Design for New Solutions

A company is designing a new microservices-based application on AWS. They need to decouple services and ensure asynchronous communication. Which AWS service should they use?

A company is designing a new CI/CD pipeline for a web application that will be deployed on Amazon ECS. Which AWS service should the company use to build and test the application code?

A company is migrating a monolithic application to a microservices architecture on AWS. They want to decouple the services and ensure that messages between services are processed asynchronously and durably. Which AWS service should they use for this purpose?

A solutions architect is reviewing the above IAM policy attached to an S3 bucket. A user from IP address 10.0.1.5 makes a request over HTTP (not HTTPS). Will the user be able to download an object?

A company is migrating a monolithic application to microservices on Amazon ECS. The application needs to communicate with external partners via HTTPS. The company wants to use mTLS for mutual authentication. Which AWS service should be used to handle the mTLS termination?

A company runs a critical two-tier application on AWS. The web tier consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The database tier is a single Amazon RDS for MySQL instance. The company wants to improve the availability of the database tier so that it can survive an Availability Zone failure with minimal downtime and no data loss. The application uses the RDS endpoint in its configuration. What should a solutions architect recommend?

A company is designing a new application that will process streaming data from thousands of IoT devices. The data must be ingested in real time and then processed using Apache Flink. Which services should be used? (Choose TWO.)

Refer to the exhibit. A company has an IAM policy that allows s3:GetObject on all objects in 'my-bucket' but denies access to objects in the 'confidential' folder. A user tries to access 's3://my-bucket/confidential/report.pdf'. What will happen?

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to implement service discovery and load balancing at the application layer. Which TWO services should the company use?

A company is designing a new application that requires a relational database with automated backups and multi-AZ redundancy. The database workload is predictable with occasional read replicas for reporting. Which AWS service should be used?

A company runs a stateless REST API on six Amazon EC2 instances in a single Availability Zone behind a Network Load Balancer (NLB). The API writes uploaded files to a shared POSIX file system that must remain accessible from every instance. The company wants to make the architecture resilient to an Availability Zone failure with the least operational effort. Which solution should a solutions architect recommend?

A company is designing a new global application that will be deployed in multiple AWS Regions. The application uses an Amazon Aurora MySQL database in each Region. The company needs to ensure that the database in each Region can be used for read scaling and that a secondary Region can be promoted to primary within minutes in case of a regional failure. The company wants to minimize data loss. Which solution should a solutions architect recommend?

A company is designing a new two-tier web application on AWS. The web tier runs on Amazon EC2 instances behind an Application Load Balancer (ALB), and the database tier uses Amazon RDS for MySQL. The company requires that the database credentials be automatically rotated every 30 days without application downtime. The application retrieves credentials from a centralized store at runtime. Which solution meets these requirements?

A company is designing a new application that will use Amazon DynamoDB as its primary database. The application has two access patterns: one requires strongly consistent reads, and the other requires eventually consistent reads. The company wants to minimize costs while meeting the read consistency requirements. How should the company configure DynamoDB reads?

A company is designing a new microservices architecture on Amazon ECS with Fargate. Each microservice must be isolated and able to communicate with others only through defined APIs. Which solution provides the BEST isolation and security?

A company is designing a new VPC with public and private subnets. The company wants to ensure that instances in the private subnets can download updates from the internet, but cannot be directly accessed from the internet. Which THREE components are required to meet these requirements? (Choose THREE.)

A media company is designing a new video transcoding pipeline on AWS. The pipeline receives large video files in an Amazon S3 bucket, and each file must be transcoded into multiple formats. The transcoding jobs take between 10 and 45 minutes, and the company wants to minimize compute cost while ensuring that jobs are not interrupted. The solution must automatically scale based on the number of pending jobs. Which compute option should the company use?

A company is designing a containerized microservices architecture on Amazon ECS. The services must be able to discover each other using DNS names. Which AWS service should the company use for service discovery?

A logistics company is designing a new shipment-tracking platform on AWS. The platform ingests telemetry from thousands of trucks, and downstream analytics must query the latest position of any truck within one second. The company also needs to retain six months of raw telemetry for audit at the lowest possible storage cost, and the data must be queryable with standard SQL for ad hoc reports. The company wants a fully managed solution with minimal operational overhead. Which design should the solutions architect recommend?

A company is designing a new global web application that will be deployed on AWS. The application must provide low-latency access to users worldwide and must be able to fail over between regions in case of an outage. The company wants to use a single global endpoint and minimize DNS propagation delays during failover. Which solution should a solutions architect recommend?

Refer to the exhibit. A CloudFormation template creates an S3 bucket with versioning and a public bucket policy. After deployment, users can access objects in the bucket via the internet. However, the security team requires that all access be logged. What is missing from this configuration?

A company is designing a new CI/CD pipeline for a containerized application using AWS CodePipeline. The application source code is stored in an Amazon S3 bucket. The pipeline must automatically build a Docker image from the source code and push it to Amazon ECR. Which action should be used as the build provider?

A company is designing a new application that will run on Amazon ECS with Fargate. They need to store configuration data and secrets securely. Which services should they use? (Choose TWO.)

A media company is designing a new video transcoding pipeline on AWS. Raw video files (up to 10 GB each) are uploaded by users to an S3 bucket. Each upload must be transcoded into multiple formats (MP4, WebM, HLS) and stored in another S3 bucket. The transcoding job can take up to 30 minutes per file. The company needs a solution that is cost-effective and can handle hundreds of concurrent uploads. The operations team wants to minimize maintenance. Which solution should a Solutions Architect recommend?

A company is migrating a monolithic application to microservices on AWS. They have identified that some services require high-throughput, low-latency data sharing. Which AWS service should they use for this purpose?

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS for PostgreSQL database. The database credentials must be rotated automatically every 30 days. Which THREE steps should the company take to securely manage the credentials? (Choose three.)

Refer to the exhibit. A company has an S3 bucket policy that allows GetObject access from two IP ranges (10.0.0.0/16 and 192.168.0.0/16). The policy also denies all S3 actions on the 'confidential/' prefix unless the request comes from the 10.0.0.0/16 range. Which of the following statements is true?

A company is designing a new application that must be highly available across multiple AWS Regions. The application will run on EC2 instances behind an Application Load Balancer. The company needs a DNS-based routing policy that routes users to the nearest healthy endpoint based on latency. Which Amazon Route 53 routing policy should be used?

A company is designing a global application that requires a highly available and low-latency API. The API will be consumed by clients across the world. The backend consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances in a single AWS Region. The company wants to improve performance for global users. Which solution meets these requirements with minimal operational overhead?

A company is designing a new serverless application that processes files uploaded to Amazon S3. The processing involves multiple steps, each implemented as a separate AWS Lambda function. The company needs to coordinate these steps, handle retries, and maintain a visual workflow. The solution must be highly available and scalable. Which service should be used to orchestrate the workflow?

A company is designing a new web application that will serve static content (HTML, CSS, JS, images) to users globally. The application must have low latency and high availability. Content changes infrequently, but when updated, the changes must be reflected immediately. Which solution should the architect recommend?

A company is building a serverless data processing pipeline using AWS Lambda, Amazon DynamoDB, and Amazon S3. The pipeline processes JSON files uploaded to an S3 bucket, transforms the data, and writes results to DynamoDB. The company wants to ensure the pipeline can handle bursts of traffic without data loss. Which TWO design decisions should the solutions architect make?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle millions of requests per day. To reduce latency and offload traffic from the EC2 instances, which AWS service should be placed in front of the load balancer?

A financial services firm is designing a new trade-processing platform on AWS. The platform uses AWS Lambda functions that must access an Amazon RDS for MySQL database in a private subnet. Security policy forbids storing database credentials in environment variables or code. The firm also requires that credentials be automatically rotated every 30 days, and that the rotation be auditable. Which solution meets these requirements with the LEAST operational overhead?

A company is designing a new application that will use Amazon S3 to store sensitive customer data. The data must be encrypted at rest and in transit. The company also needs to ensure that only authorized users can access the data. Which three steps should the company take? (Choose THREE.)

A media company stores millions of video files in an Amazon S3 bucket and serves them to viewers worldwide through Amazon CloudFront. The company recently enabled S3 Block Public Access and now viewers receive access-denied errors. The security team insists the bucket must remain private and no long-term credentials may be embedded in the application. Which solution meets these requirements with the LEAST administrative effort?

A logistics company is designing a new application that processes shipping manifests. The application runs on Amazon EC2 instances in an Auto Scaling group and must store session state so that users remain logged in if an instance is terminated. The company wants a highly available, low-latency solution with minimal operational overhead. Which solution meets these requirements?

A company is designing a highly available application on AWS that uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application requires that the client's IP address be preserved in the application logs. The company also needs to perform SSL termination at the load balancer. How should the company configure the ALB to meet these requirements?

A company is designing a new database solution for a global e-commerce application. The database must support high read and write throughput with single-digit millisecond latency. The company expects traffic spikes during peak hours. Which TWO AWS services should the company consider?

A company is deploying a serverless application using AWS Lambda. The application processes high-resolution images and stores them in Amazon S3. The processing time for each image is variable, but some images require more than 15 minutes to process. Lambda has a maximum execution time of 15 minutes. How can the company process these long-running image transformations?

A company is building a serverless application using AWS Lambda and Amazon API Gateway. They need to authenticate users. Which TWO services can be used for authentication?

A company is designing a new application that will store and retrieve large files (up to 5 TB). The files must be accessible via HTTPS and must be durable. Which AWS storage service should be used?

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. Which AWS service should be used for the migration?

A company is designing a new application that will be deployed on AWS. The application requires a relational database with automatic failover and high availability within a single AWS region. Which database deployment option meets these requirements?

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. The platform must process and store high-velocity data with low latency. Which TWO AWS services should be used together to meet these requirements? (Choose TWO.)

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other using REST APIs. The company wants to implement a service mesh to handle traffic routing, observability, and security. Which AWS service should the company use?

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application experiences sudden traffic spikes. What is the most effective way to ensure the application can handle the spikes without manual intervention?

A company is designing a new application that will process sensitive financial transactions. The application must be deployed in a VPC with no public internet access. The application needs to send logs to Amazon CloudWatch Logs and store files in Amazon S3. Which set of actions should be taken to meet these requirements without allowing internet access?

A startup is building a serverless application using AWS Lambda. They need to securely store and retrieve database credentials without hardcoding them in the function code. Which AWS service should they use?

A company has an IAM policy attached to a user as shown in the exhibit. The user is trying to stop an EC2 instance in the us-west-2 region. What will happen?

A company is designing a new microservices architecture on AWS. They need a solution for service discovery that allows services to register themselves and discover other services dynamically. The solution must be highly available and integrated with AWS-native services. Which AWS service should they use?

A company is designing a new application that will use Amazon DynamoDB. The application requires strongly consistent reads and must handle a sudden spike in read traffic that could exceed the provisioned read capacity. The company wants to ensure that the application continues to perform well without manual intervention. The table is currently provisioned with 100 read capacity units (RCUs). The workload is unpredictable but expected to grow. What should a solutions architect recommend to meet these requirements?

A media company is designing a new video processing pipeline. The pipeline must ingest large video files uploaded to Amazon S3, process them using AWS Lambda, and store the output in another S3 bucket. The processing time can vary from a few seconds to over 15 minutes. The company wants a fully serverless, cost-effective solution that can handle sudden spikes in uploads. Which solution should a solutions architect recommend?

A company is designing a new application on AWS that requires a relational database with read replicas across multiple AWS Regions. The database must have automated failover and a recovery point objective (RPO) of less than 5 seconds. Which database solution should the company choose?

An ALB is configured with a target group for HTTP:80. The health check returns a 302 redirect. What is the most likely cause of the unhealthy instances?

Refer to the exhibit. A solutions architect has attached this IAM policy to an IAM role used by an application. The application is trying to upload an object to the S3 bucket example-bucket with server-side encryption using AWS KMS (SSE-KMS). What will happen?

A company wants to design a serverless event-driven architecture where multiple downstream services need to process events from a single source. Events must be reliably delivered and each downstream service must process every event independently. Which AWS service should be used as the event router?

A company is building a data lake on Amazon S3 using Parquet files. The data will be queried by multiple teams using Amazon Athena. The security team requires that access to sensitive columns (e.g., PII) be restricted based on the user's role. Which solution provides column-level access control with the LEAST administrative overhead?

A company is designing a new application that requires secure storage of secrets such as database passwords and API keys. The application runs on Amazon EC2 instances. The company wants to centralize secret management and automatically rotate secrets. Which AWS service should be used?

A company is designing a new static website hosted on Amazon S3. The website must be served over HTTPS with a custom domain name. Which AWS service should be used to achieve this?

A company is building a new web application that will be accessed by users globally. They want to minimize latency and protect against DDoS attacks. Which AWS service should they use as the entry point?

A company is migrating a legacy on-premises application to AWS. The application uses a monolithic architecture and a MySQL database. The company wants to refactor the application into microservices and use a NoSQL database for better scalability. The new application will be deployed on Amazon EKS. The database must be highly available and support automatic scaling. Which database service should the company use?

A company is designing a new application that will run on Amazon EC2 instances. The application needs to access an Amazon S3 bucket to read and write objects. The company wants to ensure that the EC2 instances can access the S3 bucket without storing AWS credentials on the instances. Which TWO steps should the company take?

A media company is designing a video transcoding pipeline. They receive raw video files in Amazon S3, which need to be transcoded into multiple formats. The pipeline must handle sporadic bursts of uploads and complete processing within 30 minutes for each video. The cost should be minimized. Which design should they use?

A company is designing a new microservices application using Amazon ECS with Fargate. The services need to communicate securely within the VPC. Which approach should be used for service discovery?

A startup is building a web application on AWS that requires a relational database. They expect unpredictable traffic patterns and want to minimize costs while ensuring high availability. Which database solution should they choose?

A company is designing a new global application that requires a relational database with low-latency reads in multiple AWS Regions. The database must support automatic failover to a secondary Region in case of a disaster. The company wants to minimize operational overhead and ensure data consistency across Regions. Which solution should a solutions architect recommend?

A company is designing a new data lake on AWS. The data lake must support SQL queries using Amazon Athena and also allow Amazon SageMaker to access training data. The solution must minimize storage costs for infrequently accessed data while providing immediate access when needed. Which storage tier should be used for the data lake?

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

A company is designing a new multi-tenant SaaS application on AWS. Each tenant must have its own AWS KMS customer managed key (CMK) for encrypting data at rest in Amazon S3. The security team requires that the encryption keys are automatically rotated every year and that key usage is logged for auditing. The application will use AWS Lambda functions to encrypt and decrypt data on behalf of tenants. Which solution meets these requirements with the LEAST operational overhead?

A company is deploying a new web application that uses Amazon S3 to store static content and Amazon CloudFront for content delivery. The application also uses an API Gateway with Lambda for backend logic. The company wants to protect the API from common web exploits like SQL injection and cross-site scripting. Which AWS service should be added to the architecture?

A company is designing a multi-tier web application that must be fault-tolerant and scalable. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in an Auto Scaling group. The instances run a web server and a backend application. Which TWO steps should be taken to ensure the application can scale without data loss?

A company is designing a CI/CD pipeline for a containerized application using AWS CodePipeline. The application is deployed to Amazon ECS with Fargate. The pipeline must automatically build and test code changes before deploying to production. Which service should be used to build and test the Docker images?

A company is designing a serverless application using AWS Lambda that needs to access a private Amazon RDS for MySQL database. The Lambda function is deployed in a VPC with the appropriate security groups. The database is in a private subnet. The company wants to avoid storing database credentials in the Lambda function code. What should the company do to securely access the database?

A media company is designing a new video transcoding pipeline. Source files are uploaded to an Amazon S3 bucket, and a Lambda function must start an AWS Elemental MediaConvert job for each upload. Transcoding jobs take 20-40 minutes, and the company wants automatic retries with a dead-letter queue for failed job submissions, while avoiding duplicate jobs if the same object is processed twice. Which design meets these requirements?

A company is designing a new microservices application on AWS. Each microservice needs to store and retrieve stateful data with low latency (single-digit milliseconds). The data must be durable and highly available across multiple Availability Zones. Which AWS service should be used for the primary data store for each microservice?

A company needs to design a new solution for storing and retrieving user-uploaded images. The images are accessed frequently for the first 30 days and then rarely accessed after that. The company wants to minimize storage costs while maintaining low-latency access for frequently accessed images. Which storage strategy should be used?

A startup is building a serverless application using AWS Lambda for business logic and Amazon DynamoDB for data storage. The application must process a high volume of writes to a single DynamoDB table. The development team is concerned about throttling due to hot partitions. Which design should the team implement to avoid throttling?

A company is designing a new static website hosted on Amazon S3. They want to use Amazon CloudFront as a content delivery network (CDN) to serve the website globally with low latency. The website content must be encrypted in transit. Which configurations should they use? (Choose TWO.)

A company is designing a new microservices architecture on AWS. The company wants to use a service mesh to manage service-to-service communication, observability, and security. Which AWS service should the company use?

A company deployed the above CloudFormation template. An EC2 instance launched in the PrivateSubnet needs to access the internet for software updates. Which action is required?

A company is designing a new web application on AWS. The application must be highly available and scale automatically based on traffic. The architecture includes an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The application stores session state. What is the BEST way to handle session state to ensure high availability?

A company is designing a new application that will store sensitive customer data in Amazon S3. The company must ensure that the data is encrypted at rest and that the encryption keys are rotated automatically every year. The company also wants to audit key usage. Which solution will meet these requirements?

A company is designing a solution to process real-time streaming data from IoT devices. The data must be ingested, processed with sub-second latency, and stored for analytics. Which services should the company use? (Choose TWO.)

Refer to the exhibit. An IAM policy allows ec2:Describe* actions on all resources. A developer wants to also allow describing RDS instances. Which action must be added to the policy?

A company is designing a new application that will use Amazon DynamoDB as its database. The application will have a heavy read workload with occasional write spikes. The company wants to minimize costs while ensuring that reads are eventually consistent and writes are not throttled. Which three options should the architect consider? (Choose THREE.)

A company is designing a new application that will be deployed on AWS. The application consists of a web tier running on Amazon EC2 instances and a database tier using Amazon Aurora. The company expects unpredictable traffic patterns and wants to optimize costs while maintaining high availability. The web tier must automatically scale based on demand, and the database must be able to handle read-heavy workloads. What should a solutions architect recommend?

A company is designing a new application that will process sensitive financial data. The application must encrypt data at rest and in transit. The company wants to use AWS managed keys for encryption. Which AWS service should the company use to create and manage the encryption keys?

A company is deploying a containerized application on Amazon ECS. The application must be highly available and scale automatically based on CPU utilization. The application also needs to be accessible from the internet via a single endpoint. Which combination of services should the solutions architect use?

A company is designing a highly available web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to EC2 instances in an Auto Scaling group across multiple Availability Zones. The application state is stored in an Amazon ElastiCache for Redis cluster. The company wants to minimize downtime during patching of the Redis cluster. What should the company do?

A company has three EC2 instances as shown in the exhibit. The company wants to use an Application Load Balancer to distribute traffic across these instances with cross-zone load balancing enabled. How will the traffic be distributed?

A security engineer created the S3 bucket policy shown in the exhibit. The policy is intended to allow the role MyAppRole to get objects only if they are encrypted with SSE-S3. However, the role is getting access denied errors when trying to get objects that are encrypted with SSE-S3. What is the most likely cause?

A company is designing a new web application that will be deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which THREE actions should the company take to meet these requirements? (Choose three.)

A company runs a stateful web application on a single Amazon EC2 instance. The application writes data to a locally attached instance store volume. The company wants to improve the durability of the data without modifying the application. The data must survive an instance stop/start and be available if the instance is terminated and relaunched. What should a solutions architect recommend?

A company is deploying a web application on AWS Elastic Beanstalk. The application must be accessible over HTTPS only and must automatically redirect HTTP requests to HTTPS. The SSL/TLS certificate is provided by AWS Certificate Manager (ACM). How should this be configured?

A company is designing a new internal web application for its employees. The application must be accessible only from the corporate network, which connects to AWS via an AWS Site-to-Site VPN. The company wants to use an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The solution must ensure that the ALB is not accessible from the internet. Which configuration should be used?

A company is designing a new multi-region application that requires a global database with low-latency reads and writes. The application must be able to survive a regional outage. Which database solution should they choose?

A company is designing a new disaster recovery solution for a critical application running on Amazon EC2. They need to replicate data across AWS Regions with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. Which THREE actions should they take to meet these objectives?

A financial services company is designing a new multi-account landing zone. A central security team must be able to audit all API activity across every account, and each business unit must be prevented from disabling the audit trail. The company uses AWS Organizations with all features enabled. The solutions architect needs a solution that captures management events from all accounts in one place and enforces immutability of the logs. Which combination of actions should the architect take?

A company is designing a new microservices architecture on AWS. Each service needs to store and retrieve small amounts of configuration data (under 10 KB per item) with low latency. The data is accessed frequently and must be highly available across multiple Availability Zones. Which AWS service should be used?

A media company is building a new video transcoding pipeline. Source files arrive in an Amazon S3 bucket, and a workflow must fan out to several processing steps, retry failed steps with backoff, and pause for manual approval before publishing. A solutions architect is evaluating AWS Step Functions. Which two statements are correct about using Step Functions for this design? (Choose two.)

A company is migrating a legacy monolithic application to AWS. The application stores session state locally on each server. The company wants to refactor the application to be stateless and deploy it across multiple Availability Zones for high availability. The application must handle sudden traffic spikes and maintain session persistence. Which solution should a solutions architect recommend?

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

A company is deploying a new stateless web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that the application can scale automatically based on demand and that the EC2 instances are spread across multiple Availability Zones for high availability. The company also wants to minimize costs when demand is low. Which solution should a solutions architect recommend?

A company is deploying a containerized microservices architecture on Amazon ECS with Fargate. They need to securely store and rotate database credentials. Which AWS service should they use?

A company is designing a real-time analytics pipeline for IoT data. They need to ingest millions of messages per second, process them with low latency, and store results in Amazon S3. Which combination of services should they use?

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use for message brokering?

A company is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The API must be secured using AWS WAF. Which TWO actions should the company take to integrate WAF with API Gateway? (Choose TWO.)

A company wants to implement a serverless architecture where an AWS Lambda function is triggered whenever a new object is uploaded to an S3 bucket. Which S3 feature should they use?

A company is designing a new application that will process streaming data from IoT devices. The data must be processed in real time and then stored in Amazon S3 for long-term analytics. Which combination of AWS services should be used?

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

A company is designing a new global web application that will be deployed in multiple AWS Regions. The application must provide low-latency access to users worldwide, and the company wants to minimize operational complexity. The application uses a stateless web tier and a DynamoDB backend. The company needs to ensure that writes in one Region are eventually visible in other Regions. Which solution should a solutions architect recommend?

A company is designing a new cloud-native application that will be deployed across multiple AWS Regions for high availability. The application uses Amazon Aurora Global Database for its primary data store. The company needs to ensure that in the event of a regional failure, the secondary region can be promoted to primary with minimal data loss. Which configuration should be used?

A company is designing a new application that will process real-time streaming data from thousands of IoT devices. The data must be ingested, processed with low latency, and stored in Amazon S3 for analytics. Which combination of AWS services should the company use to meet these requirements?

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web tier, an application tier, and a database tier. The company wants to decouple the tiers to improve scalability and resilience. Which AWS service should the company use to send messages from the web tier to the application tier asynchronously?

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to store persistent data that must be shared across multiple containers in the same task. Which storage option should the company use?

A company is designing a new application on AWS that requires a highly available and fault-tolerant architecture. Which TWO design principles should they follow?

A company is designing a new solution to host a static website with global audience. The website content includes HTML, CSS, JavaScript, and images. The company wants to minimize latency for users worldwide and reduce the load on the origin server. The origin server is an Amazon S3 bucket configured for static website hosting. Which solution should be used to achieve these goals?

A company is deploying a new three-tier web application on AWS. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The application tier runs on Amazon ECS with the Fargate launch type. The database tier uses Amazon Aurora MySQL. The security team requires that all data in transit between tiers be encrypted and that the application tier be able to access the database without hardcoding credentials. The company wants to minimize operational overhead. Which solution meets these requirements?

A company is designing a new application that will be deployed on AWS. The application requires a relational database that must be highly available, automatically scalable, and support read-heavy workloads. The company wants to minimize operational overhead and ensure that the database can fail over to another Availability Zone automatically. Which solution meets these requirements?

A company is designing a new application that requires a fully managed NoSQL database with single-digit millisecond latency. The application needs to handle sudden spikes in read traffic without manual intervention. Which AWS service should the company choose?

A company is designing a cost-effective architecture for a batch processing job that runs nightly. The job can tolerate interruptions and requires significant compute power for a few hours. The company wants to minimize costs. Which TWO strategies should the company use?

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

A company needs to provide temporary, limited-privilege credentials to mobile app users to access AWS resources. Which AWS service should the architect recommend?

A company is building a new microservices architecture on AWS using Amazon ECS with Fargate. The services need to communicate with each other using RESTful APIs. The company wants to implement an API gateway to handle authentication, rate limiting, and request routing. Which AWS service should be used as the API gateway?

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in two AWS Regions. The company needs to ensure that if one region becomes unavailable, traffic is automatically routed to the healthy region with minimal disruption. Which configuration meets these requirements?

A company is deploying a web application on AWS that requires a relational database. The application is read-heavy and expects sudden spikes in traffic. The database must be highly available and perform well under load. Which database configuration meets these requirements?

A company is designing a new multi-tier application on AWS. The web tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The database tier uses Amazon RDS for MySQL with a single Availability Zone deployment. The company requires that the application survive an Availability Zone failure with minimal downtime and no data loss. The database must automatically fail over to a standby instance in another Availability Zone. What should a solutions architect recommend to meet these requirements?

A startup wants to deploy a web application on AWS with a serverless architecture. The application includes static content (HTML, CSS, JS) and a REST API backend using Lambda and DynamoDB. The company wants low latency and high availability globally. Which combination of services should they use?

A company is designing a new microservices architecture on AWS. Each microservice is deployed as a containerized application and must be able to scale independently. The company wants to minimize operational overhead for managing the containers and the underlying infrastructure. Which solution should the architect recommend?

A company is deploying a containerized application on Amazon EKS. The application needs to access an Amazon RDS database. The security team requires that database credentials be rotated automatically and never stored in plaintext. Which solution should the architect use?

A CloudFormation stack output is as above. The company wants to use the SQS queue URL in another stack. Which intrinsic function should be used to reference the queue URL in the second stack?

A small business wants to host a simple static website on AWS. The website consists of HTML, CSS, JavaScript, and images. The company expects low traffic and wants to minimize costs. The website must be highly available and load quickly for users globally. Which solution should a Solutions Architect recommend?

A company is designing a new solution to securely store and manage secrets for applications running on AWS. The secrets include database credentials, API keys, and OAuth tokens. The solution must automatically rotate secrets and integrate with AWS services like Amazon RDS. Which AWS service should be used?

A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?

A company is designing a multi-region active-active application using Amazon Route 53, Application Load Balancers, and Auto Scaling groups. They need to route users to the closest region with the lowest latency. Which routing policy should they use?

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function that transcodes the video into multiple formats using FFmpeg. The transcoding job runs on the Lambda function with a 15-minute timeout. Recently, the company started receiving 4K videos that take more than 15 minutes to transcode. The Lambda function times out, and the video is not processed. The company wants to process these large videos without increasing the Lambda timeout and without rewriting the entire pipeline. What should the solutions architect do?

A financial services firm runs a latency-sensitive trading application across three AWS Regions. The application writes to an Amazon DynamoDB table in the primary Region and must be able to read and write locally in the other two Regions with single-digit-millisecond latency, while tolerating a full Region failure. The firm accepts eventual consistency across Regions but requires that no acknowledged write is ever lost. Which solution should a solutions architect recommend?

A company runs a critical e-commerce platform on AWS. The application is deployed across multiple Availability Zones in a single region (us-east-1). The architecture includes an Application Load Balancer (ALB), an EC2 Auto Scaling group, and an Amazon RDS for MySQL Multi-AZ database. The application experiences periodic spikes in traffic, and the Auto Scaling group scales out successfully. However, during a recent traffic spike, the database CPU utilization reached 90%, causing increased latency and some database connection timeouts. The company needs to improve the database performance to handle the spikes without over-provisioning. The solutions architect must design a solution that reduces the load on the primary database instance and improves read scalability. The application is read-heavy, with a read-to-write ratio of 80:20. Which solution should the architect implement?

A company is running a production web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application uses a MySQL database hosted on Amazon RDS with Multi-AZ enabled. Recently, during a traffic spike, some users experienced increased latency and occasional 503 errors. The operations team noticed that the database CPU utilization reached 100% and the number of database connections peaked at the maximum limit. The application team confirmed that the application uses connection pooling on the EC2 instances but the pool size is fixed. Which solution should the solutions architect recommend to prevent recurrence?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available across multiple Availability Zones. Which TWO actions should the architect take? (Choose TWO.)

A company is migrating a legacy on-premises application to AWS. The application uses a shared file system that must be accessible from multiple Linux-based Amazon EC2 instances simultaneously. The application requires a POSIX-compliant file system with high throughput and low latency. The company wants a fully managed, scalable solution that can grow to petabytes. What should a solutions architect recommend?

A startup is deploying a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon DynamoDB table. To improve performance, the team wants to reduce latency for read-heavy workloads. Which design change would be MOST effective?

A company is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences sudden spikes in traffic. Which AWS service should be used to handle the traffic spikes without losing any requests?

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by third-party APIs. The company plans to use an Application Load Balancer with EC2 instances. Which two steps should the company take to ensure the ALB has a consistent set of IP addresses? (Choose TWO.)

Refer to the exhibit. A CloudFormation stack creation failed. The architect needs to identify the reason for the failure. Which CLI command should be used to get detailed error messages?

A company is designing a multi-tier web application on AWS. The web tier must automatically scale based on CPU utilization, and the application tier must process messages from an SQS queue. The application tier instances are frequently terminated and replaced due to scaling events. Where should the application logs be stored to ensure they are retained regardless of instance lifecycle?

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared file system for storing user uploads. The solution architect needs to design a highly available and scalable storage solution that supports concurrent read/write operations from multiple EC2 instances. Which AWS service should be used?

A company is designing a new microservices architecture using AWS Lambda. Each microservice has its own database. The company wants to securely store database credentials and rotate them automatically. Which AWS service should be used?

A company is designing a multi-region active-active application that uses Amazon DynamoDB global tables. The application must be able to handle write conflicts that may occur when the same item is updated in two different regions at the same time. The company needs to ensure that the application uses the most recently written data. What should the architect recommend?

A media company is designing a new application that ingests large video files uploaded by users. The files must be stored durably and then processed by a compute fleet that runs for several hours per file. The company wants to minimize compute costs and ensure that processing can resume if interrupted. Which architectural approach should a solutions architect recommend?

A company is designing a new real-time bidding platform that must handle sudden bursts of traffic up to 100,000 requests per second. The application runs on Amazon EC2 instances behind an Application Load Balancer and stores bid data in Amazon DynamoDB. The company wants to minimize latency and cost while ensuring the database can scale automatically. Which solution meets these requirements?

Refer to the exhibit. An architect is troubleshooting an EC2 instance that is not responding to health checks from an Application Load Balancer. The instance is in the 'running' state. Which of the following is the most likely cause?

A healthcare company is designing a new multi-tenant SaaS application on AWS. Each tenant requires a separate encryption key, and the company must be able to audit key usage per tenant and automatically rotate keys annually. The keys must be stored in a hardware security module (HSM) that is validated to FIPS 140-2 Level 3. Which solution meets these requirements with the LEAST operational overhead?

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The company wants to achieve a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 15 minutes. Which solution should the company use?

A company wants to store application logs in Amazon S3 with a lifecycle policy that moves objects to S3 Glacier Instant Retrieval after 30 days and deletes them after 1 year. The logs are accessed frequently in the first 30 days but rarely after. Which storage class should the company use for the first 30 days?

A company is building a high-performance computing (HPC) cluster on AWS for genomics research. The compute nodes require low-latency inter-node communication. Which networking solution should be used?

A company is designing a new application that will run on EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling strategy should be used?

A company is designing a new application that will process streaming data from IoT devices. The data must be ingested in real-time and stored in Amazon S3 for long-term analytics. Which AWS service should be used to ingest the streaming data?

A company wants to provide temporary, limited-privilege credentials to its application running on an EC2 instance so that the application can access an S3 bucket. What is the BEST practice for achieving this?

A company is migrating a monolithic application to a serverless architecture using AWS Lambda. The application reads and writes to an Amazon RDS for PostgreSQL database. The database connection pool is exhausted during peak traffic. Which design change should a solutions architect recommend to avoid connection exhaustion?

A company needs to provide a global content delivery solution with low latency. Which AWS service should they use?

A company is designing a new multi-tier application on AWS. The application will use an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances in an Auto Scaling group. The company requires that the application be highly available across multiple Availability Zones and that it can scale automatically based on demand. The company also wants to ensure that the application can handle sudden spikes in traffic without manual intervention. Which two actions should a solutions architect recommend to meet these requirements? (Choose two.)

Match each AWS cost management tool to its use.

A company is migrating a legacy application to AWS. The application consists of several components that communicate via TCP. The solutions architect must design a solution that minimizes operational overhead and provides high availability. Which TWO strategies should be used?

A company runs a high-traffic web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes during peak hours. Analysis shows that the latency spikes correlate with high CPU utilization on the EC2 instances. The company wants to reduce latency without over-provisioning. Which solution is MOST cost-effective and scalable?

A company is deploying a new financial application on AWS that requires strict compliance with PCI DSS. The application will store sensitive cardholder data in an Amazon S3 bucket. The security team needs to ensure that data is encrypted at rest and that access is audited. They also need to be able to prove that encryption keys are rotated annually. Which two actions should be taken to meet these requirements? (Choose two.)

A company is designing a serverless application using AWS Lambda. The function needs to access a VPC resource. What is the correct way to configure this?

A financial services company is designing a new application that will store sensitive customer data in Amazon S3. The company must encrypt the data at rest and ensure that the encryption keys are rotated annually. The security team requires that the company retains full control over the key rotation and can audit key usage. The solutions architect needs to recommend an encryption solution that meets these requirements with minimal operational effort. Which solution should the architect recommend?

A company is designing a new application that processes sensitive healthcare data. The application runs on Amazon ECS with Fargate and uses an Application Load Balancer. The company must ensure that all data in transit is encrypted. Which step should be taken?

A global e-commerce company is designing a new order-processing system that must survive the failure of an entire AWS Region. The system uses an Amazon Aurora MySQL database and must provide a recovery point objective (RPO) of 1 minute and a recovery time objective (RTO) of 5 minutes. The company wants to minimize operational overhead and avoid managing replication instances. Which solution should the solutions architect recommend?

A company wants to share a large dataset stored in Amazon S3 with a partner who has their own AWS account. The partner needs to access the data using their own account credentials. Which approach should the company use?

A company is designing a new application that will use Amazon API Gateway and AWS Lambda. The application must authenticate users using an existing OpenID Connect (OIDC) identity provider. The company wants to minimize the amount of custom code required and ensure that only authenticated users can invoke the API. Which authentication method should be used?

A company is designing a new solution to process and analyze large volumes of log data. The data is generated continuously by thousands of IoT devices and must be ingested in near real-time. The company needs to perform simple transformations and aggregations on the data before storing it in Amazon S3 for long-term analysis. The solution must be highly available, scalable, and require minimal operational overhead. Which AWS service should the solutions architect use to ingest and transform the data?

A company is designing a new application that requires low-latency access to a shared dataset across multiple EC2 instances in the same AWS Region. The dataset is updated frequently. Which storage solution should the company use?

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket and must be secured with HTTPS. Which three services or features should be used together to meet these requirements?

A company is designing a new hybrid cloud solution that requires low-latency access to on-premises data from AWS. The connection must be highly available and encrypted. The company has multiple VPCs and on-premises locations. Which combination of services meets these requirements?

A company wants to design a cost-effective solution to store infrequently accessed log files for 7 years. The logs are generated daily and must be available for retrieval within 24 hours. Which Amazon S3 storage class should be used?

A media company is deploying a new video transcoding pipeline on AWS. The pipeline will process thousands of small input files stored in Amazon S3, and each file must be transcoded independently. The transcoding jobs are short (under 5 minutes) and stateless. The company wants a solution that scales automatically, minimizes operational overhead, and provides near-real-time processing. Which design should a solutions architect recommend?

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted on multiple Amazon EC2 instances across multiple Availability Zones. The file system must be highly available, durable, and support POSIX permissions. The company wants a fully managed solution. Which AWS service should a solutions architect recommend?

A company is designing a solution to capture changes from an Amazon RDS database and stream them to a data lake. Which AWS service should be used to capture database changes in real time?

A company is designing a new solution to store and analyze large amounts of log data from multiple sources. The logs must be retained for 90 days for recent analysis, and then archived to a more cost-effective storage class for an additional 5 years. The solution must support SQL-based queries. Which combination of AWS services should the company use?

A media company is designing a new video transcoding pipeline. Source files are uploaded to an Amazon S3 bucket, and the company wants each upload to trigger processing without managing servers. Jobs can take up to 20 minutes, and the company must be able to retry a failed job without reprocessing successful ones. The operations team wants visibility into which specific uploads failed and the ability to replay only those. The company also wants to decouple the upload event from the worker so that bursts of thousands of simultaneous uploads do not overwhelm the processing tier. Which design should the solutions architect recommend?

A company runs a stateless web tier on Amazon EC2 instances behind an Application Load Balancer. Traffic is highly variable, with sharp spikes during flash sales. The company wants the web tier to scale out quickly during spikes and scale in when demand drops, while keeping costs low. Which configuration should a solutions architect recommend?

A company is designing a data lake on S3 with sensitive data that must be encrypted at rest and audited. Which TWO services should be used? (Choose TWO.)

A Solutions Architect is reviewing the IAM policy shown in the exhibit. The policy is attached to an IAM user. Which of the following is true about this policy?

A company is designing a new application that will run on Amazon EKS. The development team wants to deploy containers in a way that minimizes operational overhead. Which compute option should the company choose?

A company is designing a new serverless data-processing workflow on AWS. The workflow must orchestrate multiple AWS Lambda functions, wait for a human approval, and retry failed steps with exponential backoff. The solutions architect must choose AWS services that provide durable state and built-in error handling. (Choose two.)

A healthcare company is building a new patient records system on AWS. The system must store documents in Amazon S3 and provide access to authenticated patients and clinicians. The company requires that all data be encrypted at rest with keys that the company can rotate annually and immediately disable if compromised, and that access to the keys be logged for compliance. The company does not want to manage any hardware security modules. Which solution meets these requirements?

A company is deploying a containerized application on Amazon Elastic Kubernetes Service (Amazon EKS). The application requires persistent storage that must be accessible from multiple pods simultaneously across different Availability Zones. The storage must provide high throughput and low latency, and it must be shared read-write. Which storage solution should a solutions architect recommend?

A retail company is designing a new order-processing application on AWS. The application must survive the loss of an entire AWS Region with minimal data loss, and the recovery point objective is 1 minute. The primary database is Amazon Aurora MySQL. Which approach should the solutions architect choose to meet these requirements?

A company is building a microservices architecture on Amazon ECS. Services need to communicate with each other and with external SaaS applications. The architect must ensure that service discovery is dynamic and that traffic to external services is routed through a single egress point for security and monitoring. Which combination of services should the architect use?

A company is designing a web application that must support millions of concurrent users. The application uses a RESTful API frontend and a relational database backend. Which TWO strategies should be implemented to improve scalability?

An IAM policy is attached to an IAM user. The policy allows the `s3:PutObject` action on the resource `arn:aws:s3:::my-bucket/uploads/*` with a condition that the request must come from IP address `10.0.1.5`. The user is testing from an IP address `10.0.1.5`. What is the effect of the policy?

A financial services company is building a new payment processing system on AWS. The system must durably retain transactional records for seven years to meet regulatory requirements, and the records must be encrypted at rest with a customer-provided key that the company can rotate on demand. The company wants the simplest operational model and does not want to manage any servers. Which solution should a solutions architect recommend?

A company is designing a multi-tier web application on AWS. The application requires high availability across multiple Availability Zones. Which AWS service should be used to distribute incoming traffic across multiple EC2 instances in different Availability Zones?

Which TWO strategies can reduce the cost of storing infrequently accessed data in Amazon S3 while maintaining millisecond retrieval latency? (Choose two.)

A company is designing a new data lake on AWS. The data lake will store raw data in Amazon S3 and use Amazon Athena for ad-hoc queries. The company needs to ensure that only authorized users can query specific partitions based on their department. Which approach should the company use to implement fine-grained access control?

A startup is building a serverless photo-sharing application on AWS. Users upload photos via a web app, which stores them in Amazon S3. Each upload triggers an AWS Lambda function that creates a thumbnail and stores it in another S3 bucket. The application is expected to have unpredictable traffic patterns. The startup wants to minimize costs and operational overhead while ensuring the thumbnail generation completes reliably. Which solution should a Solutions Architect recommend?

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The company wants to secure the API by requiring authentication via a JSON Web Token (JWT). Which service should the company use to manage user authentication and issue JWTs?

A company is designing a new microservices-based application on AWS. They want to ensure that services can discover each other dynamically and that traffic can be load balanced across multiple Availability Zones. Which AWS service should they use for service discovery?

A company is designing a new application that will run on Amazon ECS with Fargate. The application must be able to read and write files to a shared file system that is accessible from multiple tasks simultaneously. The file system must be durable and support NFS protocol. Which storage solution should be used?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions. What should they do?

A company is designing a new data lake on Amazon S3 using AWS Glue for ETL. The data is partitioned by date and sensitive columns must be masked for non-privileged users. The solution must minimize storage costs and allow different masking policies per user. Which approach should the architect recommend?

Which TWO actions will improve the security posture of an Amazon S3 bucket used to store sensitive data? (Choose two.)

A gaming company is designing a new real-time multiplayer game backend on AWS. The game requires low-latency communication between players (< 50 ms) and the ability to handle up to 100,000 concurrent players. The backend must manage game state, player matchmaking, and chat. The company wants to use managed AWS services to reduce operational overhead. Which solution should a Solutions Architect recommend?

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

A company is designing a new data lake on AWS. The data lake will store petabytes of data from various sources, including IoT devices, application logs, and streaming data. The data must be stored cost-effectively, and access patterns vary from frequently accessed recent data to rarely accessed historical data. The company also needs to run SQL queries on the data. Which solution should the architect recommend?

Which TWO AWS services can be used to decouple components in a new microservices architecture? (Choose two.)

A company is designing a new serverless application that processes messages from an Amazon SQS queue. The messages contain sensitive data that must be encrypted at rest. The company wants to use a customer-managed AWS KMS key for encryption and ensure that only the application's Lambda function can decrypt the messages. Which approach should be used?

A company is building a new microservices-based application on AWS using Amazon ECS with Fargate. The application has a frontend service, an order service, and a payment service. Services communicate synchronously via REST APIs. The company expects variable traffic and wants to ensure that failures in one service do not cascade to others. Which solution should a Solutions Architect recommend?

A company is designing a new microservices architecture on AWS. Each microservice must store its own data and communicate with other services via RESTful APIs. The company wants to minimize operational overhead. Which data store should the company use for each microservice?

A company is designing a new data lake on AWS. The data lake will store structured and unstructured data from various sources. The company needs a solution that can automatically catalog the data and make it searchable. Data will be stored in Amazon S3. Which AWS service should be used to catalog and enable search across the data lake?

A company is designing a new application to store and retrieve user profile pictures. The images will be accessed frequently and must be served with low latency. Which storage solution should they use?

A company is designing a web application that must handle sudden spikes in traffic. The application runs in a VPC and uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The solution must be cost-effective for variable traffic patterns. Which scaling strategy should be used?

A developer ran the AWS CLI command shown in the exhibit. The instance has an attached EBS volume with 'DeleteOnTermination' set to false. The instance will be started again soon. What will happen to the EBS volume when the instance is stopped?

A healthcare company is designing a new system on AWS to store and analyze patient health records. The system must comply with HIPAA regulations. Data includes structured lab results and unstructured clinical notes. The company needs to run complex SQL queries on the structured data and perform natural language processing (NLP) on the unstructured data. The solution should be cost-effective and minimize administrative overhead. Which solution should a Solutions Architect recommend?

A logistics company is designing a new event-driven system to process shipment tracking updates. The system must ingest millions of events per second from thousands of IoT devices, retain the events for up to 7 days so multiple independent consumer applications can replay them, and deliver each event to consumers in the order it was received per device. Which AWS service should a solutions architect recommend as the ingestion and retention layer?

A financial-services company is designing a new multi-tenant SaaS platform on AWS. Each tenant must be able to bring its own AWS KMS customer managed key (CMK) so that tenant data is encrypted with a key the tenant controls and can revoke at any time. The platform stores objects in a single Amazon S3 bucket shared by all tenants and must support per-tenant key revocation without redeploying the application. Which design meets these requirements with the LEAST operational overhead?

A company is designing a new solution to process streaming data from IoT devices. The data must be ingested, processed in real-time, and stored in a data warehouse for analytics. The company expects millions of events per second. Which combination of AWS services should be used?

A company is designing a new application that will process messages from an SQS queue. The messages must be processed in real-time with minimal latency, and the processing time per message varies from 100 ms to 5 seconds. The company wants to minimize cost and operational overhead. Which solution should the architect recommend?

A retail company is designing a new order-processing workflow. When an order is placed, an Amazon API Gateway endpoint invokes an AWS Lambda function that must validate the order, then wait for a human fraud analyst to approve or reject it, and finally send a confirmation email. The approval can take up to three days, and the company wants to minimize operational overhead. Which design should the solutions architect use?

Which TWO design patterns help ensure data durability in Amazon S3?

A company is migrating a legacy on-premises application to AWS. The application requires a fixed IP address for whitelisting by external partners. The solution must be highly available across multiple Availability Zones. Which design should they use?

A company is designing an event-driven architecture using Amazon EventBridge. They have multiple AWS accounts that need to receive events from a central account. What is the MOST scalable and secure way to route events to these accounts?

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

A company is deploying a new web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that the application can handle sudden spikes in traffic and maintain high availability across multiple Availability Zones. The solution must be cost-effective and require minimal manual intervention. Which solution should a solutions architect recommend?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling approach should they use?

A company is designing a new solution that requires a highly available and scalable architecture for a stateless web application. The application will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that the instances are automatically replaced if they fail health checks and that the application scales based on demand. The company also wants to minimize costs by using a mix of On-Demand and Spot Instances. Which two actions should be taken to meet these requirements? (Choose two.)

A financial services firm runs a payment API on Amazon EC2 instances behind a Network Load Balancer. Regulators require that all data be encrypted in transit using certificates the firm controls, that the backend instances see the original client IP address, and that no TLS termination occur on the load balancer. Which configuration meets these requirements?

A company is designing a new serverless application that processes sensitive financial data. The application uses AWS Lambda functions that read from and write to an Amazon S3 bucket. The company requires that the data be encrypted at rest and in transit, and that access to the S3 bucket be restricted to only the Lambda functions. The company also wants to minimize management overhead. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

A company is designing a new event-driven architecture using AWS services. The system must process events from multiple sources, filter and route events to different consumers, and ensure that events are processed exactly once. Which THREE services should be used to build this architecture? (Choose three.)

A company is deploying a new microservices application on Amazon ECS using Fargate. The application consists of several services that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. Additionally, the company needs to ensure that traffic between services is encrypted in transit. The security team requires that all inter-service traffic uses TLS. Which combination of services should be used to meet these requirements?

A company is designing a new data lake on Amazon S3. They need to ensure that data is encrypted at rest and that access is audited. Which services should they use? (Choose TWO.)

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that supports the NFS protocol and must be accessible from multiple EC2 instances across different Availability Zones. The file system must provide high durability and low latency. The company also needs to control access to the file system using IAM policies. The solutions architect needs to choose the appropriate AWS storage service. Which service should the architect use?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They want to implement a blue/green deployment strategy with minimal impact on users. Which approach should they use?

A company wants to decouple a microservices architecture where one service (producer) sends events to another service (consumer). The producer can generate bursts of events, and the consumer processes them in batches. The solution must be serverless and handle potential consumer failures without losing events. Which AWS service should be used as the message broker?

A company is migrating a monolithic application to microservices on AWS. The current application uses a single Amazon RDS for PostgreSQL database. To avoid tight coupling, each microservice should have its own database. The company needs to minimize downtime during migration. Which THREE strategies should be used?

A company is designing a new application that will run on Amazon ECS with Fargate. The application consists of three microservices: Service A, Service B, and Service C. Service A receives HTTP requests from an Application Load Balancer and sends messages to an Amazon SQS queue. Service B polls the SQS queue and processes the messages, storing results in Amazon DynamoDB. Service C reads from DynamoDB and sends notifications via Amazon SNS. The company expects variable traffic and wants to minimize costs. During a load test, the team observes that Service B is not scaling fast enough, causing the SQS queue to grow. The team also notices that Service C is idle most of the time. Which solution should the company implement to improve scaling and reduce costs?

A company is designing a new data lake on Amazon S3. They need to query the data using standard SQL and expect to run complex queries that scan large datasets. The query performance should be optimized to minimize data scanned. Which service should they use?

Drag and drop the steps to recover an Amazon RDS Multi-AZ DB instance after a primary instance failure in the correct order.

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without direct coupling. Which AWS service should they use to decouple the services?

A financial services firm is migrating a latency-sensitive trading analytics workload to AWS. The workload runs on Amazon EC2 instances in a single VPC and requires network throughput of up to 100 Gbps per instance, consistent sub-100-microsecond inter-instance latency, and the ability to place instances close together to minimize hops. The firm also wants the instances to communicate without traversing the public internet. (Choose two.)

A company is designing a multi-region disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon Aurora MySQL database. The RTO is 15 minutes and RPO is 1 minute. Which THREE steps should the solutions architect take to meet these requirements?

A financial services company is designing a highly available architecture for a critical application on AWS. The application runs on EC2 instances and uses an Oracle database. The database must be resilient to an Availability Zone failure and must have automated failover. Which database solution meets these requirements?

A company is designing a new application that will store sensitive user data in Amazon S3. Compliance requirements mandate that all data must be encrypted at rest using a key that is managed by the company and rotated automatically every year. Which solution meets these requirements?

A company is migrating a legacy on-premises application to AWS. The application consists of a monolithic .NET application running on Windows Server, with a Microsoft SQL Server database. The company wants to improve scalability and reduce operational overhead. The application experiences variable traffic, with peaks during business hours. The company requires a highly available architecture with automatic failover for the database. Which migration strategy should a solutions architect recommend?

A company is migrating a legacy application to AWS. The application requires a shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones. The file system must provide high throughput and low latency. Which storage solution meets these requirements?

A company wants to migrate an on-premises relational database to Amazon RDS for MySQL with minimal downtime. The database is 500 GB in size. Which AWS service should be used for the initial data load and ongoing replication?

A company is running a web application on AWS Elastic Beanstalk with an Auto Scaling group behind an Application Load Balancer. The application stores session state in an Amazon DynamoDB table. During a traffic spike, the application becomes slow and some users are logged out unexpectedly. The operations team notices that the DynamoDB table's read capacity utilization is consistently at 100%. The company needs to improve the performance of the session store without over-provisioning capacity. Which solution should be implemented?

A company is designing a new serverless application that uses AWS Lambda, Amazon DynamoDB, and Amazon API Gateway. The application must handle burst traffic and cannot lose any data. The company wants to use a dead-letter queue (DLQ) for failed Lambda invocations. Which TWO services can be used as a DLQ for Lambda? (Choose two.)

A financial services company is migrating a batch risk-calculation workload to AWS. The workload runs nightly for 90 minutes, requires 64 vCPUs and 256 GiB of memory, and must complete within a 2-hour window. The company wants to minimize cost and is open to interruption because the job can restart from a checkpoint. Which compute option should a solutions architect recommend?

A company is designing a multi-tier web application on AWS. They want to ensure that the web tier can scale automatically based on CPU utilization. Which AWS service should they use?

A company is designing a data lake on AWS using Amazon S3. They need to run SQL queries on the data without moving it to a separate database. Which AWS service should they use?

A company wants to serve static content (images and videos) to users worldwide with low latency. The content is stored in an Amazon S3 bucket. What is the most cost-effective solution?

A company is designing a high-performance computing (HPC) workload on AWS. The workload requires tightly coupled inter-node communication with low latency and high bandwidth. Which THREE services or features should the architect consider to meet these requirements? (Choose three.)

A company is migrating a legacy on-premises application to AWS. The application uses a shared file system that is accessed by multiple Windows servers. The company wants to use a fully managed AWS storage service that provides SMB file shares and integrates with Microsoft Active Directory for authentication. The solution must be highly available and durable. Which AWS service should the company use?

A startup is designing a new web application that will be hosted on AWS. The application consists of a static frontend and a backend API. The frontend is built with React and the backend is a RESTful API built with Node.js. The startup expects low traffic initially but wants to be able to scale to millions of users. The team wants to minimize operational overhead and cost. Which architecture should they use?

A company wants to build a serverless backend for a mobile application. The backend provides user authentication, a REST API for data access, and stores data in a NoSQL database. The company expects the application to have unpredictable traffic, and wants to minimize costs. Which solution should a Solutions Architect recommend?

A company is designing a data lake on AWS using Amazon S3. They need to query the data using standard SQL without moving it to a separate analytics store. Which AWS service should they use?

A company has an S3 bucket with server-side encryption using S3-Managed Keys (SSE-S3). The IAM policy shown in the exhibit is attached to a user. When the user attempts to download an object using the AWS CLI with no encryption headers, the request fails. What is the MOST likely reason?

A company is building a serverless data processing pipeline. Data is uploaded to an S3 bucket, which triggers a Lambda function to transform the data and store the result in another S3 bucket. The Lambda function needs to access a VPC-hosted database for enrichment. What is the MOST secure way to allow the Lambda function to access the VPC resources?

A company is designing a new real-time analytics platform that processes streaming data from IoT devices. The data must be ingested, processed with windowed aggregations, and stored in Amazon S3 for long-term analytics. The solution must handle late-arriving data and provide exactly-once processing semantics. Which combination of AWS services should the architect use?

A company is designing a new cloud-native application on AWS. The application will use a microservices architecture and requires a way to manage configuration data and secrets. Which THREE AWS services can be used to meet these requirements? (Choose THREE.)

A company is designing a multi-region active-active architecture for a web application using Amazon Route 53 latency-based routing. The application runs on EC2 instances in Auto Scaling groups with Application Load Balancers in each region. The application uses an Amazon Aurora global database for its data tier. The architecture must provide the lowest possible RTO and RPO for regional failures. What should the company do to meet these requirements?

A company is designing a data lake on Amazon S3. Data is ingested from multiple sources and stored as Parquet files partitioned by date. The company needs to ensure that only authorized users can access the data, and that the data is encrypted at rest. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires that users' session data be stored and made available across all instances. Which solution is MOST cost-effective and scalable?

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

A company is designing a new serverless application that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application must handle sudden spikes in traffic without throttling errors and must provide consistent low-latency responses. The company wants to minimize operational overhead. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

A company is deploying a new web application on AWS that requires a highly available and scalable architecture. The application consists of a stateless web tier and a stateful database tier. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The database tier uses Amazon Aurora MySQL. The company expects variable traffic patterns and wants to automatically scale the web tier based on CPU utilization. Additionally, the company wants to ensure that the database can handle increased read traffic without manual intervention. Which combination of actions should the company take?

A company is building a real-time analytics platform that ingests data from thousands of IoT devices. The data must be processed in near real-time and stored in a data lake on Amazon S3 for long-term analysis. The company also needs to run complex SQL queries on the streaming data to detect anomalies. The solution must be highly available and scale automatically. Which combination of AWS services should a solutions architect recommend?

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group. The application must be able to distribute incoming traffic across multiple instances. Which TWO AWS services can be used for this purpose? (Choose TWO.)

A company is designing a new application that will process images uploaded by users. The application must automatically resize images and store them in Amazon S3. The solution should be serverless and event-driven. Which THREE AWS services should be used together? (Choose three.)

A solutions architect attempts to create this stack but receives an error: "Value of property SecurityGroups must be a list of strings". What is the likely cause?

Drag and drop the steps to migrate an on-premises MySQL database to Amazon RDS using AWS DMS in the correct order.

A financial services company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed across multiple Availability Zones. The company recently experienced a DDoS attack that overwhelmed the ALB and caused downtime. The security team wants to implement a solution that can absorb DDoS attacks at the edge and only forward legitimate traffic to the ALB. Additionally, the company needs to protect sensitive data in transit using TLS 1.3. What should the solutions architect do?

A company is designing a new application that will run on Amazon ECS with Fargate. The application must process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. The workload is unpredictable and can scale from 0 to thousands of messages per second. What is the MOST cost-effective and scalable architecture?

A company is designing a serverless application that uses AWS Lambda to process events from Amazon DynamoDB Streams. The Lambda function updates an Amazon RDS for MySQL database. The company expects a high volume of updates and is concerned about the Lambda function causing too many connections to the database. How should the company design the solution to manage the database connection pool effectively?

A company is designing a new microservices application on AWS. The application consists of several services that need to communicate asynchronously. One service generates orders and sends them to a processing service. The order volume can vary significantly, and the processing service must scale independently. The company wants to use a managed service to decouple the services and ensure that messages are not lost. The processing service is written in Python and runs on AWS Lambda. The solutions architect needs to design the message delivery mechanism. The architect decides to use Amazon SQS. However, the Lambda function sometimes fails to process a message due to a transient error, and the message should be retried. After a maximum of three retries, the message should be moved to a dead-letter queue for analysis. Which configuration should the architect use?

A retail company is deploying a new static website on AWS. The website consists of HTML, CSS, JavaScript, and image files. The company wants to serve the content globally with low latency, minimize cost, and avoid managing any servers. The website must use a custom domain name with HTTPS. Which solution should a solutions architect recommend?

A company is designing a disaster recovery solution for a critical database using Amazon RDS Multi-AZ. However, they also need to protect against regional failures. Which additional AWS service should they use?

A company is designing a new data lake solution on AWS using Amazon S3 as the storage layer. The data lake will be used by multiple teams for analytics and machine learning. The company needs to enforce fine-grained access control at the object level, enable auditing of data access, and ensure that sensitive data is masked for unauthorized users. Which combination of AWS services should be used?

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has a relational database with complex queries. The team wants to minimize changes to the existing codebase. Which database migration strategy should be recommended?

A healthcare company is designing a new application that must store protected health information in Amazon DynamoDB. The compliance team requires that all data be encrypted at rest with a customer-managed AWS KMS key so that key rotation and access can be audited centrally. The application runs on Amazon EC2 instances in a private subnet and must access the table over a private network path. The solutions architect needs to configure encryption and network access. Which combination of steps should the architect take?

A company is designing a new application that will process sensitive financial data. They need to ensure that data at rest is encrypted using customer-provided encryption keys (SSE-C) in Amazon S3. Which action is required to enable this?

A company is designing a new solution to host a static website on AWS. The website content is stored in an Amazon S3 bucket. The company wants to use a custom domain name (e.g., www.example.com) and enforce HTTPS. Which combination of AWS services should the company use?

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to output logs to CloudWatch Logs. Which configuration should be used to send logs from the container to CloudWatch?

A company is building a new application that requires a relational database with high availability across multiple Availability Zones. The database must automatically failover with minimal downtime. Which two AWS services or features meet these requirements?

A company is building a serverless application using AWS Lambda. The Lambda function needs to process files uploaded to an S3 bucket. The function should be triggered as soon as a new object is created. How should the architect configure this?

A company is building a new application that will run on AWS Lambda. The application needs to store and retrieve user preferences in a key-value format. The data is accessed frequently and must be highly available. The company expects low latency for reads and writes. Which AWS service should be used as the data store?

Which THREE design patterns can help a microservices application achieve loose coupling and independent deployability? (Choose three.)

A company wants to deploy a new web application on AWS that uses a microservices architecture. The company expects rapid growth and wants to decouple services to allow independent scaling and development. The team wants to use Docker containers for consistency across environments. Which solution should a Solutions Architect recommend?

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which TWO actions should be taken to achieve this? (Choose two.)

A company wants to decouple a web application frontend from a backend processing service. The frontend sends jobs that are processed asynchronously. Which AWS service is best suited for this decoupling?

A company is designing a new solution that uses Amazon S3 to store large amounts of archival data. The data must be retained for 7 years and then automatically deleted. Which S3 feature should they use?

A company is migrating a legacy three-tier application to AWS. The application servers run on Amazon EC2 instances behind an Application Load Balancer, and the database is a self-managed MySQL instance on an EC2 instance. The company requires that database credentials never be stored in application code or configuration files, and that credentials be automatically rotated every 30 days without application restarts. Which solution meets these requirements with the LEAST operational overhead?

A company is designing a new microservices application on AWS. Each microservice will be deployed as a containerized application using Amazon ECS with Fargate launch type. The company expects variable traffic patterns and needs to ensure that the application can scale automatically based on demand. Which scaling solution should be used?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The team wants to decouple the database layer and allow each microservice to own its data. Which design pattern should the team implement?

A solutions architect is designing a new serverless application using AWS Lambda for business logic, Amazon API Gateway for RESTful APIs, and Amazon DynamoDB for data storage. The application will experience unpredictable traffic spikes. What is the MOST cost-effective way to handle concurrency and scaling?

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application has variable traffic patterns, with high traffic during business hours and low traffic at night. They want to optimize costs while maintaining performance. Which scaling strategy should they implement?

A company is designing a new data lake on AWS using Amazon S3. The data will be ingested from various sources, including IoT devices, application logs, and streaming data. The data must be processed in near real-time as it arrives. Which combination of services should be used for ingestion and processing?

A company is building a new order-processing system on AWS. The system uses an Amazon SQS FIFO queue to receive order events from multiple producers. The company requires strict ordering of messages within each order ID and exactly-once processing. To achieve exactly-once processing, the producers must include a deduplication ID with each message. However, the producers currently do not generate deduplication IDs. What should a solutions architect recommend to meet the ordering and exactly-once processing requirements with minimal changes to the producers?

A company wants to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should be used?

Drag and drop the steps to set up a cross-region VPC peering connection in the correct order.

A company is designing a new microservices architecture on AWS. Each service must be independently deployable and scale based on demand. The company wants to minimize operational overhead for container orchestration. Which AWS service should the company use?

A company is deploying a containerized web application on Amazon Elastic Kubernetes Service (Amazon EKS). The application requires persistent storage that must be shared across multiple pods running on different nodes. The storage must support ReadWriteMany (RWX) access mode and provide high throughput for media processing workloads. The company wants to minimize operational overhead and use AWS managed services. Which two solutions should a solutions architect recommend? (Choose two.)

A company is designing a new application that will use Amazon DynamoDB as its primary data store. The application requires consistent low-latency read and write performance at any scale, and the company wants to minimize operational effort. The data model includes a table with a partition key and a sort key. The workload is expected to have highly uneven access patterns, with some items being accessed much more frequently than others. Which design approach should a solutions architect recommend to meet these requirements?

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

A company wants to automate the deployment of a three-tier web application on AWS. The deployment should include the network, security groups, EC2 instances, and an Application Load Balancer. Which AWS service should they use?

A company is designing a new application that will process sensitive financial data. The data must be encrypted at rest and in transit. The application runs on EC2 instances. Which combination of services meets these requirements?

A company is designing a multi-region active-active application using Amazon DynamoDB. They need to ensure low-latency reads and writes globally. Which DynamoDB feature should they use?

A company is designing a new application that requires a relational database with high availability and automatic failover across multiple Availability Zones. The database must support read-heavy workloads with minimal latency and must be able to scale read capacity independently. The company wants to minimize administrative overhead. Which solution meets these requirements?

A company is designing a new web application that will be accessed by users globally. The application uses Amazon CloudFront as a CDN and stores static content in Amazon S3. The dynamic content is served from EC2 instances in a single AWS Region. Which of the following will improve performance for users in distant regions with the LEAST operational effort?

A company wants to decouple a frontend API from backend processing to improve scalability and fault tolerance. The frontend sends requests that can be processed asynchronously. Which AWS service should be used to decouple the components?

A company is designing a new application that will use Amazon RDS for PostgreSQL. They need to implement read replicas to offload read traffic. However, they are concerned about replication lag affecting read consistency. Which action would minimize replication lag?

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

A company is designing a data lake solution on Amazon S3. Data is ingested from multiple sources and stored in a raw bucket. The data must be processed and transformed before being moved to a curated bucket. The processing logic is complex and includes conditional transformations. Which service should be used to orchestrate the transformation pipeline?

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?