HomeQuizzes & SurveysAWS (SAA-C02) Practice Test 4 AWS (SAA-C02) Practice Test 4 Leave a Comment / By user / November 15, 2021 Welcome to your AWS (SAA-C02) Practice Test 4 Exam Instructions The exam comprises of the following types of questions: - Multiple Choice Single Response - Multiple Choice Multiple Response There is no negative marking. Name Email Mobile Number 1. A solutions architect is designing a new service behind Amazon API Gateway. The request patterns for the service will be unpredictable and can change suddenly from 0 requests to over 500 per second. The total size of the data that needs to be persisted in a backend database is currently less than 1 GB with unpredictable future growth Data can be queried using simple key-value requests. Which combination of AWS services would meet these requirements? (Select TWO ) A. AWS Fargate B. AWS Lambda C. Amazon DynamoDB D. Amazon EC2 Auto Scaling E. MySQL-compatible Amazon Aurora 2. A company has an application that calls AWS Lambda functions. A recent code review found database credentials stored in the source code. The database credentials need to be removed from the Lambda source code. The credentials must then be securely stored and rotated on an ongoing basis to meet security policy requirements. What should a solutions architect recommend to meet these requirements? A. Store the password in AWS CloudHSM. Associate the Lambda function with a role that can retrieve the password from CloudHSM given its key ID B. Store the password in AWS Secrets Manager. Associate the Lambda function with a role that can retrieve the password from Secrets Manager given its secret ID. C. Move the database password to an environment variable associated with the Lambda function. Retrieve the password from the environment variable upon execution. D. Store the password in AWS Key Management Service (AWS KMS) Associate the Lambda function with a role that can retrieve the password from AWS KMS given its key ID. None 3. A three-tier application is being created to host small news articles. The application is expected to serve millions of users. When breaking news occurs, the site must handle very large spikes in traffic without significantly impacting database performance. Which design meets these requirements while minimizing costs? A. Use Auto Scaling groups to increase the number of Amazon EC2 instances delivering the web application B. Use Auto Scaling groups to increase the size of the Amazon RDS instances delivering the database C. Use Amazon DynamoDB strongly consistent reads to adjust for the increase in traffic D. Use Amazon DynamoDB Accelerator (DAX) to cache read operations to the database None 4. A photo-sharing website running on AWS allows users to generate thumbnail images of photos stored in Amazon S3. An Amazon DynamoDB table maintains the locations of photos, and thumbnails are easily re- created from the originals if they are accidentally deleted. How should the thumbnail images be stored to ensure the LOWEST cost? A. Amazon S3 Standard-Infrequent Access (S3 Standard-IA) with cross-region replication B. Amazon S3 C. Amazon Glacier D. Amazon S3 with cross-region replication None 5. A solutions architect is designing the cloud architecture for a new application being deployed on AWS. The process should run in parallel while adding and removing application nodes as needed based on the number of jobs to be processed. The processor application is stateless. The solutions architect must ensure that the application is loosely coupled and the job items are durably stored. Which design should the solutions architect use? The solutions architect must ensure that the application is loosely coupled and the job items are durably stored. Which design should the solutions architect use? A. Create an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch configuration that uses the AMI. Create an Auto Scaling group using the launch configuration. Set the scaling policy for the Auto Scaling group to add and remove nodes based on CPU usage B. Create an Amazon SQS queue to hold the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch configuration that uses the AMI. Create an Auto Scaling group using the launch configuration. Set the scaling policy for the Auto Scaling group to add and remove nodes based on network usage C. Create an Amazon SQS queue to hold the jobs that needs to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch template that uses the AMI. Create an Auto Scaling group using the launch template. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of items in the SQS queue D. Create an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch template that uses the AMI. Create an Auto Scaling group using the launch template. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of messages published to the SNS topic. None 6. Amazon EBS provides the ability to create backups of any Amazon EC2 volume into what is known as _____. A. snapshots B. images C. instance backups D. mirrors None 7. A solutions architect is tasked with transferring 750 TB of data from a network-attached file system located at a branch office to Amazon S3 Glacier. The solution must avoid saturating the branch office's low-bandwidth internet connection. What is the MOST cost-effective solution1? A. Create a site-to-site VPN tunnel to an Amazon S3 bucket and transfer the files directly. Create a bucket policy to enforce a VPC endpoint B. Order 10 AWS Snowball appliances and select an S3 Glacier vault as the destination. Create a bucket policy to enforce a VPC endpoint. C. Mount the network-attached file system to Amazon S3 and copy the files directly. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier D. Order 10 AWS Snowball appliances and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier. None 8. A product team is creating a new application that will store a large amount of data. The data will be analyzed hourly and modified by multiple Amazon EC2 Linux instances. The application team believes the amount of space needed will continue to grow for the next 6 months. Which set of actions should a solutions architect take to support these needs? A. Store the data in an Amazon EBS volume. Mount the EBS volume on the application instances B. Store the data in an Amazon EFS file system. Mount the file system on the application instances C. Store the data in Amazon S3 Glacier. Update the vault policy to allow access to the application instances. D. Store the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Update the bucket policy to allow access to the application instances None 9. Does DynamoDB support in-place atomic updates? A. Yes B. No C. It does support in-place non-atomic updates D. It is not defined None 10. An Elastic IP address (EIP) is a static IP address designed for dynamic cloud computing. With an EIP, you can mask the failure of an instance or software by rapidly remapping the address to another instance in your account. Your EIP is associated with your AWS account, not a particular EC2 instance, and it remains associated with your account until you choose to explicitly release it. By default how many EIPs is each AWS account limited to on a per region basis? A. 1 B. 5 C. Unlimited D. 10 None 11. You are setting up a VPC and you need to set up a public subnet within that VPC. Which following requirement must be met for this subnet to be considered a public subnet? A. Subnet's traffic is not routed to an internet gateway but has its traffic routed to a virtual private gateway. B. Subnet's traffic is routed to an internet gateway C. Subnet's traffic is not routed to an internet gateway D. None of these answers can be considered a public subnet. None 12. Much of your company's data does not need to be accessed often, and can take several hours for retrieval time, so it's stored on Amazon Glacier. However someone within your organization has expressed concerns that his data is more sensitive than the other data, and is wondering whether the high level of encryption that he knows is on S3 is also used on the much cheaper Glacier service. Which of the following statements would be most applicable in regards to this concern? A. There is no encryption on Amazon Glacier, that's why it is cheaper. B. Amazon Glacier automatically encrypts the data using AES-128 a lesser encryption method than Amazon S3 but you can change it to AES-256 if you are willing to pay more C. Amazon Glacier automatically encrypts the data using AES-256, the same as Amazon S3 D. Amazon Glacier automatically encrypts the data using AES-128 a lesser encryption method than Amazon S3. None 13. A company's website is using an Amazon RDS MySQL Multi-AZ DB instance for its transactional data storage. There are other internal systems that query this DB instance to fetch data for internal batch processing. The RDS DB instance slows down significantly the internal systems fetch data. This impacts the website's read and write performance, and the users experience slow response times. Which solution will improve the website's performance? A. Use an RDS PostgreSQL DB instance instead of a MySQL database B. Use Amazon ElastiCache to cache the query responses for the website C. Add an additional Availability Zone to the current RDS MySQL Multi.AZ DB instance. D. Add a read replica to the RDS DB instance and configure the internal systems to query the read replica. None 14. An ecommerce company is running a multi-tier application on AWS. The front-end and backend tiers both run on Amazon EC2. and the database runs on Amazon RDS for MySQL. The backend tier communicates with the RDS instance. There are frequent calls to return identical datasets from the database that are causing performance slowdowns. Which action should be taken to improve the performance of the backend? A. Implement Amazon SNS to store the database calls. B. Implement Amazon ElastiCache to cache the large datasets. C. Implement an RDS for MySQL read replica to cache database calls. D. Implement Amazon Kinesis Data Firehose to stream the calls to the database. None 15. A company delivers files in Amazon S3 to certain users who do not have AWS credentials. These users must be given access for a limited lime. What should a solutions architect do to securely meet these requirements? A. Enable public access on an Amazon S3 bucket. B. Generate a presigned URL to share with the users. C. Encrypt files using AWS KMS and provide keys to the users. D. Create and assign IAM roles that will grant GetObject permissions to the users. None 16. A company's web application is running on Amazon EC2 instances behind an Application Load Balancer. The company recently changed its policy, which now requires the application to be accessed from one specific country only. Which configuration will meet this requirement? A. Configure the security group for the EC2 instances B. Configure the security group on the Application Load Balancer C. Configure AWS WAF on the Application Load Balancer in a VPC D. Configure the network ACL for the subnet that contains the EC2 instances None 17. A web application runs on Amazon EC2 instances behind an Application Load Balancer. The application allows users to create custom reports of historical weather data. Generating a report can take up to 5 minutes. These long-running requests use many of the available incoming connections, making the system unresponsive to other users. How can a solutions architect make the system more responsive? A. Use Amazon SQS with AWS Lambda lo generate reports. B. Increase the idle timeout on the Application Load Balancer to 5 minutes. C. Update the client-side application code to increase its request timeout to 5 minutes D. Publish the reports to Amazon S3 and use Amazon CloudFront for downloading to the user None 18. A company is developing a real-time multiplier game that uses UDP for communications between client and servers in an Auto Scaling group Spikes in demand are anticipated during the day, so the game server platform must adapt accordingly. Developers want to store gamer scores and other non-relational data in a database solution that will scale without intervention. Which solution should a solution architect recommend? A. Use Amazon Route 53 for traffic distribution and Amazon Aurora Serverless for data storage. B. Use a Network Load Balancer for traffic distribution and Amazon DynamoDB on-demand for data storage C. Use a Network Load Balancer for traffic distribution and amazon Aura Global for data storage. D. Use an Application Load Balancer for traffic distribution and Amazon DynamoDB global tables for data storage None 19. A company is seeing access requests by some suspicious IP addresses. The security team discovers the requests are from different IP addresses under the same CIDR range. What should a solutions architect recommend to the team? A. Add a rule in the inbound table of the security to deny the traffic from that CIDR range B. Add a rule in the outbound table of the security group to deny the traffic from that CIDR range C. Add a deny rule in the inbound table of the network ACL with a lower number than other rules. D. Add a deny rule in the outbound table of the network ACL with a lower rule number than other rules None 20. A company has a Microsoft Windows-based application that must be migrated to AWS. This application requires the use of a shared Windows file system attached to multiple Amazon EC2 Windows instances. What should a solution architect do to accomplish this? A. Configure a volume using Amazon EFS Mount the EPS volume to each Windows Instance B. Configure AWS Storage Gateway in Volume Gateway mode Mount the volume to each Windows instance C. Configure Amazon FSx for Windows File Server Mount the Amazon FSx volume to each Windows Instance D. Configure an Amazon EBS volume with the required size Attach each EC2 instance to the volume Mount the file system within the volume to each Windows instance None 21. A company mandates that an Amazon S3 gateway endpoint must allow traffic to trusted buckets only. Which method should a solutions architect implement to meet this requirement? A. Create a bucket policy for each of the company's trusted S3 buckets that allows traffic only from the company's trusted VPCs B. Create a bucket policy for each of the company's trusted S3 buckets that allows traffic only from the company's S3 gateway endpoint IDs C. Create an S3 endpoint policy for each of the company's S3 gateway endpoints that blocks access from any VPC other than the company's trusted VPCs D. Create an S3 endpoint policy for each of the company's S3 gateway endpoints that provides access to the Amazon Resource Name (ARN) of the trusted S3 buckets None 22. A company has an on-premises data center that is running out of storage capacity. The company wants to migrate its storage infrastructure to AWS while minimizing bandwidth costs. The solution must allow for immediate retrieval of data at no additional cost. How can these requirements be met? A. Deploy Amazon S3 Glacier Vault and enable expedited retrieval. Enable provisioned retrieval capacity for the workload B. Deploy AWS Storage Gateway using cached volumes. Use Storage Gateway to store data in Amazon S3 while retaining copies of frequently accessed data subsets locally. C. Deploy AWS Storage Gateway using stored volumes to store data locally. Use Storage Gateway to asynchronously back up point-in-time snapshots of the data to Amazon S3 D. Deploy AWS Direct Connect to connect with the on-premises data center. Configure AWS Storage Gateway to store data locally. Use Storage Gateway to asynchronously bacK up potnt-tn-time snapshots of the data to Amazon S3 None 23. A company is planning to build a new web application on AWS. The company expects predictable traffic most of the year and very high traffic on occasion. The web application needs to be highly available and fault tolerant with minimal latency. What should a solutions architect recommend to meet these requirements? A. Use an Amazon Route 53 routing policy to distribute requests to two AWS Regions, each with one Amazon EC2 instance. B. Use Amazon EC2 instances in an Auto Scaling group with an Application Load Balancer across multiple Availability Zones. C. Use Amazon EC2 instances in a cluster placement group with an Application Load Balancer across multiple Availability Zones. D. Use Amazon EC2 instances in a cluster placement group and include the cluster placement group within a new Auto Scaling group. None 24. An application is running on Amazon EC2 instances Sensitive information required for the application is stored in an Amazon S3 bucket. The bucket needs to be protected from internet access while only allowing services within the VPC access to the bucket. Which combination of actions should a solutions archived take to accomplish this'' (Select TWO. A. Create a VPC endpoint for Amazon S3 B. Enable server access logging on the bucket C. Apply a bucket policy to restrict access to the S3 endpoint. D. Add an S3 ACL to the bucket that has sensitive information E. Restrict users using the IAM policy to use the specific bucket 25. A company runs a high performance computing (HPC) workload on AWS. The workload required low- latency network performance and high network throughput with tightly coupled node-to-node communication. The Amazon EC2 instances are properly sized for compute and storage capacity, and are launched using default options. What should a solutions architect propose to improve the performance of the workload'? A. Choose a cluster placement group while launching Amazon EC2 instances B. Choose dedicated instance tenancy while launching Amazon EC2 instances C. Choose an Elastic Inference accelerator while launching Amazon EC2 instances D. Choose the required capacity reservation while launching Amazon EC2 instances. None 26. A company built a new VPC with the intention of the hosting Amazon EC2 based workloads on AWS. A solutions architect specified that an Amazon S3 gateway endpoint be created and attached to this new VPC. Once the first Application server is built, developers report that server time out when accessing data stored in the S3 bucket Which scenario could be causing this issue? ( Select TWO) A. The S3 bucket is in a region other than the VPC B. The endpoint has a policy that blocks the CIDR of the VPC C. The route to the S3 endpoint is not configured in the route table D. The access is routed through an internet gateway rather than the endpoint E. The S3 bucket has a bucket policy that does not allow access to the CIDR of the VPC 27. A solutions architect is designing a VPC with public and private subnets. The VPC and subnets use IP 4 CIDR blocks. There is one public subnet and one private subnet in each of three Availability Zone (AZs) for high availability. An internet gateway is used to provide internet access for the public subnets. The private subnets require access to the internet to allow Amazon EC2 instances to download software updates What should the solutions architect do to enable Intrnet access for the private subnets? A. Create three NAT gateways, one for each public subnet in each AZ. Create a private route table for each AZ that forwards non-VPC traffic to the NAT gateway in its AZ B. Create three NAT gateways, one for each private subnet in each AZ. Create a private route table for each AZ that forwards non-VPC traffic to the NAT gateway in its AZ C. Create second internet gateway on one of the private subnets. Update the rout table for the private subnets that forward non-VPC traffic to the private internt gateway. D. Create an egress-only internet gateway on one of the public subnets. Update the route table for the private subnets that forward non-VPC traffic to the egress-only internet gateway. None 28. A company is building a media sharing application and decides to use Amazon S3 for storage. When a media file uploaded, the company starts a multi-step to create thumbnails, identify obkects in the image, transcode videos into standard formats and resolutons, and extract and store the metadata to an Amazon DynamoDB table. The metadata is used for searching and navigation. The amount of traffic is variable. the solution must be able to scale handle spikes in load without unnecessary expenses. What should a solution architect recommend to support this workload? A. Build the processing into the website or mobile app used to upload the content to Amazon S3 save the required data to the DynamDB table when the obkects are uploaded B. Trigger an AWS Lambda function when an object is stored in the S3 bucket. Have the step functions perform the steps needed to process the object and then write the metadata to the DynamoDB table C. Trigger an AWS Lambda function when an object is stored in the S3 bucket. Have the Lambda function start AWS batch to perform the steps to process the object. Place the object data in the DynamoDB table when complete D. Trigger an AWS Lambda function to store an initial entry in the DynamoDB table when an object is uploaded to Amzon S3 use a program running on an Amazon EC2 instance in an Auto Scaling group to poll the Index for unpr0cessed items, and use the program to perform the processing. None 29. A solutions architect is moving the static content from a public website hosted on Amazon EC2 instances to an Amazon S3 bucket. An Amazon CloudFront distribution will be used to deliver the static assets. The security group used by the EC2 instances restricts access to a limited set of IP ranges. Access to the static content should be similarly restricted. Which combination of steps will meet these requirements? (Select TWO.) A. Create an origin access identity (OAI) and associate it with the distribution. Change the permissions in the bucket policy so that only the OAI can read the objects B. Create an AWS WAF web ACL that includes the same IP restrictions that exist in the EC2 security group. Associate this new web ACL with the CloudFront distribution C. Create a new security group that includes the same IP restrictions that exist in the current EC2 security group. Associate this new security group with the CloudFront distribution. D. Create a new security group that includes the same IP restrictions that exist in the current EC2 security group Associate this new security group with the S3 bucket hosting the static content E. Create a new IAM role and associate the role with the distribution. Change the permissions either on the S3 bucket or on the files within the S3 bucket so that only the newly created IAM role has read and download permissions. 30. A company has data stored in an on-premises data center that is used by several on-premises applications. The company wants to maintain its existing application environment and be able to use AWS services for data analytics and future visualizations. Which storage service should a solutions architect recommend? A. Amazon Redshift. B. AWS Storage Gateway for files. C. Amazon Elastic Block Store (Amazon EBS) D. Amazon Elastic File System (Amazon EFS). None 31. A company is using a fleet of Amazon EC2 instances to ingest data from on-premises data sources. The data is in JSON format and ingestion rates can be as high as 1 MB/s. When an EC2 instance is rebooted, the data in-flight is lost. The company's data science team wants to query ingested data near-real time. Which solution provides near-real-time data querying that is scalable with minimal data loss? A. Publish data to Amazon Kinesis Data Streams. Use Kinesis Data Analytics to query the data B. Publish data to Amazon Kinesis Data Firehose with Amazon Redshift as the destination. Use Amazon Redshift to query the data C. Store ingested data in an EC2 instance store. Publish data to Amazon Kinesis Data Firehose with Amazon S3 as the destination. Use Amazon Athena to query the data D. Store ingested data in an Amazon Elastic Block Store (Amazon EBS) volume Publish data to Amazon ElastiCache for Redis. Subscribe to the Redis channel to query the data. None 32. A company's lease of a co-located storage facility will expire in 90 days. The company wants to move to AWS to avoid signing a contract extension. The company's environment consists of 200 virtual machines and a NAS with 40 TB of data. Most of the data is archival, yet instant access is required when data is requested. Leadership wants to ensure minimal downtime during the migration. Each virtual machine has a number of customized configurations. The company's existing 1 Gbps network connection is mostly idle, especially after business hours. Which combination of steps should the company take to migrate to AWS while minimizing downtime and operational impact? (Select TWO.) A. Use new Amazon EC2 instances and reinstall all application code B. Use AWS SMS to migrate the virtual machines. C. Use AWS Storage Gateway to migrate the data to cloud-native storage D. Use AWS Snowball to migrate the data E. Use AWS SMS to copy the infrequently accessed data from the NAS 33. A solutions architect is creating a new VPC design. There are two public subnet for the load balancer, two private subnets for web servers, and two private subnets for MySQL. The web serves use only HTTPS. The solutions architect has already created a security group for the load Balancer allowing port 443 from 0.0 0.0/0. Company policy requires that each resource has the least access required to still be able to perform its tasks. Which additional configuration strategy should the solution architect use to meet these requirements? A. Create a security group far the web servers and allow port 443 from 0.0.0.0/0. Create a security group tor the MySQL serve's aid allow port 3306 from the web servers security group B. Create a network ACL for the web servers and allow port 443 from 0.0.0.0/0. Create a network ACL for the MySQL servers and allow port 3306 from the web servers security group C. Create a security group for the web servers and allow port 443 from the load balancer. Create a security group tor the MySQL servers and allow port 3306 from the web sewers security group D. Create a network ACL for the web servers and allow port 443 from the web balancer. Create a network ACL for the MySQL servers and allow port 3306 from the web servers security group. None 34. A solutions architect needs to design a managed storage solution for a company's application that includes high-performance machine learning. This application runs on AWS Fargate. and the connected storage needs to have concurrent access to files and deliver high performance. Which storage option should the solutions architect recommend? A. Create an Amazon S3 bucket for the application and establish an 1AM role for Fargate to communicate with Amazon S3. B. Create an Amazon FSx for Lustre file share and establish an 1AM role that allows Fargate to communicate with FSx for Lustre C. Create an Amazon Elastic File System (Amazon EFS> file share and establish an 1AM role that allows Fargate to communicate with Amazon EFS D. Create an Amazon Elastic Block Store (Amazon EBS) volume for the application and establish an 1AM role that allows Fargate to communicate with Amazon EBS None 35. A solutions architect is helping a developer design a new ecommerce shopping cart application using AWS services. The developer is unsure of the current database schema and expects to make changes as the ecommerce site grows. The solution needs to be highly resilient and capable of automatically scaling read and write capacity. Which database solution meets these requirements? A. Amazon Aurora PostgreSQL B. Amazon DynamoDB with on-demand enabled C. Amazon DynamoDB with DynamoDB Streams enabled D. Amazon SQS and Amazon Aurora PostgreSQL None 36. A company's website hosted on Amazon EC2 instances processes classified data stored in Amazon S3. Due to security concerns, the company requires a private and secure connection between its EC2 resources and Amazon S3. Which solution meets these requirements? A. Set up S3 bucket policies to allow access from a VPC endpoint B. Set up an IAM policy to grant read-write access to the S3 bucket C. Set up a NAT gateway to access resources outside the private subnet D. Set up an access key ID and a secret access key to access the S3 bucket None 37. A company wants to migrate its web application to AWS. The legacy web aoplication consists of a web tier, an appfccation tier, and a MySQL database. The re-architectod application must consist of technologies that do not require the administration team to manage instances or clusters. Which combination of services should a solutions architect include in Ihe overall architecture? (Select TWO) A. Amazon Aurora Serverless B. Amazon EC2 Spot Instances C. Amazon Elasticsearch Service (Amazon ES D. Amazon RDS for MySQL E. AWS Fargate 38. A company has an ecommerce application that stores data in an on-premises SQL database. The company has decided to migrate this database to AWS. However, as part of the migration, the company wants to find a way to attain sub-millisecond responses to common read requests. A solutions architect knows that the increase in speed is paramount and that a small percentage of stale data returned in the database reads is acceptable. What should the solutions architect recommend? A. Build Amazon RDS read replicas B. Build the database as a larger instance type C. Build a database cache using Amazon ElastiCache D. Build a database cache using Amazon Elasticsearch Service (Amazon ES) None 39. A business application is hosted on Amazon EC2 and uses Amazon S3 for encrypted object storage. The chief information security officer has directed that no application traffic between the two services should traverse the public internet. Which capability should the solutions architect use to meet the compliance requirements? A. AWS Key Management Service (AWS KMS) B. VPC endpoint C. Private subnet D. Virtual private gateway None 40. A solutions architect is developing a multiple-subnet VPC architecture. The solution will consist of six subnets in two Availability Zones. The subnets are defined as public, private and dedicated for databases. Only the Amazon EC2 instances running in the private subnets should be able to access a database. Which solution meets these requirements? A. Create a now route table that excludes the route to the public subnets. CIDR blocks Associate the route table lo the database subnets B. Create a security group that denies ingress from the security group used by instances in the public subnets. Attach the security group to an Amazon RDS DB instance C. Create a security group that allows ingress from the security group used by instances in the private subnets. Attach the security group to an Amazon RDS DB instance D. Create a new peering connection between the public subnets and the private subnets. Create a different peering connection between the private subnets and the database subnets None 41. A company has an automobile sales website that stores its listings in an database on Amazon RDS. When an automobile is sold, the listing needs to be removed from the website and the data must be sent to multiple target systems. Which design should a solutions architect recommend? A. Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SOS) queue for the targets to consume B. Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SQS) FIFO queue for the targets to consume C. Subscribe to an RDS event notification and send an Amazon Simple Queue Service (Amazon SQS) queue fanned out to multiple Amazon Simple Notification Service (Amazon SNS) topics. Use AWS Lambda functions to update the targets D. Subscribe to an RDS event notification and send an Amazon Simple Notification Service (Amazon SNS) topic fanned out to multiple Amazon Simple Queue Service (Amazon SQS) queues. Use AWS Lambda functions to update the targets None 42. An administrator of a large company wants to monitor for and prevent any cryptocurrency-related attacks on the company's AWS accounts. Which AWS service can the administrator use to protect the company against attacks? A. Amazon Cognito B. Amazon GuardDuty C. Amazon Inspector D. Amazon Macie None 43. A company is running an application on Amazon EC2 instances hosted in a private subnet of a VPC . The EC2 instances are configured in an Auto Scaling group behind an Elastic Load Balancer (ELB). The EC2 instances use a NAT gateway for outbound internet access. However the EC2 instances are not able to connect to the public internet to download software updates. What are the possible root causes of this issue? (Select TWO ) A. The ELB is not configured with a proper health check B. The route tables in the VPC are configured incorrectly C. The EC2 instances are not associated with an Elastic IP address D. The security group attached to the NAT gateway is configured incorrectly E. The outbound rules on the security group attached to the EC2 Instances are configured incorrectly. 44. The DNS provider that hosts a company's domain name records is experiencing outages that cause service disruption for a website running on AWS. The company needs to migrate to a more resilient managed DNS service and wants the service to run on AWS. What should a solutions architect do to rapidly migrate the DNS hosting service? A. Create an Amazon Route 53 public hosted zone for the domain name. Import the zone file containing the domain records hosted by the previous provider B. Create an Amazon Route 53 private hosted zone for the domain name Import the zone file containing the domain records hosted by the previous provider C. Create a Simple AD directory in AWS. Enable zone transfer between the DNS provider and AWS Directory Service for Microsoft Active Directory for the domain records D. Create an Amazon Route 53 Resolver inbound endpoint in the VPC Specify the IP addresses that the provider's DNS will forward DNS queries to Configure the provider's DNS to forward DNS queries for the domain to the IP addresses that are specified in the inbound endpoint. None 45. A company has a large dataset for its online advertising business stored in an Amazon RDS for MySQL DB instance in a single Availability Zone. The company wants business reporting queries to run without impacting the write operations to the production DB instance. Which solution meets these requirements? A. Deploy RDS read replicas to process the business reporting queries. B. Scale out the DB instance horizontally by placing it behind an Elastic Load Balance C. Scale up the DB instance to a larger instance type to handle write operations and queries D. Deploy the DB instance in multiple Availability Zones to process the business reporting queries None 46. A company provides a three-tier web application to its customers. Each customer has an AWS account in which the application is deployed, and these accounts are members of the company's organization in AWS Organizations. To protect its customers' AWS accounts and applications the company wants to monitor them for unusual and unexpected behavior. The company needs to analyze and monitor customer VPC Flow Logs. AWS CloudTrail logs, and DNS logs. What should a solutions architect do to meet these requirements? A. Designate an account in the organization as the AWS Shield master account Enable Shield and Shield logs in every account and invite the accounts to join the Shield master account Analyze Shield findings m the Shield master account B. Designate an account in the organization as the Amazon GuardDuty master account Enable GuardDuty in every account and invite the accounts to join the GuardDuty master account Analyze GuardDuty finding in the GuardDuty master account C. Designate an account in the organization as the AWS WAF master account Enable AWS WAF and AWS WAF logs in every account and invite the accounts to join the AWS WAF master account Analyze AWS WAF logs in the AWS WAF master account D. Designate an account in the organization as the AWS Resource Access Manager (AWS RAM) master account Enable AWS RAM in every account, and invite the accounts to join the AWS RAM master account Analyze AWS RAM logs in the AWS RAM master account None 47. A company has concerns about its Amazon RDS database. The workload is unpredictable, and periodic floods of new user registrations can cause he company to run out storage. The database runs on a general purpose instance with 300 GB of storage. What should a solution architect recommend to the company? A. Enable RDS storage autoscaling. B. Schedule vertical instance scaling C. Change to a storage optimized nstance type and vertically scale the database. D. Configure an AWS Lambda function to increase RDS storage by 1 GiB when storage space is low. None 48. A company has a web application for travel ticketing. The application is based on a database that runs in a single data center in North America. The company wants to expand the application to serve a global user base. The company needs to display the application to multiple AWS Regions. Average latency must be less than 1 second on updates to reservation database. The company wants to have separate deployments of its web platform across multiple Regions. However, the company must maintain a single primary reservation database that is globally consistent. Which solution should a solutions architect recommend to meet these requirements? A. Convert the application to use Amazon DynamoDB. Use a global table for the center reservation table. Use the correct Regional endpoint in each Regional deployment B. Migrate the database to an Amazon Aurora MySQL database. Deploy Aurora Read Replicas in each Region. Use the correct Region endpoint in each Regional deployment for access to the database C. Migrate the database to an Amazon RDS for MySQL database. Deploy MySQL read replicas in each Region. Use the correct Regional endpoint In each Regional deployment for access to the database D. Migrate the application to an Amazon Aurora Severless database. Deploy instances of the database to each Region. Use the correct Region endpoint in each Regional deployment to access the database. Use AWS Lambda functions to process event streams in each Region to synchronize the databases. None 49. A gaming company is designing a highly available architecture. The application runs on a modified Linux kernel and support only UDP-based traffic. The company needs the front-end tier to provide the best possible user experience. The tier must have low latency, route traffic to the nearest edge location, and possible static IP addresses for entry into the application endpoints. What should a solution architect do to meet these requirements? A. Configure Amazon Route 53 to forward requests to an Application Load Balancer. Use AWS Lambda for the application in AWS Application Auto Scaling . Configure Amazon CloudFront to forward requests to a network Load Balancer. Use AWS Lambda for the application in a AWS Application Auto Scaling group C. Configure AWS Global Accelerator to forward requests to a Network Load Balancer. Use Amazon EC2 instances for the application in an EC2 Auto Sca ing group D. Configure Amazon API Gateway to forward requests to an Application Load Balancer. Use Amazon EC2 instances for the application in an EC2 Auto Scaling group None 50. A solution architect is designing the infrastructure for an application. The application must have a managed MySQL database mat is highly available. The database will be (censed only by resources in the same VPC. The database also must have auto scaling for storage and compute. Which solution meets these requirements? A. Amazon RDS tor MySQL B. Amazon Aurora with MySQL compatibility C. Amazon Aurora Serverless with MySQL compatibility D. MySQL on Amazon EC2 instances with Amazon Elastic File System (Amazon EFS) None 51. A company wants to improve the availability of an existing firewall. To meet the compliance requirements of the applications hosted in the VPC. The company's security team is using a proprietary firewall running on Amazon EC2 instances. All internet traffic flows through the primary firewall. When the primary firewall goes down, the team manually changes the VPC route table so that it uses a secondary firewall running in a different Availability Zone. Which strategies should a solutions architect use to improve the availability of the firewall? (Select TWO.) A. Create an EC2 gateway endpoint In the VPC where the firewall is hosted B. Create an EC2 interface endpoint in the VPC where the firewall is hosted C. Enable enhanced networking on the EC2 instance running the proprietary firewall D. Deploy a scheduled AWS Lambda function in the VPC to monitor the primary firewall and change the route table to use the secondary firewall in case of failure E. Monitor the firewall instance health in Amazon EventBridge (Amazon CloudWatch Events) Trigger an event rule to restart the primary firewall upon a detected failure. 52. A company slops a cluster of Amazon EC2 instances over a weekend. The costs decrease, but they do not drop to zero. Which resources could still be generating costs? (Select TWO.) A. Elastic IP addresses B. Data transfer out C. Regional data transfers D. Amazon Elastic Block Store (Amazon EBS) volumes E. AWS Auto Scaling 53. A developer has an application that uses an AWS Lambda function to upload files to Amazon S3 and needs the required permissions to perform the task. The developer already has an IAM user with valid IAM credentials required for Amazon S3. What should a solutions architect do to grant the permissions? A. Add required IAM permissions in the resource policy of the Lambda function. B. Create a signed request using the existing IAM credential in the Lambda function C. Create a new IAM user and use the existing IAM credentials in the Lambda function D. Create an IAM execution role with the required permissions and attach the IAM role to the Lambda function None 54. A solutions architect is designing an elastic application that will have between 10 and 50 Amazon EC2 concurrent instances running depending on the load. Each instance must mount storage that will read and write to the same 50 GB folder. Which storage type meets the requirements? A. Amazon S3 B. Amazon Elastic File System (Amazon EFS) C. Amazon Amazon Elastic Block Store (Amazon EBS) volumes D. Amazon EC2 instance store None 55. A company is using Amazon Route 53 latency-based routing to route requests to its UDP-based application for users around the world. The application is hosted on redundant servers in the company’s on-premises data centers in the United States, Asia, and Europe. The company’s compliance requirements state that the application must be hosted on premises. The company wants to improve the performance and availability of the application. What should a solutions architect do to meet these requirements? A. Configure throe Network Load Balancers (NLBs) in the three AWS Regions to address the onpremises endpoints. Create an accelerator by using AWS Global Accelerator, and register the NLBs as its endpoints. Provide access to the application by using a CNAML that points to the accelerator DNS B. Configure three Application Load Balancers (ALGs) in the three AWS Regions to wireless the onpremises endpoints. Create an accelerator by using AWS Global Accelerator, and register the ALBs as its endpoints. Provide access to the application by using a CNAK1L that points to the accelerator UNS C. Configure three Network Load Balancers (NLOs) in the three AWS Regions to address the onprernises endpoints. In Route 53, create latency-based record that points to the three NLBs, and use it as an origin for an Amazon CloudFront distribution. Provide access to the application by using a CNAML that points to the CloudFront DNS. D. Configure three Application Load Balancers (ALBs) in the three AWS Regions to address the on premises endpoint. In Route 53, create a latency based record that points to the three ALUs and use it as an origin for an Amazon CloudFront distribution. Provide access to the application by using a CNAMF that points to the CloudFront DNS. None 56. An ecommerce application places orders in an Amazon Simple Queue Service (Amazon SQS) queue. When a message is received, the Amazon EC2 worker instances process the request The EC2 instancesare in an Auto Scaling group 236. How should the architecture be designed to scale the auto scaling group with the LEAST amount of operational overhead? A. Use an Amazon CloudWatch alarm on the EC2 CPU to scale the Auto Scaling group up and down B. Use an Amazon EC2 Auto Scaling health check for messages processed on the EC2 instances to scale up or down C. Use an Amazon CloudWatch alarm based on the number of messages in the queue to scale the Auto Scaling group up or down D. Use an Amazon CloudWatch alarm based on the CPU to scale the Auto Scaling group up or down None 57. A company has an asynchronous web application where Amazon API Gateway triggers AWS Lambda functions to perform write and update operations on an Amazon RDS DB instance. During periods of extreme use API Gateway and Lambda scale in response to the incoming workload but service outages occur due to congestion with Amazon RDS. The company is seeking a cost-effective design to alleviate this congestion. What should a solutions architect recommend'? A. implement RDS storage autoscaling with a larger instance type B. Create read replicas to alleviate me read requests on the database C. Use Amazon Kinesis to poll the incoming requests from API Gateway to the Lambda functions D. Use Amazon Simple Queue Service (Amazon SQS) to buffer the incoming requests before delivering them to the Lambda functions None 58. A company has multiple AWS accounts with applications deployed in the us-west-2 Region Application togs are stored within Amazon S3 buckets in each account. The company wants to build a centralized log analysts solution that uses a single S3 bucket Logs must not leave uswest-2T and the company wants to incur minimal operational overhead. Which solution meets these requirements and is MOST cost-effective? A. Create an S3 Lifecycle policy that copies the objects from one of the application S3 buckets to the centralized S3 bucket B. Use S3 Same-Region Replication to replicate togs from the S3 buckets to another S3 bucket in us-west-2 Use this S3 bucket for log analysis C. Write a script that uses the PutObject API operation every day to copy the entire contents of the buckets to another S3 bucket in us-west-2 Use this S3 bucket for log analysis D. Write AWS Lambda functions in these accounts that are triggered every time logs ate delivered the S3 buckets (s3 ObjectCreated. * event) Copy the logs to another S3 bucket in us-west-2 Use this S3 bucket for log analysis None 59. A development team is deploying a new product on AWS and Is using AWS Lambda as part of the deployment. The team allocates 512 MB of memory for one of the Lambda functions. With this memory allocation, the function is completed in 2 minutes. The function runs millions of times monthly, and the development team is concerned about cost. The eam conducts tests to see how different Lambda memory allocations affect the cost of the function. Which steps will reduce the Lambda costs for the product? (Select TWO. A. Increase the memory allocation for this Lambda function to 1,024 MB if this change causes the execution time of each function to be less than 1 minute B. Increase the memory allocation for this Lambda function to 1.024 MB If this change causes the execution time of each function to be less than 90 seconds. C. Reduce the memory allocation for this ambda function to 256 MB if this change causes the execution time of each function to be less than 4 minutes D. Increase the memory allocation for this Lambda function to 2,048 MB If this change causes the execution time of each function to be less than 1 minute. E. Reduce the memory allocation for this Lambda function to 256 MB if this change causes the execution time of each function to be less than 5 minutes. 60. A solutions architect needs to design a centralized logging solution for a group of web applications running on Amazon EC2 instances. The solution requires min mal development effort due to budget containts. What should the architect recommend? A. Create a crontab job script in each instance t regularly push the logs to Amazon S3 B. Install and configure Amazon CloudWatch Logs agent in the Amazon EC2 instances C. Enable Amazon EventBridge (Amazon CloudWatch Events) in the AWS Management Console. D. Enable AWS Cloud Trail to map all API Calls invoked by the applications None 61. A company is using Amazon RDS for MySQL. The company disaster recovery requirements state that a near real time replica of the database must be maintained on premises. The company wants the data to be encrypted in transit/ Which solution meets these requirements? A. Use AWS Database Migration Service (AWS DMS) and AWS Direct Connect to migrate the data from AWS to on premises. B. Use MySQL replication to replicate from AWS to on premises over an IPsec VPN on top of an AWS Direct Connect Connection. C. Use AWS Data Pipeline to replicate from AWS to on premises over an IPsec VPN on top of an AWS Direct Connect Connection D. Use the Amazon RDS Multi-Az Feature. Choose on premises as the failover availability zone over an IPsec vpn on top of an AWS Direct Connect Connection None 62. A company wants to launch a new application using Amazon Route 53, an Application Load Balancer (ALB), and an Amazon EC2 Auto Scaling group. The company is preparing to perform user experience testing and has a limited budget for this phase of the project. Although the company plans to do a load test in the future, it wants to prevent users from load testing at this time because it wants to limit unnecessary EC2 automatic scaling. What should a solutions architect do to minimize costs of the user experience testing? A. Configure AWS Shield's client request threshold to 100 connections per client B. Deploy AWS WAF on the ALB with a rate-based rule configured to limit the number of requests each client can make. C. Configure the ALB with an advanced request routing policy to throttle the client connections being sent to the Auto Scaling group D. Deploy Amazon Simple Queue Service (Amazon SQS) between the ALB and Auto Scaling group to queue client requests and change the Auto Scaling group maximum size to one None 63. A solutions architect is using an AWS Cloud Formation template to deploy a three-tier web application. The web application consists of a web tier and an application tier that stores and retrieves user data in Amazon DynamoDB tables. The web and application tiers are hosted on Amazon EC2 instances, and the database tier is not publicly accessible. The application EC2 instances need to access the DynamoDB tables without exposing API credentials in the template. What should the solutions architect do to meet these requirements? A. Create an IAM role to read the DynamoOB tables. Associate the role with the application instances by reference an instance profile B. Create an IAM role that has the required permissions to read and write from the DynamoOB tables. Add the role to the EC2 instance profile and associate the instance profile with the apphcanon instances C. Use the parameter section in the AWS CkHidFormaton template to have the user input access and secret keys from an already-created IAM user mat has the required permissions to read and write from the DynamoOB tables D. Create an IAM user m the AWS CioudFormation template that has the required permissions to read and write from the DynamoOB tables. Use the GetAti function to retrieve the access and secret keys and pass them to the application instances through the user data None 64. A company is using Amazon Redshift for analytics and to generate customer reports. The company recently acquired 50 TB of additional customer demographic data. The data is stored in .csv files in Amazon S3. The company needs a solution that joins the data and visualizes the results with the least possible cost and effort. What should a solutions architect recommend to meet these requirements? A. Use Amazon Redshift Spectrum to query the data in Amazon S3 directly and join that data with the existing data in Amazon Redshift. Use Amazon QuickSight to build the visualizations B. Use Amazon Athena to query the data in Amazon S3. Use Amazon QuickSight to join the data from Athena with the existing data in Amazon Redshift and to build the visualizations C. Increase the size of the Amazon Redshift cluster, and load the data from Amazon S3. Use Amazon EMR Notebooks to query the data and build the visualizations in Amazon Redshift D. Export the data from the Amazon Redshift cluster into Apache Parquet files in Amazon S3. Use Amazon Elasticsearch Service (Amazon ES) to query the data. Use Kibana to visualize the results None 65. An image hosting company uploads its large assets to Amazon S3 Standard buckets. The company uses multipart upload in parallel by using S3 APIs and overwrites if the same object is uploaded again. For the first 30 days after upload the objects will be accessed frequently. The objects will be used less frequently after 30 days but the access patterns for each object will be inconsistent. The company must optimize its S3 storage costs while maintaining high availability and resiliency of stored assets. Which combination of actions should a solutions architect recommend lo meet these requirements? (Select TWO.) A. Move assets to S3 Intelligent-Tiering after 30 days B. Configure an S3 Lifecycle policy to clean up incomplete multipart uploads C. Configure an S3 L fecycle policy to clean up expired object delete markers D. Move ass ts to S3 Standard-Infrequent Access (S3 Standard-iA) after 30 days E. Move ass ts to S3 One Zone infrequent Access (S3 One Zone-IA) after 30 days 1 out of 65 Time's upTime is Up!
