cloudfront

An application requires extremely high I/O performance for temporary data processing that can be lost if the instance fails. The architect is considering using EC2 Instance Store. Which TWO statements correctly describe the performance and characteristics of Instance Store volumes?

A developer needs to access an Amazon RDS database from an EC2 instance within a private subnet. The database must only accept traffic from the instance. Which security configuration is most appropriate?

A company is designing a high-throughput, fault-tolerant payment processing system running on Amazon EC2 instances across multiple Availability Zones. The architecture must withstand the sudden failure of any single AZ without dropping active database transactions or corrupting state. Which TWO design practices should the solutions architect implement?

Refer to the exhibit. An S3 bucket contains millions of small log files. The requirements state that data must be moved to a cheaper storage class after 30 days. The exhibit shows a lifecycle policy. Why might this configuration be sub-optimal for cost?

An application requires a high-throughput, low-latency shared file system for a Linux-based HPC cluster. Which AWS service should be used?

A high-traffic application uses an Application Load Balancer (ALB) and an Auto Scaling group (ASG). During peak hours, some EC2 instances fail, but the ASG does not replace them immediately because the instances are still in a 'running' state despite the application being unresponsive. How should the architect fix this?

Refer to the exhibit. A security administrator is reviewing a CloudTrail log entry for an 'Access Denied' error. The user 'Alice' is trying to upload a file to an S3 bucket. Alice has an IAM policy that allows 's3:PutObject' on all resources. What is the most likely cause of this error?

A company has several AWS accounts and wants to take advantage of Savings Plans to reduce their overall compute spend. They have a mix of EC2 instances, AWS Lambda, and AWS Fargate across multiple regions. Which Savings Plan type will provide the most flexibility and cover all these services?

Refer to the exhibit. An administrator runs a script to identify underutilized EC2 instances. The output shows a production instance that has been running for 30 days. Which action would most effectively reduce costs while maintaining application stability?

Refer to the exhibit. A company wants to optimize the performance and security of data transfers between their EC2 instances and an S3 bucket named 'my-app-data'. Which architectural benefit is primarily achieved by implementing the policy shown in the exhibit?

A company is experiencing unauthorized network traffic in their VPC. They need to inspect traffic patterns between subnets to identify the source of the traffic. Which tool should they use?

A web application runs on Amazon EC2 instances managed by an Auto Scaling group across three Availability Zones behind an Application Load Balancer. The application performs heavy computations that consume high CPU resources. Users report intermittent 504 Gateway Timeouts during peak hours. The solutions architect notices that newly launched instances take several minutes to bootstrap before they can serve traffic. How should the architect resolve this issue?

A security team needs to identify and protect sensitive data, such as credit card numbers and passport IDs, that may be stored across hundreds of S3 buckets in multiple AWS accounts. Which service should they use to automate this discovery process?

A solutions architect is reviewing the architecture of a large VPC. Currently, thousands of EC2 instances in private subnets transfer several terabytes of data daily to Amazon S3 through a NAT Gateway. The NAT Gateway costs have become prohibitively high. Which TWO changes will reduce these costs?

A video transcoding application runs on EC2 instances. The processing is highly CPU-intensive and can be interrupted if the job is resumed later. Which compute strategy offers the best cost-performance balance?

A company is building a zero-trust architecture for its internal microservices running on Amazon EKS. Which THREE steps should the solutions architect take to ensure secure, least-privilege communication between services? (Select THREE)

An organization wants to identify and eliminate waste in their AWS account. They are specifically looking for idle resources that are still incurring charges. Which THREE AWS tools or features can help identify these cost-optimization opportunities?

A company is migrating a web application to AWS. The application relies on session state. Which approach is the most scalable and performant for managing sessions?

A company is migrating a legacy application to AWS. The application requires a relational database with very infrequent and unpredictable usage—sometimes it is not used for days, and then it sees a burst of activity for an hour. Which database configuration is most cost-effective?

An application running on an Amazon EC2 instance needs to securely access data in an Amazon DynamoDB table. What is the most secure way to provide the application with the necessary permissions?

A financial services firm must store transaction logs in Amazon S3 for seven years to meet regulatory requirements. The logs must be protected against any modification or deletion by any user, including the root user, during this period. Which S3 feature should be implemented?

A financial application stores data in Amazon Aurora. The architecture must survive a regional outage. Which TWO steps should the architect take to meet this requirement?

A company is using Amazon EBS volumes for their EC2 instances. The current volumes are General Purpose SSD (gp2). The company wants to reduce costs without losing performance, and in some cases, they need more control over IOPS without increasing storage size. Which TWO steps should they take?

Refer to the exhibit. A junior cloud financial analyst needs to monitor and optimize costs across the organization's AWS account. The analyst requires the ability to view historical cost data and check how effectively Reserved Instances and Savings Plans are being used. Which AWS service is the analyst most likely using with this IAM policy?

A company hosts a monolithic application on EC2. They want to move to a microservices architecture to improve fault isolation. Which approach is best?

A company is designing a global application. They need to replicate 1 TB of data monthly between two AWS Regions. What is the most cost-effective way to minimize data transfer costs?

A company is running an Amazon RDS for MySQL database that experiences predictable, steady traffic during business hours and very low traffic at night. They want to reduce costs without compromising performance. Which TWO steps should the architect take? (Select TWO.)

Refer to the exhibit. A security audit identifies that data is being transmitted to an S3 bucket named 'corporate-data' without encryption in transit. Which behavior does this bucket policy enforce to address this concern?

An architect is designing a system that must be resilient against AWS regional failure. Which AWS service is best suited to manage global DNS traffic and provide health-based routing?

A company needs a Disaster Recovery (DR) strategy with an RTO of 30 minutes and an RPO of 15 minutes. They want to minimize costs while having a scaled-down version of their core environment always running in a second region. Which DR strategy should they use?

An application uses Amazon DynamoDB. To ensure the application remains resilient to regional outages, what is the best approach?

Refer to the exhibit. An application needs to store highly durable data in S3. The architect wants to ensure data is protected against accidental deletion while maintaining cost-effective storage. What should be done?

A solutions architect is designing an application that stores user-uploaded images in Amazon S3. The images are accessed frequently for the first 30 days, then rarely accessed thereafter. Which storage class transition strategy is the most cost-effective?

An organization needs to issue and manage SSL/TLS certificates for its internal microservices, which are not accessible from the public internet. They want to avoid the overhead of managing their own PKI infrastructure. Which service should they use?

A company needs to store database credentials for an application running on Amazon ECS. The credentials must be encrypted and automatically rotated every 30 days without requiring an application restart. Which TWO AWS services should be used together to achieve this? (Select TWO)

A global e-commerce enterprise runs its checkout workflow using AWS Lambda functions integrated with Amazon API Gateway. During flash sales, traffic spikes cause downstream payment APIs to timeout, leading to lost transactions and frustrated customers. The solutions architect needs to redesign the architecture to decouple the frontend from the payment processor and ensure no transaction requests are lost. What should the architect do?

A web application hosted on EC2 instances needs to access a DynamoDB table. What is the most secure way to provide the application with the necessary permissions?

A financial services company needs to store millions of small records for 7 years to meet regulatory requirements. The records are rarely accessed after the first 30 days. The company wants to minimize storage costs while maintaining the ability to retrieve any record within a few minutes if an audit occurs. Which solution is best?

A company is building a mobile application that needs to authenticate users and allow them to upload photos directly to an Amazon S3 bucket. Which TWO Amazon Cognito components should be used to provide a secure and scalable solution?

A company is designing a mission-critical database architecture using Amazon RDS. Which TWO steps should the architect take to ensure high availability and data durability? (Select TWO.)

An enterprise requires all data stored in Amazon S3 to be encrypted at rest. The security team must maintain full control over the encryption keys, including the ability to rotate them annually and define access policies for the keys themselves. Which encryption method meets these requirements with the least operational overhead?

A company is running a development environment on Amazon RDS for MySQL. The environment is only used by developers during business hours (09:00 to 17:00, Monday through Friday). The company wants to minimize costs for these database instances. Which TWO actions should the company take?

Refer to the exhibit. The current IAM policy allows an EC2 instance to read backups. The architect wants to ensure the data is recoverable if the source bucket is compromised by an external actor with write access. What should be done?

A legacy application uses a monolithic architecture with a high-performance compute requirement. The application is CPU-bound and requires consistent sub-millisecond latency between compute nodes. Which EC2 feature should the architect use?

A company is hosting a sensitive web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The compliance team requires that all data at rest must be encrypted using keys that are rotated annually, and all access to these keys must be logged for auditing purposes. Which solution meets these requirements with the least administrative effort?

A solutions architect is tasked with reducing the cost of Amazon EBS volumes across a large AWS environment. Which THREE strategies will lead to lower EBS costs? (Select THREE.)

An application uses a monolithic architecture on EC2 instances. The company wants to improve resilience against regional failures. Which TWO actions should the architect take to achieve this? (Select TWO.)

A company is using Amazon DynamoDB to store real-time session data. The application requires response times in the sub-millisecond range for frequently accessed keys. The current DynamoDB latency is around 10-15 milliseconds. What should the architect implement to meet the performance goal?

A security auditor requires that all EC2 instances must be running with specific software versions and that any instance not compliant with these versions must be automatically terminated. Which THREE services should be used to achieve this? (Select THREE.)

An application is deployed across two AWS Regions to ensure resilience. The architect needs to direct users to the healthy region with the lowest latency. If the primary region fails, traffic should fail over automatically. Which Route 53 routing policy should be implemented?

A company's web application requires a highly available database layer to survive an Availability Zone failure without manual intervention. The database must remain accessible during maintenance windows and ensure zero data loss. Which solution meets these requirements with the least operational overhead?

A large enterprise uses AWS Organizations to manage multiple accounts. The Chief Information Security Officer (CISO) wants to ensure that no account within the organization can create any resources in regions other than 'us-east-1' and 'us-west-2'. What is the most efficient way to enforce this across the entire organization?

A media company experiences unpredictable traffic spikes on its web application. The architect needs to ensure the application remains responsive while optimizing for performance. Which TWO strategies should be implemented? (Select TWO.)

Refer to the exhibit. This bucket policy grants access to a specific account. A user in that account still cannot access the object. What is the most likely reason?

A company runs a mission-critical web application on EC2. The database is on RDS. How should the architect ensure the fastest possible recovery time objective (RTO) if the primary database instance fails?

A globally distributed application needs to provide low-latency access to static content for users around the world. Which AWS service is best suited for this requirement?

An application consists of a web tier and an application tier. The web tier must be accessible from the internet, but the application tier must remain private. How should the architect configure the network for maximum resilience?

A company is using AWS Direct Connect to connect their on-premises data center to AWS. What is the most resilient way to connect?

Refer to the exhibit. An administrator has applied the provided bucket policy to 'my-secure-bucket'. What is the effect of this policy on access to the bucket?

A company is migrating a web application to AWS and needs to ensure that all data stored in Amazon S3 is encrypted at rest using keys managed by the company. The company must be able to rotate these keys annually and maintain full control over key access policies. Which solution meets these requirements?

An enterprise organization is planning a centralized logging architecture across hundreds of AWS accounts using AWS CloudTrail and Amazon S3. Security mandates state that all log files delivered to the centralized S3 bucket must be cryptographically verified to ensure they have not been modified or tampered with after delivery. Which TWO actions must a Solutions Architect implement to achieve this mandate? (Choose two.)

A company is running a large-scale batch processing job that can be interrupted and resumed without loss of data. The job runs for several hours every weekend. Which instance purchasing option will provide the highest cost savings?

A company is migrating a high-traffic web application to AWS. The application uses an Amazon RDS for MySQL database. The database experience high read pressure during business hours, but write activity remains consistent and low. Which TWO architectural changes will reduce costs while maintaining performance? (Select TWO.)

A mission-critical application requires a recovery time objective (RTO) of near-zero. Which disaster recovery strategy should the architect implement?

A company has a stable, predictable workload consisting of several Amazon EC2 instances, AWS Lambda functions, and AWS Fargate containers that run 24/7. The company wants to minimize compute costs over a three-year period with minimal administrative effort. Which AWS pricing model should the company choose?

A solutions architect is designing a system for batch processing of large image files. The process can be interrupted and resumed later without loss of data. The workload is expected to run for several hours each night. Which EC2 instance purchasing option will provide the lowest cost?

A company wants to implement a service that continuously monitors for malicious activity and unauthorized behavior across its AWS accounts, such as cryptocurrency mining or unusual API calls. Which AWS service should they use?

A data analytics company uses Amazon Redshift for complex queries. The workload is mostly consistent but experiences heavy spikes during the last three days of every month. What is the most cost-effective way to handle these spikes?

A research institution is running a High Performance Computing (HPC) workload on AWS that requires a POSIX-compliant file system capable of millions of IOPS and sub-millisecond latencies. Which TWO storage options are most appropriate for this use case?

Refer to the exhibit. An application running on an EC2 instance requires access to S3 objects but is encountering slow performance when fetching large files. An architect observes high network latency between the instance and S3. Which strategy will improve retrieval performance?

An application has an unpredictable workload where it receives bursts of traffic for 5 minutes every few hours, followed by periods of complete inactivity. The application is currently running on a small EC2 instance. Which migration strategy would minimize costs for this specific workload?

A solutions architect is designing a storage solution for a financial firm. The firm requires that data stored in Amazon S3 must be protected against accidental deletion and all changes to the data must be versioned. Which TWO features should the architect implement to meet these requirements? (Select TWO)

A company is designing a multi-tier application. The web tier is public, and the database tier is private. Which TWO actions should the architect take to ensure the database tier is secure? (Select TWO.)

A media streaming company stores high-value video assets in an Amazon S3 bucket. The company requires a resilient storage architecture that protects against accidental deletion, malicious overwrites, and zonal or regional outages. Which combinations of features should a Solutions Architect implement to achieve these requirements? (Choose TWO.)

An architect is designing a secure storage solution for highly sensitive financial data in S3. Which THREE security controls should be implemented? (Select THREE.)

A web application stores static files in Amazon S3. Due to regulatory requirements, the company must ensure that the files are replicated to a secondary region. What is the most efficient way to achieve this?

An application is experiencing intermittent performance issues due to high IOPS demand. The application currently uses a standard General Purpose SSD (gp2) volume. Which action will provide the best performance improvement?

Refer to the exhibit. An application running on EC2 is receiving signature errors when accessing S3. The application uses an IAM role. What should the architect investigate first?

Refer to the exhibit. An architect is reviewing a CloudFront Cache Policy for a dynamic site. The application is experiencing a low cache hit ratio, leading to high load on the origin servers. Based on the configuration, which change would most likely improve the cache hit ratio?

An AWS Lambda function processing data from an S3 bucket is experiencing performance issues due to 'cold starts' during sudden bursts of traffic. The company needs to ensure that the function responds with consistent low latency at all times. Which feature should be configured?

A security team is concerned about accidental or malicious deletion of critical objects in an Amazon S3 bucket. Which TWO features should be enabled to prevent permanent data loss and require additional authentication for deletions?

A company is using AWS Secrets Manager to manage database credentials. The company needs to automatically rotate these credentials every 30 days. How can this be accomplished?

A company hosts a batch processing application on Amazon EC2 instances that process large datasets during business hours. The jobs are interruptible and can resume from the last checkpoint if terminated. Which strategy provides the most cost-effective solution?

An organization wants to protect their web application from common web exploits like SQL injection and cross-site scripting (XSS). Which AWS service should they use?

A data analysis team needs to perform complex SQL queries on petabytes of data stored in S3. Which service provides the best performance for this analytical workload?

A company is launching a new application with a DynamoDB backend. They expect the traffic to be highly unpredictable, with sudden spikes and long periods of inactivity. Which capacity mode is the most cost-effective?

A company has a legacy application that requires a persistent file system shared across multiple EC2 instances. The file system must be highly available and support standard file system protocols. Which solution is most appropriate?

Refer to the exhibit. An application running on EC2 instances needs to pull large binary files from an S3 bucket with maximum throughput. Which configuration should the architect implement to ensure the highest network performance?

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in the local memory of the EC2 instances. Users report losing their sessions when the Auto Scaling group scales in or replaces unhealthy instances. Which solution ensures session persistence while maintaining high availability?

An enterprise financial application stores critical transaction records in Amazon Aurora MySQL. The company requires a cross-Region disaster recovery strategy with a Recovery Point Objective of less than 1 minute and a Recovery Time Objective of less than 5 minutes. Which architecture achieves this?

A company wants to improve the performance of its static website hosted on S3. Which strategy provides the most significant performance gain for global users?

An application processes large batches of data from an S3 bucket. The process can take hours. If an instance fails, the batch is lost. Which design pattern ensures the most resilient batch processing?

Refer to the exhibit. A solutions architect reviewed an AWS CloudFormation template used to deploy an Auto Scaling group for a production web application. During an AWS Availability Zone outage in us-east-1, users experienced partial application downtime even though the Auto Scaling group reported instances running. Why is this architecture failing resiliency best practices?

A company has a data lake on Amazon S3 where files are uploaded frequently. The access patterns for these files are unpredictable; some are accessed multiple times a day for a week, while others are never accessed again. The company needs to reduce storage costs without manual intervention or performance impact. Which storage strategy is most cost-effective?

A company must share an S3 bucket with a third-party vendor. The vendor has their own AWS account. What is the most secure method to grant the vendor access to the S3 bucket?

Refer to the exhibit. An IAM policy is applied to an IAM user to grant access to an S3 bucket. However, the user is still receiving an 'Access Denied' error when attempting to list the objects in the bucket. What is the cause of this error?

A company is planning to connect its on-premises data center to AWS to support a high-performance hybrid cloud architecture. The connection must support a consistent 10 Gbps bandwidth and provide a private, dedicated network path to reduce jitter and latency. Which TWO steps should the architect take?

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB). The application requires high availability across two Availability Zones (AZs). Which architectural design ensures the most resilient traffic distribution?

A company is launching a high-profile marketing campaign and expects a significant increase in traffic. They are concerned about potential Distributed Denial of Service (DDoS) attacks targeting their Application Load Balancer. Which AWS service provides advanced protection and includes 24/7 access to the AWS Shield Response Team (SRT)?

A developer is using an EC2 instance to process images. The images are stored in an S3 bucket. The developer notices that the network transfer between S3 and the EC2 instance is the bottleneck. How can the developer resolve this?

Refer to the exhibit. The web application is showing high latency and 503 errors. The database CPU usage is low. What is the most likely cause and solution?

A company wants to ensure that no developer can create an Amazon S3 bucket in any AWS region except for us-east-1 and us-west-2 across their entire AWS Organization. Which solution provides the most efficient and centralized way to enforce this across all member accounts?

A company is concerned about unauthorized access and potential data exfiltration within their AWS environment. They need a service that can continuously monitor VPC Flow Logs, AWS CloudTrail management events, and DNS logs to identify suspicious activities using machine learning. Which solution should the architect recommend for centralized threat detection?

An organization is using AWS Control Tower to manage multiple AWS accounts. They need to implement a set of guardrails to ensure that all accounts remain compliant with security best practices. Which THREE components or features are part of a standard AWS Control Tower landing zone implementation?

An application has been migrated to AWS, but the performance is inconsistent. The architect finds that the application uses a legacy database driver that requires persistent connections, which is exhausting database connections. What is the best way to handle this?

A security architect is designing a multi-tier application in a VPC. The requirement is to block all traffic from a specific range of malicious IP addresses (CIDR 192.0.2.0/24) while allowing standard web traffic (HTTPS) from all other sources to the web tier. Which TWO actions should the architect take to implement this? (Select TWO.)

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB). The application has spikes in traffic. What should be configured to ensure performance and cost efficiency?

A company wants to improve the security of its Amazon RDS for PostgreSQL database. They want to eliminate the need for storing database passwords in application code and simplify the management of database access for their EC2-based applications. Which solution should they implement?

A company's security team identifies that its public-facing web application is being targeted by SQL injection and cross-site scripting (XSS) attacks. The application is running on EC2 instances behind an Application Load Balancer (ALB). Which service should the solutions architect implement to protect the application from these specific web-based attacks?

A company wants to ensure that its internal applications can access Amazon S3 without the traffic ever leaving the AWS network or passing through the public internet. What should they implement to achieve this securely?

A company is migrating a high-performance database to Amazon RDS for MySQL. The workload involves intensive read operations, causing significant latency during peak traffic. Which solution provides the most effective performance improvement with minimal architectural changes?

A company has a high-performance database running on Amazon RDS for MySQL. The workload is read-heavy and experiences latency during peak hours. Which solution will improve read performance with minimal architectural changes?

An organization needs to perform continuous security assessments of its Amazon EC2 instances to identify software vulnerabilities and unintended network exposure. Which service should they use to automate these assessments and provide a centralized view of the findings?

A global e-commerce site uses an Amazon RDS for MySQL database. Users in different regions are complaining about slow page load times when browsing product catalogs. How can the architect improve read performance for global users with minimal changes to the application?

A company is developing a mobile application that allows users to sign in using their social media accounts (e.g., Google or Facebook). After signing in, the application needs to obtain temporary AWS credentials to upload photos directly to an Amazon S3 bucket. Which service should the architect use?

An application processes data in bursts, running for 30 seconds every few minutes. The workload is unpredictable. Which compute service offers the most cost-effective solution?

A media streaming company stores millions of video assets in an Amazon S3 bucket. Compliance regulations mandate that objects must be protected against accidental deletion, malicious tampering, and region-wide disasters. The solution must prevent permanent deletion even by users with root credentials during a retention period. Which combination of features meets these requirements?

An organization needs to improve the resilience of its EC2-based application. Which THREE actions should the architect perform? (Select THREE.)

A company has several VPCs in a single region that need to access an S3 bucket for data processing. Currently, traffic goes through a NAT Gateway in each VPC. What is the most cost-effective way to provide access to S3?

A research firm is running a tightly coupled High Performance Computing (HPC) workload on AWS using EC2 instances. The firm needs to minimize network latency and maximize inter-node communication speed. Which network enhancement should the architect recommend?

A company is hosting a web application on EC2 instances behind an Application Load Balancer. The security team requires that all data in transit between the client and the ALB be encrypted using TLS. Which service should the architect use to manage the SSL/TLS certificates for the ALB?

Refer to the exhibit. A company has applied the following bucket policy to an S3 bucket named 'finance-reports'. A user is attempting to download a file from this bucket from the IP address 203.0.113.15 using an authenticated session without MFA. What will be the result of this request?

A company is hosting a multi-tier web application on AWS using Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). The security team requires that all incoming web traffic is encrypted in transit from the client to the ALB and from the ALB to the backend EC2 instances. Which combination of configurations meets these requirements?

A company has several VPCs in the same region that need to access an Amazon S3 bucket for data logging. Currently, data is transferred over the public internet, incurring data transfer charges. What is the most cost-effective way to allow the VPCs to access S3?

An application running on Amazon Aurora MySQL experiences significant performance degradation during peak hours due to a surge in read-only traffic. The database currently uses a single primary instance and one replica. What is the most effective way to scale the database for these spikes while maintaining high performance?

A global gaming company wants to reduce latency for its players who are distributed worldwide. The application uses UDP-based traffic and requires a static entry point to simplify firewall management. Which service should the architect recommend to optimize the network path?

A security engineer needs to block a specific range of malicious IP addresses from accessing an entire subnet within a VPC. The solution must ensure that the traffic is rejected before it reaches any EC2 instances. Which AWS feature should be used to implement this restriction?

A database administrator needs to ensure that an Amazon RDS for MySQL instance can withstand an Availability Zone failure and provide low-latency reads for a reporting application. Which TWO steps should be taken?

A company is concerned that its database credentials, currently stored as environment variables in AWS Lambda, are not being rotated regularly. Which AWS service should the company use to securely store and automatically rotate these credentials?

A large corporation uses AWS Organizations to manage hundreds of accounts. The security team wants to ensure that no account can provision resources in unauthorized regions and that only approved AWS services can be used. Which TWO features should be used to enforce these constraints across the entire organization? (Select TWO.)

A solutions architect is designing a mission-critical web application running on Amazon EC2 instances behind an Application Load Balancer. The application must remain highly available even during an Availability Zone outage. Which deployment strategy meets this requirement with optimal resilience?

A financial services company is hosting a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application must remain available even if an entire AWS Region experiences a major outage. The database tier uses Amazon Aurora Global Databases. Which solution provides the most resilient multi-Region architecture with automated failover?

A web application is deployed on Amazon EC2 instances within a private subnet. The application must receive traffic from an Application Load Balancer (ALB) in a public subnet and connect to an Amazon RDS MySQL database in a different private subnet. Which TWO steps are required to secure this architecture using security groups?

A developer needs to access an S3 bucket from an EC2 instance. For security best practices, the developer must avoid hardcoding long-term credentials on the instance. What is the most secure method to provide the necessary permissions?

A solutions architect is designing a caching layer for a high-traffic web application that uses a multi-node cluster. The architect needs to ensure high availability and the ability to scale horizontally while supporting complex data types such as sorted sets and lists. Which TWO features of Amazon ElastiCache for Redis support these requirements?

A company is migrating a compute-intensive web application to AWS. The application requires high CPU performance and needs to scale automatically based on demand. Which EC2 instance family and scaling feature should the architect choose to ensure optimal performance?

Refer to the exhibit. A solutions architect reviews the following IAM policy applied to a user. What is the effect of this policy when the user attempts to access an object in the bucket from an IP address of 198.51.100.5?

A company's public-facing application is experiencing a Distributed Denial of Service (DDoS) attack. The application is hosted on EC2 instances behind an Application Load Balancer (ALB). Which TWO AWS services or features can be used to mitigate this attack and protect the application?

Refer to the exhibit. A company is using this S3 bucket policy to secure high-performance data accessed by an analytics fleet on EC2. Users report that despite having the correct IAM permissions, they are receiving 403 Forbidden errors when trying to download data. What is the most likely cause of this performance and access issue?

An architect is designing a secure VPC architecture. Which TWO actions should be taken to ensure the infrastructure is compliant with security best practices regarding network isolation?

A healthcare company must store patient records in Amazon S3 for a minimum of 7 years to meet regulatory requirements. During this period, the records must not be deleted or modified by any user, including the root user. Which S3 feature should be used to enforce this?

A data analytics company stores massive amounts of data in Amazon S3. They need a way to automatically identify and flag sensitive data, such as Personally Identifiable Information (PII) or financial records, to ensure it is not being mishandled. Which AWS service is designed for this task?

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application stores session state in local memory, causing users to be logged out whenever the load balancer routes requests to different instances. Which solution provides the most resilient, scalable architecture to resolve this?

A solutions architect is designing a batch processing workload that runs for 4 hours every night. The workload can be interrupted and resumed without data loss. Cost optimization is a primary requirement for this deployment.

A startup is launching a new application with a microservices architecture. One specific service is an API that is only called a few dozen times per day. The execution time is always under 10 seconds. Which compute service would be the most cost-effective for this microservice?

A global gaming company needs to provide low-latency access to user profile data for players in North America, Europe, and Asia. The data is stored in an Amazon Aurora MySQL database. The application requires that reads be as local as possible, while writes are infrequent and can tolerate some propagation delay. Which solution offers the best performance?

A media company stores millions of small image files in an Amazon S3 bucket. The application frequently requests these images, and the company is experiencing high latency during peak hours. The current architecture uses a single prefix for all objects. How should the architect modify the S3 structure to improve performance?

A solutions architect is designing a mission-critical web application that runs on Amazon EC2 instances behind an Application Load Balancer. The application must remain available even if an entire AWS Region experiences a catastrophic failure. The RPO must be near zero, and the RTO must be less than 15 minutes. Which disaster recovery strategy should the architect implement?

A company has a multi-region application and wants to provide users with a single entry point that automatically routes traffic to the closest healthy endpoint. The solution must support non-HTTP protocols and provide static IP addresses. Which service should be used?