for the master account.

Cross-account roles are created in the target accounts and specify the master account as a trusted entity. This delegates the necessary permissions without duplicating IAM users. Permissions cannot be inherited simply through consolidated billing.

Correct answer: D. Provision EC2 servers for both your JBoss application and Oracle database, and then restore the database backups from an S3 bucket. Also provision an EBS volume containing static content obtained from Storage Gateway, and attach the volume to the JBoss EC2 server.

Provisioning Amazon EBS volumes directly from Storage Gateway snapshots provides the fastest recovery path and lowest RTO for static files. Avoid AWS Storage Gateway-VTL or Amazon Glacier for urgent disaster recovery scenarios, as their retrieval times are significantly slower.

Correct answer: C. You can use a forward web proxy server in your VPC and manage outbound access using URL-based rules. Default routes are also removed.

Deploying a forward web proxy allows you to filter outbound VPC traffic using specific URL domains. Security groups and network ACLs operate at the network layer and cannot inspect HTTP URLs, making them ineffective for domain-based content filtering.

Correct answer: D. 1. Set the DeletionPolicy on the S3 resource declaration in the CloudFormation template to Retain. 2. Set the RDS resource declaration DeletionPolicy to Snapshot.

Setting the S3 DeletionPolicy to Retain preserves the bucket during stack deletion. Setting RDS to Snapshot backs up the database and stops compute costs when idle. Option B fails because retaining the RDS instance incurs unnecessary charges during the year.

Correct answer: B. This is due to encryption overhead when copying files to the Snowball Edge device. Open multiple sessions to the Snowball Edge device and initiate parallel copy jobs to improve the overall copying throughput.

Copying millions of small files to Snowball Edge incurs heavy encryption overhead per file. Running multiple parallel copy jobs across terminal sessions drastically improves throughput. Option C fails because clustering increases storage and durability, not single-file transfer speeds.

Correct answer: C. Create a NAT gateway then specify its corresponding subnet and Elastic IP address. Update the route tables of the private subnet to point the Internet traffic to the NAT gateway.

A managed NAT gateway provides better availability and bandwidth automatically, requiring no administrative effort compared to a NAT instance. For the exam, remember that egress-only internet gateways are strictly for IPv6 traffic, not IPv4.

Correct answer: C. Deploy the Java application on Amazon EC2 instances within an Auto Scaling group spanning multiple Availability Zones. Migrate the MongoDB database to Amazon DocumentDB (with MongoDB compatibility) across multiple Availability Zones.

Deploying the Java application on EC2 instances in an Auto Scaling group and migrating the database to Amazon DocumentDB across multiple Availability Zones meets all requirements. DocumentDB is crucial here because it offers MongoDB compatibility without requiring application code changes.

Correct answer: A. The MNL-EUR.config and MNL-ASIA.config files will have a Version ID of null. · E. There would be two available versions for each of the MNL-NA.config, MNL-LA.config, and MNL-O.config files. The first Version ID of MNL-NA.config and MNL-LA.config has a value of null.

When S3 versioning is enabled, existing objects receive a version ID of null, while any new uploads or updates get a unique alphanumeric version ID. A practical exam cue is that versioning does not apply retroactively to unmodified objects.

Correct answer: D. The availability zone that is not receiving traffic was not associated with the application load balancer.

If an Availability Zone is not associated with the Application Load Balancer, instances in that zone will not receive any traffic. For the exam, remember that Auto Scaling groups can span multiple zones, but the load balancer must be explicitly configured to route traffic there.

Correct answer: C. Run the web and application tiers in stateless instances in an autoscaling group, using Amazon ElastiCache Serverless for tier synchronization and CloudWatch for monitoring. Run the database tier using RDS with read replicas, and Multi-AZ enabled.

Running stateless instances in an Auto Scaling group with Amazon ElastiCache Serverless and an RDS database with read replicas and Multi-AZ provides the best scalability and availability. A key exam cue is that stateful instances cannot scale dynamically without losing session data.

Correct answer: D. Create an Auto-scaling group of spot instance workers that scale according to the queue depth in SQS to process job messages. After the data has been processed, transfer your S3 objects to Amazon Glacier.

Using an Auto Scaling group of Spot Instances driven by Amazon SQS queue depth handles asynchronous photo processing at a low cost. Transitioning the processed Amazon S3 objects to Amazon S3 Glacier provides the required long-term archival storage.

Correct answer: D. Write an AWS CloudFormation template that contains the AWS::SageMaker::NotebookInstance resource type to launch a Jupyter notebook instance with a preconfigured KMS key. Create Mappings on the CloudFormation to map simpler parameter names for instance sizes such as Small, Medium, Large. Reference the URL of the notebook instance on the Outputs section of the template. Create a portfolio in AWS Service Catalog and upload the template to be shared with the IAM role of the data scientists.

AWS Service Catalog provides a secure self-service portal that allows data scientists to launch predefined Amazon SageMaker AI environments. This approach abstracts complex AWS configuration details while centrally enforcing mandatory security controls like KMS encryption.

Correct answer: D. Use AWS IoT Core Basic Ingest for data collection. Configure an AWS IoT rule action to send data to Amazon Data Firehose. Set up Data Firehose with an AWS Lambda function for data enrichment and a buffer interval of 300 seconds.

AWS IoT Core Basic Ingest routes messages directly to the Rules Engine, minimizing messaging costs. Routing this data to Amazon Data Firehose provides a fully managed pipeline to batch the incoming sensor data, seamlessly run AWS Lambda transformations, and deliver it to Amazon S3.

Correct answer: B. Store the order information on an Amazon DynamoDB table. Create an AWS Step Functions workflow that will be triggered for every new order. Have the workflow mark the order as "in progress" and print the shipping label for the package. Once the package is scanned and leaves the warehouse, trigger an AWS Lambda function to mark the order as "shipped" and complete the Step Functions workflow.

Step Functions provides the serverless orchestration needed to track the multi-step order workflow, while DynamoDB stores the order state. Polling SQS introduces unnecessary delays, and using EC2 with EFS violates the serverless and low-operational-overhead requirements.

Correct answer: A. Ensure that the trust policy of the IAM roles created for the federated users or groups has set the SAML provider as principal. · C. Ensure that the appropriate IAM roles are mapped to company users and groups in the IdP's SAML assertions. · D. Ensure that the ARN of the SAML provider, the ARN of the created IAM role, and SAML assertion from the IdP are all included when the federated identity web portal calls the AWS STS AssumeRoleWithSAML API.

SAML federation requires mapping IdP groups to IAM roles, setting the SAML provider as the role principal, and passing all required ARNs to STS. Federated users do not need IAM policies directly attached, and VPC connectivity is irrelevant to browser-based SAML SSO.

Correct answer: C. Create a shared transit gateway. Have each spoke VPC connect to the transit gateway. In a central VPC, deploy a Gateway Load Balancer (GWLB) that fronts a fleet of firewall appliances with routing to the public internet.

AWS Transit Gateway connects thousands of VPCs without managing complex peering limitations. Deploying a Gateway Load Balancer in a central VPC lets you scale firewall appliances for centralized egress inspection. VPC peering fails here because strict connection limits prevent scaling to thousands of accounts.

Correct answer: B. As more customers are sending data, adjust the Write Capacity Unit (WCU) of the DynamoDB table to be able to accommodate all the write requests being processed by the Lambda functions. · E. Process the data in batches to avoid reaching the write limits to the DynamoDB table. Group the requests from API Gateway by streaming the data into an Amazon Kinesis data stream.

DynamoDB throws a provisioned throughput error when write capacity is exceeded, so increasing WCUs fixes that bottleneck. To prevent Lambda concurrency limits, stream API Gateway payloads into Kinesis, allowing Lambda to process data in resilient batches.

Correct answer: A. Combine an Elastic Load balancer in front of an Auto Scaling group of web servers with Amazon CloudFront for fast delivery. The web servers will first authenticate the users by logging into their social media accounts which are integrated in Amazon Cognito, then process the user's purchases and store them into an Amazon SQS queue using IAM Roles for Amazon EC2 Instances to gain permissions to the queue. Finally, the items from the queue are retrieved by a set of application servers and stored into an Amazon DynamoDB table.

CloudFront, a load balancer, and an Auto Scaling group handle sudden traffic spikes for the web tier. Decoupling the checkout process using an SQS queue buffers incoming requests, protecting the backend DynamoDB database during massive usage surges.

Correct answer: C. Check and configure the network ACL to allow communication between the two subnets. Ensure that the security groups allow the application host to talk to the database on the right port and protocol. · E. Use AWS Config to track historical changes to the security configurations associated to your instances.

Configuring security groups and network ACLs properly permits traffic between the application and database subnets. AWS Config is the designated service for tracking historical resource configuration changes, whereas Systems Manager handles operational tasks.

Correct answer: B. 1. Enable CloudTrail logging to required AWS resources. 2. Create an IAM user with read-only permissions to the required AWS resources. 3. Provide the access credential to the auditor.

AWS CloudTrail records API calls and account events for auditing. You grant external auditors access by creating an IAM user with read-only permissions to the CloudTrail S3 bucket. Option A fails because you manage audits directly without AWS intervention.

Correct answer: A. Take hourly database backups and export to an S3 bucket with transaction logs stored in S3 every 5 minutes. Set up a Cross-Region Replication (CRR) to another AWS Region. · D. Set up an AWS Backup plan for the Amazon RDS database with the continuous backups for point-in-time recovery (PITR) option enabled

AWS Backup with continuous backups enables point-in-time recovery to meet strict recovery objectives. Exporting hourly snapshots and transaction logs to S3 with cross-region replication provides offsite disaster recovery. Option B fails because Glacier retrieval times exceed the required time.

Correct answer: B. SSE-S3 provides strong multi-factor encryption in which each object is encrypted with a unique key. It also encrypts the key itself with a master key that it rotates regularly.

SSE-S3 provides strong encryption where Amazon S3 encrypts each object with a unique key and encrypts that key with a regularly rotated master key. A quick exam cue is that if you need to manage the keys yourself, you must choose SSE-KMS, not SSE-S3.

Correct answer: A. Create a new S3 bucket in US West (N. California) region and upload the files. Use S3 pre-signed URLs to ensure that only their client can access the files. Remove permission to use Amazon S3 URLs to read the files for anyone else. · C. Use CloudFront signed URLs to ensure that only their client can access the files. Create an origin access control (OAC) and give it permission to read the files in the bucket. Remove permission to use Amazon S3 URLs to read the files for anyone else.

Using S3 pre-signed URLs directly restricts file access, while using CloudFront signed URLs with an origin access control restricts content to CloudFront. Remember that signed cookies are better for multiple files, but do not secure direct S3 access without further restrictions.

Correct answer: D. Migrate the database to a cluster of EBS-backed Amazon EC2 instances across multiple AZs. Automate the creation of EBS snapshots from EBS volumes of the EC2 instance by using Amazon Data Lifecycle Manager. Install the SSM Agent to the EC2 instance and automate the patch management process using AWS Systems Manager Patch Manager.

Since Amazon RDS does not support Oracle Real Application Clusters, you must deploy the database on Amazon EC2. You can then use AWS Systems Manager Patch Manager to automate operating system updates and Amazon Data Lifecycle Manager for scheduled EBS snapshots.

Correct answer: C. The canonical name record (CNAME) is changed from the primary database to standby database.

During an Amazon RDS Multi-AZ failover, AWS automatically updates the DNS canonical name record to point to the standby instance. Applications seamlessly reconnect using the same endpoint without needing manual IP address reconfiguration.

Correct answer: A. Use AWS WAF to define customizable web security rules that control which traffic can access your web applications. · C. Use AWS Shield Advanced which provides enhanced DDoS attack detection and monitoring for application-layer traffic to your AWS resources.

AWS Shield Advanced provides managed DDoS protection and detailed attack notifications for network and transport layer threats. AWS WAF complements this by inspecting HTTP requests to block layer seven exploits like SQL injection.

Correct answer: C. Configure Amazon API Gateway with the required resources and methods. Create unique Lambda functions to process each resource and configure the API Gateway methods with proxy integration to the respective Lambda functions. Control user access to the API by using Amazon Cognito user pools. Store service object metadata in an Amazon DynamoDB table with Auto Scaling enabled. Create a secured Amazon S3 bucket to store the static content. Generate presigned URLs when referencing objects stored on the S3 bucket.

API Gateway with Lambda proxy integration provides a serverless REST API, and Cognito user pools handle authentication without custom code. Fargate incurs higher baseline costs than Lambda, and custom authorizers add unnecessary operational overhead compared to managed pools.

Correct answer: B. Use AWS Systems Manager Patch Manager to manage and deploy the security patches of your EC2 instances based on the patch baselines from your on-premises data center. Install the SSM Agent to all of your instances and automate the patching schedule by using AWS Systems Manager Maintenance Windows.

Patch Manager automates OS patching using custom baselines, while Maintenance Windows schedule these disruptive tasks safely. Session Manager only provides shell access, and writing custom Lambda scripts to run commands requires unnecessary operational overhead.

Correct answer: A. Configure an IAM policy that authorizes access to the certificate store only for the cybersecurity team and then add a configuration to terminate the SSL on the ELB.

Configuring IAM policies restricts access to the ACM certificates, while ELB SSL termination ensures private keys never touch EC2 instances. Uploading certificates to S3 is insecure, and SCPs only set guardrails without granting actual resource access permissions.

Correct answer: A. Configure a Challenge-Handshake Authentication Protocol (CHAP) to authenticate iSCSI and initiator connections.

Configuring Challenge-Handshake Authentication Protocol secures iSCSI connections by periodically verifying the initiator identity, preventing replay attacks. CHAP does not apply to NFS connections, and changing gateway types does not resolve underlying protocol vulnerabilities.

Correct answer: B. Set up an architecture where the mobile app will send the user's location to an Amazon SQS queue, and a fleet of On-Demand Amazon EC2 instances will retrieve the relevant offers from an Amazon DynamoDB table. Once the data has been processed, use AWS SNS Mobile Push to send out the offers to the mobile app.

Amazon SNS Mobile Push delivers messages directly to mobile endpoints, making it ideal for sending timely real estate alerts globally. AWS Device Farm is strictly for testing, and relational databases like RDS or Aurora lack the necessary scalability for global user profiles.

Correct answer: B. Authenticate against LDAP using an identity broker you created, and have it call IAM Security Token Service (STS) to retrieve IAM federated user credentials. The application then gets the IAM federated user credentials from the identity broker to access the appropriate S3 bucket. · C. The application first authenticates against LDAP to retrieve the name of an IAM role associated with the user. It then assumes that role via a call to IAM Security Token Service (STS). Afterward, the application can now use the temporary credentials from the role to access the appropriate S3 bucket.

Authenticating users against LDAP and using an identity broker to assume IAM roles via STS securely grants temporary S3 access. You cannot use LDAP credentials to log in to IAM directly, and Direct Connect modifications do not resolve application-level authentication requirements.

Correct answer: A. Register the IoT devices to AWS IoT Device Management and monitor the devices' health and ensure the devices are connected to AWS IoT Core.

AWS IoT Device Management allows administrators to register, organize, monitor, and remotely manage IoT devices at scale to troubleshoot connectivity. Device Defender is strictly for security audits and anomaly detection, meaning it will not help you diagnose fleet health or resolve interrupted connections.

Correct answer: D. Store all recordings in an Amazon S3 bucket. Create an S3 lifecycle policy to move objects older than 90 days to Amazon S3 Glacier. Create an AWS Lambda trigger to start a transcription job using Amazon Transcribe. Update the web portal so it can be hosted on an Amazon S3 bucket, Amazon API Gateway, and AWS Lambda.

Storing files in Amazon S3 with a lifecycle policy to Glacier directly satisfies the cheap long-term storage requirement. Using Lambda to trigger Amazon Transcribe automates speech-to-text processing, avoiding unnecessary EC2 fleets. Distractors incorrectly suggest AWS IQ for automation or Amazon Translate, which only handles text translation, not audio.

Correct answer: D. Migrate the database using the AWS Database Migration Service and use a Cold HDD (sc1) EBS volume.

Cold HDD volumes provide low-cost magnetic storage that defines performance in terms of throughput rather than IOPS. This makes them the ideal choice for infrequently accessed, throughput-oriented workloads. Throughput Optimized HDD is for frequently accessed data, making it a less cost-effective distractor here.

Correct answer: A. You can use one S3 source bucket that is partitioned according to the month a blog entry was submitted, and store the entry in that partition. Create a CloudFront distribution with access permissions to S3 and is restricted only to it.

Partitioning data by upload month in a single S3 bucket allows you to easily apply different cache behaviors based on object age. Restricting an Origin Access Identity to the bucket ensures secure access. Duplicating data or forcing minimum TTLs is inefficient.

Correct answer: C. Create an Oracle database in Amazon RDS with Multi-AZ deployments.

Amazon RDS Multi-AZ deployments provide high availability by synchronously replicating data to a standby instance in a different Availability Zone. Read Replicas fail this requirement because content writers cannot upload to the database if the primary node goes down.

Correct answer: D. On the backup region, create a scaled-down version of the fully functional environment with one Amazon EC2 instance of the web server and application server in their own Auto Scaling groups behind Application Load Balancers. Create a standby database instance that replicates data from the primary database. In case of disaster, scale the instances to meet the demand and update the Amazon Route 53 record to point to the backup region.

A warm standby disaster recovery strategy uses a scaled-down but fully functional replica of the primary environment to meet tight recovery time objectives. This approach satisfies the five-minute failover requirement while avoiding the high continuous costs of a fully redundant multi-site active-active deployment.

Correct answer: D. Configure a reserved concurrency limit for the new function to ensure that its executions will not exceed this limit. Use Amazon CloudWatch alarms to monitor the Throttles metric for Lambda functions to ensure that the concurrency limit is not being reached.

Configuring reserved concurrency caps the maximum concurrent executions for this specific function, guaranteeing capacity remains available for critical workloads. Backoff algorithms or timeouts still consume invocation slots, and moving to a separate account introduces unnecessary operational overhead.

Correct answer: E. Use AWS CloudFormation to manage the cloud architecture and Amazon CloudFront as the CDN.

CloudFormation is the recommended service for managing AWS infrastructure as code, enabling safe rollback and environment staging. CloudFront is the correct global content delivery network service, whereas CloudWatch is strictly a monitoring and observability platform.

Correct answer: C. 3. Use an AWS CloudHSM instance to perform the SSL transactions.

Configuring TCP load balancing on the ELB passes SSL traffic directly to AWS CloudHSM, keeping private keys secure in dedicated hardware. For the exam, remember that S3 is an insecure place to store private keys and CloudHSM provides FIPS-compliant hardware protection.

Correct answer: C. Configure an Auto Scaling group and attach it to the NLB. Set the minimum capacity to 5 instances and the maximum capacity to 30. Purchase Reserved Instances for 5 instances.

An Auto Scaling group attached to the load balancer dynamically adjusts capacity to handle performance spikes while keeping baseline costs low. Purchasing Reserved Instances for the baseline capacity ensures long-term cost optimization compared to paying strictly On-Demand rates.

Correct answer: D. On VPC-A, add a static route for VPC-B CIDR (10.0.0.77/32) with the target pcx-aaaabbbb and another static route for VPC-C CIDR (10.0.0.0/16) with the target pcx-aaaacccc. On VPC-B, add a static route for VPC-A CIDR (172.16.0.0/16) with the target pcx-aaaabbbb. On VPC-C, add a static route for VPC-A CIDR (172.16.0.0/16) with the target pcx-aaaacccc.

Using a /32 static route in VPC-A leverages the longest prefix match to direct traffic to the specific database instance in VPC-B. The broader /16 route safely handles all other overlapping traffic by sending it to VPC-C. Distractors fail because network ACLs cannot redirect traffic.

Correct answer: B. Enable Amazon S3 Block Public Access in the S3 bucket.

Amazon S3 Block Public Access provides centralized controls that override policies to prevent public access with minimal configuration. Exam cue: for questions asking to secure S3 data effortlessly, Block Public Access almost always beats complex IAM policies or Config rules.

Correct answer: D. Create another Customer Gateway in a different data center and set up another dual-tunnel VPN connection.

Creating another Customer Gateway in a different data center provides redundancy for the on-premises VPN endpoint, ensuring fault tolerance. Exam cue: a virtual private gateway is already highly available across Availability Zones, so focus on the customer side for redundancy.

Correct answer: C. Create an Amazon DynamoDB global table to store the semi-structured data in two Regions. Use on-demand capacity mode to allow DynamoDB scaling. Run the web service on an Auto Scaling Amazon ECS Fargate cluster in each region. Place each Fargate cluster behind its own Application Load Balancer (ALB). Create Amazon Route 53 Alias records pointed to each ALB using a latency routing policy with health checks enabled.

DynamoDB global tables provide multi-active read and write replication across regions, and on-demand capacity handles sudden load spikes automatically. Fargate allows rapid container scaling, and Route 53 latency routing ensures users hit the fastest healthy regional endpoint.

Correct answer: D. Set up a DynamoDB stream to detect the new entries and automatically trigger the Lambda function.

DynamoDB Streams capture item-level modifications, providing a native event source to trigger your Lambda function automatically. This requires minimal configuration compared to complex alternatives like migrating databases or building SNS fan-out architectures.

Correct answer: C. Migrate the database from the Amazon EC2 instance to an Amazon Aurora global database. Set the us-east-1 region as the primary database and the us-west-2 region as the secondary database. Configure Amazon Route 53 DNS entry with health checks and failover routing policy to the us-west-2 region.

Amazon Aurora Global Database provides storage-based replication with typical cross-region latency under one second, meeting strict recovery objectives. Route 53 failover routing shifts traffic to the secondary region during a disaster.

Correct answer: B. Reconfigure the existing web servers to publish messages to a standard queue on Amazon SQS. Create an Auto Scaling group of Amazon EC2 instances that will pull requests from the queue and process the media files. Configure the Auto Scaling group to scale based on the length of the SQS queue. Send the processed media files to an Amazon S3 bucket.

An Auto Scaling group of EC2 instances scales based on SQS queue depth, handling the bursty workload effectively. AWS Lambda is incorrect here because its 15-minute maximum execution timeout cannot support the 30-minute processing requirement.

Correct answer: C. Configure the CloudFront distribution to redirect HTTP to HTTPS protocol. Generate a new SSL certificate on AWS Certificate Manager and use it as the CloudFront distribution and origin certificate.

Using an AWS Certificate Manager certificate on both CloudFront and the Application Load Balancer origin provides seamless end-to-end encryption. Configuring the distribution to redirect HTTP to HTTPS guarantees viewer connections are secured. CloudFront default certificates cannot serve custom domain names.

Correct answer: C. Configure CloudFront to use its default SSL/TLS certificate by changing the Viewer Protocol Policy setting for one or more cache behaviors to require HTTPS communication. · E. Set the Viewer Protocol Policy< to use Redirect HTTP to HTTPS or HTTPS Only.

When using the default CloudFront domain name, you can enforce viewer-side HTTPS by configuring the Viewer Protocol Policy to Redirect HTTP to HTTPS or HTTPS Only. In this specific configuration, CloudFront automatically provides and uses its default SSL certificate.

Correct answer: A. Configure authorization to use AWS_IAM for the API Gateway method. Create the IAM users or roles that have the execute-api:Invoke permission to the ARN of the API resource. Enable request signing with AWS Signature for every call to the API endpoint. Trace and analyze each user request on API Gateway by using AWS X-Ray.

Configuring AWS_IAM authorization on the API Gateway method ensures only validated identities can invoke the endpoint. AWS X-Ray is the correct tool here because it specifically traces requests end-to-end and generates service maps, whereas CloudWatch Logs only captures operational metrics.

Correct answer: B. Create an Amazon S3 bucket with website hosting enabled and upload the game package on it. Create an Amazon CloudFront distribution with the S3 bucket as the origin. Create an Amazon Route 53 entry pointing to the CloudFront distribution. Publish the Route 53 entry as the download URL to allow users to download the game package.

Serving the package through CloudFront with an S3 origin provides a highly cost-effective, globally distributed caching layer for massive download spikes. Using Requestor Pays is a strong distractor, but it requires users to have their own AWS accounts, which ruins the public experience.

Correct answer: B. Increase the capacity and scaling thresholds of the Auto Scaling group to allow the application servers to scale up across all Availability Zones, which will lower the aggregate utilization of the EC2 instances. Use Reserved Instances to handle the steady-state load and a combination of On-Demand and Spot Instances to process the peak load. When the peak usage is over, scale down the number of the On-Demand and Spot instances.

Configuring diverse Auto Scaling policies across multiple Availability Zones ensures your application dynamically scales to handle unexpected regional failures. Blending Reserved Instances for the baseline with On-Demand and Spot capacity for peak traffic provides the optimal cost-effective architecture.

Correct answer: D. Provision an AWS Storage Gateway – file gateway appliance on the on-premises data center. Configure the MAM solution to extract the video files from the current tape archives and move them to the file gateway share which is then synced to Amazon S3. Use Amazon Rekognition to build a collection based on the videos by using the catalog of people's faces and names. Create an AWS Lambda function that will invoke Rekognition to pull the video files from the S3 bucket, retrieve the generated metadata and then push it to the MAM solution search catalog.

A file gateway seamlessly syncs the tape archives to S3 via standard protocols with minimal operational overhead. Amazon Rekognition then processes the videos directly to extract metadata without custom machine learning infrastructure.

Correct answer: D. Set up a CloudFront distribution to cache objects from a custom origin to offload traffic from your on-premises environment. Customize your object cache behavior, and choose a time-to-live that will determine how long objects will reside in the cache.

Amazon CloudFront caches content at edge locations, offloading unexpected traffic bursts from on-premises servers without complex migrations. Practical cue: when dealing with unpredictable on-premises bursts and tight timelines, leverage a content delivery network to absorb the load.

Correct answer: C. Add read replicas for the RDS database to speed up batch analytics and use Amazon SNS to notify the on-premises system to update the dashboard.

Adding Amazon RDS Read Replicas offloads the heavy batch analytics reads, freeing up the primary database for CRM traffic. Amazon SNS provides a push mechanism to trigger the SMTP email notification, whereas SQS requires polling to automate updates.

Correct answer: A. Use AWS Systems Manager Patch Manager to deploy the OS security patches on the EC2 instances. Use AWS Config to manage, detect and record the security compliance of the EC2 instances.

Systems Manager Patch Manager automates operating system patch deployments, while AWS Config continuously records configurations to track patch compliance. State Manager handles desired state configurations but lacks the dedicated patching baseline features required here.

Correct answer: C. Schedule a daily snapshot of the Amazon EC2 instances for the web and application tier. Copy the snapshot to the backup region. Restore the backups in case of a disaster in the primary region. · E. Set up a cross-Region read replica of the Amazon Aurora database to the backup region. Promote this read replica as the master database in case of a disaster in the primary region.

Copying EC2 snapshots to the backup region provides a cost-effective pilot light recovery for stateless tiers within the thirty minute recovery objective. Aurora cross-region read replicas meet the strict five minute recovery point objective by asynchronously replicating data continuously.

Correct answer: D. Add an AWS CodeBuild stage on the deployment pipeline to automatically test on a non-production environment. Leverage change sets on AWS CloudFormation to preview changes before applying to production. Set up a blue/green deployment pattern on AWS CodeDeploy to deploy changes on a separate environment and to quickly rollback if needed.

Integrating CodeBuild automated testing, CloudFormation change sets for safe previews, and CodeDeploy blue-green deployments creates a resilient pipeline that minimizes downtime. Manual testing or relying solely on cfn helper scripts introduces human error and does not guarantee safe automated rollbacks.

Correct answer: D. Use the AWS Application Discovery Service to gather data about your on-premises data center and perform the TCO analysis.

Application Discovery Service collects configuration and utilization data from on-premises servers to calculate total cost of ownership for migrations. Migration Hub tracks ongoing migrations, while Application Migration Service executes the lift-and-shift but lacks planning discovery features.

Correct answer: D. Decouple the application and database tier by creating an Amazon SQS queue between them. Create an AWS Lambda function that picks up the messages on the SQS queue and writes them into the database.

Decoupling the application from the database with an SQS queue buffers high volumes of writes during traffic spikes, ensuring no submissions are lost. ElastiCache is a poor distractor because it only accelerates read performance rather than handling persistent write buffering.

Correct answer: C. On the Amazon Aurora cluster's security group, create an inbound rule with the source as the Amazon EC2 instances' security group using the default Aurora port 3306. · E. On the Amazon EC2 instances' security group, create an outbound rule with the destination as the DB cluster's security group using the default Aurora port 3306.

Configuring outbound traffic on the EC2 security group and inbound traffic on the database security group enforces least privilege. Referencing security groups directly maintains strict isolation, unlike network ACLs which use broad CIDR blocks and operate statelessly.

Correct answer: C. Configure a Canary deployment configuration for your Lambda function. Enable active tracing to integrate AWS X-Ray to your AWS Lambda function.

A Canary deployment shifts traffic in two increments, matching the requested ten percent followed by the remaining ninety percent. AWS X-Ray traces invocations and downstream calls. Linear shifts traffic in equal increments.

Correct answer: B. Create an Amazon SQS queue and develop a consumer process to flush the queue to the on-premises database server. Update the application to enable writing to the SQS queue.

Amazon SQS decouples the application writes from the on-premises database, absorbing bursts without causing erratic behavior. Since the system uses an eventual consistency model, temporary queuing is perfectly acceptable and highly cost-effective.

Correct answer: A. For both the master and core nodes, use On-Demand EC2 instances. For the task nodes, use Spot EC2 instances.

Using On-Demand Instances for EMR master and core nodes guarantees data integrity and cluster stability during the 48-hour run. Spot Instances are optimal for task nodes because they handle transient compute capacity without risking critical data loss.

Correct answer: C. Using AWS CLI, create a new KMS key with no key material and use EXTERNAL as the origin of the key. Generate a key from the on-premises HSMs and import it as KMS key using the public key and import token from AWS. Apply an Amazon S3 bucket policy on the central logging bucket to require AWS KMS as the encryption source and deny unencrypted object uploads.

Creating a KMS key with an external origin allows you to securely import key material generated by your own on-premises Hardware Security Modules. Applying an S3 bucket policy enforcing SSE-KMS ensures all uploaded logs comply with strict regulatory encryption requirements.

Correct answer: G. Create an Amazon S3 bucket to store all data. Enable server-side encryption with AWS KMS (SSE-KMS). Apply a bucket policy that enforces HTTPS only connections to the S3 bucket.

Storing data in an Amazon S3 bucket with server-side encryption using AWS KMS satisfies the requirement for customer-managed keys. Applying a bucket policy that denies non-HTTPS requests secures data in transit. This approach provides the highest durability and lowest maintenance for large files compared to EC2 or DynamoDB.

Correct answer: E. Create an Amazon CloudWatch Alarm to monitor the FreeStorageCapacity metric of the file system. Write an AWS Lambda Function to increase the capacity of the Amazon FSx for Windows File Server file system using the update-file-system command. Utilize Amazon EventBridge to invoke this Lambda function when the metric threshold is reached.

An EventBridge rule can automatically trigger a Lambda function when a CloudWatch alarm detects low free storage capacity. The function uses the update-file-system API to expand Amazon FSx storage transparently. This prevents future outages without requiring a complex data migration to a new file system.

Correct answer: B. Have CloudFront enable caching of re-usable content from your website. · E. Add a caching layer using Amazon ElastiCache Service to be used for storing sessions and frequent DB queries.

Amazon CloudFront caches reusable static and dynamic content at global edge locations to reduce latency for users. Adding Amazon ElastiCache offloads frequent database queries, reducing database load. Lowering the Auto Scaling threshold merely provisions more compute power without addressing core latency.

Correct answer: B. Utilize AWS CloudFormation as the deployment service to deploy the needed AWS resources such as an Amazon S3 bucket for storage, OpenSearch to provide the needed search functionality, and an Amazon EC2 instance to host their website.

Amazon S3 provides highly durable and cost-effective object storage for the massive 50 TB dataset. Amazon OpenSearch easily integrates with the dynamic website to provide robust full-text search capabilities. Using Amazon RDS for this specific text search requirement would be unnecessarily expensive.

Correct answer: G. Reconfigure the pipeline to create a Staging environment on AWS Elastic Beanstalk. Deploy the newer version on the Staging environment. Swap the Staging and Production environment URLs to shift traffic to the newer version.

Using Elastic Beanstalk to deploy a new staging environment allows you to validate the new application version safely. Swapping the CNAMEs instantly shifts traffic to achieve a blue-green deployment. This strategy provides rapid rollbacks by simply reversing the URL swap process.

Correct answer: A. Improve the network performance of each node by using Amazon EC2 instances with an Elastic Fabric Adapter (EFA) network interface. · C. Improve the storage performance by implementing Amazon FSx for Lustre instead of using Amazon EFS. · D. Improve the performance by placing all the compute nodes as close to each other. Re-launch all the Amazon EC2 instances within a single Availability Zone in a cluster placement group.

For tightly coupled HPC workloads, cluster placement groups, Elastic Fabric Adapters, and FSx for Lustre are the standard high-performance choices. EFS lacks the necessary throughput for intensive simulations, and spreading instances across AZs introduces latency.

Correct answer: C. Set up AWS Service Catalog to tag the provisioned resources with corresponding unique identifiers for portfolio, product, and users. · E. Set up the CloudFormation Resource Tags property to apply tags to certain resource types upon creation.

CloudFormation natively enforces tags during infrastructure deployment, and Service Catalog enforces tagging rules for self-service provisioning. Avoid reactive tools like AWS Config for tagging; prioritize proactive Infrastructure as Code solutions.

Correct answer: D. Configure Traffic Mirroring on the elastic network interface of the EC2 instances. Send the mirrored traffic to a monitoring appliance for storage and inspection.

VPC Traffic Mirroring copies actual network packets from EC2 interfaces to security appliances for deep payload inspection. VPC Flow Logs and ALB access logs only provide metadata and header information, not the packet payload required for reverse-engineering attacks.

Correct answer: A. Use an SQS queue to decouple messages from the application and the database.

Using an SQS queue decouples the application from the database, allowing messages to buffer smoothly during traffic spikes. Increasing write-capacity units is a valid distractor for performance, but the prompt specifically asks for the most cost-effective load reduction strategy.

Correct answer: C. Set up AWS WAF and AWS Shield Advanced on all web endpoints. Launch AWS WAF rules against SQL injection and other common web exploits.

Deploying AWS WAF and Shield Advanced provides scalable, managed protection against sophisticated DDoS attacks, SQL injection, and HTTP floods. Blocking specific IP addresses manually via network ACLs is easily bypassed by distributed attackers and fails to address automated bot traffic.

Correct answer: A. Use On-Demand EC2 instances for both the master and core nodes and use Spot EC2 instances for the task nodes.

For transient EMR clusters, you should use On-Demand instances for master and core nodes to guarantee cluster stability and HDFS data persistence. Spot instances are perfect for optional task nodes, providing cheap compute capacity that can handle processing without risking the cluster.

Correct answer: B. An AWS Direct Connect link between the VPC and the network housing the internal services. · D. A network device in your data center that supports Border Gateway Protocol (BGP) and BGP MD5 authentication.

AWS Direct Connect establishes a dedicated, private network connection between your on-premises data center and your VPC. Setting this up requires a customer gateway device that supports Border Gateway Protocol to handle dynamic routing over the virtual interfaces.

Correct answer: C. Write a Lamda@Edge function that will normalize the query parameters by sorting them in alphabetical order and converting them into lower case. Deploy this function with the CloudFront distribution and set "viewer request" as the trigger to invoke the function.

A Lambda@Edge viewer request function can normalize query strings before CloudFront caches the object, which directly fixes the cache miss problem. CloudFront has no native case-insensitive caching setting, so origin-side proxies fail because the edge cache is already bypassed.

Correct answer: C. Set up a Tape Gateway to back up your data in Amazon S3 and archive it in Amazon Glacier using your existing tape-based processes.

Tape Gateway provides a virtual tape library interface, letting you use existing on-premises backup software to seamlessly archive data directly into Amazon S3 Glacier. File and Volume Gateways fail because they do not integrate with tape-based backup infrastructure.

Correct answer: A. Enable Amazon Macie on the S3 buckets to automatically classify the data and detect any objects with personally identifiable information (PII). Determine if the objects with PII have been recently accessed by tracking the GET API calls in AWS CloudTrail.

Amazon Macie uses machine learning to automatically discover and classify sensitive data like PII stored in Amazon S3. CloudTrail tracks the GET API calls to determine access. Inspector only assesses EC2 vulnerabilities, not S3 data.

Correct answer: C. Create a new member account in AWS Organizations. Enable AWS Security Hub and designate the account as the delegated administrator.

AWS Security Hub centrally aggregates compliance and security findings across organizational accounts using a delegated administrator. GuardDuty alone lacks comprehensive preventive controls. CloudTrail Lake only captures API events without native compliance mapping.

Correct answer: B. Store I/O files in S3 instead and use SQS to facilitate a group of hosts working in parallel. Include the hosts in an auto scaling group that scales accordingly to the length of your SQS queue.

Storing files in S3 decouples storage from compute, enabling an Auto Scaling group to process jobs from an SQS queue in parallel. EBS volumes cannot be easily shared across multiple instances like S3 objects.

Correct answer: B. Create an IAM role in each AWS account that requires auditing, with a trust policy that lists the auditor's ARN as a principal. Assign this role read-only permissions to access necessary resources.

IAM roles with cross-account trust policies provide temporary secure access without sharing long-term credentials. Creating IAM users requires managing passwords and access keys, violating security best practices for external guest access.

Correct answer: A. Set up a DNS active-active failover using latency based routing policy that resolves to an ELB. Configure the 'Evaluate Target Health' attribute to Yes.

Using Route 53 latency-based routing with active-active failover directs user traffic to the healthiest, lowest-latency regional endpoint. Setting Evaluate Target Health to Yes is required so Route 53 automatically removes unhealthy endpoints from consideration.

Correct answer: D. Set up a scheduled Lambda function to search through the list of running EC2 instances within your VPC and determine if any of these are based on unauthorized AMIs. Afterward, publish a new message to an SNS topic to inform the Security team that this occurred and then terminate the EC2 instance. · E. Set up AWS Config rules to determine any launches of EC2 instances based on non-approved AMIs and then trigger an AWS Lambda function to automatically terminate the instance. Afterward, publish a message to an SNS topic to inform the Security team about the occurrence.

AWS Config rules continuously evaluate EC2 instances against approved AMIs, automatically triggering remediation without impacting deployments. A scheduled Lambda function acts as a valid detective control, terminating unauthorized instances and alerting security post-deployment.

Correct answer: C. Attach the PowerUserAccess AWS managed policy to the IAM users.

The PowerUserAccess managed policy grants full access to AWS services except IAM and Organizations administration, matching the requirement perfectly. It specifically allows viewing organization details while adhering to least privilege, avoiding the excessive permissions of AdministratorAccess.

Correct answer: C. 1. Create an IAM role with a policy that allows listing and uploading of the objects in the S3 bucket. Launch the EC2 instance with the IAM role.

Assigning an IAM role to the EC2 instance allows the application to securely retrieve temporary credentials from the instance metadata. This avoids the security risks of embedding long-term access keys directly on the instance. Instance user data is strictly for launch scripts, not credential retrieval.

Correct answer: D. Create a VPC endpoint policy that restricts access to the specific Amazon S3 bucket. Create an IAM role that grants access to the S3 bucket and attach it to the application EC2 instances. Apply an Amazon S3 bucket policy that only allows access from the VPC endpoint and those using the IAM role.

Attaching an IAM role to the application instances grants necessary permissions to read the bucket securely. Applying a bucket policy that restricts access to the VPC endpoint ensures traffic does not traverse the public internet. IP address restrictions fail because source IPs change within a VPC.

Correct answer: D. Configure the Network Access Control Lists (ACLs) to only allow the required ports to your network. Identify and block common DDoS request patterns to effectively mitigate a DDoS attack by using AWS WAF. · E. Always add a security group that only allows certain ports and authorized servers and protects your origin servers by putting it behind a CloudFront distribution. Enable AWS Shield Advanced which provides enhanced DDoS attack detection and monitoring for application-layer traffic to your AWS resources.

Securing origin servers behind CloudFront and AWS Shield Advanced provides robust edge protection against distributed attacks. Configuring network access control lists and using AWS WAF rules further limits the attack surface. Simply oversizing compute resources is not a recommended mitigation tactic.

Correct answer: D. Create a new IAM role for the 3rd-party vendor. Add a permission policy that only allows the actions required by the third party application. Also, add a trust policy with a Condition element for the ExternalId context key. The Condition must test the ExternalId context key to ensure that it matches the unique customer ID from the 3rd party vendor.

Creating an IAM role with a trust policy conditionally checking the External ID securely delegates access without long-term keys. For cross-account access, always rely on STS AssumeRole with an External ID rather than IAM users to prevent confused deputy attacks.

Correct answer: D. For the data tier, create an Amazon S3 bucket and move the objects of the existing shared file system to it. Use S3 Intelligent-Tiering Storage class to save costs. Use lazy-loading on an Amazon FSx for Lustre filesystem to import the contents of the S3 bucket. Use this filesystem as shared storage for the application tier EC2 instances for the duration of the job and delete it once the job is completed.

Using S3 Intelligent-Tiering for long-term storage combined with a temporary FSx for Lustre file system provides massive cost savings and high throughput. S3 Standard would technically be cheaper for monthly access, making Intelligent-Tiering a slightly ambiguous but acceptable distractor.

Correct answer: A. The timeout behavior of a NAT instance is that, when there is a connection time out, it sends a FIN packet to resources behind the NAT instance to close the connection. It does not attempt to continue the connection which is why some database updates are failing. For better performance, use a NAT Gateway instead.

A NAT instance sends a FIN packet to terminate connections upon timeout, breaking long-running patch downloads. Upgrading to a managed NAT Gateway solves this because it actively manages timeouts and provides superior, scalable bandwidth for your VPC.

Correct answer: B. Create an identity broker that authenticates against the on-premises LDAP server and then calls AWS STS to assume an IAM role, generating temporary AWS security credentials. The employees can use these credentials to access AWS resources.

A custom identity broker authenticates users against the on-premises LDAP server and requests temporary credentials via STS. Option A uses GetFederationToken while Option B uses AssumeRole, and both are technically valid AWS federation patterns for an LDAP integration.

Correct answer: C. For presigned URLs, specify the algorithm using the x-amz-server-side​-encryption​-customer-algorithm request header · E. For Amazon S3 REST API calls, use the following HTTP Request Headers: x-amz-server-side​-encryption​-customer-algorithm x-amz-server-side​-encryption​-customer-key x-amz-server-side​-encryption​-customer-key-MD5

SSE-C requires specific HTTP headers to pass the encryption algorithm, key, and MD5 during REST API calls. HTTPS is required for transit. The console does not support SSE-C uploads. WebSocket Secure is irrelevant.

Correct answer: A. Add an in-memory datastore using Amazon ElastiCache for Redis to reduce the burden on the database. Enable Redis replication to scale database reads and to have highly available clusters.

Amazon ElastiCache provides an in-memory datastore reducing latency for frequent database reads. Migrating a dynamic portal to S3 static hosting fails because readers submit comments. Database migrations take longer to implement.

Correct answer: C. Add another tier to the application by using AWS Step Functions and AWS Lambda to facilitate the different stages of processing. Use a combination of Amazon Textract and Amazon Comprehend to perform optical character recognition (OCR) and parse data from the scanned forms. Store the output in another Amazon S3 bucket. Update the application to parse data from the Amazon S3 bucket and send it to the other system via API call.

Amazon Textract extracts printed text and structured data from scanned forms, while Amazon Comprehend uses natural language processing to parse the extracted text. Building this serverless pipeline with Step Functions and Lambda provides a fully managed, low-overhead automation solution.

Correct answer: A. Use Amazon WorkSpaces applications (formerly Amazon AppStream 2.0) to centrally manage your desktop applications and improve the overall user experience. Migrate the MySQL database from your VM to Amazon Aurora. Host the application and presentation layers in an Auto Scaling group on Amazon EC2 instances behind an Application Load Balancer.

Streaming desktop applications via AppStream 2.0 significantly reduces latency for remote users over unreliable networks. Migrating the database to Amazon Aurora and hosting compute tiers behind an Application Load Balancer increases availability. CloudFront cannot stream thick-client desktop applications directly.

Correct answer: B. The expiration date of the pre-signed URL is incorrectly set to expire too quickly and thus, may have already expired when they used it. · D. The required AWS credentials in the ~/.aws/credentials configuration file located on the EC2 instances of the online portal were misconfigured

Presigned URLs require valid AWS credentials to generate and can fail if the expiration window passes before upload. For EC2 workloads, use IAM instance profiles instead of static credential files to ensure applications can reliably generate presigned URLs.

Correct answer: A. Launch an EC2 instance for both the NGINX server as well as for the database. Attach EBS volumes to the EC2 instance of the database and then use the Data Lifecycle Manager to automatically create scheduled snapshots against the EBS volumes.

Data Lifecycle Manager automates EBS snapshot schedules, which is the native way to back up self-managed databases on EC2. Amazon RDS does not support Oracle RAC, so you must deploy the database on EC2 and cannot use automated RDS features.

Correct answer: E. Deploy a new Windows AMI for an Auto Scaling group with a minimum size of three instances and spans across three Availability Zones (AZs). Create an Amazon FSx for Windows File Server file system that will be used for shared storage. Write a user data script to install the CMS application, mount the FSx for Windows File Server file system and join the instances to the AD domain.

Amazon FSx for Windows File Server provides fully managed shared storage supporting Windows ACLs and Active Directory integration across Availability Zones. EFS uses Linux POSIX permissions. EBS Multi-Attach restricts instances to a single zone.

Correct answer: E. Use AWS IoT Core with MQTT to create a new Data-ATS endpoint. Update the Route 53 DNS zone record to point to the new endpoint and allow the IoT devices to send data using the MQTT protocol. Create an AWS IoT rule to directly insert the data into the Amazon DynamoDB table.

AWS IoT Core provides a managed MQTT broker that scales automatically and uses rules to route messages directly to DynamoDB. Managing custom EC2 brokers with load balancers introduces unnecessary operational overhead compared to serverless IoT.

Correct answer: B. Launch the Windows Server on EC2 instances. Use AWS Systems Manager Patch Manager to manage the patching process for the server. Configure it to automatically apply patches as they become available, ensuring that the server is always up-to-date with the latest operating system upgrades.

AWS Systems Manager Patch Manager automates OS patching on EC2 instances and allows flexible scheduling outside standard windows. Custom Lambda functions or CloudShell introduce unnecessary complexity and manual administrative overhead.

Correct answer: E. 1. Launch a new CloudTrail trail using the AWS console with one new S3 bucket to store the logs and with the "Enable for all accounts in my organization" checkbox enabled.

Creating an organization trail in AWS CloudTrail centrally captures management events across all accounts and regions automatically. Enabling KMS encryption and MFA Delete on the S3 bucket provides the highest level of security and durability for audit logs.

Correct answer: C. 1. Configure SSL VPN on the public subnet of your VPC.

Configuring an SSL VPN in a public subnet alongside application servers in a private subnet safely grants employees remote access. The question format is broken, but the core concept remains: keep private resources isolated while enabling authorized external connectivity.

Correct answer: C. Write TypeScript or Python code that will define AWS resources. Convert these codes to AWS CloudFormation templates by using AWS Cloud Development Kit (AWS CDK). Create CloudFormation stacks using AWS CDK. Create an AWS CodeBuild job that includes AWS CDK and add this stage to AWS CodePipeline.

The AWS Cloud Development Kit lets developers define cloud infrastructure using familiar programming languages like Python, which it then compiles into CloudFormation templates for deployment. This avoids the need to learn CloudFormation's JSON or YAML syntax while integrating smoothly with existing CodePipeline CI/CD workflows.

Correct answer: B. Use the EC2Rescue tool to diagnose and troubleshoot problems on your EC2 Linux and Windows Server instances. Run the tool automatically by using the AWS Systems Manager Automation and the AWSSupport-ExecuteEC2Rescue document.

The AWSSupport-ExecuteEC2Rescue Systems Manager Automation document securely automates the execution of the EC2Rescue tool to troubleshoot impaired instances. Relying on AWS Lambda with custom scripts is an anti-pattern here, as maintaining bespoke code introduces unnecessary operational overhead compared to managed SSM runbooks.

Correct answer: A. Use a CloudFront web distribution and an Application Load Balancer in front of an Auto Scaling group of EC2 instances. Use Amazon Cognito for user authentication. The web servers will process the user's vote and pass the result in an SQS queue. Set up an IAM Role to grant the EC2 instances permissions to write to the SQS queue. A group of EC2 instances will then retrieve and process the items from the queue. Finally, store the results in a DynamoDB table.

Amazon Cognito integrates natively with social identity providers to authenticate millions of users, while SQS decouples vote ingestion to absorb massive traffic spikes safely. Writing custom authentication services or attempting to use IAM directly for end-user social login introduces unnecessary complexity and fails to scale reliably.

Correct answer: B. Create a new IAM role for cross-account access which allows the online auditing system account to assume the role. Assign it a policy that allows only the actions required for the compliance audit.

Cross-account IAM roles provide temporary credentials following the principle of least privilege. Creating IAM users with long-term access keys for external parties violates security best practices and makes credential rotation difficult.

Correct answer: B. Stop the custom cluster controller instance and move it to the existing placement group.

You can simply stop an EC2 instance and move it into an existing cluster placement group to immediately gain low-latency benefits. Terminating instances or changing to a spread placement group is unnecessary and counterproductive to high-performance computing requirements.

Correct answer: B. A single AWS Direct Connect and an AWS managed VPN connection to connect your data center with Amazon VPC

Using a single Direct Connect for primary traffic and an AWS managed VPN as a backup provides a highly available, cost-effective hybrid setup. Direct Connect lacks built-in failover, so relying on a single connection without a VPN backup introduces unacceptable risk.

Correct answer: B. Update the CloudFront distribution and create a new behavior that will forward to the origin of the static assets based on path pattern. · C. Edit the CloudFront distribution and create another origin for serving the static assets.

You must configure CloudFront with multiple origins and path-pattern behaviors to correctly route static assets to S3 and dynamic traffic to the ALB. Relying on the Application Load Balancer to forward requests violates the S3 bucket's OAC restrictions, resulting in access errors.

Correct answer: D. Use Amazon WorkDocs for document storage and utilize its user access management, version control, and built-in encryption. Integrate the Amazon WorkDocs Content Manager to the external custom applications. Develop a rollback feature to replace the current document version with the previous version from Amazon WorkDocs.

Amazon WorkDocs provides a secure, fully managed content management solution with built-in version control and granular access management, exposed via an API. Using Amazon S3 and sharing client-side encryption keys across multiple customers violates least privilege principles, creating a massive security risk.

Correct answer: D. Launch an IAM Role that has the required permissions to read and write from the DynamoDB table. Reference the IAM Role as a property inside the AWS::IAM::InstanceProfile of the application instance.

Assigning an IAM role to an instance profile grants EC2 instances secure, temporary credentials to access AWS services like DynamoDB. Hardcoding access keys in CloudFormation parameters or user data violates security best practices and introduces significant long-term credential management risks.

Correct answer: D. Implement Step Functions to orchestrate batch processing workflows. Use the AWS Management Console to monitor workflow status and manage failure reprocessing.

AWS Step Functions provides managed state machines that naturally orchestrate complex workflows, handle retries automatically, and visualize execution status in the console. Building a custom polling mechanism with RDS and Lambda introduces unnecessary operational overhead and database connection management challenges.

Correct answer: A. Use CloudWatch for the monitoring and configure the scaling in policy of the Auto Scaling group to terminate one EC2 instance when the CPU Utilization is 15% or below.

CloudWatch alarms trigger simple scaling policies to terminate instances automatically based on real-time metrics like CPU utilization. Scheduled actions are unsuitable for unpredictable traffic patterns, and using Lambda or SNS for manual termination introduces unnecessary operational overhead instead of relying on built-in Auto Scaling capabilities.

Correct answer: C. Create a dedicated VPC for outbound internet traffic with a NAT gateway on it. Connect this VPC to the existing AWS Transit Gateway. Configure an AWS Network Firewall firewall for the rule-based filtering. Modify all the default routes in each account to point to the Network Firewall endpoint.

A centralized egress VPC with AWS Network Firewall connected to Transit Gateway provides managed, stateful inspection for all accounts. Deploying custom proxy appliances on EC2 instances introduces unnecessary operational overhead and scaling complexity compared to native services.

Correct answer: A. Create a pipeline in AWS CodePipeline that is triggered automatically for commits on the private GitHub repository. Have the pipeline create a change set and execute the CloudFormation template. Add an AWS CodeBuild stage on the pipeline to build and run test scripts to verify the new stack.

CodePipeline can monitor GitHub and automatically deploy CloudFormation changes using change sets. CodeDeploy is designed for application code deployment, not infrastructure, making it an invalid distractor for managing CloudFormation stack updates.

Correct answer: B. Create an AWS Lambda function to update the database IP addresses on the Systems Manager Parameter Store. Create an Amazon EC2 bootstrap script that will retrieve the database IP address from SSM Parameter Store. Update the local configuration files with the parameters. · C. Provision a pool of Elastic Network Interfaces (ENIs). Request a license file for each ENI from the software vendor. Store the license files on an Amazon S3 bucket and use bootstrap scripts to retrieve an unused license file and attach corresponding ENI when provisioning EC2 instances.

Storing IP addresses in Systems Manager Parameter Store allows bootstrap scripts to configure static IPs dynamically. Pre-provisioning Elastic Network Interfaces secures static MAC addresses for rigid licensing while allowing Auto Scaling group flexibility.

Correct answer: A. Launch a CloudFront web distribution with the URL of the on-premises web application as the origin. Offload the DNS to AWS to handle CloudFront traffic.

Amazon CloudFront can cache heavy media assets at edge locations using the on-premises application as a custom origin. Rehosting infrastructure to AWS fails the urgent timeline, whereas caching immediately offloads traffic.

Correct answer: C. Use an AWS Config Managed Rule and specify a list of approved AMI IDs. This rule will check whether running EC2 instances are using specified AMIs. Configure AWS Config to stream configuration changes and notifications to an Amazon SNS topic which will send a notification for non-compliant instances.

AWS Config Managed Rules evaluate running instances for approved AMIs and send notifications without blocking initial deployments. Service Control Policies act as preventative guardrails, which contradicts allowing deployments and remediating later.

Correct answer: C. Add an RDS MySQL Read Replica in each Availability Zone. · D. Implement sharding to distribute the incoming load to multiple RDS MySQL instances. · F. Deploy an Amazon ElastiCache Cluster with nodes running in each Availability Zone.

Read Replicas, database sharding, and ElastiCache horizontally scale read capacity to relieve database bottlenecks cost-effectively. Upgrading instance types or provisioned IOPS represents vertical scaling, which is often cost-prohibitive and less efficient.

Correct answer: D. Configure AWS Organizations to group different accounts into separate Organizational Units (OU) depending on the business function. Create a Service Control Policy that restricts launching any AWS resources without a tag by including the Condition element in the policy which uses the ForAllValues qualifier and the aws:TagKeys condition. This policy will require its principals to tag resources during creation. Apply the SCP to the OU which will automatically cascade the policy to individual member accounts.

Applying a Service Control Policy using the ForAllValues qualifier with the aws:TagKeys condition enforces mandatory tagging across an organizational unit centrally. Applying individual IAM policies to every account requires extensive operational overhead, whereas AWS Config or Systems Manager only identify non-compliance after creation.

Correct answer: C. Add Read Replicas in RDS for each Availability Zone. · E. Implement a caching system using ElastiCache in-memory cache on each Availability Zone.

Implementing ElastiCache reduces database load by serving frequent queries from memory, and adding RDS Read Replicas scales read capacity across availability zones. Upgrading the database instance size or implementing sharding is not as cost-effective for handling sudden read spikes.

Correct answer: B. Use AWS Lambda functions to run the backend game logic. Expose the REST APIs by using Amazon API Gateway. Use Amazon DynamoDB with auto-scaling to store the player session data.

Using API Gateway with backend Lambda functions perfectly preserves the existing REST API structure while providing native API key handling and traffic throttling. DynamoDB provides the low-latency scalability required for active player session data, unlike Aurora Serverless.

Correct answer: D. Use the Amazon Connect service to create an omnichannel cloud-based contact center for the agents. · E. Use an Amazon Lex bot to recognize callers' intent.

Amazon Connect provides a managed cloud contact center, while Amazon Lex integrates AI to recognize caller intent and automate basic tasks. For the SAP exam, remember that Lex uses natural language understanding to power conversational chatbots, unlike Polly which only handles text-to-speech.

Correct answer: C. Use the AWS Database Migration Service (DMS) and the AWS Schema Conversion Tool (SCT) to convert, migrate, and re-architect the IBM Db2 database to Amazon Aurora. Set up an Auto Scaling group of EC2 instances with an ELB in front to migrate and re-host your IBM WebSphere. Migrate and re-platform IBM MQ to Amazon MQ in a phased approach.

Using DMS to migrate Db2 to Aurora and re-platforming IBM MQ to Amazon MQ provides the required modernization and cost improvements. For the exam, remember that Amazon MQ is the direct migration path for legacy message brokers like IBM MQ, as SQS lacks the required protocols.

Correct answer: B. Set up an Amazon RDS Proxy in front of the database layer to automatically route traffic to healthy RDS instances. · F. Ensure that Multi-AZ is enabled on Amazon Aurora and create one or more Aurora Replicas. · G. Migrate the Amazon RDS for MySQL cluster to an Amazon Aurora for MySQL cluster.

Migrating to Amazon Aurora MySQL and utilizing RDS Proxy directly targets sub-twenty second failovers while queueing active transactions. Aurora's isolated cache prevents reboot throttling, and the proxy maintains client connections, unlike standard Multi-AZ failovers.

Correct answer: B. Create an Amazon Aurora MySQL database instance. Create an Aurora Replica and enable Aurora Auto Scaling for the replica. Create an Auto Scaling group of Amazon EC2 instances placed behind an Application Load Balancer with the round-robin routing algorithm. Ensure that the sticky sessions feature is enabled for the ALB.

Aurora Auto Scaling specifically manages read replicas to handle increased connectivity, as you cannot scale the master node. Sticky sessions are required for stateful web applications behind an Application Load Balancer to maintain user experience. Network Load Balancers do not support least outstanding requests.

Correct answer: D. Launch an SQS queue and develop a custom service which integrates with SQS to buffer the incoming requests. Use a web distribution in CloudFront and Amazon S3 to host the diagrams, images, and other static assets of the mobile app.

Amazon SQS asynchronously buffers incoming write requests, decoupling user submissions from backend processing to prevent timeouts. CloudFront caches media assets at edge locations, improving load times globally. Provisioning massive DynamoDB write capacity is costly, and replacing DynamoDB introduces unnecessary operational overhead.

Correct answer: A. Configure AWS IAM Identity Center with AWS Organizations to manage SSO access and permissions on AWS. Set up a two-way forest trust relationship between the AWS Directory service and the company Active Directory to allow users to use their corporate credentials when logging in to AWS. Leverage on the third-party integration support of AWS IAM Identity Center.

IAM Identity Center natively integrates with Organizations and supports third-party SAML applications, providing centralized access with minimal management overhead. Setting up a two-way forest trust allows AWS Managed Microsoft AD to synchronize on-premises users. Self-managed AD FS deployments require significant infrastructure maintenance.

Correct answer: A. Use IAM Access Analyzer to review AWS CloudTrail logs and generate a policy template with permissions required by the Lambda functions. · C. Create a trail in AWS CloudTrail and turn on CloudTrail logging to capture Amazon S3 and Amazon DynamoDB events.

IAM Access Analyzer reviews CloudTrail events to automatically generate fine-grained IAM policy templates based on actual usage. CloudTrail must be enabled to capture the required S3 and DynamoDB API actions. Services like GuardDuty detect threats, while CodeGuru profiles performance rather than IAM activity.

Correct answer: B. Place the Auto Scaling of Amazon EC2 instances behind a Network Load Balancer (NLB). For the domain name, create an Amazon Route 53 entry that points to the Elastic IP address of the NLB. · E. Set up network ACL rules on the VPC to deny all non-UDP traffic. Ensure that the NACL is associated with the load balancer subnets.

A Network Load Balancer operates at layer four to route UDP traffic and uses static Elastic IP addresses required for AWS Shield Advanced protections. Additionally, configuring network ACLs to deny non-UDP traffic provides an effective layer four firewall to block unwanted protocols.

Correct answer: B. Import a certificate that is signed by a trusted third-party certificate authority, store it to ACM then attach it in your ALB. Set the Viewer Protocol Policy to HTTPS Only in CloudFront and use an SSL/TLS certificate from a third-party certificate authority which was imported to either ACM or the IAM certificate store.

Configuring the viewer protocol policy as HTTPS Only enforces encryption in transit between the client and CloudFront. Additionally, importing a trusted third-party certificate into AWS Certificate Manager for the Application Load Balancer fulfills the strict requirement for end-to-end HTTPS across the entire architecture.

Correct answer: D. Create an IPSec VPN connection using either OpenVPN or VPN/VGW through the Virtual Private Cloud service. Prepare an instance of MySQL running external to Amazon RDS. Configure the MySQL RDS instance to be the replication source. Use mysqldump to transfer the database from the Amazon RDS instance to the on-premises MySQL instance and start the replication from the Amazon RDS Read Replica.

Establishing a secure IPsec VPN tunnel encrypts database replication traffic flowing between the AWS VPC and the on-premises data center. Exposing the RDS instance directly to the internet violates fundamental security best practices, making a dedicated private network connection mandatory for compliance.

Correct answer: C. Enable object-level logging in the S3 bucket to automatically track S3 actions using CloudTrail. Set up an Amazon EventBridge rule with an SNS Topic to notify the IT Compliance team when a PutObject API call with public-read permission is detected in the CloudTrail logs. Launch another CloudWatch Events rule that invokes an AWS Lambda function to turn the newly uploaded public object to private.

Enabling S3 object-level logging in CloudTrail captures detailed API events, allowing EventBridge to trigger near-real-time alerts and automated Lambda remediation. Using scheduled hourly checks introduces unacceptable latency, while services like Trusted Advisor and GuardDuty lack the granular object-level visibility needed here.

Correct answer: C. Send the raw data directly to Amazon Data Firehose for processing and output the data to an S3 bucket. For archiving, create a lifecycle policy from S3 to Glacier. Use Amazon EMR to process the data stored in S3 and load the processed data into Amazon Redshift.

Amazon Data Firehose efficiently captures real-time streaming IoT data and delivers it to S3 for archiving or Redshift for analytics. Directly writing massive incoming sensor payloads to S3 or DynamoDB bypasses necessary ingestion buffering and creates performance bottlenecks.

Correct answer: A. Split the single Lambda function that processes the photos into several functions dedicated for each type of metadata. Create a workflow on AWS Step Functions that will run multiple Lambda functions in parallel. Create another workflow that will retrieve the list of photos for processing and execute the metadata extraction workflow for each photo.

AWS Step Functions provides native orchestration to execute multiple specialized Lambda functions concurrently, dramatically reducing processing time. A single SQS queue cannot easily coordinate parallel processing across different metadata functions because one successful extraction hides the message.

Correct answer: D. Create database backups every hour and store it in an Amazon S3 bucket with Cross-Region Replication enabled. Store the transaction logs in the same S3 bucket every 5 minutes.

Synchronous cross-AZ replication guarantees an RPO of zero for Availability Zone failures. If planning for a region-wide outage, S3 with Cross-Region Replication for frequent transaction logs is the standard DR pattern to meet strict RPO requirements.

Correct answer: A. Migrate all media files to an Amazon S3 bucket and use this as the origin for the new CloudFront web distribution. Set up an Elastic Load Balancer with an Auto Scaling of EC2 instances to host the web servers. Use a combination of Cost Explorer and AWS Trusted advisor checks to monitor the operating costs and identify potential savings.

Migrating media files to an S3 bucket and serving them through CloudFront provides high durability and offloads read traffic. Storing static media on EFS or using Storage Optimized instances is unnecessary and drives up costs.

Correct answer: C. Send a message to an Amazon Simple Notification Service (Amazon SNS) topic. Have the security team subscribe to the SNS topic. · E. Use Amazon EventBridge to invoke an AWS Step Function state machine that will remove permissions on the newly created IAM user. · F. Create a rule in Amazon EventBridge that will check for patterns in AWS CloudTrail API calls with the CreateUser eventName.

EventBridge rules detect CloudTrail CreateUser API calls and trigger Step Functions to revoke permissions while notifying an SNS topic. CloudTrail only records events and cannot proactively send notifications or invoke remediation workflows.

Correct answer: C. Configure Redshift to have automatic snapshots and do a cross-region snapshot copy to automatically replicate the current production cluster to the disaster recovery region.

Configuring automatic snapshots with cross-region snapshot copy securely backs up your Redshift cluster to a disaster recovery region. Redshift does not support live cross-region replication, making snapshot copies the only viable method for regional disaster recovery.

Correct answer: A. Use an Amazon EFS volume to store the weather forecast data points. Mount this EFS volume on a fleet of Auto Scaling Amazon EC2 instances behind an Elastic Load Balancer. Create an Amazon CloudFront distribution and point the origin to the ELB. Configure a 15-minute cache-control timeout for the CloudFront distribution.

Mounting an Amazon EFS volume on a fleet of Auto Scaling EC2 instances behind a load balancer provides the distributed storage needed for concurrent access. While storing individual objects in S3 is a viable alternative for static data, it introduces higher retrieval latency compared to EFS, and API Gateway caching has strict size limits.

Correct answer: D. 1. For each completed data set, compress and concatenate all of the files into a single Glacier archive.

Compressing data sets into a single S3 Glacier archive minimizes storage costs for rarely accessed files, while storing searchable metadata in DynamoDB enables fast lookups. Glacier lacks built-in search capabilities, so querying the vault directly would be highly inefficient and violate the time constraints.

Correct answer: A. 1. Synchronize the on-premises data to an S3 bucket one week before the migration schedule using the AWS CLI's S3 sync command.

Using the AWS CLI to sync data into S3 before the migration weekend allows delta syncing of changes, effectively overcoming slow internet bandwidth. DataSync or physical terminals are overkill and less cost-effective for a single terabyte over a week.

Correct answer: B. Record the user's information in Amazon RDS and create a role in IAM with appropriate permissions. When the user uses his/her mobile app, create temporary credentials using the 'AssumeRole' function in STS. Store these credentials in the mobile app's memory and use them to access the S3 bucket. Generate new credentials the next time the user runs the mobile app.

Using IAM roles and the STS AssumeRole function provides temporary, secure credentials for mobile applications without embedding long-term keys. Storing access keys directly inside an app is a severe security risk. Always distribute short-lived credentials dynamically to untrusted client environments.

Correct answer: C. Create a database export of the on-premises database server and bring it to an AWS Data Transfer Terminal facility. Once the data is imported to AWS, provision an Amazon Aurora MySQL DB instance and load the data. Using the VPN connection, configure replication from the on-premises database server to the Aurora DB instance. Wait until the replication is complete, then update the database DNS entry to point to the Aurora DB instance. Stop the database replication.

Moving the bulk database export to an AWS Data Transfer Terminal overcomes the strict bandwidth limitations of a 50 Mbps VPN. After the initial seed load, AWS DMS can efficiently replicate ongoing incremental changes over the VPN. This hybrid approach minimizes downtime during the final cutover.

Correct answer: B. Set up an AWS Direct Connect Gateway with two virtual private gateways. Launch and connect the required Private Virtual Interfaces to the Direct Connect Gateway.

A Direct Connect Gateway allows a single physical Direct Connect connection to extend private connectivity to multiple VPCs across different regions. This avoids the high cost of provisioning redundant physical circuits for each specific region. VPC peering cannot bridge on-premises networks directly.

Correct answer: C. Reconfigure the web application to publish messages to a new Amazon SQS queue. Create an auto-scaling group of Amazon EC2 instances based on the SQS queue length to pull messages from the queue and process the files. Store the processed files on an Amazon S3 bucket.

Using an SQS queue to trigger an EC2 Auto Scaling group provides the required decoupling and handles processing times exceeding Lambda's fifteen minute limit. Storing files in S3 is cheaper than EFS. Avoid Lambda options because long processing times will cause timeouts.

Correct answer: B. Write infrastructure-as-code to maintain consistency. Use AWS Organizations to centrally orchestrate the deployment of AWS CloudFormation template from the central account. Use CloudFormation StackSets to simplify permissions and automatic provisioning of resources across multiple regions and accounts.

CloudFormation StackSets integrated with AWS Organizations provide native multi-account and multi-region orchestration. This centralized deployment model automatically handles cross-account permissions, making it the recommended approach over manual nested stacks or custom IAM policies.

Correct answer: B. Store the SSL certificate in IAM and authorize access only to the Security team using an IAM policy. Configure the Application Load Balancer to use the SSL certificate instead of the EC2 instances.

Terminating SSL at the Application Load Balancer allows you to upload the certificate to IAM or ACM, restricting access via IAM policies so developers cannot see it. Storing certificates directly on EC2 instances is a major anti-pattern when load balancers are already in use.

Correct answer: B. Remove public read access from the S3 bucket. Use CloudFront as the global content delivery network (CDN) service for the photos and use Signed URLs with expiry dates.

Removing public read access and serving the photos through CloudFront using Signed URLs prevents hotlinking while drastically improving global load times. Blocking specific IPs fails because attackers can easily change IPs, making it an ineffective security strategy.

Correct answer: A. Install the AWS Replication Agent in your on-premises virtualization environment. · D. Use the AWS Application Migration Service to migrate your on-premises workloads to the AWS cloud.

Installing the AWS Replication Agent and using AWS Application Migration Service provides a highly automated lift-and-shift solution for converting virtual machines into EC2 instances. Avoid CloudFormation here because it builds fresh infrastructure rather than migrating existing servers.

Correct answer: D. Deploy the website across 3 Availability Zones with Auto Scaled EC2 instances behind an Application Load Balancer and a RDS configured with Multi-AZ Deployments.

Deploying Auto Scaled EC2 instances across three Availability Zones behind an Application Load Balancer ensures the web tier can survive failures. Pairing this with an RDS Multi-AZ deployment is critical because Read Replicas only scale reads and do not provide automatic failover.

Correct answer: C. Use one table every week, with a composite primary key which is the sensor ID as the partition key and the timestamp as the sort key.

Creating weekly DynamoDB tables using the sensor ID as the partition key and timestamp as the sort key enables efficient queries and simple expiration via table deletion. Using a single massive table for all historical data increases complexity, and concatenating keys removes your ability to perform range queries on the timestamp.

Correct answer: B. Update the custom AWS KMS key policy in the Marketing account to include decrypt permission for the mgmt_reviewer IAM role. · D. Add an Amazon S3 bucket policy that includes read permission. Ensure that the Principal is set to the Management team's AWS account ID. · F. Ensure that the mgmt_reviewer IAM role policy includes read permissions to the Amazon S3 bucket and a decrypt permission to the custom AWS KSM key.

Cross-account access to an encrypted bucket requires granting permissions in both the resource and identity tiers. You must update the KMS key policy and S3 bucket policy in the marketing account, and ensure the management role has the necessary read and decrypt permissions in its IAM policy.

Correct answer: B. Configure an IAM Policy that restricts access only to the user-specific folders in the Amazon S3 Bucket. · C. Set up a federation proxy or a custom identity provider and use AWS Security Token Service to generate temporary tokens. Use an IAM Role to enable access to AWS services.

Setting up an identity provider with AWS STS allows users to federate their existing Active Directory credentials using IAM roles for access. To restrict access to specific prefixes, attach an IAM policy using variables to lock each user to their designated folder.

Correct answer: H. Use AWS Secrets Manager, create a secret resource and generate a secure database password. Use Secrets Manager's managed rotation to automatically rotate the database password every 90 days. On AWS CloudFormation, specify the AutomaticallyAfterDays property in RotationRules to set the rotation schedule to 90 days.

AWS Secrets Manager natively handles random password generation and automated RDS credential rotation with minimal overhead using CloudFormation. A strong distractor uses custom Lambda functions for rotation, but that introduces unnecessary operational complexity when native managed rotation exists.

Correct answer: H. Create an AWS CodeBuild job to run tests and security scans on the generated artifacts. Create an Amazon EventBridge rule that will send Amazon SNS alerts when unit testing fails. Create AWS Cloud Development Kit (AWS CDK) constructs with a manifest file to turn on/off features of the AWS CDK app. Add a manual approval stage on the pipeline for the Lead Developer's approval prior to production deployment.

CodeBuild easily handles automated testing and security scans, while native CodePipeline manual approvals satisfy the lead developer requirement. For dynamic feature toggles, the AWS Cloud Development Kit allows conditional deployments, making it superior to custom Lambda logic.

Correct answer: C. Avail a reserved capacity for provisioned throughput for DynamoDB. · E. Set up a scheduled job to drop the DynamoDB table for the previous day that contains the biometric data after it is successfully stored in the S3 bucket. Create another DynamoDB table for the day and perform the deletion and creation process everyday.

Purchasing reserved capacity provides significant savings for predictable workloads, while dropping daily tables after successful S3 aggregation minimizes ongoing storage costs. Introducing ElastiCache or shifting to RDS would drastically increase operational overhead and monthly billing.

Correct answer: G. Leverage AWS AppSync by building GraphQL APIs and using Websockets to deliver comments in real-time.

AWS AppSync leverages GraphQL and WebSocket protocols to efficiently push real-time data updates to subscribed clients. Using short polling via API Gateway increases latency and unnecessarily drives up Lambda invocation costs, making it a poor choice.

Correct answer: A. Create an Amazon EFS volume and mount it across all the EC2 instances. Use the Provisioned Throughput mode on the EFS volume to ensure that the application can reach the required IOPS.

Creating an Amazon EFS file system using Provisioned Throughput provides a shared file system that meets performance requirements and reduces costs by eliminating duplicate EBS volumes. Max I/O performance mode is outdated and does not guarantee specific throughput independent of storage size.

Correct answer: B. Create an Amazon ECS Fargate cluster and use containers to host the web application. Create an Auto Scaling group of Amazon EC2 Spot instances to process the SQS queue. Use Amazon Rekognition to analyze and categorize the videos instead of the third-party software. Store the videos and static contents on Amazon S3 buckets.

Using ECS Fargate for the web tier and Spot Instances for queue processing minimizes operational overhead and reduces costs. S3 provides durable storage for media files, while Amazon Rekognition completely removes the third-party software dependency for video analysis.

Correct answer: D. Amazon DynamoDB with a provisioned write throughput. Use an SQS queue to buffer the large incoming traffic to your Auto Scaled EC2 instances, which processes and writes the data to DynamoDB.

Using an SQS queue acts as a buffer to decouple the write operations, protecting the DynamoDB database from being overwhelmed by sudden traffic spikes. For the exam, always pair SQS with Auto Scaling when dealing with unpredictable, write-intensive workloads to ensure system stability.

Correct answer: C. Use CloudFormation with Systems Manager Parameter Store to retrieve the latest AMI IDs for your template. Whenever you decide to update the EC2 instances, call the update-stack API in CloudFormation in your CloudFormation template.

Storing the latest AMI IDs in Systems Manager Parameter Store allows CloudFormation to dynamically retrieve the public parameters during stack updates. This avoids manual template edits and eliminates the need for AWS Service Catalog, which is used for governance, not automation.

Correct answer: B. Install the AWS Client VPN on each employee workstation. Create a Client VPN endpoint in the same VPC region in the main AWS account. Update the VPC route configurations to allow communication with the internal applications.

Installing the client on employee workstations and creating a single Client VPN endpoint in the main account leverages existing VPC peering routes for access. Client VPN is endpoint-based, so deploying it in a data center or across every account adds unnecessary cost and complexity.

Correct answer: B. Leverage AWS Transform MGN for the migration. Install the AWS Replication agent on each physical machine to start the replication to the AWS Cloud. Once syncing is completed, launch test instances and initiate cutover to the AWS Cloud.

AWS Application Migration Service, formerly known as MGN, is designed to lift and shift physical servers using an agent for continuous block-level replication. Manual VM import processes are not scalable for large migrations, and AWS Outposts is used for extending infrastructure on-premises, not migrating to the cloud.

Correct answer: B. The mobile app will send device location to an SQS endpoint. Set up an API that utilizes an Application Load Balancer and an Auto Scaling group of EC2 instances, which will retrieve the relevant offers from DynamoDB. Use Amazon SNS to send offers to the mobile app.

Amazon SNS provides native mobile push notifications directly to consumer devices, unlike Amazon SES which only handles email. While using SQS to buffer location updates is an older EC2-based design pattern, it successfully pairs SNS for the required mobile push delivery.

Correct answer: F. Create an Amazon OpenSearch Service domain to reliably ingest the events. Leverage the OpenSearch Dashboards tool to create near-real-time dashboards and visualizations. · H. Ingest the events using Amazon Data Firehose. Write a Lambda function to process and transform the buffered events.

Amazon Data Firehose provides a fully managed, auto-scaling buffer for streaming data and uses Lambda for transformations. OpenSearch Service natively handles semi-structured JSON data and offers OpenSearch Dashboards for visualization.