Knowledge + Practice

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 901–975

1660 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 13 of 23

901

MCQhard

A global company with a centralized IT team manages AWS resources across 50 accounts using AWS Control Tower. The team wants to deploy a new VPC with a specific CIDR block in each account in the same AWS Region. The VPC must have identical configuration across accounts. Which approach is the MOST efficient and meets the requirement?

A.Use AWS CloudFormation templates manually triggered in each account.

B.Create a VPC in one account and share it with other accounts using AWS Resource Access Manager (RAM).

C.Use AWS Control Tower account factory and AWS CloudFormation StackSets to deploy the VPC across all accounts.

D.Use AWS Organizations to create the VPC in each account via an SCP.

AnswerC

Control Tower account factory with StackSets automates deployment of identical resources across accounts.

Why this answer

AWS Control Tower's Account Factory combined with AWS CloudFormation StackSets enables automated, centralized deployment of identical VPC configurations across all 50 accounts in the same Region. StackSets allow you to deploy a CloudFormation template to multiple accounts and Regions from a single administrator account, ensuring consistency without manual intervention.

Exam trap

The trap here is confusing AWS Resource Access Manager (RAM) for creating separate VPCs in each account versus sharing a single VPC, and misunderstanding that SCPs only control permissions, not resource creation.

How to eliminate wrong answers

Option A is wrong because manually triggering CloudFormation templates in each account is inefficient, error-prone, and does not scale to 50 accounts, violating the 'most efficient' requirement. Option B is wrong because sharing a VPC via AWS Resource Access Manager (RAM) does not create a separate VPC in each account; it shares a single VPC, which does not meet the requirement of deploying a VPC in each account. Option D is wrong because AWS Organizations Service Control Policies (SCPs) are used to restrict permissions, not to create resources like VPCs; SCPs cannot deploy infrastructure.

Full explanation →

902

MCQmedium

A company is designing a new application that processes sensitive healthcare data. The application runs on Amazon ECS with Fargate and uses an Application Load Balancer. The company must ensure that all data in transit is encrypted. Which step should be taken?

A.Configure the target group to use HTTP protocol.

B.Configure the security group to only allow inbound traffic from approved IPs.

C.Use HTTP on port 80 and rely on VPC network ACLs.

D.Configure the ALB listener to use HTTPS (port 443) with an SSL certificate.

AnswerD

HTTPS encrypts traffic between client and ALB.

Why this answer

To encrypt data in transit between clients and the Application Load Balancer (ALB), you must configure the ALB listener to use HTTPS (port 443) with an SSL/TLS certificate. This ensures that all traffic between the client and the load balancer is encrypted using TLS, meeting the requirement for encrypted data in transit for sensitive healthcare data.

Exam trap

The trap here is that candidates often confuse network-level controls (security groups, NACLs) with encryption, or assume that using HTTP on the backend is sufficient, forgetting that the client-to-ALB leg must also be encrypted to satisfy 'data in transit' requirements.

How to eliminate wrong answers

Option A is wrong because configuring the target group to use HTTP protocol does not encrypt traffic between the client and the ALB; it only affects the backend connection, and the client-to-ALB leg remains unencrypted if the listener is HTTP. Option B is wrong because restricting inbound traffic to approved IPs controls network access but does not encrypt the data in transit; encryption requires TLS/SSL, not IP filtering. Option C is wrong because using HTTP on port 80 and relying on VPC network ACLs provides no encryption; network ACLs are stateless packet filters and do not provide any cryptographic protection for data in transit.

Full explanation →

903

MCQhard

A company is migrating a legacy on-premises application that uses a custom TCP protocol. The application needs to be accessible from the internet while maintaining security. Which AWS service should they use to expose the application without modifying the code?

A.Amazon CloudFront

B.Network Load Balancer (NLB)

C.Amazon API Gateway

D.Application Load Balancer (ALB)

AnswerB

NLB supports TCP traffic and preserves the protocol.

Why this answer

Network Load Balancer (NLB) because it operates at Layer 4 (TCP) and can handle custom TCP protocols without requiring application modifications. Option A (CloudFront) is a content delivery network that only supports HTTP/HTTPS. Option C (API Gateway) is designed for HTTP/HTTPS APIs and does not handle raw TCP traffic.

Option D (Application Load Balancer, ALB) operates at Layer 7 (HTTP/HTTPS) and cannot process custom TCP protocols.

Full explanation →

904

MCQmedium

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. After a recent deployment, users report intermittent timeouts. CloudWatch metrics show CPU utilization spikes to 90% before scaling out, but the new instances take 5 minutes to become healthy. What is the MOST effective solution to reduce timeouts during traffic spikes?

A.Use a scheduled scaling policy to add instances before expected peak times

B.Pre-warm the load balancer to reduce latency

C.Decrease the cooldown period and set a lower CPU utilization threshold for scale-out

D.Switch to predictive scaling

AnswerC

This triggers scale-out earlier and reduces the time to launch new instances.

Why this answer

By decreasing the cooldown period and lowering the CPU utilization threshold for scale-out, the Auto Scaling group reacts faster to rising CPU usage. The lower threshold triggers a scale-out action before CPU reaches 90%, and the reduced cooldown allows new instances to start sooner after the previous scaling activity. This addresses the 5-minute startup lag by ensuring new instances are launched earlier in the spike, reducing the window of timeouts.

Option A (scheduled scaling) only helps for predictable spikes, not intermittent ones. Option B (pre-warming the load balancer) is not a standard AWS feature and does not reduce instance startup time. Option D (predictive scaling) still has the same startup delay and requires historical data.

Full explanation →

905

MCQmedium

Refer to the exhibit. A company applies this SCP to an OU. However, users in the OU are still able to upload objects to S3 without encryption. What is the most likely reason?

A.The users are using SSE-S3 encryption (AES256).

B.The SCP is missing a Deny for s3:PutObject without any encryption header.

C.The users are using SSE-C encryption.

D.The users are uploading objects using the Multipart Upload API, which uses the s3:UploadPart action.

AnswerD

The SCP only denies s3:PutObject, not s3:UploadPart.

Why this answer

The SCP likely denies s3:PutObject unless encryption headers are present, but the Multipart Upload API uses the s3:UploadPart action for uploading individual parts. Since the SCP only denies s3:PutObject without encryption, the s3:UploadPart action is not covered, allowing unencrypted uploads via multipart uploads. This is why users can still upload objects without encryption despite the SCP.

Exam trap

The trap here is that candidates assume denying s3:PutObject without encryption covers all uploads, but they overlook that multipart uploads use the s3:UploadPart action, which is not affected by the s3:PutObject Deny.

How to eliminate wrong answers

Option A is wrong because SSE-S3 encryption (AES256) is a form of server-side encryption that would satisfy an encryption requirement; the SCP is intended to block unencrypted uploads, so using SSE-S3 would actually be compliant, not a reason for bypassing the policy. Option B is wrong because the SCP may already include a Deny for s3:PutObject without encryption headers; the issue is that the SCP does not cover the s3:UploadPart action used in multipart uploads. Option C is wrong because SSE-C encryption (customer-provided keys) also provides encryption and would satisfy an encryption requirement, so it would not allow unencrypted uploads; the problem is the action mismatch, not the encryption type.

Full explanation →

906

MCQmedium

A company has a multi-account AWS environment with a centralized security account. The security team needs to have read-only access to all Amazon S3 buckets across all accounts for auditing purposes. Which solution is the MOST secure and scalable?

A.Create an IAM role in each account with read-only S3 permissions and a trust policy that allows the security account to assume the role.

B.Attach a bucket policy to each S3 bucket that grants read-only access to the security team's IAM user in the security account.

C.Use the root user of each account to access the buckets.

D.Create an IAM user in each account with read-only S3 permissions and share the credentials with the security team.

AnswerA

This provides scalable and secure cross-account access.

Why this answer

It uses IAM roles with cross-account trust policies, which is the most secure and scalable approach for granting read-only S3 access across multiple accounts. The security account assumes the role in each target account, avoiding long-term credentials and allowing centralized control via AWS Organizations or manual role creation.

Exam trap

The trap here is that candidates may choose Option B thinking bucket policies are simpler, but they overlook the scalability and maintenance burden of managing individual bucket policies across hundreds or thousands of buckets, and the fact that bucket policies do not support cross-account access without explicitly listing the principal ARN, which is less flexible than IAM roles.

How to eliminate wrong answers

Option B is wrong because attaching bucket policies to each S3 bucket individually is not scalable for large environments and requires managing policies per bucket, which can lead to policy size limits and complexity. Option C is wrong because using root users violates the principle of least privilege, is not auditable, and is insecure due to shared static credentials. Option D is wrong because creating IAM users in each account with shared credentials introduces long-term access keys that must be rotated and managed, increasing security risk and operational overhead compared to role-based access.

Full explanation →

907

MCQhard

A company is migrating a 2 PB data lake from on-premises HDFS to Amazon S3. The data is in Parquet format and is accessed by Spark jobs. The migration must be completed within 30 days over a 1 Gbps network. Which approach minimizes cost and meets the deadline?

A.Use AWS DataSync over a Direct Connect connection.

B.Set up a VPN connection and use rsync to copy data to S3.

C.Use AWS Transfer Family to send data over FTP to S3.

D.Order multiple AWS Snowball Edge devices, copy data, and return them. Then set up AWS Glue jobs to convert to Parquet if needed.

AnswerD

Snowball Edge provides high-capacity offline transfer, meeting the deadline.

Why this answer

AWS Snowball Edge devices provide a petabyte-scale offline transfer solution, capable of moving 2 PB of data within the 30-day deadline without relying on the 1 Gbps network bandwidth. Option A (DataSync over Direct Connect) and Option B (VPN + rsync) are limited by the 1 Gbps network, which can transfer only about 324 TB in 30 days, insufficient for 2 PB. Option C (AWS Transfer Family over FTP) is also bandwidth-limited and inefficient for large-scale data.

Snowball Edge avoids network constraints, making it the most cost-effective and timely approach.

Full explanation →

908

Multi-Selectmedium

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences high CPU utilization during peak hours. The company wants to reduce the load on the primary database instance without making changes to the application code. Which TWO solutions should the solutions architect recommend?

Select 2 answers

A.Increase the instance size of the primary RDS instance.

B.Create one or more Read Replicas in the same region and direct read traffic to them.

C.Enable Amazon RDS Proxy to manage database connections.

D.Convert the RDS instance to a Multi-AZ deployment if not already.

E.Implement an Amazon ElastiCache cluster to cache the results of frequently accessed queries.

AnswersB, E

Read Replicas offload read queries from the primary, reducing its CPU load.

Why this answer

Options B and E are correct. Read Replicas offload read traffic from the primary database instance, reducing CPU utilization. ElastiCache caches the results of frequently accessed queries, decreasing the number of database queries and CPU load.

Option A is incorrect because increasing the instance size does not address the root cause and may require downtime. Option C is incorrect because RDS Proxy manages connection pooling, not reducing CPU load from queries. Option D is incorrect because the instance is already Multi-AZ, which provides failover but does not reduce read load.

Full explanation →

909

Multi-Selectmedium

Which TWO actions improve the security of an S3 bucket that stores sensitive data?

Select 2 answers

A.Enable default encryption with SSE-S3 or SSE-KMS.

B.Block all public access using the S3 Block Public Access feature.

C.Enable S3 Transfer Acceleration.

D.Configure a lifecycle policy to transition objects to Glacier.

E.Enable S3 Select to filter data.

AnswersA, B

Encrypts objects at rest.

Why this answer

Enabling default encryption with SSE-S3 or SSE-KMS ensures that all objects written to the S3 bucket are automatically encrypted at rest, protecting sensitive data even if the uploader does not explicitly request encryption. This is a foundational security control that mitigates the risk of data exposure due to misconfigured uploads or accidental storage of unencrypted data.

Exam trap

The trap here is that candidates may confuse performance or cost features (Transfer Acceleration, Glacier lifecycle, S3 Select) with security controls, leading them to select options that do not actually protect data confidentiality or integrity.

Full explanation →

910

MCQhard

A multinational corporation is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs in different AWS Regions, and all VPCs must be able to authenticate against the same directory. The directory must be highly available and support automatic failover. What is the MOST operationally efficient solution?

A.Use AWS Directory Service AD Connector in each VPC and point to an on-premises Active Directory.

B.Deploy AWS Managed Microsoft AD in each Region using multi-Region replication. Configure the directory as a global directory.

C.Deploy AWS Managed Microsoft AD in one Region. Create VPC peering connections to all other VPCs.

D.Deploy AWS Managed Microsoft AD in one Region. Configure VPN connections from each VPC to this directory.

AnswerB

Multi-Region replication provides automatic failover and low-latency authentication in each Region.

Why this answer

AWS Managed Microsoft AD with multi-Region replication provides a single global directory that spans multiple Regions, enabling automatic failover and high availability. This is the most operationally efficient solution because it eliminates the need for complex networking (VPC peering or VPNs) and allows all VPCs to authenticate against the same directory natively, with replication handled by AWS.

Exam trap

The trap here is that candidates often confuse VPC peering or VPN connectivity as sufficient for high availability, overlooking that a single-Region directory is a single point of failure and that multi-Region replication is the only option that provides automatic failover and operational efficiency across Regions.

How to eliminate wrong answers

Option A is wrong because AD Connector is a proxy that forwards authentication requests to an on-premises Active Directory, not a managed directory in AWS, and it does not provide a highly available, multi-Region directory for the migration scenario. Option C is wrong because VPC peering does not provide automatic failover or high availability for the directory; it only enables network connectivity, and the single-Region directory would be a single point of failure. Option D is wrong because VPN connections add network complexity and latency, and a single-Region directory lacks automatic failover across Regions, making it less operationally efficient than multi-Region replication.

Full explanation →

911

Multi-Selectmedium

A company is migrating a multi-tier web application to AWS. The application consists of a web server, application server, and Oracle database. Which TWO AWS services should be used to modernize the application while reducing operational overhead?

Select 2 answers

A.Amazon RDS for Oracle

B.Amazon Lightsail

C.AWS Elastic Beanstalk

D.Amazon EC2

E.Amazon DynamoDB

AnswersA, C

Managed Oracle database reduces overhead.

Why this answer

(Amazon RDS for Oracle) is correct because it manages the Oracle database, reducing operational overhead compared to self-managed EC2. Option C (AWS Elastic Beanstalk) is correct because it automatically handles the deployment and scaling of the web and application servers, reducing operational overhead. Option B (Amazon Lightsail) is not suitable for complex multi-tier applications.

Option D (Amazon EC2) would increase operational overhead as it requires manual management. Option E (Amazon DynamoDB) is a NoSQL database and not suitable for migrating an Oracle database.

Full explanation →

912

MCQhard

Refer to the exhibit. An IAM policy is attached to a user. When the user tries to upload an object to the S3 bucket 'my-bucket' using the AWS CLI without specifying server-side encryption, the upload fails. What is the MOST likely reason?

A.The bucket policy denies all uploads without encryption.

B.The policy requires server-side encryption with AES256, but the request did not include the encryption header.

C.The user is not the bucket owner.

D.The user does not have permission to call s3:PutObject.

AnswerB

The condition enforces encryption.

Why this answer

The IAM policy explicitly requires the `s3:x-amz-server-side-encryption` condition with a value of `AES256`. When the user uploads an object via the AWS CLI without specifying the `--server-side-encryption AES256` flag, the request lacks the required encryption header, causing the condition in the policy to fail and the upload to be denied. The policy does not deny all uploads without encryption—it only denies those that fail to meet the specific encryption requirement.

Exam trap

The trap here is that candidates may assume the failure is due to missing `s3:PutObject` permission (Option D) or a blanket bucket policy (Option A), but the real issue is the conditional `Deny` that enforces encryption headers, which is a subtle but critical distinction in IAM policy evaluation logic.

How to eliminate wrong answers

Option A is wrong because the bucket policy is not mentioned in the exhibit; the attached IAM policy uses a `Deny` effect with a condition, not a blanket denial of all uploads without encryption. Option C is wrong because bucket ownership is irrelevant to the IAM policy's encryption condition; the policy does not check ownership, and the user can upload to any bucket they have permissions for. Option D is wrong because the user does have `s3:PutObject` permission granted by the `Allow` statement; the failure is due to the `Deny` statement triggered by the missing encryption header, not a lack of the action permission.

Full explanation →

913

MCQmedium

A company uses AWS Organizations with multiple accounts. The finance team needs to track costs by department, where each department uses resources across several accounts. What is the BEST way to allocate costs accurately?

A.Use AWS Cost Explorer to view costs by linked account.

B.Define cost allocation tags for each department and enable them in the Billing and Cost Management console.

C.Set up AWS Budgets for each department with alerts.

D.Create AWS Resource Groups for each department and use AWS Config to track costs.

AnswerB

Tags allow grouping and tracking costs by department across accounts.

Why this answer

Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Finance') and then activate those tags in the Billing and Cost Management console. Once enabled, AWS Cost Explorer and cost reports can filter and group costs by these tags, providing accurate per-department cost tracking across multiple accounts in AWS Organizations. This is the most precise method because it directly associates resource usage with the department responsible, regardless of which account hosts the resource.

Exam trap

The trap here is that candidates often confuse account-level grouping (Option A) with tag-based allocation, assuming that each department has its own AWS account, but the question explicitly states departments use resources across several accounts, making tag-based allocation the only accurate method.

How to eliminate wrong answers

Option A is wrong because AWS Cost Explorer viewing costs by linked account only shows costs per AWS account, not per department; a single department may span multiple accounts, and a single account may host resources for multiple departments, so account-level grouping cannot accurately allocate costs to departments. Option C is wrong because AWS Budgets are used for setting cost thresholds and sending alerts, not for allocating or tracking historical costs by department; they do not provide a mechanism to assign costs to departments. Option D is wrong because AWS Resource Groups are logical groupings of resources based on tags or other criteria, and AWS Config tracks resource configuration changes and compliance, not cost allocation; neither service provides cost tracking or allocation capabilities.

Full explanation →

914

MCQmedium

A company is migrating a monolithic application to AWS. The application currently runs on a single on-premises server with a MySQL database. The company wants to reduce operational overhead and improve scalability. Which combination of AWS services should the company use?

A.Containerize the application and run on Amazon ECS with AWS Fargate, and use Amazon Aurora Serverless for MySQL.

B.Migrate the database to Amazon DynamoDB and host the application on AWS Lambda.

C.Host the application on Amazon EC2 and use Amazon RDS for MySQL.

D.Use AWS Elastic Beanstalk to deploy the application and Amazon RDS for MySQL as the database.

AnswerD

Elastic Beanstalk manages the environment, RDS reduces DB management overhead.

Why this answer

AWS Elastic Beanstalk automates application deployment, capacity provisioning, load balancing, and scaling, reducing operational overhead. Amazon RDS for MySQL manages the database, providing scalability and reducing administrative tasks. Option A is incorrect because while ECS with Fargate and Aurora Serverless can reduce overhead, containerizing a monolithic application requires refactoring and may not be straightforward; Elastic Beanstalk is more suitable for a lift-and-shift migration of a monolithic app.

Option B is incorrect because DynamoDB is a NoSQL database and not compatible with the existing MySQL database without significant schema changes, and AWS Lambda is event-driven and not ideal for a monolithic application. Option C is incorrect because running the application on EC2 instances still requires manual management of operating system patches, scaling, and availability, which does not reduce operational overhead as much as Elastic Beanstalk.

Full explanation →

915

Multi-Selectmedium

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. They want to improve performance and reduce costs. Which THREE actions should they take? (Choose THREE.)

Select 3 answers

A.Enable Lambda Provisioned Concurrency for the function.

B.Use DynamoDB on-demand capacity mode.

C.Use DynamoDB Accelerator (DAX) for read-heavy workloads.

D.Enable API Gateway caching to reduce backend calls.

E.Increase the Lambda function timeout to 5 minutes.

AnswersA, C, D

Reduces cold start latency for predictable traffic.

Why this answer

Options A, C, and D are correct. A: Lambda Provisioned Concurrency reduces cold starts for predictable traffic, improving performance. C: Using DAX reduces read latency and can lower DynamoDB read costs by offloading reads from the table.

D: API Gateway caching reduces the number of requests to Lambda and DynamoDB, improving response times and reducing costs. Option B is incorrect because DynamoDB on-demand capacity mode is typically more expensive for predictable workloads compared to provisioned capacity. Option E is incorrect because increasing the Lambda function timeout does not improve performance and may increase costs due to longer execution time.

Full explanation →

916

MCQeasy

A company uses AWS Organizations and wants to centrally manage backups of EC2 instances across multiple accounts. Which service should they use?

A.AWS CloudEndure Disaster Recovery

B.Amazon S3 Glacier

C.AWS Storage Gateway

D.AWS Backup

AnswerD

Centralized backup service with cross-account support.

Why this answer

AWS Backup is the correct service because it provides a fully managed, policy-based backup solution that integrates with AWS Organizations to centrally manage backups across multiple accounts. It allows you to define backup policies that automatically apply to EC2 instances and other supported resources across all member accounts, ensuring compliance and centralized monitoring without requiring per-account manual configuration.

Exam trap

The trap here is that candidates may confuse AWS Backup with disaster recovery services like CloudEndure, not realizing that AWS Backup is purpose-built for centralized, policy-driven backup management across multiple accounts, while CloudEndure focuses on continuous replication for failover, not scheduled backups.

How to eliminate wrong answers

Option A is wrong because AWS CloudEndure Disaster Recovery is designed for continuous replication and rapid failover for disaster recovery scenarios, not for scheduled, policy-based backup management across multiple accounts. Option B is wrong because Amazon S3 Glacier is a storage class for long-term archival of objects, not a service for orchestrating or managing backups of EC2 instances across accounts. Option C is wrong because AWS Storage Gateway provides hybrid cloud storage access (e.g., file, volume, tape gateways) for on-premises environments, not centralized backup management of EC2 instances within AWS Organizations.

Full explanation →

917

Multi-Selecteasy

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache Redis cluster. The operations team has noticed that during peak hours, application response times increase significantly. They need to improve performance without downtime. Which THREE actions should they take? (Choose 3)

Select 3 answers

A.Enable connection draining on the ALB.

B.Decrease the idle timeout of the ALB.

C.Increase the EC2 instance size to a larger instance type.

D.Add read replicas to the ElastiCache Redis cluster.

E.Add more EC2 instances to the Auto Scaling group.

AnswersA, D, E

Connection draining allows existing connections to complete before instances are deregistered, improving availability during scaling events.

Why this answer

(Enable connection draining on the ALB) allows in-flight requests to complete before instances are deregistered or replaced, ensuring no disruption during scaling events. Option D (Add read replicas to the ElastiCache Redis cluster) offloads read traffic from the primary Redis node, reducing latency for session reads. Option E (Add more EC2 instances to the Auto Scaling group) horizontally scales the application, distributing load and improving response times during peak hours.

Option B (Decrease the idle timeout of the ALB) would prematurely close connections, not improve performance. Option C (Increase the EC2 instance size) is vertical scaling, which could cause downtime unless done with rolling replacement, and is not the best approach for handling increased load with zero downtime.

Full explanation →

918

MCQeasy

A company wants to share a large dataset stored in Amazon S3 with a partner who has their own AWS account. The partner needs to access the data using their own account credentials. Which approach should the company use?

A.Use S3 cross-region replication.

B.Grant the partner's AWS account access via a bucket policy.

C.Create a pre-signed URL for the partner.

D.Provide the partner with an IAM user in the company's account.

AnswerB

A bucket policy can grant cross-account access to the partner's account.

Why this answer

A bucket policy can grant cross-account access to the partner's AWS account by specifying the partner's AWS account ID as the principal. This allows the partner's IAM users or roles to access the S3 bucket directly using their own credentials, without needing to share access keys or create users in the company's account. The bucket policy must explicitly allow the necessary actions (e.g., s3:GetObject) and the partner must also have an IAM policy that permits the same actions.

Exam trap

The SAP-C02 exam often tests the misconception that pre-signed URLs are the only way to grant temporary access, but the question explicitly requires the partner to use their own account credentials, which only a bucket policy (or an S3 access point with a policy) can achieve.

How to eliminate wrong answers

Option A is wrong because S3 cross-region replication is used to automatically replicate objects to a different AWS region for data redundancy or compliance, not to grant cross-account access to a partner. Option C is wrong because a pre-signed URL grants temporary access to a specific object using a URL that embeds credentials, but it does not allow the partner to use their own AWS account credentials; it also expires and is not suitable for ongoing or large-scale access. Option D is wrong because providing an IAM user in the company's account would require the partner to use that user's credentials (access key and secret key) instead of their own account credentials, violating the requirement that the partner uses their own account credentials.

Full explanation →

919

MCQhard

A company wants to migrate a legacy Oracle database to AWS with minimal downtime. The database is 2 TB in size and runs on a single on-premises server. The company requires the ability to cut over quickly and roll back if needed. Which AWS service should be used?

A.Use S3 Transfer Acceleration to upload the database dump directly to an EC2 instance.

B.AWS Database Migration Service (DMS) with ongoing replication from the source to an Amazon RDS for Oracle target.

C.AWS Schema Conversion Tool (SCT) to convert the schema and then export the data to flat files for import.

D.AWS Snowball Edge to copy the database files and then restore on Amazon RDS.

AnswerB

Correct. AWS DMS with ongoing replication enables near-zero downtime by continuously copying changes, and supports easy rollback by pausing or reversing replication.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication enables continuous data replication from the on-premises Oracle database to Amazon RDS for Oracle, allowing minimal downtime during cutover. It also supports rollback by stopping replication and reverting to the source. Option A is incorrect because S3 Transfer Acceleration is for fast uploads to S3, not for database migration with replication.

Option C is incorrect because AWS Schema Conversion Tool (SCT) handles schema conversion, not ongoing data replication. Option D is incorrect because AWS Snowball Edge is an offline data transfer device, which does not meet the minimal downtime requirement.

Exam trap

Candidates may think Snowball Edge is suitable for very large databases, but for minimal downtime requirements, an online replication service like DMS is necessary.

Full explanation →

920

Multi-Selecthard

A multinational corporation is migrating its on-premises Active Directory to AWS. The company requires a solution that supports multi-region authentication for thousands of users and integrates with existing on-premises Active Directory for seamless SSO. The solution must be highly available and provide low-latency authentication. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

Select 2 answers

A.Amazon Cognito

B.AWS Direct Connect

C.AD Connector

D.AWS Single Sign-On (SSO)

E.AWS Managed Microsoft AD

AnswersC, E

AD Connector connects AWS services to on-premises AD, enabling SSO and authentication.

Why this answer

AD Connector (Option C) is correct because it acts as a proxy to redirect authentication requests from AWS services to your on-premises Active Directory without caching credentials or requiring directory synchronization, enabling seamless SSO for users. AWS Managed Microsoft AD (Option E) is correct because it provides a highly available, fully managed Active Directory in the AWS cloud that can be extended to multiple regions via trust relationships, supporting low-latency authentication for thousands of users across regions.

Exam trap

The trap here is that candidates often confuse AWS Single Sign-On (SSO) as a standalone identity provider, but it requires an underlying directory service (like AWS Managed Microsoft AD or AD Connector) to authenticate against on-premises Active Directory, making it an incomplete solution on its own.

Full explanation →

921

MCQhard

A company is using AWS Organizations and wants to restrict the use of specific instance types across all accounts. The company wants to allow only t3.micro, t3.small, m5.large, and m5.xlarge instances. Which SCP should be applied?

A.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

B.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:*:*:instance/*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.micro","t3.small","m5.large","m5.xlarge"]}}}

C.{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

D.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*"}

AnswerB

Correct. Deny with StringNotEquals using specific instance types and instance resource ARN.

Why this answer

The correct SCP because it targets the instance resource with a resource ARN and uses a Deny effect with StringNotEquals to block any instance types not in the allowed list. By listing the specific instance types explicitly, the policy avoids the unsupported use of wildcards in StringNotEquals conditions for ec2:InstanceType. This ensures that only the specified instance types can be launched.

Exam trap

Candidates might choose Option A because it uses a similar deny condition but with a broader resource '*' and wildcards. However, the resource must be specific to the instance for the condition to be evaluated, and wildcards are not supported in StringNotEquals, making Option A ineffective.

How to eliminate wrong answers

Option B is wrong because it restricts the Resource to 'arn:aws:ec2:*:*:instance/*', which only covers existing instance resources, not the RunInstances action itself; SCPs with Deny on RunInstances must use Resource '*' to block the launch action, otherwise the policy may not prevent the creation of new instances. Option C is wrong because it uses an Allow effect, which is ineffective in SCPs since SCPs are deny lists by default; an Allow SCP does not grant permissions—it only sets a maximum permission boundary, and without a corresponding Deny for non-allowed types, all instance types remain permitted. Option D is wrong because it denies all EC2 RunInstances actions without any condition, which would block all instance types entirely, not just restrict to T3 and M5.

Full explanation →

922

MCQeasy

A company uses AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. What is the BEST way to achieve this?

A.Use an AWS Lambda function that runs periodically to enable CloudTrail in accounts where it is disabled.

B.Create an AWS Config rule in each account to enable CloudTrail if it is disabled.

C.Use an SCP to require CloudTrail to be enabled in each account.

D.Use the AWS CloudTrail setup provided by Control Tower, which automatically enables a trail for all accounts in the organization.

AnswerD

Control Tower automatically sets up a CloudTrail trail in the management account that logs all accounts.

Why this answer

AWS Control Tower provides an integrated CloudTrail setup that automatically creates and manages a central trail for all accounts in the organization. This trail is deployed using AWS CloudFormation StackSets and delivers logs to a centralized S3 bucket, ensuring compliance without manual intervention or custom automation. This is the best approach because it is native, fully managed, and aligns with Control Tower's governance model.

Exam trap

The trap here is that candidates often assume SCPs can enforce service enablement (like enabling CloudTrail), but SCPs only control permissions—they cannot enable services or resources; they can only prevent disabling of existing configurations.

How to eliminate wrong answers

Option A is wrong because using a periodic Lambda function is reactive, introduces latency, and does not prevent accounts from disabling CloudTrail between runs; it also adds operational overhead and potential single points of failure. Option B is wrong because an AWS Config rule can only detect non-compliance and trigger remediation (e.g., via auto-remediation), but it cannot enforce the setting across all accounts proactively; it also requires Config to be enabled in each account first. Option C is wrong because SCPs can only deny or allow API actions, not enable services; an SCP cannot force CloudTrail to be enabled—it can only prevent disabling of an already-enabled trail or block certain CloudTrail API calls.

Full explanation →

923

Multi-Selecthard

A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS resources (e.g., VPCs, subnets, security groups) to all accounts in a specific organizational unit (OU). The solution must be automated and ensure that new accounts added to the OU automatically receive the resources. Which three steps should the team take? (Choose three.)

Select 3 answers

A.Create a StackSet with the template and target the OU, enabling automatic deployment.

B.Create an AWS CloudFormation template that defines the common resources.

C.Use AWS Config rules to detect missing resources and deploy them via Lambda.

D.Enable AWS CloudFormation StackSets trusted access with AWS Organizations.

E.Create an SCP that requires the creation of those resources.

AnswersA, B, D

Automatically deploys to new accounts in the OU.

Why this answer

AWS CloudFormation StackSets allow you to deploy a common CloudFormation template across multiple accounts and regions. By targeting an organizational unit (OU) and enabling automatic deployment, any new account added to that OU will automatically receive the defined resources, fulfilling the automation requirement.

Exam trap

The trap here is confusing AWS Config (a detective control) with a provisioning tool, and assuming SCPs can create resources when they only enforce permission boundaries.

Full explanation →

924

MCQhard

A company has a multi-account strategy with a centralized logging account. All VPC Flow Logs and CloudTrail logs are sent to an S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena. Which configuration provides the MOST cost-effective and secure access?

A.Use S3 access points in each account to grant access to the central bucket.

B.Use AWS Lake Formation to manage permissions to the central S3 bucket and allow Athena queries across accounts.

C.Create an S3 interface endpoint in the logging account and share it with other accounts.

D.Copy logs to each account's own S3 bucket and run Athena queries locally.

AnswerB

Lake Formation provides fine-grained access control and can be used with Athena for cross-account queries without copying data.

Why this answer

AWS Lake Formation provides a centralized, fine-grained permissions model that allows the security team to grant cross-account access to the S3 data lake for Athena queries without duplicating data. It integrates directly with Athena and S3, enabling column- and row-level security while avoiding the cost and complexity of copying logs or managing multiple S3 access points.

Exam trap

The trap here is that candidates often assume S3 access points or interface endpoints are sufficient for cross-account Athena queries, but they overlook that Athena requires a centralized metadata catalog and fine-grained permissions that only Lake Formation (or a combination of Glue Catalog and IAM) can provide cost-effectively.

How to eliminate wrong answers

Option A is wrong because S3 access points are primarily for managing access to a single bucket from within the same account or via VPC origins, not for granting cross-account Athena query access; they do not natively integrate with Athena’s cross-account query capabilities and would require additional IAM policies and bucket policies, increasing complexity and cost. Option C is wrong because an S3 interface endpoint (AWS PrivateLink) only provides private network connectivity to S3, not cross-account data access or permission management; it does not enable Athena to query data across accounts without additional IAM roles and bucket policies, and it incurs hourly endpoint charges. Option D is wrong because copying logs to each account’s own S3 bucket duplicates storage costs, increases data transfer fees, and introduces latency, making it far less cost-effective than a centralized approach with Lake Formation.

Full explanation →

925

MCQhard

A company has a multi-account AWS environment with a central logging account and multiple workload accounts. The security team requires that all VPC Flow Logs be delivered to a central S3 bucket in the logging account. The VPC Flow Logs are encrypted with a customer-managed KMS key in the logging account. The workload accounts have created VPC Flow Logs, but the logs are not appearing in the central S3 bucket. The IAM role used by VPC Flow Logs in the workload accounts has the necessary permissions to deliver logs to the central S3 bucket. What is the most likely cause of the issue?

A.The VPC Flow Logs are being delivered to CloudWatch Logs instead of S3.

B.The S3 bucket policy denies access to the workload accounts.

C.The S3 bucket has a bucket policy that requires encryption in transit.

D.The KMS key policy in the logging account does not grant the VPC Flow Logs service principal permission to use the key.

AnswerD

Key policy must allow the service principal from workload accounts.

Why this answer

Even though the IAM role in the workload account has permissions to write to the S3 bucket, the KMS key policy in the logging account must explicitly grant the VPC Flow Logs service principal permission to use the key for encryption. Without this key policy statement, the logs cannot be encrypted and delivered. Option A is incorrect because VPC Flow Logs can be delivered directly to S3 without CloudWatch Logs.

Option B is incorrect because a bucket policy denying workload accounts would be an issue, but the question states the IAM role has necessary permissions, and the key policy is the missing piece. Option C is incorrect because encryption in transit is not a common requirement for VPC Flow Logs delivery to S3, and the issue is about encryption at rest using KMS.

Full explanation →

926

Multi-Selecteasy

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application occasionally receives traffic spikes that cause the Auto Scaling group to launch new instances. However, the new instances take several minutes to become healthy, causing a temporary performance degradation. Which TWO actions would improve the scaling responsiveness? (Select TWO.)

Select 2 answers

A.Increase the Auto Scaling group cooldown period.

B.Reduce the target group health check interval to 5 seconds.

C.Decrease the health check grace period to 30 seconds.

D.Use a launch template with a pre-provisioned AMI that includes the application and dependencies.

E.Configure a scheduled scaling policy to add instances before expected traffic spikes.

AnswersD, E

Pre-warmed AMI reduces launch time.

Why this answer

Using a launch template with a pre-provisioned AMI reduces instance startup time, allowing new instances to become healthy faster during traffic spikes. Option E is correct because a scheduled scaling policy can add instances before expected traffic spikes, proactively handling the load. Option A is incorrect because increasing the cooldown period would delay additional scaling actions, worsening responsiveness.

Option B is incorrect because reducing the health check interval does not speed up instance initialization; it only checks health more frequently. Option C is incorrect because decreasing the health check grace period may cause instances to be terminated prematurely before they have a chance to become healthy.

Full explanation →

927

MCQmedium

A company is migrating a critical workload to AWS and needs to ensure business continuity. The workload runs on a single EC2 instance with a 500 GB EBS volume. The company requires a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which solution meets these requirements with the least operational overhead?

A.Create an AMI of the instance every 15 minutes and launch a new instance from the latest AMI in case of failure.

B.Deploy the workload on Amazon RDS Multi-AZ and enable automatic failover.

C.Use Amazon EBS snapshots with a 15-minute frequency and automate recovery with AWS Backup.

D.Use AWS Elastic Disaster Recovery to continuously replicate the EC2 instance to another Region.

AnswerC

EBS snapshots provide cost-effective backups with low RPO and RTO.

Why this answer

EBS snapshots can be taken every 15 minutes to meet the RPO, and restoring from a snapshot can meet the 2-hour RTO. AWS Backup automates the snapshot schedule and recovery, minimizing operational overhead. Option A is incorrect because creating AMIs every 15 minutes is impractical and would not meet the RTO efficiently.

Option B is incorrect because RDS Multi-AZ is designed for database workloads, not general EC2 instances. Option D is incorrect because AWS Elastic Disaster Recovery introduces higher complexity and cost compared to the simpler snapshot-based approach for a single-instance workload.

Full explanation →

928

MCQhard

A company is migrating a critical application to AWS and needs to ensure that the migration has minimal downtime. The application runs on a single on-premises server with a local MySQL database. Which strategy provides the lowest downtime?

A.Rehost the application using AWS Application Migration Service

B.Use AWS Backup to back up and restore to RDS

C.Stop the application, take a snapshot, and restore on EC2

D.Use AWS DMS with ongoing replication and cutover

AnswerD

DMS with ongoing replication allows near-zero downtime by keeping the target in sync until cutover.

Why this answer

(Use AWS DMS with ongoing replication and cutover) is correct because it enables continuous replication from the on-premises MySQL database to Amazon RDS, allowing a cutover with minimal downtime. Option A (Rehost using AWS Application Migration Service) typically involves some downtime during the replication and cutover. Option B (AWS Backup backup and restore to RDS) requires stopping the application to take a consistent backup, causing downtime.

Option C (Stop, snapshot, restore) involves stopping the application, thus causing downtime.

Full explanation →

929

MCQeasy

A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?

A.Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity

B.Apply a service control policy to allow cross-account access

C.Create an IAM user in the production account and share the credentials with the development team

D.Configure security group rules to allow access from the development account

AnswerA

This allows users from the development account to assume the role and gain permissions.

Why this answer

Cross-account IAM role access requires creating an IAM role in the production (trusting) account with a trust policy that explicitly lists the development (trusted) account as a principal. The development team then assumes that role using the AWS STS AssumeRole API, which returns temporary security credentials. This follows the AWS recommended pattern for delegating access without sharing long-term credentials.

Exam trap

The trap here is that candidates confuse network-level controls (security groups) or organizational policies (SCPs) with IAM-based cross-account trust, or mistakenly think sharing IAM user credentials is acceptable for cross-account access.

How to eliminate wrong answers

Option B is wrong because service control policies (SCPs) are used to set permission boundaries across accounts in an AWS Organization; they do not grant cross-account access themselves and cannot be used to allow role assumption between accounts. Option C is wrong because sharing IAM user credentials violates the principle of least privilege and security best practices; it exposes long-term access keys that are not scoped or temporary, increasing risk. Option D is wrong because security group rules control network traffic at the instance level, not IAM-based access; they cannot grant API-level permissions to assume roles or deploy resources.

Full explanation →

930

MCQhard

A financial services company is designing a solution to process real-time stock trade data. The data is ingested via Amazon Kinesis Data Streams with a shard count of 10. Each shard receives 500 records per second, each record is 1 KB. The company needs to archive all raw data to Amazon S3 within 5 minutes of receipt and also run a Lambda function to enrich each record. What is the most cost-effective and scalable approach?

A.Configure Kinesis Data Firehose to read from the stream and deliver to S3, and use a Lambda function for enrichment.

B.Use Kinesis Data Analytics to archive data to S3.

C.Use the Kinesis Client Library (KCL) to process records and write to S3.

D.Use a Lambda function to read from the stream and write to S3.

AnswerA

Firehose handles buffering and delivery to S3; Lambda enriches records.

Why this answer

Kinesis Data Firehose can directly subscribe to a Kinesis Data Stream as its source, automatically reading all records from the stream and delivering them to S3 with a configurable buffer interval (e.g., 60 seconds), easily meeting the 5-minute requirement. For enrichment, Firehose can invoke a Lambda function on each incoming record before delivery, making this a fully managed, serverless pipeline that scales without manual shard management or custom code.

Exam trap

The trap here is that candidates often assume Lambda is the simplest way to process Kinesis streams, but they overlook Firehose's built-in Lambda integration and its ability to handle high-throughput archiving without custom scaling logic.

How to eliminate wrong answers

Option B is wrong because Kinesis Data Analytics is designed for real-time SQL or Apache Flink analytics on streaming data, not for archiving raw data to S3; it lacks native S3 delivery and would require additional services to archive. Option C is wrong because using the Kinesis Client Library (KCL) requires you to run custom application code (e.g., on EC2 or ECS) to process records and write to S3, adding operational overhead and cost compared to a fully managed Firehose solution. Option D is wrong because a single Lambda function reading directly from a Kinesis stream cannot scale to handle 5,000 records per second (10 shards × 500 records/s) without complex parallel processing logic, and Lambda's maximum concurrency and 15-minute timeout make it inefficient for sustained high-throughput archiving.

Full explanation →

931

Multi-Selectmedium

Which TWO strategies can be used to reduce the cost of Amazon DynamoDB tables for a new application with unpredictable traffic patterns? (Choose two.)

Select 2 answers

A.Use DynamoDB auto scaling with provisioned capacity.

B.Use DynamoDB Streams to reduce write capacity.

C.Use DynamoDB global tables for multi-region replication.

D.Use DynamoDB Accelerator (DAX) to reduce read capacity.

E.Use DynamoDB on-demand capacity mode.

AnswersA, E

Auto scaling adjusts capacity based on usage, preventing over-provisioning.

Why this answer

DynamoDB auto scaling with provisioned capacity automatically adjusts the read and write throughput based on actual traffic patterns, preventing over-provisioning and reducing costs during low-traffic periods. For unpredictable traffic, this avoids paying for unused capacity while still handling spikes within the configured limits.

Exam trap

The trap here is that candidates often confuse cost-reduction strategies with performance-enhancing features, such as DAX or global tables, which add cost rather than reduce it, or incorrectly assume DynamoDB Streams can lower write costs when they actually consume additional capacity.

Full explanation →

932

MCQmedium

A company operates multiple AWS accounts using AWS Organizations. They want to centrally manage Amazon EC2 Auto Scaling groups across all accounts. The operations team needs to view and modify scaling policies from a single pane of glass. Which solution should they implement?

A.Use AWS CloudFormation StackSets to deploy the Auto Scaling groups consistently.

B.Use AWS Config rules to enforce desired scaling policies.

C.Use AWS Systems Manager Explorer with multi-account management.

D.Use Amazon CloudWatch cross-account dashboards.

AnswerC

Systems Manager Explorer provides a central dashboard for operational data across accounts.

Why this answer

AWS Systems Manager Explorer provides a single-pane-of-glass view across multiple AWS accounts and Regions, allowing the operations team to view and modify EC2 Auto Scaling policies centrally. It integrates with Systems Manager Automation runbooks to execute changes, such as updating scaling policies, across all accounts managed via AWS Organizations.

Exam trap

The trap here is that candidates confuse monitoring (CloudWatch dashboards) or compliance (Config rules) with the ability to both view and modify operational configurations, leading them to overlook Systems Manager Explorer's centralized management capabilities.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation StackSets deploy and manage infrastructure consistently but do not provide a centralized operational interface to view or modify existing Auto Scaling scaling policies in real time. Option B is wrong because AWS Config rules are used for compliance auditing and remediation, not for interactive viewing or modification of scaling policies. Option D is wrong because Amazon CloudWatch cross-account dashboards enable monitoring of metrics but do not allow modification of Auto Scaling policies or provide a management interface for scaling actions.

Full explanation →

933

MCQeasy

A company has a legacy application that runs on an Amazon EC2 instance. The application writes logs to a local file. The company wants to centralize log monitoring without modifying the application code. Which solution should the company use?

A.Use Amazon Kinesis Agent to stream the log file to Amazon Kinesis Data Firehose.

B.Install the Amazon CloudWatch agent on the EC2 instance and configure it to tail the log file.

C.Modify the application to use the AWS SDK for logging to Amazon CloudWatch Logs.

D.Turn on AWS CloudTrail for the EC2 instance to capture logs.

E.Configure the application to write logs to Amazon S3 using the AWS SDK.

AnswerB

CloudWatch agent can collect logs from files and send to CloudWatch Logs.

Why this answer

The Amazon CloudWatch agent can be installed on the EC2 instance without modifying the application code. It tails the local log file and sends the logs to Amazon CloudWatch Logs for centralized monitoring. Option A is incorrect because Amazon Kinesis Agent streaming to Kinesis Data Firehose adds unnecessary complexity for simple log ingestion.

Option C is incorrect because it requires modifying the application code. Option D is incorrect because AWS CloudTrail captures API activity, not application logs. Option E is incorrect because it requires modifying the application code to write to Amazon S3.

Full explanation →

934

Multi-Selecthard

A company uses AWS Organizations with a hierarchical structure of organizational units (OUs). The security team needs to restrict the use of specific AWS services in the development OU. However, the SCP applied at the root level allows all services. Which TWO SCP strategies can restrict services for the development OU without affecting other OUs? (Choose TWO.)

Select 2 answers

A.Apply a tag policy to the development OU that requires tags for all resources.

B.Modify the root-level SCP to deny the unwanted services.

C.Use a service control policy that denies access to the unwanted services and attach it to the development OU.

D.Attach a deny SCP to the development OU that explicitly denies the unwanted services.

E.Create an IAM permissions boundary for all users in the development OU.

AnswersC, D

Deny SCPs are effective for restricting services.

Why this answer

Tag policies enforce tagging requirements, not service restrictions. Option B is incorrect because modifying the root-level SCP would affect all OUs, not just the development OU. Option C is correct: attaching a deny SCP to the development OU that denies unwanted services will restrict that OU only, as SCPs are inherited but explicit denies override allows.

Option D is correct: similarly, an explicit deny SCP attached to the development OU will block those services for that OU. Option E is incorrect because IAM permissions boundaries are applied to IAM principals, not OUs, and do not override SCPs. Therefore, the correct answers are C and D.

Full explanation →

935

MCQeasy

A company plans to migrate its on-premises VMware VMs to AWS. The company wants to automate the migration of VM images and minimize manual effort. Which AWS service should the company use?

A.AWS VM Import/Export

B.AWS DataSync

C.AWS Application Migration Service (MGN)

D.AWS Database Migration Service (DMS)

AnswerC

AWS Server Migration Service (SMS) automates the replication of on-premises server volumes to AWS, reducing manual intervention. It is designed for large-scale, automated migrations with minimal downtime.

Why this answer

AWS Application Migration Service (MGN) is the correct choice because it automates the migration of on-premises server volumes (including VMware VMs) to AWS with minimal manual effort. It provides continuous, block-level replication and simplifies large-scale migrations. MGN is the modern successor to AWS Server Migration Service (SMS).

AWS VM Import/Export (Option A) is a one-time import tool requiring manual steps. AWS DataSync (Option B) is for file and object transfers, not VM images. AWS DMS (Option D) is for databases.

Therefore, MGN (Option C) is the service that best meets the requirement.

Exam trap

A common pitfall is choosing AWS VM Import/Export because it is a familiar VM import tool, but it lacks automation. The correct service for automated server migration is now AWS Application Migration Service (MGN), which has replaced SMS.

Full explanation →

936

Multi-Selecthard

Which THREE factors should be considered when designing a disaster recovery plan for a multi-tier application using AWS? (Choose three.)

Select 3 answers

A.Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

B.Data replication strategy (e.g., synchronous vs. asynchronous).

C.DNS failover using Amazon Route 53.

D.Deploying the application across multiple Availability Zones.

E.Using larger instance sizes for better performance.

AnswersA, B, C

Key metrics for DR planning.

Why this answer

Options A, B, and C are correct. A: RTO and RPO define recovery objectives. B: Data replication strategy (synchronous vs. asynchronous) impacts consistency and latency.

C: DNS failover using Route 53 directs traffic to the DR site during a disaster. D is incorrect because deploying across multiple Availability Zones addresses high availability, not disaster recovery across regions. E is incorrect because larger instance sizes improve performance, not disaster recovery readiness.

Full explanation →

937

MCQmedium

A company runs a web application on EC2 instances in an Auto Scaling group. The application receives a variable workload. The company wants to scale based on a custom metric that tracks the number of active users. What is the MOST efficient way to achieve this?

A.Use a scheduled scaling policy to add or remove instances based on historical usage patterns.

B.Use AWS Lambda to periodically evaluate the custom metric and adjust the desired capacity via API calls.

C.Create a step scaling policy that uses CloudWatch alarms based on the custom metric.

D.Create a target tracking scaling policy using the custom metric as the target.

AnswerD

Target tracking automatically adjusts capacity to maintain the target metric value.

Why this answer

A target tracking scaling policy automatically adjusts the number of instances to maintain a target value for the custom metric, which is efficient for variable workloads. Option A is incorrect because scheduled scaling assumes predictable patterns. Option B is incorrect because using Lambda adds complexity and overhead.

Option C is incorrect because step scaling requires manual configuration of steps and is less efficient than target tracking.

Full explanation →

938

Multi-Selecthard

A company is designing a new microservices architecture using Amazon ECS with the Fargate launch type. The services need to communicate securely within a VPC. The company requires that inter-service communication is encrypted and that the services can discover each other using DNS names. Which THREE steps should the company take to meet these requirements?

Select 3 answers

A.Deploy an Application Load Balancer in front of each service for inter-service communication.

B.Create a VPC peering connection between the services' subnets.

C.Enable AWS Cloud Map for service discovery.

D.Configure the ECS task definitions to use the awsvpc network mode.

E.Create VPC endpoints for Amazon ECR and Amazon S3 to allow Fargate tasks to pull images.

AnswersC, D, E

Cloud Map allows services to register and discover each other via DNS.

Why this answer

AWS Cloud Map is a cloud resource discovery service that allows microservices to dynamically discover each other using DNS names or API calls. By integrating Cloud Map with ECS service discovery, tasks can register themselves with a namespace, enabling other services to resolve their IP addresses via DNS queries, which satisfies the requirement for DNS-based discovery.

Exam trap

The trap here is that candidates often confuse VPC peering or load balancers as solutions for service discovery, but AWS specifically tests that Cloud Map with awsvpc network mode is the correct combination for DNS-based discovery and secure inter-service communication within a VPC.

Full explanation →

939

MCQhard

A financial services company runs a critical application on EC2 instances in an Auto Scaling group across multiple Availability Zones. They need to ensure that in the event of a single AZ failure, the application remains available with no data loss. The application uses EBS volumes for persistent storage. What should a solutions architect recommend?

A.Take periodic EBS snapshots and restore in another AZ.

B.Use Amazon EFS instead of EBS volumes.

C.Use an EBS volume in one AZ and attach it to instances in another AZ.

D.Use an EBS multi-attach volume with a cluster-aware file system.

AnswerB

Correct. Amazon EFS provides a regional file system that is automatically replicated across multiple AZs, ensuring availability and no data loss during a single AZ failure.

Why this answer

Amazon EFS is a regional, fully managed file system that automatically replicates data across multiple Availability Zones, providing high availability and durability. This ensures no data loss during a single AZ failure. Option A is incorrect because periodic snapshots introduce a recovery point objective (RPO) that may result in data loss.

Option C is incorrect because EBS volumes are tied to a single AZ and cannot be attached to instances in another AZ. Option D is incorrect because EBS multi-attach volumes only allow attachment within the same AZ, not across different AZs, thus cannot provide cross-AZ high availability.

Exam trap

EBS multi-attach volumes are often mistaken as a cross-AZ solution, but they only work within a single AZ. For cross-AZ high availability with no data loss, consider using Amazon EFS or a replication mechanism.

Full explanation →

940

MCQhard

A company has a complex AWS environment with multiple accounts and VPCs. The company wants to ensure that all outbound traffic from VPCs goes through a centralized inspection VPC for security monitoring. The company uses AWS Transit Gateway. Which solution should be implemented?

A.Deploy AWS Network Firewall in each VPC and configure routing to send outbound traffic through the firewall.

B.Use VPC peering to connect all VPCs to the inspection VPC and configure routes.

C.Use Route 53 Resolver to forward all outbound DNS queries to the inspection VPC.

D.Create a Transit Gateway with route tables. Attach the inspection VPC as a central hub. Configure the route tables of the transit gateway to point the default route (0.0.0.0/0) to the inspection VPC attachment. Then attach all other VPCs and configure their route tables to send traffic to the Transit Gateway.

AnswerD

Transit Gateway route tables can direct traffic to inspection VPC.

Why this answer

It uses AWS Transit Gateway with centralized route tables to force all outbound traffic from attached VPCs through the inspection VPC. By configuring the Transit Gateway route table with a default route (0.0.0.0/0) pointing to the inspection VPC attachment, all outbound traffic from other VPCs is routed to the inspection VPC for security monitoring before leaving the network. This design meets the requirement of a single, centralized inspection point without requiring VPC peering or per-VPC firewall deployments.

Exam trap

The trap here is that candidates often confuse VPC peering with Transit Gateway, assuming peering can achieve transitive routing, but AWS VPC peering explicitly does not support transitive routing, making Option B invalid for centralized inspection.

How to eliminate wrong answers

Option A is wrong because deploying AWS Network Firewall in each VPC creates a decentralized inspection model, not a centralized one, and does not leverage Transit Gateway for traffic flow. Option B is wrong because VPC peering does not support transitive routing; each peering connection is a one-to-one relationship, so traffic cannot be centrally routed through a single inspection VPC without complex full-mesh peering. Option C is wrong because Route 53 Resolver only handles DNS queries, not general outbound traffic (e.g., HTTP, HTTPS, or other IP protocols), and thus cannot enforce security monitoring on all outbound traffic.

Full explanation →

941

MCQmedium

A company has a production AWS account and a development AWS account under AWS Organizations. The development team wants to deploy a CloudFormation stack that creates an S3 bucket with a bucket policy that grants access to the production account's IAM roles. The development account has an SCP that denies all s3:PutBucketPolicy actions. The development team has full administrator access in their account. When they try to create the stack, it fails. What is the most likely reason and how should they proceed?

A.The development team does not have IAM permissions to create buckets. They need to attach an IAM policy that allows s3:PutBucketPolicy.

B.The SCP denies s3:PutBucketPolicy and overrides the administrator permissions. They need to request an exception to the SCP from the security team.

C.CloudFormation service role is missing. They need to create a service role with appropriate permissions.

D.The production account's IAM roles are not trusted. They need to update the trust policy.

AnswerB

SCPs can deny actions even to administrators.

Why this answer

SCPs apply to all principals in the account, including administrators, and deny actions even if IAM policies allow them. Since the SCP denies s3:PutBucketPolicy, the development team cannot create the bucket policy despite having full admin access. Option A is incorrect because the team does have IAM permissions (admin), but the SCP overrides them.

Option C is incorrect because CloudFormation's service role is not the issue; the SCP restriction affects all principals, including CloudFormation. Option D is incorrect because the trust policy of the production account's IAM roles is unrelated to the SCP in the development account.

Full explanation →

942

MCQhard

A company is migrating a legacy .NET Framework 4.7 application to AWS. The application uses Windows authentication and COM+ components. Which migration approach is most suitable?

A.Replatform to .NET Core on AWS Elastic Beanstalk (Linux)

B.Use Windows containers on Amazon ECS with Amazon ECS-optimized Windows Server AMI

C.Refactor to run on AWS Lambda with .NET Core 3.1

D.Containerize with Linux containers on Amazon ECS

AnswerB

Windows containers support .NET Framework and COM+ components.

Why this answer

Windows containers on Amazon ECS with the ECS-optimized Windows Server AMI support .NET Framework applications and COM+ components, making them the most suitable migration approach. Option A is incorrect because replatforming to .NET Core on Linux would require significant code changes and does not support COM+. Option C is incorrect because AWS Lambda does not support full .NET Framework or COM+.

Option D is incorrect because Linux containers cannot run Windows-based .NET Framework applications.

Full explanation →

943

Multi-Selecteasy

A company is migrating to a multi-account AWS environment using AWS Control Tower. The security team must ensure that all accounts have AWS Config enabled and that logs are delivered to a central S3 bucket. Which THREE steps should the security team take?

Select 3 answers

A.Manually create an S3 bucket in each account to store Config logs.

B.Use an SCP to prevent disabling of AWS Config in any account.

C.Configure the central S3 bucket policy to allow cross-account log delivery from all accounts in the organization.

D.Enable AWS Config in the management account and use Control Tower's account factory to propagate the configuration to all accounts.

E.Create an IAM role in each account to allow the management account to access Config logs.

AnswersB, C, D

SCPs can deny actions that disable Config.

Why this answer

AWS Control Tower uses Service Control Policies (SCPs) to enforce guardrails. An SCP can be applied to the root or OUs to prevent any account from disabling AWS Config, ensuring compliance across the multi-account environment without requiring per-account manual intervention.

Exam trap

The trap here is that candidates often think they need to create IAM roles in each account for cross-account logging, but AWS Config's native cross-account delivery only requires a properly configured S3 bucket policy and does not rely on IAM roles in the member accounts.

Full explanation →

944

Multi-Selectmedium

A company is migrating a monolithic application to a microservices architecture on AWS. They want to improve deployment frequency and reduce risk. Which TWO strategies should they adopt?

Select 2 answers

A.Deploy all microservices from a single codebase.

B.Implement blue/green deployments.

C.Use CI/CD pipelines with automated testing.

D.Require manual approval for each production deployment.

E.Use feature branches with manual merge approvals.

AnswersB, C

Blue/green deployments reduce risk by switching traffic between environments.

Why this answer

Correct answers are B and C. Blue/green deployments (B) reduce risk by allowing instant rollback and minimizing downtime during production releases. CI/CD pipelines with automated testing (C) increase deployment frequency by automating build, test, and deployment steps, enabling rapid and reliable releases.

Option A is incorrect because deploying all microservices from a single codebase increases coupling and blast radius. Option D is incorrect because manual approval gates slow down frequency. Option E is incorrect because feature branches with manual merge approvals introduce delays and integration complexity.

Full explanation →

945

MCQhard

A company has a microservices architecture running on Amazon ECS with Fargate. Each service writes logs to CloudWatch Logs. The operations team needs to search across all logs for a specific error pattern. Currently, they manually query each log group, which is time-consuming. What is the MOST efficient way to enable centralized log search?

A.Export logs to Amazon S3 and use Amazon Athena to query them.

B.Use CloudWatch Contributor Insights to identify the top error sources.

C.Create a subscription filter for each log group that sends logs to a Kinesis Data Firehose delivery stream.

D.Use CloudWatch Logs Insights to query all log groups from a single query.

AnswerD

CloudWatch Logs Insights is the most efficient way to query across multiple log groups with a single query, enabling centralized search without additional infrastructure.

Why this answer

CloudWatch Logs Insights enables querying multiple log groups in a single query using a query language, allowing centralized search across all services. Option A is wrong because exporting to S3 and using Athena is for analyzing historical data, not real-time search. Option B is wrong because CloudWatch Contributor Insights identifies top contributors and is not for arbitrary pattern search.

Option C is wrong because subscription filters to Kinesis Data Firehose can centralize logs but require additional infrastructure and do not provide a built-in query interface like Logs Insights.

Exam trap

Candidates may think that sending logs to a central storage like S3 or Kinesis is necessary, but CloudWatch Logs Insights already provides cross-log-group querying.

Full explanation →

946

MCQeasy

A company is designing a microservices architecture on Amazon ECS with Fargate. They want to ensure that services can communicate with each other but are isolated from the internet. What is the MOST secure way to achieve this?

A.Use VPC peering to connect the subnets of each service.

B.Use AWS PrivateLink to create VPC endpoints for each service.

C.Place services in public subnets and use security groups to restrict inbound traffic.

D.Place all ECS services in private subnets and use AWS Cloud Map for service discovery.

AnswerD

Private subnets ensure no internet exposure; Cloud Map provides DNS-based service discovery.

Why this answer

Placing ECS services in private subnets ensures they have no direct internet access, while AWS Cloud Map provides a secure, DNS-based service discovery mechanism that allows services to communicate internally using private IP addresses. This design eliminates exposure to the internet and leverages AWS's native service discovery for dynamic microservices.

Exam trap

The trap here is that candidates often confuse VPC peering or PrivateLink as solutions for internal service communication, but these are designed for cross-VPC or external service access, not for secure, internet-isolated inter-service discovery within a single VPC.

How to eliminate wrong answers

Option A is wrong because VPC peering connects entire VPCs, not individual subnets, and does not inherently isolate services from the internet; it also adds complexity and transitive routing limitations. Option B is wrong because AWS PrivateLink creates VPC endpoints for accessing specific AWS services or your own services via NLB, but it is not designed for inter-service communication within the same VPC and introduces unnecessary cost and latency. Option C is wrong because placing services in public subnets exposes them to the internet even with restrictive security groups, as public subnets have a route to an internet gateway, violating the isolation requirement.

Full explanation →

947

MCQeasy

A company is using Amazon RDS for MySQL and wants to minimize downtime during a major version upgrade. Which approach is the MOST effective?

A.Take a snapshot, restore as a new instance with the new version, and update the application endpoint.

B.Create a read replica with the new version, promote it to primary, and update the application endpoint.

C.Launch a new RDS instance with the new version, use DMS to migrate data, and switch the application endpoint.

D.Use the AWS RDS modify-db-instance command with the --allow-major-version-upgrade option. This typically causes a few minutes of downtime but is the simplest.

AnswerB

This approach minimizes downtime as the promotion is fast.

Why this answer

Creating a read replica, upgrading it, and then promoting it to primary minimizes downtime because the promotion is a quick operation.

Full explanation →

948

MCQmedium

A company is using AWS CodePipeline to build and deploy a Java application to Elastic Beanstalk. Recently, deployments have been failing due to unit test failures in the build stage. The team wants to receive immediate notifications when a pipeline fails. What is the MOST efficient way to achieve this?

A.Configure CodePipeline to send notifications to an Amazon SNS topic when the pipeline fails.

B.Have the build script send a notification on failure using the AWS CLI.

C.Set up a CloudWatch Events rule to trigger an AWS Lambda function that sends an email via Amazon SES.

D.Create a CloudWatch alarm on the CodePipeline failure metric.

AnswerA

Direct and efficient.

Why this answer

AWS CodePipeline natively supports sending notifications to Amazon SNS topics when pipeline state changes occur, such as failure. This is the most direct and efficient method without requiring additional services. Option B is incorrect because while the build script could use the AWS CLI to send a notification, this would require modifying the build script and does not leverage CodePipeline's built-in notification capability.

Option C is incorrect because although a CloudWatch Events (EventBridge) rule can trigger a Lambda function to send email via SES, this approach is more complex and less efficient than using SNS directly from CodePipeline. Option D is incorrect because CloudWatch alarms are designed for metric-based thresholds, not for pipeline state changes; CodePipeline events are better handled via SNS or EventBridge.

Full explanation →

949

Multi-Selectmedium

A company has a multi-account AWS environment and wants to implement a secure, scalable cross-account network architecture using AWS Transit Gateway. Which TWO steps should be taken?

Select 2 answers

A.Deploy VPC endpoints in each account for communication

B.Create a Transit Gateway in a central networking account and share it with other accounts using AWS Resource Access Manager

C.Create VPC attachments in each account to connect to the shared Transit Gateway

D.Establish VPC peering connections between each account and the central networking account

E.Set up AWS Direct Connect between all accounts

AnswersB, C

RAM allows sharing the Transit Gateway with other accounts.

Why this answer

AWS Transit Gateway must be created in a central networking account and then shared with other accounts using AWS Resource Access Manager (RAM) to enable cross-account connectivity without VPC peering. This centralizes routing and simplifies network management across multiple VPCs and accounts.

Exam trap

The trap here is that candidates confuse VPC endpoints (used for service access) with Transit Gateway (used for VPC-to-VPC routing), or assume VPC peering is sufficient for multi-account scalability despite its non-transitive nature and management overhead.

Full explanation →

950

MCQhard

A company runs a production database on Amazon RDS for PostgreSQL. The database experiences high write latency during peak hours. The company wants to improve write performance with minimal cost. Which action should a solutions architect take?

A.Enable Multi-AZ deployment for automatic failover.

B.Add multiple read replicas in different Availability Zones.

C.Use RDS for PostgreSQL with multiple write replicas and configure application-level sharding.

D.Increase the allocated storage and provisioned IOPS.

AnswerD

Increasing allocated storage and provisioned IOPS directly improves I/O capacity, reducing write latency. It is a viable and cost-effective solution for high write loads.

Why this answer

To improve write performance, increasing allocated storage and provisioned IOPS can reduce write latency by providing more I/O capacity. While other options like sharding could theoretically help, Option C is not feasible because Amazon RDS for PostgreSQL does not support multiple write replicas; only read replicas are available. Option D is the most practical and cost-effective solution among the given choices.

Full explanation →

951

MCQhard

A healthcare startup is building a HIPAA-compliant application on AWS. The application uses Amazon RDS for MySQL to store patient data. The compliance team requires that all database changes be audited, including SELECT statements. The current solution enables general query logs on the RDS instance, but the logs are stored locally and are lost when the instance is rebooted. Additionally, the logs are consuming significant storage on the instance. The startup needs a durable, scalable, and cost-effective solution for storing and querying database audit logs. Which solution meets these requirements?

A.Enable audit logs on RDS and use Amazon Kinesis Data Firehose to stream logs to Amazon S3. Use Amazon Athena to query the logs.

B.Configure RDS to publish audit logs to Amazon CloudWatch Logs, then export logs to Amazon S3 using a subscription filter and Lambda. Use Athena to query the logs in S3.

C.Enable the general query log on RDS and set the log_output to TABLE. Write a scheduled script to copy the log table to Amazon S3.

D.Enable audit logs on RDS and stream them to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query logs.

AnswerB

This solution is correct. RDS for MySQL can publish audit logs to CloudWatch Logs. A subscription filter and Lambda function can export those logs to S3. Athena provides a cost-effective, serverless query service for the S3 data, meeting durability, scalability, and cost requirements.

Why this answer

The most suitable solution. RDS for MySQL supports publishing audit logs to CloudWatch Logs. From there, you can set up a subscription filter to a Lambda function that exports logs to Amazon S3 for durable storage. Athena can then be used to query the logs cost-effectively. This approach is durable, scalable, and cost-effective, meeting the compliance requirement for auditing changes including SELECT statements.

Option A: While Kinesis Data Firehose can stream to S3, enabling audit logs on RDS for MySQL does not directly integrate with Kinesis; this option is more complex and unnecessary. Option C: Storing logs in a table on RDS consumes instance storage and does not provide durable, scalable storage; logs are still lost on reboot. Option D: CloudWatch Logs Insights is not cost-effective for long-term querying of large volumes and does not offer the same query flexibility as Athena on S3.

Full explanation →

952

MCQmedium

A company has a multi-account AWS environment using AWS Organizations with 50 accounts. The accounts are organized into OUs based on environment: Production, Staging, and Development. The central IT team uses AWS CloudFormation StackSets to deploy a baseline network configuration (VPC, subnets, security groups) to all accounts. Recently, the network team updated the stack set to add a new subnet to the VPC. After the update, they noticed that the stack set operation failed for 10 accounts. The error message indicates that the stack set cannot update because a resource already exists. What is the MOST LIKELY cause of this failure?

A.The accounts are in different OUs and the stack set is not configured to deploy to all OUs.

B.Some accounts have manually created resources that conflict with the stack set template's resources.

C.The network team does not have sufficient IAM permissions to update stacks in those accounts.

D.The stack set was previously drift-detected and the drift is preventing updates.

AnswerB

If a resource with the same logical ID already exists outside the stack, CloudFormation cannot update the stack and throws an error.

Why this answer

StackSets deploy a common template across accounts. If a resource defined in the template (e.g., a subnet with a specific CIDR) already exists in an account due to manual creation or prior configuration, the update fails with a 'resource already exists' error. Option A is incorrect because OU configuration affects initial deployment, not updates, and the error is about resource conflict, not OU coverage.

Option C is incorrect because IAM permissions would cause an 'access denied' error, not a resource conflict. Option D is incorrect because drift detection does not prevent updates; it only reports differences.

Full explanation →

953

MCQmedium

A company has multiple AWS accounts managed under AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution is the MOST operationally efficient?

A.Use an AWS Lambda function triggered by AWS CloudTrail to tag buckets after creation.

B.Use an AWS Config rule to mark non-compliant buckets and automatically apply tags.

C.Use AWS CloudFormation StackSets to deploy a template that creates tagged buckets in each account.

D.Use a service control policy (SCP) to deny s3:CreateBucket unless the request includes a 'CostCenter' tag.

AnswerD

SCPs can deny API calls based on conditions, enforcing tagging across all accounts.

Why this answer

A service control policy (SCP) can deny the s3:CreateBucket action unless the request includes a 'CostCenter' tag, using the 'aws:RequestTag' condition key. This enforces tagging at the point of creation across all accounts in the organization, preventing untagged buckets from being created in the first place, which is the most operationally efficient approach as it avoids the need for remediation or post-creation tagging.

Exam trap

The trap here is that candidates often choose reactive solutions like AWS Config or Lambda because they are familiar with auto-remediation, but they overlook that SCPs can proactively deny API calls based on request parameters, which is more operationally efficient and aligns with the 'prevent rather than remediate' best practice.

How to eliminate wrong answers

Option A is wrong because using a Lambda function triggered by CloudTrail is reactive and less efficient; it requires setting up CloudTrail, Lambda, and permissions, and there is a delay between bucket creation and tagging, during which the bucket is untagged and could be used. Option B is wrong because an AWS Config rule can only detect non-compliant buckets and trigger auto-remediation (e.g., via a custom Lambda), but it is also reactive and adds complexity; it does not prevent creation of untagged buckets, and the remediation may fail if the bucket is created and immediately used. Option C is wrong because CloudFormation StackSets can only enforce tagging for buckets created via CloudFormation templates, not for buckets created through the console, CLI, SDK, or other services, leaving a significant gap in enforcement.

Full explanation →

954

MCQmedium

A financial services company uses Amazon RDS for MySQL as the backend for a trading application. The application runs on EC2 instances in an Auto Scaling group behind an ALB. The database is a Multi-AZ DB instance with 500 GB provisioned storage. During peak trading hours, the application becomes slow. The RDS metrics show high CPU utilization and high read IOPS. The application performs many read-heavy queries. The team needs to improve performance without application changes. What should they do?

A.Create one or more read replicas and direct read traffic to them.

B.Modify the DB instance to a larger instance type with more vCPUs.

C.Enable Performance Insights and create a CloudWatch dashboard.

D.Convert the DB instance to a Multi-AZ cluster with two readable standbys.

AnswerA

Read replicas offload read queries, reducing load on the primary instance.

Why this answer

Creating read replicas offloads read traffic from the primary DB instance, reducing CPU utilization and read IOPS during peak hours. This improves performance without requiring application changes. Option B (larger instance type) may help but could involve downtime and does not address the read-heavy nature as effectively.

Option C (Performance Insights) provides monitoring but does not directly improve performance. Option D (Multi-AZ cluster with readable standbys) is for high availability and read scaling, but the two readable standbys may not be as cost-effective as dedicated read replicas, and converting to a cluster may require application changes or downtime.

Full explanation →

955

MCQhard

A company is designing a new application that requires low-latency access to a shared dataset across multiple EC2 instances in the same AWS Region. The dataset is updated frequently. Which storage solution should the company use?

A.Amazon S3

B.Amazon EBS with Provisioned IOPS

C.Amazon S3 Glacier

D.Amazon EFS

AnswerD

EFS is a scalable file system that can be mounted on multiple EC2 instances.

Why this answer

Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones within the same AWS Region. It offers low-latency access and supports frequent updates through its standard storage class, making it ideal for shared datasets that require consistent, low-latency performance.

Exam trap

The trap here is that candidates often confuse block storage (EBS) with shared file storage, assuming EBS can be attached to multiple instances simultaneously, or they overlook the latency and protocol differences between object storage (S3) and file storage (EFS) for shared, low-latency workloads.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service accessed via HTTP/S APIs, not a file system; it introduces higher latency and does not support low-latency file-level locking or concurrent NFS-style access required by multiple EC2 instances. Option B is wrong because Amazon EBS volumes are block-level storage that can only be attached to a single EC2 instance at a time (except for multi-attach EBS, which is limited to specific instance types and is not designed for shared, frequently updated datasets across many instances). Option C is wrong because Amazon S3 Glacier is designed for archival and long-term backup with retrieval times ranging from minutes to hours, making it completely unsuitable for low-latency, frequently updated access.

Full explanation →

956

Multi-Selectmedium

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application needs to process a large batch job that runs once per month and takes 2 hours. The company wants to optimize costs while ensuring the batch job has sufficient capacity. Which THREE steps should a solutions architect recommend?

Select 3 answers

A.Create a scheduled scaling policy that increases the desired capacity before the batch job starts.

B.Use a launch template with multiple instance types to increase the chances of obtaining Spot capacity.

C.Use On-Demand Instances only for the batch job to ensure availability.

D.Use Spot Instances in the Auto Scaling group for the batch job.

E.Purchase Reserved Instances for the batch job capacity.

AnswersA, B, D

Scheduled scaling ensures capacity is available when needed.

Why this answer

A scheduled scaling policy allows you to increase the desired capacity of the Auto Scaling group before the batch job starts, ensuring sufficient resources are available exactly when needed. This proactive approach avoids the latency of dynamic scaling and optimizes cost by not maintaining extra capacity outside the batch window.

Exam trap

The trap here is that candidates may assume On-Demand or Reserved Instances are required for reliability, but the question emphasizes cost optimization and the batch job's fault tolerance, making Spot Instances with a scheduled scaling policy the correct approach.

Full explanation →

957

MCQmedium

A data analytics company is building a real-time streaming pipeline using Amazon Kinesis Data Streams. The data is consumed by multiple consumer applications, each with different processing requirements. The company wants to ensure that each consumer can process records independently without affecting others and can reprocess data from a specific point in time. Which feature should the company use?

A.Use Enhanced Fan-Out with a timestamp to start reading.

B.Increase the data retention period to 365 days.

C.Use resharding to increase the number of shards.

D.Use the Kinesis Client Library (KCL) with checkpointing.

AnswerA

Enhanced Fan-Out provides dedicated throughput per consumer and supports starting from a specific timestamp.

Why this answer

Enhanced Fan-Out (EFO) provides each consumer with a dedicated 2 MB/second read throughput per shard, ensuring independent processing without contention. By using the SubscribeToShard API with a starting position specified via a timestamp, consumers can reprocess data from a specific point in time, meeting the requirement exactly.

Exam trap

The trap here is that candidates often confuse checkpointing (which manages consumer state but not throughput isolation) with Enhanced Fan-Out (which provides dedicated throughput and independent consumption), leading them to select the KCL with checkpointing option instead.

How to eliminate wrong answers

Option B is wrong because increasing the data retention period to 365 days (the maximum) only extends how long records are stored in the stream; it does not provide dedicated throughput per consumer or enable independent reprocessing from a specific timestamp. Option C is wrong because resharding increases the number of shards to scale write/read capacity, but it does not give each consumer a dedicated connection or the ability to reprocess from a chosen point without affecting other consumers. Option D is wrong because the Kinesis Client Library (KCL) with checkpointing allows consumers to track their progress and resume from a checkpoint, but it still shares the 2 MB/second per shard among all consumers using the same shard, causing contention and lacking the independent, low-latency delivery that Enhanced Fan-Out provides.

Full explanation →

958

Multi-Selecthard

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket and must be secured with HTTPS. Which three services or features should be used together to meet these requirements?

Select 3 answers

A.Application Load Balancer

B.S3 bucket configured as an origin with Origin Access Control (OAC)

C.Amazon Route 53

D.AWS Certificate Manager (ACM) to provision a custom SSL certificate

E.Amazon CloudFront

AnswersB, D, E

Restricts direct access to S3, ensuring content is served only through CloudFront.

Why this answer

Origin Access Control (OAC) allows CloudFront to securely access the S3 bucket without making the bucket public, enforcing that all requests come through CloudFront. This is the modern replacement for Origin Access Identity (OAI) and supports HTTPS between CloudFront and S3.

Exam trap

The trap here is that candidates often think an Application Load Balancer is needed for HTTPS termination, but CloudFront handles HTTPS natively with ACM, and ALB is unnecessary for static S3 content.

Full explanation →

959

MCQmedium

A company is migrating a web application from on-premises to AWS. The application consists of a stateless web tier and a stateful application tier that stores session data in a local file system. The company wants to use AWS Elastic Beanstalk for both tiers. During a test migration, the development team notices that users are being logged out intermittently. The application tier is configured with two EC2 instances behind an internal load balancer. What should the development team do to resolve the issue?

A.Enable sticky sessions (session affinity) on the application tier's load balancer.

B.Move session storage to Amazon ElastiCache for Redis and configure the application to use it.

C.Increase the number of instances in the web tier to reduce the load on the application tier.

D.Store session data in Amazon DynamoDB.

AnswerB

ElastiCache provides a centralized, fast session store that works across instances.

Why this answer

The issue is that session data is stored locally on each application instance. When traffic is distributed by the internal load balancer, subsequent requests from the same user may go to a different instance, losing the session data. The best practice is to use a centralized session store like Amazon ElastiCache for Redis.

This ensures session data persists across all instances. Option A (sticky sessions) would cause load imbalance and is not recommended for high availability. Option C does not address session storage.

Option D (DynamoDB) is possible but not as performant for session storage and requires more custom code; Redis is the recommended service for session management.

Full explanation →

960

MCQhard

A company has a central networking account that hosts a transit gateway (TGW). Multiple VPCs from various accounts are attached to the TGW. The security team wants to ensure that only specific VPCs can communicate with each other, but all VPCs need access to a shared services VPC. Which configuration should be used?

A.Create a VPC peering connection between each pair of VPCs that need to communicate.

B.Use AWS PrivateLink to connect VPCs to the shared services VPC.

C.Use a single TGW route table for all attachments and control traffic with security groups.

D.Create separate TGW route tables for each VPC and only propagate the shared services VPC routes.

AnswerD

This isolates VPCs from each other while allowing all to reach shared services.

Why this answer

Using separate TGW route tables for each VPC allows you to control which VPCs can communicate by selectively propagating only the shared services VPC routes into each VPC's route table. This ensures all VPCs can reach the shared services VPC, while VPCs that do not have each other's routes in their respective route tables cannot communicate directly. This approach leverages the transitive routing capability of the transit gateway while maintaining strict isolation between non-shared VPCs.

Exam trap

The trap here is that candidates often assume a single TGW route table with security groups can control inter-VPC traffic, but security groups cannot be applied to transit gateway attachments—they only work at the instance or ENI level, and TGW route tables control routing, not filtering.

How to eliminate wrong answers

Option A is wrong because VPC peering connections are point-to-point and do not scale well; they require a separate peering connection for every pair of VPCs, which becomes unmanageable as the number of VPCs grows, and they do not leverage the existing transit gateway. Option B is wrong because AWS PrivateLink is used to expose services privately within a VPC, not to enable general VPC-to-VPC routing; it would only allow VPCs to access specific services in the shared services VPC, not full network-layer communication between all VPCs. Option C is wrong because using a single TGW route table for all attachments would allow all VPCs to communicate with each other by default (since all routes are shared), and security groups cannot be applied to TGW attachments to filter traffic between VPCs—security groups are stateful firewalls for instances, not for transit gateway routing decisions.

Full explanation →

961

MCQhard

A company is migrating from a monolithic application to microservices on AWS. They need to reduce the blast radius of failures. Which architecture pattern should they implement?

A.Implement Auto Scaling groups for each microservice without separating data stores.

B.Use a cell-based architecture where each microservice runs in isolated cells with independent data stores.

C.Route all traffic through a single Application Load Balancer to simplify management.

D.Deploy all microservices in a single Availability Zone with a shared database.

AnswerB

Cell-based architecture isolates failures to one cell, reducing overall impact.

Why this answer

Cell-based architecture isolates failures to individual cells, reducing blast radius. Option A is wrong because sharing a data store creates a single point of failure. Option C is wrong because a single Application Load Balancer creates a single point of failure and bottleneck.

Option D is wrong because a single Availability Zone and shared database are single points of failure.

Full explanation →

962

MCQhard

A large enterprise uses AWS Organizations with hundreds of accounts. The central security team needs to enforce that no IAM users are created in any account; instead, all access must be through IAM roles federated with the corporate identity provider. The security team wants to detect any IAM user creation and automatically remediate it by deleting the user and notifying the security team. Which solution should be implemented?

A.Use AWS Config with a custom rule triggered by iam:CreateUser, and an AWS Lambda function that deletes the user and sends an Amazon SNS notification.

B.Use IAM Access Analyzer to detect and report IAM user creation.

C.Use an SCP to deny iam:CreateUser across all accounts.

D.Enable AWS CloudTrail and create a metric filter for iam:CreateUser, then set up an Amazon CloudWatch alarm that triggers an SNS notification.

AnswerA

Config rule triggers Lambda for automatic remediation and notification.

Why this answer

AWS Config custom rules can be triggered on specific API calls via AWS CloudTrail events. By configuring a custom rule with an AWS Lambda function triggered by iam:CreateUser, the solution can automatically delete the newly created IAM user and send an SNS notification to the security team, providing both detection and remediation.

Exam trap

The trap here is that candidates may choose an SCP (Option C) because it prevents IAM user creation, but the question specifically requires detection and automatic remediation (deletion and notification), not just prevention.

How to eliminate wrong answers

Option B is wrong because IAM Access Analyzer is designed to analyze resource-based policies for unintended cross-account access, not to detect or report IAM user creation events. Option C is wrong because an SCP that denies iam:CreateUser would prevent IAM user creation proactively, but the question explicitly requires detection and automatic remediation (deletion and notification), not just prevention. Option D is wrong because a CloudWatch alarm on a metric filter for iam:CreateUser can only trigger a notification; it cannot automatically delete the IAM user, so it lacks the remediation step required by the question.

Full explanation →

963

MCQhard

A company is designing a new hybrid cloud solution that requires low-latency access to on-premises data from AWS. The connection must be highly available and encrypted. The company has multiple VPCs and on-premises locations. Which combination of services meets these requirements?

A.AWS Site-to-Site VPN and VPC Endpoints

B.AWS Transit Gateway and AWS Direct Connect with VPN backup

C.VPC Peering and AWS Site-to-Site VPN

D.AWS Client VPN and VPC Peering

AnswerB

Transit Gateway provides a hub-and-spoke model for multiple VPCs and on-premises networks. Direct Connect offers dedicated low-latency connections with encryption, and VPN provides a backup.

Why this answer

AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks, simplifying the hybrid architecture. AWS Direct Connect provides a private, low-latency, and consistent network path, while a Site-to-Site VPN over the Direct Connect link (or as a separate backup) adds encryption and high availability. This combination meets all requirements: low latency (Direct Connect), encryption (VPN), high availability (dual connections or failover), and support for multiple VPCs and on-premises locations (Transit Gateway).

Exam trap

The trap here is that candidates often assume a single VPN or Direct Connect alone is sufficient, but the question requires both low latency (Direct Connect) and encryption (VPN) across multiple VPCs and on-premises sites, which only Transit Gateway with Direct Connect and VPN backup fully satisfies.

How to eliminate wrong answers

Option A is wrong because VPC Endpoints are used for private access to AWS services (e.g., S3, DynamoDB) and do not provide connectivity to on-premises data centers; they also do not offer encryption or high availability for hybrid connectivity. Option C is wrong because VPC Peering does not support transitive routing (it is a one-to-one connection) and cannot connect multiple VPCs to multiple on-premises locations without a hub; additionally, it does not inherently provide encryption or low-latency guarantees for hybrid links. Option D is wrong because AWS Client VPN is a remote access VPN for individual clients (not site-to-site) and VPC Peering again lacks transitive routing and cannot aggregate multiple on-premises connections.

Full explanation →

964

Matchingmedium

Match each AWS compute service to its use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Serverless compute for event-driven applications

Run Docker containers without managing servers

Managed Kubernetes for container orchestration

Serverless compute for containers

Virtual servers for full control over the environment

Why these pairings

The correct matches are: EC2 for full control over virtual servers, Lambda for serverless event-driven code, and ECS for Docker containers. Common confusions include mixing up serverless features with EC2.

Full explanation →

965

Multi-Selecthard

A company manages 200 AWS accounts using AWS Organizations. The security team wants to prevent developers from creating resources outside of a set of approved AWS Regions. Additionally, they want to restrict the creation of resources that are not tagged with a cost center tag. Which THREE actions should be taken to enforce these requirements?

Select 3 answers

A.Create an SCP that denies all actions in non-approved regions.

B.Enable AWS Config rules to detect untagged resources and automatically apply the required tag.

C.Use IAM policies in each account to deny actions in non-approved regions.

D.Define a tag policy using AWS Organizations to enforce cost center tags.

E.Create an SCP that denies the creation of resources that do not have a cost center tag.

AnswersA, B, E

SCPs can centrally deny actions in specific regions.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can be used to deny all actions in non-approved regions by specifying a condition key like 'aws:RequestedRegion' with a list of allowed regions. This effectively prevents developers in any member account from creating or interacting with resources outside the approved set, regardless of their IAM permissions.

Exam trap

The trap here is that candidates often confuse tag policies (which only enforce compliance after creation) with SCPs that can deny creation of untagged resources, and they mistakenly think IAM policies can be centrally managed across accounts when only SCPs provide organization-wide enforcement.

Full explanation →

966

MCQeasy

A company uses Amazon CloudWatch Logs to collect application logs. The operations team wants to be notified when a specific error message appears in the logs. What is the SIMPLEST way to achieve this?

A.Configure S3 event notifications on the log file destination to send an alert.

B.Subscribe a Lambda function to the log group and have it check for the error message.

C.Create a metric filter on the log group for the error message and set up a CloudWatch alarm on the metric.

D.Use CloudWatch Logs Insights to run a query periodically and send results via email.

AnswerC

Metric filters convert log events into metrics, and alarms can trigger notifications.

Why this answer

The simplest way to notify when a specific error message appears in CloudWatch Logs is to create a metric filter on the log group for the error message, then set up a CloudWatch alarm on that metric. This is native, requires no custom code, and provides real-time alerting. Option A is incorrect because S3 event notifications apply to S3 objects, not CloudWatch Logs content.

Option B is incorrect because subscribing a Lambda function is more complex than using a metric filter and alarm. Option D is incorrect because CloudWatch Logs Insights queries are not real-time and require manual or scheduled execution.

Full explanation →

967

Multi-Selecthard

A company runs a critical application on Amazon RDS for MySQL. The database size is 500 GB and growing. The application experiences high write latency during peak hours. A Solutions Architect needs to improve write performance with minimal downtime. Which THREE actions should the architect take? (Choose three.)

Select 3 answers

A.Migrate the database to Amazon Aurora with MySQL compatibility.

B.Add a read replica to offload read traffic.

C.Enable Multi-AZ deployment for the DB instance.

D.Change the storage type to Provisioned IOPS.

E.Increase the allocated storage of the DB instance.

AnswersA, D, E

Aurora offers better write throughput and scalability compared to RDS MySQL.

Why this answer

Migrating to Amazon Aurora (A) improves write performance because Aurora uses a distributed storage subsystem with better throughput and lower latency than standard RDS for MySQL. Changing the storage type to Provisioned IOPS (D) guarantees consistent low-latency I/O, directly improving write performance. Increasing allocated storage (E) increases the baseline IOPS for gp2 volumes, which can reduce write latency under high load.

Option B (read replica) offloads read traffic but does not help write performance. Option C (Multi-AZ) provides high availability but does not improve write performance.

Full explanation →

968

MCQeasy

A company uses AWS Organizations with a single member account for its development environment. The IT team wants to allow developers to launch EC2 instances only if they use a specific AMI ID. Which policy type should the company use to enforce this requirement?

A.Attach a service control policy (SCP) to the member account that denies EC2:RunInstances if the AMI ID is not approved.

B.Create an IAM policy that denies EC2:RunInstances if the AMI ID is not approved and attach it to all developer IAM roles.

C.Use AWS Config rules to detect noncompliant EC2 instances and automatically terminate them.

D.Use AWS Systems Manager to enforce the AMI ID requirement.

AnswerA

SCPs can restrict actions at the account level and are effective for preventive controls.

Why this answer

SCPs can be used to restrict actions at the account level, including specifying allowed AMI IDs. Option B is wrong because IAM policies apply to users and roles within an account, but SCPs are more appropriate for organization-wide restrictions. Option C is wrong because AWS Config rules are detective, not preventive.

Option D is wrong because service control policies are the right mechanism.

Full explanation →

969

MCQmedium

A company is migrating a legacy monolithic application to AWS. The application has a stateful session layer that uses local disk storage. The migration plan involves rehosting the application on Amazon EC2 instances. What architecture change should the company implement to ensure high availability and stateless application tiers?

A.Store session data in Amazon S3 with Transfer Acceleration.

B.Use Amazon RDS with Multi-AZ to store session data.

C.Use Amazon ElastiCache for session state management.

D.Attach Amazon EBS volumes to each EC2 instance for session persistence.

AnswerC

Amazon ElastiCache provides low-latency session caching, enabling stateless EC2 instances.

Why this answer

ElastiCache provides a low-latency, highly available, and scalable in-memory cache that can store session state independently from EC2 instances. This decouples state from compute, enabling stateless application tiers that can be auto-scaled and replaced without losing session data. Option A (S3 Transfer Acceleration) is not suitable for frequent, low-latency session reads/writes.

Option B (RDS Multi-AZ) is designed for relational databases, not session caching, and would introduce unnecessary overhead. Option D (EBS volumes) ties state to specific instances, preventing high availability and auto-scaling.

Full explanation →

970

MCQhard

A company is modernizing a legacy application by refactoring it into microservices. The application uses a monolithic Oracle database. The team wants to use Amazon RDS for Oracle as the migration target. Which migration approach minimizes risk and downtime?

A.Create a new RDS instance and use AWS SCT to convert the schema, then cutover after testing.

B.Use the strangler fig pattern to incrementally migrate functionality to new microservices, each with its own database.

C.Migrate the entire database at once using AWS DMS with ongoing replication.

D.Rewrite the application as microservices on AWS and then migrate the database.

AnswerB

Strangler fig pattern minimizes risk by migrating in small increments.

Why this answer

The strangler fig pattern allows gradual migration. Option A is wrong because big bang migration is high risk. Option C is wrong because the phased approach may work but is broader; strangler fig is specific to microservices.

Option D is wrong because rewriting all at once is high risk.

Full explanation →

971

MCQeasy

A company wants to decouple a front-end web application from a backend processing service to improve scalability. Which AWS service should be used to send tasks from the web tier to the processing tier?

A.Amazon Simple Notification Service (SNS)

B.Amazon EventBridge

C.Amazon Kinesis Data Streams

D.Amazon Simple Queue Service (SQS)

AnswerD

SQS is a message queue that decouples components and allows asynchronous processing.

Why this answer

Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the front-end web application from the backend processing service. The web tier can send tasks (messages) to an SQS queue, and the processing tier can poll and consume those messages asynchronously, enabling independent scaling of each tier. This pattern is a classic example of a producer-consumer architecture where SQS acts as the buffer between components.

Exam trap

The trap here is that candidates often confuse SNS (push-based) with SQS (pull-based) and assume SNS can decouple components, but SNS lacks message persistence and consumer-driven polling, making it unsuitable for reliable task queuing where the consumer may be temporarily unavailable.

How to eliminate wrong answers

Option A is wrong because Amazon Simple Notification Service (SNS) is a pub/sub messaging service that pushes notifications to subscribers (e.g., HTTP endpoints, Lambda, SQS), but it does not provide a durable queue for decoupling; tasks sent via SNS are not stored for later retrieval if the consumer is unavailable. Option B is wrong because Amazon EventBridge is an event bus service designed for routing events between AWS services and SaaS applications, not for building a point-to-point task queue between a web front-end and a processing tier; it lacks the built-in message retention and polling mechanics of a queue. Option C is wrong because Amazon Kinesis Data Streams is optimized for real-time streaming of large volumes of data (e.g., log ingestion, clickstreams) and requires consumers to manage shard-level processing, which is overkill and more complex than a simple task queue for decoupling web requests.

Full explanation →

972

MCQhard

A company has a monolithic application running on a single Amazon EC2 instance. The application consists of a web server and a backend worker process. The company wants to migrate to a microservices architecture using containers on Amazon ECS with Fargate. The solutions architect needs to design a solution that minimizes downtime during the migration. Which approach should the solutions architect recommend?

A.Create a Docker image of the entire monolithic application and run it on ECS with Fargate.

B.Use a strangler fig pattern: gradually replace parts of the monolith with microservices, routing traffic via an Application Load Balancer.

C.Run the monolithic application on the same EC2 instance as the new microservices, using different ports.

D.Refactor the entire application into microservices, then deploy all microservices at once on ECS.

AnswerB

This incremental approach minimizes downtime and risk, allowing both old and new to coexist.

Why this answer

A strangler fig pattern allows incremental migration of functionality from the monolith to microservices, with the ALB routing traffic to either the monolith or new services. This minimizes downtime because the old application remains operational while pieces are moved. Option A is wrong because a lift-and-shift of the entire application into a single container does not decompose it into microservices.

Option C is wrong because running both the monolith and new services on the same instance but on different ports does not inherently minimize downtime and complicates routing. Option D is wrong because refactoring the entire application at once introduces significant risk and downtime.

Full explanation →

973

MCQhard

A company is designing a disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. The primary region is us-east-1, and the secondary region is us-west-2. Which solution meets the requirements with the LOWEST cost?

A.Use AWS Database Migration Service (DMS) for continuous replication to us-west-2

B.Use a cross-region read replica in us-west-2 with MySQL asynchronous replication

C.Use automated backups and restore to us-west-2 when needed

D.Use a Multi-AZ deployment in us-east-1 and failover to a standby instance

AnswerB

Read replica provides near real-time replication and fast promotion.

Why this answer

A cross-region read replica in us-west-2 with MySQL asynchronous replication meets the RPO of 1 hour and RTO of 15 minutes at the lowest cost. Asynchronous replication provides near-real-time data transfer with minimal overhead, and the read replica can be promoted to a standalone primary instance in minutes, satisfying the RTO. This approach avoids the continuous data transfer costs of DMS and the storage costs of Multi-AZ, while automated backups alone cannot meet the RPO.

Exam trap

The trap here is that candidates may choose Multi-AZ (Option D) thinking it provides cross-region DR, but Multi-AZ is a single-region HA feature with synchronous replication, not a cross-region DR solution, and it cannot meet the requirement for a secondary region.

How to eliminate wrong answers

Option A is wrong because AWS DMS for continuous replication incurs ongoing replication instance costs and data transfer charges, making it more expensive than a cross-region read replica for this RPO/RTO requirement. Option C is wrong because automated backups and restore to us-west-2 when needed cannot achieve an RPO of 1 hour, as backups are typically taken once per day and restore times exceed 15 minutes. Option D is wrong because a Multi-AZ deployment in us-east-1 provides high availability within a single region, not disaster recovery across regions, and fails to meet the requirement for a secondary region in us-west-2.

Full explanation →

974

MCQhard

A company is migrating a monolithic application to AWS and wants to modernize it into microservices. The application currently uses a single relational database. Which migration strategy is most appropriate to minimize risk while starting the modernization process?

A.Incremental migration using the Strangler Fig pattern

B.Big bang migration of the entire application to containers

C.Replatform to Amazon RDS for MySQL

D.Rehost the application using AWS VM Import/Export

AnswerA

The Strangler Fig pattern allows gradual replacement of monolith components with microservices, minimizing risk.

Why this answer

The Strangler Fig pattern (Option A) is the most appropriate strategy because it allows incremental replacement of monolithic components with microservices, reducing the risk associated with a full rewrite or big bang migration. Option B (big bang migration to containers) is risky as it requires simultaneous migration of all components. Option C (replatform to Amazon RDS) only changes the database platform without addressing application architecture.

Option D (rehost using VM Import/Export) simply lifts and shifts the monolith without modernization.

Full explanation →

975

MCQmedium

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to share a VPC subnet in the network account with the workload accounts so that they can launch EC2 instances directly into the shared subnet. The network team has created a VPC with a subnet and shared it using AWS Resource Access Manager (RAM) with the workload accounts. However, the workload accounts cannot see the shared subnet when launching EC2 instances. What is the most likely cause?

A.The workload accounts have not accepted the resource share invitation.

B.The workload accounts have a default VPC that conflicts with the shared subnet.

C.The workload accounts do not have the necessary IAM permissions to use shared subnets.

D.The subnet is in a different AWS Region than the workload accounts.

AnswerA

AWS RAM requires the workload accounts to accept the resource share invitation before they can see and use the shared subnet. Until acceptance, the subnet is not visible.

Why this answer

AWS RAM requires workload accounts to accept the resource share invitation before they can see and use the shared subnet. Option B is incorrect because having a default VPC in the workload account does not prevent visibility of shared subnets; the subnet will appear in the VPC list regardless. Option C is incorrect because the primary issue is the acceptance of the resource share, not IAM permissions; while IAM permissions may be needed to launch instances, the subnet itself will not be visible until the share is accepted.

Option D is incorrect because AWS RAM supports sharing across regions, so a different region would not prevent the subnet from being visible after acceptance.

Full explanation →

Page 13 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational Complexity Design for New Solutions Continuous Improvement for Existing Solutions Accelerate Workload Migration and Modernization

See all domains with question counts →