Courseiva

CCNA Design for New Solutions Questions

37 of 487 questions · Page 7/7 · Design for New Solutions · Answers revealed

451
MCQmedium

A company is designing a new solution that uses Amazon S3 to store large amounts of archival data. The data must be retained for 7 years and then automatically deleted. Which S3 feature should they use?

A.S3 Replication
B.S3 Versioning
C.S3 Object Lock
D.S3 Lifecycle policies
AnswerD

Lifecycle policies can automatically delete objects after a set period.

Why this answer

S3 Lifecycle policies allow you to define rules that automatically expire objects after a specified period, such as 7 years. This directly meets the requirement to retain archival data for a fixed duration and then delete it without manual intervention.

Exam trap

The trap here is that candidates often confuse S3 Object Lock's retention period with automatic deletion, not realizing that Object Lock only prevents deletion during the retention window and requires a separate lifecycle rule to actually remove the objects afterward.

How to eliminate wrong answers

Option A is wrong because S3 Replication is used to copy objects across buckets for redundancy or compliance, not to manage retention or deletion based on time. Option B is wrong because S3 Versioning preserves multiple versions of an object and does not provide automatic deletion after a set period; it can actually increase storage costs if not combined with lifecycle rules. Option C is wrong because S3 Object Lock is designed to prevent object deletion or overwrites for a fixed retention period (compliance or governance mode), but it does not automatically delete objects after that period ends—it only prevents premature deletion, and objects remain until manually removed or a lifecycle rule is applied.

452
Multi-Selectmedium

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket. The company wants to use a custom domain name and SSL/TLS termination. Which THREE services should the company use together to meet these requirements? (Choose THREE.)

Select 3 answers
A.Amazon CloudFront with an S3 origin.
B.AWS WAF to protect the website.
C.Amazon S3 to store the website content.
D.Application Load Balancer to distribute traffic across multiple S3 buckets.
E.Amazon Route 53 to point the custom domain to CloudFront.
AnswersA, C, E

CloudFront provides global content delivery and SSL termination.

Why this answer

Amazon CloudFront with an S3 origin is correct because CloudFront is a global content delivery network (CDN) that caches static content at edge locations, providing low-latency access worldwide. It also supports custom domain names via alternate domain names (CNAMEs) and integrates with AWS Certificate Manager (ACM) for SSL/TLS termination, meeting all requirements for hosting a static website with global performance and security.

Exam trap

The trap here is that candidates often confuse AWS WAF as a mandatory component for security compliance, but the question only asks for services to meet the specific requirements of hosting a static website with global low latency, custom domain, and SSL/TLS termination—WAF is not required for these core functions.

453
Multi-Selecteasy

A company wants to implement a serverless data processing pipeline on AWS. The pipeline reads CSV files from Amazon S3, transforms the data, and loads it into Amazon Redshift. Which THREE AWS services should be used to build this pipeline?

Select 3 answers
A.AWS Database Migration Service (DMS)
B.Amazon EC2
C.AWS Lambda
D.AWS Glue
E.Amazon Redshift
AnswersC, D, E

Lambda can be triggered by S3 events to start the pipeline.

Why this answer

AWS Lambda is correct because it can be triggered by S3 events when a CSV file is uploaded, and it can execute lightweight data transformation logic (e.g., parsing CSV rows, filtering, or converting formats) before loading the data into Amazon Redshift. Lambda is serverless, scales automatically, and integrates natively with S3 and Redshift via the AWS SDK, making it ideal for event-driven, short-running transformations in a serverless pipeline.

Exam trap

The trap here is that candidates often confuse AWS DMS (option A) as a data loading tool for Redshift, but DMS is for database migration, not for serverless file transformation and loading from S3.

454
MCQmedium

A company is designing a new microservices application on AWS. Each microservice will be deployed as a containerized application using Amazon ECS with Fargate launch type. The company expects variable traffic patterns and needs to ensure that the application can scale automatically based on demand. Which scaling solution should be used?

A.Use Amazon EC2 Auto Scaling to add more Fargate tasks.
B.Configure Application Auto Scaling with a target tracking scaling policy based on average CPU utilization.
C.Use AWS Auto Scaling Plans with predictive scaling.
D.Manually adjust the desired count of tasks in the ECS service based on traffic analysis.
AnswerB

Application Auto Scaling with target tracking is the standard method to automatically scale ECS services based on a metric like CPU.

Why this answer

Amazon ECS with Fargate uses Application Auto Scaling to automatically adjust the desired count of tasks based on demand. A target tracking scaling policy based on average CPU utilization is the correct approach because it allows you to define a target value (e.g., 70% CPU) and Application Auto Scaling will add or remove tasks to maintain that target, matching the variable traffic patterns described.

Exam trap

The trap here is confusing EC2 Auto Scaling (which manages instances) with Application Auto Scaling (which manages ECS tasks), leading candidates to choose Option A despite Fargate being serverless and not requiring EC2 instance management.

How to eliminate wrong answers

Option A is wrong because Amazon EC2 Auto Scaling manages EC2 instances, not Fargate tasks; Fargate tasks are serverless and scaled via Application Auto Scaling, not EC2 Auto Scaling. Option C is wrong because AWS Auto Scaling Plans with predictive scaling is designed for recurring, predictable traffic patterns (e.g., based on historical data), not for variable, unpredictable traffic patterns as described in the question. Option D is wrong because manually adjusting the desired count of tasks does not meet the requirement for automatic scaling based on demand; it requires human intervention and analysis, which is not automated.

455
MCQeasy

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?

A.Install a self-signed certificate on each EC2 instance
B.Use a Network Load Balancer (NLB) with SSL pass-through
C.Configure the ALB with an SSL certificate
D.Use Amazon CloudFront for SSL termination
AnswerC

Configuring the ALB with an SSL certificate offloads SSL/TLS termination to the load balancer, reducing CPU usage on the instances. This is the recommended approach.

Why this answer

An Application Load Balancer (ALB) can terminate SSL/TLS by installing a certificate on it, reducing CPU load on backend EC2 instances. Option A (self-signed certificate on each instance) does not offload SSL and is less secure. Option B (NLB with SSL pass-through) does not terminate SSL; it passes encrypted traffic through.

Option D (CloudFront) can terminate SSL but is a CDN service, not primarily for SSL offload in this architecture, and adds cost and complexity.

456
MCQhard

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The team wants to decouple the database layer and allow each microservice to own its data. Which design pattern should the team implement?

A.Implement an event-driven architecture using Amazon SQS and AWS Lambda with CQRS.
B.Deploy a read replica of the database for each microservice to offload queries.
C.Use a single Amazon RDS instance with multiple schemas for each microservice.
D.Use a database-per-service pattern with each microservice having its own Amazon DynamoDB table or RDS instance.
AnswerD

Database-per-service ensures each microservice owns its data, enabling independent development and scaling.

Why this answer

The database-per-service pattern ensures each microservice has its own database, promoting loose coupling and independent scaling. Option A is wrong because an event-driven architecture with CQRS is a separate pattern for handling commands and queries, not for database decoupling per service. Option B is wrong because read replicas are used to offload read traffic from a single database, not to provide each microservice its own data store.

Option C is wrong because a single RDS instance with multiple schemas still results in a shared database, contradicting the goal of decoupling.

457
MCQhard

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from the 'confidential' folder in 'my-bucket' using HTTP (not HTTPS). What will happen?

A.The request is denied because the second statement denies access from the IP range.
B.The request is denied because the first statement only allows from a specific IP range.
C.The request is denied because the second statement explicitly denies access when using HTTP.
D.The request is allowed because the first statement allows s3:GetObject.
AnswerC

The Deny statement denies all S3 actions on confidential/* when SecureTransport is false.

Why this answer

The Deny statement explicitly denies s3:* actions on the confidential folder when SecureTransport is false (HTTP). Since the first statement allows GetObject for the whole bucket, but the Deny overrides (explicit deny), the request will be denied. Option A (allowed) ignores the Deny.

Option B (denied due to first statement) is wrong because first statement allows. Option D (denied due to IP condition) is wrong because the IP condition is only on the Allow statement.

458
MCQeasy

A solutions architect is designing a new serverless application using AWS Lambda for business logic, Amazon API Gateway for RESTful APIs, and Amazon DynamoDB for data storage. The application will experience unpredictable traffic spikes. What is the MOST cost-effective way to handle concurrency and scaling?

A.Use Lambda provisioned concurrency to pre-warm instances.
B.Use Lambda reserved concurrency to set a limit on concurrent executions.
C.Configure DynamoDB auto scaling to handle traffic spikes.
D.Set a usage plan in API Gateway with a throttling limit.
AnswerB

Reserved concurrency controls the maximum number of concurrent Lambda invocations, preventing excessive scaling and cost.

Why this answer

Lambda reserved concurrency sets a hard limit on the number of concurrent executions for a function, preventing runaway scaling and controlling costs during unpredictable traffic spikes. It ensures that the function does not consume more concurrency than allocated, which avoids excessive DynamoDB read/write capacity usage and keeps costs predictable without needing to pre-warm instances.

Exam trap

The trap here is that candidates confuse provisioned concurrency (which reduces latency but adds cost) with reserved concurrency (which controls scaling and cost), or they mistakenly think DynamoDB auto scaling or API Gateway throttling directly manages Lambda concurrency.

How to eliminate wrong answers

Option A is wrong because provisioned concurrency pre-warms a fixed number of instances to reduce cold starts, but it incurs additional costs even when idle and does not control scaling or concurrency limits during spikes—it is not cost-effective for unpredictable traffic. Option C is wrong because DynamoDB auto scaling adjusts read/write capacity based on actual traffic, but it does not directly handle Lambda concurrency or scaling; it only manages the database side and can still lead to high costs if Lambda invocations spike. Option D is wrong because a usage plan in API Gateway throttles requests at the API level, but it does not control Lambda concurrency or scaling; it may reject valid requests rather than managing cost-efficient concurrency.

459
MCQhard

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. Each device sends a JSON payload every second. The company needs to store the raw data for a month and then aggregate it into hourly summaries for long-term storage. The solution must be serverless and cost-effective. Which combination of AWS services should the company use?

A.Amazon Kinesis Data Streams to ingest data, AWS Lambda to transform and aggregate, Amazon S3 for storage.
B.Amazon Kinesis Data Streams to ingest data, Amazon Kinesis Data Analytics to aggregate in real-time, Amazon Kinesis Data Firehose to deliver aggregated data to S3, and an S3 Lifecycle policy to expire raw data after 30 days.
C.Amazon Kinesis Data Streams to ingest data, Amazon Kinesis Data Firehose to deliver to S3, and Amazon Athena to query raw data.
D.Amazon SQS to ingest data, AWS Lambda to process and aggregate, Amazon DynamoDB for raw data, S3 for summaries.
AnswerB

This design uses serverless services for real-time ingestion, aggregation, and cost-effective storage.

Why this answer

Kinesis Data Streams ingests real-time data, Kinesis Data Analytics performs real-time aggregation, and Kinesis Data Firehose delivers aggregated data to S3. An S3 Lifecycle policy can expire raw data after 30 days. Option A uses Lambda for aggregation, which is not ideal for streaming aggregations.

Option C misses the real-time aggregation step. Option D uses SQS, which is not designed for real-time streaming, and DynamoDB is not suitable for raw data storage at high volumes.

460
MCQhard

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application has variable traffic patterns, with high traffic during business hours and low traffic at night. They want to optimize costs while maintaining performance. Which scaling strategy should they implement?

A.Use target tracking scaling with a schedule to increase minimum capacity during business hours.
B.Use step scaling policies based on memory utilization.
C.Use scheduled scaling to increase capacity during business hours.
D.Use simple scaling policies based on CPU utilization.
AnswerA

This combination handles both patterns.

Why this answer

Combining target tracking scaling with a scheduled action allows the application to dynamically adjust capacity based on actual demand while ensuring a higher baseline during peak business hours. This hybrid approach optimizes costs by scaling down at night and maintains performance by preventing cold starts or lag during traffic spikes, which is ideal for variable patterns on ECS Fargate.

Exam trap

The trap here is that candidates often choose scheduled scaling alone (Option C) thinking it directly handles variable traffic, but they miss that it cannot react to unexpected spikes or lulls within the scheduled window, whereas target tracking with a schedule provides both proactive and reactive scaling.

How to eliminate wrong answers

Option B is wrong because step scaling policies based on memory utilization are less responsive to traffic-driven CPU spikes and can cause thrashing if memory is not the bottleneck; they also lack the predictive baseline needed for variable patterns. Option C is wrong because scheduled scaling alone cannot adapt to real-time fluctuations within business hours, leading to either over-provisioning or under-provisioning if traffic deviates from the schedule. Option D is wrong because simple scaling policies are deprecated in AWS and lack the cooldown and metric stabilization features of target tracking, making them prone to oscillation and inefficient for variable traffic.

461
MCQmedium

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use to decouple the services while providing durable message storage?

A.Amazon SNS
B.Amazon EventBridge
C.Amazon Kinesis Data Streams
D.Amazon SQS
AnswerD

SQS provides a fully managed message queue that decouples microservices with durable, scalable message storage.

Why this answer

Amazon SQS (Simple Queue Service) is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, decoupling them so that producers and consumers operate independently. SQS offers durable message storage by persisting messages across multiple Availability Zones, ensuring messages are not lost even if a consumer fails. This aligns with the requirement for loose coupling and reliable message delivery.

Exam trap

The trap here is that candidates often confuse Amazon SNS (pub/sub) with SQS (queue), overlooking that SNS does not provide durable message storage or consumer-driven polling, which are essential for decoupled asynchronous communication.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service that pushes messages to subscribers, but it does not provide durable message storage; messages are not persisted if a subscriber is unavailable, and it lacks the queue-based decoupling needed for asynchronous microservices. Option B is wrong because Amazon EventBridge is a serverless event bus for routing events between services, but it does not offer durable message storage; events are not retained after delivery, and it is designed for event-driven architectures rather than persistent queueing. Option C is wrong because Amazon Kinesis Data Streams is designed for real-time streaming of large data volumes with a focus on ordered processing and replay, not for simple asynchronous decoupling with durable message storage; it requires consumers to manage checkpoints and does not provide the same at-least-once delivery semantics as SQS.

462
MCQmedium

A company is designing a serverless application using AWS Lambda. The application needs to store and retrieve JSON documents. The company wants the lowest cost for infrequent access. Which data store should be used?

A.Amazon RDS for MySQL
B.Amazon S3 Standard
C.Amazon ElastiCache for Redis
D.Amazon DynamoDB (on-demand)
AnswerD

Amazon DynamoDB with on-demand capacity is serverless, scales automatically, and is cost-effective for infrequent access with no minimum charges.

Why this answer

Amazon DynamoDB with on-demand capacity is serverless and cost-effective for infrequent access. Option A is wrong because Amazon RDS for MySQL is relational and not serverless, and would require provisioning and scaling, leading to higher cost. Option B is wrong because Amazon S3 Standard is not ideal for small JSON documents and has higher cost for frequent updates or retrieval.

Option C is wrong because Amazon ElastiCache for Redis is a cache, not a durable store.

463
MCQmedium

A company is designing a new data lake on AWS using Amazon S3. The data will be ingested from various sources, including IoT devices, application logs, and streaming data. The data must be processed in near real-time as it arrives. Which combination of services should be used for ingestion and processing?

A.Amazon S3 Transfer Acceleration and AWS Lambda
B.Amazon Kinesis Data Firehose and Amazon Kinesis Data Analytics
C.Amazon Athena and Amazon S3
D.AWS Glue and Amazon Redshift
AnswerB

Kinesis Data Firehose can ingest streaming data and deliver it to S3 for the data lake. Kinesis Data Analytics can process the data in near real-time.

Why this answer

Amazon Kinesis Data Firehose is the correct ingestion service because it can reliably capture and load streaming data into Amazon S3 in near real-time without custom code. Amazon Kinesis Data Analytics then processes the data using SQL or Apache Flink as it arrives, enabling near real-time transformations and analytics before the data lands in the data lake.

Exam trap

The trap here is that candidates often confuse Amazon S3 Transfer Acceleration (a speed optimization for large file uploads) with a streaming ingestion service, or assume that Athena can process data as it arrives, when in fact Athena only queries data at rest in S3.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Transfer Acceleration is a feature that speeds up uploads over long distances using edge locations, but it does not provide streaming ingestion or near real-time processing capabilities; AWS Lambda alone cannot handle continuous high-throughput streaming ingestion without a buffer like Kinesis. Option C is wrong because Amazon Athena is an interactive query service for analyzing data already stored in S3, not a service for ingesting or processing streaming data in near real-time. Option D is wrong because AWS Glue is a serverless data integration service for batch ETL and cataloging, and Amazon Redshift is a data warehouse for analytics on structured data; neither is designed for near real-time streaming ingestion into a data lake.

464
MCQeasy

A company wants to deploy a containerized web application on AWS. They need to manage container orchestration, automatic scaling, and service discovery. Which AWS services should they use? (Select TWO.)

A.Amazon Lightsail
B.Amazon Elastic Container Service (ECS)
C.Amazon Elastic Kubernetes Service (EKS)
D.AWS Elastic Beanstalk
AnswerB, C

Amazon ECS is a fully managed container orchestration service that supports automatic scaling and service discovery, making it a valid option.

Why this answer

Amazon ECS and Amazon EKS both provide container orchestration, automatic scaling, and service discovery. ECS is a fully managed container orchestration service tightly integrated with AWS, while EKS offers Kubernetes-based orchestration. Both meet the requirements, so options B and C are correct.

Lightsail is for simple VMs or containers, not full orchestration. Elastic Beanstalk is a PaaS service that can deploy containers but lacks native container orchestration features.

465
MCQhard

A CloudFormation stack creation failed with the status shown in the exhibit. The stack was created using a template that defines an EC2 instance, a security group, and an Elastic IP address. What is the MOST likely cause of the failure?

A.The AWS account has reached the Elastic IP address limit.
B.The security group rule is invalid.
C.The EC2 instance failed to associate with the Elastic IP.
D.The EC2 instance type is not supported in the region.
AnswerA

The error message explicitly states the maximum number of addresses has been reached.

Why this answer

The stack creation failed with a status that indicates a resource creation failure, and the most likely cause is that the AWS account has reached its Elastic IP address limit. Each AWS account has a default limit of 5 Elastic IP addresses per region, and attempting to create a new Elastic IP beyond this quota causes the CloudFormation stack to roll back. The error message in the exhibit (not shown here but implied) typically states 'The maximum number of addresses has been reached' or similar, confirming this as the root cause.

Exam trap

The trap here is that candidates often assume the failure is due to an invalid security group rule or instance type, but the exhibit's error message (e.g., 'Resource creation cancelled' or 'API: ec2:AllocateAddress') specifically points to a quota limit on Elastic IPs, not a configuration or association issue.

How to eliminate wrong answers

Option B is wrong because an invalid security group rule would cause a validation error during stack creation, but the stack would fail with a specific error about the rule, not a generic resource creation failure. Option C is wrong because the EC2 instance failing to associate with the Elastic IP would occur after both resources are created, and CloudFormation would show a different error related to the association resource, not a failure to create the Elastic IP itself. Option D is wrong because an unsupported EC2 instance type would cause an immediate creation failure for the EC2 instance, but the error would reference the instance type, not the Elastic IP, and the stack would fail at the instance creation step, not at the Elastic IP step.

466
MCQeasy

A company wants to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should be used?

A.EC2 Instance Store
B.Amazon EFS
C.Amazon S3
D.Amazon EBS
AnswerB

EFS provides a shared file system for multiple instances.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances. This makes it the ideal choice for persistent storage that must be shared across containers running on different EC2 instances, as it supports the NFSv4.1 and NFSv4.0 protocols and automatically scales storage capacity as files are added or removed.

Exam trap

The trap here is that candidates often confuse Amazon EBS with a shared storage solution, but EBS volumes (except for the limited multi-attach feature) can only be attached to a single EC2 instance at a time, making it unsuitable for multi-instance shared access.

How to eliminate wrong answers

Option A is wrong because EC2 Instance Store provides ephemeral block-level storage that is physically attached to the host computer, and data is lost when the instance is stopped or terminated; it cannot be shared across multiple EC2 instances. Option C is wrong because Amazon S3 is an object storage service accessed via HTTP/HTTPS APIs, not a file system that can be mounted directly by multiple EC2 instances for concurrent read/write access with standard file system semantics. Option D is wrong because Amazon EBS provides block-level storage volumes that can be attached to only one EC2 instance at a time (except for multi-attach EBS io1/io2 volumes, which are limited to a small number of Nitro-based instances and are not designed for general-purpose shared file storage across many containers).

467
Drag & Dropmedium

Drag and drop the steps to set up a cross-region VPC peering connection in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First initiate, then accept, then add routes, then update security groups, and finally network ACLs.

468
MCQmedium

A company is designing a new microservices architecture on AWS. Each service must be independently deployable and scale based on demand. The company wants to minimize operational overhead for container orchestration. Which AWS service should the company use?

A.Amazon Elastic Kubernetes Service (EKS)
B.Amazon EC2 with Auto Scaling
C.Amazon Elastic Container Service (ECS) with AWS Fargate
D.AWS Lambda
AnswerC

ECS with Fargate is serverless and reduces operational overhead for container orchestration.

Why this answer

Amazon ECS with AWS Fargate is the correct choice because it provides a fully managed container orchestration service that eliminates the need to provision, configure, or scale underlying EC2 instances. Fargate runs each container in its own isolated compute environment, allowing each microservice to scale independently based on demand while minimizing operational overhead for cluster management.

Exam trap

The trap here is that candidates often choose Amazon EKS assuming Kubernetes is the only modern orchestration tool, but the question specifically asks for minimal operational overhead, and Fargate's serverless model removes the need to manage any cluster infrastructure, which EKS does not fully eliminate even with managed node groups.

How to eliminate wrong answers

Option A is wrong because Amazon EKS requires you to manage the Kubernetes control plane (or pay for it) and typically involves managing worker nodes or using managed node groups, which adds operational overhead compared to Fargate's serverless model. Option B is wrong because Amazon EC2 with Auto Scaling requires you to manage the underlying instances, including patching, scaling policies, and container orchestration software, which contradicts the goal of minimizing operational overhead. Option D is wrong because AWS Lambda is designed for short-running, event-driven functions with a maximum execution timeout of 15 minutes and limited runtime environments, making it unsuitable for long-running microservices that require container-level isolation and persistent connections.

469
Multi-Selecthard

A company is designing a new serverless application using AWS Lambda. The application must be invoked by an Amazon S3 bucket event. The company wants to ensure that the Lambda function has the necessary permissions to be invoked. Which THREE steps are required?

Select 3 answers
A.Add a resource-based policy to the Lambda function that grants S3 permission to invoke it.
B.Configure an S3 bucket notification event to send events to the Lambda function.
C.Attach an IAM role to the S3 bucket that allows it to invoke Lambda functions.
D.Create an event source mapping in Lambda for the S3 bucket.
E.Create an IAM role for the Lambda function with permissions to read from the S3 bucket.
AnswersA, B, E

A resource-based policy (function policy) allows S3 to invoke the Lambda function.

Why this answer

Lambda uses a resource-based policy (also known as a function policy) to grant other AWS services, such as S3, permission to invoke the function. Without this policy, S3 does not have the necessary invoke permissions, and the Lambda function will reject the invocation request.

Exam trap

The trap here is confusing event source mappings (used for polling-based triggers like SQS or DynamoDB Streams) with S3 event notifications, which are push-based and require only a resource-based policy and a bucket notification configuration.

470
Multi-Selectmedium

A company is designing a new application on AWS that requires a highly available and scalable web tier. The web servers must be stateless and scale automatically based on CPU utilization. Which TWO actions should the company take to meet these requirements?

Select 2 answers
A.Configure an Auto Scaling group with a launch template that includes a user data script to bootstrap the web server
B.Attach the Auto Scaling group to an Application Load Balancer
C.Configure lifecycle hooks in the Auto Scaling group to drain connections
D.Use a single large EC2 instance (e.g., c5n.18xlarge) to handle all traffic
E.Use a Network Load Balancer to distribute traffic to web servers
AnswersA, B

Auto Scaling group provides automatic scaling and high availability.

Why this answer

A launch template with user data allows the Auto Scaling group to bootstrap web server software automatically when new instances launch, ensuring they are stateless and ready to serve traffic. Option B is correct because attaching an Application Load Balancer (ALB) distributes incoming traffic across the Auto Scaling group's instances, enabling horizontal scaling and high availability. Together, these actions support stateless web servers that scale based on CPU utilization via Auto Scaling policies.

Exam trap

The trap here is that candidates may confuse lifecycle hooks (Option C) as necessary for scaling or connection draining, when in fact the ALB handles connection draining automatically, and lifecycle hooks are an optional feature for custom workflows like patching or logging.

471
MCQhard

A solutions architect is designing a new serverless application using AWS Lambda to process orders from an API Gateway endpoint and store them in DynamoDB. The architect creates the IAM role shown in the exhibit. When testing, the Lambda function fails to write to DynamoDB with an AccessDeniedException. What is the MOST likely cause?

A.The Lambda function does not have permission to create log groups.
B.The Lambda function is not in the same VPC as DynamoDB.
C.The DynamoDB table 'Orders' does not exist.
D.The IAM role lacks a trust policy that allows Lambda to assume it.
AnswerD

The exhibit shows only permission policies; the trust policy is missing.

Why this answer

The IAM role shown in the exhibit likely includes a permissions policy that grants DynamoDB write access, but it is missing a trust policy that allows the Lambda service (lambda.amazonaws.com) to assume the role. Without this trust relationship, Lambda cannot obtain temporary credentials to execute the function, resulting in an AccessDeniedException when attempting to write to DynamoDB.

Exam trap

The trap here is that candidates often focus on the permissions policy (e.g., DynamoDB actions) and overlook the trust policy, assuming any IAM role can be used by Lambda, but AWS requires an explicit trust relationship for service-to-service role assumption.

How to eliminate wrong answers

Option A is wrong because Lambda automatically creates log groups via the AWSLambdaBasicExecutionRole managed policy if the function has logs:CreateLogGroup permission; a missing log group permission would cause a different error (e.g., 'Unable to write to CloudWatch Logs'), not an AccessDeniedException on DynamoDB writes. Option B is wrong because Lambda functions do not need to be in the same VPC as DynamoDB; DynamoDB is a fully managed service accessible over the public internet or via VPC endpoints, and VPC placement does not affect IAM authorization. Option C is wrong because if the table 'Orders' did not exist, the error would be a ResourceNotFoundException, not an AccessDeniedException.

472
Multi-Selecthard

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

Select 3 answers
A.Launch the database instance in a public subnet.
B.Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.
C.Store database credentials in AWS Systems Manager Parameter Store.
D.Launch the web tier instances in a private subnet.
E.Set the 'Publicly accessible' option of the RDS instance to 'No'.
AnswersB, D, E

Security group rules restrict traffic to only the web tier.

Why this answer

The database security group should allow inbound traffic on port 5432 (the default PostgreSQL port) from the web tier security group. This creates a security group-level firewall rule that restricts database access to only the web tier instances, ensuring no other sources can connect.

Exam trap

The trap here is that candidates may confuse security best practices (like using Parameter Store for credentials) with network-level access controls, leading them to select Option C instead of recognizing that only security group rules and subnet placement directly control connectivity and internet exposure.

473
MCQeasy

A company wants to automate the deployment of a three-tier web application on AWS. The deployment should include the network, security groups, EC2 instances, and an Application Load Balancer. Which AWS service should they use?

A.AWS Elastic Beanstalk
B.AWS CloudFormation
C.AWS CodeDeploy
D.AWS OpsWorks
AnswerB

CloudFormation provisions infrastructure as code, including network, EC2, and ALB.

Why this answer

AWS CloudFormation. AWS CloudFormation allows infrastructure as code to provision all required resources, including the network, security groups, EC2 instances, and an Application Load Balancer. Option A (AWS Elastic Beanstalk) abstracts the underlying infrastructure and does not provide granular control.

Option C (AWS CodeDeploy) is used for deploying application code, not infrastructure. Option D (AWS OpsWorks) is a configuration management service, not an infrastructure provisioning tool.

474
MCQmedium

A company is designing a new application that will process sensitive financial data. The data must be encrypted at rest and in transit. The application runs on EC2 instances. Which combination of services meets these requirements?

A.Use Amazon S3 with server-side encryption and enforce HTTPS.
B.Use AWS Key Management Service (KMS) to generate keys and enable encryption on EBS volumes.
C.Use AWS Certificate Manager (ACM) to issue TLS certificates and configure the application to use HTTPS.
D.Enable EBS encryption on the volumes and configure the application to use TLS for all network traffic.
AnswerD

EBS encryption provides at-rest encryption; TLS provides in-transit encryption.

Why this answer

It addresses both encryption requirements: EBS encryption ensures data at rest is encrypted using AWS KMS-managed keys, and configuring the application to use TLS encrypts data in transit between clients and the EC2 instances. This combination directly meets the stated security needs without relying on external services like S3 or ACM for the EC2-hosted application.

Exam trap

The trap here is that candidates often pick options that address only one requirement (e.g., only encryption at rest or only encryption in transit) or confuse storage services (S3) with compute services (EC2), failing to realize both encryption states must be covered for the EC2-based application.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is a storage service, not the compute platform (EC2) where the application runs; using S3 with server-side encryption and HTTPS does not encrypt data at rest on EC2 EBS volumes or in transit to/from the application. Option B is wrong because enabling encryption on EBS volumes only covers data at rest, but does not address encryption in transit for network traffic. Option C is wrong because ACM-issued TLS certificates and HTTPS only encrypt data in transit, leaving data at rest on EC2 EBS volumes unencrypted.

475
MCQmedium

A company is designing a microservices architecture using Amazon ECS with Fargate. Each microservice needs to communicate with others via REST APIs. The company wants to ensure that communication is encrypted in transit and that services can discover each other using DNS names. Which set of actions should the company take?

A.Enable ECS Service Connect on each service, and use the service discovery names provided by Service Connect.
B.Create a namespace in AWS Cloud Map, register each service, and configure service-to-service communication using the namespace.
C.Place a Network Load Balancer in front of each service and use the NLB DNS name for communication.
D.Place an Application Load Balancer in front of each service and use the ALB DNS name for communication.
AnswerA

Correct. ECS Service Connect provides DNS-based service discovery and automatic encryption via TLS, meeting both requirements.

Why this answer

ECS Service Connect provides built-in DNS-based service discovery and automatic encryption via TLS for inter-service communication. Option B uses AWS Cloud Map for service discovery but does not enforce encryption in transit. Option C uses a Network Load Balancer (NLB) in front of each service, which adds unnecessary complexity and cost without addressing service discovery.

Option D uses an Application Load Balancer (ALB) in front of each service, which is also overly complex and costly for simple inter-service communication.

476
Multi-Selectmedium

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

Select 2 answers
A.Configure RDS Multi-AZ in the primary region.
B.Deploy an Amazon Aurora Global Database with a secondary region.
C.Pre-warm a standby EC2 instance in the DR region.
D.Take hourly snapshots of RDS and copy them to the DR region.
E.Use Amazon S3 Cross-Region Replication for application data.
AnswersA, B

Multi-AZ provides automatic failover with low RTO.

Why this answer

RDS Multi-AZ provides automatic failover to a standby in a different Availability Zone within the same region, achieving an RTO typically under 1-2 minutes and an RPO of zero (synchronous replication). This meets the 15-minute RTO and 1-minute RPO for intra-region failures, but it does not address cross-region DR. Option B is correct because Amazon Aurora Global Database uses asynchronous replication with a typical RPO of 1 second or less and can promote a secondary region in under 1 minute, satisfying both the 15-minute RTO and 1-minute RPO for a full regional disaster.

Exam trap

The trap here is that candidates often assume Multi-AZ alone is sufficient for cross-region DR, but Multi-AZ only protects against AZ failures within the same region, not a regional disaster, so a cross-region solution like Aurora Global Database is required to meet the RTO and RPO for a full region outage.

477
MCQmedium

A company is designing a multi-region active-active application using Amazon DynamoDB. They need to ensure low-latency reads and writes globally. Which DynamoDB feature should they use?

A.Auto Scaling
B.DynamoDB Accelerator (DAX)
C.DynamoDB Streams
D.Global Tables
AnswerD

Global Tables provides fully managed, multi-region, multi-active replication, enabling low-latency reads and writes across multiple regions.

Why this answer

DynamoDB Global Tables provide a fully managed, multi-region, multi-active database for low-latency reads and writes globally. Option A (Auto Scaling) adjusts throughput but doesn't enable multi-region replication. Option B (DAX) is an in-memory cache that improves read latency but doesn't handle writes or multi-region.

Option C (Streams) captures item-level changes but requires additional setup for cross-region replication. Option D (Global Tables) is the correct feature for active-active multi-region workloads.

478
MCQeasy

A company is designing a new web application that will be accessed by users globally. The application uses Amazon CloudFront as a CDN and stores static content in Amazon S3. The dynamic content is served from EC2 instances in a single AWS Region. Which of the following will improve performance for users in distant regions with the LEAST operational effort?

A.Deploy EC2 instances in multiple AWS Regions and use Route 53 latency-based routing.
B.Use AWS Global Accelerator to route traffic to the EC2 instances via the AWS global network.
C.Move the dynamic content to Lambda@Edge functions running at CloudFront edge locations.
D.Add an Amazon ElastiCache cluster in front of the EC2 instances to cache dynamic responses.
AnswerB

Global Accelerator uses the AWS network to route traffic from edge locations to the nearest healthy endpoint, reducing latency and jitter.

Why this answer

AWS Global Accelerator uses the AWS global network to route traffic from edge locations to the optimal EC2 endpoint, reducing latency and jitter for distant users without requiring multi-region deployments. This minimizes operational effort because it involves only a single configuration change (creating an accelerator and associating it with the existing EC2 instances) rather than managing infrastructure across multiple regions.

Exam trap

The trap here is that candidates often assume Lambda@Edge can handle all dynamic content at the edge, but they overlook its execution time and resource constraints, making it unsuitable for complex backend logic or database queries.

How to eliminate wrong answers

Option A is wrong because deploying EC2 instances in multiple AWS Regions and using Route 53 latency-based routing requires significant operational overhead for managing, patching, and synchronizing infrastructure across regions, which contradicts the 'least operational effort' requirement. Option C is wrong because Lambda@Edge functions are designed for lightweight compute at edge locations (e.g., header manipulation, authentication) and are not suitable for serving full dynamic content from a backend, as they have execution time limits (5 seconds for viewer events) and cannot maintain persistent connections to databases. Option D is wrong because adding an ElastiCache cluster in front of EC2 instances only caches dynamic responses for repeated requests within a single region, but does not reduce network latency for users in distant regions who still traverse the public internet to reach the origin region.

479
MCQmedium

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires that users' session data be stored durably and with low latency. The session data is accessed frequently but is rarely updated. Which solution is MOST cost-effective?

A.Use ElastiCache for Redis with replication.
B.Store session data in Amazon S3 with reduced redundancy.
C.Use DynamoDB with on-demand capacity.
D.Use ElastiCache for Memcached with multiple nodes.
AnswerA

Redis provides low latency and durability via replication, suitable for session storage.

Why this answer

ElastiCache for Redis with replication is the most cost-effective solution because it provides durable, low-latency session storage with built-in replication for high availability. Redis supports persistence (e.g., snapshots or AOF logs) to ensure session data survives node failures, and its in-memory nature delivers sub-millisecond latency for frequent reads with rare updates, avoiding the higher costs of DynamoDB on-demand or the lack of durability in Memcached.

Exam trap

The trap here is that candidates may choose DynamoDB for its durability and scalability, overlooking that its on-demand pricing is significantly more expensive than a provisioned Redis cluster for frequent reads with rare updates, or they may choose Memcached for its simplicity, forgetting that it lacks persistence and replication, which are required for durable session storage.

How to eliminate wrong answers

Option B is wrong because Amazon S3 with reduced redundancy (RRS) is not designed for low-latency session data access; it has higher latency (typically tens to hundreds of milliseconds) and lacks the sub-millisecond performance needed for real-time session reads, plus RRS is deprecated and offers lower durability (99.99%) than standard S3, making it unsuitable for critical session data. Option C is wrong because DynamoDB with on-demand capacity incurs higher costs for frequent reads with rare updates due to its pay-per-request pricing model, which is less cost-effective than a fixed-capacity Redis instance for predictable workloads; additionally, DynamoDB's latency (single-digit milliseconds) is higher than Redis's sub-millisecond performance. Option D is wrong because ElastiCache for Memcached does not support data persistence or replication, meaning session data is lost on node failure, violating the durability requirement; it also lacks features like snapshots or replication that Redis provides for durability.

480
MCQmedium

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data includes sensitive customer information that must be encrypted at rest. The company also needs to regularly rotate the encryption keys. Which solution meets these requirements with the least operational overhead?

A.Use server-side encryption with S3 managed keys (SSE-S3) and enable S3 bucket key rotation.
B.Implement client-side encryption using the AWS Encryption SDK and store keys in AWS Secrets Manager.
C.Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation in KMS.
D.Use server-side encryption with customer-provided keys (SSE-C) and rotate keys manually.
AnswerC

SSE-KMS with automatic rotation meets encryption and rotation needs with low overhead.

Why this answer

SSE-KMS with automatic key rotation provides encryption at rest with minimal operational overhead. AWS KMS automatically rotates the customer master key (CMK) annually, and you can configure a custom rotation period (e.g., 90 days) if needed. This meets the requirement for regular key rotation without manual intervention, unlike SSE-S3 which does not support key rotation, and SSE-C which requires manual key management.

Exam trap

The trap here is that candidates often confuse S3 bucket key rotation (which reduces KMS costs but does not rotate the encryption key) with actual key rotation, leading them to incorrectly select SSE-S3.

How to eliminate wrong answers

Option A is wrong because SSE-S3 uses S3-managed keys that cannot be rotated; the 'bucket key' feature reduces KMS API calls but does not rotate the encryption key itself. Option B is wrong because client-side encryption with the AWS Encryption SDK and Secrets Manager adds significant operational overhead for key management and rotation, and the question asks for the least operational overhead. Option D is wrong because SSE-C requires you to provide and manage your own encryption keys, including manual rotation, which increases operational complexity and does not meet the 'least operational overhead' requirement.

481
MCQeasy

A company wants to decouple a frontend API from backend processing to improve scalability and fault tolerance. The frontend sends requests that can be processed asynchronously. Which AWS service should be used to decouple the components?

A.Amazon Simple Notification Service (SNS)
B.Amazon Simple Queue Service (SQS)
C.Amazon Kinesis Data Streams
D.AWS Step Functions
AnswerB

SQS is a message queue that decouples components.

Why this answer

Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the frontend API from backend processing. The frontend can send requests to an SQS queue, and backend consumers can poll and process messages asynchronously, which improves scalability by buffering traffic spikes and enhances fault tolerance by persisting messages until they are successfully processed.

Exam trap

The trap here is that candidates often confuse SNS (push-based notification) with SQS (pull-based queue) for decoupling, but SNS does not provide the durable, asynchronous message buffer required for decoupling frontend and backend processing.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service that pushes messages to subscribers (e.g., HTTP endpoints, Lambda, SQS) but does not provide a durable buffer for asynchronous decoupling; it is designed for fan-out notifications, not for queuing where consumers pull messages at their own pace. Option C is wrong because Amazon Kinesis Data Streams is optimized for real-time streaming of large-scale data (e.g., clickstreams, logs) with ordered records and replay capabilities, not for simple request/response decoupling where each message is processed independently by a single consumer. Option D is wrong because AWS Step Functions is a serverless orchestration service for coordinating multiple AWS services into workflows, not a message queue; it does not inherently decouple frontend from backend via asynchronous message buffering.

482
Multi-Selecthard

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

Select 3 answers
A.Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP
B.Use IAM roles for service accounts (IRSA) to grant pods access to Secrets Manager
C.Store secrets in AWS Secrets Manager and enable automatic rotation
D.Use the AWS Secrets and Configuration Provider (ASCP) for the Secrets Store CSI Driver to inject secrets into pods
E.Store secrets in Kubernetes Secrets and use a ConfigMap to reference them
AnswersB, C, D

IRSA provides fine-grained permissions for pods.

Why this answer

IAM Roles for Service Accounts (IRSA) allows pods in Amazon EKS to assume an IAM role with fine-grained permissions, enabling secure access to AWS Secrets Manager without embedding long-term credentials. This approach integrates with AWS IAM to provide temporary credentials via OIDC federation, ensuring that only authorized pods can retrieve secrets.

Exam trap

The trap here is that candidates may think mounting the CSI driver without ASCP (Option A) is sufficient, but ASCP is the critical component that bridges the CSI driver to AWS Secrets Manager, and without it, the driver cannot retrieve secrets from AWS.

483
Multi-Selectmedium

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Select 3 answers
A.EC2 Spot Instances to reduce compute costs.
B.AWS Lambda functions to process each file.
C.AWS Batch with a job queue and compute environment.
D.Amazon S3 Event Notifications to trigger the batch job when a new file is uploaded.
E.Auto Scaling group with scheduled scaling policies.
AnswersA, C, D

Spot Instances are cost-effective for fault-tolerant batch jobs.

Why this answer

A is correct because EC2 Spot Instances can reduce compute costs by up to 90% compared to On-Demand instances, making them ideal for fault-tolerant, stateless batch workloads that can handle interruptions. The batch processing system described is CPU-intensive and runs for up to 2 hours per file, which fits well within the typical Spot interruption notice (2 minutes) and can be retried using AWS Batch’s built-in retry logic.

Exam trap

The trap here is that candidates often choose AWS Lambda for any event-driven processing without considering its 15-minute timeout limit, overlooking that long-running CPU-intensive tasks require a different compute service like AWS Batch.

484
MCQhard

A company needs to provide temporary credentials for users to access an S3 bucket for exactly 1 hour. The solution must not require any custom code or user management. Which AWS service should be used?

A.Amazon Cognito identity pools
B.An IAM role with a trust policy
C.S3 pre-signed URLs
D.AWS STS
AnswerD

STS generates temporary credentials with a specified duration.

Why this answer

AWS STS (Security Token Service) is the correct choice because it can generate temporary, limited-privilege credentials for IAM users or federated users, with a configurable expiration period (up to 1 hour for the default API call). This meets the requirement of providing temporary credentials for exactly 1 hour without requiring custom code or user management, as STS is a managed service that issues credentials via API calls like AssumeRole or GetFederationToken.

Exam trap

The trap here is that candidates often confuse IAM roles (which define permissions) with the actual mechanism to issue temporary credentials (STS), leading them to select Option B, but a role alone cannot generate credentials without STS or custom code.

How to eliminate wrong answers

Option A is wrong because Amazon Cognito identity pools are designed for federated identities and user pools for authentication, but they require integration with a user pool or external identity provider and do not directly issue temporary S3 credentials without additional configuration; they also involve user management overhead. Option B is wrong because an IAM role with a trust policy defines who can assume the role but does not itself generate temporary credentials; it must be combined with AWS STS to actually issue credentials, and the role alone does not provide a mechanism to grant credentials to users without custom code. Option C is wrong because S3 pre-signed URLs grant time-limited access to specific S3 objects, not to the entire bucket, and they are generated using AWS SDK or CLI, which requires custom code; they also do not provide temporary credentials for general S3 operations.

485
Multi-Selectmedium

A company is designing a new system to ingest and process real-time streaming data from thousands of IoT devices. The system must be able to handle variable throughput and provide durable storage for the data. The data will be processed by a Lambda function and then stored in Amazon S3. Which two services should be used together to build this ingestion pipeline?

Select 2 answers
A.AWS Lambda
B.Amazon Kinesis Data Firehose
C.Amazon Simple Queue Service (SQS)
D.Amazon Kinesis Data Streams
E.Amazon Simple Notification Service (SNS)
AnswersA, D

Can process records from Kinesis Data Streams in near real-time.

Why this answer

Amazon Kinesis Data Streams (Option D) is the correct ingestion service because it provides durable, real-time data streaming with shard-level persistence for up to 365 days, enabling Lambda to process records in near real-time with at-least-once delivery semantics. AWS Lambda (Option A) is the correct processing service because it can be configured as a consumer of the Kinesis stream via event source mapping, scaling automatically with the number of shards to handle variable throughput without managing servers.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose with Kinesis Data Streams, assuming Firehose's direct S3 delivery is sufficient, but they miss that Firehose cannot trigger Lambda per-record processing and lacks the durable, replayable stream storage required for real-time IoT ingestion with Lambda.

486
MCQmedium

A company is designing a data lake solution on Amazon S3. Data is ingested from multiple sources and stored in a raw bucket. The data must be processed and transformed before being moved to a curated bucket. The processing logic is complex and includes conditional transformations. Which service should be used to orchestrate the transformation pipeline?

A.AWS Data Pipeline
B.AWS Step Functions
C.AWS Lambda functions
D.AWS Glue ETL jobs
AnswerB

Step Functions can orchestrate complex workflows with conditional branching.

Why this answer

AWS Step Functions is the correct choice because it is designed to orchestrate complex, multi-step workflows with conditional branching, retries, and error handling. It can coordinate AWS Lambda functions, AWS Glue jobs, and other services to process and transform data from a raw S3 bucket to a curated bucket, making it ideal for a transformation pipeline with complex logic.

Exam trap

The trap here is that candidates often confuse AWS Glue ETL jobs as an orchestration tool because it can transform data, but Glue is a processing engine, not a workflow orchestrator; Step Functions is the correct service for coordinating complex, conditional pipelines.

How to eliminate wrong answers

Option A is wrong because AWS Data Pipeline is a legacy service for moving data between sources and destinations, but it lacks native support for complex conditional transformations and is not as flexible as Step Functions for orchestrating custom processing logic. Option C is wrong because AWS Lambda functions are stateless and have a maximum execution timeout of 15 minutes, making them unsuitable for orchestrating long-running or multi-step transformation pipelines; they are better suited for individual processing tasks within the workflow. Option D is wrong because AWS Glue ETL jobs are designed for batch data transformation using Apache Spark, but they are not an orchestration service; they would be a component orchestrated by Step Functions, not the orchestrator itself.

487
MCQhard

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?

A.AWS Storage Gateway File Gateway
B.Amazon EFS
C.Amazon EBS with multi-attach enabled
D.Amazon S3
AnswerB

EFS provides a fully managed, scalable NFS file system that can be mounted by many instances with strong consistency.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. It offers strong read-after-write consistency and low-latency access, making it ideal for shared file workloads requiring POSIX permissions and concurrent access.

Exam trap

The trap here is that candidates often confuse Amazon EBS multi-attach with a shared file system, but EBS multi-attach is a block-level shared volume limited to a single AZ and does not provide file-level locking or POSIX semantics, making it unsuitable for concurrent file system access.

How to eliminate wrong answers

Option A is wrong because AWS Storage Gateway File Gateway provides on-premises caching of S3 objects via NFS/SMB, but it is designed for hybrid cloud access with higher latency and not optimized for low-latency concurrent EC2 mounting. Option C is wrong because Amazon EBS with multi-attach enabled supports only up to 16 Nitro-based EC2 instances in a single Availability Zone, lacks cross-AZ support, and does not provide a shared file system interface (it is a block device). Option D is wrong because Amazon S3 is an object storage service accessed via HTTPS API, not a file system that can be mounted with POSIX semantics, and it does not support concurrent file-level locking or low-latency NFS access.

← PreviousPage 7 of 7 · 487 questions total

Ready to test yourself?

Try a timed practice session using only Design for New Solutions questions.