Exams Practice Test – 303 Free Exam Questions with Answers

Correct answer: A. Configure S3 Event Notifications to trigger an AWS Lambda function whenever a new product description is uploaded. Inside the function, use Amazon Comprehend's custom entity recognition feature to extract ingredient names. Store these names in the DynamoDB table and let the front-end application query for health scores

Amazon Comprehend custom entity recognition provides managed text analysis without requiring machine learning expertise. SageMaker requires ML skills, Lookout for Vision handles image analysis, and Amazon Transcribe processes audio rather than text files.

Correct answer: C. Expose an Amazon API Gateway REST API endpoint to receive transaction requests from mobile clients. Integrate the API with AWS Lambda to perform basic validation. For backend processing, deploy the long-running application to Amazon ECS using the Fargate launch type, allowing ECS to manage compute and memory provisioning automatically, with no server management required

API Gateway secures incoming requests, Lambda handles lightweight validation, and Fargate provides serverless compute for long-running heavy workloads. EKS with self-managed nodes, Lightsail, and EKS Anywhere all introduce infrastructure patching burdens.

Correct answer: C. Deploy Babelfish for Aurora PostgreSQL to enable support for T-SQL commands · E. Use AWS Schema Conversion Tool (AWS SCT) along with AWS Database Migration Service (AWS DMS) to migrate the schema and data

Babelfish for Aurora PostgreSQL enables applications to run T-SQL queries directly, minimizing application refactoring. AWS Schema Conversion Tool and Database Migration Service handle schema translation and data transfer, whereas standard endpoints or AWS Glue lack native protocol conversion.

Correct answer: C. Create a Route 53 Resolver outbound endpoint. Define a forwarding rule that routes DNS queries for on-premises domains to the on-premises DNS server. Associate the rule with the VPC

A Route 53 Resolver outbound endpoint securely forwards DNS queries from a VPC to on-premises DNS servers across a VPN. Inbound endpoints serve the opposite direction, while private hosted zones are not authoritative for external infrastructure.

Correct answer: C. Use a daily AWS Glue job to transform and clean the data stored in Amazon S3. Load the transformed dataset into Amazon Redshift Serverless, which offers MPP capabilities in a serverless model. Enable analysts to use Amazon Redshift ML to build and train ML models

AWS Glue provides serverless ETL, Amazon Redshift Serverless delivers massively parallel processing for analytics, and Redshift ML enables SQL-based model training. Provisioned EMR and RDS fail the strict serverless requirements.

Correct answer: B. Use multipart uploads for faster file uploads into the destination Amazon S3 bucket · C. Use Amazon S3 Transfer Acceleration (Amazon S3TA) to enable faster file uploads into the destination S3 bucket

Amazon S3 Transfer Acceleration and multipart upload optimize large file transfers over long distances. Direct Connect and Site-to-Site VPN are costly infrastructure provisions rather than simple transfer optimizations, and AWS Global Accelerator does not route traffic directly to S3 buckets.

Correct answer: A. Use AWS Glue DataBrew to visually build transformation workflows on top of the raw Parquet files in S3. Use DataBrew recipes to track, audit, and share the transformation steps with others. Enable data profiling to inspect column statistics, null values, and data types across datasets

AWS Glue DataBrew is a visual data preparation tool that enables code-free transformations, data profiling, and shareable recipes for lineage tracking. AWS Glue Studio requires underlying Spark scripts and lacks built-in data profiling, making it less suitable for business analysts.

Correct answer: D. Amazon FSx for Windows File Server

Amazon FSx for Windows File Server provides fully managed file storage accessible via SMB and natively supports Microsoft's Distributed File System. FSx for Lustre targets high-performance computing, while AWS Managed Microsoft AD handles identity rather than file system workloads.

Correct answer: A. Put the instance into the Standby state and then update the instance by applying the maintenance patch. Once the instance is ready, you can exit the Standby state and then return the instance to service · B. Suspend the ReplaceUnhealthy process type for the Auto Scaling group and apply the maintenance patch to the instance. Once the instance is ready, you can manually set the instance's health status back to healthy and activate the ReplaceUnhealthy process type again

Placing an instance in Standby state or suspending the ReplaceUnhealthy process prevents Auto Scaling from terminating it during temporary health check failures. ScheduledActions are irrelevant, and recreating instances is highly inefficient, eliminating those distractors.

Correct answer: D. Upload the compressed file using multipart upload with Amazon S3 Transfer Acceleration (Amazon S3TA)

S3 Transfer Acceleration speeds up long-distance public internet transfers by routing traffic through Amazon CloudFront edge locations. Combining this with a multipart upload parallelizes the file transfer, maximizing throughput over your available bandwidth. Option D correctly leverages both.

Correct answer: B. Change the application architecture to create customer-specific custom prefixes within the single Amazon S3 bucket and then upload the daily files into those prefixed locations

S3 scales automatically by distributing requests across distinct prefixes. Using customer-specific prefixes within a single bucket parallelizes the uploads, successfully bypassing the bottleneck of the baseline request rate. Creating multiple buckets or migrating storage types introduces unnecessary operational overhead.

Correct answer: B. Modify the application to publish purchase events to an Amazon SQS queue. Launch an Auto Scaling group of EC2 workers that poll the queue and process purchases asynchronously · C. Implement Amazon RDS Proxy between the application and the Aurora PostgreSQL cluster. Deploy EC2 instances in an Auto Scaling group to retry transactions as needed

Amazon RDS Proxy efficiently pools database connections to prevent timeouts during compute scaling. Amazon SQS decouples transaction processing to buffer traffic bursts asynchronously. Caching transactions or slowing traffic with API Gateway risks data loss or user friction.

Correct answer: C. Use AWS Directory Service AD Connector to connect AWS to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Use permission sets to assign access to AWS accounts and resources based on Active Directory group membership

AWS IAM Identity Center provides a centralized access portal and uses permission sets to manage accounts via Active Directory group membership. Integrating it with an AD Connector delegates authentication to the existing on-premises directory, completely eliminating the need to manage a separate cloud identity store.

Correct answer: A. Deploy an AWS Storage Gateway File Gateway on premises. Configure it to present an NFS-compatible file share to the workloads. Store the uploaded files in Amazon S3, and use S3 Lifecycle policies to automatically transition infrequently accessed objects to lower-cost storage classes

A File Gateway provides seamless NFS compatibility to existing applications while transparently storing files as S3 objects. This combination utilizes unlimited cloud storage and native lifecycle policies. Volume and FSx options require unnecessary architecture changes or protocol conversions.

Correct answer: B. Enable multi-factor authentication (MFA) delete on the Amazon S3 bucket · E. Enable versioning on the Amazon S3 bucket

Amazon S3 versioning preserves, retrieves, and restores overwritten or accidentally deleted objects. Enabling multi-factor authentication delete adds a secondary authentication requirement, preventing unauthorized or accidental permanent deletions. SNS alerts or managerial approvals do not technically restrict the deletion action.

Correct answer: A. Use Instance Store based Amazon EC2 instances

Instance store volumes provide high random I/O performance and are physically attached to the host computer. Because the application replicates data across the fleet, ephemeral storage is the most cost-optimal and resource-efficient choice. Block storage like EBS incurs extra costs for provisioned IOPS.

Correct answer: B. Implement an Amazon SQS FIFO queue to reliably buffer and deliver form submissions from the web application layer to the processing tier

Amazon SQS FIFO queues guarantee exactly-once message processing and preserve the order of operations. Standard queues only offer at-least-once delivery, risking duplicates, making FIFO the required choice for strict data integrity and reliable permit submissions.

Correct answer: B. Store the intermediary query results in Amazon S3 Standard storage class

Amazon S3 Standard is the most cost-effective storage class for frequently accessed data with a lifespan of only 24 hours. Infrequent Access classes incur retrieval fees and minimum duration charges, making them more expensive for heavily referenced, short-lived data.

Correct answer: C. Use AWS Direct Connect plus virtual private network (VPN) to establish a connection between the data center and AWS Cloud

AWS Direct Connect provides a dedicated, low latency, high throughput connection, but it is not encrypted by default. Adding a virtual private network ensures the traffic remains fully encrypted. Therefore, Direct Connect combined with a VPN satisfies all requirements.

Correct answer: C. Throughput Optimized Hard disk drive (st1) · D. Cold Hard disk drive (sc1)

Amazon EBS HDD-backed volumes like Throughput Optimized HDD and Cold HDD are optimized for large streaming workloads and cannot be used as boot volumes. Solid state drive backed volumes and Instance Store are the only valid options for booting an EC2 instance.

Correct answer: A. Use server-side encryption with AWS Key Management Service keys (SSE-KMS) to encrypt the user data on Amazon S3

Server-side encryption with AWS Key Management Service keys provides a detailed audit trail through AWS CloudTrail showing exactly when keys are used. SSE-S3 lacks this audit capability, while SSE-C and client-side encryption require the customer to manage keys.

Correct answer: C. Amazon ECS with EC2 launch type is charged based on EC2 instances and EBS volumes used. Amazon ECS with Fargate launch type is charged based on vCPU and memory resources that the containerized application requests

Amazon ECS with the EC2 launch type bills for underlying infrastructure like EC2 and EBS volumes, while Fargate bills per vCPU and memory consumed. Understanding Fargate's serverless pricing model versus EC2 infrastructure management is key.

Correct answer: C. Use Amazon EFS resource policies to allow cross-account access to the file system from the central account. Attach the EFS mount target to a shared VPC or peered VPC, and mount the file system in the Lambda function configuration using an EFS access point

Amazon EFS supports cross-account mounting using resource policies and access points over a peered VPC. Lambda layers have size limits, proxy functions add latency, and copying large datasets to S3 creates unnecessary operational overhead.

Correct answer: A. Configure AWS CloudTrail to log all AWS Identity and Access Management (AWS IAM) actions · E. Enable AWS Multi-Factor Authentication (AWS MFA) for privileged users

Enabling MFA for privileged users and logging actions via CloudTrail are foundational security best practices. Sharing credentials, granting maximum privileges, and using user credentials for EC2 instances violate least privilege principles.

Correct answer: B. Amazon S3 Intelligent-Tiering => Amazon S3 Standard · E. Amazon S3 One Zone-IA => Amazon S3 Standard-IA

S3 lifecycle transitions prohibit moving objects back to the Standard class or upgrading from One Zone-IA to Standard-IA. S3 uses a waterfall model where objects can move down to colder tiers, but never upward to warmer, more redundant classes.

Correct answer: A. Amazon FSx for Lustre

Amazon FSx for Lustre is optimized for high-performance computing workloads like chip design, offering parallel processing for hot data and S3 integration for cold data. AWS Glue and EMR handle data analytics, while Windows File Server targets SMB workloads.

Correct answer: A. Create separate Kubernetes service accounts for the UI and data services. Use IAM Roles for Service Accounts (IRSA) to map each service account to an IAM role with only the required permissions. Assign DynamoDB access to the UI Pods and S3 access to the data Pods

IAM Roles for Service Accounts provides granular IAM permissions to individual Kubernetes pods. The node instance profile trap grants every pod on the node identical access, violating the required least privilege isolation.

Correct answer: B. Create a new IAM role with the required permissions to access the resources in the production environment. The users can then assume this IAM role while accessing the resources from the production environment

Cross-account delegation relies on IAM roles to provide temporary security credentials. Sharing long-term IAM user credentials is an anti-pattern, and relying on it unnecessarily compromises your security posture across both environments.

Correct answer: A. Leverage Amazon API Gateway with Amazon Kinesis Data Analytics

Amazon Kinesis Data Analytics processes streaming data in real-time, which pairs seamlessly with API Gateway to expose RESTful endpoints. Business intelligence tools and serverless compute services lack the native streaming integration required for real-time location tracking.

Correct answer: A. Multi-AZ follows synchronous replication and spans at least two Availability Zones (AZs) within a single region. Read replicas follow asynchronous replication and can be within an Availability Zone (AZ), Cross-AZ, or Cross-Region

Amazon RDS Multi-AZ deployments use synchronous replication across availability zones for high availability. Read replicas use asynchronous replication to scale read capacity and can span across availability zones or regions.

Correct answer: B. Use an Amazon Aurora Global Database for the games table and use Amazon Aurora for the users and games_played tables

Amazon Aurora Global Database replicates data globally with low latency, fulfilling the global table requirement. Maintaining regional data in Amazon Aurora minimizes application refactoring, whereas mixing in DynamoDB requires transitioning from SQL to NoSQL APIs.

Correct answer: A. Configure the Auto Scaling group to use target tracking policy and set the CPU utilization as the target metric with a target value of 50%

Target tracking scaling policies automatically adjust capacity to maintain a specific metric, such as 50% CPU utilization. Step and simple scaling require manual CloudWatch alarms, lacking the continuous stabilization provided by target tracking.

Correct answer: B. Use Amazon CloudFront with a custom origin pointing to the on-premises servers

Amazon CloudFront caches content at edge locations globally, reducing latency for international users while keeping the origin on-premises. Migrating to S3 fails the dynamic website requirement, and Route 53 routing alone cannot overcome the physical distance from the US servers.

Correct answer: C. Enable Amazon DynamoDB Accelerator (DAX) for Amazon DynamoDB and Amazon CloudFront for Amazon S3

Amazon DynamoDB Accelerator (DAX) delivers microsecond latency for DynamoDB reads without application code changes, while Amazon CloudFront provides low-latency access to static S3 assets. ElastiCache requires custom integration code, and Memcached cannot front S3 content.

Correct answer: C. 1 Amazon EC2 instance, 1 AMI and 1 snapshot exist in Region B

When an Amazon Machine Image is copied to a new region, the underlying Amazon EBS snapshot is also copied to that destination region. Launching the new instance from the copied AMI results in one instance, one AMI, and one snapshot residing in Region B.

Correct answer: A. Power the on-demand, live leaderboard using Amazon ElastiCache for Redis as it meets the in-memory, high availability, low latency requirements · D. Power the on-demand, live leaderboard using Amazon DynamoDB with DynamoDB Accelerator (DAX) as it meets the in-memory, high availability, low latency requirements

Amazon ElastiCache for Redis and Amazon DynamoDB with DAX both provide the required in-memory caching for real-time leaderboards. Standard DynamoDB, Aurora, and Neptune are not natively in-memory data stores.

Correct answer: C. Use Amazon EC2 spot instances to run the workflow processes

Amazon EC2 Spot Instances offer significant cost savings for workloads that are flexible and fault-tolerant. AWS Lambda has a strict fifteen-minute execution timeout, and both On-Demand and Reserved Instances are more expensive for interruptible tasks.

Correct answer: C. Path-based Routing

Application Load Balancers use path-based routing to direct traffic based on the URL path, such as forward slashes for orders or products. Host-based routing relies on domain names, and query string routing uses URL parameters.

Correct answer: A. Use Amazon Route 53 based geolocation routing policy to restrict distribution of content to only the locations in which you have distribution rights · E. Use georestriction to prevent users in specific geographic locations from accessing content that you're distributing through a Amazon CloudFront web distribution

Amazon Route 53 geolocation routing and Amazon CloudFront geo restriction enforce geographic content limits. Route 53 failover, latency, and weighted routing policies distribute traffic based on health or performance, not user location.

Correct answer: D. Use an Application Load Balancer for distributing traffic to the Amazon EC2 instances spread across different Availability Zones (AZs). Configure Auto Scaling group to mask any failure of an instance

An Application Load Balancer operates at Layer 7 to enable content-based routing across multiple Availability Zones, fulfilling the high availability requirement. Network Load Balancers operate at Layer 4, and Auto Scaling groups alone cannot distribute traffic.

Correct answer: B. Ingest the sensor data in an Amazon Simple Queue Service (Amazon SQS) standard queue, which is polled by an AWS Lambda function in batches and the data is written into an auto-scaled Amazon DynamoDB table for downstream processing

Amazon SQS and AWS Lambda create a fully serverless, auto-scaling architecture for ingesting and processing sensor data. Options using Amazon EC2 require manual capacity planning, and Kinesis Data Firehose cannot write directly to Amazon DynamoDB.

Correct answer: D. Amazon API Gateway creates RESTful APIs that enable stateless client-server communication and Amazon API Gateway also creates WebSocket APIs that adhere to the WebSocket protocol, which enables stateful, full-duplex communication between client and server

Amazon API Gateway creates stateless RESTful APIs using standard HTTP methods and stateful WebSocket APIs for full-duplex communication. The distractors incorrectly assign stateful characteristics to REST APIs or stateless characteristics to WebSocket APIs, contradicting core protocol behaviors.

Correct answer: A. Use permissions boundary to control the maximum permissions employees can grant to the IAM principals

Permissions boundaries control the maximum permissions employees can grant to IAM principals, preventing excessive access. Removing all database access or relying on manual CTO reviews are impractical, and the root user should never perform daily administration.

Correct answer: B. Leverage multi-AZ configuration of Amazon RDS Custom for Oracle that allows the Database Administrator (DBA) to access and customize the database environment and the underlying operating system

Amazon RDS Custom for Oracle provides managed database high availability while permitting administrative access to the underlying operating system. Standard Amazon RDS restricts OS access, and deploying on EC2 instances violates the requirement to minimize maintenance.

Correct answer: D. Enable Multi Factor Authentication (MFA) for the AWS account root user account · E. Create a strong password for the AWS account root user

Securing the AWS account root user requires enabling multi-factor authentication and setting a strong password. Root access keys should never be created or shared, and sending credentials via email introduces severe security vulnerabilities, eliminating those distractors.

Correct answer: B. AWS Global Accelerator

AWS Global Accelerator improves non-HTTP UDP traffic performance and provides fast regional failover without requiring DNS changes. Route 53 is a DNS service, which contradicts the requirement to keep the custom DNS provider.

Correct answer: B. Use Amazon GuardDuty to monitor any malicious activity on data stored in Amazon S3. Use security assessments provided by Amazon Inspector to check for vulnerabilities on Amazon EC2 instances

Amazon GuardDuty continuously monitors accounts and S3 data for malicious activity using threat intelligence and machine learning. Amazon Inspector specifically assesses EC2 instances for unintended network accessibility and software vulnerabilities. The correct option pairs each service with its exact intended use case.

Correct answer: B. The Amazon EC2 instances should be deployed in a cluster placement group so that the underlying workload can benefit from low network latency and high network throughput

High Performance Computing workloads require tightly coupled node-to-node communication. A cluster placement group logically packs instances close together inside an Availability Zone to deliver the necessary low latency and high network throughput. Spread and partition groups prioritize isolation instead of network performance.

Correct answer: C. Push score updates to Amazon Kinesis Data Streams which uses an AWS Lambda function to process these updates and then store these processed updates in Amazon DynamoDB

Amazon Kinesis Data Streams seamlessly handles massive ingestion while maintaining strict record ordering. Using an AWS Lambda consumer abstracts polling complexities and pairs perfectly with Amazon DynamoDB for zero-administration processing. EC2-based alternatives violate the constraint to minimize operational overhead.

Correct answer: B. As the resources are unbalanced in the Availability Zones, Amazon EC2 Auto Scaling will compensate by rebalancing the Availability Zones. When rebalancing, Amazon EC2 Auto Scaling launches new instances before terminating the old ones, so that rebalancing does not compromise the performance or availability of your application · D. Amazon EC2 Auto Scaling creates a new scaling activity for terminating the unhealthy instance and then terminates it. Later, another scaling activity launches a new instance to replace the terminated instance

Amazon EC2 Auto Scaling compensates for unbalanced Availability Zones by launching new instances before terminating old ones to maintain availability. Conversely, when responding to an unhealthy instance, Auto Scaling creates a scaling activity to terminate it before launching a replacement.

Correct answer: C. Instruct the partner to create a Network Load Balancer (NLB) in front of the Amazon RDS for MySQL instance. Use AWS PrivateLink to expose the NLB as an interface VPC endpoint in the research company's VPC

AWS PrivateLink provides private connectivity between VPCs without requiring internet gateways, VPN connections, or Direct Connect. By placing a Network Load Balancer in front of the database, the partner can securely expose the RDS instance as an interface endpoint.

Correct answer: C. Configure AWS Web Application Firewall (AWS WAF) on the Application Load Balancer in a Amazon Virtual Private Cloud (Amazon VPC)

AWS Web Application Firewall provides geographic match conditions that allow or block web requests based on the viewer's geographic location. Security groups only filter IP addresses, and CloudFront geo restriction cannot attach directly to an Application Load Balancer inside a VPC.

Correct answer: C. Use an IAM policy to control access for clients who can mount your file system with the required permissions · E. Use VPC security groups to control the network traffic to and from your file system

Security groups restrict network access to the EFS mount targets. IAM policies evaluate identity-based authorization when mounting the file system. Network ACLs operate at the subnet boundary and lack the instance-level specificity required here.

Correct answer: C. When you apply a retention period to an object version explicitly, you specify a Retain Until Date for the object version · D. Different versions of a single object can have different retention modes and periods

S3 Object Lock applies retention settings to individual object versions. You can specify an explicit retain until date for specific versions, and explicit settings override bucket default configurations.

Correct answer: B. Use Amazon SQS FIFO (First-In-First-Out) queue in batch mode of 4 messages per operation to process the messages at the peak rate

Amazon SQS FIFO queues support up to 3000 messages per second via batching, maintaining strict ordering. A standard queue offers best-effort ordering rather than strict ordering, failing the processing requirement, while a basic FIFO queue maxes out at 300 messages per second.

Correct answer: D. The spreadsheet on the Amazon Elastic File System (Amazon EFS) can be accessed in other AWS regions by using an inter-region VPC peering connection

Amazon EFS supports access across AWS regions via inter-region VPC peering, maintaining a single collaborative file system. Moving the spreadsheet to object storage or relational databases introduces significant operational overhead and requires custom application logic to simulate collaboration.

Correct answer: C. Configure your Auto Scaling group by creating a scheduled action that kicks-off at the designated hour on the last day of the month. Set the desired capacity of instances to 10. This causes the scale-out to happen before peak traffic kicks in at the designated hour

Scheduled actions proactively adjust Auto Scaling group capacity for known recurring peaks by modifying the desired instance count. Target tracking policies react to metrics in real-time and cannot guarantee capacity ahead of designated schedule hours.

Correct answer: B. Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

Amazon S3 Standard-IA is intended for data accessed less frequently but requiring rapid access when needed, offering millisecond latency at a lower storage price. Since the workflow includes built-in retry logic, the slightly lower SLA of Standard-IA is completely acceptable for this use case.

Correct answer: C. Install an AWS Outposts rack in the company's data center. Use Amazon EKS Anywhere on Outposts to run containerized workloads locally while integrating with AWS APIs

AWS Outposts brings native AWS infrastructure and services directly into your on-premises data center. This allows you to run local compute and data while integrating with AWS APIs. However, option C is technically imprecise because EKS Anywhere is distinct from EKS on Outposts.

Correct answer: A. The junior scientist does not need to pay any transfer charges for the image upload

Amazon S3 Transfer Acceleration does not charge for uploads that are not accelerated. Data transferred into S3 from the internet is free, so you only pay standard or acceleration fees when the service functions correctly.

Correct answer: D. Attach the appropriate IAM role to the Amazon EC2 instance profile so that the instance can access Amazon S3 and Amazon DynamoDB

Attaching an IAM role to an EC2 instance profile uses temporary credentials to grant secure access to AWS services. Hardcoding long-term access keys on instances is a security risk, eliminating the options relying on manual credentials.

Correct answer: C. Configure individual S3 access points for each analytics service. Attach access point policies that restrict access to only the relevant prefix in the S3 bucket

Amazon S3 Access Points provide scalable and manageable access control for shared datasets. By attaching distinct policies to dedicated access points, you isolate prefix-level permissions perfectly without maintaining massive bucket policies.

Correct answer: A. Amazon Elastic File System (EFS) Standard–IA storage class

Amazon EFS Standard-Infrequent Access provides cost-effective, concurrent file storage for less frequently accessed data. Object storage lacks file system semantics, and EBS volumes cannot be mounted concurrently by hundreds of instances.

Correct answer: D. Set up a read replica and modify the application to use the appropriate endpoint

Aurora read replicas offload read traffic via the cluster reader endpoint, reducing I/O contention on the writer instance. Options mentioning standby instances or built-in caching confuse Aurora with standard RDS or ElastiCache.

Correct answer: C. Deploy a standard accelerator in AWS Global Accelerator and register the existing regional NLBs as endpoints. Use the accelerator to route user requests through AWS's global edge network to the closest healthy Regional NLB

AWS Global Accelerator routes TCP and UDP traffic through the AWS global network, reducing latency for real-time applications using Network Load Balancers. CloudFront cannot cache Layer 4 traffic, making it unsuitable here.

Correct answer: C. Enable storage auto-scaling for Amazon RDS MySQL

Enabling storage auto-scaling on an existing RDS database automatically expands capacity with zero administrative effort. Migrating to Aurora or DynamoDB requires unnecessary downtime and engineering overhead.

Correct answer: A. By default, an Amazon S3 object is owned by the AWS account that uploaded it. So the Amazon S3 bucket owner will not implicitly have access to the objects written by the Amazon Redshift cluster

By default, Amazon S3 objects are owned by the AWS account that uploaded them, even when the destination bucket is owned by another account. The bucket owner must explicitly grant object ownership or use cross-account IAM roles to access the unloaded files.

Correct answer: C. Migrate the SQL Server databases to a Multi-AZ Amazon RDS for SQL Server deployment. Enable encryption at rest by using an AWS Key Management Service (AWS KMS) managed key

Amazon RDS for SQL Server provides a fully managed relational database, significantly reducing operational overhead compared to EC2. A Multi-AZ deployment ensures high availability, and AWS KMS encryption easily meets stringent security and compliance requirements.

Correct answer: B. Take a snapshot of the database, copy it as an encrypted snapshot, and restore a database from the encrypted snapshot. Terminate the previous database

Amazon RDS does not allow you to enable encryption on an existing unencrypted database instance directly. You must create a snapshot of the database, copy it with encryption enabled, restore a new instance from the encrypted snapshot, and delete the old one.

Correct answer: A. Use AWS Glue ETL job to write the transformed data in the refined zone using a compressed file format · C. Setup a lifecycle policy to transition the raw zone data into Amazon S3 Glacier Deep Archive after 1 day of object creation

A lifecycle policy moves infrequently accessed raw data into Amazon S3 Glacier Deep Archive to minimize long-term storage costs. Writing refined data in a compressed format reduces storage expenses and improves Amazon Athena query performance.

Correct answer: A. Any database engine level upgrade for an Amazon RDS database instance with Multi-AZ deployment triggers both the primary and standby database instances to be upgraded at the same time. This causes downtime until the upgrade is complete

Major database engine upgrades require downtime on Amazon RDS because both the primary and standby instances are upgraded simultaneously. This ensures they remain perfectly synchronized, ruling out options claiming zero downtime.

Correct answer: D. Amazon FSx for Windows File Server

Amazon FSx for Windows File Server natively supports Windows environments and integrates with Microsoft Active Directory. It fully supports Distributed File System Replication, making it the ideal replacement for on-premises Windows file servers.

Correct answer: C. Purchase 70 reserved instances (RIs) and 30 spot instances

Reserved Instances provide significant discounts for steady-state workloads requiring continuous availability. Spot Instances offer the lowest cost for flexible, interruptible tasks like batch processing, making this combination the most cost-optimal.

Correct answer: D. Build the website as a static website hosted on Amazon S3. Create an Amazon CloudFront distribution with Amazon S3 as the origin. Use Amazon Route 53 to create an alias record that points to your Amazon CloudFront distribution

Static websites are best hosted on Amazon S3 paired with Amazon CloudFront for low-latency global content delivery. Using Route 53 alias records ensures seamless domain routing, while eliminating servers minimizes costs.

Correct answer: A. Deploy the application on multiple Amazon EC2 instances in an Auto Scaling group that spans two Availability Zones. Place an Application Load Balancer (ALB) in front of the group. Associate AWS WAF with the ALB

An Auto Scaling group across multiple Availability Zones ensures elasticity and fault tolerance. Integrating AWS WAF directly with an Application Load Balancer inspects Layer 7 traffic to block web exploits without managing underlying infrastructure.

Correct answer: C. Deploy the containerized application to Amazon Elastic Kubernetes Service (Amazon EKS) using AWS Fargate to avoid managing EC2 nodes · D. Replace the current messaging system with Amazon MQ, a fully managed broker that supports AMQP natively. Integrate the application with the Amazon MQ endpoint without modifying the existing message format

Amazon EKS with AWS Fargate removes the need to manage underlying worker nodes for Kubernetes workloads. Amazon MQ provides a fully managed message broker that natively supports AMQP, minimizing code changes and operational overhead.

Correct answer: B. Create an IAM role for the AWS Lambda function that grants access to the Amazon S3 bucket. Set the IAM role as the AWS Lambda function's execution role. Make sure that the bucket policy also grants access to the AWS Lambda function's execution role

Cross-account access requires granting permissions in both the IAM role and the S3 bucket policy. The Lambda execution role allows the function to assume permission, while the bucket policy explicitly trusts the cross-account role.

Correct answer: D. For each developer, define an IAM permission boundary that will restrict the managed policies they can attach to themselves

IAM permission boundaries set the maximum permissions an entity can ever attain, preventing privilege escalation. Boundaries can only be applied directly to IAM users or roles, not to IAM groups.

Correct answer: C. Send the extracted text to Amazon Comprehend for entity detection and sentiment analysis. Store the results in Amazon S3 for further access or visualization.

Amazon Comprehend provides pre-trained natural language processing for sentiment analysis and entity recognition directly from text. Pairing it with Amazon Textract creates a fully managed, serverless pipeline requiring no custom model training.

Correct answer: B. Provision an Amazon FSx for Windows File Server file system. Mount the file system using the SMB protocol on the media servers

Amazon FSx for Windows File Server provides fully managed shared storage with native SMB protocol support. It automates administrative tasks like patching, backups, and replication, minimizing operational overhead for the media studio.

Correct answer: A. Deploy the instances in three Availability Zones (AZs). Launch two instances in each Availability Zone (AZ)

Distributing six instances across three Availability Zones maintains the required capacity of four instances if one zone fails. This architecture provides high availability without the excessive costs of over-provisioning instances.

Correct answer: B. Build a shared services Amazon Virtual Private Cloud (Amazon VPC)

A shared services VPC centralizes resources like directory services and VPC endpoints when using AWS Transit Gateway. Fully meshed peering or transit VPCs introduce massive administrative overhead and additional data transfer charges.

Correct answer: B. The security group of Amazon RDS should have an inbound rule from the security group of the Amazon EC2 instances in the Auto Scaling group on port 5432 · D. The security group of the Application Load Balancer should have an inbound rule from anywhere on port 443 · E. The security group of the Amazon EC2 instances should have an inbound rule from the security group of the Application Load Balancer on port 80

Security groups must follow the exact traffic flow, restricting inbound access to only the necessary ports and originating security groups. The load balancer accepts traffic on port 443, instances accept port 80 from the load balancer, and the database accepts port 5432 from the instances.

Correct answer: A. Mount Amazon Elastic File System (Amazon EFS) on all Amazon EC2 instances. Write a one time job to copy the videos from all Amazon EBS volumes to Amazon EFS. Modify the application to use Amazon EFS for storing the videos · B. Write a one time job to copy the videos from all Amazon EBS volumes to Amazon S3 and then modify the application to use Amazon S3 standard for storing the videos

Using shared storage like Amazon S3 or Amazon EFS ensures data remains centrally accessible regardless of which load-balanced instance handles the request. Block storage like EBS is locally attached to one instance, causing data dispersion when traffic is distributed across multiple instances.

Correct answer: D. Instance B

The default termination policy prioritizes instances using older launch configurations before those using launch templates. Proximity to the next billing hour is an outdated legacy criterion that no longer applies to modern AWS billing.

Correct answer: C. Dedicated Instances

Dedicated Instances run on single-tenant hardware without offering visibility into the physical server sockets. Dedicated Hosts provide additional control for licensing but are more expensive and unnecessary unless you specifically need to manage instance placement.

Correct answer: D. Set up a service control policy (SCP) that prohibits changes to AWS CloudTrail, and attach it to the developer accounts

Service control policies enforce maximum permission boundaries across AWS Organizations member accounts, completely restricting even the root user. IAM policies attached to the root user fail because the root user can simply modify or detach those policies.

Correct answer: A. Use AWS Global Accelerator to distribute a portion of traffic to a particular deployment

AWS Global Accelerator shifts traffic using static IP addresses, bypassing client DNS caching for immediate blue/green transitions. Route 53 weighted routing is unreliable for rapid deployments because mobile devices cache DNS records for extended periods.

Correct answer: C. Enable DNS hostnames and DNS resolution for private hosted zones

Private hosted zones require both DNS resolution and DNS hostnames to be enabled on the VPC. The VPC resolver uses these settings to intercept and route internal domain queries to the correct Route 53 records.

Correct answer: B. Use Amazon Cognito Authentication via Cognito User Pools for your Application Load Balancer

Application Load Balancers natively support integrating with Amazon Cognito User Pools to offload user authentication. This allows your backend EC2 instances to focus solely on application business logic without handling custom authentication code.

Correct answer: A. By default, user data runs only during the boot cycle when you first launch an instance · E. By default, scripts entered as user data are executed with root user privileges

Amazon EC2 user data scripts execute with root user privileges and run only during the initial boot cycle when an instance is first launched. These defaults simplify automated configuration tasks without requiring sudo commands.

Correct answer: A. Server-Side Encryption with Customer-Provided Keys (SSE-C)

Server-Side Encryption with Customer-Provided Keys (SSE-C) lets Amazon S3 manage the encryption process while you retain full control over the encryption keys. This offloads storage processing without surrendering custom key management.

Correct answer: A. Create an IP match condition in the AWS WAF to block the malicious IP address

AWS WAF allows you to block specific malicious IP addresses using IP match conditions within your web ACL. Security groups only support allow rules, and network ACLs do not scale well for edge protection.

Correct answer: B. Migrate the application to Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Use Amazon Aurora Serverless v2 for MySQL to manage the database layer with auto-scaling and built-in high availability

Aurora Serverless v2 provides automatic scaling and high availability for MySQL-compatible workloads while minimizing operational overhead. Option D is viable but lacks the database auto-scaling requested, making Aurora Serverless v2 the strongest answer.

Correct answer: C. Create a virtual private cloud (VPC) in an account and share one or more of its subnets with the other accounts using Resource Access Manager

Sharing subnets across accounts using AWS Resource Access Manager avoids transit gateway fees and complex peering meshes. Instances deployed in the same shared subnet communicate locally without extra costs.

Correct answer: B. Create an AWS Snowball job and target an Amazon S3 bucket. Create a lifecycle policy to transition this data to Amazon S3 Glacier Deep Archive on the same day

Snowball jobs must target a standard S3 bucket, where a zero-day lifecycle policy immediately moves data to Glacier Deep Archive for the lowest archival cost. Snowball cannot write directly to Glacier classes.

Correct answer: A. Use an Amazon Simple Queue Service (Amazon SQS) FIFO (First-In-First-Out) queue, and make sure the telemetry data is sent with a Group ID attribute representing the value of the Desktop ID

Using an SQS FIFO queue with a Message Group ID matching the Desktop ID preserves per-system ordering while allowing multiple consumers to process messages concurrently. Without a Group ID, throughput is bottlenecked.

Correct answer: D. Create an encrypted snapshot of the database, share the snapshot, and allow access to the AWS Key Management Service (AWS KMS) encryption key

Sharing an encrypted RDS snapshot and granting KMS key access lets the auditor securely restore a private database copy. Options involving direct S3 exports or cross-account read replicas fail security or isolation requirements.

Correct answer: B. Create an Amazon Simple Queue Service (Amazon SQS) queue to buffer the incoming location data. Configure the backend application to poll the queue and process messages

An Amazon SQS queue decouples the ingestion layer from the processing layer, providing a buffer for traffic surges. Distractors like Firehose or custom queues introduce higher latency or unnecessary operational overhead.

Correct answer: C. Create a new Amazon S3 bucket in the us-east-1 region with replication enabled from this new bucket into another bucket in us-west-1 region. Enable SSE-KMS encryption on the new bucket in us-east-1 region by using an AWS KMS multi-region key. Copy the existing data from the current Amazon S3 bucket in us-east-1 region into this new Amazon S3 bucket in us-east-1 region

AWS KMS multi-region keys allow data to be encrypted and decrypted across different regions without re-encryption. Existing single-region keys cannot be converted or shared, so you must create a new multi-region key and copy the data to a new bucket for replication.

Correct answer: B. Leverage Amazon Aurora MySQL with Multi-AZ Aurora Replicas and create the dev database by restoring from the automated backups of Amazon Aurora

Amazon Aurora MySQL provides high availability and read scaling through Multi-AZ Aurora Replicas. You can restore the development database from continuous, incremental automated backups without impacting primary database performance.

Correct answer: D. Use Amazon EC2 Instance Hibernate

Amazon EC2 instance hibernation saves the RAM contents to the EBS root volume upon stopping. When the instance restarts, the operating system and previously running applications resume instantly, bypassing the lengthy bootstrap process.

Correct answer: C. Run the workload on a Spot Fleet

A Spot Fleet automatically maintains target capacity by launching replacement instances if interruptions occur. Individual Spot Instances lack automatic fleet replenishment, while Reserved Instances and Dedicated Hosts are too expensive for intermittent workloads.

Correct answer: B. Package the scripts into a container image. Use Amazon EventBridge Scheduler to define cron-based recurring schedules. Configure EventBridge Scheduler to invoke AWS Fargate tasks using Amazon ECS

Amazon EventBridge Scheduler combined with AWS Fargate provides a serverless, cron-based container execution environment without underlying infrastructure management. AWS Lambda is disqualified here because its fifteen-minute timeout cannot handle thirty-minute scripts.

Correct answer: D. Deploy a fully managed AWS Transfer Family endpoint with SFTP enabled. Configure it to store uploaded files directly in an Amazon S3 bucket. Set up IAM roles mapped to each vendor for secure bucket or prefix access

AWS Transfer Family provides a managed SFTP endpoint that maps users to IAM roles for secure direct-to-S3 uploads. Option A incorrectly focuses on bucket policies and Cognito, blurring the primary managed integration.

Correct answer: B. Use Amazon Security Lake to create a centralized data lake that automatically collects security-related logs and events from AWS services and third-party sources. Store the data in an Amazon S3 bucket managed by Security Lake

Amazon Security Lake automatically centralizes and normalizes security data, minimizing development effort. The other options require custom integrations and lack built-in native log collection, or use the wrong service for security data.

Correct answer: C. Deploy the web-tier Amazon EC2 instances in two Availability Zones (AZs), behind an Elastic Load Balancer. Deploy the Amazon RDS MySQL database in Multi-AZ configuration

Deploying instances across two Availability Zones behind an Elastic Load Balancer with a Multi-AZ database provides high availability. Read replicas do not provide availability, and Elastic Load Balancers cannot span across multiple regions.

Correct answer: C. Use Amazon Aurora Global Database to enable fast local reads with low latency in each region

Amazon Aurora Global Database provides low-latency global reads while maintaining the existing relational database schema. Options involving DynamoDB or Redshift require changing the database schema, violating the requirements.

Correct answer: A. Configure an AWS DataSync agent on the on-premises server that has access to the NFS file system. Transfer data over the AWS Direct Connect connection to an AWS PrivateLink interface VPC endpoint for Amazon EFS by using a private VIF. Set up an AWS DataSync scheduled task to send the video files to the Amazon EFS file system every 24 hours

AWS DataSync can efficiently transfer files over a private virtual interface to an Amazon EFS interface endpoint. The other options introduce unnecessary complexity or incorrectly use public VIFs and gateway endpoints for Direct Connect.

Correct answer: B. Leverage AWS Config managed rule to check if any third-party SSL/TLS certificates imported into ACM are marked for expiration within 30 days. Configure the rule to trigger an Amazon SNS notification to the security team if any certificate expires within 30 days

AWS Config managed rules check for imported ACM certificates nearing expiration, triggering SNS with minimal effort. ACM-generated certificates renew automatically, while CloudWatch requires more configuration overhead.

Correct answer: C. Purchase 80 reserved instances (RIs). Provision additional on-demand and spot instances per the workload demand (Use Auto Scaling Group with launch template to provision the mix of on-demand and spot instances)

Reserved instances provide the highest cost optimization for steady-state workloads, offering significant savings over on-demand. Spikes are handled by on-demand and spot instances, whereas steady spot instances risk interruptions.

Correct answer: A. Create a resource policy for the API Gateway API that explicitly denies access to all IP addresses except those listed in an allow list

API Gateway uses resource policies to restrict access based on IP addresses. Security groups cannot be attached to API Gateway because it is a managed service that does not deploy directly into your VPC subnets.

Correct answer: A. Create Amazon Aurora read replicas in the eu-west-1 region · D. Setup another fleet of Amazon EC2 instances for the web tier in the eu-west-1 region. Enable latency routing policy in Amazon Route 53

Cross-region Aurora read replicas scale database reads globally, while Route 53 latency routing directs users to the closest web tier. Failover and geolocation policies target disaster recovery and content restrictions, not performance.

Correct answer: B. The instance maybe in Impaired status · C. The health check grace period for the instance has not expired · D. The instance has failed the Elastic Load Balancing (ELB) health check status

Amazon EC2 Auto Scaling relies on configured health checks, grace periods, and specific health status reporting to determine when to terminate instances. A failing ELB health check won't trigger termination if the ASG health check type is still set to EC2, and impaired instances are given time to recover.

Correct answer: C. For security group B: Add an inbound rule that allows traffic only from security group A on port 1433 · D. For security group A: Add an inbound rule that allows traffic from all sources on port 443. Add an outbound rule with the destination as security group B on port 1433

Security groups enforce least privilege by restricting database access to specific ports and source security groups. The web tier allows public traffic on port 443 and restricts outbound traffic to the database on port 1433.

Correct answer: B. There are data transfer charges for replicating data across AWS Regions

There are no data transfer charges for replicating Amazon RDS data within the same AWS Region. Charges only apply when cross-Region replication is used. Regional or AZ-based replication options are incorrect because AWS does not bill for that traffic.

Correct answer: A. Use Amazon API Gateway HTTP API with a native JWT authorizer configured to validate tokens from the OIDC provider

Amazon API Gateway HTTP APIs support native JWT authorizers, enabling automatic validation of tokens from an OIDC provider. REST APIs require custom Lambda authorizers, increasing latency and costs.

Correct answer: C. If your instance has a public IPv4 address, it retains the public IPv4 address after recovery · E. A recovered instance is identical to the original instance, including the instance ID, private IP addresses, Elastic IP addresses, and all instance metadata

Automatic instance recovery preserves the instance ID, private IP addresses, Elastic IP addresses, and public IPv4 address. Terminated instances cannot be recovered, and in-memory data is lost during the recovery process because the underlying hardware has failed.

Correct answer: D. With cross-zone load balancing enabled, one instance in Availability Zone A receives 20% traffic and four instances in Availability Zone B receive 20% traffic each. With cross-zone load balancing disabled, one instance in Availability Zone A receives 50% traffic and four instances in Availability Zone B receive 12.5% traffic each

With cross-zone load balancing enabled, traffic is distributed evenly across all registered targets, giving each instance twenty percent of the load. When disabled, each load balancer node routes strictly within its local Availability Zone, heavily skewing traffic distribution.

Correct answer: A. Create an AWS Transit Gateway and attach all 25 VPCs to it. Enable route propagation for each attachment to automatically manage inter-VPC routing · E. Create a transit virtual interface (VIF) from the Direct Connect connection and associate it with the transit gateway

A transit gateway centralizes routing and enables transitive peering between attached VPCs. Associating a Direct Connect transit VIF with the transit gateway extends this hub-and-spoke model to on-premises networks, eliminating the operational overhead of managing individual private VIFs.

Correct answer: C. Use SQS long polling to retrieve messages from your Amazon SQS queues

Amazon SQS long polling reduces the number of empty responses by waiting for messages to arrive before returning. Short polling immediately returns empty responses, increasing API call costs.

Correct answer: B. Configure Amazon Simple Queue Service (Amazon SQS) queue to decouple microservices running faster processes from the microservices running slower ones

Amazon SQS effectively decouples microservices by buffering messages, allowing slower consumers to process tasks from faster producers. SNS pushes messages immediately without buffering.

Correct answer: B. You can copy an Amazon Machine Image (AMI) across AWS Regions · E. You can share an Amazon Machine Image (AMI) with another AWS account · F. Copying an Amazon Machine Image (AMI) backed by an encrypted snapshot cannot result in an unencrypted target snapshot

Amazon Machine Images can be copied across AWS Regions and shared between AWS Accounts. Additionally, copying an encrypted snapshot will always result in an encrypted target snapshot.

Correct answer: A. You can use an Internet Gateway ID as the custom source for the inbound rule

Security group inbound rules require a valid source, such as an IP range or another security group. Internet Gateway IDs cannot be used as a source in security group rules.

Correct answer: C. Use Amazon ElastiCache to improve the performance of compute-intensive workloads · D. Use Amazon ElastiCache to improve latency and throughput for read-heavy application workloads

Amazon ElastiCache accelerates read-heavy and compute-intensive workloads by serving frequently accessed data from memory. It is not optimal for write-heavy applications or complex relational joins.

Correct answer: C. Use Amazon Kinesis Data Streams to process the data streams as well as decouple the producers and consumers for the real-time data processor

Amazon Kinesis Data Streams enables custom applications to process and analyze streaming data in real time. SNS and SQS lack native streaming capabilities, while Kinesis Data Firehose is designed to load data directly into destinations rather than supporting custom processing logic.

Correct answer: B. Launch AWS Global Accelerator and create endpoints for all the Regions. Register the Application Load Balancers of each Region to the corresponding endpoints

AWS Global Accelerator provides two static anycast IP addresses that front Application Load Balancers across multiple regions, simplifying firewall rules. Elastic IPs cannot be assigned to Application Load Balancers, and Layer 3 load balancing introduces unnecessary operational complexity.

Correct answer: B. File Gateway Configuration of AWS Storage Gateway · E. Amazon FSx for Windows File Server

Amazon FSx for Windows File Server provides fully managed native Windows file storage. The File Gateway configuration of AWS Storage Gateway also offers SMB protocol access, seamlessly bridging on-premises environments with Amazon S3.

Correct answer: C. Configure an Amazon CloudWatch alarm that triggers the recovery of the Amazon EC2 instance, in case the instance fails. The instance, however, should only be configured with an Amazon EBS volume

Configuring an Amazon CloudWatch alarm to automatically recover an EC2 instance provides a cost-effective solution for system failures. The recovery action requires the instance to use Amazon EBS volumes, as instances relying on ephemeral instance store volumes cannot be restored.

Correct answer: B. Configure Amazon CloudFront to distribute the data hosted on Amazon S3 cost-effectively

Configuring Amazon CloudFront to distribute website content reduces both user latency and data transfer costs. Serving data directly from CloudFront edge locations is significantly cheaper than standard Amazon S3 outbound internet data transfer rates.

Correct answer: B. Create an outbound endpoint on Amazon Route 53 Resolver and then Amazon Route 53 Resolver can conditionally forward queries to resolvers on the on-premises network via this endpoint · C. Create an inbound endpoint on Amazon Route 53 Resolver and then DNS resolvers on the on-premises network can forward DNS queries to Amazon Route 53 Resolver via this endpoint

An inbound Route 53 Resolver endpoint allows on-premises networks to forward DNS queries to AWS. Conversely, an outbound endpoint uses conditional forwarding rules to resolve AWS VPC queries against your on-premises DNS infrastructure securely.

Correct answer: C. Use AWS CloudFormation StackSets to deploy the same template across AWS accounts and regions

AWS CloudFormation StackSets extend stack functionality to deploy templates across multiple accounts and regions in a single operation. Standard templates and stacks lack this cross-account deployment capability, and AWS Resource Access Manager shares resources rather than deploying them.

Correct answer: B. Use Amazon GuardDuty to monitor any malicious activity on data stored in Amazon S3. Use Amazon Macie to identify any sensitive data stored on Amazon S3

Amazon Macie uses machine learning to discover sensitive data like PII in S3, while Amazon GuardDuty analyzes logs for threats. GuardDuty handles threat detection, and Macie handles data classification and discovery.

Correct answer: A. Deploy Amazon FSx for Windows File Server and mount it using the SMB protocol from both Windows and Linux EC2 instances

Amazon FSx for Windows File Server natively supports SMB, NTFS permissions, and Active Directory integration for Windows and Linux instances. EFS and Lustre lack Windows ACL support, while Mountpoint for S3 is Linux-only and lacks file system features.

Correct answer: B. Use Amazon FSx for Windows File Server as a shared storage solution

Amazon FSx for Windows File Server natively integrates with self-managed Active Directory and provides SMB shared storage. EFS and Lustre are Linux-based, and File Gateway acts as a hybrid bridge rather than a native shared file system.

Correct answer: C. Use Amazon ECS with Fargate launch type. Provision an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS volume inside the container at runtime to provide persistent storage access

Amazon ECS with the Fargate launch type provides a fully managed, serverless compute environment that natively supports mounting Amazon EFS volumes for persistent storage. Options using EKS or manual EBS management violate the requirement to avoid infrastructure management.

Correct answer: C. Security Groups are stateful, so allowing inbound traffic to the necessary ports enables the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic

Security groups are stateful, automatically allowing return traffic for approved inbound connections. Network ACLs are stateless, requiring explicit outbound rules for ephemeral ports to complete the connection.

Correct answer: D. Configure AWS Auto Scaling to scale out the Amazon ECS cluster when the ECS service's CPU utilization rises above a threshold

Amazon ECS service auto scaling uses CloudWatch metrics from your specific ECS service, such as average CPU utilization, to add or remove tasks dynamically. Load balancers and generic CloudWatch alarms do not directly trigger ECS service scaling policies.

Correct answer: B. Security Groups can be associated with a NAT instance · C. NAT instance can be used as a bastion server · E. NAT instance supports port forwarding

A NAT instance operates as a standard EC2 instance, meaning it can be used as a bastion server, supports port forwarding, and utilizes security groups. A managed NAT gateway is a highly available service that does not support these specific features.

Correct answer: B. Use Amazon DynamoDB point in time recovery to restore the table to the state just before corrupted data was written

Amazon DynamoDB point-in-time recovery (PITR) provides continuous backups with per-second granularity, allowing you to restore a table to a specific state before data corruption occurred. On-demand backups are manual snapshots and cannot recover unscheduled mid-write errors.

Correct answer: A. AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD)

AWS Managed Microsoft AD allows you to run directory-aware workloads in the cloud and establish trust relationships with your on-premises Active Directory. Simple AD lacks trust support, and AD Connector merely proxies requests to your existing infrastructure.

Correct answer: B. Use AWS Config to review resource configurations to meet compliance guidelines and maintain a history of resource configuration changes

AWS Config is designed specifically to assess resource configurations for compliance and maintain a detailed history of changes over time. CloudTrail logs API actions, while CloudWatch monitors performance metrics, neither providing configuration state histories.

Correct answer: B. Set up an Amazon FSx for ONTAP instance. Configure an FSx for ONTAP file system on the root volume and migrate the data to the FSx for ONTAP volume

Amazon FSx for NetApp ONTAP provides multi-protocol access to both SMB and NFS clients natively. FSx for OpenZFS and EFS only support NFS, eliminating them for environments requiring simultaneous Windows and Linux access.

Correct answer: D. Use Amazon API Gateway and configure usage plans with API keys to apply rate limits and quotas per client

Amazon API Gateway natively supports per-client rate limiting and usage quotas through API keys tied to usage plans. Load balancers operate at the network layer and do not provide built-in application-layer quota management for external consumers.

Correct answer: B. Use a target tracking scaling policy based on a custom Amazon SQS queue metric

A target tracking scaling policy uses a custom backlog per instance metric to dynamically adjust capacity based on real demand. Simple or step scaling policies react slower to sudden traffic spikes, leading to degraded application performance.

Correct answer: A. Use Availability Zone (AZ) ID to uniquely identify the Availability Zones across the two AWS Accounts

AWS maps availability zone names differently across individual accounts for resource distribution. To ensure instances align in the exact same physical location across accounts, you must reference the unique Availability Zone ID.

Correct answer: A. Set up an IAM service role with the appropriate permissions to allow access to the Amazon DynamoDB table. Configure an instance profile to assign this IAM role to the Amazon EC2 instance

Assigning an IAM role via an instance profile is the secure AWS best practice for granting EC2 instances access to other AWS services. Hardcoding IAM user credentials in local storage or S3 buckets poses a severe security risk and violates AWS security principles.

Correct answer: B. Create a virtual private gateway (VGW) on the AWS side of the VPN and a Customer Gateway on the on-premises side of the VPN

For an AWS Site-to-Site VPN, the virtual private gateway anchors the AWS side, while the customer gateway represents the on-premises router. Placing the virtual private gateway on-premises fails because that component is strictly an AWS-managed VPC endpoint.

Correct answer: D. Set up an Amazon RDS MySQL DB instance with Multi-AZ functionality enabled to synchronously replicate the data

Amazon RDS Multi-AZ deployments provide high availability by synchronously replicating data to a standby instance in a different Availability Zone. Read replicas rely on asynchronous replication, making them unsuitable for meeting strict data loss prevention requirements.

Correct answer: C. Enable Default Host Management Configuration in AWS Systems Manager Quick Setup

Systems Manager Default Host Management Configuration automatically configures EC2 instances with required permissions for patching without altering existing IAM roles. Detaching or replacing roles risks application disruption, while cron jobs and hybrid activations add administrative overhead.

Correct answer: D. Create a read replica and connect the report generation tool/application to it

Routing heavy business reporting queries to an Amazon RDS read replica offloads read traffic from the primary database, keeping production applications unaffected. Multi-AZ standby instances cannot serve read traffic, and upgrading instances unnecessarily increases costs.

Correct answer: A. Traffic is routed to instances using the primary private IP address specified in the primary network interface for the instance

When registering targets via instance IDs, a Network Load Balancer routes traffic using the primary private IP address of the instance's primary network interface. Public and Elastic IP addresses are ignored for internal routing to maintain VPC network boundaries.

Correct answer: C. Use AWS DataSync to automate and accelerate online data transfers to the given AWS storage services

AWS DataSync automates and accelerates online migrations directly into Amazon S3, Amazon EFS, and Amazon FSx. AWS Transfer Family and File Gateway lack support for all three services, while Snowball Edge is strictly an offline physical migration appliance.

Correct answer: C. Internet Gateway (I1)

An Internet Gateway performs network address translation for instances assigned public IPv4 addresses in a public subnet. A NAT instance translates traffic for private subnet instances, so it is unnecessary and unused when the destination is already internet routable.

Correct answer: C. Configure a Network Address Translation gateway (NAT gateway) in the public subnet of the VPC

A NAT gateway enables instances in a private subnet to initiate outbound IPv4 traffic to the internet while preventing inbound connections. The question specifies a fully managed service, which eliminates the unmanaged NAT instance, and IPv4, which eliminates the IPv6-only egress-only gateway.

Correct answer: B. If a user or role has an IAM permission policy that grants access to an action that is either not allowed or explicitly denied by the applicable service control policy (SCP), the user or role can't perform that action · C. Service control policy (SCP) affects all users and roles in the member accounts, including root user of the member accounts · D. Service control policy (SCP) does not affect service-linked role

Service Control Policies act as guardrails that set the maximum available permissions for an organization, overriding even the root user of member accounts. The key trap is that SCPs never affect service-linked roles, and any IAM policy granting access is rendered invalid if denied by an SCP.

Correct answer: C. Set up three NAT gateways, one in each public subnet in each AZ. Create a custom route table for each AZ that forwards non-local traffic to the NAT gateway in its AZ

NAT gateways must be deployed in public subnets to provide outbound internet access to private subnets. To maintain high availability across Availability Zones, you must deploy a NAT gateway in the public subnet of each specific Availability Zone rather than sharing one.

Correct answer: A. The instances launched by both Launch Template LT1 and Launch Template LT2 will have dedicated instance tenancy

EC2 instance tenancy becomes dedicated if either the launch template or the VPC specifies dedicated tenancy. If either layer forces dedicated hardware, the resulting instance inherits it.

Correct answer: C. Use Amazon S3 for hosting the web application and use Amazon S3 Transfer Acceleration (Amazon S3TA) to reduce the latency that geographically dispersed users might face

Amazon S3 Transfer Acceleration optimizes large file uploads by routing traffic over the AWS global backbone. CloudFront can also accelerate large transfers, creating slight ambiguity.

Correct answer: B. Use Amazon EFS with Provisioned Throughput mode

Amazon EFS with Provisioned Throughput mode decouples throughput capacity from storage size, optimizing high-frequency access for smaller datasets. DynamoDB has a strict 400 KB item size limit, while standard EFS bursting relies heavily on the total data stored.

Correct answer: C. Deploy an internal AWS Transfer Family SFTP server across two Availability Zones backed by Amazon S3. Configure a Transfer Family managed workflow to invoke an AWS Lambda function immediately after file upload completes

Deploying an internal Transfer Family server across multiple Availability Zones ensures secure network integration and high availability. Configuring a managed workflow to trigger Lambda guarantees immediate event-driven processing without relying on inefficient polling.

Correct answer: A. Set up a VPC gateway endpoint for Amazon S3. Attach an endpoint policy to the endpoint. Update the route table to direct the S3-bound traffic to the VPC endpoint

A VPC gateway endpoint routes S3 traffic privately within the AWS network, bypassing the NAT gateway and eliminating data processing fees. Egress-only gateways apply to IPv6 traffic, and Gateway Load Balancer endpoints secure virtual appliances, not S3 access.

Correct answer: D. Create a CNAME record

A CNAME record maps one fully qualified domain name to another, which properly aliases the third-party application. Alias records only point to AWS resources, and A records map to IP addresses.

Correct answer: C. Make sure that the name of the FIFO (First-In-First-Out) queue ends with the .fifo suffix · D. Make sure that the throughput for the target FIFO (First-In-First-Out) queue does not exceed 3,000 messages per second · E. Delete the existing standard queue and recreate it as a FIFO (First-In-First-Out) queue

To migrate from an SQS standard queue, you must delete it and recreate a new FIFO queue with the mandatory .fifo suffix. FIFO queues support up to 3,000 messages per second when batching is enabled. You cannot convert existing queues.

Correct answer: B. Use AWS Global Accelerator to provide a low latency way to distribute live sports results

AWS Global Accelerator optimizes non-HTTP traffic like UDP by routing users to optimal endpoints over the AWS global network. CloudFront is meant for HTTP and HTTPS content delivery, making it incompatible with proprietary UDP protocols.

Correct answer: A. AWS Database Migration Service (AWS DMS) · C. AWS Schema Conversion Tool (AWS SCT)

Heterogeneous database migrations require the AWS Schema Conversion Tool to translate source schemas before moving data with AWS Database Migration Service. Basic Schema Copy omits stored procedures and foreign keys, failing complex requirements.

Correct answer: A. Use Amazon CloudFront with Amazon S3 as the storage solution for the static assets

Amazon CloudFront paired with Amazon S3 creates a highly available, serverless architecture ideal for delivering static assets globally without provisioning underlying infrastructure. Distractors involving relational databases or Lambda introduce unnecessary compute overhead for simple file downloads.

Correct answer: A. Subscribe to AWS Shield Advanced to gain proactive DDoS protection. Engage the AWS DDoS Response Team (DRT) to analyze traffic patterns and apply mitigations. Use the built-in logging and reporting to maintain an audit trail of detected events

AWS Shield Advanced provides managed DDoS protection, access to the DDoS Response Team, and detailed diagnostic reports for Layer 3, 4, and 7 attacks. Services like Inspector and GuardDuty focus on vulnerability and threat detection, not real-time volumetric attack mitigation.

Correct answer: D. Create an alias record for covid19survey.com that routes traffic to www.covid19survey.com

Amazon Route 53 alias records allow traffic routing for a zone apex to specific AWS resources and other records. Alias queries to AWS resources are free, making them more cost-effective than standard CNAME records.

Correct answer: B. Schedule a weekly Amazon EventBridge event cron expression to invoke an AWS Lambda function that runs the database rollover job

Amazon EventBridge can trigger AWS Lambda on a weekly cron schedule to execute a short Python script efficiently. AWS Glue is suited for heavy ETL processing, and EC2 instances violate the serverless requirement while adding unnecessary operational overhead.

Correct answer: D. Provisioned IOPS SSD (io1)

Provisioned IOPS SSD volumes deliver consistent, high-performance storage tailored for I/O intensive workloads. It easily scales to 25,000 IOPS per volume, whereas standard SSDs cap at 16,000 and HDDs offer significantly lower limits.

Correct answer: D. If a spot request is persistent, then it is opened again after your Spot Instance is interrupted · E. Spot Fleets can maintain target capacity by launching replacement instances after Spot Instances in the fleet are terminated · F. When you cancel an active spot request, it does not terminate the associated instance

Persistent spot requests reopen after an instance is interrupted, and Spot Fleets automatically launch replacement instances to maintain target capacity. Canceling an active spot request does not terminate its already running associated instances.

Correct answer: C. Use VPC sharing to share one or more subnets with other AWS accounts belonging to the same parent organization from AWS Organizations

VPC sharing via AWS Resource Access Manager enables sharing individual subnets across accounts within AWS Organizations. VPC peering connects entire VPC networks and does not support centralized subnet sharing for highly interconnected application resources.

Correct answer: B. Use AWS Lambda to run the Python-based microservice. Integrate it with Amazon API Gateway for HTTP access and enable provisioned concurrency for performance during peak loads

AWS Lambda paired with Amazon API Gateway provides a fully managed, automatically scaling serverless architecture ideal for Python microservices. Provisioned concurrency further reduces cold start latency. Container services like ECS require more operational overhead.

Correct answer: C. Host the static content on Amazon S3 and use AWS Lambda with Amazon DynamoDB for the serverless web application that handles dynamic content. Amazon CloudFront will sit in front of AWS Lambda for distribution across diverse regions

A serverless architecture requires services that do not require you to provision or manage servers, making S3, Lambda, and DynamoDB the ideal combination here. Options using Amazon EC2 are eliminated because virtual servers require operating system management.

Correct answer: A. Use VPC endpoint to access Amazon SQS

VPC endpoints powered by AWS PrivateLink allow private connectivity to supported AWS services without traversing the public internet. Since the requirement is to keep traffic off the public internet, options relying on internet gateways, NAT devices, or VPNs are invalid.

Correct answer: B. Use Amazon Kinesis Data Streams to ingest the data, process it using AWS Lambda or run analytics using Amazon Kinesis Data Analytics

Amazon Kinesis Data Streams provides massive scalability for real-time data streaming and integrates natively with Lambda for analytics. SQS handles message decoupling, but Kinesis is purpose-built for high-throughput streaming time-series data.

Correct answer: B. Configure a single Amazon S3 bucket to hold all data. Use server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data

When using Amazon S3 server-side encryption with S3 managed keys (SSE-S3), each object is automatically encrypted with a unique data key. This satisfies the requirement for unique keys without requiring complex data partitioning or KMS configuration.

Correct answer: C. Set up database migration from Amazon RDS MySQL to Amazon Aurora MySQL. Swap out the MySQL read replicas with Aurora Replicas. Configure Aurora Auto Scaling

Migrating to Amazon Aurora MySQL provides low-latency replicas that share the same distributed storage volume as the primary instance. This virtually eliminates replication lag without requiring code changes or intense resource management.

Correct answer: D. Connect both Direct Connect links to a shared Direct Connect gateway. Attach each Region's virtual private gateway (VGW) to the Direct Connect gateway, enabling transitive routing between the VPCs and the on-premises networks across Regions

A Direct Connect gateway connects Direct Connect links to VPCs across different Regions, enabling scalable hybrid transit. Inter-Region VPC peering lacks transitive routing, and third-party VPNs require excessive operational overhead.

Correct answer: B. Place an Amazon ElastiCache for Redis cluster in front of the PostgreSQL database. Modify the application to cache recent location reads and updates in Redis, using a TTL-based eviction strategy

Amazon ElastiCache for Redis provides sub-millisecond latency and natively supports geospatial data, making it perfect for handling frequent GPS updates. The other options fail to address the high-frequency write bottleneck, as read replicas and multi-AZ deployments do not offload rapid write operations.

Correct answer: C. Integrate Amazon ElastiCache for Redis between the application and Aurora. Cache frequently accessed query results in Redis to reduce the number of identical read requests hitting the database

Amazon ElastiCache for Redis acts as an in-memory caching layer to serve repeated reads directly, significantly reducing identical database queries. Adding Aurora read replicas is less cost-effective here because it still routes repeated queries to the database, consuming unnecessary resources.

Correct answer: B. Add a rule to authorize the security group of the Application Load Balancer

Referencing a security group directly inside an inbound rule ensures strict traffic isolation between associated resources. Allowing specific CIDR blocks is less secure because any resource within that network range could bypass the intended load balancer perimeter.

Correct answer: B. Amazon MQ

Amazon MQ provides a managed message broker service that supports industry-standard protocols including MQTT for seamless migrations. AWS native services like SQS and SNS rely on proprietary APIs, requiring you to rewrite application logic during cloud migration.

Correct answer: C. Use predictive scaling for the Auto Scaling group to analyze daily and weekly patterns, and configure dynamic scaling with target tracking policies to respond to real-time traffic changes

Predictive scaling uses machine learning to analyze historical traffic and provision capacity proactively before demand spikes occur. Combining it with target tracking ensures the system reacts dynamically to real-time changes, whereas step or scheduled scaling reactively handles traffic.

Correct answer: D. Set up AWS Global Accelerator. Register the Application Load Balancers in different Regions to the AWS Global Accelerator. Configure the on-premises firewall's rule to allow static IP addresses associated with the AWS Global Accelerator

AWS Global Accelerator provides static anycast IP addresses that serve as fixed entry points for regional load balancers. Using Lambda scripts or migrating to Network Load Balancers creates administrative overhead because underlying IP addresses frequently change.

Correct answer: B. Geoproximity routing

Geoproximity routing uses a bias value to dynamically expand or shrink the geographic boundary routing traffic to resources. Geolocation routing maps fixed boundaries to resources, lacking the dynamic bias sizing feature.

Correct answer: D. Create an AWS Transit Gateway with equal cost multipath routing and add additional VPN tunnels

AWS Transit Gateway supports equal cost multi-path routing, allowing multiple VPN tunnels to aggregate throughput beyond single tunnel limits. Virtual private gateways lack ECMP support, making them incapable of increasing VPN bandwidth.

Correct answer: B. Attach an AWS Identity and Access Management (IAM) role to AWS Lambda · D. Use IAM authentication from AWS Lambda to Amazon RDS PostgreSQL

IAM database authentication allows AWS Lambda to use temporary tokens to access Amazon RDS for PostgreSQL. You must attach an execution role to the function to grant permissions to generate these tokens, while security groups only control network access.

Correct answer: D. The Time To Live (TTL) is still in effect

DNS resolvers cache records for the duration of the Time To Live, or TTL. If the TTL has not expired, clients will continue using the cached IP address of the old load balancer instead of querying Route 53 for the updated record.

Correct answer: B. Use Amazon EventBridge to decouple the system architecture

Amazon EventBridge is the ideal service to asynchronously decouple a SaaS application because it natively integrates with third-party providers. While SNS and SQS decouple systems, they lack built-in partner integrations for this specific SaaS requirement.

Correct answer: B. Use AWS Key Management Service (KMS) to create a customer managed key with automatic rotation enabled. Configure the S3 bucket's default encryption to use the customer managed key. Migrate the data to the S3 bucket

A customer managed KMS key with automatic rotation satisfies the strict compliance requirement for auditable annual key rotation. SSE-S3 handles encryption transparently but does not allow you to control or track the key rotation schedule.

Correct answer: B. The security group of the Amazon EC2 instance does not allow for traffic from the security group of the Application Load Balancer · C. The route for the health check is misconfigured

An Application Load Balancer marks targets as unhealthy if its health checks fail. This usually happens when the health check ping path is misconfigured or the target security group blocks traffic from the load balancer.

Correct answer: A. Each of the four targets in AZ-A receives 12.5% of the traffic

Route 53 distributes traffic equally between the two Network Load Balancer nodes. With cross-zone load balancing disabled, each node routes its fifty percent of traffic strictly within its own zone, giving each target in the four-target zone exactly twelve point five percent.

Correct answer: B. Migrate the data to Amazon RDS for SQL Server database in a Multi-AZ deployment

Amazon RDS for SQL Server in a Multi-AZ deployment provides high availability through an automatic standby instance in another zone. This minimizes operational overhead compared to EC2, while avoiding the non-existent cross-region Multi-AZ configuration.

Correct answer: A. Use Tape Gateway, which can be used to move on-premises tape data onto AWS Cloud. Then, Amazon S3 archiving storage classes can be used to store data cost-effectively for years

Tape Gateway presents cloud-backed virtual tapes to on-premises backup applications without changing existing workflows. It archives this data directly into low-cost Amazon S3 Glacier or Glacier Deep Archive storage classes, minimizing long-term storage costs.

Correct answer: D. Warm Standby

A warm standby disaster recovery strategy keeps a scaled-down but fully functional version of your environment always running in the cloud. This differs from a pilot light, which only keeps core services active while scaling others during a failover event.

Correct answer: D. test.example.com

In Elastic Load Balancing host-based routing, an asterisk wildcard matches zero or more characters before the specified domain. Therefore, the pattern asterisk dot example dot com matches test dot example dot com, but it does not match the exact apex domain example dot com.

Correct answer: B. Enable deletion protection on DynamoDB tables

Enabling deletion protection on a DynamoDB table prevents accidental table deletion by blocking the destructive API call entirely. Point-in-time recovery is a reactive backup mechanism that helps restore deleted data but does not prevent the initial deletion or resulting downtime.

Correct answer: D. Deploy AWS IAM Identity Center and configure it to use AWS Directory Service for Microsoft Active Directory (Enterprise Edition). Establish a two-way trust relationship between the managed directory and the on-premises Active Directory to enable federated authentication across all AWS accounts

AWS IAM Identity Center centrally manages single sign-on access across multiple AWS accounts. By connecting it to an AWS Managed Microsoft AD with a two-way trust to your on-premises directory, users can federate seamlessly without duplicating identity stores.

Correct answer: A. Create EFS mount targets in each AZ and mount the EFS file system to EC2 instances in the same AZ as the mount target

Provisioning an Amazon EFS mount target in each Availability Zone ensures instances access local resources, yielding the lowest possible latency. Deploying a single target forces cross-AZ traffic, increasing delay, while using Mountpoint for S3 confuses object storage with shared file systems.

Correct answer: B. Use AWS Direct Connect connection as a primary connection · C. Use AWS Site-to-Site VPN as a backup connection

AWS Direct Connect provides a dedicated private network path for a primary connection. To guarantee uptime over the public internet during a failure, an encrypted AWS Site-to-Site VPN serves as the standard backup layer. Egress-only gateways are for IPv6 VPC outbound traffic, not hybrid connectivity.

Correct answer: A. Use AWS CloudFormation to manage Amazon RDS databases

AWS CloudFormation allows you to provision resources using infrastructure as code, ensuring reusable templates with standardized best practices. The other options are incorrect because they rely on reactive monitoring, generic alerts, or unrelated IAM policies instead of using a proactive template.

Correct answer: A. Set up Amazon S3 batch replication to copy objects across Amazon S3 buckets in another Region using S3 console and then delete the replication configuration · E. Copy data from the source bucket to the destination bucket using the aws S3 sync command

The AWS CLI sync command efficiently copies large datasets between S3 buckets without duplicating existing files. S3 batch replication is the second valid choice because it enables you to replicate existing objects on demand, which can be deleted afterward for a one-time migration.

Correct answer: B. Use a Network Load Balancer with an Auto Scaling Group

A Network Load Balancer provides a static, predictable IP address required for strict whitelisting. Application and Classic Load Balancers expose dynamic DNS names, making them unsuitable for fixed IP whitelisting requirements.

Correct answer: A. Use Amazon RDS Read Replicas

Amazon RDS Read Replicas scale read capacity horizontally without modifying application database logic. ElastiCache requires code changes, and Multi-AZ strictly provides availability and disaster recovery failover.

Correct answer: A. Create an Amazon Machine Image (AMI) after installing the software and copy the AMI across all Regions. Use this Region-specific AMI to run the recovery process in the respective Regions

Pre-baked Amazon Machine Images launch instances in minutes to meet strict Recovery Time Objectives. AMIs are Regional resources, so they must be copied to target Regions to enable rapid multi-Region disaster recovery.

Correct answer: B. Use AWS Transit Gateway to connect the Amazon VPCs to the on-premises networks

AWS Transit Gateway provides a fully managed, highly available hub-and-spoke model connecting VPCs and on-premises networks. VPC peering is eliminated because it lacks transitive routing required for on-premises connectivity.

Correct answer: A. Use field level encryption in Amazon CloudFront to protect sensitive data for specific content · C. Use an origin group with primary and secondary origins to configure Amazon CloudFront for high-availability and failover · F. Amazon CloudFront can route to multiple origins based on the content type

Amazon CloudFront uses cache behaviors to route requests to different origins based on path patterns or content type. Origin groups provide automatic failover for high availability, while field-level encryption protects specific sensitive data at the edge.

Correct answer: D. Use a bucket policy to grant permission to users in its account as well as to users in another account

S3 bucket policies are resource-based policies that can easily grant cross-account access to an S3 bucket. However, the question is ambiguous because IAM user policies in the target account can also be used to assume a role for cross-account access.

Correct answer: B. Check if the route table is configured with internet gateway · E. Check if the security groups allow ping from the source

If you cannot ping an Amazon EC2 instance, you must verify that the route table directs internet traffic to the internet gateway. You must also ensure the security group allows inbound ICMP traffic, which is required for ping requests.

Correct answer: C. Use Amazon DynamoDB DAX

Amazon DynamoDB Accelerator (DAX) provides a fully managed in-memory cache that directly integrates with DynamoDB to resolve hot partition read issues transparently. Using ElastiCache would require significant application code refactoring, which violates the scenario constraints.

Correct answer: C. Use Amazon EC2 user data to customize the dynamic installation parts at boot time · D. Create a Golden Amazon Machine Image (AMI) with the static installation components already setup

Baking static installation components into a custom Golden AMI drastically reduces boot times, while EC2 user data handles the remaining dynamic configuration. Attempting to run the entire forty-five minute installation process via user data alone violates the two-minute requirement.

Correct answer: A. Use a Cluster placement group

A cluster placement group packs EC2 instances close together inside a single Availability Zone, delivering low-latency, high-throughput network performance for tightly coupled workloads. Spread placement groups intentionally isolate instances across hardware to reduce correlated failures, which hurts performance.

Correct answer: A. Configure Amazon RDS to use SSL for data in transit

Configuring Amazon RDS to use SSL or TLS encrypts the data in transit between the application and the database, fulfilling the end-to-end security requirement. Security groups, network ACLs, and IAM authentication manage access control rather than encrypting the network payload.

Correct answer: C. Create a Lifecycle Policy to transition objects to Amazon S3 Standard IA using a prefix after 45 days · E. Create a Lifecycle Policy to transition all objects to Amazon S3 Glacier after 180 days

Amazon S3 Standard-IA provides high availability across multiple Availability Zones while lowering costs for infrequently accessed data. S3 One Zone-IA fails the availability requirement, and using a prefix for the 45-day transition isolates the image files from the actively viewed thumbnails.

Correct answer: C. Amazon DynamoDB

Amazon DynamoDB is a serverless NoSQL database that delivers consistent single-digit millisecond latency and scales horizontally to handle high-frequency lookloads. ElastiCache is meant for caching rather than primary storage, while RDS and Neptune do not meet all the required constraints.

Correct answer: C. Set up Amazon DynamoDB table in the on-demand capacity mode

DynamoDB on-demand capacity instantly accommodates unpredictable traffic spikes without relying on CloudWatch alarms or scaling delays. Provisioned capacity with auto-scaling reacts too slowly for rapid bursts, while global tables and secondary indexes address replication and queries rather than capacity.

Correct answer: A. Select a cluster placement group while launching Amazon EC2 instances

Cluster placement groups pack EC2 instances close together within a single Availability Zone to deliver the low-latency network performance required for tightly coupled HPC workloads. Dedicated tenancy, capacity reservations, and Elastic Inference address compliance, availability, and machine learning rather than network performance.

Correct answer: A. Use Reserved Instances (RIs) for the minimum capacity · D. Set the minimum capacity to 2

Setting a minimum capacity of two instances across separate Availability Zones ensures high availability during a failure. Covering this constant baseline with Reserved Instances optimizes costs, whereas Dedicated Hosts or higher minimum capacities increase expenses without adding necessary value.

Correct answer: C. Enable Amazon API Gateway Caching

Enabling API Gateway caching reduces the load on your backend database by serving repeated requests directly from the cache. Aurora Read Replicas would increase costs, and Lambda lacks native in-memory caching, making the caching feature the most effective solution.

Correct answer: A. The instance with the oldest launch template or launch configuration will be terminated in AZ-B

The default Auto Scaling termination policy balances instances across Availability Zones by terminating instances in the most populated zone first. Within that zone, it removes the instance using the oldest launch template or configuration to maintain updated configurations.

Correct answer: A. Deploy the Kubernetes Cluster Autoscaler to the EKS cluster. Configure it to integrate with the existing EC2 Auto Scaling group to automatically launch or terminate nodes based on pending pod demands

The Kubernetes Cluster Autoscaler automatically adjusts the underlying EC2 Auto Scaling Group when pods become unschedulable due to resource constraints. Dynamic CloudWatch alarms lack scheduling visibility, while custom Lambda functions and Fargate migrations introduce unnecessary operational overhead.

Correct answer: B. Use AWS Cost Optimization Hub to get a report of Amazon EC2 instances that are either idle or have low utilization and use AWS Compute Optimizer to look at instance type recommendations

Cost Optimization Hub identifies idle and underutilized EC2 instances, while Compute Optimizer recommends right-sized instance types to reduce expenses. Compute Optimizer does not handle purchasing options, S3 Analytics excludes Glacier, and Trusted Advisor cannot automatically renew instances.

Correct answer: C. Amazon S3 · E. Amazon DynamoDB

Amazon S3 and Amazon DynamoDB are the only AWS services that support Gateway VPC Endpoints, which use route tables for private connectivity. SQS, Kinesis, and SNS rely on Interface Endpoints, which use Elastic Network Interfaces and PrivateLink instead of route tables.

Correct answer: B. Leverage AWS Database Migration Service (AWS DMS) as a bridge between Amazon S3 and Amazon Kinesis Data Streams

AWS Database Migration Service can stream existing data and ongoing changes from Amazon S3 to Amazon Kinesis Data Streams out of the box. The event-based alternatives require custom Lambda code to process files, making them slower to implement than a managed replication service.

Correct answer: C. Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate for serverless orchestration of the containerized services · E. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate for serverless orchestration of the containerized services

Amazon ECS and Amazon EKS are the native AWS container orchestration services. Pairing either with AWS Fargate provides a serverless compute engine, eliminating the need to manage underlying EC2 instances.

Correct answer: A. Opt for Multi-AZ configuration with automatic failover functionality to help mitigate failure

A Multi-AZ configuration with automatic failover guarantees high availability and low data loss during a cache failure. Scheduled backups or manual AOF retention incur significant recovery delays, and read replicas alone cannot provide automatic failover for writes.

Correct answer: B. Convert the Amazon EC2 instance EBS volume to gp2

General purpose SSD gp2 volumes provide cost-effective storage with the ability to burst to higher IOPS levels, perfectly matching the requirements. Provisioned IOPS volumes remain expensive and unnecessary for under-utilized workloads, and CloudFormation itself incurs no additional service charges.

Correct answer: C. Use an Auto Scaling Group

Auto Scaling Groups dynamically provision and terminate compute resources based on demand, providing the underlying scaling required. CloudFront is eliminated because the highly dynamic content is unsuitable for edge caching.

Correct answer: B. Configure the Aurora cluster to use Aurora I/O-Optimized storage. This configuration delivers high throughput and low-latency I/O performance with predictable pricing and no I/O-based charges

Aurora I/O-Optimized storage provides consistent high throughput with predictable pricing, automatically handling spikes. Provisioned IOPS and Magnetic options are eliminated as they are unsupported configurations for Aurora clusters.

Correct answer: B. By default, AWS Lambda functions always operate from an AWS-owned VPC and hence have access to any public internet address or public AWS APIs. Once an AWS Lambda function is VPC-enabled, it will need a route through a Network Address Translation gateway (NAT gateway) in a public subnet to access public resources · C. Since AWS Lambda functions can scale extremely quickly, it's a good idea to deploy a Amazon CloudWatch Alarm that notifies your team when function metrics such as ConcurrentExecutions or Invocations exceeds the expected threshold · E. If you intend to reuse code in more than one AWS Lambda function, you should consider creating an AWS Lambda Layer for the reusable code

Lambda functions rely on Layers for shared code, require NAT gateways for public internet access inside a VPC, and need CloudWatch alarms to monitor concurrency. Timeout over-provisioning is discouraged because it incurs unexpected costs.

Correct answer: A. Use multi-part upload feature of Amazon S3

Amazon S3 multipart upload is the required method for uploading files larger than five gigabytes, allowing parallel transmission and recovery from network failures. AWS Snowball is intended for offline petabyte-scale migrations, and Direct Connect only provides bandwidth without addressing the file size limit.

Correct answer: C. Use Secure Sockets Layer certificate (SSL certificate) with SNI

Application Load Balancers use Server Name Indication (SNI) to serve multiple secure HTTPS applications, each with its own TLS certificate, behind a single listener. A wildcard certificate cannot cover entirely different base domains like mycorp and yourcorp.

Correct answer: B. Amazon Simple Queue Service (Amazon SQS) · C. Amazon EC2 Spot Instances

Amazon SQS decouples the application to buffer image compression jobs asynchronously, enabling built-in retries for failed tasks. Combining this with EC2 Spot Instances minimizes compute costs for asynchronous, interruptible workloads without requiring long-term commitments.

Correct answer: A. Use a VPC peering connection

VPC peering provides the most cost-effective way to route traffic privately between instances in separate VPCs within the same AWS account. Direct Connect is an expensive dedicated circuit for on-premises connectivity, while internet gateways and NAT gateways do not route internal traffic.

Correct answer: D. Trust policy

The IAM service only supports one type of resource-based policy, which is the role trust policy attached to an IAM role. Access control lists are external service-level policies, while permissions boundaries and Service Control Policies govern maximum entity permissions.

Correct answer: G. Use Amazon S3 Object Lock in Compliance mode for Policy A, and S3 Glacier Vault Lock for Policy B

S3 Object Lock in Compliance mode enforces strict write-once-read-many protections for immediately accessible transaction records. S3 Glacier Vault Lock provides a tamper-proof policy for long-term, low-cost archival data, perfectly meeting both regulatory retention requirements.

Correct answer: A. Use Amazon Elasticache for distributed in-memory cache based session management

Amazon ElastiCache provides a distributed in-memory data store that allows an Application Load Balancer to distribute traffic across all instances. Sticky sessions fail when an instance becomes unhealthy, while RDS and DynamoDB do not provide in-memory caching.

Correct answer: D. Migrate the order data to Amazon DynamoDB and create a global table. Deploy the application in each Region and connect to the local DynamoDB replica for low-latency access

Amazon DynamoDB global tables provide a fully managed multi-Region, multi-active database with typical replication latency under one second. Aurora and RDS cross-Region read replicas force all writes through a single primary Region, increasing global latency.

Correct answer: D. Configure an AWS DMS Serverless replication task to synchronize historical and ongoing changes between the on-premises Oracle database and Amazon RDS for Oracle

AWS DMS Serverless automatically provisions and scales compute capacity to match fluctuating database migration workloads. AWS Glue handles batch ETL rather than continuous transactional replication, and building custom EC2 scaling logic adds operational overhead.

Correct answer: D. Set up Amazon Route 53 active-passive type of failover routing policy. If Amazon Route 53 health check determines the Application Load Balancer endpoint as unhealthy, the traffic will be diverted to a static error page, hosted on Amazon S3 bucket

Route 53 active-passive failover routing uses health checks to automatically divert traffic to a static S3 backup site during a primary outage. Latency and weighted routing cannot provide automatic failover, and Route 53 does not have an active-active failover policy type.

Correct answer: C. Use AWS Site-to-Site VPN to establish encrypted network connectivity between the on-premises data center and AWS Cloud

An AWS Site-to-Site VPN establishes encrypted IPsec connections over the public internet and can be provisioned almost immediately. AWS Direct Connect provides dedicated bandwidth but does not natively encrypt traffic, while DataSync and Secrets Manager do not establish network connectivity.

Correct answer: B. The Auto Scaling group is using Amazon EC2 based health check and the Application Load Balancer is using ALB based health check

When an Auto Scaling group relies on EC2 health checks while an Application Load Balancer uses ALB health checks, a failed application can cause the ALB to drop the instance without triggering a replacement. Configuring the ASG to use ELB health checks ensures it detects application failures and provisions replacements.

Correct answer: A. Set up AWS Global Accelerator and add endpoints to cater to users in different geographic locations

AWS Global Accelerator uses static anycast IP addresses and the AWS global network to route traffic to healthy regional endpoints with automatic failover. Route 53 geo-proximity routing relies on DNS caching, which slows down failover, and CloudFront only routes static content.

Correct answer: C. Set up an Amazon S3 File Gateway to provide storage for the on-premises application

Amazon S3 File Gateway provides on-premises applications with low-latency access to S3 by caching frequently accessed files locally via standard NFS or SMB mounts. FSx for Lustre is optimized for cloud compute workloads, while Mountpoint lacks local caching capabilities.

Correct answer: D. Use Amazon Elastic File System (Amazon EFS) with the Standard storage class and configure AWS Backup to create cross-Region backups on a scheduled basis

Amazon EFS provides a managed POSIX-compliant NFS file system with multi-AZ redundancy that integrates natively with AWS Backup for scheduled cross-Region replication. Mountpoint for S3 lacks POSIX compliance, and AWS Backup does not currently support automatic cross-Region replication for Amazon FSx for NetApp ONTAP.

Correct answer: B. Use DynamoDB global tables for automatic multi-Region replication. Enable provisioned capacity mode with auto scaling to optimize cost and ensure consistent availability

DynamoDB global tables provide native multi-Region replication, ensuring high availability and low latency. Provisioned capacity with auto scaling optimizes costs; custom Lambda replication or Data Pipeline adds operational overhead and risk.

Correct answer: C. Use Amazon EC2 instances with Instance Store as the storage option

Instance store volumes provide temporary block-level storage physically attached to the host machine, delivering the highest performance and lowest latency for scratch data. EBS volumes cost extra and introduce additional latency compared to local instance storage.

Correct answer: A. Use S3 Object Lock in Compliance Mode, which enforces retention policies strictly and prevents all users from modifying or deleting data during the retention period

S3 Object Lock in Compliance Mode enforces a strict retention period that prevents any user, including the root account, from deleting or overwriting the object. Governance Mode allows privileged users to bypass locks.

Correct answer: B. Ingest and process the streaming data using Amazon Kinesis Data Streams, then index the data with Amazon OpenSearch Service for real-time search capabilities. Use Amazon QuickSight to build interactive dashboards and visualizations based on the indexed data

Amazon Kinesis Data Streams captures real-time streaming data, which OpenSearch indexes for low-latency full-text search and analytics. Amazon QuickSight connects to OpenSearch to provide interactive dashboards for end users.

Correct answer: A. Use Amazon S3 Intelligent-Tiering storage class to optimize the Amazon S3 storage costs

Amazon S3 Intelligent-Tiering automatically moves data between access tiers based on usage patterns, optimizing storage costs without operational overhead. Manual tiering via lifecycle policies requires administration, while One-IA risks durability.

Correct answer: A. Request a public certificate from AWS Certificate Manager (ACM) in the us-east-1 Region and associate it with the CloudFront distribution · C. Set up Amazon S3 to accept uploads from CloudFront by enabling origin access control (OAC)

CloudFront requires AWS Certificate Manager public certificates to be provisioned in the us-east-1 Region for custom HTTPS domains. Origin Access Control securely restricts S3 bucket access so only CloudFront can upload files.

Correct answer: A. Data at rest inside the volume is encrypted · B. Data moving between the volume and the instance is encrypted · F. Any snapshot created from the volume is encrypted

Encrypting an Amazon EBS volume secures data at rest and data moving between the volume and the EC2 instance. This encryption automatically applies to any snapshots created from that volume and volumes restored from those snapshots.

Correct answer: A. Create Amazon CloudFront distribution for the application on Amazon EC2 instances. Deploy AWS WAF on Amazon CloudFront to provide the necessary safety measures

AWS WAF integrates directly with CloudFront, Application Load Balancers, and API Gateway to inspect web requests. Option A is likely the intended answer, but because WAF also attaches directly to an ALB, a reasonable test-taker could argue option B is partially valid despite its stated inaccuracy.

Correct answer: B. Setup an Amazon CloudWatch alarm to monitor the health status of the instance. In case of an Instance Health Check failure, an EC2 Reboot CloudWatch Alarm Action can be used to reboot the instance

CloudWatch alarms can directly trigger reboot, stop, or recover actions for failing EC2 instances without custom code. Using Lambda or EventBridge to poll status checks introduces unnecessary operational overhead compared to the native built-in alarm action.

Correct answer: D. Migrate the existing MySQL database to an Amazon Aurora MySQL cluster. Deploy the primary DB instance and one or more read replicas in different Availability Zones · E. Use an Auto Scaling group to deploy EC2 instances across multiple Availability Zones within a single Region. Register the instances in a target group behind an Application Load Balancer to distribute web traffic evenly

Deploying EC2 instances across multiple Availability Zones within a single Region using an Auto Scaling group and ALB ensures high availability. Migrating the database to Aurora MySQL with read replicas enhances fault tolerance and improves read scaling performance.

Correct answer: A. Use AWS transit gateway to interconnect the VPCs

AWS Transit Gateway acts as a central hub, solving the transitive routing limitations of VPC peering. Full mesh peering is operationally complex, while internet gateways and VPC endpoints do not route private traffic between separate VPCs.

Correct answer: B. Set up a 7-day EBS snapshot retention rule in Recycle Bin and apply the rule for all snapshots

Amazon EBS Snapshot Recycle Bin retains accidentally deleted snapshots for a specified period before permanent removal. It requires minimal setup, unlike Vault Lock which only protects resources explicitly managed by AWS Backup.

Correct answer: D. Use a dead-letter queue to handle message processing failures

A dead-letter queue isolates messages that cannot be processed successfully after a configured number of retries. Polling methods only control how messages are retrieved, and temporary queues handle short-lived request-response patterns rather than capturing failed messages.

Correct answer: C. Use AWS DataSync to migrate existing data to Amazon S3 and then use File Gateway to retain access to the migrated data for ongoing updates from the on-premises applications

AWS DataSync accelerates and automates large-scale online data migrations to Amazon S3. File Gateway then provides low-latency, on-premises access to that migrated data for ongoing updates. Transfer Acceleration optimizes long-distance internet transfers but does not provide local cache access.

Correct answer: C. Configure the S3 bucket to send an event notification to an AWS Lambda function each time a new image is uploaded. Use the Lambda function to process the image, create a thumbnail, and store the thumbnail in the second S3 bucket

Amazon S3 event notifications can trigger an AWS Lambda function to process new objects automatically. This event-driven architecture is serverless, minimizes operational overhead, and is highly cost-effective for intermittent workloads compared to continuously polling with compute resources.

Correct answer: D. Create a gateway VPC endpoint for Amazon S3 in the VPC. Ensure that the EC2 instance's subnet route table is updated to route S3 traffic through the endpoint. Confirm that appropriate IAM policies are in place to permit access via the VPC endpoint

A gateway VPC endpoint routes Amazon S3 traffic over the private AWS network, keeping it completely off the public internet. Updating route tables directs traffic correctly. NAT gateways still route over the public internet, and S3 access points only manage permissions, not network paths.

Correct answer: C. Use batch messages

Using the API to batch multiple records into a single request dramatically increases throughput and prevents throttling exceptions. Increasing shards also works but raises costs, making it an inferior choice. Exponential backoff manages temporary errors but does not optimize overall shard efficiency.

Correct answer: A. The security group configuration for the database instance does not have the correct rules to allow inbound connections from the application servers

A connection timeout indicates that network traffic is blocked before reaching the database. The database security group must allow inbound traffic from the application servers' security group. Incorrect credentials or privileges result in access denied errors, which immediately confirms the network connection succeeded.

Correct answer: C. Take snapshots of the production EBS volumes. Enable EBS fast snapshot restore on the snapshots. Create new EBS volumes from the snapshots and attach them to EC2 instances in the test environment

EBS fast snapshot restore eliminates the initialization latency of new volumes, providing immediate high I/O performance for intensive workloads. Creating new volumes from snapshots safely clones the data. Using Multi-Attach breaks isolation requirements, while standard backups lack the required speed.

Correct answer: C. Install an Amazon CloudWatch Logs agents on the Amazon EC2 instances to send logs to Amazon CloudWatch

Installing the CloudWatch agent automatically streams logs from ephemeral instances to a centralized service before termination. This ensures logs survive instance deletion and removes the need for manual intervention. Taking snapshots or disabling termination introduces unnecessary operational overhead and reduces elasticity.

Correct answer: A. Use Enhanced Fanout feature of Amazon Kinesis Data Streams

Enhanced Fanout for Amazon Kinesis Data Streams provides each consumer with a dedicated two megabits per second throughput per shard. This eliminates the read bottleneck that occurs when multiple consumers share the default stream capacity.

Correct answer: A. Configure AWS Global Accelerator in front of the existing HTTPS API, create one endpoint group in us-west-2 for the current application endpoint, and use the accelerator's global edge network to improve performance for users connecting from Europe and Asia

AWS Global Accelerator routes traffic over the AWS global network to reduce latency for international users. Because this API serves real-time tracking data that cannot be cached, Global Accelerator is preferred over CloudFront.

Correct answer: B. Set up two Amazon SQS queues to decouple the job intake and job processing stages respectively. Assign one SQS queue to collect incoming jobs, and another to queue them for processing. Configure the EC2 instances to poll the relevant queue. Scale the Auto Scaling groups based on number of messages in each queue

Using Amazon SQS queues to decouple the intake and processing stages preserves job data during scaling events. You should scale your EC2 Auto Scaling groups based on the number of visible messages in each queue to handle demand.

Correct answer: C. Enable S3 Bucket Keys for server-side encryption with AWS KMS (SSE-KMS) so that new objects use a bucket-level key rather than requesting individual KMS data keys for every object

Amazon S3 Bucket Keys decrease AWS KMS request costs by generating a bucket-level data key for temporary use. This reduces the volume of API requests sent from S3 to KMS while maintaining standard encryption controls.

Correct answer: A. Use EC2 Instance Connect to inject a temporary public key and establish SSH access using the instance's public IP address

Amazon EC2 Instance Connect pushes a temporary SSH public key to the instance metadata for short-lived access. Without Session Manager, it requires instances to have a public IP address to establish the connection.

Correct answer: C. Feed the streaming transactions into Amazon Kinesis Data Streams. Leverage AWS Lambda integration to remove sensitive data from every transaction and then store the cleansed transactions in Amazon DynamoDB. The internal applications can consume the raw transactions off the Amazon Kinesis Data Stream

Amazon Kinesis Data Streams captures real-time transactions and allows multiple consumers, including AWS Lambda, to process the data simultaneously. Lambda can then remove sensitive details before storing records in Amazon DynamoDB.

Correct answer: C. Use AWS Identity and Access Management (IAM) Access Analyzer to evaluate resource-based and identity-based policies and identify resources shared outside the account or organization

AWS IAM Access Analyzer evaluates resource-based policies to identify resources shared with external entities. It uses automated reasoning to detect unintended access paths, whereas tools like Amazon Inspector focus on vulnerability scanning, not policy analysis.

Correct answer: D. Design a RESTful API with Amazon API Gateway that forwards incoming feedback data to an Amazon SQS queue. Set up an AWS Lambda function to process the queue messages, analyze sentiment using Amazon Comprehend, and store results in a DynamoDB table with a 365-day TTL configured on each item

Using Amazon API Gateway with an SQS queue decouples the ingestion of sudden traffic spikes from backend processing. AWS Lambda and Amazon Comprehend then provide automated sentiment analysis, while DynamoDB TTL handles the automatic one year data expiration.

Correct answer: B. Build an Amazon Machine Image (AMI) from the existing EC2 instance and configure a launch template. Create an Auto Scaling group using the launch template with Spot Instance pricing enabled. Attach an Application Load Balancer to distribute traffic across dynamically launched instances

An EC2 Auto Scaling group with an Application Load Balancer dynamically adjusts capacity to match unpredictable traffic spikes for stateless workloads. Utilizing Spot Instances significantly reduces compute costs compared to On-Demand, while the load balancer ensures fault tolerance.

Correct answer: A. Create a replica Aurora instance in another Availability Zone to improve the availability as the replica can serve as a failover target · B. Handle all read operations for your application by connecting to the reader endpoint of the Amazon Aurora cluster so that Aurora can spread the load for read-only connections across the Aurora replica

Adding Aurora Replicas improves high availability by providing automatic failover targets, and using the reader endpoint offloads read traffic to reduce CPU and memory spikes. Aurora does not use standby instances for failover, and increasing Lambda concurrency would worsen the database bottleneck.

Correct answer: D. The route table in the instance's subnet should have a route to an Internet Gateway · E. The network access control list (network ACL) associated with the subnet must have rules to allow inbound and outbound traffic

For an EC2 instance to reach the internet, its subnet's route table must include a route to the Internet Gateway. Additionally, the associated network ACL must permit the necessary inbound and outbound traffic.

Correct answer: C. The Auto Scaling group should be configured with the minimum capacity set to 4, with 2 instances each in two different Availability Zones. The maximum capacity of the Auto Scaling group should be set to 6

To guarantee high availability across an Availability Zone failure, an Auto Scaling group needs a minimum capacity of four instances spread evenly across two zones. This ensures two instances survive if one zone fails.

Correct answer: C. Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage

Amazon EC2 instance store delivers maximum IOPS for processing large video files. Amazon S3 provides highly durable storage for active media, and Amazon S3 Glacier offers low-cost archival storage for legacy data.

Correct answer: B. Set up AWS Site-to-Site VPN to connect the on-premises network to the AWS VPC. Use route tables to manage traffic flow and configure security groups and network ACLs to allow only authorized communication between systems

AWS Site-to-Site VPN encrypts traffic between on-premises networks and AWS VPCs using IPsec tunnels. Layering TLS satisfies the session encryption requirement, while route tables, security groups, and network ACLs provide the necessary granular access controls.

Correct answer: A. Set up an Amazon S3 bucket lifecycle policy to move files from Amazon S3 Standard to Amazon S3 Standard-IA 30 days after object creation. Delete the files 5 years after object creation

Amazon S3 Standard-IA provides immediate millisecond access for critical data while lowering costs for infrequently accessed objects. One Zone-IA is eliminated because it lacks multi-AZ durability for non-reproducible data, and Glacier lacks immediate access.

Correct answer: A. Use AWS Web Application Firewall (AWS WAF) with Amazon CloudFront distribution

AWS WAF inspects web requests at the edge to block common application-layer exploits like SQL injection and cross-site scripting. Security Hub, Firewall Manager, and Route 53 provide security posture management or DNS routing, not request-level attack prevention.

Correct answer: C. Use Amazon S3 Glacier vault to store the sensitive archived data and then use a vault lock policy to enforce compliance controls

Amazon S3 Glacier Vault Lock enforces compliance controls via a write-once-read-many policy to prevent future alterations. Lifecycle policies and Access Control Lists manage object transitions and basic permissions, but they cannot enforce strict regulatory retention rules.

Correct answer: B. Use AWS Systems Manager Automation with the AWSEC2-PatchLoadBalancerInstance document to manage patching · D. Configure Systems Manager Maintenance Windows to coordinate patching and instance removal from the ALB during the defined window

AWS Systems Manager Maintenance Windows schedule patching operations, and the dedicated automation document safely deregisters targets before patching. This coordination prevents traffic disruptions during patching. Manually altering configurations or disabling network interfaces introduces unnecessary risk and does not scale.

Correct answer: C. Use Reserved Instances for the baseline level of traffic and configure EC2 Auto Scaling with Spot Instances to handle spikes in message volume

A blended purchasing strategy uses Reserved Instances for steady baseline capacity and Spot Instances for unpredictable traffic spikes, optimizing costs. However, because the scenario demands no downtime despite Spot Instance interruptions, relying solely on Spot for spikes is arguably ambiguous without explicit fallback policies.

Correct answer: A. Use AWS WAF geo match statement listing the countries that you want to block · C. Use AWS WAF IP set statement that specifies the IP addresses that you want to allow through

AWS WAF uses geo match statements to block or allow traffic from specific countries. You can combine this with an IP set statement to explicitly allow specific IP addresses, such as those of your remote development team.

Correct answer: C. Amazon EC2 with Amazon EBS volume of Provisioned IOPS SSD (io1) type

Provisioned IOPS SSD volumes are designed to deliver predictable, high-performance database workloads. Because the engineering team wants strict control over the database and high IOPS, running it on an EC2 instance with this storage type is the right fit.

Correct answer: B. Use Amazon ElastiCache for Redis

Amazon ElastiCache for Redis enhances database performance by caching data and supports advanced data structures like geospatial indexing. Memcached does not support geospatial data, making Redis the required choice.

Correct answer: C. Use Amazon Transcribe to convert audio files to text and Amazon Athena to perform SQL based analysis to understand the underlying customer sentiments

Amazon Transcribe converts audio files to text, and Amazon Athena runs ad-hoc SQL queries directly against data stored in Amazon S3. This pairing provides a serverless pipeline for analyzing the transcribed text.

Correct answer: C. Use AWS PrivateLink to create a private endpoint within the application's VPC that connects securely to the SaaS provider's VPC

AWS PrivateLink provides private connectivity between VPCs and supported SaaS applications without exposing traffic to the public internet. VPC peering lacks granular access controls and could allow unsolicited inbound traffic, making PrivateLink the superior and more secure choice.

Correct answer: D. Create an Amazon S3 bucket configured with server-side encryption using AWS KMS multi-Region keys (SSE-KMS). Enable cross-Region replication (CRR) on the source bucket. Use Amazon Athena to run SQL queries on the data

Amazon Athena is a serverless query service that analyzes S3 data using standard SQL without managing infrastructure. Using S3 with AWS KMS multi-Region keys allows seamless cross-Region replication while maintaining least operational overhead.

Correct answer: B. Enable detailed monitoring on all EC2 instances and use Amazon CloudWatch metrics to track performance

Enabling detailed monitoring on EC2 instances changes CloudWatch metric intervals from five minutes to one minute, meeting the requirement for frequent visibility. This native integration provides the fastest implementation and lowest maintenance compared to custom log pipelines.

Correct answer: A. Deploy the visualization tool in the same AWS region as the data warehouse. Access the visualization tool over a Direct Connect connection at a location in the same region

Deploying the visualization tool in the same AWS Region as the data warehouse avoids transferring large query results over the network. Accessing the small web pages over Direct Connect minimizes data transfer egress costs compared to querying on-premises.

Correct answer: D. The CNAME record will be updated to point to the standby database

During a failover in an Amazon RDS Multi-AZ deployment, Amazon RDS automatically updates the DNS CNAME record to point to the standby replica. This ensures the connection endpoint URL remains the same without requiring manual intervention.

Correct answer: A. Use Amazon EFS with encryption enabled. Create an AWS Transfer Family SFTP endpoint in a VPC with Elastic IP addresses. Restrict access using a security group that allows traffic only from known IPs. Manage user access using POSIX identity mappings and IAM policies

Amazon EFS provides scalable, low-latency file storage natively supported by AWS Transfer Family for high-IOPS SFTP workloads. Deploying the SFTP endpoint within a VPC allows security groups to restrict access to trusted IP addresses, while POSIX mappings handle permissions.

Correct answer: A. Use Amazon Athena to run SQL based analytics against Amazon S3 data

Amazon Athena is a serverless interactive query service that analyzes data directly in Amazon S3 using standard SQL. It requires no infrastructure management, making it the most cost-effective and easiest to maintain solution compared to provisioning Redshift, EMR, or RDS clusters.

Correct answer: A. Transfer the on-premises data into multiple AWS Snowball Edge Storage Optimized devices. Copy the AWS Snowball Edge data into Amazon S3 and create a lifecycle policy to transition the data into Amazon S3 Glacier

AWS Snowball Edge Storage Optimized is optimal for securely transferring petabytes of data to AWS. The data must first be imported into Amazon S3 before a lifecycle policy can transition it to S3 Glacier, as Snowball does not write directly to Glacier.

Correct answer: A. Create an Amazon S3 bucket with Intelligent-Tiering enabled. Update the application to store and retrieve project files using the Amazon S3 API

Amazon S3 Intelligent-Tiering automatically moves objects between access tiers based on changing usage patterns, optimizing costs for unpredictable workloads. Refactoring to use the S3 API provides the most cost-effective and durable storage compared to maintaining EFS or FSx file systems.

Correct answer: B. Create a service control policy (SCP) that denies the ec2:RunInstances API action unless the required tag key is present in the request. Create a second SCP that denies the ec2:DeleteTags action for EC2 resources. Attach both SCPs to the relevant OU in AWS Organizations · C. Define a tag policy in AWS Organizations that enforces the dataClassification key and restricts values to 'confidential' and 'public'. Attach this tag policy to the applicable organizational unit (OU) to enforce uniform tagging behavior across accounts

Service Control Policies can explicitly deny the RunInstances and DeleteTags API actions unless specific tagging conditions are met. Additionally, AWS Organizations tag policies enforce standardized tag keys and values, effectively eliminating the operational overhead of custom lambda remediation.

Correct answer: A. Enable Amazon S3 Transfer Acceleration (Amazon S3TA) for the Amazon S3 bucket. This would speed up uploads as well as downloads for the video files

Amazon S3 Transfer Acceleration and Amazon CloudFront both leverage edge locations to optimize global file transfers. However, CloudFront is primarily designed for downloads, making Transfer Acceleration the technically superior AWS service for accelerating large file uploads.

Correct answer: A. Enable the automated backup feature of Amazon RDS in a multi-AZ deployment that creates backups across multiple Regions · D. Use cross-Region Read Replicas

Cross-Region Read Replicas and Cross-Region Automated Backups provide regional disaster recovery capabilities. Option A is slightly imprecise because automated backups do not inherently span Regions unless explicitly copied, creating slight ambiguity.

Correct answer: B. Create a Network Load Balancer (NLB) in each Region to handle the EC2-based TCP traffic. For the UDP-based on-premises workload, configure NLBs in each Region to route to the on-premises endpoints via IP-based target groups · D. Configure an AWS Global Accelerator standard accelerator, and register the TCP-based EC2 workloads behind the load balancers

AWS Global Accelerator leverages the AWS global network to route TCP traffic to the closest healthy regional endpoints. Network Load Balancers are required here because they support both TCP and UDP protocols, whereas Application Load Balancers only support Layer 7.