Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 751825

1660 questions total · 23pages · All types, answers revealed

Page 10

Page 11 of 23

Page 12
751
MCQhard

A company runs a critical e-commerce platform on AWS. The application is deployed across multiple Availability Zones in a single region (us-east-1). The architecture includes an Application Load Balancer (ALB), an EC2 Auto Scaling group, and an Amazon RDS for MySQL Multi-AZ database. The application experiences periodic spikes in traffic, and the Auto Scaling group scales out successfully. However, during a recent traffic spike, the database CPU utilization reached 90%, causing increased latency and some database connection timeouts. The company needs to improve the database performance to handle the spikes without over-provisioning. The solutions architect must design a solution that reduces the load on the primary database instance and improves read scalability. The application is read-heavy, with a read-to-write ratio of 80:20. Which solution should the architect implement?

A.Implement an Amazon ElastiCache Redis cluster to cache frequent database queries.
B.Increase the DB instance class to a larger size and enable Multi-AZ with synchronous replication.
C.Migrate the database to Amazon DynamoDB and use DynamoDB Accelerator (DAX) for read performance.
D.Create one or more Amazon RDS Read Replicas in the same region and configure the application to route read queries to the read replica endpoint.
AnswerD

Read replicas offload read traffic from the primary, improving performance for read-heavy workloads.

Why this answer

Amazon RDS Read Replicas can offload read traffic from the primary instance, reducing CPU utilization. For a read-heavy workload (80:20), creating Read Replicas in the same region and routing read queries to them is the most effective solution to improve read scalability without over-provisioning the primary. Option D is correct.

Option A (ElastiCache) is more suited for caching but does not offload database reads directly; it requires significant application changes and may not handle all query patterns. Option B (scaling up instance class) has scaling limits and is less cost-effective; Multi-AZ is for high availability, not read scaling. Option C (DynamoDB) is a different database; migrating would be complex and unnecessary.

752
MCQhard

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to use AWS Transit Gateway to connect VPCs across accounts. The network team has created a Transit Gateway in the network account and shared it using AWS Resource Access Manager (RAM) with the workload accounts. The workload accounts have created VPC attachments to the Transit Gateway. However, traffic is not flowing between the VPCs. The route tables in the workload VPCs have routes pointing to the Transit Gateway. What is the most likely cause?

A.The Transit Gateway is in a different AWS account, so route propagation is not automatic.
B.The Transit Gateway route tables do not have routes for the attached VPCs.
C.The security groups in the workload VPCs are blocking traffic.
D.VPC flow logs are not enabled.
AnswerB

Transit Gateway route tables need routes to forward traffic.

Why this answer

The most likely cause is that the Transit Gateway route tables do not have routes for the attached VPCs. Even though the Transit Gateway is shared and VPC attachments are created, the Transit Gateway route tables must contain routes pointing to the attached VPCs for traffic to flow. By default, VPC attachments are not automatically propagated to the Transit Gateway route table.

Option A is incorrect because route propagation is automatic when attachments are created, but only if the route table is configured for propagation. Option C is incorrect because security groups are stateful and allow return traffic; they would not block traffic between VPCs if the correct rules are in place. Option D is incorrect because VPC flow logs are a monitoring tool and do not affect traffic flow.

753
Multi-Selectmedium

Which TWO of the following are best practices for migrating a large-scale relational database to Amazon Aurora using AWS DMS? (Choose two.)

Select 2 answers
A.Use multiple parallel DMS tasks to improve throughput
B.Disable foreign key constraints on the target database during migration to speed up the load
C.Use the largest DMS replication instance to maximize performance
D.Enable validation on the DMS task to ensure data consistency after migration
E.Migrate while the source database is fully active without any downtime
AnswersA, D

Parallel tasks increase performance.

Why this answer

Using parallel tasks improves throughput. Validating data after migration ensures consistency. Disabling foreign keys may cause data integrity issues.

Using largest instance type may not be cost-effective. Using CDC reduces downtime.

754
MCQhard

A company runs a data processing pipeline on AWS using AWS Glue and Amazon Redshift. Recently, the pipeline has been failing due to insufficient memory in the Glue job. The team wants to improve the pipeline to handle larger datasets without manual intervention. Which solution is MOST cost-effective?

A.Enable job bookmarking and configure incremental processing to reduce data volume per run.
B.Use a larger node type for the Amazon Redshift cluster to offload processing.
C.Replace AWS Glue with Amazon EMR and use spot instances for cost savings.
D.Partition the input data in Amazon S3 into more files with smaller sizes.
E.Increase the number of DPUs (Data Processing Units) for the Glue job.
AnswerA

Reduces the amount of data processed each time, preventing memory exhaustion.

Why this answer

The most cost-effective solution is to enable job bookmarking and configure incremental processing. This reduces the data volume processed per run, thereby preventing memory issues without increasing costs. Increasing DPUs (Option E) would linearly increase cost.

Changing Redshift node type (Option B) does not address Glue memory. Replacing Glue with EMR (Option C) adds complexity and may not be more cost-effective. Partitioning input data into more files (Option D) does not directly solve memory issues and can actually increase overhead.

755
Multi-Selecthard

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application data is stored on Amazon EBS volumes. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. Which TWO actions should the company take to meet these objectives? (Choose two.)

Select 2 answers
A.Use Amazon EBS Multi-Attach to attach volumes to instances in another region.
B.Use AWS Backup to create a backup plan with a daily backup.
C.Use AWS CloudFormation to recreate the EC2 instances from a template.
D.Configure Amazon EBS snapshots to be taken every 15 minutes.
E.Copy EBS snapshots to another AWS Region and automate restoring them into EBS volumes.
AnswersD, E

Meets the 15-minute RPO.

Why this answer

Taking Amazon EBS snapshots every 15 minutes ensures that the RPO of 15 minutes is met, as the maximum data loss is limited to the interval between snapshots. Option E is correct because copying EBS snapshots to another AWS Region and automating their restoration into EBS volumes enables cross-region recovery, which is necessary since the application runs in a single Region and the RTO of 2 hours allows time for the restore process.

Exam trap

The trap here is that candidates often confuse RPO with RTO and incorrectly assume that daily backups (Option B) or instance recreation (Option C) are sufficient, failing to recognize that the 15-minute RPO requires frequent snapshot intervals and cross-region replication for true disaster recovery.

756
MCQeasy

A company wants to centralize management of AWS resources across multiple accounts using AWS Control Tower. What is a prerequisite for setting up Control Tower?

A.A pre-configured landing zone.
B.An AWS Organizations management account.
C.At least three organizational units (OUs).
D.Existing AWS Config rules in all accounts.
AnswerB

Control Tower is built on Organizations.

Why this answer

AWS Control Tower requires an AWS Organizations management account because Control Tower uses Organizations to create and manage accounts, apply service control policies (SCPs), and enforce guardrails across the organization. The management account serves as the central point for all administrative actions, and without it, Control Tower cannot establish the necessary multi-account structure or landing zone.

Exam trap

The trap here is that candidates often confuse the prerequisite of an existing AWS Organizations management account with the need for a pre-configured landing zone, mistakenly thinking Control Tower requires an already-built environment rather than building it itself.

How to eliminate wrong answers

Option A is wrong because a pre-configured landing zone is not a prerequisite; Control Tower itself sets up the landing zone as part of its initial configuration. Option C is wrong because Control Tower does not require at least three organizational units (OUs); it creates a default OU structure (e.g., Security, Sandbox) but the minimum is one OU, and you can add more later. Option D is wrong because existing AWS Config rules in all accounts are not a prerequisite; Control Tower deploys and manages Config rules as part of its guardrails, and pre-existing rules could conflict with Control Tower's managed rules.

757
MCQhard

A company uses Amazon RDS for PostgreSQL with Multi-AZ and automated backups set to 35 days. The database experiences a sudden spike in write IOPS, causing performance degradation. The team needs to investigate the cause without affecting production. What should they do?

A.Use the enhanced monitoring feature to collect OS-level metrics on the production instance.
B.Review Amazon CloudWatch metrics for the production DB instance to identify the cause.
C.Enable Performance Insights on the production instance to analyze queries.
D.Create a read replica from the latest automated snapshot and enable Performance Insights on the replica.
AnswerD

This provides a copy for analysis without impacting production.

Why this answer

Creating a read replica from the latest automated snapshot provides a near-current copy of the database without impacting the production instance. This allows the team to enable Performance Insights on the replica to analyze query performance and investigate the write IOPS spike safely. Option A is wrong because enhanced monitoring provides OS-level metrics but not query-level details needed for this investigation.

Option B is wrong because CloudWatch metrics show overall performance but not individual queries. Option C is wrong because enabling Performance Insights on the production instance could add overhead and impact performance.

758
MCQhard

A company is migrating a large-scale batch processing workload to AWS. The workload runs on a schedule and processes terabytes of data. The migration must be cost-effective. Which AWS service is best suited for this workload?

A.Amazon EMR
B.AWS Lambda
C.AWS Batch
D.Amazon EC2 with Auto Scaling
AnswerC

AWS Batch is a fully managed batch computing service that dynamically provisions compute resources.

Why this answer

AWS Batch is designed for batch computing and can automatically provision the optimal quantity and type of compute resources. Option A is wrong because Amazon EMR is optimized for big data frameworks like Spark, not general batch processing. Option B is wrong because AWS Lambda has a 15-minute timeout and limited memory, making it unsuitable for large-scale batch processing.

Option D is wrong because Amazon EC2 with Auto Scaling requires more manual management of instances compared to AWS Batch.

759
MCQmedium

A company is using Amazon RDS for MySQL and notices that read replicas are falling behind the primary. The primary instance is experiencing high write traffic. What is the best solution to reduce replica lag?

A.Increase the instance class of the read replica.
B.Enable Multi-AZ on the primary instance.
C.Disable binary logging on the primary.
D.Move the read replica to the same AWS Region as the primary.
AnswerA

Larger instance class can apply changes faster.

Why this answer

Increasing the instance class of the read replica provides it with more CPU and memory resources to apply write-ahead logs from the primary, directly addressing the replica lag caused by high write traffic. Enabling Multi-AZ on the primary (Option B) only ensures high availability and does not reduce replica lag. Disabling binary logging (Option C) would prevent replication entirely.

Read replicas can be in the same region (Option D) and that does not solve lag due to resource constraints.

760
MCQeasy

A solutions architect runs the command shown in the exhibit. Which statement is true about the output?

A.There are two instances with the Environment=production tag.
B.The command displays the instance ID, instance type, and launch time of three running instances.
C.One of the instances is stopped.
D.The command lists all instances in the account regardless of tags.
AnswerB

The output shows three instances with those attributes.

Why this answer

The command `aws ec2 describe-instances --query 'Reservations[].Instances[?State.Name==`running`].[InstanceId,InstanceType,LaunchTime]' --output table` filters for running instances and projects only the InstanceId, InstanceType, and LaunchTime fields. The output shows three rows, each representing a running instance with those three attributes. Therefore, option B is correct because it accurately describes the displayed data.

Exam trap

The trap here is that candidates may assume the output includes all instances or tag information, but the JMESPath query explicitly filters for running instances and projects only the specified fields, so any inference about tags or stopped instances is unsupported by the output.

How to eliminate wrong answers

Option A is wrong because the command does not filter or display tags; it only queries instances with State.Name==`running` and projects InstanceId, InstanceType, and LaunchTime, so there is no way to determine the Environment tag from this output. Option C is wrong because the command explicitly filters for instances where State.Name equals `running`, so a stopped instance would not appear in the output. Option D is wrong because the command uses a JMESPath query to filter for running instances only, not all instances in the account regardless of tags.

761
Multi-Selectmedium

A company is using Amazon CloudFront to distribute content globally. They want to optimize cost and performance. Which TWO actions are recommended?

Select 2 answers
A.Enable Regional Edge Caches to reduce load on the origin.
B.Disable compression to reduce CPU usage on the origin.
C.Use a single origin server to simplify configuration.
D.Use multiple CloudFront distributions for the same content.
E.Select the appropriate Price Class to limit the number of edge locations used.
AnswersA, E

Regional Edge Caches improve performance and reduce origin load.

Why this answer

Using Regional Edge Caches reduces origin load and latency. Price Class selection reduces cost by limiting edge locations.

762
MCQhard

A company is migrating a critical application from on-premises to AWS. The application uses a Microsoft SQL Server database with Always On Availability Groups for high availability. The company wants to use Amazon RDS for SQL Server to reduce management overhead. The database size is 500 GB. The migration must have minimal downtime and support transactional consistency. The company has a VPN connection to AWS. Which migration strategy should the company use?

A.Use AWS DMS with a full-load migration and ongoing replication from the on-premises SQL Server to RDS for SQL Server.
B.Take a full backup of the database, restore it to RDS, and then schedule a final backup and restore after cutting over.
C.Use the SQL Server Import/Export Wizard to copy data from on-premises to RDS over the VPN.
D.Use AWS SCT to convert the database schema and then use AWS DMS for data migration.
AnswerA

DMS supports full load and CDC for minimal downtime.

Why this answer

AWS DMS supports ongoing replication from SQL Server to RDS for SQL Server using native CDC capabilities, enabling minimal downtime. Option B is wrong because native backup/restore requires downtime and does not support ongoing replication. Option C is wrong because exporting data with SQL Server Import/Export Wizard requires downtime and does not support ongoing sync.

Option D is wrong because SCT is for schema conversion, not data migration; also, the question states the database is SQL Server to RDS for SQL Server, so schema conversion is not needed.

763
MCQmedium

A company is using Amazon CloudFront with an S3 origin. They notice that users are receiving outdated content. What configuration change should be made to ensure users always get the latest content?

A.Use signed URLs to serve content.
B.Create an invalidation for the objects.
C.Enable compression on the S3 bucket.
D.Reduce the TTL to 0 in the CloudFront distribution.
AnswerB

Invalidation removes cached objects, forcing fresh fetch.

Why this answer

Creating an invalidation removes cached objects from CloudFront edge locations, forcing them to be refreshed from the origin. Option A is incorrect because signed URLs control access, not cache freshness. Option C is incorrect because compression does not affect whether cached or fresh content is served.

Option D is incorrect because reducing TTL to 0 would cause every request to go to the origin, increasing load and latency; invalidations are more efficient.

Exam trap

Choosing to reduce TTL to 0 may seem like a solution but it's inefficient; invalidation is the proper way to clear cached objects.

764
MCQhard

A company is migrating a legacy on-premises application to AWS. The application consists of a web server, an application server, and a MySQL database. The company has already migrated the web and application servers to EC2 instances in a VPC. The database is still on-premises. The application currently connects to the database using a JDBC connection string with the on-premises IP address. The company wants to minimize changes to the application code. The network team has established an AWS Direct Connect connection between the on-premises data center and the VPC. The security team requires that traffic between the application and the database be encrypted in transit. The database is not publicly accessible. The migration plan includes moving the database to Amazon RDS for MySQL in the same VPC after the initial cutover. During the migration testing phase, the application team reports that the application can connect to the on-premises database but performance is slower than expected. CloudWatch metrics show high latency on the database connections. The application uses a connection pool with 100 connections. Which solution should the solutions architect recommend to improve performance while minimizing application code changes?

A.Increase the connection pool size to 200 and enable connection multiplexing
B.Deploy an Amazon RDS for MySQL read replica in the same Region and direct read traffic to it
C.Use AWS Database Migration Service to set up ongoing replication from on-premises to RDS
D.Enable Multi-AZ on the RDS instance
AnswerC

Using DMS with ongoing replication creates an RDS instance in the VPC that stays synchronized with the on-premises database. The application can then be pointed to this local RDS instance, drastically reducing latency. This is the most effective solution with minimal application changes.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication can continuously replicate data from the on-premises MySQL database to an Amazon RDS for MySQL instance in the same VPC. This allows the application to connect to the local RDS instance, significantly reducing latency compared to the Direct Connect link. To minimize code changes, the application's JDBC connection string can be updated to point to the RDS endpoint, or a DNS CNAME can be used to abstract the change.

Option A (increasing connection pool size) does not reduce network latency and may worsen performance. Option B (read replica) is not feasible because an RDS read replica can only replicate from an RDS primary, not from an on-premises database. Option D (Multi-AZ) is not applicable until the database is on AWS and does not improve latency.

Exam trap

Candidates may incorrectly choose option B (read replica) thinking it can replicate from on-premises, but RDS read replicas only work with an RDS source. The correct approach is to use DMS to replicate the on-premises database to an RDS instance in the cloud.

765
MCQhard

A company is migrating a monolithic application to microservices on AWS. The application uses a shared MySQL database. The team wants to decouple the database per microservice. Which strategy should the team use to minimize downtime during migration?

A.Rehost the application on EC2 and use a single RDS MySQL instance for all microservices.
B.Use the strangler fig pattern to gradually migrate functionality to microservices, each with its own database.
C.Use AWS Database Migration Service (DMS) to replicate the shared database to multiple target databases in real time.
D.Rewrite the entire application as microservices in a single release, using a shared database initially.
AnswerB

The strangler fig pattern allows incremental migration with minimal downtime.

Why this answer

The strangler fig pattern incrementally replaces parts of the monolith. Option A is wrong because re-platforming as-is does not decouple the database. Option C is wrong because a single shared database contradicts microservices.

Option D is wrong because rewriting the entire application at once increases risk and downtime.

766
MCQmedium

A company has a centralized AWS account for managing Amazon Route 53 DNS. The company has 100 VPCs across multiple accounts, and each VPC needs to resolve private hosted zones in the central account. What is the most scalable solution to enable DNS resolution across accounts?

A.Use CloudFormation StackSets to deploy Route 53 private hosted zones in each account
B.Use Route 53 Resolver outbound endpoints in the central account and share Resolver rules with other accounts using AWS RAM
C.Create a VPC peering connection between each VPC and the central account's VPC
D.Use AWS PrivateLink to connect VPCs to a central DNS service
AnswerB

This allows conditional forwarding of DNS queries to the central hosted zones.

Why this answer

Route 53 Resolver outbound endpoints in the central account can forward DNS queries to the central private hosted zones, and the associated Resolver rules can be shared with other accounts via AWS Resource Access Manager (RAM). This provides a centralized, scalable DNS resolution architecture without requiring VPC peering or duplicating hosted zones across accounts.

Exam trap

The trap here is that candidates often confuse VPC peering with DNS resolution, assuming that network connectivity alone enables private hosted zone resolution, but Route 53 private hosted zones require explicit DNS query forwarding or association, which is not provided by peering alone.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets would deploy Route 53 private hosted zones in each account, but each private hosted zone is isolated to its own account and VPC; this does not enable cross-account DNS resolution from the 100 VPCs to the central account's hosted zones. Option C is wrong because VPC peering does not automatically enable DNS resolution across accounts; it only provides network connectivity, and you would still need to configure Route 53 Resolver or use private hosted zones with peering, which does not scale to 100 VPCs due to peering limits and complexity. Option D is wrong because AWS PrivateLink is used to expose services via Network Load Balancers and ENIs, not for DNS forwarding or resolution; it does not provide the DNS query forwarding capability needed to resolve private hosted zones across accounts.

767
MCQhard

A company is running a production web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application uses a MySQL database hosted on Amazon RDS with Multi-AZ enabled. Recently, during a traffic spike, some users experienced increased latency and occasional 503 errors. The operations team noticed that the database CPU utilization reached 100% and the number of database connections peaked at the maximum limit. The application team confirmed that the application uses connection pooling on the EC2 instances but the pool size is fixed. Which solution should the solutions architect recommend to prevent recurrence?

A.Add read replicas to offload read queries.
B.Increase the DB instance class to a larger size.
C.Implement Amazon RDS Proxy to manage database connections.
D.Increase the maximum number of EC2 instances in the Auto Scaling group.
AnswerC

RDS Proxy pools connections, reducing the load on the database and preventing connection exhaustion.

Why this answer

The issue stems from database connections hitting the maximum limit, causing CPU saturation and 503 errors. Amazon RDS Proxy sits between the application and the database, efficiently managing and pooling connections from the EC2 instances, reducing the number of open connections to the RDS instance and preventing connection exhaustion. This allows the existing connection pooling on the EC2 side to scale without overwhelming the database, directly addressing the root cause.

Exam trap

The trap here is that candidates often confuse connection exhaustion with CPU or memory bottlenecks and choose vertical scaling (Option B) or read replicas (Option A), missing that the core issue is the fixed connection pool size and the database's max connections limit, which RDS Proxy directly addresses by pooling and reusing connections.

How to eliminate wrong answers

Option A is wrong because adding read replicas offloads read queries but does not reduce the number of database connections hitting the primary instance; the connection limit and CPU spike from connection overhead remain. Option B is wrong because increasing the DB instance class provides more CPU and memory but does not solve the connection limit issue; the application will still exhaust the max connections, and scaling vertically is a temporary fix that increases cost without addressing the architectural bottleneck. Option D is wrong because increasing the maximum number of EC2 instances in the Auto Scaling group would increase the number of application servers, each with a fixed connection pool, potentially worsening the connection exhaustion and CPU spike on the database.

768
Multi-Selecteasy

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available across multiple Availability Zones. Which TWO actions should the architect take? (Choose TWO.)

Select 2 answers
A.Launch all EC2 instances in a single Availability Zone.
B.Configure the ALB as internet-facing and attach it to multiple Availability Zones.
C.Launch EC2 instances in at least two Availability Zones.
D.Use a Network Load Balancer instead of an Application Load Balancer.
E.Assign Elastic IP addresses to each EC2 instance.
AnswersB, C

Internet-facing ALB with multiple AZs provides HA.

Why this answer

An internet-facing Application Load Balancer (ALB) must be attached to multiple Availability Zones (AZs) to provide high availability and fault tolerance. If the ALB is configured in only one AZ, a failure in that AZ would render the application unreachable. Option C is correct because EC2 instances must be launched in at least two AZs to serve as healthy targets for the ALB, ensuring that traffic can be routed to instances in another AZ if one AZ fails.

Exam trap

The trap here is that candidates may think launching instances in a single AZ is sufficient if the ALB is configured across multiple AZs, but the ALB requires healthy targets in each enabled AZ to maintain high availability; without instances in at least two AZs, the ALB cannot route traffic if the sole AZ fails.

769
MCQhard

A media company is building a video transcoding pipeline using AWS Elemental MediaConvert. The source videos are uploaded to an S3 bucket, and the transcoded outputs are stored in another S3 bucket. The company wants to trigger the transcoding job as soon as a new video is uploaded. The pipeline must handle high volumes of uploads and ensure that no upload is missed. Which solution is MOST reliable and scalable?

A.Configure an S3 event notification to directly invoke an AWS Lambda function that starts the MediaConvert job.
B.Configure an S3 event notification to publish to an Amazon SNS topic, which triggers an AWS Lambda function that starts the MediaConvert job.
C.Use Amazon EventBridge to detect S3 PUT events and route them to a Lambda function.
D.Configure an S3 event notification to send events to an Amazon SQS queue, and have a Lambda function poll the queue and start MediaConvert jobs.
AnswerA

This is a simple, reliable, and scalable event-driven pattern.

Why this answer

S3 event notifications can directly invoke a Lambda function with minimal latency and no intermediate components, making it the simplest and most reliable way to trigger MediaConvert jobs for each upload. S3 event notifications are designed to deliver events with at-least-once delivery semantics, ensuring no upload is missed even under high volumes. This direct integration avoids additional failure points like SNS or SQS, which could introduce delays or require extra configuration for scaling.

Exam trap

The trap here is that candidates may overcomplicate the solution by adding intermediate services like SNS or SQS, thinking they improve reliability, when in fact the direct S3-to-Lambda integration is the most reliable and scalable for this specific trigger pattern, and additional components only introduce unnecessary complexity and potential failure points.

How to eliminate wrong answers

Option B is wrong because adding an SNS topic between S3 and Lambda introduces an unnecessary intermediate hop that does not improve reliability or scalability; SNS is typically used for fan-out to multiple subscribers, but here only one Lambda function is needed, so the direct S3-to-Lambda integration is simpler and more reliable. Option C is wrong because Amazon EventBridge is not the native service for S3 event notifications; while EventBridge can capture S3 events via CloudTrail, this adds complexity and potential latency compared to native S3 event notifications, and it is not the most direct or recommended approach for triggering Lambda from S3 PUTs. Option D is wrong because using an SQS queue adds polling overhead and potential processing delays; while it can help with throttling, it is unnecessary for this use case because Lambda can scale automatically to handle high volumes of concurrent invocations from S3 events, and the queue introduces an extra component that could fail or require monitoring.

770
MCQmedium

A developer notices that CloudWatch Logs for a Lambda function show no logs after a recent deployment. The function is invoked successfully. What is the most likely cause?

A.The Lambda function is exceeding the CloudWatch Logs API rate limits.
B.The Lambda execution role does not have permissions to write to CloudWatch Logs.
C.The log group retention policy is set to 7 days, which expired old logs.
D.The log group was deleted and not recreated.
AnswerB

Without proper IAM permissions, Lambda cannot create log streams or write logs.

Why this answer

If the Lambda execution role lacks logs:CreateLogGroup and logs:PutLogEvents permissions, Lambda cannot write logs. Option A is wrong because the log group exists but has 0 stored bytes. Option C is wrong because retention policy doesn't prevent new logs.

Option D is wrong because the log group exists.

771
MCQeasy

A company uses AWS Organizations with a single OU for all accounts. The security team wants to prevent any account from leaving the organization without approval. What should they do?

A.Configure IAM policies on the root user of each account to deny leave actions.
B.Create an AWS Config rule to detect leave attempts.
C.Enable AWS CloudTrail to monitor leave events and send alerts.
D.Apply an SCP that denies the organizations:LeaveOrganization action.
AnswerD

SCP can deny the action across all accounts.

Why this answer

A Service Control Policy (SCP) applied at the root or OU level in AWS Organizations can explicitly deny the `organizations:LeaveOrganization` action for all member accounts. SCPs are the only mechanism that can centrally restrict what actions accounts can perform, including leaving the organization, regardless of the permissions granted by IAM policies within those accounts.

Exam trap

The trap here is that candidates often confuse IAM policies with SCPs, thinking IAM can restrict root user actions, or they choose detective controls (Config or CloudTrail) instead of the preventive SCP that actually blocks the action.

How to eliminate wrong answers

Option A is wrong because IAM policies attached to the root user of each account cannot prevent the account from leaving the organization; the root user has full administrative access that overrides IAM policies, and the LeaveOrganization action is controlled by Organizations, not IAM. Option B is wrong because an AWS Config rule can only detect noncompliant resources or actions after they occur, but it cannot prevent the leave action from succeeding; by the time the rule triggers, the account may have already left. Option C is wrong because AWS CloudTrail logs events after they happen, so it can only provide visibility into a leave event after it has occurred, not block it proactively.

772
MCQeasy

A startup is deploying a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon DynamoDB table. To improve performance, the team wants to reduce latency for read-heavy workloads. Which design change would be MOST effective?

A.Add an Amazon ElastiCache Redis cluster in front of DynamoDB to cache session data.
B.Use an Auto Scaling group to add more EC2 instances during peak hours.
C.Enable DynamoDB Accelerator (DAX) for the session table.
D.Increase the size of the EC2 instances to handle more concurrent users.
AnswerC

DAX provides an in-memory cache for DynamoDB, reducing read latency without application changes.

Why this answer

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache specifically designed for Amazon DynamoDB. It reduces read latency from single-digit milliseconds to microseconds by caching frequently accessed items, making it ideal for read-heavy session state workloads without requiring application-level cache management.

Exam trap

The trap here is that candidates often choose ElastiCache Redis (Option A) because it is a general-purpose cache, but they overlook that DAX is purpose-built for DynamoDB and eliminates the need for custom cache invalidation logic, making it the most effective and operationally simpler choice for this specific use case.

How to eliminate wrong answers

Option A is wrong because adding an ElastiCache Redis cluster in front of DynamoDB introduces operational complexity and potential data inconsistency between the cache and the database, whereas DAX provides a native, write-through cache that automatically synchronizes with DynamoDB. Option B is wrong because scaling EC2 instances with Auto Scaling addresses compute capacity, not the latency of reading session data from DynamoDB; the bottleneck is database read performance, not application server throughput. Option D is wrong because increasing EC2 instance size improves compute and memory capacity but does not reduce the latency of DynamoDB read operations; the session state is stored externally, so larger instances do not accelerate database access.

773
Multi-Selecthard

A company is migrating a critical application to AWS and needs to ensure high availability across AWS Regions. The application uses a relational database. Which THREE components are necessary for this multi-region architecture?

Select 3 answers
A.Amazon RDS Multi-AZ deployment
B.Application Load Balancer in each region
C.Amazon Route 53 with failover routing policy
D.Amazon RDS cross-Region read replica
E.VPC peering between regions
AnswersB, C, D

Distributes traffic within region.

Why this answer

For a multi-region architecture ensuring high availability, three key components are required: an Application Load Balancer in each region to distribute traffic locally, Amazon Route 53 with failover routing policy to direct traffic to the healthy region, and an Amazon RDS cross-Region read replica to provide database disaster recovery and read scalability. Option A (RDS Multi-AZ) is incorrect because it only provides high availability within a single region, not across regions. Option E (VPC peering) is incorrect because VPC peering does not provide high availability; it is a networking feature for connecting VPCs, typically within the same region or across regions for private communication, but it is not a component for multi-region HA architecture.

774
MCQmedium

A company migrated a monolithic application to a microservices architecture on Amazon ECS. They notice that the CPU utilization of the cluster is high, but individual services are underutilized. What is the best optimization?

A.Increase the number of tasks for each service.
B.Use AWS Fargate Spot for interruptible workloads.
C.Switch from Fargate to EC2 launch type.
D.Right-size the task definitions by adjusting CPU and memory reservations.
AnswerD

Proper sizing reduces over-provisioning and improves cluster utilization.

Why this answer

Right-sizing the task definitions by adjusting CPU and memory reservations ensures each service receives the appropriate resources, reducing wasted capacity and optimizing cluster utilization. This directly addresses the high cluster CPU utilization while individual services are underutilized. Option A (increasing tasks) would exacerbate the issue.

Option B (Fargate Spot) does not solve the resource allocation problem. Option C (EC2 launch type) is not relevant to the utilization pattern described.

775
MCQmedium

A company is migrating its on-premises VMware virtual machines to AWS. The company wants to use the same VM images and has a 10 Gbps direct connect link. Which service should be used to automate the migration of the VMs?

A.AWS Migration Hub
B.AWS DataSync
C.AWS VM Import/Export
D.AWS Server Migration Service
AnswerC

Directly imports VMware VMs as EC2 instances.

Why this answer

AWS VM Import/Export enables the import of existing VM images (including VMware) from on-premises into EC2, making it the correct choice for migrating existing VM images. Option A (AWS Migration Hub) is a tracking and management service, not a migration tool. Option B (AWS DataSync) is used for transferring file and object storage, not VM images.

Option D (AWS Server Migration Service) is deprecated and is not the recommended service for this use case; AWS Application Migration Service (MGN) is the modern replacement, but VM Import/Export directly supports importing images without agent installation.

776
MCQmedium

A company is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences sudden spikes in traffic. Which AWS service should be used to handle the traffic spikes without losing any requests?

A.Amazon SNS
B.AWS Step Functions
C.Amazon SQS
D.Amazon Kinesis Data Streams
AnswerC

SQS decouples the API from Lambda and buffers requests.

Why this answer

Amazon SQS can buffer requests during spikes, allowing Lambda to process them at its own pace without dropping any.

777
MCQhard

A multinational corporation is using AWS Organizations with hundreds of accounts. The finance team needs to track costs by cost center, which is stored as a tag on each resource. However, some resources are missing the tag. What is the most efficient way to ensure that all resources are tagged correctly going forward?

A.Use AWS Config rules to identify untagged resources and send alerts
B.Use tag policies in AWS Organizations to enforce tagging on new resources
C.Attach an SCP that denies all actions if the resource does not have the cost center tag
D.Create a Lambda function that runs daily to tag untagged resources
AnswerB

Tag policies proactively enforce tagging rules.

Why this answer

Tag policies in AWS Organizations allow you to define a set of tagging rules that are enforced across all accounts in the organization. When a tag policy is attached to an organizational root, OU, or account, AWS automatically prevents the creation of resources that do not comply with the specified tags, ensuring that all new resources are tagged correctly from the start without requiring manual remediation or custom scripts.

Exam trap

The trap here is that candidates often confuse AWS Config rules (detective control) with tag policies (preventive control), or incorrectly assume that SCPs can enforce tagging at resource creation, when in fact SCPs cannot condition on resource tags for most services and are not designed for tag enforcement.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can only detect and alert on untagged resources after they are created; they do not prevent the creation of untagged resources, so they are not the most efficient way to ensure tagging going forward. Option C is wrong because an SCP that denies all actions if a resource does not have the cost center tag would be overly broad and impractical—SCPs cannot condition on resource tags at the time of creation for most services, and such a policy would block legitimate actions on existing untagged resources or services that do not support tag-based conditions. Option D is wrong because a Lambda function that runs daily to tag untagged resources is reactive and inefficient; it does not prevent the creation of untagged resources and adds operational overhead, whereas tag policies enforce tagging proactively at resource creation.

778
Multi-Selecthard

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to be accessible from the internet and must be secured with an AWS WAF. Which TWO steps should be taken to achieve this?

Select 2 answers
A.Associate the ALB with an AWS WAF web ACL.
B.Use an Application Load Balancer in front of the ECS service.
C.Use a Network Load Balancer in front of the ECS service.
D.Assign public IP addresses to the Fargate tasks.
E.Use Amazon CloudFront as a CDN.
AnswersA, B

WAF can be associated with ALB to filter malicious traffic.

Why this answer

AWS WAF can be associated with an Application Load Balancer (ALB) to filter HTTP/HTTPS traffic at the application layer. This allows you to protect the containerized application from common web exploits like SQL injection or cross-site scripting. Option B is correct because an ALB is required to route internet traffic to the ECS Fargate service and to terminate TLS, which is necessary for WAF to inspect the request payload.

Exam trap

The trap here is that candidates often assume a Network Load Balancer can be used with WAF or that assigning public IPs to tasks is acceptable, but WAF requires Layer 7 inspection which only an ALB (or CloudFront) can provide, and direct public IPs bypass all security controls.

779
MCQmedium

A company is migrating its on-premises application to AWS and needs to maintain the same private IP addresses for the application servers. The on-premises network uses 10.0.0.0/16. Which AWS service allows the company to extend its on-premises network to AWS and preserve IP addresses?

A.AWS Transit Gateway
B.VPC Peering
C.AWS Site-to-Site VPN
D.AWS Direct Connect
AnswerC

AWS Site-to-Site VPN creates a secure tunnel between the on-premises network and the VPC, enabling the use of the same private IP addresses in the VPC.

Why this answer

WS Site-to-Site VPN (Option C). This service creates an encrypted connection between the on-premises network and the VPC, allowing the company to extend its on-premises IP address range (10.0.0.0/16) into AWS, thereby preserving the private IP addresses for application servers. AWS Transit Gateway (Option A) is a hub that connects multiple VPCs and on-premises networks but requires VPN or Direct Connect attachments; it does not directly provide IP preservation.

VPC Peering (Option B) connects VPCs within AWS, not on-premises networks. AWS Direct Connect (Option D) provides a dedicated private connection but does not inherently preserve IP addresses; it can be used with VPN to achieve IP preservation.

780
MCQmedium

A company is designing a new event-driven architecture on AWS for processing orders. When a new order is placed, it must be validated, inventory checked, payment processed, and notification sent. Each step is independent and may take variable time. The company wants to decouple the steps and ensure that failures do not block the entire workflow. Which solution should a Solutions Architect recommend?

A.Use Amazon SQS queues for each step, with Lambda functions polling each queue and forwarding to the next step.
B.Use Amazon SNS to publish order events, and subscribe separate Lambda functions for validation, inventory, payment, and notification.
C.Use AWS Step Functions to define a state machine that invokes Lambda functions for each step, with retry and error handling.
D.Create a single Lambda function that performs all steps sequentially.
AnswerC

Step Functions provides orchestration, error handling, and visibility into the workflow.

Why this answer

AWS Step Functions is the correct choice because it provides a fully managed state machine that can orchestrate multiple Lambda functions with built-in retry logic, error handling, and parallel execution. This decouples each step (validation, inventory, payment, notification) while ensuring that failures in one step do not block the entire workflow, as Step Functions can handle errors gracefully with configurable retries and fallback states.

Exam trap

The trap here is that candidates often confuse decoupling with simple fan-out (SNS) or queue-based processing (SQS), overlooking the need for orchestration with error handling and sequential/parallel coordination that Step Functions uniquely provides.

How to eliminate wrong answers

Option A is wrong because using separate SQS queues with Lambda functions polling each queue introduces unnecessary complexity and latency, and does not natively support orchestration of sequential or parallel steps with error handling; it also requires custom code to manage retries and ordering. Option B is wrong because Amazon SNS is a pub/sub messaging service that fans out events to all subscribers simultaneously, but it cannot enforce a sequential order of steps or handle failures in one step without affecting others, as all subscribers receive the event at once and there is no built-in retry or error handling for the workflow. Option D is wrong because a single Lambda function performing all steps sequentially creates a monolithic architecture that violates the decoupling requirement, and any failure in a step would block the entire process with no built-in retry or error isolation.

781
MCQhard

A global company uses a multi-account AWS Organizations structure with hundreds of accounts. The network team wants to centrally manage VPC flow logs for all accounts and send them to a centralized S3 bucket in the security account. Which solution is MOST scalable and operationally efficient?

A.Use AWS Config to detect VPCs without flow logs and trigger a Lambda function to enable them.
B.Use CloudFormation StackSets to deploy a stack that enables VPC flow logs in every account and region, sending logs to a centralized S3 bucket with appropriate bucket policies.
C.Write a script that uses the AWS API to enable VPC flow logs in each account and region, triggered by AWS Config rules.
D.Set up a VPN connection from each account to the security account and configure flow logs to use a S3 endpoint in the security account.
AnswerB

StackSets allow automated deployment across accounts and regions with minimal overhead.

Why this answer

CloudFormation StackSets allow you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization, making it the most scalable and operationally efficient solution for centrally enabling VPC Flow Logs. By including the appropriate S3 bucket policy in the security account, you can ensure logs from all accounts are delivered to a centralized bucket without manual intervention.

Exam trap

The trap here is that candidates often overcomplicate the solution by considering VPNs or custom scripts, when the most scalable and operationally efficient approach is to use CloudFormation StackSets with a service-managed permission model to deploy a standardized stack across the entire organization.

How to eliminate wrong answers

Option A is wrong because AWS Config can detect non-compliant VPCs, but relying on a Lambda function to enable flow logs introduces a single point of failure and is less scalable than a declarative, infrastructure-as-code approach like StackSets. Option C is wrong because writing a custom script that uses the AWS API to enable flow logs in each account and region is error-prone, requires ongoing maintenance, and does not provide the same level of consistency and rollback capabilities as StackSets. Option D is wrong because setting up a VPN connection from each account to the security account is unnecessary and adds significant complexity and cost; VPC Flow Logs can be delivered directly to a centralized S3 bucket using a bucket policy that grants cross-account access, without requiring network connectivity.

782
MCQeasy

A company uses AWS Organizations with a management account and multiple member accounts. The management account has a trail in AWS CloudTrail that logs all management events for all accounts. The security team wants to also log data events for S3 buckets across all accounts. They create a new trail in the management account with data events enabled for all S3 buckets in all accounts. However, data events from member accounts are not appearing in the CloudTrail logs. What is the most likely cause?

A.The S3 bucket in the management account does not have a bucket policy that allows CloudTrail to write logs from member accounts.
B.The trail is not configured to log data events for all S3 buckets; it only logs for specific buckets.
C.Data events for S3 buckets are not logged centrally by a trail created in the management account; each account must have its own trail for data events.
D.The S3 bucket is encrypted with a KMS key that CloudTrail does not have permission to use.
AnswerC

Data events are per-account unless using advanced event selectors with cross-account support (which is not default).

Why this answer

A trail created in the management account of AWS Organizations can log management events for all member accounts, but data events (such as S3 object-level operations) are logged only for the account that owns the trail. To capture data events from member accounts, each member account must create its own trail and enable data event logging for its S3 buckets. Option A is incorrect because CloudTrail can write to an S3 bucket even without a bucket policy, as long as the bucket is in the same account.

Option B is incorrect because the trail was configured to log data events for all S3 buckets, but that setting only applies to the management account, not member accounts. Option D is incorrect because KMS encryption does not affect the ability to log data events; CloudTrail can use the appropriate KMS permissions if configured.

783
MCQhard

An IAM policy attached to a user allows s3:GetObject and s3:PutObject on my-bucket, but denies all actions on the confidential/ prefix. The user reports that they can still upload objects to the confidential/ folder. Why?

A.The Allow statement appears before the Deny statement in the policy.
B.The Deny statement is not explicit enough to override the Allow.
C.The Deny statement is in a separate policy that is not attached to the user.
D.The Deny statement's resource ARN does not match the confidential folder objects.
AnswerC

If the Deny statement is in a policy that is not attached to the user, it never gets evaluated, so the Allow from the attached policy permits the upload.

Why this answer

IAM policy evaluation follows the rule that an explicit Deny always overrides any Allow. If both the Allow and Deny statements were in an attached policy, the Deny would block uploads to the confidential/ prefix. Therefore, the fact that the user can still upload indicates that the Deny statement is in a policy that is not attached to the user (or not effective).

Option C correctly identifies this: the Deny statement is in a separate policy that is not attached to the user.

784
Multi-Selecthard

A company runs a web application on EC2 instances in an Auto Scaling group. The application writes logs to local instance storage. The operations team wants to centralize log analysis using Amazon CloudWatch Logs. The team needs a solution that is resilient to instance failures and does not lose logs. Which TWO options should the team implement? (Choose TWO.)

Select 2 answers
A.Use the CloudWatch agent with the auto-scaling group lifecycle hooks
B.Mount an EFS volume to the instances for log storage
C.Install the CloudWatch Logs agent on each EC2 instance to stream logs to CloudWatch Logs
D.Configure the Auto Scaling group to send logs to Amazon S3 on instance termination
E.Use Amazon SQS to buffer log events before sending to CloudWatch Logs
AnswersB, C

Persistent storage ensures logs survive instance termination.

Why this answer

(EFS volume) ensures log persistence even if an instance fails, because EFS is a shared, durable file system. Option C (CloudWatch agent) streams logs to CloudWatch Logs in near real-time, enabling centralized analysis. Option A (lifecycle hooks) is not sufficient for streaming logs to CloudWatch; it only helps with final log delivery on instance termination but doesn't provide real-time streaming.

Option D (SQS) adds unnecessary complexity; CloudWatch agent can directly stream logs. Option E (S3) is not needed when using CloudWatch Logs.

785
MCQhard

A financial services company uses AWS Organizations with a multi-account structure: a central security account, a shared services account, and multiple workload accounts. The security team needs to centrally manage and audit all changes to security groups across all accounts. They have implemented AWS Config with an aggregator in the security account. However, they notice that changes to security groups in workload accounts are not appearing in the aggregator. The workload accounts have AWS Config enabled and are recording security group changes. The security account has the necessary cross-account permissions. What is the most likely cause and solution?

A.The security account is not authorized in each workload account's Config settings. The security team must add the security account as an authorized aggregator in each workload account.
B.AWS CloudTrail is not enabled in workload accounts. The security team must enable CloudTrail.
C.Service Control Policies are blocking cross-account access. The security team must modify SCPs to allow Config aggregation.
D.AWS Config in workload accounts is not recording security group changes. The security team must enable recording for security groups.
AnswerA

Config aggregator requires explicit authorization from source accounts.

Why this answer

AWS Config aggregator requires an authorized aggregator account that is set up in each source account. Without this authorization, the aggregator cannot collect data. Option B is wrong because Config is recording changes.

Option C is wrong because CloudTrail is not needed for Config aggregation. Option D is wrong because SCPs do not block Config aggregation.

786
MCQhard

A media company is designing a video transcoding pipeline using AWS Lambda and Amazon S3. The pipeline must process videos uploaded to an S3 bucket, transcode them into multiple formats, and store the results in another S3 bucket. The processing time for each video can vary from a few seconds to several minutes. Which architecture will minimize cost and ensure all videos are processed, even if Lambda execution timeout is reached?

A.Configure S3 event notifications to invoke Lambda directly and use a dead-letter queue to capture failed events.
B.Use AWS Step Functions to orchestrate the transcoding workflow, with each step as a separate Lambda function.
C.Configure S3 event notifications to send messages to an Amazon SQS queue. Have Lambda poll the queue and process each message. Set the SQS visibility timeout to match the expected maximum processing time.
D.Use Amazon Kinesis Data Streams to ingest S3 events and have Lambda process records from the stream.
AnswerC

SQS decouples the trigger from processing, allowing Lambda to poll at its own pace; visibility timeout ensures messages are reprocessed if Lambda times out or fails.

Why this answer

Using S3 event notifications to send messages to an Amazon SQS queue decouples the upload from processing, allowing Lambda to poll the queue at its own pace. Setting the visibility timeout to match the expected maximum processing time ensures that if a Lambda invocation times out, the message becomes visible again after the visibility timeout, so it can be reprocessed. This minimizes cost (no additional services like Step Functions or Kinesis) and guarantees all videos are processed.

Option A is incorrect because direct Lambda invocation via S3 events can lead to throttling under high concurrency, and the dead-letter queue only captures events after all retries fail, but timeouts within the function may not be handled elegantly. Option B is incorrect because AWS Step Functions adds cost and complexity for orchestration; while it can manage long-running workflows, the simpler SQS approach is more cost-effective. Option D is incorrect because Amazon Kinesis Data Streams is designed for real-time streaming and is overkill for this batch-oriented transcoding pipeline, increasing cost and complexity.

787
MCQeasy

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences increased traffic, and the environment's Auto Scaling group is not scaling out quickly enough. What should a solutions architect do to improve the scaling response?

A.Decrease the CPU utilization threshold for scale-out alarms.
B.Increase the minimum number of instances in the Auto Scaling group.
C.Reduce the cooldown period for the Auto Scaling group.
D.Use a larger instance type to handle more traffic.
AnswerC

A shorter cooldown allows new instances to be launched sooner after a scaling activity.

Why this answer

Reducing the cooldown period allows the Auto Scaling group to react faster to increased traffic, enabling quicker scale-out. Option A is incorrect because decreasing the CPU utilization threshold for scale-out alarms would cause the group to scale out at lower CPU levels, potentially scaling out sooner but not necessarily improving the speed of response. Option B is incorrect because increasing the minimum number of instances does not speed up scaling; it only ensures a higher baseline capacity.

Option D is incorrect because using larger instance types handles more traffic per instance but does not improve the scaling response time.

788
MCQmedium

A company uses Amazon S3 to store backups. The backup process uploads objects with a prefix 'backups/' and sets the storage class to STANDARD_IA. The company wants to automatically move objects older than 30 days to GLACIER. What is the most efficient way to achieve this?

A.Use an AWS Lambda function triggered by S3 events to change the storage class.
B.Use S3 Batch Operations to copy objects to a new bucket with GLACIER storage class.
C.Create an S3 Lifecycle rule that transitions objects with prefix 'backups/' to GLACIER after 30 days.
D.Enable S3 Intelligent-Tiering on the bucket.
AnswerC

Lifecycle rules automate transitions based on age.

Why this answer

An S3 Lifecycle rule can be configured to transition objects with the prefix 'backups/' to the GLACIER storage class after 30 days. This is the most efficient and automated approach. Option A is incorrect because using AWS Lambda triggered by S3 events to change the storage class would be less efficient and more complex than a lifecycle rule.

Option B is incorrect because S3 Batch Operations are designed for one-time bulk operations, not for ongoing, time-based transitions. Option D is incorrect because S3 Intelligent-Tiering automatically moves objects between access tiers based on changing access patterns, but it does not automatically move objects to GLACIER after a fixed period; lifecycle rules are more appropriate for this requirement.

789
MCQhard

A company is using an AWS Direct Connect connection to access its VPC. The company is experiencing intermittent connectivity issues. The Solutions Architect suspects a routing problem. Which AWS service can help diagnose the issue by providing real-time metrics and logs?

A.Amazon CloudWatch with Direct Connect metrics
B.VPC Flow Logs
C.AWS CloudTrail
D.AWS Trusted Advisor
AnswerA

CloudWatch provides metrics like connection state and BGP status.

Why this answer

Amazon CloudWatch with Direct Connect metrics (Option A) is correct because it provides real-time metrics and logs specifically for AWS Direct Connect connections, such as connection state, latency, and packet loss. This helps diagnose routing and connectivity issues. VPC Flow Logs (Option B) capture IP traffic metadata within the VPC but do not include Direct Connect-specific metrics like BGP status or link health.

AWS CloudTrail (Option C) records API activity, not network-level diagnostics. AWS Trusted Advisor (Option D) offers cost optimization and security recommendations but does not provide real-time network monitoring.

790
MCQhard

A company is designing a multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets across accounts must have server access logging enabled and must block public access. What is the MOST scalable and secure way to enforce these requirements?

A.Use AWS CloudFormation StackSets to deploy S3 buckets with logging and public access blocks
B.Apply service control policies (SCPs) at the organizational unit (OU) level to deny actions that disable logging or enable public access
C.Create IAM roles in each account with policies that require logging and block public access
D.Use AWS Config rules to detect non-compliant buckets and send notifications
AnswerB

SCPs centrally enforce restrictions across all accounts.

Why this answer

Service control policies (SCPs) at the OU level are the most scalable and secure way to enforce guardrails across all accounts in an AWS Organization. By denying actions that disable server access logging (e.g., s3:PutBucketLogging with a condition that the logging target is not set) and actions that enable public access (e.g., s3:PutBucketPublicAccessBlock with a condition that the block is not set to true), SCPs prevent non-compliant configurations from being created or modified, regardless of the IAM principal used. This approach is centralized, immutable by child accounts, and scales automatically as new accounts are added to the OU.

Exam trap

The trap here is that candidates often choose detective solutions like AWS Config (Option D) or deployment solutions like CloudFormation StackSets (Option A), failing to recognize that only a preventive, organization-wide guardrail like SCPs can enforce compliance at scale and prevent non-compliant actions from ever succeeding.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets can deploy compliant S3 buckets, but they cannot prevent users or roles in child accounts from subsequently modifying the bucket configuration to disable logging or enable public access, leaving the environment vulnerable to drift. Option C is wrong because IAM roles in each account are not scalable (they must be created and maintained per account) and cannot enforce requirements on actions performed by the root user or by services that do not assume the role; SCPs are the only mechanism that can restrict the root user. Option D is wrong because AWS Config rules are detective, not preventive; they can detect non-compliant buckets and send notifications, but they do not block the non-compliant action from occurring, meaning a bucket could be publicly accessible or lack logging for a period before remediation.

791
MCQeasy

Refer to the exhibit. A CloudFormation stack creation failed. The architect needs to identify the reason for the failure. Which CLI command should be used to get detailed error messages?

A.aws cloudformation describe-stacks --stack-name my-stack
B.aws cloudformation describe-stack-events --stack-name my-stack
C.aws cloudformation get-template --stack-name my-stack
D.aws cloudformation list-stack-resources --stack-name my-stack
AnswerB

Correct. 'describe-stack-events' provides detailed events including error messages, which are useful for troubleshooting stack failures.

Why this answer

The 'describe-stack-events' command provides detailed events including error messages, which can be used to identify reasons for stack creation failure. Option A is incorrect because 'describe-stacks' only shows the stack status and output, not detailed error messages. Option C is incorrect because 'get-template' retrieves the template body, not events.

Option D is incorrect because 'list-stack-resources' lists resources, not events or errors.

792
Multi-Selectmedium

A company is implementing a hybrid network architecture with multiple VPCs in different AWS accounts. They need to ensure private connectivity between the VPCs and their on-premises data center. Which TWO services should they use together to meet this requirement?

Select 2 answers
A.AWS Direct Connect
B.Amazon Route 53 Resolver
C.VPC peering
D.AWS Transit Gateway
E.AWS Client VPN
AnswersA, D

Direct Connect provides private, dedicated connectivity to on-premises.

Why this answer

AWS Direct Connect provides a dedicated private network connection from an on-premises data center to AWS, bypassing the public internet for consistent latency and bandwidth. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across different AWS accounts and route traffic to the Direct Connect virtual interface, enabling a scalable hub-and-spoke architecture for hybrid connectivity.

Exam trap

The trap here is that candidates often choose VPC peering (Option C) thinking it can connect multiple VPCs to on-premises directly, but VPC peering lacks transitive routing and cannot terminate a Direct Connect connection, making Transit Gateway the required central aggregation point.

793
MCQmedium

A company is designing a multi-tier web application on AWS. The web tier must automatically scale based on CPU utilization, and the application tier must process messages from an SQS queue. The application tier instances are frequently terminated and replaced due to scaling events. Where should the application logs be stored to ensure they are retained regardless of instance lifecycle?

A.Configure the CloudWatch Logs agent on each instance to stream logs to CloudWatch Logs.
B.Store logs on an EBS volume and take regular snapshots.
C.Write logs to the instance store volume of each EC2 instance.
D.Write logs to an Amazon S3 bucket mounted on each instance using NFS.
AnswerA

CloudWatch Logs persists logs independently of instance lifecycle and supports real-time streaming.

Why this answer

The CloudWatch Logs agent streams log data to Amazon CloudWatch Logs in real-time, decoupling log retention from the EC2 instance lifecycle. When instances are terminated, the logs are already persisted in CloudWatch Logs, ensuring they are retained regardless of scaling events.

Exam trap

The trap here is that candidates may confuse instance store (ephemeral) with EBS (persistent) storage, or assume that mounting S3 via NFS is a straightforward AWS feature, when in fact CloudWatch Logs is the only fully managed, instance-lifecycle-independent solution for log retention in this scenario.

How to eliminate wrong answers

Option B is wrong because EBS snapshots are point-in-time backups and do not provide continuous log streaming; logs written to an EBS volume are lost if the instance is terminated and the volume is deleted, unless snapshots are taken frequently, which adds complexity and potential data loss between snapshots. Option C is wrong because instance store volumes are ephemeral and data is lost when the instance is stopped, terminated, or fails; they are not suitable for persistent log storage. Option D is wrong because mounting an S3 bucket via NFS is not a native AWS feature; it requires third-party tools or FUSE-based solutions, introduces latency and complexity, and does not guarantee real-time log streaming or seamless integration with instance scaling.

794
MCQmedium

A company runs a critical application on an Amazon RDS for PostgreSQL DB instance. The database experiences periodic slowdowns. The team notices that the DB instance has a large number of connections in an idle state. What is the BEST way to address this issue?

A.Migrate the database to Amazon Aurora.
B.Configure AWS Lambda to manage database connections.
C.Use an RDS Proxy to pool database connections.
D.Increase the max_connections parameter in the DB parameter group.
AnswerC

RDS Proxy efficiently pools and reuses database connections, reducing idle connections and improving scalability.

Why this answer

Using an RDS Proxy reduces the number of idle connections by pooling and reusing them. Option A is wrong because switching to Aurora may not directly address idle connections. Option B is wrong because Lambda is not a database connection management tool.

Option D is wrong because increasing max_connections might worsen the problem.

795
MCQmedium

Refer to the exhibit. A company uses AWS CloudFormation to deploy an EC2 instance. The template uses a condition to select the instance type based on the environment. The company deploys the stack with the parameter EnvType set to 'prod'. What will be the instance type of the created EC2 instance?

A.t3.large
B.The instance type will be determined at runtime.
C.The instance will not be created because the condition is false.
D.t2.micro
AnswerA

The condition IsProduction is true, so Fn::If returns t3.large.

Why this answer

The condition in the CloudFormation template evaluates to true when EnvType equals 'prod', so the EC2 instance is created with the instance type specified in the condition's true branch, which is t3.large. The template uses a condition like 'If(Equals(EnvType, 'prod'), t3.large, t2.micro)', and since the parameter is set to 'prod', the Fn::If intrinsic function returns 't3.large'.

Exam trap

The trap here is that candidates may confuse a false condition with skipping resource creation, but in this case the condition is used only to select a property value, not to conditionally create the resource itself.

How to eliminate wrong answers

Option B is wrong because the instance type is not determined at runtime; CloudFormation resolves the condition and intrinsic functions at stack creation time, not during instance boot. Option C is wrong because the condition is true (EnvType equals 'prod'), so the instance is created; a false condition would omit the resource entirely. Option D is wrong because t2.micro is the value for the false branch of the condition, which is used only when EnvType is not 'prod'.

796
MCQeasy

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data locally on the EC2 instances. The company wants to make the application stateless to improve availability and scalability. Which solution should the solutions architect recommend?

A.Use Amazon ElastiCache for Redis to store session data externally.
B.Configure session stickiness on the ALB to route requests from the same user to the same EC2 instance.
C.Mount an Amazon EFS file system on the EC2 instances and store session files there.
D.Store session data in Amazon S3 and update the application to read and write sessions to S3.
AnswerA

ElastiCache for Redis is a fast, in-memory store ideal for session management, making the application stateless.

Why this answer

Amazon ElastiCache for Redis provides a fast, in-memory, highly available session store that decouples session state from EC2 instances, making the application stateless. This improves availability and scalability. Option B is incorrect because session stickiness (sticky sessions) on the ALB ties a user to a specific instance, preventing true statelessness and can cause uneven load distribution.

Option C is incorrect because mounting Amazon EFS to store session files still relies on a filesystem, which is slower than in-memory storage and does not eliminate statefulness. Option D is incorrect because Amazon S3 is not designed for high-frequency read/write operations like session management; it introduces high latency and is less efficient than ElastiCache.

797
MCQhard

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket. After deployment, the bucket is created but objects are not automatically deleted after 30 days as expected. What is the most likely cause?

A.The lifecycle rule only applies to noncurrent versions, not current objects.
B.The bucket name conflicts with an existing bucket.
C.Versioning is not enabled on the bucket.
D.The lifecycle rule requires a region-specific prefix.
AnswerA

NoncurrentVersionExpirationInDays only deletes old versions, not current objects.

Why this answer

The lifecycle rule in the template likely uses `NoncurrentVersionExpirationInDays`, which only applies to noncurrent versions, not current objects. To delete current objects after 30 days, an `ExpirationInDays` rule is needed. Versioning being enabled (option C) is necessary for the noncurrent version expiration to work, but the issue is that current objects are not expiring.

The bucket name conflict (option B) would cause a deployment failure, not a lifecycle misconfiguration. Region-specific prefix (option D) is not required for lifecycle rules.

798
Multi-Selecteasy

A company has an AWS Lambda function that processes messages from an SQS queue. The function is experiencing timeouts. Which TWO changes could help resolve the timeout issue? (Choose 2)

Select 2 answers
A.Increase the batch size in the SQS event source mapping.
B.Enable SQS queue encryption.
C.Increase the Lambda function timeout.
D.Increase the Lambda function memory allocation.
E.Decrease the SQS visibility timeout.
AnswersC, D

Allows longer execution.

Why this answer

Increasing the Lambda function timeout (option C) allows the function more time to complete processing of SQS messages, directly addressing timeout errors. Increasing memory allocation (option D) also increases CPU and network throughput, which can speed up execution and prevent timeouts. Option A (increasing batch size) would process more messages per invocation, potentially worsening timeouts.

Option B (enabling SQS encryption) does not affect timeout. Option E (decreasing visibility timeout) would cause messages to reappear in the queue sooner, which does not resolve the Lambda timeout issue.

799
MCQeasy

Refer to the exhibit. A company runs this CLI command and sees the output. Which account is the management account?

A.333333333333
B.222222222222
C.o-example1
D.111111111111
AnswerD

The management account is the one that created the organization; it is typically the first account.

Why this answer

The management account in AWS Organizations is the account that created the organization and has the ID displayed in the `management-account-id` field of the `aws organizations describe-organization` output. In the exhibit, this field shows `111111111111`, making option D correct.

Exam trap

The trap here is that candidates confuse the organization ID (starting with 'o-') or member account IDs with the management account ID, because the output lists multiple IDs without clearly labeling which one is the management account unless you read the `management-account-id` field carefully.

How to eliminate wrong answers

Option A is wrong because `333333333333` is listed as a member account ID in the `accounts` array, not the management account. Option B is wrong because `222222222222` is also a member account ID in the `accounts` array, not the management account. Option C is wrong because `o-example1` is the organization ID (a string starting with 'o-'), not an AWS account ID.

800
MCQhard

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. What is the MOST scalable and efficient way to enforce this policy?

A.Use an AWS Lambda function that runs periodically across all accounts to check and remediate buckets.
B.Use an SCP that denies s3:PutBucketEncryption actions unless the encryption is set to aws:kms.
C.Use AWS Config rules in each account to detect unencrypted buckets and trigger auto-remediation.
D.Use AWS CloudTrail to monitor PutBucketEncryption calls and alert the security team.
AnswerB

SCPs can prevent the creation of non-compliant buckets across all accounts in the organization.

Why this answer

Using a service control policy (SCP) that denies s3:PutBucketEncryption unless the encryption is set to aws:kms is the most scalable and efficient way to enforce encryption across all accounts in an AWS Organization. SCPs are applied centrally and affect all accounts without requiring per-account configuration. Option A is less scalable because a periodic Lambda function may have delays and requires managing cross-account roles.

Option C is per-account and requires Config rules and remediation in each account, which is less efficient. Option D only provides monitoring and alerting, not enforcement.

801
MCQmedium

A company is designing a new application that will be deployed on Amazon ECS with Fargate launch type. The application needs to store configuration data, including database connection strings, that must be encrypted at rest. The company wants to follow best practices for managing secrets. Which solution should the company use?

A.Store the secrets in AWS Secrets Manager and reference them in the ECS task definition.
B.Store the configuration data in an S3 bucket with server-side encryption (SSE-S3) and download it at container startup.
C.Store the secrets in AWS Systems Manager Parameter Store (SecureString) and reference them in the ECS task definition.
D.Store the configuration data in environment variables in the ECS task definition.
AnswerA

Secrets Manager provides encryption, rotation, and ECS integration.

Why this answer

AWS Secrets Manager is the recommended service for storing sensitive configuration data like database connection strings because it provides built-in encryption at rest using AWS KMS, automatic secret rotation, and fine-grained access control. ECS task definitions can reference Secrets Manager secrets directly using the 'secrets' parameter, which injects the secret value into the container at runtime without exposing it in plaintext. This approach follows AWS best practices for managing secrets by avoiding hard-coded values and leveraging a dedicated secrets management service.

Exam trap

The trap here is that candidates often choose Systems Manager Parameter Store (Option C) because it is cheaper and also supports SecureString, but they overlook that AWS Secrets Manager is the specifically recommended service for secrets that require rotation and tighter integration with ECS, especially for database credentials.

How to eliminate wrong answers

Option B is wrong because storing configuration data in an S3 bucket with SSE-S3 requires the container to download the file at startup, which introduces complexity, potential exposure of the bucket or object, and lacks native integration with ECS task definitions for secure injection. Option C is wrong because while Systems Manager Parameter Store (SecureString) can store secrets, it does not support automatic secret rotation natively (unlike Secrets Manager), and AWS best practices recommend Secrets Manager for database credentials and other secrets that require rotation. Option D is wrong because storing secrets in environment variables in the ECS task definition exposes them in plaintext in the task definition and container metadata, violating security best practices for secret management.

802
MCQhard

A company is modernizing a legacy Java application to run on AWS. The application currently uses a monolithic architecture with a shared MySQL database. The company wants to adopt a microservices architecture using containers and wants to decouple the database. The solutions architect proposes using Amazon ECS with Fargate for compute and Amazon RDS for MySQL for the database. However, during the transition, the performance team notices that the database CPU utilization is consistently above 80% during peak hours. The application logs show many slow queries. The team suspects that the database is the bottleneck. The company wants to improve performance without rewriting the application. Which action should the solutions architect take first?

A.Enable Amazon RDS Performance Insights to identify the most resource-intensive queries.
B.Add an RDS read replica and direct read traffic to it.
C.Scale up the RDS instance to a larger instance type.
D.Migrate the database to Amazon DynamoDB to eliminate relational bottlenecks.
AnswerA

First step: diagnose the problem.

Why this answer

The first step to address the database bottleneck is to identify the root cause of the slow queries. Enabling Amazon RDS Performance Insights provides detailed visibility into query performance, allowing the team to pinpoint the most resource-intensive queries and their execution plans. This diagnostic information guides further optimization efforts (e.g., indexing, query rewriting, or schema changes) without requiring application code changes.

Options B and C are premature without understanding which queries are problematic; a read replica would not help if the bottleneck is write-heavy or if reads are already well-distributed, and scaling up may only mask the issue. Option D would require significant application rewriting, which contradicts the requirement to improve performance without rewriting the application.

803
MCQmedium

A company is migrating its on-premises PostgreSQL database to Amazon Aurora PostgreSQL. The database is 2 TB in size and has a 24-hour maintenance window on weekends. The company needs to minimize downtime and ensure data consistency. Which strategy should the solutions architect recommend?

A.Create an Aurora read replica from the on-premises database using a VPN connection.
B.Use AWS DMS with ongoing replication from the on-premises database to Aurora, then perform a cutover during the maintenance window.
C.Use AWS Schema Conversion Tool (AWS SCT) to convert the schema and then use AWS Database Migration Service (AWS DMS) with full load only.
D.Perform a full pg_dump of the on-premises database and restore it to Aurora using pg_restore.
AnswerB

Ongoing replication keeps data in sync with minimal downtime during cutover, leveraging the maintenance window.

Why this answer

AWS DMS with ongoing replication (change data capture, CDC) allows the on-premises PostgreSQL database to be continuously synchronized with the target Aurora PostgreSQL cluster, minimizing downtime. When the cutover is performed during the 24-hour maintenance window, data consistency is ensured because all changes up to that point have been replicated. This approach avoids the need for a lengthy full database dump and restore, which would cause extended downtime.

Exam trap

The trap here is that candidates often assume a full dump and restore (pg_dump/pg_restore) is the simplest approach, but they overlook the massive downtime it requires for a 2 TB database, whereas DMS with CDC is designed specifically to minimize downtime for large-scale migrations.

How to eliminate wrong answers

Option A is wrong because Aurora read replicas can only be created from an existing Aurora DB cluster, not from an on-premises database; a VPN connection alone does not enable this replication. Option C is wrong because AWS SCT is used for schema conversion (not needed here since both are PostgreSQL), and a full-load-only DMS task would not capture ongoing changes, leading to data inconsistency and longer downtime. Option D is wrong because performing a full pg_dump and pg_restore would require the on-premises database to be offline for the duration of the dump and restore, causing significant downtime that exceeds the maintenance window.

804
MCQhard

A company has a legacy application that runs on a single EC2 instance. The application stores data on an attached EBS volume. The company wants to improve availability and reduce the recovery time objective (RTO) in case of instance failure. What should the company do?

A.Create an Auto Scaling group with a minimum of 2 instances across multiple Availability Zones and use a load balancer.
B.Take frequent EBS snapshots and automate the creation of a new instance from the latest snapshot.
C.Configure the EBS volume as a Multi-Attach volume and attach it to a standby instance.
D.Convert the instance to an AMI and launch a new instance from that AMI in a different Availability Zone.
AnswerA

An Auto Scaling group with a minimum of 2 instances across multiple Availability Zones and a load balancer provides automatic failover and load distribution, reducing recovery time and improving availability.

Why this answer

An Auto Scaling group with a minimum of two instances across multiple Availability Zones combined with a load balancer provides high availability and automatic failover, reducing RTO significantly. Option B is wrong: while EBS snapshots are useful for backups, restoring from a snapshot to create a new instance involves manual steps and can take minutes, not improving RTO adequately. Option C is wrong: Multi-Attach EBS volumes are for specific clustered applications (e.g., Windows Server Failover Clustering) and not all applications support it; also, it does not provide automatic failover.

Option D is wrong: converting to an AMI and launching in another AZ requires manual intervention and does not ensure rapid recovery; it's a migration step, not an availability solution.

805
MCQmedium

A company is migrating a legacy application to AWS. The application has hardcoded IP addresses and uses non-HTTP protocols. The solutions architect needs to minimize changes to the application code. Which migration pattern should be used?

A.Use AWS Global Accelerator to assign static IP addresses.
B.Containerize the application and use service discovery.
C.Rehost the application on EC2 instances with the same IP addresses using Elastic IPs.
D.Refactor the application to use DNS names instead of IP addresses.
AnswerC

Rehosting (lift-and-shift) on EC2 instances with Elastic IPs allows the application to retain the same IP addresses, minimizing code changes.

Why this answer

Rehosting (lift-and-shift) with EC2 instances and Elastic IPs allows the application to retain its hardcoded IP addresses with minimal code changes. Option A is wrong because AWS Global Accelerator provides static IP addresses for front-end traffic, but the application's hardcoded IPs are internal; changing to use Global Accelerator still requires code modifications. Option B is wrong because containerization and service discovery require code changes to integrate with service discovery.

Option D is wrong because refactoring to use DNS names requires modifying the application code.

806
MCQmedium

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared file system for storing user uploads. The solution architect needs to design a highly available and scalable storage solution that supports concurrent read/write operations from multiple EC2 instances. Which AWS service should be used?

A.Amazon FSx for Windows File Server
B.Amazon S3 with S3 File Gateway
C.Amazon EFS
D.Amazon EBS with Multi-Attach enabled
AnswerC

EFS provides a scalable, shared file system accessible from multiple EC2 instances.

Why this answer

Amazon EFS provides a fully managed, elastic NFS file system that supports concurrent read/write access from thousands of EC2 instances across multiple Availability Zones. It is designed for high availability and scalability, automatically growing and shrinking as files are added or removed, making it ideal for a shared file system for user uploads in a migrated monolithic application.

Exam trap

The trap here is that candidates often confuse Amazon EBS Multi-Attach with a true shared file system, overlooking its single-AZ limitation and the need for a cluster-aware file system, or they mistakenly choose S3 File Gateway thinking it provides native file system semantics, when in fact it adds latency and complexity for concurrent write workloads.

How to eliminate wrong answers

Option A is wrong because Amazon FSx for Windows File Server is optimized for Windows-based workloads requiring SMB protocol support and Active Directory integration, not for general-purpose Linux-based concurrent access from multiple EC2 instances. Option B is wrong because Amazon S3 with S3 File Gateway presents an NFS or SMB mount point backed by S3, but it introduces latency and caching complexity, and S3 itself is an object store, not a POSIX-compliant file system suitable for concurrent read/write locking. Option D is wrong because Amazon EBS with Multi-Attach enabled supports only up to 16 Nitro-based EC2 instances in a single Availability Zone, lacks cross-AZ high availability, and does not provide a shared file system interface (it is a block-level device requiring a cluster-aware file system).

807
MCQhard

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. They need to ensure that the application can handle sudden spikes in traffic without throttling. Which design should they implement?

A.Use Lambda provisioned concurrency and an API Gateway usage plan.
B.Enable DynamoDB auto scaling and configure Lambda function reserved concurrency.
C.Configure Lambda function reserved concurrency and an API Gateway cache.
D.Use DynamoDB Accelerator (DAX) and Lambda function reserved concurrency.
AnswerB

Auto scaling handles throughput spikes; reserved concurrency prevents throttling of the function.

Why this answer

Enabling DynamoDB auto scaling automatically adjusts read/write capacity to handle traffic spikes, while configuring Lambda reserved concurrency ensures that the function has a guaranteed pool of concurrency available, preventing throttling from other functions. Option A (Lambda provisioned concurrency) reduces cold starts but does not prevent throttling; API Gateway usage plans control client access rates but do not handle backend spikes. Option C (reserved concurrency) alone prevents other functions from using concurrency but does not address DynamoDB throttling; API Gateway cache reduces read load but not write spikes.

Option D (DAX) is a caching layer for DynamoDB reads, not a scaling mechanism for traffic spikes.

808
MCQhard

A company is migrating a legacy API to Amazon API Gateway and Lambda. The API currently uses long-polling to retrieve messages from a queue. The migration must maintain the same client behavior. Which AWS service should replace the long-polling mechanism?

A.Use Amazon SQS with long polling enabled.
B.Use Amazon Kinesis Data Streams with enhanced fan-out.
C.Use Amazon MQ (ActiveMQ) with STOMP protocol.
D.Use API Gateway WebSocket APIs to maintain persistent connections.
AnswerD

WebSocket APIs allow persistent connections, replacing long-polling.

Why this answer

API Gateway WebSocket APIs enable persistent, bidirectional communication between client and server, allowing the server to push messages to clients without polling. This matches the client's existing long-polling behavior by providing a real-time, event-driven mechanism. Option A (SQS with long polling) still requires the client to poll, which does not eliminate the polling overhead.

Option B (Kinesis Data Streams with enhanced fan-out) is designed for streaming data and does not offer a direct polling replacement. Option C (Amazon MQ with STOMP) is a managed message broker but still relies on client-initiated connections or polling, not persistent server-push.

809
MCQmedium

A company is designing a new microservices architecture using AWS Lambda. Each microservice has its own database. The company wants to securely store database credentials and rotate them automatically. Which AWS service should be used?

A.AWS Key Management Service (KMS)
B.AWS Systems Manager Parameter Store
C.AWS Identity and Access Management (IAM)
D.AWS Secrets Manager
AnswerD

Secrets Manager supports automatic rotation.

Why this answer

AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like Amazon RDS, Redshift, and DocumentDB. It supports built-in rotation with AWS Lambda, ensuring credentials are rotated on a schedule without manual intervention, which directly meets the requirement for automatic rotation in a microservices architecture.

Exam trap

The trap here is that candidates often confuse Parameter Store's secure string parameter with Secrets Manager, but Parameter Store lacks native automatic rotation, which is the critical requirement in this question.

How to eliminate wrong answers

Option A is wrong because AWS KMS is a key management service for encryption keys, not for storing or rotating secrets like database credentials; it can encrypt secrets but does not manage rotation. Option B is wrong because AWS Systems Manager Parameter Store can store secrets but lacks native automatic rotation capabilities—it requires custom solutions or integration with Secrets Manager for rotation. Option C is wrong because IAM is used for access control and permissions, not for storing secrets or rotating credentials; it cannot store database passwords or manage their lifecycle.

810
MCQmedium

A company is designing a data lake on Amazon S3. The data will be ingested from various sources, including streaming data from IoT devices. The data must be processed in near real-time to derive insights. The company wants to use serverless technologies to minimize operational overhead. Which combination of services should the company use?

A.AWS Lambda, Amazon DynamoDB Streams, and Amazon S3.
B.Amazon Kinesis Data Streams, Amazon Kinesis Data Analytics, and Amazon Kinesis Data Firehose.
C.Amazon SQS, AWS Lambda, and Amazon S3.
D.Amazon Kinesis Data Firehose, AWS Glue, and Amazon S3.
AnswerB

Kinesis Data Streams ingests streaming data, Kinesis Data Analytics processes it in real-time, and Firehose loads it into S3.

Why this answer

Amazon Kinesis Data Streams ingests and stores streaming IoT data durably, Amazon Kinesis Data Analytics performs near real-time processing using SQL or Apache Flink, and Amazon Kinesis Data Firehose delivers the processed data to Amazon S3 for the data lake. This combination is fully serverless, scales automatically, and meets the near real-time requirement without managing any infrastructure.

Exam trap

The trap here is that candidates often confuse batch ETL (AWS Glue) or simple message queuing (SQS) with true streaming analytics, missing that Kinesis Data Analytics is the only option that provides native, serverless, near real-time stream processing with stateful operations like windowing and aggregations.

How to eliminate wrong answers

Option A is wrong because DynamoDB Streams is designed for change data capture from DynamoDB tables, not for ingesting high-throughput streaming data from IoT devices; it lacks the buffering, fan-out, and analytics capabilities needed for near real-time processing. Option C is wrong because Amazon SQS is a message queue for decoupling applications, not a streaming ingestion service; it does not support ordered, replayable, or near real-time analytics on continuous data streams. Option D is wrong because Amazon Kinesis Data Firehose alone cannot perform near real-time analytics—it is a delivery service that can only apply simple transformations (e.g., Lambda) but lacks native stream processing with windowing, aggregations, or joins; AWS Glue is a batch ETL service, not a streaming analytics engine.

811
MCQhard

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts in AWS Organizations. The logs are stored in Amazon S3. The security team needs to query these logs for specific IP addresses and time ranges. Which solution is MOST cost-effective and scalable?

A.Use Amazon Athena to query the logs directly in S3.
B.Use Amazon S3 Select to retrieve only the relevant log entries based on the IP address and time range.
C.Stream the logs to Amazon OpenSearch Service for real-time querying.
D.Use AWS Glue to catalog the logs and query with Amazon Redshift Spectrum.
AnswerB

S3 Select filters server-side and only returns matching data, minimizing data transfer and cost.

Why this answer

Amazon S3 Select allows you to retrieve only a subset of data from an object using SQL expressions, making it highly cost-effective for scanning large log files for specific IP addresses and time ranges. It reduces the amount of data transferred and processed compared to reading the entire object, and it scales automatically without provisioning any infrastructure. This approach is ideal for ad-hoc queries on structured or semi-structured log data stored in S3.

Exam trap

The trap here is that candidates often assume Athena is the default choice for querying S3 logs, overlooking that S3 Select is more cost-effective for simple, selective row retrieval from individual objects without the need for a full SQL engine or schema-on-read overhead.

How to eliminate wrong answers

Option A is wrong because Amazon Athena would require scanning the entire dataset (or using partitions) and incurs costs based on the amount of data scanned per query, which is less cost-effective than S3 Select for simple filtering on individual objects. Option C is wrong because streaming logs to Amazon OpenSearch Service involves ongoing ingestion costs, cluster management overhead, and is not as cost-effective for infrequent, ad-hoc queries on historical log data. Option D is wrong because AWS Glue and Redshift Spectrum introduce additional complexity and cost for cataloging and querying, and are overkill for simple IP and time-range filtering on log files that can be handled directly with S3 Select.

812
MCQhard

A company is designing a multi-region active-active application that uses Amazon DynamoDB global tables. The application must be able to handle write conflicts that may occur when the same item is updated in two different regions at the same time. The company needs to ensure that the application uses the most recently written data. What should the architect recommend?

A.Use the default last writer wins conflict resolution
B.Use optimistic locking with a version number
C.Use DynamoDB Streams to capture changes and reconcile conflicts
D.Use conditional writes to prevent overwrites
AnswerA

DynamoDB global tables use LWW based on a timestamp attribute to ensure the most recently written data is kept.

Why this answer

Amazon DynamoDB global tables use a last writer wins (LWW) conflict resolution mechanism based on the timestamp of the update. When concurrent updates to the same item occur in different regions, DynamoDB automatically compares the update timestamps and retains the most recently written data. This satisfies the requirement to use the most recently written data without requiring custom reconciliation logic.

Exam trap

The trap here is that candidates often overthink conflict resolution and choose complex options like streams or optimistic locking, not realizing that DynamoDB global tables already handle this automatically with LWW, which is the simplest and most appropriate solution for ensuring the most recently written data is used.

How to eliminate wrong answers

Option B is wrong because optimistic locking with a version number prevents overwrites by rejecting stale updates, but it does not resolve conflicts by keeping the most recent write; it would cause writes to fail instead of automatically selecting the latest data. Option C is wrong because DynamoDB Streams can capture changes but do not provide built-in conflict resolution; using streams to reconcile conflicts would require custom application logic and would not automatically ensure the most recently written data is used. Option D is wrong because conditional writes prevent overwrites when a condition is not met, which would cause write failures rather than resolving conflicts by keeping the latest write.

813
MCQmedium

A company uses AWS Organizations with multiple accounts. They want to centralize VPC flow logs for all VPCs across accounts. The logs should be stored in a central S3 bucket in the management account. What is the MOST efficient way to achieve this?

A.Use a bucket policy on the central S3 bucket to allow cross-account delivery from all accounts.
B.Enable VPC flow logs at the organization level using CloudTrail.
C.Create a flow log in each account and configure it to deliver to a central S3 bucket.
D.Use CloudWatch Logs in each account and stream to a central log group.
AnswerA

Bucket policy allows any account to deliver logs to that bucket.

Why this answer

A bucket policy on the central S3 bucket can grant the necessary permissions for VPC Flow Logs from any account in the organization to be delivered directly to that bucket. This approach avoids the overhead of managing individual delivery configurations and leverages AWS Organizations to simplify cross-account permissions, making it the most efficient centralized solution.

Exam trap

The trap here is that candidates often assume VPC Flow Logs must be delivered via CloudWatch Logs first, or that CloudTrail can manage flow logs, when in fact S3 bucket policies with organization-level conditions provide a direct and scalable solution.

How to eliminate wrong answers

Option B is wrong because VPC Flow Logs cannot be enabled at the organization level; CloudTrail is used for API activity logging, not for VPC Flow Logs, and it does not support organization-wide flow log creation. Option C is wrong because while creating a flow log in each account and delivering to a central bucket is possible, it is less efficient than using a bucket policy because it requires manual configuration in every account and does not leverage Organizations for centralized management. Option D is wrong because streaming CloudWatch Logs to a central log group adds unnecessary complexity and cost, and it does not directly store logs in an S3 bucket as required.

814
MCQhard

A company is migrating a critical application to AWS and needs to ensure it meets a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. The application runs on EC2 with an EBS volume. Which configuration should the company use?

A.Multi-AZ deployment with synchronous replication between two instances.
B.Single EC2 instance with EBS snapshots every 5 minutes.
C.Two EC2 instances in an Auto Scaling group with a warm standby.
D.EC2 instance with Elastic Disaster Recovery service.
AnswerD

Correct. AWS Elastic Disaster Recovery provides continuous replication with low RPO and fast recovery, meeting the 15-minute RTO and 5-minute RPO requirements.

Why this answer

AWS Elastic Disaster Recovery (AWS DRS) provides continuous replication with near-zero RPO (typically seconds) and can meet an RTO of minutes. For an EC2 instance with an EBS volume, DRS replicates the entire server and enables rapid recovery in the same AWS Region or another Region, achieving the required 15-minute RTO and 5-minute RPO. Option A is incorrect because standard EC2 instances do not support synchronous replication between two instances—Multi-AZ is a feature of managed services like RDS, not for general EC2/EBS.

Option B is wrong because EBS snapshots taken every 5 minutes achieve a 5-minute RPO, but restoring from a snapshot takes longer than 15 minutes, failing the RTO. Option C is wrong because an Auto Scaling group with warm standby does not guarantee stateful synchronous replication, and recovery time may exceed 15 minutes without additional orchestration.

Exam trap

The trap is assuming that Multi-AZ synchronous replication is available for standard EC2 instances with EBS volumes. It is not—Multi-AZ is specific to managed database services like RDS. For EC2 disaster recovery, AWS Elastic Disaster Recovery is the correct service.

815
MCQhard

A company is using a multi-account strategy with AWS Organizations. The security team discovers that an SCP intended to block access to non-compliant AWS regions is not working. The SCP is attached to the root OU. When a user in a member account attempts to launch an EC2 instance in a blocked region, the request succeeds. What is the most likely cause?

A.The IAM policy of the user overrides the SCP.
B.The SCP is not attached to the member account's OU.
C.The SCP is missing an explicit allow statement for the regions.
D.The user belongs to the management account, and SCPs do not apply to the management account.
AnswerD

SCPs do not affect the management account.

Why this answer

SCPs do not apply to the management account of an AWS Organizations hierarchy. Since the user belongs to the management account, the SCP attached to the root OU has no effect on their actions, allowing the EC2 launch in a blocked region to succeed.

Exam trap

The trap here is that candidates assume SCPs apply to all accounts in the organization, forgetting the explicit exemption for the management account, which is a common oversight in multi-account security scenarios.

How to eliminate wrong answers

Option A is wrong because IAM policies cannot override SCPs; SCPs set the maximum permissions boundary, and any action denied by an SCP cannot be allowed by an IAM policy. Option B is wrong because the SCP is attached to the root OU, which applies to all member accounts and OUs under it, so the member account's OU is already covered. Option C is wrong because SCPs use an implicit deny by default; an explicit allow is not required for regions not blocked—only an explicit deny is needed to block them.

816
MCQhard

A company runs a high-traffic web application on EC2 instances in an Auto Scaling group. The application uses a Redis cluster for caching. Recently, they have noticed that the cache hit ratio has dropped significantly, causing increased load on the database. The operations team observed that the Redis cluster's CPU utilization is high and memory usage is near capacity. They need to improve the cache performance with minimal changes to the application code. What should a solutions architect recommend?

A.Migrate from ElastiCache to Amazon MemoryDB for Redis.
B.Upgrade the Redis cluster to a larger node type with more CPU and memory.
C.Increase the TTL values for cached objects in the application.
D.Enable encryption in transit for the Redis cluster.
AnswerB

More resources directly improve performance and cache hit ratio.

Why this answer

Upgrading to a larger node type provides more CPU and memory, directly addressing the high utilization and capacity issues without requiring application code changes. Option A is incorrect because migrating to MemoryDB for Redis does not solve the immediate capacity problem and introduces unnecessary complexity. Option C is incorrect because increasing TTL values may reduce cache churn but does not increase the available CPU or memory.

Option D is incorrect because enabling encryption in transit adds overhead and does not resolve the capacity or performance issues.

817
MCQhard

Refer to the exhibit. An architect is troubleshooting an EC2 instance that is not responding to health checks from an Application Load Balancer. The instance is in the 'running' state. Which of the following is the most likely cause?

A.The security group is blocking the health check traffic.
B.The instance is in a stopped state.
C.The instance is impaired due to an AWS issue.
D.The instance has exhausted its CPU credits.
AnswerA

A misconfigured security group can block health checks even if the instance is running.

Why this answer

The most likely cause for a running EC2 instance not responding to ALB health checks is that the security group associated with the instance is not allowing incoming health check traffic from the ALB. Option B is incorrect because the instance is in the 'running' state, not stopped. Option C is incorrect because if the instance were impaired due to an AWS issue, its status checks would fail, but the instance is running.

Option D is incorrect because CPU credits affect performance but do not prevent the instance from responding to health checks; the instance would still respond even with low CPU credits.

818
MCQmedium

A company is running a stateful web application on EC2 instances in an Auto Scaling group. Users report that their sessions are lost when instances are terminated during scale-in. What should a solutions architect do to preserve session state?

A.Use lifecycle hooks to save session data to Amazon S3 before instance termination.
B.Enable sticky sessions (session affinity) on the Application Load Balancer.
C.Store session state in Amazon ElastiCache.
D.Increase the Auto Scaling group's cooldown period to prevent rapid scaling.
AnswerC

ElastiCache provides a durable, shared session store independent of EC2 instances.

Why this answer

ElastiCache provides a centralized, fast session store that persists across instance terminations, ensuring session state is retained even when instances are scaled in. Option A is wrong because using lifecycle hooks to save session data to Amazon S3 is unreliable due to the high latency and the risk that the termination process may not complete the save in time. Option B is wrong because sticky sessions (session affinity) on the Application Load Balancer can cause uneven load distribution and still result in session loss if all instances in a target group are replaced or if the specific instance with the session is terminated.

Option D is wrong because increasing the Auto Scaling group's cooldown period only delays the next scaling activity but does not preserve session state when instances are eventually terminated.

819
MCQhard

A company runs a data processing application on EC2 instances that read from an Amazon SQS queue. The application processes each message in about 2 seconds. The company expects a sudden spike in messages and wants to minimize processing latency. Which configuration will handle the spike most cost-effectively?

A.Replace the EC2 instances with AWS Lambda functions that are triggered by SQS events.
B.Increase the EC2 instance size to handle more messages per instance.
C.Increase the Auto Scaling group's desired capacity to a higher fixed value during the expected spike.
D.Use Auto Scaling with a step scaling policy based on the SQS queue depth.
AnswerA

Lambda scales automatically with the number of messages and is cost-effective for variable loads.

Why this answer

Using Lambda functions triggered by SQS events provides automatic scaling to handle sudden spikes in message volume without requiring provisioning or managing EC2 instances. Lambda scales instantly based on the number of messages in the queue, and you pay only for compute time used, making it the most cost-effective solution for variable workloads. Option B is incorrect because increasing instance size is less cost-effective and still requires manual scaling.

Option C is incorrect because a fixed desired capacity may lead to over-provisioning or under-provisioning during the spike. Option D is incorrect because step scaling based on queue depth introduces latency as it takes time to launch new instances, whereas Lambda reacts immediately per message.

820
MCQhard

A company uses cross-account S3 access. The above IAM policy is attached to an IAM user in Account A. The user tries to upload an object to a bucket in Account B, but the upload fails. What is the MOST likely reason?

A.The upload request does not include the 'x-amz-acl' header with value 'bucket-owner-full-control'.
B.The resource ARN in the policy is incorrect; it should include the bucket name only.
C.The bucket policy in Account B denies the upload.
D.The IAM user does not have permission to call s3:PutObject.
AnswerA

The condition requires that header to be set.

Why this answer

The policy explicitly requires the 'x-amz-acl: bucket-owner-full-control' condition. If the upload request does not include this header, the request fails. Options B, C, and D are incorrect: the resource ARN is correct (includes bucket and object), the bucket policy is not shown but the IAM policy is the issue, and the IAM user does have s3:PutObject permission as stated in the policy.

821
MCQhard

A company uses AWS Organizations with 50 accounts. The central IT team wants to deploy a CloudFormation stack set to create a VPC with a CIDR of 10.0.0.0/16 in each account, but the VPC CIDR must not overlap with existing VPCs in each account. What is the most scalable and automated approach?

A.Use AWS Service Catalog to create a product that deploys the VPC, and share the portfolio with each account.
B.Create a StackSet that references an Amazon S3 bucket containing a JSON file with account-specific parameters, including unique CIDR blocks for each account.
C.Write a custom AWS Lambda function that iterates through each account and deploys the CloudFormation template with a different CIDR.
D.Create a StackSet with a single parameter for the CIDR block and deploy it to all accounts.
AnswerB

This allows each account to have a unique CIDR without manual intervention.

Why this answer

CloudFormation StackSets can reference an Amazon S3 bucket containing a JSON file with account-specific parameters, allowing each account to receive a unique, non-overlapping CIDR block. This approach is fully automated, scalable to 50 accounts, and avoids manual parameter entry or custom code maintenance.

Exam trap

The trap here is that candidates may choose Option D (single parameter StackSet) thinking it is simpler, but they overlook the requirement for unique, non-overlapping CIDRs per account, which a single parameter cannot achieve.

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog portfolios require manual sharing and product launch per account, which is not scalable or automated for 50 accounts, and it does not inherently prevent CIDR overlap. Option C is wrong because writing a custom Lambda function to iterate accounts and deploy CloudFormation templates is less scalable and introduces operational overhead for error handling, retries, and state management compared to a native StackSet solution. Option D is wrong because a StackSet with a single CIDR parameter would deploy the same CIDR block to all accounts, causing overlap with existing VPCs and violating the non-overlap requirement.

822
MCQeasy

A company wants to store application logs in Amazon S3 with a lifecycle policy that moves objects to S3 Glacier Instant Retrieval after 30 days and deletes them after 1 year. The logs are accessed frequently in the first 30 days but rarely after. Which storage class should the company use for the first 30 days?

A.S3 Standard
B.S3 Standard-IA
C.S3 One Zone-IA
D.S3 Glacier Flexible Retrieval
AnswerA

S3 Standard is appropriate for frequently accessed data. It has no retrieval fees, making it cost-effective for logs accessed multiple times in the first 30 days. The lifecycle transition to Glacier Instant Retrieval after 30 days is seamless.

Why this answer

S3 Standard is the correct choice because the logs are accessed frequently during the first 30 days. Standard provides low-latency access with no retrieval fees, and the lifecycle policy can transition objects to S3 Glacier Instant Retrieval after 30 days. For data that is accessed multiple times within a short retention period, Standard is more cost-effective than Standard-IA, which incurs retrieval fees and a 30-day minimum storage charge.

Exam trap

The common trap is selecting S3 Standard-IA (Option B) due to its lower storage cost, but failing to account for retrieval fees and the 30-day minimum charge. For frequently accessed data with short retention, S3 Standard is more cost-effective.

How to eliminate wrong answers

Option A (S3 Standard) is wrong because it is designed for frequently accessed data with no cost savings for infrequent access patterns; using it for the first 30 days would incur higher storage costs than necessary since the logs are not accessed constantly. Option C (S3 One Zone-IA) is wrong because it stores data in a single Availability Zone, which does not provide the durability and availability required for application logs that may need to be recovered after a zone failure; the question does not indicate tolerance for such risk. Option D (S3 Glacier Flexible Retrieval) is wrong because it is intended for long-term archival with retrieval times ranging from minutes to hours, not for data that is accessed frequently within the first 30 days; it would introduce unacceptable latency for the initial frequent access pattern.

823
Multi-Selectmedium

A company wants to implement a data perimeter to ensure that only authorized accounts can access their S3 buckets. Which TWO steps should they take?

Select 2 answers
A.Use SCPs to deny access from external accounts.
B.Use VPC endpoints with bucket policies.
C.Use S3 bucket policy with aws:SourceAccount condition.
D.Enable CloudTrail to log access.
E.Use AWS Network Firewall.
AnswersA, C

Prevents access from accounts outside organization.

Why this answer

SCPs can deny access from external accounts, limiting S3 bucket access to authorized accounts. Option C is correct because S3 bucket policy with aws:SourceAccount condition restricts access to specific AWS accounts. Options B, D, and E are incorrect: B (VPC endpoints with bucket policies) controls network-level access but not account-level; D (CloudTrail logging) only logs access, does not enforce perimeter; E (AWS Network Firewall) is for network traffic inspection, not account-based control.

824
MCQmedium

A company has multiple AWS accounts and wants to use AWS CloudFormation StackSets to deploy a common set of resources across all accounts. The StackSet should be managed from the management account. What permissions are required?

A.Create IAM users in target accounts with AdministratorAccess.
B.Create an IAM role in each target account with a trust policy allowing the management account to assume it.
C.Use a CloudFormation service role in the management account.
D.Apply an SCP to allow CloudFormation actions across accounts.
AnswerB

StackSets assume this role to deploy resources.

Why this answer

AWS CloudFormation StackSets require the management account to assume an IAM role in each target account to deploy resources. This role must have a trust policy that allows the management account's StackSets service-linked role (or a custom role) to assume it, granting the necessary permissions to create, update, or delete stack instances across accounts. Without this cross-account trust relationship, StackSets cannot perform operations in target accounts.

Exam trap

The trap here is that candidates often confuse a CloudFormation service role (used for stack operations within a single account) with the cross-account IAM roles required by StackSets, leading them to select Option C.

How to eliminate wrong answers

Option A is wrong because creating IAM users with AdministratorAccess in target accounts is not required and violates security best practices; StackSets use IAM roles, not users, for cross-account access. Option C is wrong because a CloudFormation service role in the management account only governs permissions within that account, not across target accounts; StackSets need roles in each target account. Option D is wrong because SCPs (Service Control Policies) are used to restrict permissions at the organizational unit or account level, but they do not grant the necessary cross-account trust or permissions for StackSets to assume roles; SCPs can only deny or allow actions, not establish trust relationships.

825
MCQhard

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

A.Create a Lambda function in each account that periodically checks Config rules and triggers remediation
B.Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions
C.Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts
D.Use AWS Organizations service control policies to automatically remediate non-compliant resources
AnswerC

This leverages Config's built-in remediation and provides centralized monitoring.

Why this answer

It leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.

Exam trap

The trap here is that candidates often confuse AWS Config's automatic remediation with custom event-driven approaches (like Lambda or CloudWatch Events) or mistakenly think SCPs can remediate resources, when in fact SCPs only prevent non-compliant actions from being taken, not fix existing non-compliant resources.

How to eliminate wrong answers

Option A is wrong because periodically checking Config rules with a Lambda function introduces latency and inefficiency, as it relies on polling rather than event-driven detection, and it requires managing Lambda functions in every account, which is less scalable and secure than using native Config remediation. Option B is wrong because while CloudWatch Events (now Amazon EventBridge) can detect compliance changes, invoking a Lambda function for remediation adds unnecessary complexity and custom code, whereas AWS Config's built-in automatic remediation is more direct and secure, eliminating the need for additional event processing. Option D is wrong because AWS Organizations service control policies (SCPs) are used to restrict permissions and enforce guardrails, not to automatically remediate non-compliant resources; SCPs cannot trigger remediation actions on existing resources.

Page 10

Page 11 of 23

Page 12