Solutions Arch (Q/A 101-150) WITH EXPLANATION

QUESTION 116 A company hosts an application on an Amazon EC2 instance that requires a maximum of 200 GB storage space. The application is used infrequently, with peaks during mornings and evenings. Disk I/O varies, but peaks at 3,000 IOPS. The chief financial officer of the company is concerned about costs and has asked a solutions architect to recommend the most cost-effective storage option that does not sacrifice performance. Which solution should the solutions architect recommend? A. Amazon EBS Cold HDD (sc1) B. Amazon EBS General Purpose SSD (gp2) C. Amazon EBS Provisioned IOPS SSD (io1) D. Amazon EBS Throughput Optimized HDD (st1)

B. Amazon EBS General Purpose SSD (gp2) https://aws.amazon.com/ebs/features/

QUESTION 117 A company's application hosted on Amazon EC2 instances needs to access an Amazon S3 bucket. Due to data sensitivity, traffic cannot traverse the internet. How should a solutions architect configure access? A. Create a private hosted zone using Amazon Route 53. B. Configure a VPC gateway endpoint for Amazon S3 in the VPC. C. Configure AWS PrivateLink between the EC2 instance and the S3 bucket. D. Set up a site-to-site VPN connection between the VPC and the S3 bucket.

B. Configure a VPC gateway endpoint for Amazon S3 in the VPC. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html

QUESTION 104 An ecommerce company is running a multi-tier application on AWS. The front-end and backend tiers both run on Amazon EC2, and the database runs on Amazon RDS for MySQL. The backend tier communicates with the RDS instance. There are frequent calls to return identical datasets from the database that are causing performance slowdowns. Which action should be taken to improve the performance of the backend? A. Implement Amazon SNS to store the database calls. B. Implement Amazon ElastiCache to cache the large datasets. C. Implement an RDS for MySQL read replica to cache database calls. D. Implement Amazon Kinesis Data Firehose to stream the calls to the database.

B. Implement Amazon ElastiCache to cache the large datasets. https://aws.amazon.com/elasticache/

QUESTION 112 A company recently launched its website to serve content to its global user base. The company wants to store and accelerate the delivery of static content to its users by leveraging Amazon CloudFront with an Amazon EC2 instance attached as its origin. How should a solutions architect optimize high availability for the application? A. Use Lambda@Edge for CloudFront. B. Use Amazon S3 Transfer Acceleration for CloudFront. C. Configure another EC2 instance in a different Availability Zone as part of the origin group. D. Configure another EC2 instance as part of the origin server cluster in the same Availability Zone.

C. Configure another EC2 instance in a different Availability Zone as part of the origin group. (Answer corrected, old answer A) https://docs.aws.amazon.com/us_en/AmazonCloudFront/latest/DeveloperGuide/high_availability_origin_failover.html

QUESTION 145 A solutions architect needs to design a low-latency solution for a static single-page application accessed by users utilizing a custom domain name. The solution must be serverless, encrypted in transit, and costeffective. Which combination of AWS services and features should the solutions architect use? (Choose two.) A. Amazon S3 B. Amazon EC2 C. AWS Fargate D. Amazon CloudFront E. Elastic Load Balancer

A. Amazon S3 D. Amazon CloudFront https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serve-static-website/

QUESTION 141 A company has global users accessing an application deployed in different AWS Regions, exposing public static IP addresses. The users are experiencing poor performance when accessing the application over the internet. What should a solutions architect recommend to reduce internet latency? A. Set up AWS Global Accelerator and add endpoints. B. Set up AWS Direct Connect locations in multiple Regions. C. Set up an Amazon CloudFront distribution to access an application. D. Set up an Amazon Route 53 geoproximity routing policy to route traffic.

A. Set up AWS Global Accelerator and add endpoints. https://aws.amazon.com/global-accelerator/?blogs-global-accelerator.sort-by=item.additionalFields.createdDate&blogs-global-accelerator.sort-order=desc&aws-global-accelerator-wn.sort-by=item.additionalFields.postDateTime&aws-global-accelerator-wn.sort-order=desc

QUESTION 113 An application running on an Amazon EC2 instance in VPC-A needs to access files in another EC2 instance in VPC-B. Both are in separate. AWS accounts. The network administrator needs to design a solution to enable secure access to EC2 instance in VPC-B from VPC-A. The connectivity should not have a single point of failure or bandwidth concerns. Which solution will meet these requirements? A. Set up a VPC peering connection between VPC-A and VPC-B. B. Set up VPC gateway endpoints for the EC2 instance running in VPC-B. C. Attach a virtual private gateway to VPC-B and enable routing from VPC-A. D. Create a private virtual interface (VIF) for the EC2 instance running in VPC-B and add appropriate routes from VPC-B.

A. Set up a VPC peering connection between VPC-A and VPC-B. (Answer corrected, old answer is D) https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

QUESTION 150 A solutions architect is working on optimizing a legacy document management application running on Microsoft Windows Server in an on-premises data center. The application stores a large number of files on a network file share. The chief information officer wants to reduce the on-premises data center footprint and minimize storage costs by moving on-premises storage to AWS. What should the solutions architect do to meet these requirements? A. Set up an AWS Storage Gateway file gateway. B. Set up Amazon Elastic File System (Amazon EFS) C. Set up AWS Storage Gateway as a volume gateway D. Set up an Amazon Elastic Block Store (Amazon EBS) volume.

A. Set up an AWS Storage Gateway file gateway. https://aws.amazon.com/storagegateway/file/

QUESTION 124 A company is using Amazon EC2 to run its big data analytics workloads. These variable workloads run each night, and it is critical they finish by the start of business the following day. A solutions architect has been tasked with designing the MOST cost-effective solution. Which solution will accomplish this? A. Spot Fleet B. Spot Instances C. Reserved Instances D. On-Demand Instances

A. Spot Fleet https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-fleet.html

QUESTION 108 A company wants to run a hybrid workload for data processing. The data needs to be accessed by onpremises applications for local data processing using an NFS protocol, and must also be accessible from the AWS Cloud for further analytics and batch processing. Which solution will meet these requirements? A. Use an AWS Storage Gateway file gateway to provide file storage to AWS, then perform analytics on this data in the AWS Cloud. B. Use an AWS storage Gateway tape gateway to copy the backup of the local data to AWS, then perform analytics on this data in the AWS cloud. C. Use an AWS Storage Gateway volume gateway in a stored volume configuration to regularly take snapshots of the local data, then copy the data to AWS. D. Use an AWS Storage Gateway volume gateway in a cached volume configuration to back up all the local storage in the AWS cloud, then perform analytics on this data in the cloud.

A. Use an AWS Storage Gateway file gateway to provide file storage to AWS, then perform analytics on this data in the AWS Cloud. https://docs.aws.amazon.com/storagegateway/latest/userguide/WhatIsStorageGateway.html

QUESTION 111 A company is investigating potential solutions that would collect, process, and store users' service usage data. The business objective is to create an analytics capability that will enable the company to gather operational insights quickly using standard SQL queries. The solution should be highly available and ensure Atomicity, Consistency, Isolation, and Durability (ACID) compliance in the data tier. Which solution should a solutions architect recommend? A. Use Amazon DynamoDB transactions. B. Create an Amazon Neptune database in a Multi-AZ design C. Use a fully managed Amazon RDS for MySQL database in a Multi-AZ design. D. Deploy PostgreSQL on an Amazon EC2 instance that uses Amazon EBS Throughput Optimized HDD (st1) storage.

C. Use a fully managed Amazon RDS for MySQL database in a Multi-AZ design. https://aws.amazon.com/dynamodb/

QUESTION 114 A company currently stores symmetric encryption keys in a hardware security module (HSM). A solutions architect must design a solution to migrate key management to AWS. The solution should allow for key rotation and support the use of customer provided keys. Where should the key material be stored to meet these requirements? A. Amazon S3 B. AWS Secrets Manager C. AWS Systems Manager Parameter store D. AWS Key Management Service (AWS KMS)

D. AWS Key Management Service (AWS KMS) https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html

QUESTION 142 A company wants to migrate a workload to AWS. The chief information security officer requires that all data be encrypted at rest when stored in the cloud. The company wants complete control of encryption key lifecycle management. The company must be able to immediately remove the key material and audit key usage independently of AWS CloudTrail. The chosen services should integrate with other storage services that will be used on AWS. Which services satisfies these security requirements? A. AWS CloudHSM with the CloudHSM client B. AWS Key Management Service (AWS KMS) with AWS CloudHSM C. AWS Key Management Service (AWS KMS) with an external key material origin D. AWS Key Management Service (AWS KMS) with AWS managed customer master keys (CMKs)

D. AWS Key Management Service (AWS KMS) with AWS managed customer master keys (CMKs) (Corrected answer, old answer is A) https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html

QUESTION 132 A media company is evaluating the possibility of moving its systems to the AWS Cloud. The company needs at least 10 TB of storage with the maximum possible I/O performance for video processing, 300 TB of very durable storage for storing media content, and 900 TB of storage to meet requirements for archival media that is not in use anymore. Which set of services should a solutions architect recommend to meet these requirements? A. Amazon EBS for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage B. Amazon EBS for maximum performance, Amazon EFS for durable data storage, and Amazon S3 Glacier for archival storage C. Amazon EC2 instance store for maximum performance, Amazon EFS for durable data storage, and Amazon S3 for archival storage D. Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage

A. Amazon EBS for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage https://aws.amazon.com/s3/storage-classes/

QUESTION 130 A company hosts its website on Amazon S3. The website serves petabytes of outbound traffic monthly, which accounts for most of the company's AWS costs. What should a solutions architect do to reduce costs? A. Configure Amazon CloudFront with the existing website as the origin. B. Move the website to Amazon EC2 with Amazon EBS volumes for storage. C. Use AWS Global Accelerator and specify the existing website as the endpoint. D. Rearchitect the website to run on a combination of Amazon API Gateway and AWS Lambda.

A. Configure Amazon CloudFront with the existing website as the origin. cloudfront vs s3 http request pricing; https://aws.amazon.com/cloudfront/pricing/

QUESTION 127 A company has a mobile chat application with a data store based in Amazon DynamoDB. Users would like new messages to be read with as little latency as possible. A solutions architect needs to design an optimal solution that requires minimal application changes. Which method should the solutions architect select? A. Configure Amazon DynamoDB Accelerator (DAX) for the new messages table. Update the code to use the DAX endpoint. B. Add DynamoDB read replicas to handle the increased read load. Update the application to point to the read endpoint for the read replicas. C. Double the number of read capacity units for the new messages table in DynamoDB. Continue to use the existing DynamoDB endpoint. D. Add an Amazon ElastiCache for Redis cache to the application stack. Update the application to point to the Redis cache endpoint instead of DynamoDB.

A. Configure Amazon DynamoDB Accelerator (DAX) for the new messages table. Update the code to use the DAX endpoint. https://aws.amazon.com/dynamodb/dax/

QUESTION 149 A monolithic application was recently migrated to AWS and is now running on a single Amazon EC2 instance. Due to application limitations, it is not possible to use automatic scaling to scale out the application. The chief technology officer (CTO) wants an automated solution to restore the EC2 instance in the unlikely event the underlying hardware fails. What would allow for automatic recovery of the EC2 instance as quickly as possible? A. Configure an Amazon CloudWatch alarm that triggers the recovery of the EC2 instance if it becomes impaired. B. Configure an Amazon CloudWatch alarm to trigger an SNS message that alerts the CTO when the EC2 instance is impaired. C. Configure AWS CloudTrail to monitor the health of the EC2 instance, and if it becomes impaired, trigger instance recovery. D. Configure an Amazon EventBridge event to trigger an AWS Lambda function once an hour that checks the health of the EC2 instance and triggers instance recovery if the EC2 instance is unhealthy.

A. Configure an Amazon CloudWatch alarm that triggers the recovery of the EC2 instance if it becomes impaired. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-recover.html

QUESTION 134 An application is running on Amazon EC2 instances. Sensitive information required for the application is stored in an Amazon S3 bucket. The bucket needs to be protected from internet access while only allowing services within the VPC access to the bucket. Which combination of actions should solutions archived take to accomplish this? (Choose two.) A. Create a VPC endpoint for Amazon S3. B. Enable server access logging on the bucket. C. Apply a bucket policy to restrict access to the S3 endpoint. D. Add an S3 ACL to the bucket that has sensitive information. E. Restrict users using the IAM policy to use the specific bucket.

A. Create a VPC endpoint for Amazon S3. C. Apply a bucket policy to restrict access to the S3 endpoint. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html

QUESTION 110 A solutions architect is moving the static content from a public website hosted on Amazon EC2 instances to an Amazon S3 bucket. An Amazon CloudFront distribution will be used to deliver the static assets. The security group used by the EC2 instances restricts access to a limited set of IP ranges. Access to the static content should be similarly restricted. Which combination of steps will meet these requirements? (Choose two.) A. Create an origin access identity (OAI) and associate it with the distribution. Change the permissions in the bucket policy so that only the OAI can read the objects. B. Create an AWS WAF web ACL that includes the same IP restrictions that exist in the EC2 security group. Associate this new web ACL with the CloudFront distribution. C. Create a new security group that includes the same IP restrictions that exist in the current EC2 security group. Associate this new security group with the CloudFront distribution. D. Create a new security group that includes the same IP restrictions that exist in the current EC2 security group. Associate this new security group with the S3 bucket hosting the static content. E. Create a new IAM role and associate the role with the distribution. Change the permissions either on the S3 bucket or on the files within the S3 bucket so that only the newly created IAM role has read and download permissions.

A. Create an origin access identity (OAI) and associate it with the distribution. Change the permissions in the bucket policy so that only the OAI can read the objects. B. Create an AWS WAF web ACL that includes the same IP restrictions that exist in the EC2 security group. Associate this new web ACL with the CloudFront distribution. https://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html

QUESTION 143 A company recently deployed a two-tier application in two Availability Zones in the us-east-1 Region. The databases are deployed in a private subnet while the web servers are deployed in a public subnet. An internet gateway is attached to the VPC. The application and database run on Amazon EC2 instances. The database servers are unable to access patches on the internet. A solutions architect needs to design a solution that maintains database security with the least operational overhead. Which solution meets these requirements? A. Deploy a NAT gateway inside the public subnet for each Availability Zone and associate it with an Elastic IP address. Update the routing table of the private subnet to use it as the default route. B. Deploy a NAT gateway inside the private subnet for each Availability Zone and associate it with an Elastic IP address. Update the routing table of the private subnet to use it as the default route. C. Deploy two NAT instances inside the public subnet for each Availability Zone and associate them with Elastic IP addresses. Update the routing table of the private subnet to use it as the default route. D. Deploy two NAT instances inside the private subnet for each Availability Zone and associate them with Elastic IP addresses. Update the routing table of the private subnet to use it as the default route.

A. Deploy a NAT gateway inside the public subnet for each Availability Zone and associate it with an Elastic IP address. Update the routing table of the private subnet to use it as the default route. https://aws.amazon.com/premiumsupport/knowledge-center/nat-gateway-vpc-private-subnet/

QUESTION 148 A company has migrated an on-premises Oracle database to an Amazon RDS for Oracle Multi-AZ DB instance in the us-east-l Region. A solutions architect is designing a disaster recovery strategy to have the database provisioned in the us-west-2 Region in case the database becomes unavailable in the us-east-1 Region. The design must ensure the database is provisioned in the us-west-2 Region in a maximum of 2 hours, with a data loss window of no more than 3 hours. How can these requirements be met? A. Edit the DB instance and create a read replica in us-west-2. Promote the read replica to master in us-west2 in case the disaster recovery environment needs to be activated. B. Select the multi-Region option to provision a standby instance in us-west-2. The standby instance will be automatically promoted to master in us-west-2 in case the disaster recovery environment needs to be created. C. Take automated snapshots of the database instance and copy them to us-west-2 every 3 hours. Restore the latest snapshot to provision another database instance in us-west-2 in case the disaster recovery environment needs to be activated. D. Create a multimaster read/write instances across multiple AWS Regions. Select VPCs in us-east-1 and uswest-2 to make that deployment. Keep the master read/write instance in us-west-2 available to avoid having to activate a disaster recovery environment.

A. Edit the DB instance and create a read replica in us-west-2. Promote the read replica to master in us-west2 in case the disaster recovery environment needs to be activated. (Answer corrected, old answer is B) https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-read-replicas.html

QUESTION 102 A company must migrate 20 TB of data from a data center to the AWS Cloud within 30 days. The company's network bandwidth is limited to 15 Mbps and cannot exceed 70% utilization. What should a solutions architect do to meet these requirements? A. Use AWS Snowball. B. Use AWS DataSync. C. Use a secure VPN connection. D. Use Amazon S3 Transfer Acceleration.

A. Use AWS Snowball. https://aws.amazon.com/getting-started/projects/migrate-petabyte-scale-data/services-costs/

QUESTION 147 A solutions architect is designing a customer-facing application. The application is expected to have a variable amount of reads and writes depending on the time of year and clearly defined access patterns throughout the year. Management requires that database auditing and scaling be managed in the AWS Cloud. The Recovery Point Objective (RPO) must be less than 5 hours. Which solutions can accomplish this? (Choose two.) A. Use Amazon DynamoDB with auto scaling. Use on-demand backups and AWS CloudTrail. B. Use Amazon DynamoDB with auto scaling. Use on-demand backups and Amazon DynamoDB Streams. C. Use Amazon Redshift Configure concurrency scaling. Enable audit logging. Perform database snapshots every 4 hours. D. Use Amazon RDS with Provisioned IOPS. Enable the database auditing parameter. Perform database snapshots every 5 hours. E. Use Amazon RDS with auto scaling. Enable the database auditing parameter. Configure the backup retention period to at least 1 day.

A. Use Amazon DynamoDB with auto scaling. Use on-demand backups and AWS CloudTrail. B. Use Amazon DynamoDB with auto scaling. Use on-demand backups and Amazon DynamoDB Streams. https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.html

QUESTION 144 A company has an application with a REST-based interface that allows data to be received in near-real time from a third-party vendor. Once received, the application processes and stores the data for further analysis. The application is running on Amazon EC2 instances. The third-party vendor has received many 503 Service Unavailable Errors when sending data to the application. When the data volume spikes, the compute capacity reaches its maximum limit and the application is unable to process all requests. Which design should a solutions architect recommend to provide a more scalable solution? A. Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions. B. Use Amazon API Gateway on top of the existing application. Create a usage plan with a quota limit for the third-party vendor. C. Use Amazon Simple Notification Service (Amazon SNS) to ingest the data. Put the EC2 instances in an Auto Scaling group behind an Application Load Balancer. D. Repackage the application as a container. Deploy the application using Amazon Elastic Container Service (Amazon ECS) using the EC2 launch type with an Auto Scaling group.

A. Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions. https://docs.aws.amazon.com/streams/latest/dev/introduction.html

QUESTION 131 A company runs a website on Amazon EC2 instances behind an ELB Application Load Balancer. Amazon Route 53 is used for the DNS. The company wants to set up a backup website with a message including a phone number and email address that users can reach if the primary website is down. How should the company deploy this solution? A. Use Amazon S3 website hosting for the backup website and Route 53 failover routing policy. B. Use Amazon S3 website hosting for the backup website and Route 53 latency routing policy. C. Deploy the application in another AWS Region and use ELB health checks for failover routing. D. Deploy the application in another AWS Region and use server-side redirection on the primary website.

A. Use Amazon S3 website hosting for the backup website and Route 53 failover routing policy. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html

QUESTION 135 A web application runs on Amazon EC2 instances behind an Application Load Balancer. The application allows users to create custom reports of historical weather data. Generating a report can take up to 5 minutes. These long-running requests use many of the available incoming connections, making the system unresponsive to other users. How can a solutions architect make the system more responsive? A. Use Amazon SQS with AWS Lambda to generate reports. B. Increase the idle timeout on the Application Load Balancer to 5 minutes. C. Update the client-side application code to increase its request timeout to 5 minutes. D. Publish the reports to Amazon S3 and use Amazon CloudFront for downloading to the user.

A. Use Amazon SQS with AWS Lambda to generate reports. https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-how-it-works.html

QUESTION 129 A company has implemented one of its microservices on AWS Lambda that accesses an Amazon DynamoDB table named Books. A solutions architect is designing an IAM policy to be attached to the Lambda function's IAM role, giving it access to put, update, and delete items in the Books table. The IAM policy must prevent function from performing any other actions on the Books table or any other. Which IAM policy would fulfill these needs and provide the LEAST privileged access? A. { "Version": "2012-10-17", "Statement": [ { "sid": "PutUpdateDeleteOnBooks", "Effect": "Allow", "Action": [ "dynamodb: PutItem", "dynamodb: UpdateItem", "dynamodb: DeleteItem" ], "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/Books" } ] } B. { "Version": "2012-10-17", "Statement": [ { "sid": "PutUpdateDeleteOnBooks", "Effect": "Allow", "Action": [ "dynamodb: PutItem", "dynamodb: UpdateItem", "dynamodb: DeleteItem" ], "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/*" } ] } C. { "Version": "2012-10-17", "Statement": [ { "sid": "PutUpdateDeleteOnBooks", "Effect": "Allow", "Action": "dynamodb:*", "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/*" } ] } D. { "Version": "2012-10-17", "Statement": [ { "sid": "PutUpdateDeleteOnBooks", "Effect": "Allow", "Action": "dynamodb:*", "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/*" }, { "sid": "PutUpdateDeleteOnBooks", "Effect": "Deny", "Action": "dynamodb:*:*", "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/*" ] }

A. { "Version": "2012-10-17", "Statement": [ { "sid": "PutUpdateDeleteOnBooks", "Effect": "Allow", "Action": [ "dynamodb: PutItem", "dynamodb: UpdateItem", "dynamodb: DeleteItem" ], "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/Books" } ] } https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_grammar.html

QUESTION 140 A solutions architect is designing an architecture for a new application that requires low network latency and high network throughput between Amazon EC2 instances. Which component should be included in the architectural design? A. An Auto Scaling group with Spot Instance types. B. A placement group using a cluster placement strategy. C. A placement group using a partition placement strategy. D. An Auto Scaling group with On-Demand instance types.

B. A placement group using a cluster placement strategy. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-placementgroup.html

QUESTION 101 A company has an Amazon EC2 instance running on a private subnet that needs to access a public website to download patches and updates. The company does not want external websites to see the EC2 instance IP address or initiate connections to it. How can a solutions architect achieve this objective? A. Create a site-to-site VPN connection between the private subnet and the network in which the public site is deployed. B. Create a NAT gateway in a public subnet. Route outbound traffic from the private subnet through the NAT gateway. C. Create a network ACL for the private subnet where the EC2 instance deployed only allows access from the IP address range of the public website. D. Create a security group that only allows connections from the IP address range of the public website. Attach the security group to the EC2 instance.

B. Create a NAT gateway in a public subnet. Route outbound traffic from the private subnet through the NAT gateway. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

QUESTION 139 A solutions architect must design a solution for a persistent database that is being migrated from on-premises to AWS. The database requires 64,000 IOPS according to the database administrator. If possible, the database administrator wants to use a single Amazon Elastic Block Store (Amazon EBS) volume to host the database instance. Which solution effectively meets the database administrator's criteria? A. Use an instance from the I3 I/O optimized family and leverage local ephemeral storage to achieve the IOPS requirement. B. Create an Nitro-based Amazon EC2 instance with an Amazon EBS Provisioned IOPS SSD (io1) volume attached. Configure the volume to have 64,000 IOPS. C. Create and map an Amazon Elastic File System (Amazon EFS) volume to the database instance and use the volume to achieve the required IOPS for the database. D. Provision two volumes and assign 32,000 IOPS to each. Create a logical volume at the operating system level that aggregates both volumes to achieve the IOPS requirements.

B. Create an Nitro-based Amazon EC2 instance with an Amazon EBS Provisioned IOPS SSD (io1) volume attached. Configure the volume to have 64,000 IOPS. https://aws.amazon.com/ebs/features/

QUESTION 105 A company has an on-premises data center that is running out of storage capacity. The company wants to migrate its storage infrastructure to AWS while minimizing bandwidth costs. The solution must allow for immediate retrieval of data at no additional cost. How can these requirements be met? A. Deploy Amazon S3 Glacier Vault and enable expedited retrieval. Enable provisioned retrieval capacity for the workload. B. Deploy AWS Storage Gateway using cached volumes. Use Storage Gateway to store data in Amazon S3 while retaining copies of frequently accessed data subsets locally. C. Deploy AWS Storage Gateway using stored volumes to store data locally. Use Storage Gateway to asynchronously back up point-in-time snapshots of the data to Amazon S3. D. Deploy AWS Direct Connect to connect with the on-premises data center. Configure AWS Storage Gateway to store data locally. Use Storage Gateway to asynchronously back up point-in-time snapshots of the data to Amazon S3.

B. Deploy AWS Storage Gateway using cached volumes. Use Storage Gateway to store data in Amazon S3 while retaining copies of frequently accessed data subsets locally. https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html

QUESTION 126 A company has created an isolated backup of its environment in another Region. The application is running in warm standby mode and is fronted by an Application Load Balancer (ALB). The current failover process is manual and requires updating a DNS alias record to point to the secondary ALB in another Region. What should a solutions architect do to automate the failover process? A. Enable an ALB health check B. Enable an Amazon Route 53 health check. C. Crate an CNAME record on Amazon Route 53 pointing to the ALB endpoint. D. Create conditional forwarding rules on Amazon Route 53 pointing to an internal BIND DNS server.

B. Enable an Amazon Route 53 health check. (Answer corrected, old answer is C) https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html

QUESTION 107 A company delivers files in Amazon S3 to certain users who do not have AWS credentials. These users must be given access for a limited time. What should a solutions architect do to securely meet these requirements? A. Enable public access on an Amazon S3 bucket. B. Generate a presigned URL to share with the users. C. Encrypt files using AWS KMS and provide keys to the users. D. Create and assign IAM roles that will grant GetObject permissions to the users.

B. Generate a presigned URL to share with the users. https://docs.aws.amazon.com/AmazonS3/latest/dev/ShareObjectPreSignedURL.html

QUESTION 121 A company running an on-premises application is migrating the application to AWS to increase its elasticity and availability. The current architecture uses a Microsoft SQL Server database with heavy read activity. The company wants to explore alternate database options and migrate database engines, if needed. Every 4 hours, the development team does a full copy of the production database to populate a test database. During this period, users experience latency. What should a solutions architect recommend as replacement database? A. Use Amazon Aurora with Multi-AZ Aurora Replicas and restore from mysqldump for the test database. B. Use Amazon Aurora with Multi-AZ Aurora Replicas and restore snapshots from Amazon RDS for the test database. C. Use Amazon RDS for MySQL with a Multi-AZ deployment and read replicas, and use the standby instance for the test database. D. Use Amazon RDS for SQL Server with a Multi-AZ deployment and read replicas, and restore snapshots from RDS for the test database.

B. Use Amazon Aurora with Multi-AZ Aurora Replicas and restore snapshots from Amazon RDS for the test database. (Answer corrected, old answer D) https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CreateSnapshot.html

QUESTION 128 A company is creating an architecture for a mobile app that requires minimal latency for its users. The company's architecture consists of Amazon EC2 instances behind an Application Load Balancer running in an Auto Scaling group. The EC2 instances connect to Amazon RDS. Application beta testing showed there was a slowdown when reading the data. However the metrics indicate that the EC2 instances do not cross any CPU utilization thresholds. How can this issue be addressed? A. Reduce the threshold for CPU utilization in the Auto Scaling group. B. Replace the Application Load Balancer with a Network Load Balancer. C. Add read replicas for the RDS instances and direct read traffic to the replica. D. Add Multi-AZ support to the RDS instances and direct read traffic to the new EC2 instance.

C. Add read replicas for the RDS instances and direct read traffic to the replica. https://aws.amazon.com/rds/features/read-replicas/

QUESTION 146 A company is migrating to the AWS Cloud. A file server is the first workload to migrate. Users must be able to access the file share using the Server Message Block (SMB) protocol. Which AWS managed service meets these requirements? A. Amazon EBS B. Amazon EC2 C. Amazon FSx D. Amazon S3

C. Amazon FSx https://aws.amazon.com/fsx/

QUESTION 123 A company has several business systems that require access to data stored in a file share. The business systems will access the file share using the Server Message Block (SMB) protocol. The file share solution should be accessible from both of the company's legacy on-premises environments and with AWS. Which services meet the business requirements? (Choose two.) A. Amazon EBS B. Amazon EFS C. Amazon FSx for Windows D. Amazon S3 E. AWS Storage Gateway file gateway

C. Amazon FSx for Windows E. AWS Storage Gateway file gateway Explanation: both accessible from hybrid environments

QUESTION 125 A company has a Microsoft Windows-based application that must be migrated to AWS. This application requires the use of a shared Windows file system attached to multiple Amazon EC2 Windows instances. What should a solutions architect do to accomplish this? A. Configure a volume using Amazon EFS. Mount the EFS volume to each Windows instance. B. Configure AWS Storage Gateway in Volume Gateway mode. Mount the volume to each Windows instance. C. Configure Amazon FSx for Windows File Server. Mount the Amazon FSx volume to each Windows instance. D. Configure an Amazon EBS volume with the required size. Attach each EC2 instance to the volume. Mount the file system within the volume to each Windows instance.

C. Configure Amazon FSx for Windows File Server. Mount the Amazon FSx volume to each Windows instance. Explanation: EFS not supported on windows instances

QUESTION 122 A company has enabled AWS CloudTrail logs to deliver log files to an Amazon S3 bucket for each of its developer accounts. The company has created a central AWS account for streamlining management and audit reviews. An internal auditor needs to access the CloudTrail logs, yet access needs to be restricted for all developer account users. The solution must be secure and optimized. How should a solutions architect meet these requirements? A. Configure an AWS Lambda function in each developer account to copy the log files to the central account. Create an IAM role in the central account for the auditor. Attach an IAM policy providing read-only permissions to the bucket. B. Configure CloudTrail from each developer account to deliver the log files to an S3 bucket in the central account. Create an IAM user in the central account for the auditor. Attach an IAM policy providing full permissions to the bucket. C. Configure CloudTrail from each developer account to deliver the log files to an S3 bucket in the central account. Create an IAM role in the central account for the auditor. Attach an IAM policy providing readonly permissions to the bucket. D. Configure an AWS Lambda function in the central account to copy the log files from the S3 bucket in each developer account. Create an IAM user in the central account for the auditor. Attach an IAM policy providing full permissions to the bucket.

C. Configure CloudTrail from each developer account to deliver the log files to an S3 bucket in the central account. Create an IAM role in the central account for the auditor. Attach an IAM policy providing readonly permissions to the bucket. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html

QUESTION 106 A company is processing data on a daily basis. The results of the operations are stored in an Amazon S3 bucket, analyzed daily for one week, and then must remain immediately accessible for occasional analysis. What is the MOST cost-effective storage solution alternative to the current configuration? A. Configure a lifecycle policy to delete the objects after 30 days. B. Configure a lifecycle policy to transition the objects to Amazon S3 Glacier after 30 days. C. Configure a lifecycle policy to transition the objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days. D. Configure a lifecycle policy to transition the objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days.

C. Configure a lifecycle policy to transition the objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days. (Answer corrected, old answer D) https://aws.amazon.com/s3/storage-classes/

QUESTION 119 An ecommerce company has noticed performance degradation of its Amazon RDS based web application. The performance degradation is attributed to an increase in the number of read-only SQL queries triggered by business analysts. A solutions architect needs to solve the problem with minimal changes to the existing web application. What should the solutions architect recommend? A. Export the data to Amazon DynamoDB and have the business analysts run their queries. B. Load the data into Amazon ElastiCache and have the business analysts run their queries. C. Create a read replica of the primary database and have the business analysts run their queries. D. Copy the data into an Amazon Redshift cluster and have the business analysts run their queries.

C. Create a read replica of the primary database and have the business analysts run their queries. https://aws.amazon.com/rds/features/read-replicas/

QUESTION 138 A company relies on an application that needs at least 4 Amazon EC2 instances during regular traffic and must scale up to 12 EC2 instances during peak loads. The application is critical to the business and must be highly available. Which solution will meet these requirements? A. Deploy the EC2 instances in an Auto Scaling group. Set the minimum to 4 and the maximum to 12, with 2 in Availability Zone A and 2 in Availability Zone B. B. Deploy the EC2 instances in an Auto Scaling group. Set the minimum to 4 and the maximum to 12, with all 4 in Availability Zone A. C. Deploy the EC2 instances in an Auto Scaling group. Set the minimum to 8 and the maximum to 12, with 4 in Availability Zone A and 4 in Availability Zone B. D. Deploy the EC2 instances in an Auto Scaling group. Set the minimum to 8 and the maximum to 12, with all 8 in Availability Zone A.

C. Deploy the EC2 instances in an Auto Scaling group. Set the minimum to 8 and the maximum to 12, with 4 in Availability Zone A and 4 in Availability Zone B. Explanation: minimum for ap to work is 4, so 4 for each AZ gives you HA

QUESTION 133 A company uses Amazon S3 as its object storage solution. The company has thousands of S3 buckets it uses to store data. Some of the S3 buckets have data that is accessed less frequently than others. A solutions architect found that lifecycle policies are not consistently implemented or are implemented partially, resulting in data being stored in high-cost storage. Which solution will lower costs without compromising the availability of objects? A. Use S3 ACLs. B. Use Amazon Elastic Block Store (Amazon EBS) automated snapshots. C. Use S3 Intelligent-Tiering storage. D. Use S3 One Zone-Infrequent Access (S3 One Zone-IA).

C. Use S3 Intelligent-Tiering storage. https://aws.amazon.com/about-aws/whats-new/2018/11/s3-intelligent-tiering/

QUESTION 109 A company plans to store sensitive user data on Amazon S3. Internal security compliance requirement mandate encryption of data before sending it to Amazon S3. What should a solutions architect recommend to satisfy these requirements? A. Server-side encryption with customer-provided encryption keys B. Client-side encryption with Amazon S3 managed encryption keys C. Server-side encryption with keys stored in AWS key Management Service (AWS KMS) D. Client-side encryption with a master key stored in AWS Key Management Service (AWS KMS)

D. Client-side encryption with a master key stored in AWS Key Management Service (AWS KMS) https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html

QUESTION 120 A company is running a highly sensitive application on Amazon EC2 backed by an Amazon RDS database. Compliance regulations mandate that all personally identifiable information (PII) be encrypted at rest. Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure? A. Deploy AWS Certificate Manager to generate certificates. Use the certificates to encrypt the database volume. B. Deploy AWS CloudHSM, generate encryption keys, and use the customer master key (CMK) to encrypt database volumes. C. Configure SSL encryption using AWS Key Management Service customer master keys (AWS KMS CMKs) to encrypt database volumes. D. Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes.

D. Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html

QUESTION 118 A company has two applications it wants to migrate to AWS. Both applications process a large set of files by accessing the same files at the same time. Both applications need to read the files with low latency. Which architecture should a solutions architect recommend for this situation? A. Configure two AWS Lambda functions to run the applications. Create an Amazon EC2 instance with an instance store volume to store the data. B. Configure two AWS Lambda functions to run the applications. Create an Amazon EC2 instance with an Amazon Elastic Block Store (Amazon EBS) volume to store the data. C. Configure one memory optimized Amazon EC2 instance to run both applications simultaneously. Create an Amazon Elastic Block Store (Amazon EBS) volume with Provisioned IOPS to store the data. D. Configure two Amazon EC2 instances to run both applications. Configure Amazon Elastic File System (Amazon EFS) with General Purpose performance mode and Bursting Throughput mode to store the data.

D. Configure two Amazon EC2 instances to run both applications. Configure Amazon Elastic File System (Amazon EFS) with General Purpose performance mode and Bursting Throughput mode to store the data. https://docs.aws.amazon.com/efs/latest/ug/performance.html

QUESTION 136 A solutions architect must create a highly available bastion host architecture. The solution needs to be resilient within a single AWS Region and should require only minimal effort to maintain. What should the solutions architect do to meet these requirements? A. Create a Network Load Balancer backed by an Auto Scaling group with a UDP listener. B. Create a Network Load Balancer backed by a Spot Fleet with instances in a partition placement group. C. Create a Network Load Balancer backed by the existing servers in different Availability Zones as the target. D. Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple Availability Zones as the target.

D. Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple Availability Zones as the target. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-increase-availability.html

QUESTION 115 A recent analysis of a company's IT expenses highlights the need to reduce backup costs. The company's chief information officer wants to simplify the on-premises backup infrastructure and reduce costs by eliminating the use of physical backup tapes. The company must preserve the existing investment in the onpremises backup applications and workflows. What should a solutions architect recommend? A. Set up AWS Storage Gateway to connect with the backup applications using the NFS interface. B. Set up an Amazon EFS file system that connects with the backup applications using the NFS interface. C. Set up an Amazon EFS file system that connects with the backup applications using the iSCSI interface. D. Set up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface.

D. Set up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface. https://docs.aws.amazon.com/storagegateway/latest/userguide/WhatIsStorageGateway.html

QUESTION 137 A three-tier web application processes orders from customers. The web tier consists of Amazon EC2 instances behind an Application Load Balancer, a middle tier of three EC2 instances decoupled from the web tier using Amazon SQS, and an Amazon DynamoDB backend. At peak times, customers who submit orders using the site have to wait much longer than normal to receive confirmations due to lengthy processing times. A solutions architect needs to reduce these processing times. Which action will be MOST effective in accomplishing this? A. Replace the SQS queue with Amazon Kinesis Data Firehose. B. Use Amazon ElastiCache for Redis in front of the DynamoDB backend tier. C. Add an Amazon CloudFront distribution to cache the responses for the web tier. D. Use Amazon EC2 Auto Scaling to scale out the middle tier instances based on the SQS queue depth.

D. Use Amazon EC2 Auto Scaling to scale out the middle tier instances based on the SQS queue depth. https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-basic-architecture.html

QUESTION 103 A company has a website running on Amazon EC2 instances across two Availability Zones. The company is expecting spikes in traffic on specific holidays, and wants to provide a consistent user experience. How can a solutions architect meet this requirement? A. Use step scaling. B. Use simple scaling. C. Use lifecycle hooks. D. Use scheduled scaling.

D. Use scheduled scaling. https://docs.aws.amazon.com/autoscaling/ec2/userguide/schedule_time.html