route 53 failover

A large enterprise has 200 AWS accounts organized under AWS Organizations. The central security team needs to audit all IAM role trust policies across accounts to ensure no cross-account roles allow external principals. Which approach is most efficient and scalable?

A company is designing a real-time analytics pipeline to process streaming data from IoT devices. The solution must be serverless and handle data transformation before storage. Which combination of services is most cost-effective?

A company is designing a new microservices architecture using Amazon ECS with Fargate. Each service must be isolated within its own VPC and communicate via AWS PrivateLink. The company expects variable traffic and wants to minimize costs. Which solution meets these requirements?

A company wants to implement a cost-effective disaster recovery strategy for a production Amazon RDS for PostgreSQL database. The solution must provide a recovery point objective (RPO) of less than 5 minutes and a recovery time objective (RTO) of less than 15 minutes. Which strategies meet these requirements? (Choose THREE.)

A company is designing a new microservices-based application on AWS. They need to decouple services and ensure asynchronous communication. Which AWS service should they use?

A company has multiple AWS accounts and wants to centralize the management of security policies. The security team needs to enforce that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. The solution must be centrally managed and automatically applied to new accounts as they are added. Which approach should be taken?

A company has a multi-account AWS environment with hundreds of accounts. The central IT team needs to audit all API calls made in the organization. The solution must be cost-effective and capture events from all regions and accounts, including future accounts. Which solution should the company use?

A company is designing a new CI/CD pipeline for a web application that will be deployed on Amazon ECS. Which AWS service should the company use to build and test the application code?

A company uses AWS Organizations and has a central security account. They want to use AWS Security Hub to aggregate findings from all member accounts. They have enabled Security Hub in the security account and invited all member accounts. However, findings from member accounts are not appearing in the Security Hub console of the security account. What is the most likely cause?

A company is migrating a .NET application from Windows Server to AWS. The application uses SQL Server and needs to run on Amazon EC2. The company wants to reduce licensing costs. Which Amazon EC2 instance type should the company use?

A company is modernizing its monolithic application by breaking it into microservices. The application uses a shared MySQL database. The team wants to implement a database per microservice pattern. Which AWS service should be used to manage multiple databases efficiently?

A company has a multi-account AWS environment. The security team wants to enforce that all IAM roles in the production accounts can only be assumed from a specific IP range (the corporate network). Which TWO approaches can achieve this?

A company is migrating a monolithic e-commerce application to a microservices architecture on AWS. The migration must minimize downtime and allow rollback. Which migration strategy should the company use?

A company is migrating a monolithic application to AWS. They want to minimize refactoring effort while gaining some benefits of the cloud. Which migration strategy is most appropriate?

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all new S3 buckets are encrypted using AES-256. What is the MOST effective way to enforce this requirement?

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The deployment pipeline includes a source stage, a build stage using CodeBuild, and a deploy stage. Recently, deployments have been failing in the deploy stage with the error: 'The environment is in an invalid state for this operation.' The developer confirms the build artifacts are correct. What is the MOST likely cause?

A company is building a serverless application using AWS Lambda. The function needs to access a private Amazon RDS MySQL database. The Lambda function and the RDS instance are in the same VPC. What is the correct way to configure the Lambda function to connect to the database?

A company is using Amazon API Gateway to expose a REST API. The API backend is a Lambda function that queries an Amazon DynamoDB table. During peak hours, the API returns HTTP 429 (Too Many Requests) errors. What is the MOST cost-effective way to reduce these errors?

A company is migrating a monolithic application to a microservices architecture on AWS. They want to decouple the services and ensure that messages between services are processed asynchronously and durably. Which AWS service should they use for this purpose?

A company is migrating 50 TB of data from on-premises to Amazon S3 over a 100 Mbps internet connection. The migration must complete within 30 days. What should they do?

A company is migrating a legacy monolithic e-commerce platform to AWS. The platform consists of a Java-based web application, an Oracle database, and a file server storing product images. The company's migration requirements are: (1) minimize downtime during cutover, (2) reduce operational overhead for the database, (3) enable future migration to microservices. The current on-premises environment experiences high I/O latency for the file server. The company has already set up a VPN connection to AWS and has installed the AWS Application Discovery Service agent on all servers. During the assessment, you discover that the Oracle database is 2 TB and the file server holds 5 TB of images. The web application is tightly coupled with the database and uses stored procedures. You need to design the migration approach. Which combination of actions should be taken?

A company is using AWS Lambda functions to process data from an S3 bucket. Recently, the function has been timing out. The function has a 5-minute timeout configured. What is the most likely cause of the timeout?

A company is planning to migrate its on-premises data warehouse to AWS. The data warehouse runs on a large Oracle RAC cluster with complex stored procedures and ETL jobs. The company wants to minimize migration effort while gaining cloud benefits. Which AWS service should be used as the target?

A solutions architect is reviewing the above IAM policy attached to an S3 bucket. A user from IP address 10.0.1.5 makes a request over HTTP (not HTTPS). Will the user be able to download an object?

A company is designing a multi-account AWS environment with a centralized logging account. Which TWO services should be used to aggregate logs from all accounts?

A company is using AWS CodePipeline with an S3 source action. After a successful deployment, the latest commit ID is stored as an environment variable in the CodeBuild project. The team notices that subsequent pipeline executions are not triggering when new commits are pushed to the S3 bucket. What is the most likely cause?

A company is migrating a monolithic application to microservices on Amazon ECS. The application needs to communicate with external partners via HTTPS. The company wants to use mTLS for mutual authentication. Which AWS service should be used to handle the mTLS termination?

A company is migrating its on-premises NoSQL database (MongoDB) to Amazon DocumentDB. The migration must have minimal downtime. The company uses AWS DMS with ongoing replication. After starting the replication, the target DocumentDB cluster shows a lag of several minutes. The source MongoDB has high write throughput. What should the company do to reduce replication lag?

A company uses AWS Lambda to process events from an SQS queue. The Lambda function has a reserved concurrency of 5. During peak hours, messages are being backed up in the queue. The function's duration is well within the 15-minute limit. What is the fastest way to increase throughput?

A company wants to centralize management of IAM users and groups across multiple AWS accounts. The solution should allow users to access resources in any account without needing separate credentials. Which AWS service should be used?

A company has a multi-account AWS environment with a central security account. They want to enable Amazon GuardDuty in all accounts and centrally view findings. The security team has already enabled GuardDuty in the security account and invited all member accounts. However, the security account is not receiving findings from all member accounts. Upon investigation, some member accounts show that GuardDuty is not enabled, and some show that they have not accepted the invitation. The team needs a scalable solution to enable GuardDuty across all accounts and ensure findings are sent to the security account. What should the team do?

Drag and drop the steps to set up AWS CloudTrail for logging API activity in the correct order.

A company has a multi-account AWS environment and wants to enforce that all EC2 instances are launched with a specific AMI ID. The AMI ID is maintained by the security team in a central account. What is the MOST effective way to enforce this across all accounts?

A DevOps engineer notices that a CloudFormation stack update fails with the error: 'UPDATE_ROLLBACK_FAILED'. The stack is in a state where some resources were updated, but others failed to update. The engineer needs to fix the stack and complete the update. What should the engineer do FIRST?

A company uses AWS Organizations with a dedicated security account. They want to centralize the management of AWS Config rules and ensure that all accounts are compliant with the same set of rules. Which THREE steps should they take?

Refer to the exhibit. A solutions architect runs the AWS CLI command to check the state of an EC2 instance. The output shows the instance is running. However, the application team reports that the instance is unreachable over SSH. What is the MOST likely cause?

A company is designing a new application that will process streaming data from thousands of IoT devices. The data must be ingested in real time and then processed using Apache Flink. Which services should be used? (Choose TWO.)

A company is running a stateful web application on EC2 instances behind an ALB. Users report that when they refresh a page, they are logged out. What is the best solution to fix this issue?

Refer to the exhibit. An SCP is attached to an OU. A developer in an account under this OU tries to launch a t3.large EC2 instance. What will happen?

A company has multiple AWS accounts that are centrally managed using AWS Organizations. The security team requires that all API activity be logged and retained for 7 years. The logs must be stored in a central Amazon S3 bucket that is in the management account. Which solution meets these requirements with the least operational overhead?

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences intermittent timeouts when calling an external API. The ECS tasks are in a private subnet with a NAT gateway. How can the company improve the reliability of outbound traffic?

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences periodic spikes in traffic. The operations team wants to ensure that the application can handle the spikes without manual intervention. What is the MOST cost-effective solution?

Drag and drop the steps to deploy a serverless application using AWS SAM in the correct order.

A company is migrating a stateful application to AWS. The application maintains session state in memory on the application server. Which AWS service should be used to store session state for high availability?

A company is using AWS Elastic Beanstalk to deploy a web application. The application's performance degrades over time due to increasing database connections. The company wants to implement a solution that automatically scales the database tier based on connection count. Which action should be taken?

A solutions architect is troubleshooting an issue where an EC2 instance cannot connect to the internet. The output of the describe-instances CLI command is shown in the exhibit. The instance is in a VPC with a public subnet that has a route table with a default route pointing to an internet gateway. The security group allows outbound traffic to 0.0.0.0/0. What is the MOST likely cause of the problem?

Refer to the exhibit. A company has an IAM policy that allows s3:GetObject on all objects in 'my-bucket' but denies access to objects in the 'confidential' folder. A user tries to access 's3://my-bucket/confidential/report.pdf'. What will happen?

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to implement service discovery and load balancing at the application layer. Which TWO services should the company use?

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM users are created in member accounts. All access must be through federated roles. Which approach should they use?

A company is designing a new container-based application using Amazon EKS. The application requires persistent storage for stateful workloads, such as databases. The storage must be highly available and durable across multiple Availability Zones. Which storage solution should be used?

A company is designing a new application that requires a relational database with automated backups and multi-AZ redundancy. The database workload is predictable with occasional read replicas for reporting. Which AWS service should be used?

A company receives a Trusted Advisor recommendation to reduce costs by deleting unused Amazon EBS snapshots. The company has hundreds of snapshots. Which approach should the company use to identify and delete snapshots that are no longer needed?

A company has multiple AWS accounts that each have their own VPCs with overlapping CIDR ranges. They want to use AWS Transit Gateway to connect these VPCs to a central network account. However, overlapping CIDRs prevent attachment. What is the MOST scalable solution?

A company wants to implement a cost allocation strategy using tags across multiple accounts in AWS Organizations. Which TWO practices should be followed?

A company is building a new serverless application using AWS Lambda functions. The application processes images uploaded to an Amazon S3 bucket. Each image triggers a Lambda function that resizes the image and stores the result in another S3 bucket. The company expects a high volume of uploads, up to 10,000 images per minute. The current Lambda function is configured with a timeout of 5 minutes and 1024 MB of memory. During testing, the Lambda function times out for large images. What should the company do to ensure the function can process large images without timing out?

A company is migrating a legacy application that uses TCP on port 8080 to AWS. The application must be accessible from the internet. The company wants to use an Application Load Balancer. What must the company do to ensure the load balancer can accept traffic on port 8080?

A company is designing a multi-account AWS environment for different business units. They need to share a central Amazon RDS database with read replicas in each account for disaster recovery. What architecture minimizes cross-region data transfer costs while maintaining high availability?

A company is migrating an on-premises .NET application to AWS. The application uses a SQL Server database with a large number of stored procedures and triggers. The company wants to reduce licensing costs by moving to an open-source database. Which AWS service should the solutions architect use to automate the database conversion?

A company is designing a disaster recovery strategy for a production database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 1 hour. Which TWO solutions meet these requirements? (Choose two.)

A company is designing a new web application that will be deployed on Amazon ECS with Fargate. The application must scale based on the number of requests per container. The company wants to use a service that can automatically adjust the number of tasks based on a custom metric. Which solution should the company use?

A company is using AWS CodePipeline to automate deployments of a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy to an Auto Scaling group. Recently, deployments have been failing during the deploy stage with an error indicating that the target instances are not in a healthy state. The CodeDeploy agent logs show that the agent is running but the application validation scripts are failing. Which THREE actions should the solutions architect take to troubleshoot and resolve the issue?

A company is migrating a batch processing workload to AWS. The workload runs daily and processes large files. Which TWO AWS services are most suitable for this workload? (Choose TWO.)

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). During a recent deployment, users experienced errors. The team wants to automatically roll back the deployment if the error rate exceeds 5% within 10 minutes after deployment. Which solution meets these requirements with minimal operational overhead?

A company uses AWS Organizations with hundreds of accounts. The central IT team wants to manage IP address ranges for VPCs across all accounts using a custom AWS Resource Access Manager (RAM) resource share. They have created a resource share containing the IP address CIDR blocks (as managed prefix lists) and shared it with the organization. However, some accounts cannot see the shared prefix lists. What is the MOST likely cause?

Match each AWS networking concept to its definition.

A company is designing a new application that will use Amazon DynamoDB as its primary database. The application has two access patterns: one requires strongly consistent reads, and the other requires eventually consistent reads. The company wants to minimize costs while meeting the read consistency requirements. How should the company configure DynamoDB reads?

A company has a legacy application that runs on a single EC2 instance. The application writes logs to a local file. The company wants to centralize log management without modifying the application code. Which solution is MOST operationally efficient?

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared filesystem for storing user-uploaded documents. The company wants to decouple storage and compute, ensure high durability, and minimize operational overhead. Which AWS service should the company use to replace the shared filesystem?

A company runs a critical workload on EC2 instances in an Auto Scaling group across three Availability Zones. The application needs to maintain a consistent IP address for outbound traffic to external partners. The current design uses a NAT gateway in each AZ, but partners whitelist a single IP. How can the company provide a fixed outbound IP while maintaining high availability?

A company is designing a microservices architecture on ECS with Fargate. Services need to communicate securely within a VPC and be accessible from the internet via an Application Load Balancer. The solution must minimize operational overhead. Which networking configuration should be used?

A global company uses AWS Organizations with many OUs and accounts. The finance team needs to track costs by cost center, which is tagged on each resource. However, some resources are not tagged. Which solution will provide the MOST accurate cost allocation?

A retail company is migrating its e-commerce platform from a monolith running on a single on-premises server to AWS. The current application consists of a Java-based web server, a MySQL database, and a caching layer using Redis. The company wants to modernize the architecture by adopting microservices, using serverless where possible, and minimizing operational overhead. The migration must be completed within six months with minimal disruption to ongoing operations. The solutions architect proposes the following initial steps: containerize the Java application and run it on Amazon ECS with Fargate, migrate the MySQL database to Amazon Aurora Serverless v2, and replace Redis with Amazon ElastiCache for Redis Serverless. However, the team is concerned about the complexity of the migration and the potential for downtime. Which recommendation should the solutions architect make to address these concerns?

A company is designing a new microservices architecture on Amazon ECS with Fargate. Each microservice must be isolated and able to communicate with others only through defined APIs. Which solution provides the BEST isolation and security?

A company runs a batch processing application on a scheduled EC2 instance that starts every night. The instance processes a large number of files from an S3 bucket and writes results to another S3 bucket. The job takes approximately 6 hours to complete. Recently, the job has been failing after 4 hours with an error indicating that the instance's EBS root volume is full. The instance type is t3.medium with a 20 GB gp2 root volume. The application writes temporary files to the root volume. The company wants to fix this with minimal changes to the application and infrastructure. What should a solutions architect recommend?

A company is designing a new VPC with public and private subnets. The company wants to ensure that instances in the private subnets can download updates from the internet, but cannot be directly accessed from the internet. Which THREE components are required to meet these requirements? (Choose THREE.)

A company is designing a new web application that will be accessed by users worldwide. The application will serve static content (HTML, CSS, images) and dynamic API responses. The company wants to minimize latency for all users. Which combination of AWS services should the company use?

A company is migrating a legacy application that uses a proprietary binary protocol over TCP. The application must be migrated with minimal changes and requires high throughput. Which AWS service should the architect recommend for load balancing?

A company is designing a new real-time analytics platform that ingests data from thousands of IoT devices. The devices send JSON messages every second to an AWS IoT Core topic. The messages must be processed and stored in Amazon S3 for long-term analysis. The processing includes enrichment by calling a third-party API to add location data. The company expects the workload to vary significantly, with peak traffic of 100,000 messages per second. The solution must be cost-effective and minimize operational overhead. The current architecture uses a Lambda function subscribed to the IoT topic, which processes each message and writes to S3. However, during initial testing, the Lambda function frequently times out due to the third-party API latency, causing message loss. What should the company do to resolve this issue while meeting all requirements?

A CloudFormation stack creation command is run with a parameter. The template.yaml includes a parameter declared as follows: Parameters: InstanceTypeParameter: Type: String Default: t2.micro AllowedValues: - t2.micro - t2.small - t2.medium The stack creation fails with the error: "Value (t2.nano) for parameter InstanceTypeParameter is invalid. Must be one of: t2.micro, t2.small, t2.medium". What is the most likely cause?

A company wants to centrally manage access to multiple AWS accounts using AWS Organizations. The security team requires that all IAM users and roles be created in a single master account and assume roles in member accounts. Which configuration ensures that cross-account role assumptions are auditable and enforced?

A company wants to allow developers to launch EC2 instances only in the us-east-1 Region. They have a single AWS account. What is the simplest way to enforce this?

A company is designing a multi-account AWS Organizations architecture. Which TWO considerations should be taken into account when designing the organizational structure?

Refer to the exhibit. A company is using an S3 bucket to store migration logs. The company has set a lifecycle policy to transition objects to Glacier after 30 days and expire them after 365 days. After 45 days, the company notices that the objects are still in S3 Standard. What is the most likely reason?

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. The company also needs to ensure that any attempt to upload an unencrypted object is blocked. How can the company enforce this requirement?

A company is migrating a multi-tier web application to AWS. The application consists of a stateless web tier and a stateful application tier that uses sticky sessions. The company wants to reduce operational overhead and improve elasticity. Which architecture should the solutions architect recommend?

An S3 bucket contains log files. An administrator runs the above AWS CLI command. What does the output indicate?

A company is designing a containerized microservices architecture on Amazon ECS. The services must be able to discover each other using DNS names. Which AWS service should the company use for service discovery?

An IAM policy is attached to an S3 bucket to allow access only from a specific IP range. Users report that they can access the bucket from IP addresses outside the range. The bucket policy also includes another statement that denies access to all principals. What is the most likely reason users outside the IP range can still access the bucket?

A company uses AWS CloudFormation to deploy infrastructure. The company wants to ensure that if a stack update fails, the stack automatically rolls back to the last known good state. Which CloudFormation stack option should the company configure?

A company is migrating a legacy application from an on-premises data center to AWS. The application uses a proprietary network protocol that is not supported by AWS Application Migration Service. What should the company do to migrate this application?

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are launched in a public subnet. How should they configure network access?

A company runs a web application on EC2 instances behind an ALB. The application uses an Amazon Aurora MySQL database. The operations team notices that the database CPU utilization is consistently above 80% during business hours. The team needs to reduce database load without changing the application code. Which TWO actions should the team take? (Select TWO.)

A company is modernizing its monolithic Java application to a microservices architecture on AWS. The application uses a shared Oracle database. The team wants to implement an event-driven architecture. Which TWO AWS services should be used to decouple microservices and handle asynchronous communication?

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL database. Recently, the application has become slow during peak hours. The operations team notices that the database CPU utilization is high, but the number of connections is within limits. The application is read-heavy. The team wants to improve performance with minimal changes to the application code. The database is currently a single Aurora instance. Which solution should the team implement?

Refer to the exhibit. A CloudFormation template creates an S3 bucket with versioning and a public bucket policy. After deployment, users can access objects in the bucket via the internet. However, the security team requires that all access be logged. What is missing from this configuration?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and EC2 instance status checks. The team needs to identify the root cause of the latency. Which TWO actions should the team take to diagnose the issue? (Choose two.)

A company uses AWS Organizations and wants to delegate administration of a specific service to a member account. The service must be able to perform actions across all accounts in the organization. Which steps should the company take?

A company uses AWS Organizations with consolidated billing. The finance team needs to allocate costs to different departments based on resource tags. However, some resources are not tagged. What is the most effective solution?

A company is designing a new CI/CD pipeline for a containerized application using AWS CodePipeline. The application source code is stored in an Amazon S3 bucket. The pipeline must automatically build a Docker image from the source code and push it to Amazon ECR. Which action should be used as the build provider?

A company's security team wants to ensure that all S3 buckets are encrypted at rest. They have thousands of existing buckets. Which approach should a Solutions Architect use to identify noncompliant buckets?

A company needs to store configuration files for multiple environments (dev, test, prod) and retrieve them programmatically with versioning and access control. Which AWS service should be used?

A company wants to monitor CPU utilization of their EC2 instances and receive an alert when utilization exceeds 80% for 10 minutes. Which AWS service should be used?

A company is designing a new application that will run on Amazon ECS with Fargate. They need to store configuration data and secrets securely. Which services should they use? (Choose TWO.)

A company uses AWS Organizations with a single OU. The management account has a service control policy (SCP) that denies all actions on EC2 instances with a specific tag. However, users in a member account can still terminate tagged instances. What is the most likely cause?

A media company is designing a new video transcoding pipeline on AWS. Raw video files (up to 10 GB each) are uploaded by users to an S3 bucket. Each upload must be transcoded into multiple formats (MP4, WebM, HLS) and stored in another S3 bucket. The transcoding job can take up to 30 minutes per file. The company needs a solution that is cost-effective and can handle hundreds of concurrent uploads. The operations team wants to minimize maintenance. Which solution should a Solutions Architect recommend?

A company is migrating a large number of on-premises VMs to AWS. They need to assess the current environment and track migration progress. Which THREE AWS services should be used together?

A company has a multi-account AWS environment and uses AWS Organizations. The security team wants to automatically remediate non-compliant resources, such as S3 buckets that are publicly accessible. Which design should they implement?

A company uses Amazon DynamoDB as its primary database. The operations team is seeing increased read latency during peak hours. The table has a provisioned read capacity of 1000 RCU, but CloudWatch metrics show that consumed read capacity frequently reaches 1000 RCU. The application uses eventually consistent reads. What is the MOST cost-effective way to reduce read latency?

A company is moving a legacy application that uses a shared file system to AWS. The application requires POSIX-compliant file storage that can be accessed by multiple EC2 instances simultaneously. Which AWS storage service should they use?

A company is migrating a large-scale e-commerce platform to AWS. The platform uses a MySQL database with a 2 TB dataset. They want to modernize to Amazon Aurora MySQL with minimal downtime. Which THREE steps should they take? (Select THREE.)

Refer to the exhibit. An administrator runs this command and sees the output. Which statement about the accounts is correct?

A company has an Amazon RDS for PostgreSQL database that is experiencing high CPU utilization due to a large number of read queries. They need to offload read traffic and improve performance. Which TWO actions should they take? (Choose TWO.)

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

A company has a multi-account environment and wants to centralize logging for all AWS API calls. Which TWO services should they use together to achieve this?

A company is migrating a monolithic application to microservices on AWS. They have identified that some services require high-throughput, low-latency data sharing. Which AWS service should they use for this purpose?

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS for PostgreSQL database. The database credentials must be rotated automatically every 30 days. Which THREE steps should the company take to securely manage the credentials? (Choose three.)

A company is running a production web application on AWS Auto Scaling EC2 instances behind an Application Load Balancer. Recent deployments have caused intermittent errors. The team wants to implement a deployment strategy that minimizes downtime and allows for quick rollback. Which strategy should they use?

Refer to the exhibit. A company has an S3 bucket policy that allows GetObject access from two IP ranges (10.0.0.0/16 and 192.168.0.0/16). The policy also denies all S3 actions on the 'confidential/' prefix unless the request comes from the 10.0.0.0/16 range. Which of the following statements is true?

A company is migrating a legacy Citrix XenApp environment to AWS. The application requires Windows-based virtual desktops for 200 users. Users need to access the desktops from various devices, including thin clients and mobile devices. Which solution is most cost-effective and scalable?

A company is modernizing a monolithic application into microservices on Amazon ECS. They want to decouple services and improve resilience. Which AWS service should they use for asynchronous communication between microservices?

A company is designing a new application that will run on Amazon ECS with Fargate launch type. The application needs to store session state that is shared across multiple tasks. The session data must be highly available and low-latency. Which AWS service should be used to store the session state?

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. Which TWO actions are required?

A company uses AWS CloudFormation to manage infrastructure. They want to detect drift from the intended template configuration. Which service should they use?

Refer to the exhibit. A company applies this SCP to all accounts in an AWS Organization. What is the effect of this policy?

A company is designing a new application that must be highly available across multiple AWS Regions. The application will run on EC2 instances behind an Application Load Balancer. The company needs a DNS-based routing policy that routes users to the nearest healthy endpoint based on latency. Which Amazon Route 53 routing policy should be used?

A company is migrating a batch processing workload to AWS. The workload runs on a schedule and processes large files stored on a network file system. The company wants to use a serverless architecture to reduce costs. Which combination of AWS services should the company use?

A company is designing a global application that requires a highly available and low-latency API. The API will be consumed by clients across the world. The backend consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances in a single AWS Region. The company wants to improve performance for global users. Which solution meets these requirements with minimal operational overhead?

A financial services company needs to store sensitive customer data in Amazon S3 with encryption at rest. They require that the encryption keys be stored in AWS CloudHSM and that the S3 bucket must not be able to access the keys without explicit permission. Which S3 encryption option should they use?

A company wants to migrate its on-premises Active Directory to AWS Managed Microsoft AD to support Windows-based workloads on AWS. The company has a complex Active Directory structure with multiple domains, group policies, and trusts with external directories. Which migration approach should the company use?

A company is deploying a multi-tier web application on AWS. The application must be highly available across three Availability Zones. The web tier runs on EC2 instances behind an Application Load Balancer (ALB). The application tier runs on EC2 instances behind a Network Load Balancer (NLB). The database tier uses a Multi-AZ RDS instance. To reduce cross-AZ data transfer costs, which design should be implemented?

A company has a centralized logging solution using Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) in a central logging account. Application logs from hundreds of EC2 instances across multiple accounts are shipped to the OpenSearch cluster via Amazon Kinesis Data Firehose. The security team requires that all log data be encrypted at rest and in transit. The logging account has a KMS key used to encrypt the OpenSearch cluster and the Firehose delivery stream. Recently, the security team noticed that some log deliveries are failing with 'AccessDenied' errors. The CloudWatch Logs delivery to Firehose is configured correctly. What is the most likely cause of the failure?

A company runs a containerized application on Amazon ECS with Fargate. They want to improve the security of their container images without slowing down the CI/CD pipeline. Which THREE measures should they implement?

A company has a centralized logging account and multiple member accounts. The member accounts generate VPC Flow Logs that need to be sent to a central S3 bucket in the logging account. Which TWO steps must be taken to enable this cross-account delivery?

A company has an IAM policy attached to a user. The user is trying to download an object from the S3 bucket 'my-bucket' that was uploaded with SSE-S3 encryption. What will happen?

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by external partners. The company will use a Network Load Balancer (NLB) to distribute traffic to EC2 instances. Which TWO actions should the company take to provide static IP addresses for the partners to whitelist?

A company has a multi-account AWS environment. The security team wants to centrally manage VPC flow logs for all accounts. They already have a centralized logging account. What is the MOST scalable solution?

A financial services company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets in any account have server-side encryption enabled using AWS KMS (SSE-KMS) with a customer managed key. Additionally, they want to prevent any S3 bucket from being publicly accessible. What is the MOST efficient and comprehensive way to enforce these policies?

A company is planning to migrate 50 TB of data from on-premises to Amazon S3 over a 100 Mbps internet connection. The data is not time-sensitive and can tolerate some latency. Which migration method is MOST cost-effective and suitable?

A company is migrating a batch processing workload to AWS. The workload runs daily on a single on-premises server and takes 6 hours to complete. The company wants to reduce processing time and cost. Which approach should the solutions architect recommend?

A company is building a microservices architecture on Amazon ECS with Fargate. Each service must be isolated and communicate only via APIs. The company needs to enforce that services cannot directly access each other's databases. Which approach should be used?

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?

A company is migrating a data warehouse from on-premises to Amazon Redshift. The current workload runs complex queries that join large tables. The company wants to optimize query performance after migration. Which design should the company implement?

A company is migrating a monolithic application to AWS. They want to minimize changes to the application code while taking advantage of AWS managed services. Which migration strategy should they use?

A company manages multiple AWS accounts using AWS Organizations. They want to enforce that any EC2 instance launched with a public IP address must have a specific security group attached. What is the MOST effective way to enforce this?

A company runs a batch processing application on AWS. The application reads input files from an S3 bucket, processes them on EC2 instances, and writes results to another S3 bucket. The processing job runs once a day and takes approximately 3 hours. The company wants to reduce costs and operational overhead. The Solutions Architect suggests using AWS Lambda for processing, but the processing time per file can exceed the Lambda maximum execution time of 15 minutes. The architect also considers using AWS Batch. The company wants to minimize the need for infrastructure management. Which solution should the Solutions Architect recommend?

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS database. Which THREE steps are required to secure the database access? (Choose THREE.)

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared file system mounted on each instance. The company wants to minimize downtime during deployments. What should they use?

A company has an AWS Lambda function that processes files uploaded to an S3 bucket. The Lambda function has been running successfully for months. Recently, the company updated the Lambda function code and started seeing occasional throttling errors (HTTP 429) from the Lambda service. The function's reserved concurrency is set to 100. The company is unsure why throttling is occurring only after the code update. What is the MOST likely cause?

A company is hosting a static website on Amazon S3. The website uses JavaScript to make API calls to a backend API hosted on Amazon API Gateway. The company wants to reduce latency for users worldwide. Which combination of AWS services should the solutions architect use? (Choose two.)

Refer to the exhibit. A company is migrating an application to AWS and has attached the IAM policy shown to an IAM role. The application runs on an EC2 instance and needs to upload files to an S3 bucket. However, the uploads are failing with an access denied error. What is the most likely cause?

A company has a multi-account AWS environment with over 500 accounts managed through AWS Organizations. The accounts are organized into OUs by business unit. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled (SSE-S3 or SSE-KMS). They also want to automatically remediate any existing non-compliant buckets and prevent creation of new non-compliant buckets. Currently, there is no centralized logging or monitoring. The team has tried using AWS Config rules with auto-remediation, but they found that Config rules are not triggered for buckets created before the rule was enabled, and some teams are creating buckets via AWS CloudFormation that bypass the Config rule evaluation. The team needs a solution that covers all buckets, regardless of creation method or time. What should the team do?

A company is migrating a legacy application to AWS. The application runs on a single Windows Server instance and uses a local MySQL database. The company wants to minimize changes to the application code. Which migration strategy should the company use?

A company uses AWS CodePipeline to deploy a web application. They want to automatically roll back the deployment if the new version fails CloudWatch alarm-based health checks. Which feature should they use?

A company is designing a new web application that will serve static content (HTML, CSS, JS, images) to users globally. The application must have low latency and high availability. Content changes infrequently, but when updated, the changes must be reflected immediately. Which solution should the architect recommend?

A company is designing a new application that will store sensitive user data in Amazon S3. The data must be encrypted at rest and in transit. The solution must use AWS managed keys and must be compliant with PCI DSS. Which combination of encryption options should be used?

A company has multiple AWS accounts. They want to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should be taken to enforce this across all accounts?

A company is migrating a multi-tier web application to AWS. The application consists of a web tier, an application tier, and a database tier. The company wants to use AWS services to improve scalability and reduce management overhead. The web and application tiers run on Linux. The database is Oracle running on Linux. Which solution meets these requirements with the LEAST operational overhead?

A company wants to implement a centralized logging solution for all AWS accounts in AWS Organizations. The logs include CloudTrail, VPC Flow Logs, and AWS Config configuration items. Which approach provides the MOST scalable and cost-effective solution?

A company has an S3 bucket that stores critical data. They need to ensure that all objects are encrypted at rest. The bucket policy currently denies uploads if the x-amz-server-side-encryption header is not set to AES256. However, some objects are still stored with SSE-KMS. How can the company enforce SSE-S3 exclusively?

A company is designing a new application that requires a relational database. The application has variable traffic, with high spikes during business hours and low traffic at night. The company wants to minimize costs while ensuring the database can handle the spikes. Which solution should the architect recommend?

A company wants to implement AWS Organizations with multiple OUs to isolate development, testing, and production workloads. The company needs to ensure that production workloads are not impacted by changes in other OUs. Which TWO practices should the company follow? (Choose two.)

A company is building a serverless data processing pipeline using AWS Lambda, Amazon DynamoDB, and Amazon S3. The pipeline processes JSON files uploaded to an S3 bucket, transforms the data, and writes results to DynamoDB. The company wants to ensure the pipeline can handle bursts of traffic without data loss. Which TWO design decisions should the solutions architect make?

A company is using Amazon S3 to store critical data and needs to ensure that objects are automatically deleted after 30 days. The current lifecycle policy is configured to expire objects after 30 days, but objects are not being deleted. What is the most likely cause?

A company is migrating a web application to AWS. They want to use the same domain name for both the development and production environments, but route traffic based on the source IP address. Which AWS service can accomplish this?

An SCP is attached to a production OU. An IAM user in a member account under that OU attempts to launch an m5.large EC2 instance. What happens?

A company uses Amazon S3 to store critical data. They need to ensure that data is encrypted at rest. Which TWO methods can achieve this?

A CloudFormation stack update failed with the above error. What is the likely cause?

A company is designing a new application that will use Amazon S3 to store user-uploaded images. The application must enforce that all uploads are encrypted in transit and at rest. Additionally, the bucket must be configured to block all public access. Which TWO actions should be taken to meet these requirements?

A company is migrating a legacy Windows-based .NET application to AWS. The application uses a SQL Server database and a proprietary authentication mechanism that relies on Active Directory. The company wants to reduce operational overhead and licensing costs. Which combination of AWS services should the architect recommend for the migration?

A company is using AWS Organizations and wants to allow only specific AWS services to be used in member accounts. The security team needs to block the use of Amazon EC2 and Amazon RDS, but allow all other services. Which SCP configuration should be used?

A company is modernizing its application by migrating from a monolithic architecture to microservices on Amazon ECS Fargate. The application uses an on-premises Oracle database, which is being migrated to Amazon Aurora PostgreSQL as part of the modernization. The team has refactored the application into several microservices, each with its own database schema in the same Aurora cluster. During load testing, the team notices that one microservice's heavy write operations cause increased latency for other microservices' read queries. The Aurora cluster uses a single writer and multiple readers. The team needs to isolate the write-heavy microservice without changing the application code. What should the solutions architect do?

A company is designing a multi-region disaster recovery solution for a critical application. The application uses Amazon RDS for MySQL with Multi-AZ in the primary region. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 1 minute. Which solution meets these requirements?

A company has a management account and several member accounts in AWS Organizations. They want to allow a developer in a member account to create an organization trail. What should they do?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle millions of requests per day. To reduce latency and offload traffic from the EC2 instances, which AWS service should be placed in front of the load balancer?

A global company with 50 AWS accounts uses AWS Organizations and wants to centralize CloudTrail logs. The security team requires that all accounts send their CloudTrail logs to a central S3 bucket in the audit account. Which combination of steps will ensure this?

An organization is modernizing a legacy application by breaking it into microservices on AWS. The application processes customer orders and sends notifications. The team wants to decouple the order processing from the notification service to improve scalability. Which AWS service should they use to asynchronously pass messages between the services?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences high request latency during peak traffic. A solutions architect discovers that the ALB is not distributing traffic evenly across the instances. The instances have different sizes (t3.large and t3.xlarge). Which TWO actions should the solutions architect take to improve load distribution?

A healthcare company is storing sensitive patient data in Amazon S3. The compliance team requires that all data be encrypted at rest and that the encryption keys be rotated every 90 days. Additionally, the company must maintain an audit trail of all key usage. Which solution meets these requirements with the LEAST operational overhead?

A company has multiple AWS accounts managed via AWS Control Tower. The DevOps team wants to deploy a shared CI/CD pipeline that can deploy applications across all accounts. The pipeline must use the same source repository and artifact store. What is the MOST secure and scalable approach?

A company is migrating a legacy application that uses a proprietary binary protocol over TCP. They want to modernize to a containerized microservices architecture on Amazon EKS. The protocol must be preserved for backward compatibility. Which approach should they take?

A company is migrating a large number of on-premises virtual machines to AWS. The company wants to automate the migration process and reduce manual effort. Which TWO AWS services can be used together to achieve this goal? (Choose TWO.)

A company is using AWS Organizations and wants to centralize the management of Amazon EC2 instance security groups. The security team needs to enforce that certain ports are not open to the internet across all accounts. The company currently uses AWS Firewall Manager. Which approach should the security team use to enforce this policy?

A company is designing a new application that will use Amazon S3 to store sensitive customer data. The data must be encrypted at rest and in transit. The company also needs to ensure that only authorized users can access the data. Which three steps should the company take? (Choose THREE.)

A company is modernizing its infrastructure by moving from EC2 instances to a serverless architecture using AWS Lambda. The application processes images uploaded to Amazon S3. The current EC2-based solution uses a third-party image processing library that is not supported in Lambda's runtime environment. What is the best approach to migrate to serverless while using the same library?

A company's IT team uses AWS CloudFormation to deploy infrastructure. They want to enforce tagging standards across all stacks. Which approach should they use?

A company is migrating a monolithic application to AWS and wants to adopt a microservices architecture. The application currently runs on a single server and uses a shared MySQL database. Which AWS service can help the company decouple the microservices and enable asynchronous communication?

Refer to the exhibit. A solutions architect runs the AWS CLI command and receives the output shown. The instance was stopped 2 hours ago. The company wants to minimize costs. What should the architect do next?

A company has a monolithic application running on a single EC2 instance. The application experiences performance issues during peak hours. The company decides to migrate to a microservices architecture using AWS Lambda and Amazon API Gateway. The migration must be done incrementally without downtime. What strategy should the company use?

A company wants to centralize access control for multiple AWS accounts using AWS Organizations. They need to allow developers in a specific account to launch EC2 instances only in certain regions. What is the most scalable solution?

A company uses AWS Organizations and wants to centrally manage backups for EC2 instances across multiple accounts. They want to create a backup plan that backs up all EC2 instances tagged with Backup=Weekly. The backup must be stored in a central backup vault in the management account. Which solution meets these requirements?

A company is running a batch processing job on an EC2 instance that processes data from an S3 bucket and writes results to another S3 bucket. The job runs once per hour and takes about 20 minutes. The company wants to optimize costs by only paying for compute time when the job is running. Which solution is MOST cost-effective?

A company uses AWS Control Tower to manage a multi-account environment. They want to ensure that all accounts are enrolled in AWS Shield Advanced for DDoS protection. What is the MOST efficient way to achieve this?

A company is designing a highly available application on AWS that uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application requires that the client's IP address be preserved in the application logs. The company also needs to perform SSL termination at the load balancer. How should the company configure the ALB to meet these requirements?

A company runs a critical application on Amazon ECS with Fargate launch type. The application needs to be highly available across multiple Availability Zones. The company wants to implement blue/green deployments to minimize downtime. Which THREE steps should the solutions architect take?

A company is designing a new database solution for a global e-commerce application. The database must support high read and write throughput with single-digit millisecond latency. The company expects traffic spikes during peak hours. Which TWO AWS services should the company consider?

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single Windows Server with IIS and SQL Server. The company wants to adopt a microservices architecture on AWS using containers. The development team has containerized the application into several Docker containers. The company needs a solution that minimizes operational overhead for managing the container orchestration and scaling, and also integrates with AWS services like IAM, CloudWatch, and VPC. Which AWS service should the company use to run the containers?

A company has a monolithic application running on a single Amazon EC2 instance. The application stores data on an instance store volume. The company wants to improve availability and disaster recovery with minimal architectural changes. What is the MOST cost-effective solution?

A company is migrating a critical application to AWS and needs to ensure that the migration has minimal downtime. The application uses a SQL Server database. The company wants to use AWS Database Migration Service (DMS) for the migration. What should the company do to minimize downtime during the database migration?

A company is migrating a large-scale .NET application to AWS. The application uses Windows authentication and requires Active Directory integration. The company wants to reduce operational overhead. Which migration approach should they use?

A company is designing a new application that will store sensitive data in Amazon S3. The data must be encrypted at rest using a key that is rotated every 90 days. The company wants to use AWS managed services to minimize operational overhead. Which encryption solution should they choose?

A company is migrating a legacy .NET application to AWS. The application uses Windows authentication and connects to an on-premises SQL Server database. The company wants to minimize code changes. Which migration strategy is most appropriate?

A company uses Amazon RDS for MySQL with Multi-AZ deployment. They notice that during a failover, the application experiences a brief outage but then recovers. They want to minimize the failover time. Which action will most effectively reduce the failover time?

A company is using AWS CloudFormation to manage infrastructure. The security team requires that all CloudFormation stacks include a specific tag (CostCenter). The company wants to enforce this tag automatically. Which method should be used to enforce the tag?

A Solutions Architect runs the AWS CLI command shown in the exhibit. Which statement accurately describes the output?

A company has multiple AWS accounts managed through AWS Organizations. The security team requires that all VPC flow logs be enabled in every account and region. What is the MOST efficient way to enforce this requirement?

A company is using Amazon DynamoDB as the primary database for a web application. The application experiences occasional throttling on writes. The company wants to implement a solution that automatically increases write capacity during traffic spikes. Which solution should they use?

A company is migrating a legacy application to Amazon ECS. The application has a stateful component that stores data on the local filesystem. Which TWO storage options can be used to persist data beyond the lifecycle of the container?

An e-commerce company runs a customer-facing application on AWS. The application architecture includes an Application Load Balancer (ALB), EC2 instances in an Auto Scaling group, and an Amazon RDS for MySQL Multi-AZ DB instance. The application uses a custom web server that stores session data in a local file system. During peak traffic, users experience session timeouts and errors. The operations team observes that the Auto Scaling group launches new instances and terminates old ones frequently. The team wants to improve the user experience and ensure session persistence. The Solutions Architect proposes to modify the application to store session data in an external store. However, due to a legacy code dependency, the application cannot be modified in the short term. Which solution should the Solutions Architect implement to resolve the session persistence issue without modifying the application?

A company is using AWS Organizations with a centralized logging account. They want to collect VPC Flow Logs from all member accounts into a single S3 bucket in the logging account. Which TWO steps are required to achieve this?

An e-commerce company runs its application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL DB cluster with one writer and two reader instances. During a sales event, the database CPU utilization is high, and read replicas show high replica lag. The company needs to improve the read scalability and reduce replica lag. Which THREE actions should the company take? (Choose THREE.)

A company is using AWS CodePipeline to automate deployments. The pipeline includes a build stage that compiles code and runs tests. The build stage fails intermittently due to network timeouts when downloading dependencies. Which THREE actions could improve the reliability of the build stage?

A company is deploying a serverless application using AWS Lambda. The application processes high-resolution images and stores them in Amazon S3. The processing time for each image is variable, but some images require more than 15 minutes to process. Lambda has a maximum execution time of 15 minutes. How can the company process these long-running image transformations?

A company is migrating a legacy on-premises application to AWS. The application currently runs on a Windows Server with a SQL Server database. The company wants to minimize changes to the application code. Which migration strategy should the company use?

A company is designing a new solution to ingest real-time clickstream data from a website. The data volume varies from 100 to 100,000 events per second. The solution must buffer the data for up to 5 minutes and then deliver it to Amazon S3 for analysis. The company wants to minimize operational overhead and cost. Which service should be used to buffer the data?

A company is building a serverless application using AWS Lambda and Amazon API Gateway. They need to authenticate users. Which TWO services can be used for authentication?

A solutions architect deployed the above CloudFormation template. However, the Lambda function is not triggered when objects are uploaded to the S3 bucket. What is the most likely cause?

A company has a complex AWS environment with hundreds of accounts. They want to implement a tagging strategy that allows them to track costs by department and project. The tags must be propagated from resources to cost reports automatically. Which approach meets these requirements with minimal ongoing maintenance?

A company uses AWS CodePipeline to deploy a serverless application. They want to automatically test the deployment in a staging environment before promoting to production. Which THREE actions should they include in their pipeline? (Choose THREE.)

A company uses a central IT team to manage multiple AWS accounts. The team wants to provide developers with the ability to launch EC2 instances but restrict them to using only specific instance types. How should this be enforced?

A company is migrating a legacy application to AWS. The application requires a static IP address that can be used for whitelisting by third-party partners. The application will be deployed in multiple Availability Zones for high availability. The company wants to use a load balancer to distribute traffic. The solution must provide a single static IP address that does not change even if the underlying instances are replaced. Which combination of services should the company use?

A company is using AWS Organizations with a single OU for all production accounts. The security team wants to restrict the use of specific instance types across all accounts in the OU. They create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not in the allowed list. However, some accounts still launch disallowed instance types. What is the most likely cause?

A company is migrating a large-scale Hadoop cluster to Amazon EMR. The migration plan includes moving data from HDFS to Amazon S3. The company wants to minimize costs and ensure data durability. Which approach should the company use?

A company has a multi-account AWS organization with hundreds of accounts. The security team wants to ensure that all accounts have AWS Config enabled with a specific set of rules. They also want to automatically remediate non-compliant resources. Which solution is MOST scalable and operationally efficient?

A company is designing a new application that will store and retrieve large files (up to 5 TB). The files must be accessible via HTTPS and must be durable. Which AWS storage service should be used?

A company is using an AWS Lambda function to process files uploaded to an S3 bucket. The function is written in Python and uses the boto3 library to read the files. Recently, some files have been processed multiple times. Which TWO measures should a solutions architect implement to ensure idempotent processing?

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. Which AWS service should be used for the migration?

A company is designing a disaster recovery solution for a critical application running on EC2 with data in an Amazon RDS MySQL Multi-AZ DB instance. The recovery time objective (RTO) is 15 minutes and recovery point objective (RPO) is 1 hour. Which strategy meets these requirements?

A solutions architect applies the IAM policy shown in the exhibit to an IAM user. The user attempts to upload an object to the S3 bucket 'my-bucket' without specifying the 'x-amz-server-side-encryption' header. What will happen?

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application is deployed across multiple Availability Zones. The team notices that during a recent traffic spike, some instances were terminated and replaced, causing a temporary drop in performance. How can the team improve the resilience of the application?

A company is designing a new application that will be deployed on AWS. The application requires a relational database with automatic failover and high availability within a single AWS region. Which database deployment option meets these requirements?

A company uses AWS Lambda to process events from an Amazon SQS queue. The Lambda function is invoked with a batch size of 10. Recently, the function started failing with timeout errors when processing large batches. Which solution would improve the reliability of event processing without losing messages?

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. The platform must process and store high-velocity data with low latency. Which TWO AWS services should be used together to meet these requirements? (Choose TWO.)

Refer to the exhibit. A solutions architect is designing a new application that requires three EC2 instances running in different Availability Zones in us-east-1. The architect runs the AWS CLI command shown and sees three instances running in three AZs. However, the application is not highly available because if one AZ fails, the application loses one-third of its capacity. The architect needs to ensure that the application can survive the loss of an entire AZ without manual intervention. What should the architect do?

A company wants to provide temporary access to an S3 bucket for external partners. The access must be time-limited and restricted to specific objects. Which AWS service or feature should they use?

A company is migrating a legacy on-premises application to AWS. The application uses a proprietary database that runs on a single Windows server. The company wants to minimize downtime and avoid re-architecting the database. Which migration strategy should the solutions architect recommend?

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other using REST APIs. The company wants to implement a service mesh to handle traffic routing, observability, and security. Which AWS service should the company use?

A company is migrating a stateful application to AWS. The application uses local storage for temporary data that must survive instance restarts but not region failures. Which storage solution should the company use?

Which THREE factors should be considered when designing a global application that requires low-latency access to static content and dynamic API responses?

A company is migrating a mission-critical application to AWS. The application requires a fixed IP address for whitelisting by external partners. The company plans to use an Application Load Balancer (ALB) to distribute traffic. However, ALB does not support static IP addresses. How can the company meet the requirement for static IP addresses while using the ALB?

A company has a fleet of EC2 instances that process data from an SQS queue. The instances are part of an Auto Scaling group. The team notices that the queue depth is growing, but the Auto Scaling group is not scaling out quickly enough. Which THREE actions should the team take to improve the scaling responsiveness? (Choose three.)

A company is designing a serverless data processing pipeline that uses AWS Lambda to process messages from Amazon SQS. Each message requires 5 minutes of processing time. The company expects a steady state of 1,000 messages per second. What is the MOST scalable and cost-effective design?

A company has an Amazon S3 bucket that stores sensitive data. They want to ensure that all objects in the bucket are encrypted at rest. What should they do?

A financial services company is designing a new system on AWS to process real-time stock trades. The system must handle up to 10,000 trades per second with end-to-end latency under 500 milliseconds. Trades are ingested via REST API, validated, enriched with market data, and stored in a database for regulatory compliance. The architecture must be highly available across three Availability Zones. The company wants to use AWS managed services to minimize operational overhead. Which solution should a Solutions Architect recommend?

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS Fargate. The pipeline includes stages for source, build, and deploy. The deploy stage uses an ECS service with a blue/green deployment configuration. After a recent update, the deployment fails with the error: 'The service cannot be deployed because the target group is not in a healthy state.' The target group health checks are configured with path '/health', interval 30 seconds, unhealthy threshold 2. The application health endpoint returns 200 OK. What should the company do to resolve this issue?

A company is designing a hybrid cloud solution that extends its on-premises data center to AWS. The company has a 10 Gbps AWS Direct Connect connection and needs to securely connect multiple VPCs and on-premises networks with transitive routing. The solution must be highly available and use AWS managed services. Which TWO components should the company include in the design? (Choose TWO.)

A company is migrating a stateful application that uses local disks for caching to AWS. The application requires high-performance, low-latency storage that can be attached to a single EC2 instance. Which THREE AWS services or features should the company consider for the cache storage?

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application experiences sudden traffic spikes. What is the most effective way to ensure the application can handle the spikes without manual intervention?

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by department. Each department has its own AWS account. Which feature should be used to map costs to departments?

Refer to the exhibit. A company creates this CloudFormation stack. After 30 days, what happens to objects with the prefix 'logs/'?

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. The company currently uses server-side encryption with S3 managed keys (SSE-S3). The team wants to enforce encryption using a customer-managed key (CMK) from AWS KMS. Which TWO actions should the team take?

A company uses Amazon S3 to store sensitive data. The security team requires that all objects be encrypted at rest. The company currently uses server-side encryption with S3-managed keys (SSE-S3). The security team wants to ensure that only authorized users can access the decryption keys. What should the company do?

A social media startup uses AWS Lambda functions to process user-uploaded images. The Lambda function resizes images and stores them in Amazon S3. The function uses the S3 SDK to put objects. Recently, the team noticed that the function sometimes fails with 'Timeout' errors for large images. The Lambda function has a timeout of 5 seconds and 256 MB of memory. The team wants to improve the solution to handle larger images reliably and cost-effectively. Which solution should the team implement?

Refer to the exhibit. This bucket policy is applied to a central logging bucket in account 111111111111. Account 222222222222 wants to deliver CloudTrail logs to this bucket. However, log delivery fails. What is the MOST likely cause?

A company is migrating a legacy application to AWS using the rehost (lift-and-shift) strategy. The application uses a proprietary database that is not supported by Amazon RDS. The company wants to automate the migration of multiple servers and minimize downtime. Which AWS service should be used to automate the server migration?

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to specific S3 buckets are encrypted at rest. Which TWO actions should they take? (Choose 2)

A company is designing a new application that will process sensitive financial transactions. The application must be deployed in a VPC with no public internet access. The application needs to send logs to Amazon CloudWatch Logs and store files in Amazon S3. Which set of actions should be taken to meet these requirements without allowing internet access?

A company is migrating its on-premises data center to AWS. The company has over 200 applications, each with varying dependencies. The migration team wants to use AWS Migration Hub to track the migration progress. Which approach should the team take to ensure successful tracking and minimize manual effort?

A company runs a real-time analytics platform on Amazon Kinesis Data Streams with multiple consumers. The stream is provisioned with 10 shards. One consumer is falling behind, causing data latency. The consumer reads data using the Kinesis Client Library (KCL). Which action will improve the consumer's processing throughput?

A company is designing a cross-account backup strategy using AWS Backup. They have a central backup account that needs to manage backups for multiple member accounts. What is the minimal set of permissions required?

A company is migrating a critical application to AWS. The application requires a relational database with high availability and automated failover. The company wants to use a fully managed database service. Which AWS service should the architect choose?

A multinational company operates a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all Amazon S3 buckets are encrypted at rest using AWS KMS customer managed keys (CMKs) and that no bucket policies allow anonymous access. What is the MOST efficient way to achieve this across all accounts?

A company uses Amazon RDS for MySQL with Multi-AZ. The operations team notices that during a failover, the application experiences errors for about 2 minutes. The application uses a JDBC connection pool. Which solution should the team implement to reduce the failover impact?

A startup is building a serverless application using AWS Lambda. They need to securely store and retrieve database credentials without hardcoding them in the function code. Which AWS service should they use?

A company is migrating a legacy application that uses a third-party identity provider (IdP) for authentication. The application currently uses SAML 2.0. The company wants to use AWS IAM Identity Center for centralized access management. What is the best approach to integrate the IdP with AWS?

A company is designing a new serverless data processing pipeline. The pipeline uses AWS Lambda to process records from an Amazon Kinesis Data Stream. The company wants to ensure that failed records are automatically retried and sent to a dead-letter queue after three failed attempts. Which configuration should the company use?

A large e-commerce company uses a multi-account AWS Organizations setup with a central logging account. The company has enabled AWS CloudTrail in all accounts and configured it to deliver logs to a centralized Amazon S3 bucket in the logging account. Recently, the security team noticed that some log files are missing for a period of 2 hours. The CloudTrail console shows that trails are still enabled and delivering to the bucket, but no new log files were created during that time. The team verified that there were API calls made during that period. Which action is most likely to resolve the issue and prevent recurrence?

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files across any account. What is the most effective way to enforce this?

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences a sudden spike in traffic. The operations team notices that the Auto Scaling group is not scaling out quickly enough. Which TWO actions should the team take to improve the scaling responsiveness?

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. Recently, some requests are returning 401 Unauthorized errors even though the tokens are valid. The Lambda authorizer logs show that the function is invoked and returns an IAM policy. What is the MOST likely cause?

A company is using Amazon ECS with Fargate launch type for a microservices application. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization but no obvious pattern. What should the company do to identify the cause?

A company is migrating a large-scale e-commerce platform from on-premises to AWS. The migration plan includes rehosting the application servers and replatforming the database to Amazon Aurora. The company needs to ensure minimal downtime during the cutover. Which strategy should the company use for the database migration?

A company has an IAM policy attached to a user as shown in the exhibit. The user is trying to stop an EC2 instance in the us-west-2 region. What will happen?

A company is designing a new microservices architecture on AWS. They need a solution for service discovery that allows services to register themselves and discover other services dynamically. The solution must be highly available and integrated with AWS-native services. Which AWS service should they use?

A company is migrating a critical application to AWS and needs to ensure business continuity. The application must be able to fail over to a different AWS Region with a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. Which strategy should the company use?

A company is migrating a legacy on-premises .NET application to AWS. The application uses Windows Authentication and relies on Active Directory. The company wants to minimize code changes. Which solution should the architect recommend?

A company wants to store application logs in a centralized location for analysis. The logs are generated by EC2 instances in an Auto Scaling group. The solution must be cost-effective and support real-time analysis. Which service should be used to collect and analyze the logs?

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all new member accounts automatically have a specific AWS Config rule enabled. Which solution should be used?

A company is designing a new application that will run on Amazon EC2 instances. The application writes logs to local disk, and the logs must be aggregated centrally for analysis. The company wants a solution that requires minimal configuration and can handle high log volume. Which TWO AWS services should the company use?

A company is migrating a large .NET application to AWS. The application uses Windows authentication and integrates with Active Directory. The company wants to minimize operational overhead for the directory service. The on-premises Active Directory is already synchronized to AWS using AWS Directory Service for Microsoft Active Directory. During migration, the application fails to authenticate users. The security team confirms that the on-premises AD and AWS Managed AD are in sync. The application is running on EC2 instances that are joined to the AWS Managed AD domain. The application logs show authentication errors. What is the most likely cause of the authentication failure?

A company uses AWS Organizations to manage multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest. Currently, some buckets are not encrypted. Which THREE steps should the team take to enforce encryption? (Select THREE.)

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application consists of a frontend service and a backend service. The backend service is CPU-intensive and experiences high load during business hours. The operations team observes that the frontend service sometimes returns 503 errors during peak load. The team has already configured an ECS service auto scaling policy for the backend service based on average CPU utilization with a target value of 70%. The backend service is currently running 4 tasks, and the frontend is running 2 tasks. The errors seem to correlate with the backend scaling up. Which solution should the team implement to improve the application's performance and reduce errors?

A company has multiple AWS accounts managed under AWS Organizations. The security team wants to enforce that all new S3 buckets created in any account are automatically tagged with the cost center and environment (e.g., dev, prod). Which solution should the team implement?

A migration engineer is using AWS Application Migration Service (MGN) to migrate a Windows server from on-premises. The engineer runs the command above and sees the source server is in the "READY_FOR_TEST" state. What should the engineer do next?

A company is designing a new application on AWS that requires a relational database with read replicas across multiple AWS Regions. The database must have automated failover and a recovery point objective (RPO) of less than 5 seconds. Which database solution should the company choose?

A company is using AWS CodePipeline to automate deployments of a web application. The deployment to an Amazon ECS cluster often fails during the 'Deploy' stage due to insufficient capacity in the target group. The operations team wants to improve the pipeline to automatically handle such failures without manual intervention. Which solution is MOST operationally efficient?

An ALB is configured with a target group for HTTP:80. The health check returns a 302 redirect. What is the most likely cause of the unhealthy instances?

A retail company is migrating its on-premises e-commerce application to AWS. The application currently runs on a single server with a MySQL database. The company wants to minimize operational overhead and improve scalability. Which migration strategy should be used?

Refer to the exhibit. A solutions architect has attached this IAM policy to an IAM role used by an application. The application is trying to upload an object to the S3 bucket example-bucket with server-side encryption using AWS KMS (SSE-KMS). What will happen?

A company runs a stateful application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume attached to each instance. The company wants to implement a patching strategy that minimizes downtime and preserves data. What should a solutions architect do?

A company is migrating a monolithic e-commerce application to AWS. The application currently runs on a single on-premises server running Windows Server and SQL Server. The company wants to minimize re-architecting effort and time to migrate. Which migration strategy should the company use?

A company uses AWS Organizations and wants to allow a development account to assume a role in the production account for deployment purposes. Which component is necessary for this cross-account access?

A company is using the 7 Rs strategy to migrate a monolithic application to AWS. They want to move the application to the cloud without modifying the code but plan to later refactor parts of it. Which migration strategy should they choose initially?

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and the company has a 1 Gbps AWS Direct Connect connection. They need to minimize downtime. Which approach should the solutions architect recommend?

A company is migrating a 5 TB Microsoft SQL Server database to Amazon RDS for SQL Server. The migration must have minimal downtime. The team uses AWS DMS with ongoing replication. During the full load, the task fails with an error indicating that the source server's transaction log is full. What should the team do to resolve this issue?

A company is running a web application on EC2 instances in an Auto Scaling group behind an ALB. The application uses an Amazon RDS for MySQL database. Recently, the application has become slow, and the operations team identifies that the database is the bottleneck due to a high number of read queries. Which TWO actions should a solutions architect take to improve read performance? (Choose two.)

A company is designing a disaster recovery solution for a web application hosted on AWS. The primary site is in us-east-1 and the DR site is in us-west-2. The application uses an Amazon RDS for MySQL database. They need to recover the database with a Recovery Point Objective (RPO) of 5 seconds and a Recovery Time Objective (RTO) of 1 hour. Which solution meets these requirements?

A company runs a static website on Amazon S3 with a custom domain using Amazon Route 53. The website content is updated frequently by multiple developers. The company wants to implement a workflow where updates are automatically tested and deployed. They have existing CI/CD tools that integrate with AWS CodeCommit. The Solutions Architect needs to design a deployment pipeline that rebuilds the website only when changes are pushed to the main branch, and then invalidates the Amazon CloudFront cache if a CloudFront distribution is used. Which solution meets these requirements with the least operational overhead?

A company is migrating a legacy monolithic application to AWS. The application has tightly coupled components and high latency between them. The company wants to modernize the application into a microservices architecture. Which migration strategy should the company use?

A financial services company is designing a multi-tier application that must achieve a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes for a database tier. The application uses Amazon RDS for MySQL with Multi-AZ deployment. Which disaster recovery strategy meets these requirements at the LOWEST cost?

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

Refer to the exhibit. An IAM role trust policy is shown. A user from account 123456789012 tries to assume this role but receives an 'AccessDenied' error. The user has MFA enabled and is passing the MFA token. What is the MOST likely reason for the failure?

A Solutions Architect runs the following command for an EC2 instance that is part of an Auto Scaling group. The instance is in a private subnet and should only receive traffic from an Application Load Balancer. However, the instance is accessible from the internet. ``` $ aws ec2 describe-instances --instance-id i-0abcd1234efgh5678 { "Reservations": [ { "Instances": [ { "InstanceId": "i-0abcd1234efgh5678", "SecurityGroups": [ { "GroupName": "sg-web-app", "GroupId": "sg-0123456789abcdef0" } ], "PublicIpAddress": null, "SubnetId": "subnet-12345678", "VpcId": "vpc-23456789" } ] } ] } ``` Based on the output, what is the most likely reason?

A company has an S3 bucket that stores sensitive data. The company wants to ensure that all objects uploaded to the bucket are encrypted at rest. Which solution should the solutions architect recommend?

A company is using AWS CloudFormation to manage infrastructure. They want to ensure that any changes to a production stack are reviewed and approved before being applied. What is the BEST way to achieve this?

A DevOps engineer notices that an EC2 instance's CPU utilization is consistently above 90%. They need to optimize costs without affecting performance. What should they do?

Refer to the exhibit. A company has a trust policy on an IAM role in account 222222222222. The trust policy allows the root user of account 111111111111 to assume the role. However, a user in account 111111111111 is unable to assume the role. What is the most likely cause?

A company is designing a new solution to store and analyze log files from multiple sources. The solution must provide near real-time analytics and the ability to query the logs using SQL. Which TWO AWS services should be used together to meet these requirements? (Choose two.)

A company is designing a microservices architecture on AWS ECS with Fargate. Each service needs to store and retrieve session state. The solution must be highly available and low latency. Which AWS service should be used for session state storage?

A company has a legacy application that runs on Windows Server 2008 R2 on-premises. The application is no longer supported by the vendor, but the company still needs to run it for compliance reasons. They are migrating to AWS and want to minimize changes. What should the solutions architect recommend?

Which TWO AWS services can be used together to automate the discovery and migration of on-premises servers to AWS? (Choose two.)

A company wants to design a serverless event-driven architecture where multiple downstream services need to process events from a single source. Events must be reliably delivered and each downstream service must process every event independently. Which AWS service should be used as the event router?

Which TWO AWS services can be used to automate the enforcement of compliance policies across multiple AWS accounts? (Choose TWO.)

A company is migrating an on-premises Hadoop cluster to Amazon EMR. The cluster processes large datasets that are stored on HDFS. The company wants to minimize migration effort and cost. Which storage option should the company use with Amazon EMR?

A company is using AWS CloudFormation to manage infrastructure. The stack creation fails with the error 'Resource handler returned message: 'User: arn:aws:sts::123456789012:assumed-role/Admin/MySession is not authorized to perform: ec2:RunInstances'. What is the MOST likely cause?

A company is building a data lake on Amazon S3 using Parquet files. The data will be queried by multiple teams using Amazon Athena. The security team requires that access to sensitive columns (e.g., PII) be restricted based on the user's role. Which solution provides column-level access control with the LEAST administrative overhead?

A company is designing a new application that requires secure storage of secrets such as database passwords and API keys. The application runs on Amazon EC2 instances. The company wants to centralize secret management and automatically rotate secrets. Which AWS service should be used?

An administrator attached the above IAM policy to a group of developers. A developer tries to launch a t3.medium EC2 instance and receives an 'AccessDenied' error. What is the MOST likely reason?

A company has a multi-account setup with AWS Organizations. The security team wants to enforce that all IAM users must have MFA enabled. Which approach is most effective?

A company has a centralized security account and wants to enable AWS Config in all accounts. They want to centrally manage Config rules and view compliance. What should they do?

A company is designing a new application that will run on AWS. The application needs to store and retrieve user session data with low latency. The session data is small (less than 1 KB per user) and must be highly available. The company expects up to 10 million active users per day. Which AWS service should be used as the session store?

A company has a centralized AWS account for security tools and multiple member accounts. They want to use AWS GuardDuty to detect threats across all accounts. They have enabled GuardDuty in the management account and invited all member accounts. GuardDuty is set to send findings to a central S3 bucket in the security account. However, findings from member accounts are not appearing in the central S3 bucket. The security account has a bucket policy that allows the GuardDuty service principal to write findings. What is the most likely cause?

A company is planning to migrate its on-premises Oracle database to Amazon RDS for Oracle using AWS DMS. The database is 5 TB in size with continuous changes. Which TWO steps should the company take to minimize downtime during the migration?

A company has a CI/CD pipeline that builds and deploys a containerized application to Amazon ECS Fargate. The pipeline uses AWS CodeBuild to run tests and build Docker images. Recently, the pipeline has been failing intermittently with the error 'CannotPullContainerError: Error response from daemon: manifest for <image> not found'. The image is stored in Amazon ECR. The team suspects the issue is related to image tag inconsistency. The pipeline tags images with the commit hash. Which change will prevent this error?

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts and business applications. The company uses Microsoft Active Directory on-premises. Which AWS service should be used to integrate with the existing directory?

A company wants to centrally manage backups for Amazon EBS volumes across multiple AWS accounts. They need a solution that can automatically back up volumes based on tags, retain backups according to a policy, and send notifications on failures. Which AWS service should they use?

A company is designing a new static website hosted on Amazon S3. The website must be served over HTTPS with a custom domain name. Which AWS service should be used to achieve this?

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic to the application be encrypted in transit and that the load balancer use a certificate from AWS Certificate Manager (ACM). The application currently uses HTTP. What should the company do to meet the security requirement?

A Solutions Architect is reviewing an Amazon S3 bucket policy that grants access to users from another AWS account. The policy uses the Principal element with "AWS": "arn:aws:iam::123456789012:root". The users in the other account are unable to access the bucket. What is the most likely cause?

A company runs a containerized application on Amazon ECS with Fargate launch type. The application is deployed across multiple Availability Zones. Recently, deployments have been failing because new tasks cannot register with the Application Load Balancer (ALB) target group. The health checks are failing. What is the MOST likely cause?

A company is building a new data lake on AWS to store and analyze petabytes of data from various sources. The data includes structured (CSV, Parquet), semi-structured (JSON), and unstructured (images, videos) files. The company needs a cost-effective storage solution that allows running SQL queries directly on the data without loading it into a database. Data is accessed infrequently but must be available within minutes. Which solution should a Solutions Architect recommend?

A company is building a new web application that will be accessed by users globally. They want to minimize latency and protect against DDoS attacks. Which AWS service should they use as the entry point?

Refer to the exhibit. A solutions architect is reviewing an IAM trust policy for a Lambda function's execution role. The function needs to access an S3 bucket in the same account. The trust policy is as shown. What is missing for the Lambda function to successfully assume the role?

A company is migrating a legacy Oracle database to Amazon Aurora PostgreSQL. The migration must be completed with minimal downtime and minimal manual effort. Which AWS service should be used?

A company uses Amazon CloudFront to distribute content globally. The company wants to restrict access to content based on geographic location. Which THREE actions can the company take?

A startup runs its application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer to distribute traffic. During a recent marketing campaign, the application experienced high latency and some requests returned 503 errors. The team suspects that the tasks are hitting resource limits. The team wants to automatically scale the tasks based on CPU utilization. Which solution should the team implement?

A global company uses AWS Organizations with hundreds of accounts. The networking team needs to allow VPCs in different accounts to communicate privately using AWS Transit Gateway. The company wants to centralize management while allowing individual account owners to create and attach VPCs. Which solution meets these requirements?

A company is migrating a stateful firewall appliance to AWS. The appliance currently inspects traffic between multiple on-premises segments. In AWS, the company wants to deploy the appliance in a VPC to inspect traffic between subnets. Which architecture should the company use to ensure that the appliance can inspect all traffic?

A company has a single AWS account that hosts multiple applications for different business units. Each business unit wants to have its own set of IAM users and permissions. The company wants to minimize administrative overhead while maintaining separation. They are considering using AWS Organizations with multiple accounts. However, the CFO is concerned about increased costs due to separate accounts. What is the best solution to address the business units' needs while managing costs?

A company uses this CloudFormation template to manage an S3 bucket. They notice that old object versions are not being deleted after 30 days. What is the most likely reason?

A company wants to migrate its on-premises virtualized workloads to AWS using the VMware Cloud on AWS service. The company currently uses VMware vSphere for virtualization. What is the primary benefit of using VMware Cloud on AWS for this migration?

A company uses AWS Organizations and has a requirement that all API calls to AWS services must be logged and monitored. The security team wants to create a central CloudWatch dashboard that shows API activity across all accounts. Which solution should be implemented with the least operational overhead?

A company is migrating a web application to AWS and wants to use a multi-tier architecture with an Auto Scaling group of EC2 instances behind an Application Load Balancer. The company needs to store session state for the application. Which TWO approaches should the company use to store session state in a scalable and highly available manner? (Choose TWO.)

A company is migrating a legacy application to AWS. The application currently runs on a single on-premises server with a local MySQL database. The company wants to minimize changes and reduce operational overhead. Which TWO strategies should the solutions architect recommend? (Select TWO.)

Refer to the exhibit. A company has the above AWS Organization with a management account (111111111111) and a production account (222222222222). The security administrator in the management account creates an SCP that denies s3:DeleteBucket. The SCP is attached to the root. The production account's administrator tries to delete an S3 bucket and fails. What is the MOST likely reason?

A CloudFormation stack is created using the template above. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]'. Logs show: 'AMI 'ami-0abcdef1234567890' does not exist.' What is the most likely cause?

A company has a data pipeline that uses AWS Glue to process large datasets in Amazon S3. The pipeline runs daily and takes over 12 hours to complete. The company wants to reduce the processing time. Which approach would be MOST effective?

A global company uses AWS Organizations with multiple organizational units (OUs) for different business units. The networking team wants to ensure that all VPCs across all accounts can communicate through a central transit gateway. However, the security team requires that specific accounts cannot access each other's resources. Which combination of actions should the company take to meet these requirements?

A company uses AWS CloudFormation to manage its infrastructure. The operations team reports that stack updates often fail because of resource conflicts. The team wants to improve the reliability of updates without manual intervention. Which solution provides the MOST automated recovery from update failures?

A company is migrating a legacy on-premises application to AWS. The application uses a monolithic architecture and a MySQL database. The company wants to refactor the application into microservices and use a NoSQL database for better scalability. The new application will be deployed on Amazon EKS. The database must be highly available and support automatic scaling. Which database service should the company use?

A company is migrating a legacy application to AWS. The application uses a proprietary binary protocol that is not HTTP-based. The application currently runs on a single server and communicates with clients over TCP port 4444. The company wants to use AWS Elastic Load Balancing to distribute traffic across multiple EC2 instances for high availability. Which load balancer type should the company use?

A company is designing a new application that will run on Amazon EC2 instances. The application needs to access an Amazon S3 bucket to read and write objects. The company wants to ensure that the EC2 instances can access the S3 bucket without storing AWS credentials on the instances. Which TWO steps should the company take?

A media company is designing a video transcoding pipeline. They receive raw video files in Amazon S3, which need to be transcoded into multiple formats. The pipeline must handle sporadic bursts of uploads and complete processing within 30 minutes for each video. The cost should be minimized. Which design should they use?

A company is designing a new microservices application using Amazon ECS with Fargate. The services need to communicate securely within the VPC. Which approach should be used for service discovery?

A company is migrating a legacy monolithic application to a microservices architecture on AWS. They want to use an event-driven design where services react to state changes. Which AWS service should they use to capture, store, and replay events?

A startup is building a web application on AWS that requires a relational database. They expect unpredictable traffic patterns and want to minimize costs while ensuring high availability. Which database solution should they choose?

Refer to the exhibit. A company has this IAM policy attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 with the tag 'Environment: staging'. What happens?

A company is using AWS CloudFormation to manage its infrastructure. They have a production stack that creates an Amazon RDS DB instance. The company wants to update the DB instance class to a larger size with minimal downtime. Which approach should they use?

A company is migrating to AWS and wants to use AWS CloudFormation to manage infrastructure as code. The DevOps team needs to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key. What is the MOST efficient way to achieve this?

A company is migrating a large number of on-premises virtual machines (VMs) to AWS using AWS Application Migration Service (AWS MGN). During the initial replication, some VMs fail with the error 'Replication agent cannot communicate with the AWS MGN endpoint'. Which TWO actions should the company take to resolve this issue? (Choose TWO.)

A company uses AWS CloudFormation to manage infrastructure. The stack fails to update with the error: 'Resource handler returned message: The subnet 'subnet-xxx' is in use by a network interface.' The subnet is associated with a Lambda function in a VPC. The CloudFormation template is trying to delete the subnet. What should the company do to resolve this?

A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?

A company is migrating a three-tier web application to AWS and wants to decouple the layers for scalability. Which THREE AWS services should they use?

A financial services company is designing a multi-account strategy using AWS Control Tower. The company has strict data residency requirements: customer data must remain in the country of origin. The company operates in three countries: US, UK, and Germany. Each country has a set of accounts for production, development, and testing. The company needs to ensure that IAM roles in UK accounts cannot access resources in German accounts, and vice versa. Which architecture should be used?

A company uses AWS CloudFormation to manage infrastructure. The operations team wants to implement a change management process where all stack updates must be reviewed and approved before execution. The team currently uses AWS CodePipeline for CI/CD. Which solution meets these requirements with the LEAST operational overhead?

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs across different accounts that need to authenticate against the same directory. What is the MOST scalable and secure way to provide this access?

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of 'user_id' and a sort key of 'game_id'. The application experiences high latency during peak hours. Which TWO actions would improve read performance?

A company uses AWS Lambda functions to process events from Amazon SQS. The function's duration has increased, causing a backlog. The team wants to improve throughput without changing the function code. Which action should the team take?

A company is designing a new data lake on AWS. The data lake must support SQL queries using Amazon Athena and also allow Amazon SageMaker to access training data. The solution must minimize storage costs for infrequently accessed data while providing immediate access when needed. Which storage tier should be used for the data lake?

A company is migrating a large Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime and support ongoing replication. Which AWS service should the company use?

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to centrally enforce that all S3 buckets across all accounts have server-side encryption enabled. Which solution should be used?

A company uses AWS Organizations with 50 accounts. The networking team wants to deploy a shared VPC in the network account and share subnets with other accounts. The shared subnets will host EC2 instances from the consuming accounts. What is the MOST secure way to ensure that only authorized accounts can create resources in the shared subnets?

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts and business applications. Which TWO components are required for this setup?

A company is migrating a web application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to ensure high availability and scalability. The web application is stateless. Which TWO actions should the company take to achieve these goals? (Choose TWO.)

A company has a multi-account AWS environment with a centralized logging account. The security team needs to collect all Amazon S3 access logs and AWS CloudTrail logs from all accounts into a centralized Amazon S3 bucket in the logging account. Which THREE steps are required to meet this requirement? (Choose THREE.)

A company is deploying a new web application that uses Amazon S3 to store static content and Amazon CloudFront for content delivery. The application also uses an API Gateway with Lambda for backend logic. The company wants to protect the API from common web exploits like SQL injection and cross-site scripting. Which AWS service should be added to the architecture?

A company is migrating a stateful application to AWS and needs to preserve the client IP addresses at the application layer. The application runs on EC2 instances behind a load balancer. Which load balancer type should they use?

A company is migrating a legacy application that uses Windows Authentication for SQL Server. The company wants to use AWS Managed Microsoft AD. Which migration strategy should be used for the database to maintain compatibility?

A company is designing a multi-tier web application that must be fault-tolerant and scalable. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in an Auto Scaling group. The instances run a web server and a backend application. Which TWO steps should be taken to ensure the application can scale without data loss?

A company is designing a CI/CD pipeline for a containerized application using AWS CodePipeline. The application is deployed to Amazon ECS with Fargate. The pipeline must automatically build and test code changes before deploying to production. Which service should be used to build and test the Docker images?

A company is using AWS Control Tower to manage multiple accounts. The security team wants to enforce that all accounts use a specific AWS Region for data storage. Which TWO steps should be taken to enforce this requirement?

A company is designing a multi-region active-active application using Amazon DynamoDB global tables. The application requires strong consistency reads. However, global tables only support eventual consistency. What should the solutions architect do to meet the requirement?

A large enterprise has a multi-account AWS environment managed through AWS Organizations. The central networking team uses a transit gateway in a shared services VPC to connect all VPCs. The security team requires that all traffic between VPCs be inspected by a third-party firewall appliance that is deployed in an auto-scaling group in the shared services VPC. The firewall appliance is configured as a Gateway Load Balancer (GWLB) endpoint. The transit gateway has a route table that sends all inter-VPC traffic to the GWLB endpoint. Recently, the operations team noticed that some applications are experiencing high latency and packet loss when communicating across VPCs. Upon investigation, they found that the firewall appliance is not scaling properly. Which solution should be implemented to ensure that the firewall can handle the traffic load and maintain low latency?

Refer to the exhibit. A solutions architect has attached this key policy to an AWS KMS key. The IAM role MyAppRole is used by an application running on an EC2 instance in us-east-1. The application tries to decrypt an object stored in the S3 bucket my-bucket using server-side encryption with AWS KMS (SSE-KMS). What will happen?

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. During a traffic spike, some API requests fail with 5xx errors. The CloudWatch logs show 'ProvisionedThroughputExceededException' for DynamoDB. The team wants to handle this gracefully without losing requests. What should they do?

A company is designing a new microservices application on AWS. Each microservice needs to store and retrieve stateful data with low latency (single-digit milliseconds). The data must be durable and highly available across multiple Availability Zones. Which AWS service should be used for the primary data store for each microservice?

A company wants to allow developers to launch EC2 instances only if they include a specific tag 'CostCenter'. The tag must be provided at launch. Which IAM policy should be used?

A company is migrating a large-scale Oracle data warehouse to Amazon Redshift. The migration must minimize downtime. The source database is 10 TB and runs on a single on-premises server with 1 Gbps network. Which approach should be used for the initial data load?

A company uses AWS Organizations with 100 accounts. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if MFA is not present. However, some users report that they cannot access the console even with MFA. What is the most likely reason?

A company has a central IT account that manages DNS using Amazon Route 53 Private Hosted Zones. Multiple VPCs from different accounts are associated with the same private hosted zone. The company wants to ensure that only authorized VPCs can resolve records in the zone. Which three steps should be taken? (Choose THREE.)

A company is modernizing a monolithic Java application to run on Amazon ECS with Fargate. The application uses a proprietary configuration management system. Which TWO AWS services can replace the configuration management system to store and retrieve configuration at runtime?

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to example-bucket with SSE-S3 (AES256) encryption. What will happen?

A company is migrating its on-premises virtual machines (VMs) to AWS. The company has 50 VMs running various operating systems and applications. The architect wants to use a service that automates the replication and conversion of the VMs to Amazon EC2 instances. Which AWS service should the architect use?

A company is planning to migrate 50 TB of data from an on-premises data center to Amazon S3. The on-premises network bandwidth is 100 Mbps. The migration must be completed within 30 days. What is the most cost-effective solution?

A company wants to design a highly available, stateless web application using Amazon ECS with Fargate. They need to distribute traffic across multiple AWS Regions for low latency. Which approach should they use?

A startup is launching a new multi-account AWS environment using AWS Organizations. They want to ensure that only the central security team has access to the root user of each member account. Additionally, they want to enable multi-factor authentication (MFA) for the root user of each account. The security team has access to the management account. What is the MOST secure and efficient way to meet these requirements?

A company is performing a server migration to AWS using AWS Server Migration Service (SMS). The company needs to automate the replication of servers and track the migration status. Which THREE components are required for this solution? (Choose three.)

A company needs to design a new solution for storing and retrieving user-uploaded images. The images are accessed frequently for the first 30 days and then rarely accessed after that. The company wants to minimize storage costs while maintaining low-latency access for frequently accessed images. Which storage strategy should be used?

A startup is building a serverless application using AWS Lambda for business logic and Amazon DynamoDB for data storage. The application must process a high volume of writes to a single DynamoDB table. The development team is concerned about throttling due to hot partitions. Which design should the team implement to avoid throttling?

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application currently uses a central MySQL database. The architects plan to refactor the database into separate RDS instances per microservice. Which strategy will ensure data consistency across services with minimal application changes?

A company runs a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. The Auto Scaling group has a minimum of 2 and maximum of 10 instances. CloudWatch metrics show that CPU utilization rarely exceeds 30%. What is the MOST likely cause of the 503 errors?

A company has a web application running on EC2 instances in an Auto Scaling group. The application experiences unpredictable traffic spikes. The company wants to ensure that the application can scale out quickly and scale in to reduce costs. Which TWO actions should the solutions architect recommend?

A company is designing a multi-account architecture using AWS Organizations. The company wants to enforce that all Amazon S3 buckets across all accounts must have server-side encryption (SSE) enabled. Which TWO actions should be taken to enforce this requirement?

A financial services company is designing a new application that processes sensitive transactions. The application runs on Amazon ECS with Fargate. The compliance team requires that all data in transit between the application and the database must be encrypted. The database is an Amazon RDS for PostgreSQL instance. The application connects to the database using a connection string that includes the database endpoint. The security team has enabled encryption in transit on the RDS instance using a certificate. The application is currently failing to connect to the database with an error related to SSL/TLS. The development team verified that the connection string includes the sslmode=require parameter. What is the most likely cause of the connection failure?

A company uses AWS Organizations with a management account and several member accounts. The security team needs to centrally manage IAM users and roles across all accounts. Which AWS service should the company use?

A company is migrating a legacy on-premises .NET application to AWS. The application uses a SQL Server database and requires full control over the operating system for compliance. Which migration strategy should the solutions architect recommend to minimize rework while meeting compliance requirements?

A company runs a production application on EC2 instances behind an Application Load Balancer. After a recent deployment, users report intermittent 503 errors. The CloudWatch metrics show that the ALB's 'TargetResponseTime' is within normal range, but 'RequestCount' has increased by 50%. There are no changes to the security groups. What is the MOST likely cause of the 503 errors?

A company runs a web application on AWS Elastic Beanstalk. The application experiences periodic traffic spikes that cause the environment to scale out. However, the scaling is slow, leading to increased latency during spikes. The operations team wants to improve the responsiveness of the Auto Scaling group. The application is stateless and runs on a single instance type. What should a solutions architect recommend?

A company is migrating a legacy .NET application to AWS. The application uses Windows authentication and integrates with on-premises Active Directory. The company wants to use AWS Managed Microsoft AD to reduce administrative overhead. However, after migration, the application fails to authenticate users. What is the most likely cause?

A company is designing a new static website hosted on Amazon S3. They want to use Amazon CloudFront as a content delivery network (CDN) to serve the website globally with low latency. The website content must be encrypted in transit. Which configurations should they use? (Choose TWO.)

Refer to the exhibit. An S3 bucket policy is shown. A user from IP 10.0.0.5 makes a GET request over HTTPS. Will the request succeed?

A company is migrating data to Amazon S3 and requires that all objects uploaded to the bucket 'my-bucket' are encrypted with SSE-S3. The above IAM policy is attached to an IAM user. An application using the user's credentials attempts to upload an object without specifying the x-amz-server-side-encryption header. What will happen?

A company uses AWS Organizations with consolidated billing. The company wants to share a centrally managed Amazon VPC subnet across multiple accounts using AWS Resource Access Manager (RAM). Which THREE resources can be shared via RAM? (Choose THREE.)

A company is migrating a large-scale batch processing workload from on-premises to AWS. The workload runs on a schedule and processes data files from an FTP server. The company wants to use AWS services that are serverless and event-driven to reduce operational overhead. The data files will be uploaded to an Amazon S3 bucket. Which solution meets these requirements?

A company is migrating a batch processing workload to AWS. The workload runs nightly and takes approximately 2 hours on a single on-premises server. The company wants to reduce the processing time to under 30 minutes. Which THREE steps should the solutions architect recommend?

A company is running a critical microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic. Recently, the team noticed that the ALB's 5xx error rate has increased. The error is HTTP 503. The team suspects the target group is unhealthy. Which THREE steps should the team take to diagnose and resolve the issue?

A company uses AWS CloudFormation to deploy a multi-tier application. The stack fails to update due to a resource conflict. The operations team needs to identify the resource causing the failure and modify the template to allow the update. Which approach is MOST effective?

Refer to the exhibit. A CloudFormation stack was successfully created. The stack's template includes an S3 bucket and a Lambda function. A developer runs the CLI command shown but receives an error that the stack does not exist. What is the MOST likely cause?

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon S3 bucket that contains sensitive data. The security team requires that all traffic between the ECS tasks and S3 remain within the AWS network and not traverse the internet. What is the MOST secure way to meet this requirement?

A company is designing a data processing pipeline for real-time analytics. The pipeline ingests data from IoT devices that send JSON messages via MQTT to AWS IoT Core. The messages must be processed in real-time to detect anomalies and the results must be stored in Amazon S3 for later analysis. The company currently uses a Lambda function to process each message, but as the number of devices grows, the Lambda function is being throttled due to concurrency limits. The company needs a solution that scales to handle thousands of devices per second without losing messages. The processed data must be available in S3 within 1 minute of ingestion. Which architecture should the company use?

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function writes results to a DynamoDB table. Over time, the function's execution time has increased, and some operations fail with ProvisionedThroughputExceededException. The function is configured with 1024 MB memory and a 5-minute timeout. The DynamoDB table has 1000 RCUs and 500 WCUs. The Lambda function performs reads and writes on the same table. What is the MOST cost-effective way to resolve the throttling without sacrificing performance?

A company is designing a new microservices architecture on AWS. The company wants to use a service mesh to manage service-to-service communication, observability, and security. Which AWS service should the company use?

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot in the correct order.

A company is designing a new serverless application that uses Amazon API Gateway and AWS Lambda. The application must authenticate users using a third-party identity provider (IdP) that supports OpenID Connect (OIDC). The company wants to offload authentication to the API Gateway. Which solution should the architect recommend?

A company deployed the above CloudFormation template. An EC2 instance launched in the PrivateSubnet needs to access the internet for software updates. Which action is required?

A company is migrating a critical application to AWS. The migration plan includes a pilot light strategy. The company has set up a small replica of the environment in AWS. During a disaster, the company wants to quickly provision the full production environment. Which AWS service is best suited for this purpose?

A company is designing a new application that will process sensitive data. The application will run on Amazon ECS with Fargate. The security team requires that all data at rest be encrypted, and that encryption keys be managed by the company's own hardware security module (HSM) in an on-premises data center. Which TWO steps should the company take to meet these requirements? (Choose TWO.)

A retail company is migrating its on-premises e-commerce platform to AWS. The platform consists of a load-balanced web tier, an application tier, and a MySQL database. The company wants to modernize the database by migrating to Amazon Aurora MySQL. The migration must have minimal downtime and support rollback. The database is 2 TB in size and has high write activity. The company has set up an AWS Direct Connect connection. Which approach should the company take to migrate the database with minimal downtime?

An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 using the AWS CLI. What will happen?

A company has an IAM policy attached to a user. When the user tries to stop an EC2 instance using the AWS CLI, they receive an 'AccessDenied' error. The instance is tagged with 'Environment=Production'. What is the most likely cause?

A company is designing a new web application on AWS. The application must be highly available and scale automatically based on traffic. The architecture includes an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The application stores session state. What is the BEST way to handle session state to ensure high availability?

A company is migrating a web application to AWS. The application runs on EC2 instances behind an Application Load Balancer. The exhibit shows the current running instances. The company wants to ensure high availability across multiple Availability Zones. Which action should the company take?

A company is migrating a legacy .NET application to AWS. The application uses Windows authentication and stores session state in-memory. The company wants to minimize code changes and use AWS managed services. Which combination of AWS services should the company use to modernize the application's authentication and session management?

A company uses Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). What is the MOST secure way to enforce this requirement across all S3 buckets?

A company is designing a data lake on AWS using Amazon S3. The data lake will store sensitive customer data that must be encrypted at rest. The company requires that the encryption keys be managed by the company's own hardware security module (HSM) and rotated every 90 days. Which solution meets these requirements?

A company is migrating a large .NET application from Windows Server on-premises to AWS. The application uses a SQL Server database. The company wants to reduce licensing costs by using open-source alternatives where possible. However, the application code heavily uses SQL Server-specific features like CLR integration, linked servers, and T-SQL stored procedures. What is the most cost-effective migration strategy?

A company uses AWS Organizations with a hierarchical OU structure. The security OU has an SCP that denies all actions except those explicitly allowed. The development OU has an SCP that allows all actions. A developer account in the development OU tries to launch an EC2 instance but receives an access denied error. The IAM user in the developer account has full administrator permissions. What is the most likely cause?

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application experiences intermittent high latency due to CPU spikes on some instances. The company wants to automatically replace unhealthy instances and optimize costs. What should a solutions architect do?

A company is designing a multi-account strategy using AWS Organizations. The security team requires that all API calls to create or modify IAM roles are logged and alerted. Which TWO steps should be taken to meet this requirement?

A company has a AWS Organizations setup with 100 accounts. The security team requires that all IAM users across all accounts must have multi-factor authentication (MFA) enabled. Currently, there is no central enforcement. The company wants to implement a solution that automatically detects IAM users without MFA and disables their access keys. The solution must be centrally managed from the management account. Which solution meets these requirements?

Refer to the exhibit. A CloudFormation template is used to create an IAM role for EC2. The stack creation fails with the error: "Resource creation cancelled". The IAM role is not created. What is the MOST likely reason?

A company runs a static website on Amazon S3 behind Amazon CloudFront. The website uses a custom domain and SSL certificate from AWS Certificate Manager (ACM). Users report that they sometimes see an older version of the website after updates. What should the company do to ensure users always see the latest content?

A company is migrating a monolithic .NET application to AWS. The application uses a SQL Server database with complex stored procedures and tightly coupled components. The migration team wants to minimize refactoring and reduce licensing costs. Which migration strategy should the team use?

A company uses AWS Organizations to manage multiple accounts. The central team wants to deploy a CloudFormation template that creates an S3 bucket with default encryption in every member account. Which THREE steps are required to accomplish this?

A company wants to use AWS IAM Identity Center (successor to AWS SSO) to provide single sign-on access to multiple AWS accounts. They have an existing Microsoft Active Directory and want to synchronize users and groups. Which TWO actions should be taken to set this up?

A company is migrating a containerized application to Amazon ECS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which storage solution should they use?

A company has a multi-account AWS environment. The central IT team manages IAM roles in each account using AWS CloudFormation StackSets. The team needs to ensure that a specific IAM role exists in all member accounts. Which solution is the MOST efficient?

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The company wants to ensure that traffic to the application is encrypted in transit. Which TWO actions should the company take?

A company has a consolidated billing setup with AWS Organizations. The finance team needs to track costs at the department level. Each department has its own AWS account. Which THREE steps should be taken to achieve detailed cost allocation? (Choose THREE.)

A company has a multi-account AWS environment with a central security account for AWS GuardDuty, AWS Security Hub, and AWS IAM Access Analyzer. The security team wants to aggregate findings from all member accounts into the security account. Which THREE steps should be taken?

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs visibility into all IAM user activities across accounts. What is the MOST scalable solution to aggregate CloudTrail logs?

A company runs a critical database on Amazon RDS for PostgreSQL. The database is experiencing performance degradation due to high CPU utilization. The operations team wants to analyze the root cause. Which THREE steps should the team take to diagnose the issue?

Which THREE of the following are common challenges when migrating a monolithic application to a microservices architecture on AWS? (Choose three.)

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The application needs to store session state. Which AWS service provides a fully managed, highly scalable solution for session state management?

A company is migrating a critical database server to Amazon EC2. The root volume (EBS) is configured with DeleteOnTermination=false. After migration, the company needs to ensure that if the EC2 instance fails, a new instance can be quickly launched using the same data. The company takes regular snapshots of the volume. Which statement is correct regarding the root volume's behavior?

A company has a centralized logging account and wants all VPC Flow Logs from all accounts to be delivered to a central S3 bucket in the logging account. Each account has a VPC Flow Log configured to deliver to a bucket in the same account. What is the most efficient way to centralize these logs?

A company has an AWS Organization with multiple accounts. The central IT team wants to deploy a common set of AWS Config rules across all accounts in the production OU. Which approach is the MOST scalable and maintainable?

A company uses Amazon RDS for MySQL for its database. The operations team notices that read queries are slow during peak hours. The application is read-heavy and can tolerate eventual consistency. Which solution would improve read performance with minimal application changes?

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which solution should the team implement?

A company wants to implement a multi-account strategy using AWS Organizations. The security team requires that all new accounts added to the organization automatically inherit a baseline set of security controls, such as AWS CloudTrail and AWS Config rules. Which approach should the company use?

Refer to the exhibit. A company attaches this SCP to the root of an AWS Organization. What is the effect?

A solutions architect runs the AWS CLI command shown in the exhibit to troubleshoot a failed CloudFormation stack creation. What is the most likely cause of the failure?

A company is designing a solution to process real-time streaming data from IoT devices. The data must be ingested, processed with sub-second latency, and stored for analytics. Which services should the company use? (Choose TWO.)

Refer to the exhibit. { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:role/Admin" }, "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "kms:CallerAccount": "123456789012" } } }, { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:role/Admin" }, "Action": [ "kms:Decrypt" ], "Resource": "*" } ] } A solutions architect is reviewing the above KMS key policy. The Admin role cannot decrypt data using the key. What is the MOST likely reason?

A company has a centralized logging solution where all VPC Flow Logs from member accounts are delivered to a central S3 bucket in the logging account. The logs contain sensitive IP addresses that must be redacted before analysis. What is the MOST scalable approach?

An IAM policy allows a user to start and stop EC2 instances but denies terminating instances under a specific condition. Which action will the policy deny?

A solutions architect runs the above CLI command. What is the output format?

A company is designing a new solution to process a continuous stream of events from multiple sources. The events must be processed in real-time with exactly-once processing semantics. The solution should be able to handle replayed events without duplication. Which AWS service should be used for the event processing?

A company uses AWS Organizations with several OUs. The security team wants to enforce that EC2 instances in production accounts cannot have public IP addresses. The solution must be preventive and should not rely on developers remembering to follow guidelines. What should the security team do?

A company uses AWS SSO with an external identity provider. The security team needs to enforce that users in the finance department can only access the finance OU accounts. Which configuration is required?

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all root user activities are monitored and alerted. Which TWO actions should the team take? (Choose TWO.)

A company wants to migrate a monolithic application to AWS and redesign it using microservices. The application uses a MySQL database. The company wants to minimize operational overhead and enable each microservice to have its own database. Which AWS service should the company use to implement the database layer?

A company uses AWS CloudFormation to manage infrastructure. A recent stack update failed because a resource exceeded a service quota. The team wants to be notified proactively when service limits are approaching. Which solution meets this requirement?

An IAM policy attached to an S3 bucket is shown. What is the net effect on requests to read objects from the bucket?

A company is using AWS Organizations with a multi-account strategy. The finance team wants to centrally manage and enforce cost allocation tags across all accounts. Which solution is MOST effective?

Refer to the exhibit. An IAM policy allows ec2:Describe* actions on all resources. A developer wants to also allow describing RDS instances. Which action must be added to the policy?

A company uses AWS Organizations with multiple OUs. The finance team needs to have read-only access to billing data across all accounts. The security team wants to ensure that no IAM user can modify billing preferences. Which policy should be attached to the root OU to achieve this?

A company is designing a new serverless data processing pipeline that uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data must be processed using AWS Lambda and then stored in Amazon S3. The company needs to ensure that records are processed in order within each shard and that each record is processed exactly once. Which configuration should they use? (Choose TWO.)

A company is migrating a containerized application from on-premises to AWS. The application runs on Kubernetes. The company wants to use Amazon EKS for orchestration. The migration must support high availability across multiple Availability Zones and integrate with AWS services like IAM, VPC, and CloudWatch. The company needs to minimize the operational overhead of managing the Kubernetes control plane. Which EKS configuration should the company use?

A company wants to centrally manage IAM permissions across multiple AWS accounts using AWS Organizations. They need to allow developers to launch EC2 instances but restrict the instance types to approved families (e.g., t3 and m5). Which TWO solutions meet this requirement?

A company is migrating a large-scale on-premises Apache Kafka cluster to AWS. The cluster handles real-time streaming data from thousands of IoT devices. The company wants to reduce operational overhead and ensure high availability. Which AWS service should be used?

A company is migrating a legacy application that uses a proprietary binary protocol for communication. The application communicates over TCP/IP. The company wants to modernize the communication layer to use a RESTful API. Which TWO approaches should the company consider?

A company has a centralized logging account that receives VPC flow logs from all accounts. The logs are stored in an S3 bucket. The security team needs to analyze these logs to detect anomalous traffic patterns. Which solution provides the most cost-effective and scalable analysis?

A company wants to migrate its on-premises file server to AWS. The file server contains 10 TB of data that changes infrequently. The company has a limited bandwidth internet connection and needs to complete the migration within one week. Which AWS service should the company use for the initial data transfer?

A company is designing a new application that will use Amazon DynamoDB as its database. The application will have a heavy read workload with occasional write spikes. The company wants to minimize costs while ensuring that reads are eventually consistent and writes are not throttled. Which three options should the architect consider? (Choose THREE.)

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). An audit reveals that some objects were uploaded without encryption. What is the MOST efficient way to enforce encryption for all future uploads?

A company is designing a disaster recovery strategy for a critical application running on Amazon RDS for PostgreSQL. The primary database is in us-east-1. The company needs a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which TWO solutions meet these requirements? (Choose TWO.)

A global e-commerce company is designing a new recommendation engine on AWS. The engine processes user behavior data (clicks, purchases) from multiple sources in real time and updates recommendations stored in Amazon DynamoDB. The data stream can reach 100,000 events per second. The solution must be highly available and process events with minimal latency (< 1 second). The company wants to use a managed streaming service and a real-time processing framework. Which solution should a Solutions Architect recommend?

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions query an Amazon RDS for PostgreSQL database. Recently, the company has noticed increased latency and occasional timeouts during peak hours. A solutions architect needs to improve the performance and scalability of the database layer. Which solution will meet these requirements with the LEAST operational overhead?

A company uses Amazon CloudFront to deliver static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. What configuration should they use?

A company is designing a new application that will run on Amazon EKS. The application must be able to scale based on custom metrics such as number of messages in an SQS queue. Which Kubernetes component should be used to achieve this?

A company has 100 AWS accounts in AWS Organizations. The security team wants to enforce that all Amazon S3 buckets have encryption enabled. Which TWO actions should the team take to meet this requirement? (Choose TWO.)

A DevOps engineer is troubleshooting an AWS CodePipeline that fails during the Deploy stage. The pipeline deploys a static website to an S3 bucket. The error message indicates 'Access Denied' when putting objects into the bucket. What is the MOST likely cause?

A company is designing a new application that will process sensitive financial data. The application must encrypt data at rest and in transit. The company wants to use AWS managed keys for encryption. Which AWS service should the company use to create and manage the encryption keys?

A company is migrating an on-premises application to AWS. The application requires low-latency access to a file system that can be mounted by multiple EC2 instances simultaneously. Which AWS storage service should they use?

A company wants to automatically enforce encryption on all new objects uploaded to an S3 bucket. What should they do?

A company uses AWS Organizations with 200 accounts. The security team wants to enforce that all EC2 instances launched in any account must use a specific Amazon Machine Image (AMI) ID that is approved by the security team. Which approach should be used?

Refer to the exhibit. A solutions architect applies this IAM policy to a user. The user tries to upload an object to my-bucket using an unencrypted HTTP connection with SSE-S3 encryption. Will the upload succeed?

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to `s3://my-bucket/secret/data.txt` from an IP address in the 10.0.0.0/8 range. What will happen?

A company is migrating a stateful application to AWS. The application uses sticky sessions (session affinity) on the current on-premises load balancer. The company wants to use an Application Load Balancer (ALB) in AWS. Which feature should be enabled?

A company is deploying a containerized application on Amazon ECS. The application must be highly available and scale automatically based on CPU utilization. The application also needs to be accessible from the internet via a single endpoint. Which combination of services should the solutions architect use?

A company uses AWS Organizations with hundreds of accounts. The central IT team needs to ensure that all accounts use a standard set of network configurations, including VPC CIDR blocks and subnets. Which THREE steps should the team take to enforce this standard? (Choose THREE.)

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

A company is designing a global application that requires low-latency read access to a database from multiple AWS regions. The database stores user profile data that is updated infrequently. The solution must ensure eventual consistency and minimize write conflicts. Which combination of AWS services should be used?

A company has a production AWS Lambda function that processes data from an Amazon SQS queue. The function often experiences throttling errors. The company wants to implement a solution to reduce throttling and improve processing performance. Which solution meets these requirements?

A company is migrating a multi-tier application to AWS. The application has a web tier, application tier, and database tier. The company wants to use AWS services to improve scalability and reduce costs. Currently, the on-premises infrastructure is underutilized. What is the most cost-effective migration strategy?

A company is migrating a stateful application to AWS. The application runs on a single on-premises server and uses local storage for persistent data. The company wants to achieve high availability and scalability. Which migration approach should the company use?

A company is designing a new serverless application using AWS Lambda. The Lambda function needs to access an Amazon RDS database. The database is in a VPC without public internet access. What is the MOST secure way to allow the Lambda function to connect to the database?

A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?

A company uses a centralized logging account with an S3 bucket that receives VPC Flow Logs from multiple accounts. The logs must be encrypted at rest using a KMS key in the logging account. Which configuration is required to allow cross-account delivery of VPC Flow Logs?

A company runs a web application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer. The operations team notices that the ALB returns 503 errors during peak traffic. Which TWO actions should the solutions architect take to resolve this issue?

A company is designing a data lake on Amazon S3 for analytics. The data is ingested from multiple sources and must be encrypted at rest. The company requires the ability to audit access to the data lake and enforce fine-grained access control based on tags. Which solution should the company choose?

A company is designing a highly available web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to EC2 instances in an Auto Scaling group across multiple Availability Zones. The application state is stored in an Amazon ElastiCache for Redis cluster. The company wants to minimize downtime during patching of the Redis cluster. What should the company do?

A large enterprise has a multi-account AWS environment with over 200 accounts organized under AWS Organizations. The central platform team uses AWS CloudFormation StackSets to deploy a standard VPC with a CIDR of 10.0.0.0/16 into each account. Recently, a business unit created a new account that was not included in the StackSet deployment, and the team manually deployed the VPC using a CloudFormation template. Now, the central team wants to ensure that all accounts have exactly the same VPC configuration and that any drift is automatically corrected. The team also wants to prevent unauthorized changes to the VPC configuration. What is the MOST efficient and secure solution?

A company has three EC2 instances as shown in the exhibit. The company wants to use an Application Load Balancer to distribute traffic across these instances with cross-zone load balancing enabled. How will the traffic be distributed?

A company is migrating a large number of files from on-premises to Amazon S3. The files are in a network-attached storage (NAS) system with a 1 Gbps connection to the internet. The company has a 2-week deadline to complete the migration. Which TWO services should the company use to accelerate the migration? (Choose TWO.)

A security engineer created the S3 bucket policy shown in the exhibit. The policy is intended to allow the role MyAppRole to get objects only if they are encrypted with SSE-S3. However, the role is getting access denied errors when trying to get objects that are encrypted with SSE-S3. What is the most likely cause?

A company is designing a new microservices architecture on Amazon ECS with Fargate. The company wants to ensure that services can discover each other using DNS names. Which TWO components are required?

A company is designing a new web application that will be deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which THREE actions should the company take to meet these requirements? (Choose three.)

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a central security account. The solution must scale as new accounts are added. What should the team do?

A company is designing a multi-account strategy for its development teams. Each team needs to have its own isolated environment with VPCs, subnets, and security groups. The company wants to centralize network administration and ensure that all VPCs use a common set of security rules. Which THREE steps should the company take? (Choose THREE.)

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. Recently, a deployment failed because the new task definition referenced an ECR image that did not exist. The team wants to prevent this type of failure in the future. Which action should be taken?

A company has a multi-account environment with over 500 accounts. They need to enforce that all EC2 instances are launched only in approved instance families (e.g., t3, m5, c5). Which combination of AWS services provides the MOST scalable and effective enforcement?

A company is designing a new serverless application using AWS Lambda to process high-resolution images uploaded to Amazon S3. Each image can be up to 500 MB. The processing must complete within 5 minutes. What is the MOST cost-effective and scalable design to meet these requirements?

Which TWO AWS services can be used to implement a centralized logging solution across multiple AWS accounts?

A company is designing a cost-effective solution to store and serve large media files (e.g., videos) to users globally. The files are frequently accessed initially but become rarely accessed after 30 days. The company needs millisecond retrieval for the first 30 days and can tolerate retrieval times of minutes after that. What storage solution should the company use?

A company is migrating workloads to AWS using AWS Application Migration Service (AWS MGN). The source servers are running on VMware vSphere. After installing the AWS Replication Agent on the source servers, the migration waves are set up. However, during a test cutover, the test instance fails to launch with an error 'Insufficient IP address space in the target VPC'. What is the most likely cause?

A company is migrating a legacy PHP application running on a single on-premises server to AWS. The application stores session data locally on the server's filesystem. The company wants to achieve high availability and elasticity for the application on AWS. What should the company do to handle session state in the new architecture?

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to be notified immediately if any instance fails a status check. What is the simplest solution?

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

A company is deploying a web application on AWS Elastic Beanstalk. The application must be accessible over HTTPS only and must automatically redirect HTTP requests to HTTPS. The SSL/TLS certificate is provided by AWS Certificate Manager (ACM). How should this be configured?

A company has multiple AWS accounts and wants to ensure that all resources are tagged with a cost center tag. Which THREE steps should they take to enforce this?

A company is modernizing a legacy application by breaking it into microservices. The application has a complex set of dependencies and requires gradual migration. Which design pattern should the company use?

A company runs a critical database on an RDS for MySQL Multi-AZ DB instance. The database is experiencing high read latency. The application is read-heavy and uses many complex joins. The company needs to improve read performance with minimal application changes. Which solution is MOST appropriate?

A company is migrating a critical application to AWS and needs to ensure business continuity during the migration. The application must remain available with minimal downtime. Which AWS service should be used to replicate data continuously?

A company has a multi-account AWS environment with a central logging account. All VPC Flow Logs are published to a central S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena, but they want to minimize costs by reducing the amount of data scanned. Which partitioning strategy is MOST effective?

A company uses Amazon DynamoDB as a data store for a mobile application. The application experiences throttling errors during peak hours. The table has a provisioned read capacity of 5000 RCUs and write capacity of 2000 WCUs. The throttling is on writes. What is the MOST cost-effective solution?

A company uses AWS Organizations and wants to implement a least-privilege model for IAM roles. The security team needs to ensure that no IAM role can be created without an approval workflow. Which THREE steps should the company take?

A company needs to store configuration data for multiple applications in a centralized, secure, and versioned manner. The configuration must be encrypted at rest and automatically rotated. Which AWS service should they use?

A company uses AWS CloudFormation to deploy infrastructure. A Solutions Architect needs to update a stack that includes an RDS DB instance. The update requires modifying the DB instance's storage type from gp2 to io1. What change should be made to the CloudFormation template to minimize downtime?

A company is designing a new disaster recovery solution for a critical application running on Amazon EC2. They need to replicate data across AWS Regions with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. Which THREE actions should they take to meet these objectives?

Refer to the exhibit. A company deploys this CloudFormation template. After deployment, they enable S3 Transfer Acceleration on the bucket. Later, they update the stack. What happens to the Transfer Acceleration setting?

A company has a production AWS Lambda function that processes orders. The function's execution time has increased, causing timeouts. The team wants to troubleshoot without affecting production traffic. What should they do?

A company wants to implement a centralized logging solution for all VPCs in their AWS Organization. They need to capture VPC Flow Logs, AWS CloudTrail logs, and DNS logs, and store them in a central Amazon S3 bucket. The logs must be encrypted with a customer-managed KMS key. Which solution meets these requirements with the least operational overhead?

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce that all newly created accounts automatically have a specific set of security controls, including AWS Config rules and an AWS CloudTrail trail. Which solution meets these requirements with the LEAST operational overhead?

A multinational corporation is implementing a multi-account AWS strategy using AWS Organizations. The security team requires that all newly created accounts in the organization automatically have an Amazon GuardDuty detector enabled in all enabled Regions. Which solution meets this requirement with the LEAST operational overhead?

A company has deployed a web application behind an Application Load Balancer (ALB) with an Auto Scaling group. Users report that the application is slow during peak hours. The CPU utilization of the EC2 instances is consistently below 40%, but the ALB's request count per target is high. Which action would MOST improve performance?

A company manages multiple AWS accounts and wants to centralize billing and cost tracking. They have enabled AWS Organizations and consolidated billing. Which additional step should they take to gain granular visibility into costs per department?

A company has attached the above bucket policy to an S3 bucket. The bucket is accessed by an application running on an EC2 instance in the same AWS account. The EC2 instance is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678) to access the bucket. The application is failing to get objects from the bucket. What is the most likely cause?

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in the organization are encrypted at rest. Which TWO approaches can the company use to achieve this? (Choose TWO.)

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets have server-side encryption enabled. How can the company enforce this across all existing and future buckets?

A company uses AWS Organizations and wants to centrally manage Amazon GuardDuty across all accounts. Which TWO steps are required to enable GuardDuty in all accounts from a single management account?

A company uses AWS Organizations and wants to enable cost allocation across business units using tags. They require that all resources are tagged with a 'CostCenter' tag. What is the most effective way to enforce this?

Refer to the exhibit. A company has an SCP named 'DenyOutsideRegions' attached to the root OU. The SCP is intended to deny all actions outside us-east-1 and eu-west-1. However, users in a member account are still able to launch EC2 instances in ap-southeast-1. What is the most likely reason?

A company is managing multiple AWS accounts using AWS Organizations. They want to centralize the management of EC2 instances and enforce tagging standards across all accounts. Which TWO approaches should they use?

Match each AWS disaster recovery strategy to its description.

A company is migrating a 10 TB SQL Server database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. The source database is running on-premises with a 1 Gbps network link to AWS. Which strategy should be used to reduce the migration downtime?

A startup is building a serverless application using AWS Lambda. They need to store session state that can be shared across multiple Lambda invocations. Which AWS service should they use?

A company is designing a new microservices architecture on AWS. Each service needs to store and retrieve small amounts of configuration data (under 10 KB per item) with low latency. The data is accessed frequently and must be highly available across multiple Availability Zones. Which AWS service should be used?

A company uses AWS CloudTrail to log API activity. The compliance team requires that logs be stored for 7 years and be immediately accessible for the first 90 days, after which access can take up to 12 hours. Which storage solution meets these requirements cost-effectively?

A company is designing a new application on AWS that uses Amazon API Gateway and AWS Lambda to expose a RESTful API. The API must authenticate requests using OAuth 2.0 with an external identity provider (IdP). The company wants to offload the authentication logic to the API Gateway. Which API Gateway feature should they use?

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for all accounts. The flow logs should be sent to a central S3 bucket in the logging account. The solution must be automated for new accounts added to the organization. What should the team do?

A company uses Amazon CloudFront with an S3 origin to serve static content. They recently updated the content in S3, but users still see the old files. What is the MOST likely reason?

A company runs a critical database on an Amazon RDS for PostgreSQL instance. The database experiences high write latency during peak hours. The company wants to improve write performance without changing the application code. Which action should the Solutions Architect take?

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet compliance requirements that logs be immutable and stored for 7 years. Which THREE services should be combined to achieve this?

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

Which TWO actions should a company take to implement a least-privilege access model across multiple AWS accounts? (Choose TWO.)

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?

A company is designing a new application on AWS that requires high availability and disaster recovery across multiple AWS Regions. The application uses an Amazon RDS for MySQL database. Which TWO strategies should they implement to meet these requirements?

A company wants to reduce costs for a batch processing workload that runs nightly on Amazon EMR. The workload is fault-tolerant and can handle interruptions. Which TWO strategies should they implement? (Choose TWO.)

A DevOps engineer notices that an EC2 instance is running but is not reachable via SSH. The instance was launched with a security group that allows SSH from anywhere (0.0.0.0/0). What is the most likely cause?

A company has a multi-tier application running on AWS. The web tier uses an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The application tier runs on a separate Auto Scaling group of EC2 instances. The database tier uses Amazon RDS for MySQL. During a recent load test, the application became unresponsive. Monitoring showed that the database's CPU utilization was at 100% and the number of database connections was at the maximum limit. The application tier instances were healthy, but the web tier instances were returning 503 errors. The Solutions Architect determined that the application tier was making too many database connections because each request opened a new connection and did not close it properly. The team wants to fix the issue with minimal changes to the application code. Which solution should the Solutions Architect recommend?

A company is designing a new serverless application that processes orders from an e-commerce website. The application uses AWS Lambda functions that are invoked by Amazon API Gateway. The company expects a sudden spike in traffic during a flash sale. Which TWO strategies should be used to ensure the application can handle the spike without errors? (Choose two.)

A company attaches the IAM policy shown in the exhibit to an IAM user. The user tries to upload an object to my-bucket using the AWS CLI without the --ssl flag (i.e., using HTTP). What will happen?

A company uses AWS Organizations with a central logging account. They want to ensure that all VPC Flow Logs from member accounts are published to a central S3 bucket in the logging account. Which steps are required?

Refer to the exhibit. A company is using AWS Migration Hub to track migrations. The above IAM policy is attached to an IAM role used by the migration tool. The migration tool reports that it cannot register the migration task with Migration Hub. Which action should the company add to the policy to fix the issue?

A company is deploying a containerized microservices architecture on Amazon ECS with Fargate. They need to securely store and rotate database credentials. Which AWS service should they use?

A company is using AWS Organizations with a set of member accounts that need to access a shared Amazon S3 bucket in the master account. The bucket policy allows access only from the member accounts' root user. However, developers in member accounts are unable to access the bucket even when they assume an IAM role. What is the most likely cause?

A media company delivers video content to a global audience using Amazon CloudFront, AWS Lambda@Edge, and Amazon S3. The origin is an S3 bucket that stores video files. Recently, users in Asia-Pacific report slow load times. The operations team checks CloudFront metrics and sees a high cache miss rate for content popular in that region. The team wants to improve performance for all users without significantly increasing costs. The application uses a single CloudFront distribution with a default cache behavior. The S3 bucket is in us-east-1. Which solution should the team implement?

A company is designing a serverless data processing pipeline. An AWS Lambda function processes records from an Amazon Kinesis Data Stream. The function runs for an average of 30 seconds per record, and the stream has 10 shards. The company expects a sustained load of 5,000 records per second. What is the primary consideration to ensure the Lambda function can scale to handle the load?

A company is designing a real-time analytics pipeline for IoT data. They need to ingest millions of messages per second, process them with low latency, and store results in Amazon S3. Which combination of services should they use?

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. How should they configure this?

A company is migrating a critical application to AWS using a lift-and-shift approach. The application runs on two on-premises servers: a web server and a database server running SQL Server. The company has deployed the web server on an EC2 instance behind an Application Load Balancer, and the database on an RDS for SQL Server Multi-AZ instance. After migration, users report that the application is noticeably slower compared to on-premises. The application uses a large number of database transactions, and latency between the web server and database has increased. The web server is in us-east-1a, and the RDS primary instance is in us-east-1b. The solutions architect verifies that the application is using the RDS endpoint, not the IP address. What should the architect do to reduce latency?

A multinational company is adopting AWS Organizations to manage multiple accounts across business units. The security team requires that specific IAM roles be automatically deployed to all existing and future member accounts. Which solution should the company use?

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic to tasks. The company has configured an Auto Scaling target tracking policy based on average CPU utilization. During a marketing campaign, traffic spikes cause the ALB to return 503 errors. The ECS service dashboard shows that the number of tasks scaled out to the maximum allowed but the CPU utilization remained high. What is the MOST likely cause of the 503 errors?

A company is implementing a data lake on AWS using Amazon S3 as the storage layer. The data lake must support multiple consumer accounts within the organization. The security team requires that data is encrypted at rest using AWS KMS with customer-managed keys (CMKs) and that access to the keys is strictly controlled. Which THREE steps should be taken to meet these requirements?

A company has multiple business units, each with its own AWS account. They want to enforce that all EC2 instances launched across accounts use only approved AMIs. The AMIs are stored in a central account. What is the MOST scalable and secure way to enforce this?

Match each AWS service to its primary use case.

A company uses AWS Elastic Beanstalk to deploy a web application. They want to update the environment's configuration to use a larger instance type without any downtime. Which update policy supports this?

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use for message brokering?

Which TWO actions improve the security of an Amazon S3 bucket that stores sensitive data?

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must block public access. How can this be enforced centrally with minimal operational overhead?

An administrator runs the above commands on an S3 bucket. What is the effect of these configurations on an object uploaded to the bucket?

A multinational company is implementing a multi-account strategy using AWS Organizations. The security team needs to ensure that all newly created accounts automatically have a specific baseline CloudTrail trail and a set of AWS Config rules applied. The company also wants to enforce that no account can disable these controls. Which solution should be used?

A company is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The API must be secured using AWS WAF. Which TWO actions should the company take to integrate WAF with API Gateway? (Choose TWO.)

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to implement a change management process that requires approval before stack updates can proceed. Which TWO approaches can achieve this?

A company wants to implement a serverless architecture where an AWS Lambda function is triggered whenever a new object is uploaded to an S3 bucket. Which S3 feature should they use?

An administrator attempts to start an EC2 instance that was previously stopped. The instance fails to start. The administrator runs the CLI command shown in the exhibit. What is the most likely cause of the failure?

A company is migrating a legacy Windows application to AWS. The application requires a shared file system accessible from multiple EC2 instances. Which AWS storage solution should the company use?

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The company wants to reduce operational overhead and achieve high availability. Which database strategy should the company adopt for the microservices?

A company is designing a new application that will process streaming data from IoT devices. The data must be processed in real time and then stored in Amazon S3 for long-term analytics. Which combination of AWS services should be used?

A company has a multi-account AWS environment and wants to centralize the management of IAM roles. The security team needs to ensure that all IAM roles across all accounts trust the same identity provider (IdP) for federated access. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which solution should be implemented?

A company is migrating an application that uses an S3 bucket to store user uploads. The IAM policy above is attached to the application's IAM role. The application is experiencing permission errors when trying to list objects in the bucket. What is the most likely cause?

A company uses AWS CodeCommit to store source code and CodePipeline for CI/CD. The pipeline includes a build stage using CodeBuild and a deploy stage to Elastic Beanstalk. The team wants to add a manual approval step before deployment to production. Which THREE resources are needed? (Choose three.)

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts have server-side encryption with AWS KMS (SSE-KMS) enabled, and any new bucket that does not comply must be automatically remediated. Which design should be used?

A company is migrating an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. They need to minimize downtime and ensure data consistency. Which AWS service should they use for the migration?

A company is designing a serverless data processing pipeline using AWS Lambda to process messages from an Amazon SQS queue. The messages are generated by thousands of IoT devices. The architect needs to ensure that messages are processed in order within each device's stream and that failures are handled without data loss. Which combination of services should the architect use?

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

A company is designing a new global application that will serve users worldwide. The application uses an Application Load Balancer (ALB) in a single region. To reduce latency for users in other regions, the company wants to cache static content at edge locations. The dynamic content must still be served from the ALB. Which configuration should be used?

A large enterprise is migrating to AWS and wants to implement a multi-account strategy with centralized network connectivity. The company has multiple VPCs in various accounts that need to communicate with each other and with on-premises resources. The solution must be scalable and minimize operational overhead. Which design should be used?

A company is using AWS Lambda functions to process files uploaded to an S3 bucket. Recently, the processing time has increased significantly. A solutions architect notices that the Lambda functions are using the default VPC configuration. What is the MOST likely cause of the performance degradation?

A financial services company needs to store transaction records for 7 years to meet regulatory requirements. The records must be retrievable within 24 hours of a request. The volume of data is 10 TB per year. Which storage solution is MOST cost-effective?

A company is migrating a monolithic application to AWS. The application consists of a web server, an application server, and a MySQL database. The web server and application server run on the same EC2 instance. The company wants to minimize changes during migration. Which migration strategy should the architect recommend?

A company uses AWS Organizations with a multi-account strategy. They want to allow a centralized DevOps team to manage EC2 instances across all accounts using AWS Systems Manager. The DevOps team should not have direct IAM access to the target accounts. How can this be achieved?

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has strict latency requirements and must be deployed across multiple Availability Zones. Which design strategy BEST meets these requirements while minimizing operational overhead?

A company is designing a new hybrid cloud architecture that extends on-premises storage to AWS. The solution must provide low-latency access to frequently accessed data and use AWS storage for backup. Which TWO services should be used together?

A company is designing a new cloud-native application that will be deployed across multiple AWS Regions for high availability. The application uses Amazon Aurora Global Database for its primary data store. The company needs to ensure that in the event of a regional failure, the secondary region can be promoted to primary with minimal data loss. Which configuration should be used?

A company is deploying a web application that uses an Application Load Balancer and an Auto Scaling group of EC2 instances. The application must be able to handle sudden spikes in traffic. Which TWO actions should the Solutions Architect take to improve scalability and reduce latency? (Choose two.)

A company is designing a new application that will process real-time streaming data from thousands of IoT devices. The data must be ingested, processed with low latency, and stored in Amazon S3 for analytics. Which combination of AWS services should the company use to meet these requirements?

A company runs a critical web application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer (ALB) with a target group that has health checks configured. Recently, the operations team noticed that during a deployment, the ALB started routing traffic to a new instance before it was ready to serve requests, causing a brief period of errors. The team wants to ensure that new instances are fully initialized and ready before receiving traffic. The application takes about 30 seconds to start up. Current health check settings: health check protocol HTTP, path /, interval 30 seconds, timeout 5 seconds, healthy threshold 2, unhealthy threshold 2. The deployment uses the Auto Scaling group's instance refresh feature. Which of the following is the MOST effective way to prevent traffic from being sent to instances that are not ready?

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web tier, an application tier, and a database tier. The company wants to decouple the tiers to improve scalability and resilience. Which AWS service should the company use to send messages from the web tier to the application tier asynchronously?

A company is migrating a legacy Java-based customer relationship management (CRM) system from on-premises to AWS. The application currently runs on a single physical server with a monolithic architecture. The application stores data in an Oracle database on a separate server. The company has purchased a third-party migration tool that can convert Oracle stored procedures to Amazon Aurora PostgreSQL-compatible code. The migration team has successfully migrated the database to Aurora PostgreSQL using AWS DMS with ongoing CDC. The application now runs on a single EC2 instance in a test environment. However, during load testing, the application experiences high latency and intermittent timeouts when accessing the database. The team notices that the application makes many short-lived database connections and uses a connection pool that was configured for the on-premises environment. The team has also observed that the application logs show a high number of connection timeouts. The company wants to modernize the application to be highly available and scalable on AWS. Which combination of actions should the team take to resolve the performance issues and achieve the company's goals?

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to store persistent data that must be shared across multiple containers in the same task. Which storage option should the company use?

A company wants to centralize AWS CloudTrail logs from all accounts in AWS Organizations into a single S3 bucket. Which configuration is required?

A company is replatforming a legacy application to use AWS managed services. The application consists of a web server, an application server, and a MySQL database. Which THREE AWS services should the company use to modernize the architecture? (Choose THREE.)

A company uses a single AWS account for development and production workloads. To improve security and cost allocation, the company decides to separate environments into multiple accounts. What is the PRIMARY benefit of using multiple accounts?

A company wants to centrally manage IAM users across multiple AWS accounts using AWS IAM Identity Center (successor to AWS Single Sign-On). Which of the following are true? (Choose TWO.)

A company is designing a new application on AWS that requires a highly available and fault-tolerant architecture. Which TWO design principles should they follow?

A company wants to centralize management of Amazon EC2 instances across multiple AWS accounts. They need to be able to run commands on instances in any account from a central management account. Which service should be used?

A company is designing a new solution to host a static website with global audience. The website content includes HTML, CSS, JavaScript, and images. The company wants to minimize latency for users worldwide and reduce the load on the origin server. The origin server is an Amazon S3 bucket configured for static website hosting. Which solution should be used to achieve these goals?

A company uses AWS Organizations with multiple accounts. The network team wants to centrally manage Amazon VPC IP addresses using Amazon VPC IP Address Manager (IPAM). They have enabled IPAM in the management account and delegated an administrator account. However, the delegated administrator account cannot create IPAM pools. What is the most likely cause?

A company uses AWS Lambda functions to process orders. Recently, some orders have been lost due to Lambda throttling. The operations team wants to implement a solution to capture failed invocations and retry them. What is the MOST reliable approach?

A company is planning to migrate a large .NET application to AWS. The application uses IIS and SQL Server. Which TWO AWS services can be used to rehost the application with minimal changes?

A company is migrating a critical application to AWS and wants to ensure business continuity during the cutover. The migration plan includes a pilot light strategy. Which of the following BEST describes the pilot light pattern?

Match each AWS migration service to its function.

A company is migrating a legacy monolithic application to AWS. They plan to use Amazon ECS with Fargate for containerized microservices. The application requires sticky sessions and SSL termination. What should the company use to meet these requirements?

A company is migrating a critical application to AWS. The application must be highly available across two Availability Zones. The migration plan includes rehosting the application on EC2 instances in an Auto Scaling group behind an ALB. Which configuration ensures that the application remains available during an Availability Zone failure?

A company uses AWS Organizations and wants to centrally manage AWS Config rules across all member accounts. They have enabled AWS Config in the management account and used AWS Config aggregator to view compliance status across accounts. However, they want to enforce a specific Config rule in all accounts automatically. Which solution should they use?

A company is migrating a multi-tier application to AWS and wants to modernize by using containers and serverless technologies. The application consists of a Node.js frontend, a Java backend, and a PostgreSQL database. The company wants to reduce operational overhead and improve scalability. Which TWO strategies should the company use? (Choose two.)

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. The team wants to automatically remediate any non-compliant buckets created in the future. Which solution is MOST effective and requires the least ongoing maintenance?

A company is designing a new application that requires a fully managed NoSQL database with single-digit millisecond latency. The application needs to handle sudden spikes in read traffic without manual intervention. Which AWS service should the company choose?

A company uses AWS Organizations with a multi-account strategy. The security team wants to restrict the use of specific instance types across all accounts. What is the MOST effective way to enforce this policy?

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all CloudTrail logs from all accounts are delivered to a single S3 bucket in the logging account. The logging account's S3 bucket policy allows CloudTrail to write logs from other accounts. The CloudTrail trail in each account is configured to deliver to the centralized bucket. However, logs from some accounts are not appearing. The security team has verified that the IAM permissions for CloudTrail are correct. What is the most likely reason for the missing logs?

A company is designing a multi-region disaster recovery solution for a stateful web application on Amazon EC2 with an Amazon Aurora MySQL database. The RPO must be less than 1 second and RTO less than 5 minutes. The application uses a custom TCP port 8080. What is the MOST cost-effective architecture?

A company is migrating a Windows-based .NET application to AWS. The application uses SQL Server for its database and stores documents on a Windows file share. The company wants to adopt a hybrid model initially, where the application runs on AWS but still connects to on-premises resources for legacy integration. The migration must use a phased approach: first move the compute to AWS, then the database, and finally the file storage. The company has high latency to the internet and wants to optimize data transfer. You have set up a Direct Connect connection. During the first phase, you migrate the web and application servers to Amazon EC2 Windows instances. You need to ensure that the EC2 instances can access the on-premises SQL Server and file share securely. Which combination of actions should be taken?

A company is planning to migrate a three-tier web application to AWS. The application consists of a web server, an application server, and a MySQL database. The company wants to minimize operational overhead and improve scalability. Which THREE AWS services should the company use to modernize the architecture? (Choose THREE.)

A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?

Refer to the exhibit. A company has created a CloudTrail trail named 'my-trail' in the management account of AWS Organizations. The trail is configured to deliver logs to a central S3 bucket. The security team wants to capture all management events from all accounts in the organization. Based on the exhibit, what is the most likely issue?

A company is using an AWS Lambda function to process records from an Amazon Kinesis stream. The function stores results in an Amazon DynamoDB table. The team notices that the Lambda function sometimes fails due to throttling from DynamoDB. Which TWO actions should the team take to improve the continuous processing of records? (Choose TWO.)

A company runs a critical application on Amazon RDS for PostgreSQL. The database performance has degraded over time. The Solutions Architect notices that read queries are slow and the DB instance's ReadIOPS metric is consistently high. Which action would improve read performance with minimal operational overhead?

A company is migrating a legacy on-premises application to AWS. The application uses a proprietary database that is not supported by Amazon RDS. The migration must minimize downtime and require minimal changes to the application. Which migration strategy should the company use?

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no IAM role in any member account can be assumed by a user from outside the organization. Which policy should be used?

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 100 Mbps internet connection. The migration must be completed within a week and have minimal downtime. Which AWS service should the company use to transfer the initial database dump to AWS?

A company is planning to migrate a workload to AWS and needs to estimate the total cost of ownership (TCO) compared to on-premises. Which TWO AWS tools can be used to perform this analysis?

A global company uses AWS Organizations with multiple business units. Each business unit has its own OU and VPCs that need to communicate with a central shared services VPC. The network team wants to minimize latency and maximize throughput. Which design should they use?

A company is designing a cost-effective architecture for a batch processing job that runs nightly. The job can tolerate interruptions and requires significant compute power for a few hours. The company wants to minimize costs. Which TWO strategies should the company use?

A company runs a production AWS environment with Amazon EC2 instances managed by Auto Scaling groups. The operations team notices that after a recent deployment, the application is returning higher error rates. Which TWO steps should the team take to enable a quick rollback and improve future deployments?

A company uses AWS Lambda functions to process files uploaded to an S3 bucket. The processing time varies, but some files fail with a timeout error. The function has the default timeout setting. What is the MOST cost-effective way to resolve this issue?

A security engineer created the above bucket policy on the central-logging-bucket in account 111111111111. They want account 222222222222 to deliver CloudTrail logs to this bucket. What is missing?

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket with versioning enabled and a DeletionPolicy of Retain. The stack is deleted. What happens to the bucket and its objects?

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required?

A company is designing a new multi-tier web application on AWS. The application consists of a public-facing Application Load Balancer, a fleet of EC2 instances in private subnets, and an RDS database in a private subnet. The security team requires that all traffic between the ALB and EC2 instances be encrypted, and that the EC2 instances have no direct internet access. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

A company is using Amazon CloudFront to deliver static content from an S3 bucket. The company wants to ensure that users can only access content through CloudFront and not directly from the S3 bucket. What should the company do?

A company is migrating a web application to AWS and wants to use a containerized architecture. The application consists of multiple microservices that communicate via REST APIs. The company needs a solution that minimizes operational overhead for managing containers and orchestrating microservices. Which AWS service should the company use?

A startup needs a serverless compute service to run code in response to S3 events. The code should execute within milliseconds and require no server management. Which AWS service should be used?

A company is using AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have a specific AWS Config rule enabled and that any drift is automatically remediated. Which approach should be used?

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

A company uses AWS Organizations and wants to establish a central logging solution. They need to collect CloudTrail logs from all accounts and store them in a central S3 bucket in the management account. Which TWO steps are required to achieve this?

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The Lambda function processes messages from an SQS queue and writes to DynamoDB. The company expects unpredictable traffic spikes and must ensure that messages are not lost. Which configuration should the company use to meet these requirements?

A company is migrating a large-scale, stateful application to AWS. The application maintains session state in memory on the current on-premises servers. The company needs a solution that preserves session state during migration and minimizes latency for users worldwide. Which strategy should the company use?

A company needs to provide temporary, limited-privilege credentials to mobile app users to access AWS resources. Which AWS service should the architect recommend?

A company is designing a new application that will store sensitive user data in an Amazon RDS for PostgreSQL database. The data must be encrypted at rest and in transit. The company also requires automated backups with a retention period of 35 days. What is the MOST secure and cost-effective configuration?

A company has a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences occasional timeouts during peak hours. After reviewing AWS X-Ray traces, the team finds that DynamoDB queries are slow. Which THREE actions should the team take to improve performance and continuously optimize the solution?

A multinational corporation is migrating to AWS and needs to manage permissions across multiple accounts using AWS IAM Identity Center (successor to AWS SSO). The company has a central identity source in Microsoft Active Directory. They need to grant different levels of access to users based on their job function. Which combination of AWS services will provide the most scalable and maintainable solution?

A company has a multi-account AWS environment with a shared services account that hosts Active Directory for authentication. Developers need to launch EC2 instances in development accounts and join them to the domain. What is the most secure way to allow this?

A company is building a new data analytics platform on AWS. The platform ingests streaming data from multiple sources, processes it in real time, and stores the results in Amazon S3 for later analysis. The data volume is expected to be up to 50 GB per day. The company needs to choose a service for real-time stream processing. Which AWS service is most appropriate for this use case?

A company has a central IT team that manages AWS Organizations. The development team needs to create and manage their own AWS accounts for new projects. What is the BEST way to automate account creation while maintaining governance?

A media company uses S3 for storing video files and CloudFront for distribution. They implemented a Lambda@Edge function to add copyright headers. After deployment, some users report that older videos still lack the headers. What is the most likely reason?

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The directory will be used for authentication across multiple VPCs in different accounts. The company needs to ensure that resources in all VPCs can resolve DNS names from the directory. What is the MOST scalable and secure solution?

A company is migrating a legacy application to AWS. The application runs on Windows Server and uses a shared file system for storage. The company wants to modernize the application by using a managed file storage service that is POSIX-compliant and can be accessed by multiple EC2 instances concurrently. Which TWO AWS services meet these requirements? (Choose TWO.)

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in two AWS Regions. The company needs to ensure that if one region becomes unavailable, traffic is automatically routed to the healthy region with minimal disruption. Which configuration meets these requirements?

A company is migrating its application stack from on-premises to AWS using a rehost strategy. The stack includes a web server, an application server, and a MySQL database. The company wants to automate the migration using AWS Application Migration Service (MGN). After configuring MGN, the web server test instance fails to start because the boot volume is missing the boot sector. What is the most likely cause?

A company is deploying a web application on AWS that requires a relational database. The application is read-heavy and expects sudden spikes in traffic. The database must be highly available and perform well under load. Which database configuration meets these requirements?

A company has a data lake on Amazon S3 that is accessed by multiple business units via VPC endpoints. The security policy mandates that all access to the data lake must be encrypted in transit and originate from approved VPCs. The company has a central security account that manages AWS Network Firewall. Which combination of controls should be implemented to enforce this policy? (Choose TWO.)

A company is designing a new multi-region disaster recovery solution for a critical database. The database runs on Amazon RDS for MySQL in us-east-1. The recovery point objective (RPO) is 1 second, and the recovery time objective (RTO) is 1 minute. Which strategy meets these requirements?

A company needs to design a disaster recovery (DR) solution for a critical database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 5 minutes. The primary region is us-east-1. Which solution meets these requirements?

A company uses a cross-account IAM role 'LogDelivery' in account 111122223333 to write logs to an S3 bucket 'my-company-logs' in a logging account. The bucket policy is shown above. Logs are not being delivered. What is the MOST likely issue?

A company has a legacy application that runs on an EC2 instance with a large attached EBS volume. The application writes log files to the volume, and the volume is frequently full, causing application errors. The Solutions Architect needs to implement a solution to automatically manage disk space without application changes. Which solution meets these requirements?

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS MySQL instance. The stack template defines the DBInstanceClass as db.t3.medium. After deployment, the database performance is insufficient for the workload. The company wants to change the instance class to db.r5.large without recreating the database. What should they do?

A company deploys the above CloudFormation template. After deployment, an EC2 instance launched in mySubnet can access the internet. However, the instance cannot receive inbound traffic from the internet. What is the MOST likely reason?

Refer to the exhibit. A company configured an Amazon Route 53 alias record for a domain name pointing to an Application Load Balancer (ALB). Users report that occasionally they are directed to an unhealthy ALB node. Which change should the company make to improve availability?

A company has a centralized IT team that manages AWS accounts for multiple departments. They need to grant the team permissions to create and manage IAM roles in all accounts, but without giving them full administrator access. What should they use?

A startup wants to deploy a web application on AWS with a serverless architecture. The application includes static content (HTML, CSS, JS) and a REST API backend using Lambda and DynamoDB. The company wants low latency and high availability globally. Which combination of services should they use?

A company runs a production web application on EC2 instances in an Auto Scaling group behind an ALB. The application logs are stored on an EBS volume attached to each instance. The operations team notices that the logs are not being sent to a central location. What is the MOST efficient way to centralize log collection with minimal code changes?

A company runs a monolithic application on a single EC2 instance. The application is critical and must be highly available. The company wants to migrate to a containerized architecture on Amazon ECS with minimal downtime. Which approach should the company take?

A company is migrating a 3-tier web application from on-premises to AWS. The application consists of a Linux Apache HTTP server, a Java application server (Tomcat), and a MySQL database. The company wants to use AWS managed services to reduce operational overhead. The migration plan includes using AWS Elastic Beanstalk for the web and application tiers, and Amazon RDS for MySQL for the database. During a test migration, the team notices that the application is experiencing intermittent connection timeouts when the web tier attempts to connect to the application tier. The web and application tiers are deployed in separate Elastic Beanstalk environments, both in the same VPC, same region, and same Availability Zone. The security groups allow traffic from the web tier to the application tier on port 8080. What is the MOST likely cause of the connection timeouts?

A company is migrating its on-premises file server to Amazon FSx for Windows File Server. The company has 2 TB of data and a 100 Mbps internet connection. The migration must be completed within 5 days. What should the company do?

A company is designing a new microservices architecture on AWS. Each microservice is deployed as a containerized application and must be able to scale independently. The company wants to minimize operational overhead for managing the containers and the underlying infrastructure. Which solution should the architect recommend?

A company is designing a multi-region disaster recovery solution for a stateless web application running on Amazon ECS Fargate. The application uses an Application Load Balancer and stores session data in Amazon ElastiCache for Redis. The company needs to achieve an RPO of 15 minutes and an RTO of 30 minutes. What is the MOST cost-effective design that meets these requirements?

A company is migrating a legacy monolithic application to AWS. They want to refactor the application into microservices and use container orchestration. Which AWS service should they use to manage the containers?

A company uses AWS Config to record resource changes. The security team wants to be notified when an S3 bucket policy changes to allow public access. What is the most efficient way to achieve this?

Which THREE factors should be considered when designing a VPC for a new application that must be compliant with the Payment Card Industry Data Security Standard (PCI DSS)? (Choose three.)

A company has a multi-account AWS environment with a centralized security account. The security team wants to ensure that any IAM role created in any account with a trust policy allowing access from another AWS account must be approved by the security team. Which approach should be used?

A company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled and block public access. Which TWO actions should be taken to enforce these requirements centrally?

A company uses AWS Organizations and has a requirement that all Amazon S3 buckets must have versioning enabled. The company wants to automatically enable versioning on any bucket that is created without it. Which solution should be implemented?

A company is migrating a legacy application to AWS. The application uses a custom authentication mechanism that relies on LDAP. The company wants to minimize changes to the application. Which THREE services should the company consider for integrating LDAP authentication? (Choose THREE.)

A company uses AWS CloudFormation to deploy infrastructure. The operations team notices that stack updates frequently fail because of updates to resources that are not supported for updates. What is the BEST way to handle this?

A company uses AWS Lambda functions to process events from an SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a high volume of messages, and the Lambda function is experiencing throttling errors. What is the most cost-effective solution to reduce throttling?

Refer to the exhibit. An EC2 instance in subnet-11111 (10.0.1.0/24) cannot access the internet. The route table for the subnet is shown. What is the MOST likely cause?

A company is using Amazon RDS for MySQL and needs to capture slow query logs for performance tuning. The logs must be stored for 30 days for analysis. What is the MOST cost-effective way to achieve this?

A company is planning to migrate a legacy application to AWS. The application runs on a single server with a monolithic architecture and uses an Oracle database. The migration team wants to reduce licensing costs and improve scalability. Which TWO strategies should the team consider?

A company is deploying a containerized application on Amazon EKS. The application needs to access an Amazon RDS database. The security team requires that database credentials be rotated automatically and never stored in plaintext. Which solution should the architect use?

A company is designing a centralized logging solution for multiple AWS accounts. They need to aggregate VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts into a single S3 bucket. Which AWS service should be used to centralize the log collection?

A large enterprise with multiple business units (BUs) uses AWS Organizations with a shared services account and BU-specific accounts. Each BU account has a VPC with multiple subnets. The shared services account hosts a central NAT gateway that provides outbound internet access to all BU private subnets via VPC peering. Recently, the network team noticed that traffic from one BU's private subnet is being blocked by the security group in the shared services account. They verified that the route tables are correctly configured. What is the most likely cause and solution?

A company is using AWS Organizations with consolidated billing. They want to track costs by department, where each department has its own AWS account. Which service should they use to tag resources with department IDs and view cost breakdowns?

A CloudFormation stack output is as above. The company wants to use the SQS queue URL in another stack. Which intrinsic function should be used to reference the queue URL in the second stack?

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances must use a specific AMI ID that is approved by the security team. Which two actions should the team take to achieve this? (Choose two.)

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences occasional read replica lag of up to 5 seconds. The application requires read-after-write consistency. Which action should the company take to improve the solution?

A company runs a global application on AWS spanning multiple regions. They need to enforce that IAM users in specific accounts can only launch EC2 instances in approved regions. The company uses AWS Organizations. What is the most effective way to enforce this?

A company is building a serverless application using AWS Lambda. The application processes files uploaded to an S3 bucket. Each file can be up to 500 MB, and processing takes up to 10 minutes. The Lambda function must be triggered as soon as a file is uploaded. Which configuration should they use?

A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)

A company is using AWS Organizations to manage multiple accounts. The security team requires that all newly created member accounts automatically have an AWS Config rule enabled that checks whether S3 buckets have default encryption enabled. Which solution should be used?

A small business wants to host a simple static website on AWS. The website consists of HTML, CSS, JavaScript, and images. The company expects low traffic and wants to minimize costs. The website must be highly available and load quickly for users globally. Which solution should a Solutions Architect recommend?

A company is designing a new solution to securely store and manage secrets for applications running on AWS. The secrets include database credentials, API keys, and OAuth tokens. The solution must automatically rotate secrets and integrate with AWS services like Amazon RDS. Which AWS service should be used?

A company uses AWS CloudFormation to deploy a multi-tier application. The deployment includes an Application Load Balancer, Auto Scaling group, and Amazon RDS database. The company wants to ensure that updates to the database do not cause downtime. Which TWO strategies should the company use? (Choose two.)

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must maintain session state. The company expects steady traffic with occasional spikes. Which solution is MOST scalable and cost-effective?

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that no S3 buckets in any account are publicly accessible. Which TWO services can the team use to achieve this?

A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?

A company is migrating a multi-tier web application to AWS. The application uses sticky sessions (session affinity). The company wants to use an Application Load Balancer (ALB). How should the architect configure the ALB to support sticky sessions?

A company is migrating a legacy .NET application to AWS. The application currently uses Windows Authentication and a SQL Server database. The company wants to reduce licensing costs and use managed services where possible. The migration should minimize code changes. Which combination of services meets these requirements?

A company wants to implement a data perimeter across all AWS accounts to prevent data exfiltration. Which TWO strategies should the company use? (Choose TWO.)

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket. The logging accounts are part of an AWS Organization. Which approach should be used to allow CloudTrail to deliver logs from all accounts to the central bucket?

A company is designing a multi-region active-active application using Amazon Route 53, Application Load Balancers, and Auto Scaling groups. They need to route users to the closest region with the lowest latency. Which routing policy should they use?

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function that transcodes the video into multiple formats using FFmpeg. The transcoding job runs on the Lambda function with a 15-minute timeout. Recently, the company started receiving 4K videos that take more than 15 minutes to transcode. The Lambda function times out, and the video is not processed. The company wants to process these large videos without increasing the Lambda timeout and without rewriting the entire pipeline. What should the solutions architect do?

A company is designing a data lake on AWS using Amazon S3. The data lake will store petabytes of data from various sources. The company needs to query the data using Amazon Athena and Amazon Redshift Spectrum. The data is highly compressed and stored in Parquet format. Which storage class should be used to minimize costs while maintaining immediate query performance?

A company uses AWS CloudFormation to deploy resources. The operations team notices that some stack updates fail due to resource conflicts. What is the BEST practice to minimize such failures?

Which TWO AWS services can be used to monitor and troubleshoot network connectivity issues between EC2 instances? (Choose two.)

A company with multiple AWS accounts wants to centrally manage network security policies. The security team needs to inspect all traffic between VPCs in different accounts and block malicious traffic. Which solution is MOST operationally efficient?

A company is migrating a large-scale application to AWS. The application uses a message queue for decoupling components. The current on-premises solution uses RabbitMQ. The company wants a managed service that supports message durability and at-least-once delivery. Which THREE AWS services meet these requirements? (Choose THREE.)

A company runs a web application on EC2 instances behind an ALB. They want to improve the security posture by implementing defense in depth. Which TWO measures should they implement? (Choose TWO.)

A company is migrating a batch processing workload to AWS. The workload reads input files from an on-premises NFS server, processes them, and writes output files. The company wants to use AWS managed services and minimize operational overhead. Which TWO AWS services should the company use to replace the on-premises NFS server? (Choose TWO.)

A company uses AWS Organizations and wants to allow certain accounts to use AWS Service Catalog for self-service provisioning. The IT team needs to control which products are available. Where should the product portfolio be shared?

A company runs a batch processing job on Amazon EMR every night. The job processes data from an S3 bucket and writes results to another S3 bucket. The job currently takes 6 hours to complete. The company wants to reduce the runtime to under 2 hours to meet a new SLA. The data volume is expected to grow by 20% each month. The EMR cluster uses a single master node and 10 core nodes of type m5.xlarge. The job is CPU-bound. What should they do?

A company runs a critical e-commerce platform on AWS. The application is deployed across multiple Availability Zones in a single region (us-east-1). The architecture includes an Application Load Balancer (ALB), an EC2 Auto Scaling group, and an Amazon RDS for MySQL Multi-AZ database. The application experiences periodic spikes in traffic, and the Auto Scaling group scales out successfully. However, during a recent traffic spike, the database CPU utilization reached 90%, causing increased latency and some database connection timeouts. The company needs to improve the database performance to handle the spikes without over-provisioning. The solutions architect must design a solution that reduces the load on the primary database instance and improves read scalability. The application is read-heavy, with a read-to-write ratio of 80:20. Which solution should the architect implement?

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to use AWS Transit Gateway to connect VPCs across accounts. The network team has created a Transit Gateway in the network account and shared it using AWS Resource Access Manager (RAM) with the workload accounts. The workload accounts have created VPC attachments to the Transit Gateway. However, traffic is not flowing between the VPCs. The route tables in the workload VPCs have routes pointing to the Transit Gateway. What is the most likely cause?

Which TWO of the following are best practices for migrating a large-scale relational database to Amazon Aurora using AWS DMS? (Choose two.)

A company runs a data processing pipeline on AWS using AWS Glue and Amazon Redshift. Recently, the pipeline has been failing due to insufficient memory in the Glue job. The team wants to improve the pipeline to handle larger datasets without manual intervention. Which solution is MOST cost-effective?

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application data is stored on Amazon EBS volumes. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. Which TWO actions should the company take to meet these objectives? (Choose two.)

A company wants to centralize management of AWS resources across multiple accounts using AWS Control Tower. What is a prerequisite for setting up Control Tower?

A company uses Amazon RDS for PostgreSQL with Multi-AZ and automated backups set to 35 days. The database experiences a sudden spike in write IOPS, causing performance degradation. The team needs to investigate the cause without affecting production. What should they do?

A company is migrating a large-scale batch processing workload to AWS. The workload runs on a schedule and processes terabytes of data. The migration must be cost-effective. Which AWS service is best suited for this workload?

A company is using Amazon RDS for MySQL and notices that read replicas are falling behind the primary. The primary instance is experiencing high write traffic. What is the best solution to reduce replica lag?

A solutions architect runs the command shown in the exhibit. Which statement is true about the output?

A company is using Amazon CloudFront to distribute content globally. They want to optimize cost and performance. Which TWO actions are recommended?

A company is migrating a critical application from on-premises to AWS. The application uses a Microsoft SQL Server database with Always On Availability Groups for high availability. The company wants to use Amazon RDS for SQL Server to reduce management overhead. The database size is 500 GB. The migration must have minimal downtime and support transactional consistency. The company has a VPN connection to AWS. Which migration strategy should the company use?

A company is using Amazon CloudFront with an S3 origin. They notice that users are receiving outdated content. What configuration change should be made to ensure users always get the latest content?

A company is migrating a legacy on-premises application to AWS. The application consists of a web server, an application server, and a MySQL database. The company has already migrated the web and application servers to EC2 instances in a VPC. The database is still on-premises. The application currently connects to the database using a JDBC connection string with the on-premises IP address. The company wants to minimize changes to the application code. The network team has established an AWS Direct Connect connection between the on-premises data center and the VPC. The security team requires that traffic between the application and the database be encrypted in transit. The database is not publicly accessible. The migration plan includes moving the database to Amazon RDS for MySQL in the same VPC after the initial cutover. During the migration testing phase, the application team reports that the application can connect to the on-premises database but performance is slower than expected. CloudWatch metrics show high latency on the database connections. The application uses a connection pool with 100 connections. Which solution should the solutions architect recommend to improve performance while minimizing application code changes?

A company is migrating a monolithic application to microservices on AWS. The application uses a shared MySQL database. The team wants to decouple the database per microservice. Which strategy should the team use to minimize downtime during migration?

A company has a centralized AWS account for managing Amazon Route 53 DNS. The company has 100 VPCs across multiple accounts, and each VPC needs to resolve private hosted zones in the central account. What is the most scalable solution to enable DNS resolution across accounts?

A company is running a production web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application uses a MySQL database hosted on Amazon RDS with Multi-AZ enabled. Recently, during a traffic spike, some users experienced increased latency and occasional 503 errors. The operations team noticed that the database CPU utilization reached 100% and the number of database connections peaked at the maximum limit. The application team confirmed that the application uses connection pooling on the EC2 instances but the pool size is fixed. Which solution should the solutions architect recommend to prevent recurrence?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available across multiple Availability Zones. Which TWO actions should the architect take? (Choose TWO.)

A media company is building a video transcoding pipeline using AWS Elemental MediaConvert. The source videos are uploaded to an S3 bucket, and the transcoded outputs are stored in another S3 bucket. The company wants to trigger the transcoding job as soon as a new video is uploaded. The pipeline must handle high volumes of uploads and ensure that no upload is missed. Which solution is MOST reliable and scalable?

A developer notices that CloudWatch Logs for a Lambda function show no logs after a recent deployment. The function is invoked successfully. What is the most likely cause?

A company uses AWS Organizations with a single OU for all accounts. The security team wants to prevent any account from leaving the organization without approval. What should they do?

A startup is deploying a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon DynamoDB table. To improve performance, the team wants to reduce latency for read-heavy workloads. Which design change would be MOST effective?

A company is migrating a critical application to AWS and needs to ensure high availability across AWS Regions. The application uses a relational database. Which THREE components are necessary for this multi-region architecture?

A company migrated a monolithic application to a microservices architecture on Amazon ECS. They notice that the CPU utilization of the cluster is high, but individual services are underutilized. What is the best optimization?

A company is migrating its on-premises VMware virtual machines to AWS. The company wants to use the same VM images and has a 10 Gbps direct connect link. Which service should be used to automate the migration of the VMs?

A company is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences sudden spikes in traffic. Which AWS service should be used to handle the traffic spikes without losing any requests?

A multinational corporation is using AWS Organizations with hundreds of accounts. The finance team needs to track costs by cost center, which is stored as a tag on each resource. However, some resources are missing the tag. What is the most efficient way to ensure that all resources are tagged correctly going forward?

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to be accessible from the internet and must be secured with an AWS WAF. Which TWO steps should be taken to achieve this?

A company is migrating its on-premises application to AWS and needs to maintain the same private IP addresses for the application servers. The on-premises network uses 10.0.0.0/16. Which AWS service allows the company to extend its on-premises network to AWS and preserve IP addresses?

A company is designing a new event-driven architecture on AWS for processing orders. When a new order is placed, it must be validated, inventory checked, payment processed, and notification sent. Each step is independent and may take variable time. The company wants to decouple the steps and ensure that failures do not block the entire workflow. Which solution should a Solutions Architect recommend?

A global company uses a multi-account AWS Organizations structure with hundreds of accounts. The network team wants to centrally manage VPC flow logs for all accounts and send them to a centralized S3 bucket in the security account. Which solution is MOST scalable and operationally efficient?

A company uses AWS Organizations with a management account and multiple member accounts. The management account has a trail in AWS CloudTrail that logs all management events for all accounts. The security team wants to also log data events for S3 buckets across all accounts. They create a new trail in the management account with data events enabled for all S3 buckets in all accounts. However, data events from member accounts are not appearing in the CloudTrail logs. What is the most likely cause?

An IAM policy attached to a user allows s3:GetObject and s3:PutObject on my-bucket, but denies all actions on the confidential/ prefix. The user reports that they can still upload objects to the confidential/ folder. Why?

A company runs a web application on EC2 instances in an Auto Scaling group. The application writes logs to local instance storage. The operations team wants to centralize log analysis using Amazon CloudWatch Logs. The team needs a solution that is resilient to instance failures and does not lose logs. Which TWO options should the team implement? (Choose TWO.)

A financial services company uses AWS Organizations with a multi-account structure: a central security account, a shared services account, and multiple workload accounts. The security team needs to centrally manage and audit all changes to security groups across all accounts. They have implemented AWS Config with an aggregator in the security account. However, they notice that changes to security groups in workload accounts are not appearing in the aggregator. The workload accounts have AWS Config enabled and are recording security group changes. The security account has the necessary cross-account permissions. What is the most likely cause and solution?

A media company is designing a video transcoding pipeline using AWS Lambda and Amazon S3. The pipeline must process videos uploaded to an S3 bucket, transcode them into multiple formats, and store the results in another S3 bucket. The processing time for each video can vary from a few seconds to several minutes. Which architecture will minimize cost and ensure all videos are processed, even if Lambda execution timeout is reached?

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences increased traffic, and the environment's Auto Scaling group is not scaling out quickly enough. What should a solutions architect do to improve the scaling response?

A company uses Amazon S3 to store backups. The backup process uploads objects with a prefix 'backups/' and sets the storage class to STANDARD_IA. The company wants to automatically move objects older than 30 days to GLACIER. What is the most efficient way to achieve this?

A company is using an AWS Direct Connect connection to access its VPC. The company is experiencing intermittent connectivity issues. The Solutions Architect suspects a routing problem. Which AWS service can help diagnose the issue by providing real-time metrics and logs?

A company is designing a multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets across accounts must have server access logging enabled and must block public access. What is the MOST scalable and secure way to enforce these requirements?

Refer to the exhibit. A CloudFormation stack creation failed. The architect needs to identify the reason for the failure. Which CLI command should be used to get detailed error messages?

A company is implementing a hybrid network architecture with multiple VPCs in different AWS accounts. They need to ensure private connectivity between the VPCs and their on-premises data center. Which TWO services should they use together to meet this requirement?

A company is designing a multi-tier web application on AWS. The web tier must automatically scale based on CPU utilization, and the application tier must process messages from an SQS queue. The application tier instances are frequently terminated and replaced due to scaling events. Where should the application logs be stored to ensure they are retained regardless of instance lifecycle?

A company runs a critical application on an Amazon RDS for PostgreSQL DB instance. The database experiences periodic slowdowns. The team notices that the DB instance has a large number of connections in an idle state. What is the BEST way to address this issue?

Refer to the exhibit. A company uses AWS CloudFormation to deploy an EC2 instance. The template uses a condition to select the instance type based on the environment. The company deploys the stack with the parameter EnvType set to 'prod'. What will be the instance type of the created EC2 instance?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data locally on the EC2 instances. The company wants to make the application stateless to improve availability and scalability. Which solution should the solutions architect recommend?

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket. After deployment, the bucket is created but objects are not automatically deleted after 30 days as expected. What is the most likely cause?

A company has an AWS Lambda function that processes messages from an SQS queue. The function is experiencing timeouts. Which TWO changes could help resolve the timeout issue? (Choose 2)

Refer to the exhibit. A company runs this CLI command and sees the output. Which account is the management account?

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. What is the MOST scalable and efficient way to enforce this policy?

A company is designing a new application that will be deployed on Amazon ECS with Fargate launch type. The application needs to store configuration data, including database connection strings, that must be encrypted at rest. The company wants to follow best practices for managing secrets. Which solution should the company use?

A company is modernizing a legacy Java application to run on AWS. The application currently uses a monolithic architecture with a shared MySQL database. The company wants to adopt a microservices architecture using containers and wants to decouple the database. The solutions architect proposes using Amazon ECS with Fargate for compute and Amazon RDS for MySQL for the database. However, during the transition, the performance team notices that the database CPU utilization is consistently above 80% during peak hours. The application logs show many slow queries. The team suspects that the database is the bottleneck. The company wants to improve performance without rewriting the application. Which action should the solutions architect take first?

A company is migrating its on-premises PostgreSQL database to Amazon Aurora PostgreSQL. The database is 2 TB in size and has a 24-hour maintenance window on weekends. The company needs to minimize downtime and ensure data consistency. Which strategy should the solutions architect recommend?

A company has a legacy application that runs on a single EC2 instance. The application stores data on an attached EBS volume. The company wants to improve availability and reduce the recovery time objective (RTO) in case of instance failure. What should the company do?

A company is migrating a legacy application to AWS. The application has hardcoded IP addresses and uses non-HTTP protocols. The solutions architect needs to minimize changes to the application code. Which migration pattern should be used?

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared file system for storing user uploads. The solution architect needs to design a highly available and scalable storage solution that supports concurrent read/write operations from multiple EC2 instances. Which AWS service should be used?

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. They need to ensure that the application can handle sudden spikes in traffic without throttling. Which design should they implement?

A company is migrating a legacy API to Amazon API Gateway and Lambda. The API currently uses long-polling to retrieve messages from a queue. The migration must maintain the same client behavior. Which AWS service should replace the long-polling mechanism?

A company is designing a new microservices architecture using AWS Lambda. Each microservice has its own database. The company wants to securely store database credentials and rotate them automatically. Which AWS service should be used?

A company is designing a data lake on Amazon S3. The data will be ingested from various sources, including streaming data from IoT devices. The data must be processed in near real-time to derive insights. The company wants to use serverless technologies to minimize operational overhead. Which combination of services should the company use?

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts in AWS Organizations. The logs are stored in Amazon S3. The security team needs to query these logs for specific IP addresses and time ranges. Which solution is MOST cost-effective and scalable?

A company is designing a multi-region active-active application that uses Amazon DynamoDB global tables. The application must be able to handle write conflicts that may occur when the same item is updated in two different regions at the same time. The company needs to ensure that the application uses the most recently written data. What should the architect recommend?

A company uses AWS Organizations with multiple accounts. They want to centralize VPC flow logs for all VPCs across accounts. The logs should be stored in a central S3 bucket in the management account. What is the MOST efficient way to achieve this?

A company is migrating a critical application to AWS and needs to ensure it meets a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. The application runs on EC2 with an EBS volume. Which configuration should the company use?

A company is using a multi-account strategy with AWS Organizations. The security team discovers that an SCP intended to block access to non-compliant AWS regions is not working. The SCP is attached to the root OU. When a user in a member account attempts to launch an EC2 instance in a blocked region, the request succeeds. What is the most likely cause?

A company runs a high-traffic web application on EC2 instances in an Auto Scaling group. The application uses a Redis cluster for caching. Recently, they have noticed that the cache hit ratio has dropped significantly, causing increased load on the database. The operations team observed that the Redis cluster's CPU utilization is high and memory usage is near capacity. They need to improve the cache performance with minimal changes to the application code. What should a solutions architect recommend?

Refer to the exhibit. An architect is troubleshooting an EC2 instance that is not responding to health checks from an Application Load Balancer. The instance is in the 'running' state. Which of the following is the most likely cause?

A company is running a stateful web application on EC2 instances in an Auto Scaling group. Users report that their sessions are lost when instances are terminated during scale-in. What should a solutions architect do to preserve session state?

A company runs a data processing application on EC2 instances that read from an Amazon SQS queue. The application processes each message in about 2 seconds. The company expects a sudden spike in messages and wants to minimize processing latency. Which configuration will handle the spike most cost-effectively?

A company uses cross-account S3 access. The above IAM policy is attached to an IAM user in Account A. The user tries to upload an object to a bucket in Account B, but the upload fails. What is the MOST likely reason?

A company uses AWS Organizations with 50 accounts. The central IT team wants to deploy a CloudFormation stack set to create a VPC with a CIDR of 10.0.0.0/16 in each account, but the VPC CIDR must not overlap with existing VPCs in each account. What is the most scalable and automated approach?

A company wants to store application logs in Amazon S3 with a lifecycle policy that moves objects to S3 Glacier Instant Retrieval after 30 days and deletes them after 1 year. The logs are accessed frequently in the first 30 days but rarely after. Which storage class should the company use for the first 30 days?

A company wants to implement a data perimeter to ensure that only authorized accounts can access their S3 buckets. Which TWO steps should they take?

A company has multiple AWS accounts and wants to use AWS CloudFormation StackSets to deploy a common set of resources across all accounts. The StackSet should be managed from the management account. What permissions are required?

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

A company is migrating a legacy application that uses hard-coded IP addresses for database connections. The company wants to refactor the application to use a more resilient architecture in AWS. Which THREE steps should the company take to modernize the database connectivity? (Choose THREE.)

A company is using AWS Application Migration Service (MGN) to migrate hundreds of on-premises servers to AWS. After the migration, some servers fail a health check. What is the most efficient way to remediate the failed servers?

A company is building a high-performance computing (HPC) cluster on AWS for genomics research. The compute nodes require low-latency inter-node communication. Which networking solution should be used?

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 1 hour and the recovery point objective (RPO) is 15 minutes. Which combination of steps should the company take to meet these requirements? (Choose THREE.)

A company is designing a new application that will run on EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling strategy should be used?

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail. They want to ensure that logs are immutable and cannot be deleted or modified by any user, including the root user. Which S3 feature should be enabled?

Refer to the exhibit. A company is deploying a CloudFormation stack for a web application. The stack creation fails with the error 'The parameter DBPassword is not defined'. What is the most likely cause?

A company is designing a multi-account strategy for its development, testing, and production environments. The security team requires that all accounts share a centralized logging solution. Which approach meets this requirement with the LEAST administrative overhead?

A company is using AWS Organizations and wants to delegate administration of Amazon GuardDuty to a member account. Which of the following are required? (Choose TWO.)

A company is designing a new application that will process streaming data from IoT devices. The data must be ingested in real-time and stored in Amazon S3 for long-term analytics. Which AWS service should be used to ingest the streaming data?

A company is designing a new system that will ingest and process real-time streaming data from thousands of IoT devices. Each device sends data every second. The data must be processed with low latency (under 1 second) and then stored in Amazon S3 for long-term analytics. The company also needs to be able to reprocess data in case of processing errors. Which solution should the architect recommend?

A company wants to provide temporary, limited-privilege credentials to its application running on an EC2 instance so that the application can access an S3 bucket. What is the BEST practice for achieving this?

A company is implementing a multi-account strategy using AWS Organizations. They need to centralize logging of all API calls across accounts. Which solution meets this requirement with the least operational overhead?

A company is designing a new application that will store sensitive customer data in Amazon S3. The data must be encrypted at rest. The company wants to use an encryption solution that provides an audit trail of when keys are used and by whom. The company also wants to rotate the encryption keys automatically every year. Which two options meet these requirements? (Choose TWO.)

A company uses AWS Organizations with multiple accounts. The central IT team wants to restrict the use of specific EC2 instance types across all accounts to control costs. Which approach should the team use?

A company is migrating an on-premises application to AWS. The application requires dedicated hardware for licensing compliance. Which AWS service should the company use to meet this requirement?

A company is planning to migrate its on-premises Oracle database to Amazon RDS for Oracle. Which actions should the company take to minimize downtime during the migration? (Choose TWO.)

A company runs a critical e-commerce platform on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to an Auto Scaling group of EC2 instances running a web server. The web servers store session data locally on the instance's ephemeral storage. The Auto Scaling group is configured with a min of 2, max of 10, and desired of 2. Recently, during a flash sale, traffic surged and the Auto Scaling group scaled out to 10 instances. However, many users reported that their shopping carts were lost and they were logged out during the event. The Cognito user pool was used for authentication, and the application uses cookies to maintain session state. The ALB's stickiness is enabled. The team observed that the ALB's RequestCountPerTarget metric was well below the instance's capacity, but the error rate increased. The CloudWatch logs show that the web server returned 503 errors for a subset of requests. After the flash sale ended, the Auto Scaling group scaled back to 2 instances, and the issue disappeared. The team wants to prevent this from happening in future events. Which solution should the Solutions Architect recommend?

A company is migrating a legacy application that uses an Oracle database to AWS. The application is critical and requires high availability with automatic failover. The company wants to use Amazon RDS for Oracle. The database size is 200 GB. The company needs a solution that provides automatic failover to a standby instance in a different Availability Zone with minimal downtime. Which RDS deployment option should the company use?

A startup is deploying a multi-account AWS environment using AWS Organizations. They have a central logging account where all VPC Flow Logs and CloudTrail logs are stored in an S3 bucket. The security team requires that all accounts in the organization, including future accounts, automatically send logs to this central bucket. They also want to prevent any account from disabling logging. Which solution meets these requirements?

A company is designing a new web application that will be deployed on Amazon ECS with Fargate. They need to store session state for the application. Which TWO services can they use for this purpose?

A DevOps team wants to automatically enforce tagging standards on all AWS resources created in an account. If a resource is created without the required tags, the team wants to prevent the creation or remediate it. Which AWS service should the team use?

A company is designing a new web application that requires a scalable, low-latency key-value store for session state. The application runs on EC2 instances in an Auto Scaling group. Which solution is the MOST cost-effective and scalable?

A company is designing a new cloud-native application that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application handles user authentication using Amazon Cognito User Pools. During a stress test, the team notices that some requests are failing with HTTP 503 (Service Unavailable) errors. The CloudWatch logs show that Lambda functions are being throttled, and the DynamoDB table is experiencing high write throttling. The team needs to resolve these issues while maintaining low latency. Which solution is the MOST effective?

A company is migrating a monolithic application to a serverless architecture using AWS Lambda. The application reads and writes to an Amazon RDS for PostgreSQL database. The database connection pool is exhausted during peak traffic. Which design change should a solutions architect recommend to avoid connection exhaustion?

A company is designing a disaster recovery strategy for a critical application that runs on Amazon EC2. The application data is stored on Amazon EBS volumes and Amazon RDS for MySQL. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 1 hour. Which THREE steps should the company take to meet these objectives?

A company is designing a serverless application using AWS Lambda that processes images uploaded to an S3 bucket. The processing time varies but typically completes within 5 minutes. The Lambda function needs to access a VPC-hosted database. What is the BEST way to configure the Lambda function to access the database while minimizing cold start latency?

A company uses Amazon DynamoDB with provisioned capacity for a critical workload. They notice that write requests are being throttled during peak hours. The table has a partition key of 'user_id' and a sort key of 'timestamp'. The access pattern is evenly distributed. What should a solutions architect do to reduce throttling?

A company plans to migrate a relational database to Amazon RDS for MySQL. They need to minimize downtime during the migration. The source database is running on-premises. Which strategy should they use?

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function takes too long to execute and frequently times out. The function downloads the entire file to /tmp before processing. Which TWO changes would improve performance? (Choose two.)

A company has a multi-account AWS environment with centralized logging. The security team wants to ensure that all VPC Flow Logs are published to a central S3 bucket in the logging account. Which combination of steps should be taken to achieve this?

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a specific member account. What must be done?

A company is migrating an on-premises application to AWS. The application stores files on a Windows file server. The company wants to replace the file server with a managed AWS service that supports SMB protocol and integrates with Active Directory. Which TWO AWS services should the company consider? (Choose TWO.)

A company is deploying a web application on AWS that must scale automatically based on CPU utilization. The application runs on Amazon EC2 instances in an Auto Scaling group. Which configuration is required for the Auto Scaling group to scale based on CPU?

A company is using Amazon CloudFront to serve content from an S3 origin. The content is updated infrequently. Users in some regions report seeing stale content. The company wants to ensure that users always see the latest version without waiting for TTL expiration. What is the MOST cost-effective solution?

A company is migrating a large-scale Apache Kafka cluster to Amazon MSK. The cluster has 100 topics with high throughput. The team wants to minimize operational overhead and ensure high availability. Which configuration should be used?

A company is migrating a legacy application to AWS. The application runs on a single EC2 instance and uses an attached EBS volume for data storage. The company wants to improve high availability. Which THREE actions should the company take? (Choose three.)

A company needs to provide a global content delivery solution with low latency. Which AWS service should they use?

A company is designing a disaster recovery solution for a critical application that runs on EC2 instances in a single AWS Region. The application uses a custom AMI that is updated weekly. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 4 hours. The solution must minimize cost while meeting these objectives. Which approach should be used?

A company hosts a static website on Amazon S3 with public read access. The website uses a custom domain name (www.example.com). The company wants to improve performance for global users and also add HTTPS support. They have already set up a CloudFront distribution with the S3 bucket as the origin. However, users still cannot access the website via HTTPS. What should they do?

A company is migrating 50 on-premises web applications to AWS. Each application has a different OS and middleware. The migration must minimize downtime and use a pay-as-you-go model. Which AWS service should the company use to standardize the deployment of these applications?

A company has a central IT team that manages AWS resources for multiple business units using AWS Organizations. Each business unit has its own OU. The central team needs to allow each OU's administrators to manage their own IAM roles and policies, but prevent them from modifying the OU structure or creating new accounts. Which IAM policy should be attached to the administrators in the management account?

A company is running a stateless web application on Amazon EC2 instances in an Auto Scaling group. The application stores session data in an Amazon ElastiCache Redis cluster. After a recent deployment, users are being logged out frequently. What is the most likely cause?

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, they experienced a few minutes of downtime because the application's connection string pointed to the primary instance DNS name. What is the MOST effective solution to minimize downtime during failover?

A company is designing a disaster recovery solution for an Amazon Aurora MySQL database. The database is currently in a single AWS Region. The company needs an RPO of less than 1 minute and an RTO of less than 5 minutes. Which TWO steps should the company take? (Choose TWO.)

A company uses AWS Organizations and wants to centralize Amazon VPC IP Address Manager (IPAM) across multiple accounts. Which TWO steps are required to enable cross-account IPAM?

A company is designing a hybrid cloud architecture that requires low-latency connectivity between on-premises and AWS. The company has multiple branch offices connecting to a central data center. The data center must be connected to AWS with 10 Gbps throughput and high availability. Which solution should the company choose?

A company uses AWS CloudFormation to deploy infrastructure. They need to ensure that updates to a stack do not cause downtime for a critical database. Which TWO strategies should they use?

A company is migrating a web application to AWS. The application consists of a stateless web tier, a stateful application tier, and a MySQL database. The company wants to use AWS managed services to improve scalability and reduce operational overhead. Which THREE services should the company use? (Choose THREE.)

A company plans to migrate a legacy on-premises web application to AWS using the 7 Rs (Rehost, Replatform, etc.). The application has tightly coupled components and unpredictable traffic. The team wants to minimize migration risk and time. Which migration strategy should they use?

A company is troubleshooting a Lambda function that is timing out when trying to connect to an RDS database in a VPC. The Lambda function configuration is shown in the exhibit. The function has a timeout of 30 seconds and a memory size of 128 MB. The VPC has subnets in multiple Availability Zones, but the function only has one subnet configured. What change will MOST LIKELY resolve the timeout?

A company is migrating a critical application to AWS using a rehost (lift-and-shift) approach. The application consists of a web tier and a database tier. The company wants to ensure high availability and disaster recovery. Which TWO actions should the company take? (Choose TWO.)

A company stores sensitive data in an S3 bucket encrypted with SSE-KMS. They need to audit all access requests to the bucket. Which AWS service should they use?

Match each AWS cost management tool to its use.

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs to ensure that all accounts use a specific set of IAM roles for cross-account access. What is the most scalable way to enforce this?

A company is migrating a legacy application to AWS. The application consists of several components that communicate via TCP. The solutions architect must design a solution that minimizes operational overhead and provides high availability. Which TWO strategies should be used?

A company is migrating a legacy application that uses Oracle stored procedures to Amazon Aurora PostgreSQL. Which TWO strategies minimize code changes and migration effort?

A company is migrating its on-premises VMware VMs to AWS using AWS MGN. They need to ensure that the migration minimizes downtime and automates cutover. Which TWO steps are required? (Select TWO.)

A company runs a high-traffic web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes during peak hours. Analysis shows that the latency spikes correlate with high CPU utilization on the EC2 instances. The company wants to reduce latency without over-provisioning. Which solution is MOST cost-effective and scalable?

A company is designing a serverless application using AWS Lambda. The function needs to process files uploaded to an S3 bucket and store metadata in DynamoDB. The solution must handle up to 1,000 concurrent invocations. Which configuration should be used to avoid throttling?

A media company is designing a new video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function to start an AWS Elemental MediaConvert job. The MediaConvert job uses a custom job template. The pipeline must handle bursty uploads of up to 50 videos simultaneously. The company has noticed that some uploads are not being processed. The Lambda function is configured with a reserved concurrency of 10. The S3 event notification is configured to send events to the Lambda function. The MediaConvert job template is configured correctly. What is the most likely reason for the missed processing?

A company runs a production application on Amazon EC2 instances behind an Application Load Balancer. Recently, error rates increased due to a misconfiguration. The operations team wants to automatically roll back to the previous working configuration if errors exceed a threshold. Which solution provides the fastest rollback?

A company is designing a new web application with a global user base. They need to improve latency for static content and protect against DDoS attacks. Which services should they use? (Choose THREE.)

A company wants to allow developers to assume a role in a production account from their development account using AWS IAM. What is needed for this cross-account access?

A company uses AWS Organizations and wants to implement a data perimeter across all accounts to ensure that data can only be accessed from approved networks. Which combination of controls should be used to enforce this perimeter?

A company uses AWS Organizations with hundreds of accounts. The security team wants to ensure that no account can disable AWS CloudTrail or delete CloudTrail log files. Which preventive control should be implemented?

A company is designing a serverless application using AWS Lambda. The function needs to access a VPC resource. What is the correct way to configure this?

A developer is deploying a serverless application using AWS SAM. The deployment fails with a 'ResourceNotReady' error. What is the most likely cause?

A company is planning to migrate its on-premises workload to AWS. The workload consists of a stateful web application that requires a static IP address for whitelisting by third-party services. The company will use a multi-AZ deployment. Which service should be used to meet these requirements?

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked with a batch size of 10. Some messages are failing repeatedly, causing the function to retry them up to the maximum retry count and then they are sent to a dead-letter queue (DLQ). The company wants to improve the resilience of the application by handling partial batch failures more efficiently. What should a solutions architect do?

A company is migrating a legacy database to Amazon RDS. The database currently runs on a single server with a 2 TB volume. The migration must have less than 30 minutes of downtime. Which approach should be used for the initial data load?

A company wants to use AWS Systems Manager to automate patching of EC2 instances across multiple AWS accounts. What is the most efficient way to manage this centrally?

A company is using AWS Organizations with consolidated billing. The company has a production account and a development account. The security team needs to ensure that developers cannot create IAM users in the development account. Which option is the MOST effective?

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which approach provides the BEST security and performance?

A company has a multi-account AWS environment with hundreds of accounts. They need to enforce that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. Which TWO actions should be taken to ensure compliance across the organization?

A global company with a centralized IT team manages AWS resources across 50 accounts using AWS Control Tower. The team wants to deploy a new VPC with a specific CIDR block in each account in the same AWS Region. The VPC must have identical configuration across accounts. Which approach is the MOST efficient and meets the requirement?

A company is designing a new application that processes sensitive healthcare data. The application runs on Amazon ECS with Fargate and uses an Application Load Balancer. The company must ensure that all data in transit is encrypted. Which step should be taken?

A company is migrating a legacy on-premises application that uses a custom TCP protocol. The application needs to be accessible from the internet while maintaining security. Which AWS service should they use to expose the application without modifying the code?

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. After a recent deployment, users report intermittent timeouts. CloudWatch metrics show CPU utilization spikes to 90% before scaling out, but the new instances take 5 minutes to become healthy. What is the MOST effective solution to reduce timeouts during traffic spikes?

Refer to the exhibit. A company applies this SCP to an OU. However, users in the OU are still able to upload objects to S3 without encryption. What is the most likely reason?

A company has a multi-account AWS environment with a centralized security account. The security team needs to have read-only access to all Amazon S3 buckets across all accounts for auditing purposes. Which solution is the MOST secure and scalable?

A company is migrating a 2 PB data lake from on-premises HDFS to Amazon S3. The data is in Parquet format and is accessed by Spark jobs. The migration must be completed within 30 days over a 1 Gbps network. Which approach minimizes cost and meets the deadline?

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences high CPU utilization during peak hours. The company wants to reduce the load on the primary database instance without making changes to the application code. Which TWO solutions should the solutions architect recommend?

Which TWO actions improve the security of an S3 bucket that stores sensitive data?

A multinational corporation is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs in different AWS Regions, and all VPCs must be able to authenticate against the same directory. The directory must be highly available and support automatic failover. What is the MOST operationally efficient solution?

A company is migrating a multi-tier web application to AWS. The application consists of a web server, application server, and Oracle database. Which TWO AWS services should be used to modernize the application while reducing operational overhead?

Refer to the exhibit. An IAM policy is attached to a user. When the user tries to upload an object to the S3 bucket 'my-bucket' using the AWS CLI without specifying server-side encryption, the upload fails. What is the MOST likely reason?

A company uses AWS Organizations with multiple accounts. The finance team needs to track costs by department, where each department uses resources across several accounts. What is the BEST way to allocate costs accurately?

A company is migrating a monolithic application to AWS. The application currently runs on a single on-premises server with a MySQL database. The company wants to reduce operational overhead and improve scalability. Which combination of AWS services should the company use?

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. They want to improve performance and reduce costs. Which THREE actions should they take? (Choose THREE.)

A company uses AWS Organizations and wants to centrally manage backups of EC2 instances across multiple accounts. Which service should they use?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache Redis cluster. The operations team has noticed that during peak hours, application response times increase significantly. They need to improve performance without downtime. Which THREE actions should they take? (Choose 3)

A company wants to share a large dataset stored in Amazon S3 with a partner who has their own AWS account. The partner needs to access the data using their own account credentials. Which approach should the company use?

A company wants to migrate a legacy Oracle database to AWS with minimal downtime. The database is 2 TB in size and runs on a single on-premises server. The company requires the ability to cut over quickly and roll back if needed. Which AWS service should be used?

A multinational corporation is migrating its on-premises Active Directory to AWS. The company requires a solution that supports multi-region authentication for thousands of users and integrates with existing on-premises Active Directory for seamless SSO. The solution must be highly available and provide low-latency authentication. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

A company is using AWS Organizations and wants to restrict the use of specific instance types across all accounts. The company wants to allow only t3.micro, t3.small, m5.large, and m5.xlarge instances. Which SCP should be applied?

A company uses AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. What is the BEST way to achieve this?

A company is using AWS Organizations with hundreds of accounts. The central IT team needs to deploy a common set of AWS resources (e.g., VPCs, subnets, security groups) to all accounts in a specific organizational unit (OU). The solution must be automated and ensure that new accounts added to the OU automatically receive the resources. Which three steps should the team take? (Choose three.)

A company has a multi-account strategy with a centralized logging account. All VPC Flow Logs and CloudTrail logs are sent to an S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena. Which configuration provides the MOST cost-effective and secure access?

A company has a multi-account AWS environment with a central logging account and multiple workload accounts. The security team requires that all VPC Flow Logs be delivered to a central S3 bucket in the logging account. The VPC Flow Logs are encrypted with a customer-managed KMS key in the logging account. The workload accounts have created VPC Flow Logs, but the logs are not appearing in the central S3 bucket. The IAM role used by VPC Flow Logs in the workload accounts has the necessary permissions to deliver logs to the central S3 bucket. What is the most likely cause of the issue?

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application occasionally receives traffic spikes that cause the Auto Scaling group to launch new instances. However, the new instances take several minutes to become healthy, causing a temporary performance degradation. Which TWO actions would improve the scaling responsiveness? (Select TWO.)

A company is migrating a critical workload to AWS and needs to ensure business continuity. The workload runs on a single EC2 instance with a 500 GB EBS volume. The company requires a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which solution meets these requirements with the least operational overhead?

A company is migrating a critical application to AWS and needs to ensure that the migration has minimal downtime. The application runs on a single on-premises server with a local MySQL database. Which strategy provides the lowest downtime?

A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?

A financial services company is designing a solution to process real-time stock trade data. The data is ingested via Amazon Kinesis Data Streams with a shard count of 10. Each shard receives 500 records per second, each record is 1 KB. The company needs to archive all raw data to Amazon S3 within 5 minutes of receipt and also run a Lambda function to enrich each record. What is the most cost-effective and scalable approach?

Which TWO strategies can be used to reduce the cost of Amazon DynamoDB tables for a new application with unpredictable traffic patterns? (Choose two.)

A company operates multiple AWS accounts using AWS Organizations. They want to centrally manage Amazon EC2 Auto Scaling groups across all accounts. The operations team needs to view and modify scaling policies from a single pane of glass. Which solution should they implement?

A company has a legacy application that runs on an Amazon EC2 instance. The application writes logs to a local file. The company wants to centralize log monitoring without modifying the application code. Which solution should the company use?

A company uses AWS Organizations with a hierarchical structure of organizational units (OUs). The security team needs to restrict the use of specific AWS services in the development OU. However, the SCP applied at the root level allows all services. Which TWO SCP strategies can restrict services for the development OU without affecting other OUs? (Choose TWO.)

A company plans to migrate its on-premises VMware VMs to AWS. The company wants to automate the migration of VM images and minimize manual effort. Which AWS service should the company use?

Which THREE factors should be considered when designing a disaster recovery plan for a multi-tier application using AWS? (Choose three.)

A company runs a web application on EC2 instances in an Auto Scaling group. The application receives a variable workload. The company wants to scale based on a custom metric that tracks the number of active users. What is the MOST efficient way to achieve this?

A company is designing a new microservices architecture using Amazon ECS with the Fargate launch type. The services need to communicate securely within a VPC. The company requires that inter-service communication is encrypted and that the services can discover each other using DNS names. Which THREE steps should the company take to meet these requirements?

A financial services company runs a critical application on EC2 instances in an Auto Scaling group across multiple Availability Zones. They need to ensure that in the event of a single AZ failure, the application remains available with no data loss. The application uses EBS volumes for persistent storage. What should a solutions architect recommend?

A company has a complex AWS environment with multiple accounts and VPCs. The company wants to ensure that all outbound traffic from VPCs goes through a centralized inspection VPC for security monitoring. The company uses AWS Transit Gateway. Which solution should be implemented?

A company has a production AWS account and a development AWS account under AWS Organizations. The development team wants to deploy a CloudFormation stack that creates an S3 bucket with a bucket policy that grants access to the production account's IAM roles. The development account has an SCP that denies all s3:PutBucketPolicy actions. The development team has full administrator access in their account. When they try to create the stack, it fails. What is the most likely reason and how should they proceed?

A company is migrating a legacy .NET Framework 4.7 application to AWS. The application uses Windows authentication and COM+ components. Which migration approach is most suitable?

A company is migrating to a multi-account AWS environment using AWS Control Tower. The security team must ensure that all accounts have AWS Config enabled and that logs are delivered to a central S3 bucket. Which THREE steps should the security team take?

A company is migrating a monolithic application to a microservices architecture on AWS. They want to improve deployment frequency and reduce risk. Which TWO strategies should they adopt?

A company has a microservices architecture running on Amazon ECS with Fargate. Each service writes logs to CloudWatch Logs. The operations team needs to search across all logs for a specific error pattern. Currently, they manually query each log group, which is time-consuming. What is the MOST efficient way to enable centralized log search?

A company is designing a microservices architecture on Amazon ECS with Fargate. They want to ensure that services can communicate with each other but are isolated from the internet. What is the MOST secure way to achieve this?

A company is using Amazon RDS for MySQL and wants to minimize downtime during a major version upgrade. Which approach is the MOST effective?

A company is using AWS CodePipeline to build and deploy a Java application to Elastic Beanstalk. Recently, deployments have been failing due to unit test failures in the build stage. The team wants to receive immediate notifications when a pipeline fails. What is the MOST efficient way to achieve this?

A company has a multi-account AWS environment and wants to implement a secure, scalable cross-account network architecture using AWS Transit Gateway. Which TWO steps should be taken?

A company runs a production database on Amazon RDS for PostgreSQL. The database experiences high write latency during peak hours. The company wants to improve write performance with minimal cost. Which action should a solutions architect take?

A healthcare startup is building a HIPAA-compliant application on AWS. The application uses Amazon RDS for MySQL to store patient data. The compliance team requires that all database changes be audited, including SELECT statements. The current solution enables general query logs on the RDS instance, but the logs are stored locally and are lost when the instance is rebooted. Additionally, the logs are consuming significant storage on the instance. The startup needs a durable, scalable, and cost-effective solution for storing and querying database audit logs. Which solution meets these requirements?

A company has a multi-account AWS environment using AWS Organizations with 50 accounts. The accounts are organized into OUs based on environment: Production, Staging, and Development. The central IT team uses AWS CloudFormation StackSets to deploy a baseline network configuration (VPC, subnets, security groups) to all accounts. Recently, the network team updated the stack set to add a new subnet to the VPC. After the update, they noticed that the stack set operation failed for 10 accounts. The error message indicates that the stack set cannot update because a resource already exists. What is the MOST LIKELY cause of this failure?

A company has multiple AWS accounts managed under AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution is the MOST operationally efficient?

A financial services company uses Amazon RDS for MySQL as the backend for a trading application. The application runs on EC2 instances in an Auto Scaling group behind an ALB. The database is a Multi-AZ DB instance with 500 GB provisioned storage. During peak trading hours, the application becomes slow. The RDS metrics show high CPU utilization and high read IOPS. The application performs many read-heavy queries. The team needs to improve performance without application changes. What should they do?

A company is designing a new application that requires low-latency access to a shared dataset across multiple EC2 instances in the same AWS Region. The dataset is updated frequently. Which storage solution should the company use?

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application needs to process a large batch job that runs once per month and takes 2 hours. The company wants to optimize costs while ensuring the batch job has sufficient capacity. Which THREE steps should a solutions architect recommend?

A data analytics company is building a real-time streaming pipeline using Amazon Kinesis Data Streams. The data is consumed by multiple consumer applications, each with different processing requirements. The company wants to ensure that each consumer can process records independently without affecting others and can reprocess data from a specific point in time. Which feature should the company use?

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket and must be secured with HTTPS. Which three services or features should be used together to meet these requirements?

A company is migrating a web application from on-premises to AWS. The application consists of a stateless web tier and a stateful application tier that stores session data in a local file system. The company wants to use AWS Elastic Beanstalk for both tiers. During a test migration, the development team notices that users are being logged out intermittently. The application tier is configured with two EC2 instances behind an internal load balancer. What should the development team do to resolve the issue?

A company has a central networking account that hosts a transit gateway (TGW). Multiple VPCs from various accounts are attached to the TGW. The security team wants to ensure that only specific VPCs can communicate with each other, but all VPCs need access to a shared services VPC. Which configuration should be used?

A company is migrating from a monolithic application to microservices on AWS. They need to reduce the blast radius of failures. Which architecture pattern should they implement?

A large enterprise uses AWS Organizations with hundreds of accounts. The central security team needs to enforce that no IAM users are created in any account; instead, all access must be through IAM roles federated with the corporate identity provider. The security team wants to detect any IAM user creation and automatically remediate it by deleting the user and notifying the security team. Which solution should be implemented?

A company is designing a new hybrid cloud solution that requires low-latency access to on-premises data from AWS. The connection must be highly available and encrypted. The company has multiple VPCs and on-premises locations. Which combination of services meets these requirements?

Match each AWS compute service to its use case.

A company manages 200 AWS accounts using AWS Organizations. The security team wants to prevent developers from creating resources outside of a set of approved AWS Regions. Additionally, they want to restrict the creation of resources that are not tagged with a cost center tag. Which THREE actions should be taken to enforce these requirements?

A company uses Amazon CloudWatch Logs to collect application logs. The operations team wants to be notified when a specific error message appears in the logs. What is the SIMPLEST way to achieve this?

A company runs a critical application on Amazon RDS for MySQL. The database size is 500 GB and growing. The application experiences high write latency during peak hours. A Solutions Architect needs to improve write performance with minimal downtime. Which THREE actions should the architect take? (Choose three.)

A company uses AWS Organizations with a single member account for its development environment. The IT team wants to allow developers to launch EC2 instances only if they use a specific AMI ID. Which policy type should the company use to enforce this requirement?

A company is migrating a legacy monolithic application to AWS. The application has a stateful session layer that uses local disk storage. The migration plan involves rehosting the application on Amazon EC2 instances. What architecture change should the company implement to ensure high availability and stateless application tiers?

A company is modernizing a legacy application by refactoring it into microservices. The application uses a monolithic Oracle database. The team wants to use Amazon RDS for Oracle as the migration target. Which migration approach minimizes risk and downtime?

A company wants to decouple a front-end web application from a backend processing service to improve scalability. Which AWS service should be used to send tasks from the web tier to the processing tier?

A company has a monolithic application running on a single Amazon EC2 instance. The application consists of a web server and a backend worker process. The company wants to migrate to a microservices architecture using containers on Amazon ECS with Fargate. The solutions architect needs to design a solution that minimizes downtime during the migration. Which approach should the solutions architect recommend?

A company is designing a disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. The primary region is us-east-1, and the secondary region is us-west-2. Which solution meets the requirements with the LOWEST cost?

A company is migrating a monolithic application to AWS and wants to modernize it into microservices. The application currently uses a single relational database. Which migration strategy is most appropriate to minimize risk while starting the modernization process?

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to share a VPC subnet in the network account with the workload accounts so that they can launch EC2 instances directly into the shared subnet. The network team has created a VPC with a subnet and shared it using AWS Resource Access Manager (RAM) with the workload accounts. However, the workload accounts cannot see the shared subnet when launching EC2 instances. What is the most likely cause?

A company uses AWS Systems Manager Patch Manager to patch Amazon EC2 instances. After a patching operation, some instances fail to report their compliance status. What is the MOST efficient way to identify the cause of the failure?

A company is using AWS CloudTrail to log all API activity. The security team wants to be alerted when an IAM user creates a new access key. What is the simplest way to achieve this?

A company has a centralized logging account and multiple application accounts. All VPC Flow Logs are sent to a central S3 bucket in the logging account. The security team needs to analyze the logs using Amazon Athena. The team must ensure queries are cost-effective and return results quickly for recent logs. Which configuration should be used?

A company is migrating its on-premises data warehouse to Amazon Redshift. The data warehouse is currently running on a single large server with 10 TB of data. The company wants to minimize downtime and ensure data consistency. Which AWS service should the architect use to perform the migration?

A company runs a critical web application on EC2 instances behind an ALB. The application stores session data in an ElastiCache Redis cluster. During a recent outage, the Redis cluster failed and all active sessions were lost, causing users to be logged out. Which solution would provide the HIGHEST availability for session data?

A company uses AWS Organizations and has shared a subnet from the VPC shown in the exhibit using AWS Resource Access Manager (RAM). A workload account launches an EC2 instance in the shared subnet. The instance needs to communicate with an RDS database in a different private subnet within the same VPC. What additional configuration is required?

A company is migrating a legacy on-premises .NET application to AWS. The application uses a SQL Server database. The company wants to minimize code changes and reduce licensing costs. Which migration strategy should the company choose?

A multinational company is implementing AWS Organizations to manage multiple accounts across business units. The security team requires that all IAM users in member accounts must use a specific password policy and must have MFA enabled. Which combination of actions should the company take to enforce these requirements?

A company uses AWS Lambda functions within a VPC to process data from an Amazon SQS queue. The Lambda functions frequently timeout with the error 'Task timed out after 3.00 seconds'. The functions perform database operations on an RDS instance in the same VPC. The average database query takes 2 seconds. What is the MOST likely cause of the timeouts?

A company is migrating a monolithic application to microservices on Amazon ECS. The application uses a legacy database that does not support distributed transactions. The team wants to ensure data consistency across services. Which solution is BEST for achieving eventual consistency with minimal code changes?

A multinational company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization block public access. What is the MOST efficient way to enforce this requirement?

A company is migrating a critical application to AWS and needs to ensure high availability across two Availability Zones. The application runs on EC2 instances behind an Application Load Balancer (ALB). The database is an on-premises SQL Server that will be migrated later. Which architecture provides high availability for the application tier during the migration?

A media company runs a video transcoding pipeline on AWS using Amazon EC2 Spot Instances. The pipeline uses a custom AMI with pre-installed software. The operations team notices that the latest AMI is not always used when new instances launch, causing inconsistent transcoding results. What should the team do to ensure that all new Spot Instances use the latest AMI?

A company is migrating a legacy application to AWS using the 7 Rs migration strategy. The application is a monolithic Java application running on a single on-premises server with a MySQL database. The company wants to reduce operational overhead and improve scalability. The development team has already containerized the application and tested it locally. The company wants to run the containerized application on AWS without managing the underlying infrastructure. Which AWS service should the company use to deploy the containerized application?

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest and that the encryption keys be rotated automatically every year. The company also needs to audit who accessed the key and when. Which THREE services should the solutions architect use to meet these requirements?

An IAM policy is attached to an IAM user. The user reports being unable to download objects from the bucket 'example-bucket' when connecting from their office IP address 203.0.113.5. What is the most likely reason?

A company wants to design a cost-effective solution to store infrequently accessed log files for 7 years. The logs are generated daily and must be available for retrieval within 24 hours. Which Amazon S3 storage class should be used?

A company is designing a solution to capture changes from an Amazon RDS database and stream them to a data lake. Which AWS service should be used to capture database changes in real time?

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline includes a source stage from GitHub and a deploy stage that syncs the S3 bucket. Recently, the deployment has been failing intermittently with the error 'Access Denied' when the pipeline tries to write to the S3 bucket. The bucket policy allows the pipeline's service role to perform s3:PutObject. The service role has the following IAM policy attached: { 'Effect': 'Allow', 'Action': 's3:PutObject', 'Resource': 'arn:aws:s3:::my-bucket/*' }. What is the MOST likely cause of the failure?

A company is designing a new microservices platform on AWS. The platform consists of 50 microservices, each running in its own Amazon ECS service on AWS Fargate. The services communicate via REST APIs. The company wants to implement a service mesh to handle traffic routing, observability, and security (mTLS). They also need to meet compliance requirements that all traffic between services must be encrypted and logged. The solution must be fully managed and reduce operational overhead. After implementing the service mesh, the operations team notices that latency between services has increased by 20%, and some services are experiencing connection timeouts. The team has enabled mTLS and distributed tracing. Which course of action should the team take to diagnose and resolve the latency issues?

A company runs a web application on Amazon ECS with Fargate launch type. The application is behind an Application Load Balancer. During traffic spikes, the application becomes slow. The team suspects that the ECS service is not scaling fast enough. Which TWO actions should the team take to improve the scalability? (Choose two.)

A company uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group of EC2 instances. The operations team notices that the ALB is returning a high number of 504 errors during peak hours. Which configuration change is MOST likely to reduce the 504 errors?

An organization has deployed the above CloudFormation template. They want to ensure that all uploads to the bucket are encrypted in transit. However, users are still able to upload objects over unencrypted HTTP. What is the MOST likely reason?

A company is migrating a virtual machine from on-premises to AWS. The VM runs Windows Server 2012 R2. The company wants to minimize changes to the VM. Which AWS service should the company use to migrate the VM?

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all newly created S3 buckets have encryption enabled. Which TWO approaches can achieve this? (Choose TWO.)

A company is designing a new solution to store and analyze large amounts of log data from multiple sources. The logs must be retained for 90 days for recent analysis, and then archived to a more cost-effective storage class for an additional 5 years. The solution must support SQL-based queries. Which combination of AWS services should the company use?

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. The security team needs to allow a third-party SIEM tool to read these logs from the S3 bucket, but only from a specific VPCE (VPC Endpoint). Which policy should be applied to the S3 bucket?

Refer to the exhibit. A company uses this IAM policy to allow an automation script to manage Amazon EBS snapshots. The script runs on an EC2 instance with this attached IAM role. The script is failing when trying to create a snapshot from a volume and tag it. The error message indicates an authorization failure. What is the root cause?

A company is migrating a legacy application to AWS. The application requires a relational database with high availability and automated backups. Which TWO AWS services should the company consider? (Choose two.)

A company is planning to migrate a Microsoft SQL Server database to Amazon RDS for SQL Server. They want to automate the migration process and minimize manual effort. Which AWS service should they use?

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. What is the most efficient way to enforce this?

Refer to the exhibit. An AWS Lambda function logs the error above. The function uses the AWS SDK to call an Amazon DynamoDB table. What is the MOST likely cause?

A company is designing a multi-account strategy for development, testing, and production environments. They want to ensure that developers can deploy resources in development and testing accounts but not in production. Which TWO methods should the company use to achieve this? (Choose TWO.)

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts. The company has an existing identity source in an on-premises Active Directory. Which integration method should the company use?

A company is designing a new data processing pipeline that uses AWS Glue to run ETL jobs. The pipeline must process data from multiple sources with varying schemas and load the results into Amazon Redshift. The data must be partitioned by date and encrypted at rest. Which TWO AWS services or features should the company use to meet these requirements? (Choose two.)

A company is designing a data lake on S3 with sensitive data that must be encrypted at rest and audited. Which TWO services should be used? (Choose TWO.)

Which TWO actions would improve the security of an S3 bucket that contains sensitive data? (Choose two.)

A company wants to reduce costs for its Amazon RDS for MySQL database without affecting performance. The database is used by a read-intensive application. Which action should the company take?

A Solutions Architect is reviewing the IAM policy shown in the exhibit. The policy is attached to an IAM user. Which of the following is true about this policy?

A company is designing a new application that will be hosted on AWS. The application must be highly available across multiple Availability Zones. Which of the following services provide built-in high availability across AZs? (Choose TWO.)

Refer to the exhibit. This S3 bucket policy is attached to a bucket in the security account (111111111111). The policy grants access to account 123456789012. A service in account 123456789012 tries to write a log file to s3://my-log-bucket/AWSLogs/123456789012/logfile.txt. What will happen?

A company is designing a new application that will run on Amazon EKS. The development team wants to deploy containers in a way that minimizes operational overhead. Which compute option should the company choose?

A company runs a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. CloudWatch logs show the ALB's healthy host count occasionally drops to zero during traffic spikes. Which design change should a solutions architect implement to improve availability?

A company is migrating its on-premises data warehouse to Amazon Redshift. The existing system uses PostgreSQL and has 10 TB of data. The migration must be completed within a 4-hour downtime window. The company has a 1 Gbps AWS Direct Connect connection. After starting the migration using AWS DMS with a full load and CDC, the full load takes 6 hours. What should the company do to meet the downtime window?

A company has a centralized logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all member accounts in AWS Organizations. The logs are stored in an S3 bucket in the logging account. Security analysts need to query these logs using Amazon Athena. What is the MOST efficient way to set up the table partitions?

A company uses Amazon ECS with Fargate launch type for a web application. During deployments, the new tasks fail health checks and the deployment rolls back. What should the team do to identify why the new tasks are failing?

A financial services company is migrating its trading platform to AWS. The platform consists of hundreds of microservices deployed in containers using Amazon ECS with Fargate launch type. Each service has its own IAM role for fine-grained permissions. The security team requires that all ECS tasks use a specific VPC (vpc-12345) and cannot run in any other VPC. During a recent audit, it was discovered that some tasks are running in a different VPC (vpc-67890). The solutions architect must implement a preventive control to ensure that ECS tasks only run in the approved VPC. The company uses AWS Organizations and has Service Control Policies (SCPs) in place. What should the solutions architect do?

A company uses AWS Lambda functions to process events from Amazon S3. They notice that some Lambda invocations are failing with 'ResourceNotFoundException' errors when trying to write to an Amazon DynamoDB table. The Lambda execution role has a policy that grants dynamodb:PutItem on the table. What is the most likely cause of these errors?

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users in Europe report slow load times. The CloudFront distribution uses the default cache behavior. What is the MOST cost-effective improvement?

A company has a multi-account AWS environment. They want to ensure that any new account created in the organization automatically gets a specific set of IAM roles and AWS Config rules deployed. Which solution requires the least manual effort?

A company has a management account in AWS Organizations and wants to share a central Amazon VPC subnet with multiple member accounts for a shared services VPC. Which AWS service should be used to share the subnet?

A financial services company runs a critical trading application on Amazon EC2 instances behind an Application Load Balancer (ALB) in three Availability Zones. The application uses a MySQL-compatible Amazon RDS for MariaDB database with Multi-AZ deployment. Recently, the operations team noticed that during periods of heavy trading, the database CPU utilization spikes to 100%, causing query timeouts and application errors. The team has already reviewed slow query logs and enabled Performance Insights, but the issue persists. The application is read-heavy with frequent writes. The team needs to reduce database load with minimal changes to the application code. Which solution is the MOST effective and scalable?

A company is building a microservices architecture on Amazon ECS. Services need to communicate with each other and with external SaaS applications. The architect must ensure that service discovery is dynamic and that traffic to external services is routed through a single egress point for security and monitoring. Which combination of services should the architect use?

A company is designing a serverless application that processes images uploaded to an S3 bucket. The processing must be asynchronous and can take up to 15 minutes per image. Which AWS service should be used to trigger the processing?

A company is designing a web application that must support millions of concurrent users. The application uses a RESTful API frontend and a relational database backend. Which TWO strategies should be implemented to improve scalability?

A company is designing a disaster recovery (DR) solution for a critical application running on Amazon EC2 instances in a single AWS Region. The DR site will be in a different Region. The application data is stored in an Amazon RDS for MySQL DB instance with Multi-AZ enabled. The Recovery Point Objective (RPO) is 15 minutes, and the Recovery Time Objective (RTO) is 2 hours. Which strategy meets these requirements MOST cost-effectively?

An IAM policy is attached to an IAM user. The policy allows the `s3:PutObject` action on the resource `arn:aws:s3:::my-bucket/uploads/*` with a condition that the request must come from IP address `10.0.1.5`. The user is testing from an IP address `10.0.1.5`. What is the effect of the policy?

A company is designing a multi-tier web application on AWS. The application requires high availability across multiple Availability Zones. Which AWS service should be used to distribute incoming traffic across multiple EC2 instances in different Availability Zones?

A company is modernizing its legacy PHP application to run on AWS. The application is currently deployed on a single on-premises server with a LAMP stack. The company wants to use containerization to improve scalability and deployment speed. Which AWS service should be used to run the containers with minimal operational overhead?

A financial services company needs to design a solution for storing sensitive customer data that must be encrypted at rest using a customer-managed key stored in AWS Key Management Service (KMS). The data will be accessed by multiple EC2 instances in an Auto Scaling group. The company needs to rotate the key every 90 days and ensure that old encrypted data can still be decrypted. Which key strategy should they use?

A company is running a containerized microservices application on Amazon ECS with Fargate launch type. The application experiences increased latency during peak hours. Upon investigation, the CPU utilization of the tasks reaches 90%. The ECS service is configured with a target tracking scaling policy based on average CPU at 70%. However, scaling is not keeping up with demand. What should a solutions architect do to improve the responsiveness of the scaling?

A company runs a stateful web application on EC2 instances behind an Application Load Balancer (ALB). The application uses WebSockets for real-time communication. During scale-in events, users experience disconnections. How can the company maintain WebSocket connections during scaling?

A company uses AWS Organizations with a centralized networking account that hosts a VPC with a transit gateway. Other accounts need to connect to this transit gateway. The company wants to ensure that only approved VPCs can attach to the transit gateway, and that the attachments are automatically approved when a VPC is created in a member account. Which solution meets these requirements?

Which TWO strategies can reduce the cost of storing infrequently accessed data in Amazon S3 while maintaining millisecond retrieval latency? (Choose two.)

A company is migrating a legacy .NET Framework 4.8 application to AWS. The application uses Windows authentication integrated with Active Directory and relies on a shared file system for configuration files. The company wants to minimize operational overhead and use managed services. Which combination of AWS services should the company use to modernize the application?

A company wants to allow developers to launch EC2 instances, but only with specific instance types and only if the instance has a tag 'CostCenter'. Which IAM policy statement should be applied to the developers' IAM group? (Choose TWO.)

A company is migrating a legacy .NET Framework 4.7 application to AWS. The application uses Windows Server 2012 R2, IIS, and SQL Server 2014. The company wants to modernize the application to reduce licensing costs and operational overhead. Which THREE actions should the company take? (Choose THREE.)

A company is migrating a .NET application from Windows Server to Linux on EC2. The application uses a proprietary COM+ component that cannot be recompiled. Which migration path should they take?

A company is designing a new data lake on AWS. The data lake will store raw data in Amazon S3 and use Amazon Athena for ad-hoc queries. The company needs to ensure that only authorized users can query specific partitions based on their department. Which approach should the company use to implement fine-grained access control?

A company runs a production database on Amazon RDS for PostgreSQL. They need to perform a major version upgrade with minimal downtime. Which strategy should they use?

A company has a legacy application that runs on an EC2 instance with a single EBS volume. The application stores temporary data on a second EBS volume that is attached to the instance. The company wants to improve durability of the temporary data without increasing costs significantly. What should the company do?

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application stores session data locally on the instances. The company wants to improve availability and scalability. What should a solutions architect recommend?

A startup is building a serverless photo-sharing application on AWS. Users upload photos via a web app, which stores them in Amazon S3. Each upload triggers an AWS Lambda function that creates a thumbnail and stores it in another S3 bucket. The application is expected to have unpredictable traffic patterns. The startup wants to minimize costs and operational overhead while ensuring the thumbnail generation completes reliably. Which solution should a Solutions Architect recommend?

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The company wants to secure the API by requiring authentication via a JSON Web Token (JWT). Which service should the company use to manage user authentication and issue JWTs?

A company is designing a new microservices-based application on AWS. They want to ensure that services can discover each other dynamically and that traffic can be load balanced across multiple Availability Zones. Which AWS service should they use for service discovery?

A company is designing a new application that will run on Amazon ECS with Fargate. The application must be able to read and write files to a shared file system that is accessible from multiple tasks simultaneously. The file system must be durable and support NFS protocol. Which storage solution should be used?

Match each storage class to its description.

A company is designing a new application that will be deployed on Amazon EKS. The application must meet PCI DSS compliance requirements. Which TWO steps should the solutions architect take to secure the cluster?

A company is designing a new serverless application using AWS Lambda. The function needs to access an Amazon RDS database. Which THREE practices should be followed to avoid connection exhaustion?

A company uses Amazon DynamoDB with on-demand capacity. They notice that a specific table frequently exceeds the write throughput limit and experiences throttling. The table has a partition key with high cardinality. What is the MOST likely cause of throttling?

A company has a multi-account strategy using AWS Organizations. They want to enforce that all newly created S3 buckets in any account have server-side encryption enabled. What is the most scalable solution?

A company is designing a disaster recovery solution that must recover an application in a different AWS Region within 15 minutes of a failure. The application uses an Amazon Aurora MySQL DB cluster. Which combination of strategies will meet the recovery time objective (RTO) while minimizing costs?

A company is designing a data lake on Amazon S3. Data is ingested from various sources, including IoT devices, and must be stored in a cost-effective manner. The data access patterns are unpredictable; some data is accessed frequently for a few days, then rarely accessed. The company wants to minimize storage costs while ensuring data is available within minutes when accessed. Which storage class should they use for the data?

A company is designing a new system that will use Amazon S3 to store sensitive data. Which THREE methods can be used to encrypt data at rest in S3?

A company uses AWS Organizations with several OUs. The security team wants to restrict the use of specific instance types (e.g., all instances except t2.micro) across all accounts. Which SCP should be applied?

A company is migrating a legacy application to AWS. The application requires a relational database with read replicas for reporting. The company wants to minimize operational overhead. Which TWO database services meet these requirements?

A company has a multi-account environment with a centralized network account that hosts a transit gateway. Application accounts need to connect to the transit gateway. The network team wants to ensure that only authorized accounts can create attachments. Which method should be used?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions. What should they do?

A company is migrating an on-premises data center to AWS. The company has a large amount of data (50 TB) that needs to be transferred quickly. The internet connection is limited to 100 Mbps. Which TWO methods should the solutions architect consider for the initial data transfer? (Select TWO.)

A company is designing a new data lake on Amazon S3 using AWS Glue for ETL. The data is partitioned by date and sensitive columns must be masked for non-privileged users. The solution must minimize storage costs and allow different masking policies per user. Which approach should the architect recommend?

The above CLI output shows the state of a CloudWatch alarm. The EC2 instance's CPU utilization averaged 85% for the last 10 minutes. What is the alarm state?

Which TWO actions will improve the security posture of an Amazon S3 bucket used to store sensitive data? (Choose two.)

A company has multiple VPCs across different AWS accounts and wants to establish private connectivity between them. They also need to centrally manage network traffic for security inspection. Which architecture should they use?

A company has a mission-critical application running on Amazon RDS for PostgreSQL. The database experiences high read traffic that causes performance degradation. The company wants to improve read scalability without modifying the application. Which THREE solutions should a solutions architect recommend?

A company has multiple AWS accounts in an organization. The security team needs to centrally manage Amazon GuardDuty findings from all accounts. Which THREE steps should the team take to meet this requirement? (Choose THREE.)

A gaming company is designing a new real-time multiplayer game backend on AWS. The game requires low-latency communication between players (< 50 ms) and the ability to handle up to 100,000 concurrent players. The backend must manage game state, player matchmaking, and chat. The company wants to use managed AWS services to reduce operational overhead. Which solution should a Solutions Architect recommend?

A company is designing a new real-time analytics platform that ingests millions of events per second from IoT devices. The events must be processed with low latency (under 100 ms) and stored for replay. The company wants to use managed services. Which combination of AWS services should the company use?

A company uses AWS CloudFormation to manage infrastructure. The operations team wants to ensure that all future stack updates follow best practices for change management. Which THREE actions should the team implement?

A company is migrating a legacy batch processing system to AWS. The batch jobs run on a schedule and process files from an FTP server. The company wants a serverless solution. Which THREE AWS services should be combined to implement the solution?

A company is migrating its data warehouse from on-premises to Amazon Redshift. The current on-premises data warehouse runs on a proprietary MPP system. The company wants to minimize downtime and ensure data consistency. The company has a large volume of historical data (30 TB) and daily incremental updates of 10 GB. Which migration approach should the company use?

A company is using AWS CloudFormation to manage infrastructure. The operations team wants to be notified when a stack operation fails. Which approach is the MOST efficient?

A company is designing a serverless application using AWS Lambda functions. The application processes events from an Amazon SQS queue. The company wants to ensure that the Lambda function can scale to handle a sudden increase in messages without losing any messages. The Lambda function must process each message at least once. Which configuration should the company use?

A company plans to migrate 50 on-premises virtual machines (VMs) to AWS. The migration must be completed within 2 weeks. The VMs run various operating systems and have a total data size of 10 TB. The company has a low-bandwidth internet connection (50 Mbps). Which migration approach minimizes the time to transfer the data?

A development team deploys a web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences intermittent 503 errors. A Solutions Architect notices that the errors coincide with high CPU utilization on the EC2 instances. What is the MOST effective way to improve the application's availability?

An IAM policy is attached to a user. What is the result when the user tries to upload an object with SSE-KMS encryption?

A company is designing a multi-account AWS environment using AWS Organizations. The company has several business units that each require their own VPC in shared accounts managed centrally. The company wants to enable VPC sharing to allow business units to create resources in shared subnets while maintaining network isolation. Which combination of steps should the company take to achieve this? (Choose TWO.)

A company is designing a cross-account backup strategy using AWS Backup. The backup policy must be centrally managed from the management account. Which TWO steps are required to implement this?

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

A company is using AWS CloudFormation to deploy infrastructure. They want to ensure that updates to a stack do not cause downtime for a critical web application. Which THREE strategies should they consider? (Choose THREE.)

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with a resource update failure. The team wants to investigate the specific error without rolling back the stack. What is the BEST approach?

A company is migrating an application that uses a commercial database to Amazon RDS. The database size is 500 GB. Which migration approach minimizes downtime?

A company is migrating a large-scale batch processing system from on-premises to AWS. The system processes hundreds of thousands of files daily, each file being a few MB in size. The files are received via SFTP and need to be processed within 4 hours. The company wants to use AWS services to build a fully managed, scalable, and cost-effective solution. The current on-premises system uses a single server with a scheduled task that processes files sequentially. The migration should improve throughput and reduce processing time. Which architecture should the company implement?

A company is migrating a virtualized workload to AWS. The current environment uses VMware vSphere. The company wants to migrate the virtual machines (VMs) to AWS with minimal changes. Which AWS service should the company use?

A company has multiple AWS accounts and wants to share a centrally managed Amazon VPC subnet for workloads that require low latency. The VPC is in the networking account. Which solution meets these requirements with the LEAST operational overhead?

A company uses AWS Organizations with a single OU for all production accounts. The central security team wants to prevent any user from disabling Amazon GuardDuty in any production account. What is the MOST effective way to enforce this?

Drag and drop the steps to configure an Application Load Balancer with HTTPS listeners in the correct order.

A company is migrating a web application to AWS and wants to use Amazon ECS with Fargate. The application needs to store session state. Which AWS service should the company use for session state management?

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They have configured an Auto Scaling group with a dynamic scaling policy based on CPU utilization. During a traffic spike, the Auto Scaling group launches new instances, but users report slow response times. What should the company do to improve the scaling responsiveness?

A company is migrating a critical application to AWS. The application requires consistent performance and low latency. The company has selected an instance type that meets the performance requirements. However, during testing, the application experiences variable performance due to CPU stealing from other instances on the same physical host. What should the company do to mitigate this issue?

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest. Currently, the S3 bucket uses server-side encryption with S3 managed keys (SSE-S3). The company wants to use a key stored in AWS KMS for additional control. What is the simplest way to achieve this?

An S3 bucket is created using the above CloudFormation template. What happens to objects in the bucket after 30 days?

A company uses AWS Organizations with multiple OUs. The finance team needs visibility into costs across all accounts. They want to tag resources with a 'CostCenter' tag. What is the BEST way to enforce tag propagation?

A company is designing a new data lake on AWS. The data lake will store petabytes of data from various sources, including IoT devices, application logs, and streaming data. The data must be stored cost-effectively, and access patterns vary from frequently accessed recent data to rarely accessed historical data. The company also needs to run SQL queries on the data. Which solution should the architect recommend?

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover event. After the failover, the application team notices that the new primary DB instance has higher latency than expected. What is the most likely cause?

Which TWO AWS services can be used to decouple components in a new microservices architecture? (Choose two.)

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error: 'The following resource(s) failed to create: [MyEC2Instance].' The EC2 instance creation failed because of an insufficient IAM permissions error. Which TWO actions should the company take to resolve this issue? (Choose two.)

Refer to the exhibit. A trust policy is attached to an IAM role named AuditRole in account 111111111111. The IAM role Admin in account 222222222222 attempts to assume AuditRole. The session is launched with source identity 'admin'. Will the assumption succeed?

A company is migrating a legacy application to AWS. The application requires a relational database. The company wants to minimize operational overhead. Which TWO options should the company consider? (Choose two.)

A company is implementing AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts in the organization follow the principle of least privilege for IAM roles. Which TWO actions should the team take?

A company is building a new microservices-based application on AWS using Amazon ECS with Fargate. The application has a frontend service, an order service, and a payment service. Services communicate synchronously via REST APIs. The company expects variable traffic and wants to ensure that failures in one service do not cascade to others. Which solution should a Solutions Architect recommend?

A company wants to migrate a legacy monolithic application to AWS with minimal changes. The application currently runs on a single on-premises server with a Microsoft SQL Server database. The company wants to use AWS managed services to reduce operational overhead. Which combination of services should the company use to meet these requirements?

A company is designing a network architecture for a multi-account AWS environment. They need to establish a central inspection VPC through which all traffic between VPCs in different accounts must pass. Which AWS service should be used to route traffic between VPCs through the inspection VPC?

A company is designing a new microservices architecture on AWS. Each microservice must store its own data and communicate with other services via RESTful APIs. The company wants to minimize operational overhead. Which data store should the company use for each microservice?

A company is migrating a web application to AWS and wants to use a content delivery network (CDN) to improve performance. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

A solutions architect is trying to export an EC2 instance as a VM using AWS VM Import/Export. The CLI command fails with the error shown in the exhibit. What is the most likely cause?

A company is designing a new data lake on AWS. The data lake will store structured and unstructured data from various sources. The company needs a solution that can automatically catalog the data and make it searchable. Data will be stored in Amazon S3. Which AWS service should be used to catalog and enable search across the data lake?

A company is migrating to AWS and wants to set up a multi-account structure using AWS Organizations. The security team requires that all accounts be part of an organization and that any attempt to leave the organization be blocked. Additionally, the company wants to prevent the use of the root user in member accounts for daily operations. What should they do?

A company is designing a new application to store and retrieve user profile pictures. The images will be accessed frequently and must be served with low latency. Which storage solution should they use?

A company is designing a web application that must handle sudden spikes in traffic. The application runs in a VPC and uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The solution must be cost-effective for variable traffic patterns. Which scaling strategy should be used?

A company is designing a multi-account strategy using AWS Organizations. They need to enforce that all IAM users in member accounts must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO approaches should they combine to enforce this requirement?

A solutions architect deployed an AWS Lambda function using a deployment package. The function logs the error shown in the exhibit. What is the most likely cause?

A company is migrating a large Oracle database to Amazon Aurora PostgreSQL using AWS DMS. The database is 5 TB and has frequent write operations. The migration must have minimal downtime. Which configuration should be used?

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data lake will ingest data from multiple sources, including streaming data from Amazon Kinesis Data Streams and batch data from on-premises systems via AWS Snowball. The company needs to catalog the data and make it available for querying with Amazon Athena and Amazon Redshift Spectrum. Which combination of services should the company use to meet these requirements?

A company uses AWS Lambda to process incoming messages from an SQS queue. The Lambda function is triggered by SQS and processes messages in batches of 10. Recently, the number of messages has increased significantly, and some messages are being processed multiple times. What should a solutions architect do to ensure exactly-once processing?

A company uses AWS CloudFormation to manage infrastructure. They want to update a stack that fails due to a resource limit exceeded error. Which approach minimizes downtime while fixing the issue?

A company wants to modernize a batch processing application that runs on EC2 instances using a cron job. The job processes files from an S3 bucket and takes about 2 hours. They want to reduce operational overhead. Which service should they use?

An organization wants to migrate 50 TB of data from an on-premises NAS to Amazon S3 over a slow internet connection. The migration must be completed within two weeks. Which approach is most appropriate?

A developer ran the AWS CLI command shown in the exhibit. The instance has an attached EBS volume with 'DeleteOnTermination' set to false. The instance will be started again soon. What will happen to the EBS volume when the instance is stopped?

A company is migrating an on-premises monolithic application to AWS. The application uses a legacy database that cannot be easily refactored. The company wants to minimize changes to the application code while gaining scalability and high availability. Which migration strategy should the architect recommend?

A company is designing a multi-account strategy using AWS Organizations. They want to enforce that no one can disable AWS CloudTrail in any account. Which TWO methods can achieve this?

A company has a multi-account AWS organization. The security team wants to centrally manage and enforce that all S3 buckets are encrypted with a specific KMS key. Which approach should the architect recommend?

A healthcare company is designing a new system on AWS to store and analyze patient health records. The system must comply with HIPAA regulations. Data includes structured lab results and unstructured clinical notes. The company needs to run complex SQL queries on the structured data and perform natural language processing (NLP) on the unstructured data. The solution should be cost-effective and minimize administrative overhead. Which solution should a Solutions Architect recommend?

A company is designing a new application on AWS that processes real-time IoT sensor data from thousands of devices. The data must be ingested, processed, and stored for analysis. The company wants to use a serverless architecture to reduce operational overhead. The processing includes filtering, aggregation, and transformation. Which solution should a Solutions Architect recommend?

A company is using AWS Migration Hub to track a server migration. The migration task has failed with the error shown in the exhibit. Which action should the solutions architect take to resolve the issue?

A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?

A company is designing a new solution to process streaming data from IoT devices. The data must be ingested, processed in real-time, and stored in a data warehouse for analytics. The company expects millions of events per second. Which combination of AWS services should be used?

A company has a serverless application using AWS Lambda and Amazon API Gateway. The application experiences cold starts that cause latency spikes. Which solution would reduce the impact of cold starts?

A company is deploying a containerized application on Amazon EKS. The application requires persistent storage that can be shared across multiple pods in different Availability Zones. Which TWO storage solutions meet this requirement? (Choose TWO.)

A company is migrating a legacy e-commerce application to AWS. The application includes a web tier, an application tier, and a MySQL database. The company wants to improve scalability and reduce operational overhead. The architect plans to use Amazon RDS for MySQL and refactor the application to use Auto Scaling for the web and application tiers. However, the application currently stores session state locally on the web servers. What should the architect do to address session state management in the new architecture?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL Multi-AZ DB instance. During a recent load test, the application became unresponsive for several minutes. The monitoring shows that the RDS instance CPU utilization spiked to 100% during the test. The application reads and writes to the same database. Which design change would provide the BEST improvement in database scalability and reduce CPU contention?

A company has a management account in AWS Organizations. It wants to delegate administration of AWS IAM Identity Center to a member account for user management. What is the correct way to achieve this?

A company is migrating a legacy application that uses a network file system (NFS) for shared storage. The application runs on Windows servers. Which AWS storage service should be used for the migration?

A company is migrating a legacy application to AWS. The application uses a proprietary database that is not supported by Amazon RDS. The company wants to minimize changes and use a managed service. Which TWO options should the company consider? (Choose TWO.)

A company is designing a new application that will process messages from an SQS queue. The messages must be processed in real-time with minimal latency, and the processing time per message varies from 100 ms to 5 seconds. The company wants to minimize cost and operational overhead. Which solution should the architect recommend?

A company is designing a new application on AWS that requires a highly available and durable NoSQL database. The database must be able to scale horizontally for both reads and writes. Which TWO AWS services meet these requirements? (Choose two.)

A company is experiencing increased latency in their web application running on EC2 instances behind an Application Load Balancer. The application uses an RDS MySQL database. The CloudWatch metrics show elevated CPU utilization on the database instance during peak hours. Which design change would be MOST effective to reduce database load without application code changes?

A company is migrating a legacy CRM application from a colocation facility to AWS. The application uses a client-server architecture with a thick client installed on employee desktops. The company wants to reduce desktop administration and provide remote access. Which migration approach should the architect recommend?

A gaming company uses Amazon DynamoDB as the database for a leaderboard feature. The table has a partition key of 'game_id' and a sort key of 'score'. The table uses on-demand capacity mode. During a new game launch, write traffic to a few popular game_id partitions becomes very hot, causing throttling. The company wants to improve performance for these hot partitions without changing the application code. What should they do?

A company is migrating a legacy application that uses SOAP web services to AWS. The application currently runs on a single on-premises server. The company wants to minimize changes and reduce operational overhead. Which approach should the company take?

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to ensure that during a patching cycle, the application remains available and no requests are dropped. Which TWO strategies should they implement? (Choose TWO.)

A company is migrating a large on-premises data lake to Amazon S3. They need to transfer petabytes of data over the network securely and efficiently. Which TWO AWS services should they use?

A company is modernizing a legacy application by breaking it into microservices. The application currently uses a single relational database. The company wants to adopt a microservices architecture with separate databases per service. Which THREE patterns should the company consider? (Choose THREE.)

A company is migrating a large-scale Hadoop cluster to Amazon EMR. They want to optimize costs by using transient clusters and storing data in Amazon S3. Which feature should they enable on the EMR cluster to improve performance?

A company is designing a microservices architecture on AWS. Each service needs its own DynamoDB table, and services must be fully isolated. Which networking design ensures that services can only communicate through APIs and not directly to each other's databases?

A company has a multi-account AWS environment. The security team needs to centrally manage and audit IAM roles that allow cross-account access. Which solution meets these requirements?

A company needs to store application logs for at least one year with the ability to query them occasionally. The logs are generated at a rate of 10 GB per day. Which storage solution is MOST cost-effective?

A company is using AWS CloudTrail to log API activity. The security team wants to ensure that log files are tamper-proof and can be used for forensic analysis. Which TWO actions should the company take?

Refer to the exhibit. An IAM policy is attached to an IAM group. When a user in the group tries to start a stopped EC2 instance with the tag 'Environment: production', the action fails. What is the MOST likely reason?

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application needs to maintain a fixed number of instances and should automatically replace any unhealthy instance. Which scaling policy should be used?

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance does not have a public IP. What is the most secure way to provide internet access?

Which TWO design patterns help ensure data durability in Amazon S3?

A company uses AWS Organizations with a multi-account strategy. The central IT team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key. The security policy must be applied without modifying individual bucket policies. Which approach meets these requirements?

A company is migrating a web application to AWS and wants to use a blue/green deployment strategy to minimize downtime. The application runs on EC2 instances behind an Application Load Balancer (ALB). Which approach should be used?

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and logs, but cannot identify the root cause. What is the MOST effective way to troubleshoot the latency issue?

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 with an Amazon RDS for MySQL database. The Recovery Time Objective (RTO) is 15 minutes and Recovery Point Objective (RPO) is 1 hour. Which TWO strategies meet these requirements? (Choose TWO.)

A company has a complex AWS environment with multiple VPCs connected via a transit gateway. The company wants to centrally manage DNS resolution across all VPCs. Currently, each VPC has its own Amazon Route 53 private hosted zone. The company needs a solution that allows resources in any VPC to resolve DNS names from any other VPC's private hosted zone. Which solution should be implemented?

A company has multiple AWS accounts for different departments. The finance team wants to centrally manage and optimize EC2 Reserved Instance purchases across all accounts. Which solution should the company implement?

A company is migrating a legacy on-premises application to AWS. The application requires a fixed IP address for whitelisting by external partners. The solution must be highly available across multiple Availability Zones. Which design should they use?

A company is migrating its on-premises VMware VMs to AWS using AWS MGN. After the test cutover, the migrated EC2 instance fails the health check. The source VM runs Windows Server 2016 with a static IP. What is the most likely cause?

A company is migrating a critical application to AWS and must ensure business continuity with a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The application runs on a single on-premises server with a 500 GB disk. The current data changes at a rate of 10 MB per minute. Which solution will meet the RTO and RPO requirements with the least operational overhead?

An IAM policy is attached to an IAM user. The user tries to download an object from S3 bucket 'example-bucket' from an IP address 10.0.1.5. What will happen?

A company wants to migrate its on-premises Oracle database to Amazon RDS for MySQL with minimal downtime. Which AWS service should be used for the initial data load and ongoing replication?

A solutions architect runs the above commands for an EC2 instance. The instance state is 'running' but the system status is 'impaired'. What should the solutions architect do to restore the instance?

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing high latency. A Solutions Architect reviews the CloudWatch metrics and notices that the ALB's SurgeQueueLength is consistently high. What does this indicate, and how should the architect respond?

A solutions architect is designing a disaster recovery plan for a critical application. The application runs on EC2 instances behind an Application Load Balancer (ALB) in us-east-1. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. Which approach meets these requirements?

A company runs a customer-facing web application on EC2 instances behind an Application Load Balancer. The application stores session data in an RDS MySQL database. Recently, they have been experiencing increased latency and occasional timeouts during peak hours. The operations team has observed that the RDS instance's CPU utilization is consistently above 80%, and the number of database connections is near the maximum allowed. The application code is not easily modifiable in the short term. The company needs a solution that reduces the load on the database with minimal changes to the application. What should a solutions architect recommend?

A company is migrating a web application to AWS. The application uses a three-tier architecture with a web server, application server, and MySQL database. The company wants to ensure high availability by deploying across multiple Availability Zones. The web and application servers are stateless. Which solution provides the HIGHEST availability with the LEAST administrative effort?

A company is designing an event-driven architecture using Amazon EventBridge. They have multiple AWS accounts that need to receive events from a central account. What is the MOST scalable and secure way to route events to these accounts?

A company has a central S3 bucket for logs (central-logs-bucket) in account 123456789012. The bucket policy is shown in the exhibit. A developer in account 111111111111 tries to access an object in the bucket using the AWS CLI without the --no-sign-request option. The request fails. What is the MOST likely cause?

A company has a multi-account AWS environment with over 500 accounts. The security team uses AWS Config to evaluate resource compliance across all accounts. They have set up an AWS Config aggregator in the security account to collect configuration snapshots from all member accounts. Recently, the team noticed that some member accounts are not showing up in the aggregator. The accounts are active and have AWS Config enabled. What should the security team do to troubleshoot this issue?

A company is migrating a critical application from on-premises to AWS. The application uses a shared file system for user uploads and logs. The company wants a highly available, durable, and low-latency solution. Which AWS storage service should the company use?

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

A company is designing a new data processing pipeline that must transform data from JSON to Parquet format. The pipeline should run daily and handle data up to 10 GB. Which TWO AWS services can be used to perform this transformation?

A company has multiple AWS accounts and wants to centralize CloudTrail logs from all accounts into a single S3 bucket in the audit account. Which configuration is required?

Refer to the exhibit. An IAM policy is attached to a user who needs to upload objects to an S3 bucket owned by another AWS account. The uploads are failing with access denied. What is the most likely cause?

A company has a hybrid architecture with an AWS Direct Connect connection to its on-premises data center. The company wants to improve network availability and ensure that if the Direct Connect fails, traffic automatically uses a VPN backup. Which configuration should the company implement?

A developer runs the above AWS CLI command. What is the expected output?

A company is designing a serverless event-driven application using AWS Lambda. The application processes messages from an Amazon SQS queue. The team needs to ensure that messages are processed in order and exactly once. Which THREE steps should be taken?

A solutions architect needs to design a network architecture for a multi-account AWS environment using AWS Transit Gateway. The company requires that all traffic between VPCs be inspected by a central security appliance. What is the MOST efficient way to achieve this?

A company is migrating a multi-tier web application to AWS. The application includes an Apache web server and a MySQL database. The operations team needs to scale the web tier based on CPU utilization while maintaining a static IP for the database. Which combination of AWS services should the solutions architect use?

A company has a multi-account strategy with a dedicated audit account. The audit account needs to have read-only access to all resources in all other accounts. The security team wants to use IAM roles. What is the MOST scalable way to set up this cross-account access?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling approach should they use?

A company is designing a new microservices architecture that requires service discovery and API management. Which THREE services can be used together to achieve this? (Choose THREE.)

A company is migrating a stateful web application to AWS. The application currently runs on a single on-premises server and uses local storage for session data. The company wants to make the application highly available and scalable. What should the solutions architect do?

A company is migrating a legacy application to AWS and wants to use a containerized architecture. The application requires persistent storage that can be shared across multiple containers in an Amazon ECS cluster. Which TWO storage solutions should the company consider? (Choose TWO.)

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by project, where each project may use resources across multiple accounts. What is the MOST scalable way to allocate costs?

A company plans to modernize an existing .NET Framework 4.7 application running on Windows Server 2012 R2. The company wants to move to a containerized architecture on AWS with minimal code changes. Which service should the company use to meet these requirements?

A company is using AWS DMS to migrate a SQL Server database to Amazon Redshift. The initial full load completed, but the ongoing replication task failed with the error shown. What is the MOST likely cause?

Match each AWS database service to its characteristic.

A company runs a web application on EC2 instances behind an ALB. Users report intermittent 503 errors during peak hours. The metrics show the target group's healthy host count drops to zero periodically. What is the most likely cause?

A company wants to implement a data lake on AWS with data from multiple sources. They need to store data in its raw format and allow multiple teams to query it using different tools. Which service should be used as the central storage layer?

A company is designing a multi-tier web application on AWS. The application must be highly available and scale automatically based on traffic. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The application tier also uses EC2 instances. Which solution meets these requirements with the LEAST operational overhead?

A company is setting up AWS DMS to migrate a database. The trust policy above is attached to the IAM role used by DMS. When testing the connection, DMS reports an authentication error. What is the most likely cause?

A company has a centralized logging account and multiple application accounts. Each application account sends CloudWatch Logs to a cross-account log group in the logging account. The security team wants to ensure that logs are encrypted at rest using a KMS key that only the logging account can manage. Which configuration is required?

Drag and drop the steps to troubleshoot an EC2 instance that is unreachable via SSH in the correct order.

A company is monitoring a Lambda function named my-function. The function has an alias 'prod' that points to version 1. The above CLI output shows two metrics for the Errors metric. What is the likely reason for two metrics?

A company is designing a new event-driven architecture using AWS services. The system must process events from multiple sources, filter and route events to different consumers, and ensure that events are processed exactly once. Which THREE services should be used to build this architecture? (Choose three.)

A company is designing a disaster recovery (DR) strategy for a critical application. The application runs on EC2 instances in a single AWS Region. The company needs a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which TWO strategies meet these requirements? (Choose TWO.)

A company runs a containerized microservices application on Amazon EKS. The operations team notices that some pods are frequently being evicted due to resource constraints. The team wants to improve resource utilization and reduce evictions. Which TWO actions should the team take? (Choose two.)

A company is deploying a new microservices application on Amazon ECS using Fargate. The application consists of several services that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. Additionally, the company needs to ensure that traffic between services is encrypted in transit. The security team requires that all inter-service traffic uses TLS. Which combination of services should be used to meet these requirements?

A company is running a stateful web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data locally on the instance. The company wants to make the application highly available and fault-tolerant without rewriting the application code. What should the solutions architect do?

A company is designing a new data lake on Amazon S3. They need to ensure that data is encrypted at rest and that access is audited. Which services should they use? (Choose TWO.)

A Lambda function logs are being retained for 30 days. The company wants to reduce costs by deleting logs older than 7 days. What should they do?

A company uses AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required to set this up?

A company is migrating a legacy .NET application to AWS. The application uses Windows authentication and has a dependency on a local file system. The company wants to minimize code changes. Which combination of services should be used?

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache for Redis cluster. Recently, the operations team noticed that during traffic spikes, the ALB returns 5xx errors and the application becomes slow. CloudWatch metrics show that the Redis cluster's CPU utilization reaches 100% and memory usage is high. The Auto Scaling group scales out, but the new instances take several minutes to warm up and become healthy. The company needs to improve the application's ability to handle traffic spikes with minimal impact on performance. Which solution should the company implement?

A company is building a serverless application using AWS Lambda and Amazon DynamoDB. They need to ensure that the application can handle a sudden increase in traffic without losing any data or causing errors. Which THREE strategies should they implement?

A company wants to centralize management of Amazon EC2 instances across multiple accounts using AWS Systems Manager. The company uses AWS Organizations. What is the simplest way to enable Systems Manager to manage instances in all accounts?

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They want to implement a blue/green deployment strategy with minimal impact on users. Which approach should they use?

A company has a global AWS environment with multiple VPCs in different regions. The company uses AWS Transit Gateway to connect VPCs in the same region, but they need to interconnect VPCs across regions. The network team wants a solution that provides transitive routing across regions with minimal latency and operational overhead. Which solution should be implemented?

A company is designing a new cloud-native application that will run on Amazon ECS with Fargate. The application must store logs centrally for analysis. Which TWO services can be used to collect and analyze logs from ECS Fargate tasks?

A company runs a web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The application writes logs to local instance storage. The company wants to centralize log collection and ensure logs are retained even if instances are terminated. The current solution uses Amazon CloudWatch Logs agent, but log streams are frequently missing when instances are replaced. What should the company do to ensure complete log collection?

A company is setting up a new AWS Organization and wants to implement a data perimeter to ensure that data can only be accessed from approved network locations. Which TWO actions should the company take?

A company is migrating a monolithic application to a microservices architecture on Amazon ECS. The application uses a shared MySQL database. Which THREE strategies should the company use to modernize the data layer?

A company is migrating a critical 3-tier application to AWS. The application consists of a web tier, an application tier, and a PostgreSQL database. The web and application tiers are stateless and run on Linux. The company has deployed the web tier on EC2 instances behind an Application Load Balancer (ALB) across two Availability Zones. The application tier is deployed on EC2 instances in an Auto Scaling group across two Availability Zones. The PostgreSQL database is migrated to Amazon RDS for PostgreSQL with Multi-AZ deployment. The application uses sticky sessions (session affinity) to maintain user sessions on the web tier. After migration, users report that they are frequently logged out and lose session data. The web tier logs show that requests are being routed to different web instances. What is the MOST likely cause of this issue?

A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer. The application stores session state in a local file system on the container. Users report that they are frequently logged out and lose session data. What is the most likely cause?

A company wants to decouple a microservices architecture where one service (producer) sends events to another service (consumer). The producer can generate bursts of events, and the consumer processes them in batches. The solution must be serverless and handle potential consumer failures without losing events. Which AWS service should be used as the message broker?

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization on tasks during these spikes. The current task definition has 1 vCPU and 2 GB memory. Which improvement will most effectively reduce latency without over-provisioning?

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. Recently, the company has observed increased latency and occasional 5xx errors from the API. The operations team wants to implement continuous improvements. Which TWO actions should be taken to improve performance and reliability? (Choose 2)

A company is planning a hybrid cloud migration and needs to establish a dedicated network connection between its on-premises data center and AWS with consistent low latency. Which AWS service should be used?

A company is migrating a monolithic application to microservices on AWS. The current application uses a single Amazon RDS for PostgreSQL database. To avoid tight coupling, each microservice should have its own database. The company needs to minimize downtime during migration. Which THREE strategies should be used?

A company is designing a serverless application using AWS Lambda and Amazon API Gateway. The application must handle sudden spikes in traffic and ensure that no requests are lost. Which of the following design choices will BEST meet these requirements?

A company is migrating a .NET application from Windows Server to AWS. The application uses Microsoft SQL Server. The company wants to reduce licensing costs and minimize operational overhead. Which migration strategy should be recommended?

A company is migrating an on-premises application to AWS. The application requires persistent shared storage that can be accessed by multiple EC2 instances simultaneously with strong consistency. Which AWS storage solution should the company use?

A company runs a microservices architecture on Amazon ECS with Fargate. The operations team observes that some services are experiencing high latency during peak hours. The team wants to identify the root cause. Which THREE approaches should the team use? (Choose THREE.)

A multinational corporation is deploying a multi-account AWS environment using AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with a specific AWS KMS key managed by the security account. Which solution should the company implement to enforce this policy across the organization?

A company is using Amazon CloudFront to deliver content to users worldwide. The origin is an S3 bucket. Users in some regions experience high latency. What is the most effective way to reduce latency?

A company has multiple AWS accounts and wants to centrally manage CloudWatch dashboards. Which solution should they use?

A company is designing a serverless application using AWS Lambda to process incoming files from Amazon S3. Each file is less than 1 MB and processing must complete within 10 seconds. The application must handle bursts of up to 1,000 concurrent invocations. Which configuration will provide the MOST cost-effective solution?

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an S3 bucket and a Lambda function that processes objects uploaded to the bucket. Recently, updates to the Lambda code caused the stack update to fail because the S3 bucket already existed in the account. What is the most efficient way to allow future updates without error?

A company is designing a new application that will run on Amazon ECS with Fargate. The application consists of three microservices: Service A, Service B, and Service C. Service A receives HTTP requests from an Application Load Balancer and sends messages to an Amazon SQS queue. Service B polls the SQS queue and processes the messages, storing results in Amazon DynamoDB. Service C reads from DynamoDB and sends notifications via Amazon SNS. The company expects variable traffic and wants to minimize costs. During a load test, the team observes that Service B is not scaling fast enough, causing the SQS queue to grow. The team also notices that Service C is idle most of the time. Which solution should the company implement to improve scaling and reduce costs?

An IAM policy is attached to a role used by AWS DMS for a database migration from an RDS MySQL instance to an S3 bucket. The migration fails with an access denied error when writing to S3. Which missing permission is the most likely cause?

A company has a legacy monolithic application running on a single EC2 instance. The application stores customer data in an attached EBS volume. The company wants to modernize the application to improve scalability and availability. Which approach should a solutions architect recommend?

A company is using Amazon CloudFront to distribute content globally. They want to improve the cache hit ratio. Which TWO actions are most effective? (Choose two.)

A company is migrating a monolithic application to AWS. The application currently runs on a single on-premises server and uses a local MySQL database. To reduce migration risk, the company wants to minimize application code changes. Which AWS service should the company use to migrate the database with minimal application modification?

A company is migrating a legacy on-premises application to AWS. The application uses a shared file system for user home directories. Which AWS service should the company use to minimize changes to the application while providing scalable, highly available file storage?

A company is deploying a new application on AWS and wants to implement a least-privilege IAM policy for an EC2 instance that needs to read from an S3 bucket (my-bucket) and write logs to CloudWatch Logs. Which TWO statements should be included in the IAM policy? (Choose two.)

A company is designing a new data lake on Amazon S3. They need to query the data using standard SQL and expect to run complex queries that scan large datasets. The query performance should be optimized to minimize data scanned. Which service should they use?

A company is migrating a legacy on-premises application to AWS. The application requires a relational database with Oracle compatibility and the ability to run read replicas across multiple Availability Zones. Which AWS service should the company use to minimize migration effort?

A company is using t3.large instances in an Auto Scaling group. They want to launch instances that support both x86_64 and arm64 architectures. Based on the exhibit, can they meet this requirement with t3.large?

A financial services company runs a critical application on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Amazon RDS for MySQL database with Multi-AZ deployment. The company has a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour for the database. During a recent disaster recovery drill, the solutions architect simulated an Availability Zone failure by terminating all EC2 instances and the primary RDS instance in one AZ. The Auto Scaling group launched new instances in the other AZ, and the RDS Multi-AZ failover completed in about 2 minutes. However, the application remained unavailable for 30 minutes because the new EC2 instances could not connect to the RDS secondary instance. The security groups are configured correctly. The RDS instance is not publicly accessible. What is the MOST likely cause of the connectivity issue?

Drag and drop the steps to recover an Amazon RDS Multi-AZ DB instance after a primary instance failure in the correct order.

A company runs a stateful web application on EC2 instances with EBS volumes. They want to improve resilience by distributing the workload across multiple Availability Zones. Which THREE steps should they take?

A company is designing a serverless data processing pipeline using AWS Step Functions, AWS Lambda, and Amazon DynamoDB. The pipeline must process incoming JSON records from an Amazon Kinesis Data Stream. Each record must be processed exactly once and in order. The company expects a throughput of up to 1,000 records per second. Which combination of services and configurations should the company use to meet these requirements? (Choose TWO.)

A company is migrating a large-scale data analytics workload from on-premises to AWS. The workload uses Apache Spark to process terabytes of data daily. The company wants to use Amazon EMR for the migration. The current on-premises cluster has 20 nodes, each with 64 vCPUs and 256 GB of RAM. The data is stored in HDFS on the cluster. The company wants to minimize costs while maintaining performance. The data sources are in Amazon S3 and on-premises. The company has set up a dedicated AWS Direct Connect connection. Which EMR configuration should the company use?

A company is using AWS Organizations with a hierarchical OU structure. The security team wants to enforce that any new account created in the organization automatically inherits a baseline set of AWS Config rules and a VPC with a default CIDR block. What is the MOST efficient way to achieve this?

A company is migrating a 10 TB Oracle database to Amazon RDS for Oracle. The migration must have minimal downtime. The source database is running on-premises with limited bandwidth (50 Mbps). Which strategy should be used?

A company uses AWS CloudFormation to deploy infrastructure. They want to update a stack but need to ensure that a specific resource is not accidentally replaced. Which CloudFormation attribute should they use?

A company is designing a new microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other securely. The company wants to use service discovery so that services can find each other using DNS names. Which AWS service should the company use?

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without direct coupling. Which AWS service should they use to decouple the services?

A company is migrating a large e-commerce platform to AWS using a lift-and-shift approach. The application consists of a web tier, application tier, and a MySQL database. After migration, users report intermittent slow page loads. The operations team notices high CPU utilization on the application tier instances. Which THREE steps should the team take to address the performance issues?

A company runs a web application on a single EC2 instance. They want to improve availability and fault tolerance with minimal architectural changes. What should they do?

A company uses AWS Organizations with a large number of accounts. The security team needs to enforce that only approved AMIs from a central account can be used to launch EC2 instances in all accounts. Which combination of actions should be taken? (Choose TWO.)

A company is designing a multi-region disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon Aurora MySQL database. The RTO is 15 minutes and RPO is 1 minute. Which THREE steps should the solutions architect take to meet these requirements?

A company wants to migrate a legacy .NET application to AWS. The application uses Windows authentication and requires a shared file system. Which TWO AWS services should the company use to modernize this application? (Choose two.)

A company wants to implement a centralized logging solution for its multi-account AWS environment. The solution must be resilient to AWS Regional failures and provide near real-time log delivery. Which combination of services should the company use?

A company is designing a new data lake on AWS. The data lake will store raw data from various sources in Amazon S3. The data will be processed using AWS Glue ETL jobs and queried using Amazon Athena. To optimize costs and performance, which three practices should the solutions architect implement?

A company uses AWS Organizations with a single OU for all member accounts. The company wants to restrict the use of specific Amazon EC2 instance types across all member accounts. However, the management account should not be restricted. Which solution meets this requirement?

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to decouple the application into microservices while minimizing changes to the existing code. Which design approach is MOST cost-effective and requires the least code changes?

A financial services company is designing a highly available architecture for a critical application on AWS. The application runs on EC2 instances and uses an Oracle database. The database must be resilient to an Availability Zone failure and must have automated failover. Which database solution meets these requirements?

A company is migrating a web application to AWS and wants to modernize it by using a microservices architecture. Which TWO AWS services should the company use to implement service discovery and API gateway functionality?

A financial services company is designing a new application that processes sensitive transactions. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application writes transaction logs to an Amazon EFS file system. The company needs to ensure that the logs are encrypted at rest using a customer-managed AWS KMS key. Additionally, the logs must be retained for 7 years and should not be accessible after that period. Which solution meets the encryption and retention requirements?

A company is migrating a stateful application that uses local storage on EC2. They want to modernize to a stateless architecture using Amazon EFS for shared storage. What is the best approach to migrate the existing data?

Refer to the exhibit. An IAM policy is attached to a user in the management account of AWS Organizations. The user wants to assume the OrganizationAccountAccessRole in a member account. However, the user receives an access denied error. What is the most likely reason?

A company needs to share a central Amazon S3 bucket containing common data files with multiple accounts in AWS Organizations. Which approach is most secure and scalable?

A company runs a stateful application on EC2 instances in an Auto Scaling group behind an ALB. They want to perform a rolling update without losing session state. Which solution is most appropriate?

A company has a centralized logging account and multiple member accounts. The security team wants to enable VPC Flow Logs for all VPCs across all accounts and centralize the logs in the logging account. The solution must be automated and ensure that new VPCs are automatically included. Which approach should be taken?

Refer to the exhibit. A security engineer applied this bucket policy to an S3 bucket. A developer tries to upload an object using the AWS CLI without specifying any encryption. What is the outcome?

A company is using AWS Lambda functions to process data from an SQS queue. The Lambda function sometimes fails due to transient errors, but the messages are not being retried. Which configuration should the company check to ensure proper retry behavior?

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which THREE mechanisms can be used for service-to-service communication? (Choose THREE.)

A company is designing a new VPC for a web application that must be accessible from the internet. The application will run on EC2 instances in private subnets. Which TWO components are required to allow the EC2 instances to access the internet for updates?

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all VPC Flow Logs from all accounts are delivered to a central Amazon S3 bucket in the logging account. The logs must be encrypted at rest using AWS KMS. The company currently uses AWS Organizations. Which solution meets these requirements with the least operational overhead?

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. The team wants to capture network traffic between containers for troubleshooting. Which solution should they implement?

A company is designing a new application that will process streaming data from IoT devices. They need to ingest data in real time and apply transformations before storing it in Amazon S3. Which AWS service should they use?

A company is designing a new application that requires a relational database. The application has variable workloads with predictable spikes. The company wants to minimize costs while ensuring that the database can handle the spikes. Which Amazon RDS feature should the company use?

A company is designing a new application that must meet PCI DSS compliance requirements. The application will process credit card transactions and store encrypted data. Which AWS service should be used to manage the encryption keys?

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to store session state data that must be highly available and low latency. The data is accessed frequently and can be recreated if lost. Which storage solution should the solutions architect recommend?

A startup is designing a data lake on AWS using Amazon S3. They expect to ingest hundreds of terabytes of data from IoT devices daily. Data is in JSON format and will be queried using Amazon Athena. Which combination of actions will optimize query performance and minimize costs?

Refer to the exhibit. A company has an S3 bucket policy that requires server-side encryption with AES256 for all objects uploaded. However, users can still upload objects without encryption. What is the MOST likely reason?

A company is moving its application from on-premises to AWS. They want to use the same third-party software licenses on AWS. Which AWS purchasing option allows them to bring their own licenses?

A company is designing a new serverless application using AWS Lambda. The application must process files uploaded to an S3 bucket. Each file can be up to 1 GB in size. The processing time for each file is expected to be up to 15 minutes. The company wants to minimize cost and operational overhead. Which TWO configuration choices should the company make? (Choose TWO.)

A company uses AWS Organizations with 50 accounts. The network team wants to centrally manage VPC flow logs for all accounts, storing them in a central S3 bucket in the security account. The flow logs must be encrypted with a KMS key managed by the security account. What is the MOST efficient way to configure this?

A company has a stateful web application running on Amazon EC2 instances. They want to implement blue/green deployments to reduce downtime. Which TWO actions should the company take? (Choose TWO.)

A company wants to modernize a legacy monolithic application by decomposing it into microservices. The application handles HTTP requests and uses a MySQL database. The company needs to decouple the microservices and improve scalability. Which AWS services should be used?

A company is migrating a web application to AWS and wants to use a microservices architecture. The application needs to communicate synchronously via REST APIs. Which TWO AWS services should the architect consider for implementing API communication?

A company has a monolithic application running on a single Amazon RDS for MySQL DB instance. The application is experiencing performance issues due to heavy read traffic. The company wants to implement a solution that offloads read traffic with minimal application changes. What should a solutions architect do?

A company uses AWS Control Tower to manage a multi-account environment. The security team wants to ensure that all accounts conform to a set of baseline rules, including encryption at rest for S3 buckets. Which THREE steps should the team take to implement this control? (Choose THREE.)

A company uses AWS CloudFormation to manage infrastructure. A recent update to a stack failed, and the stack is now in a ROLLBACK_COMPLETE state. The team needs to investigate the cause and then redeploy the update. Which TWO actions should the team take? (Choose two.)

A global company uses AWS Organizations with hundreds of accounts. The security team requires that all S3 buckets across the organization block public access. They want to enforce this policy without modifying existing bucket policies. Which solution should they use?

A Solutions Architect is reviewing the CloudFormation template snippet shown in the exhibit. What will happen when this template is deployed?

A company uses AWS Organizations with multiple OUs. The security team wants to enforce that no resources can be created outside of approved AWS Regions. Which policy should be used, and how should it be attached?

A company runs a containerized application on Amazon ECS with Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. The company has configured a target tracking scaling policy based on average memory utilization. During a traffic spike, the ECS service scales out, but the new tasks are immediately deregistered and replaced. The CloudWatch logs show that the new tasks are failing the ALB health check. The health check is configured to ping the '/health' endpoint on the container. The solutions architect verifies that the application container correctly responds to the '/health' endpoint with a 200 status code. What is the MOST likely cause of the health check failures?

A global e-commerce company is migrating its on-premises application to AWS. The application uses Active Directory for authentication and requires integration with AWS Managed Microsoft AD. The company has a multi-account strategy using AWS Organizations. Which TWO steps should the solutions architect take to ensure seamless authentication across the organization?

A company is designing a new application that will store sensitive user data in Amazon S3. Compliance requirements mandate that all data must be encrypted at rest using a key that is managed by the company and rotated automatically every year. Which solution meets these requirements?

A company is building a data analytics pipeline. Raw data is ingested into an Amazon S3 bucket. The data must be transformed and loaded into Amazon Redshift for analysis. The pipeline must handle late-arriving data and ensure data consistency. Which THREE AWS services should the company use?

A company is designing a multi-account strategy for its AWS environment. Which TWO considerations are important when using AWS Organizations?

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, the application experienced a 5-minute downtime. The application uses a connection pool with a 30-second connection timeout. The RDS DNS name is used as the endpoint. What is the MOST likely cause of the downtime?

A company is migrating a legacy application to AWS. The application requires a shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones. The file system must provide high throughput and low latency. Which storage solution meets these requirements?

A company runs a containerized application on Amazon ECS using Fargate. The application experiences intermittent high latency during peak hours. The operations team suspects that the task placement strategy is causing resource contention. The cluster uses the default binpack strategy. What should the team do to improve performance?

A company wants to migrate an on-premises relational database to Amazon RDS for MySQL with minimal downtime. The database is 500 GB in size. Which AWS service should be used for the initial data load and ongoing replication?

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

A company is migrating a large-scale data warehouse from on-premises to Amazon Redshift. The current on-premises solution uses a proprietary columnar storage format. The company needs to minimize data transformation effort. Which approach should the company take?

A company is modernizing a legacy application by breaking it into microservices. The application uses a shared MySQL database. The team wants to refactor the database to use Amazon DynamoDB for better scalability. Which migration strategy should be used?

A large financial services company uses AWS Organizations with over 200 accounts. The security team has implemented a Service Control Policy (SCP) that denies access to all services except a whitelist that includes Amazon S3, Amazon DynamoDB, AWS Lambda, and Amazon CloudWatch. Recently, the DevOps team reported that they cannot create new EC2 instances in their development account, even though the administrator explicitly attached an IAM policy allowing ec2:RunInstances. The SCP does not explicitly deny EC2. What is the most likely cause of this issue?

A company is designing a serverless data processing pipeline using AWS Lambda. The pipeline processes data from an Amazon Kinesis Data Stream. The Lambda function has a memory limit of 512 MB and a timeout of 5 minutes. The data volume is expected to increase significantly. Which TWO strategies should the company implement to improve throughput and reduce processing latency? (Choose TWO.)

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket is used to store sensitive logs from multiple accounts in an AWS Organization. What is the primary purpose of the condition element in this policy?

A company is designing a new serverless application that uses AWS Lambda, Amazon DynamoDB, and Amazon API Gateway. The application must handle burst traffic and cannot lose any data. The company wants to use a dead-letter queue (DLQ) for failed Lambda invocations. Which TWO services can be used as a DLQ for Lambda? (Choose two.)

A multinational company wants to implement a multi-account AWS environment using AWS Organizations. The security team requires that all new accounts automatically have AWS CloudTrail and AWS Config enabled with specific rules. Which solution should the company use to enforce these settings across all accounts?

A company is migrating a legacy e-commerce platform to AWS. The platform includes a MySQL database that experiences heavy read traffic. The company wants to improve performance and reduce latency for read operations. Which TWO actions should the solutions architect take?

A company is designing a multi-tier web application on AWS. They want to ensure that the web tier can scale automatically based on CPU utilization. Which AWS service should they use?

An IAM policy condition allows launching EC2 instances only if the instance type is t2.micro or t2.small. A developer tries to launch a t2.medium instance. What happens?

A company uses AWS Organizations with multiple OUs. The DevOps team needs to allow developers to launch EC2 instances only of type t3.micro in the dev OU. Which action should the team take?

A company is migrating a distributed application that uses a custom TCP protocol between components. The application is deployed on-premises across multiple servers. The company wants to use AWS without modifying the application code. Which approach should the company take to migrate the application while maintaining low latency between components?

A company plans to migrate on-premises workloads to AWS. They have 500 VMs and need to ensure consistent network segmentation and security group rules across multiple VPCs in different AWS accounts. The network team uses a centralized hub-and-spoke model with AWS Transit Gateway. Which approach minimizes operational overhead while maintaining security compliance?

A global company has a multi-region AWS deployment. They need to share a single Amazon RDS for MySQL database across multiple AWS Regions for disaster recovery. The database must have minimal data loss and RTO of less than 1 minute. Which solution meets these requirements?

A CloudFormation stack deployment failed with the status ROLLBACK_COMPLETE. What is the most likely cause?

A company is migrating a legacy .NET application to AWS. The application currently runs on Windows Server and uses a SQL Server database. The company wants to minimize licensing costs and operational overhead. Which migration strategy should the company use?

A company uses AWS Organizations with 100 accounts. They want to restrict which AWS services can be used in the development OU. Which TWO steps should they take?

A company is designing a new web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be highly available across multiple Availability Zones. The company wants to ensure that if an EC2 instance fails, the load balancer stops sending traffic to it. Which two steps should the architect take? (Choose TWO.)

Refer to the exhibit. A solutions architect runs this CLI command but receives an error: 'Unknown options: --query'. What is the most likely cause?

A company is designing a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The Lambda function sometimes experiences throttling, causing messages to be sent to the dead-letter queue (DLQ). The company wants to minimize throttling and ensure that messages are processed in order. What should the solutions architect do?

A company is migrating to a multi-account structure and needs to manage DNS resolution across accounts. The company uses Amazon Route 53 private hosted zones. They want a central resolver in the shared services VPC. Which THREE components are required?

A company is designing a data lake on AWS using Amazon S3. They need to run SQL queries on the data without moving it to a separate database. Which AWS service should they use?

A company is migrating a legacy mainframe application to AWS. The application uses a hierarchical database (IMS) and has complex batch processing jobs. The company wants to minimize changes to the application code. Which approach should be taken?

A company is designing a new application that will run on Amazon EKS. The application requires persistent storage that can be accessed by multiple pods simultaneously. The storage must be highly available and durable. Which storage solution should be used?

A company applied the above SCP to an OU. A developer in an account under that OU tries to launch a t2.medium EC2 instance. What will happen?

A company is designing a new disaster recovery (DR) strategy for its critical applications. The DR plan must achieve a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 minute. The applications run on Amazon EC2 instances with Amazon EBS volumes. Which THREE actions should the company take to meet these requirements? (Choose three.)

A company deploys the above CloudFormation template. After creation, they upload a file to the bucket and then delete it. What happens to the deleted object after 30 days?

A financial services company has a multi-account AWS Organization with hundreds of accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest and that no public read access is allowed. They want a solution that automatically remediates non-compliant buckets in real time. What is the MOST scalable and operationally efficient approach?

A company uses AWS Organizations with a central security account. They need to ensure that any S3 bucket created in any account is configured with encryption and versioning enabled. Which THREE steps should they take?

A company wants to serve static content (images and videos) to users worldwide with low latency. The content is stored in an Amazon S3 bucket. What is the most cost-effective solution?

A company is designing a high-performance computing (HPC) workload on AWS. The workload requires tightly coupled inter-node communication with low latency and high bandwidth. Which THREE services or features should the architect consider to meet these requirements? (Choose three.)

An organization is planning to migrate a large number of on-premises virtual machines to AWS. The migration must be automated and support replication of live workloads with minimal downtime. Which AWS service is best suited for this task?

A company runs a web application on EC2 instances behind an Application Load Balancer. Recently, the application has been experiencing intermittent latency spikes. CloudWatch metrics show high CPU utilization on the instances during these spikes, but no corresponding increase in request count. Which action is MOST likely to identify the root cause?

A company wants to allow developers to manage their own resources in individual AWS accounts while the central IT team manages networking and security. Which AWS service can help enforce that developers cannot modify networking resources?

A company is migrating a multi-tier web application to AWS. The application uses a commercial database that requires a license. The company wants to reduce licensing costs. Which migration strategy should be considered?

A media company runs a video processing pipeline on AWS. The pipeline uses AWS Step Functions to orchestrate multiple AWS Lambda functions. The first Lambda function downloads a video file from an S3 bucket, the second transcodes it using AWS Elemental MediaConvert, and the third uploads the transcoded files to a different S3 bucket. Recently, the pipeline has been failing intermittently with 'State machine execution timed out' errors. The Step Functions execution history shows that the first Lambda function takes up to 25 minutes to complete for large video files. The Step Functions state machine has a default execution timeout of 5 minutes. The company wants to fix the timeout issue without redesigning the entire pipeline. Which solution should the solutions architect recommend?

A security engineer runs the above command to list network interfaces attached to security group sg-12345678. The engineer notices that instance i-0a1b2c3d4e5f67890 has two network interfaces but only one is shown in the output. What is the MOST likely reason?

A company is migrating a web application to AWS and wants to decouple the frontend and backend tiers to improve scalability. The frontend runs on Amazon EC2 behind an Application Load Balancer (ALB). The backend processes orders asynchronously. Which service should the company use to decouple the tiers?

Refer to the exhibit. A solutions architect is reviewing this SCP. What is the effect of this SCP when attached to an organizational unit (OU)?

A company has a multi-account architecture with a shared services account that hosts a central Amazon RDS instance. Member accounts need to access this database. Which TWO actions should the company take to enable secure access?

A company is migrating a monolithic application to microservices on AWS. They want to implement a continuous improvement process for existing services. Which AWS service should they use to collect and analyze operational metrics and logs from all microservices in a centralized location?

A company wants to use AWS Resource Access Manager (RAM) to share a subnet in a VPC with other accounts in the organization. Which of the following are required? (Choose THREE.)

A company uses AWS Organizations with multiple OUs. The DevOps team wants to allow developers in a specific OU to create and manage their own VPCs but restrict them from deleting VPCs created by the central networking team. How can this be achieved?

Refer to the exhibit. A company has an Amazon ECS task definition with two containers. The 'web' container is essential, and the 'sidecar' container is not. The 'sidecar' container exits unexpectedly. What will happen to the task?

A company uses AWS Organizations with a multi-account setup. The central IT team manages a shared services VPC in the network account, which hosts a NAT gateway, a VPN connection to the on-premises network, and a transit gateway. Several application accounts have VPCs attached to the transit gateway. Recently, the application teams report that they cannot reach the on-premises network through the VPN. The network team confirms that the VPN is up and routes are propagated in the transit gateway route tables. However, the application VPCs are not receiving the routes. What is the MOST likely cause?

A company uses AWS Organizations and wants to delegate administrative tasks for specific AWS services to a member account. Which AWS feature should be used?

A company wants to migrate 500 TB of data from an on-premises data center to Amazon S3. The company has a 1 Gbps dedicated network connection to AWS. What is the most cost-effective and time-efficient migration method?

A company uses AWS Lambda with a VPC configuration to access an RDS database. After a recent change, the Lambda function times out when connecting to the database. The security group and network ACLs appear correct. What should the company check first?

A solutions architect sees the above CloudWatch metric data for a Lambda function. The function is triggered by an SQS queue. The errors occur in a pattern: exactly 5 errors at 00:10, 00:30, and 00:50. What is the MOST likely cause?

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by project, but projects span multiple accounts. Which approach should be used to tag resources consistently across accounts?

A company uses AWS Organizations and has deployed a multi-account strategy. The security team wants to enforce that all S3 buckets have versioning enabled. They create an SCP that denies the PutBucketVersioning action if versioning is not enabled. However, they find that the SCP is not preventing users in member accounts from disabling versioning on existing buckets. What is the most likely reason?

A startup is designing a new web application that will be hosted on AWS. The application consists of a static frontend and a backend API. The frontend is built with React and the backend is a RESTful API built with Node.js. The startup expects low traffic initially but wants to be able to scale to millions of users. The team wants to minimize operational overhead and cost. Which architecture should they use?

A company is designing a multi-account strategy using AWS Organizations. Which TWO benefits does this approach provide? (Choose TWO.)

A company is planning to migrate its on-premises infrastructure to AWS. The company wants to assess the current environment and create a migration plan. Which TWO AWS services should be used for discovery and assessment?

A company is designing a data lake on AWS using Amazon S3. They need to query the data using standard SQL without moving it to a separate analytics store. Which AWS service should they use?

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances launched in any account must have a specific tag key 'CostCenter'. Which approach should be used?

A company is building a serverless data processing pipeline. Data is uploaded to an S3 bucket, which triggers a Lambda function to transform the data and store the result in another S3 bucket. The Lambda function needs to access a VPC-hosted database for enrichment. What is the MOST secure way to allow the Lambda function to access the VPC resources?

A company has a production Amazon ECS service running on Fargate. The service needs to be updated to use a new task definition with different environment variables. The company wants to perform a rolling update with minimal impact. What is the correct way to update the service?

A company is designing a new real-time analytics platform that processes streaming data from IoT devices. The data must be ingested, processed with windowed aggregations, and stored in Amazon S3 for long-term analytics. The solution must handle late-arriving data and provide exactly-once processing semantics. Which combination of AWS services should the architect use?

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to automatically roll back a stack update if it fails, and receive a notification. What should be configured to meet these requirements?

A company is modernizing a .NET Framework application to run on AWS. The application currently uses Windows Communication Foundation (WCF) services. The company wants to minimize code changes and run on Linux. Which approach should the company take?

A company is designing a multi-region active-active application using Amazon Aurora Global Database. The application writes to a custom domain endpoint that routes to the primary cluster. To minimize write latency, the application should write to the nearest region. Which configuration should the solutions architect use?

A company uses AWS CodeBuild to compile and test code. The build process takes a long time because dependencies are downloaded from the internet each time. The company wants to speed up the build process. Which TWO actions should the company take? (Choose TWO.)

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header for authentication. The security team wants to ensure that requests are only accepted from authenticated users. Which TWO actions should the team take?

A company is designing a new cloud-native application on AWS. The application will use a microservices architecture and requires a way to manage configuration data and secrets. Which THREE AWS services can be used to meet these requirements? (Choose THREE.)

A company is migrating its on-premises applications to AWS. The company has a mix of Windows and Linux servers. The migration team wants to automate the discovery of application dependencies and track the migration progress. Which TWO AWS services should the team use? (Choose TWO.)

A company runs a batch processing job on a schedule using AWS Lambda. The job processes files from an S3 bucket and writes results to another S3 bucket. Recently, the job has been failing with the error 'Access Denied' when trying to write to the destination bucket. The Lambda function's execution role has the following IAM policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::source-bucket/*", "arn:aws:s3:::source-bucket" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::destination-bucket/*" } ] } The Lambda function also has a VPC configuration to access an RDS instance. The S3 buckets are in the same region. The Solutions Architect verified that the destination bucket policy does not deny access. What is the MOST likely cause of the 'Access Denied' error?

A company is deploying a web application on AWS. The application requires a relational database with read replicas for scaling read queries. The database must support automatic failover and be Multi-AZ. Which database solution meets these requirements?

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application uses a custom health check that reports instance health to Amazon CloudWatch. The Auto Scaling group is configured with an EC2 health check type. Recently, the company noticed that instances failing the custom health check are not being terminated and replaced. What should the solutions architect do to ensure that instances failing the custom health check are automatically replaced?

Refer to the exhibit. A company applies this S3 bucket policy to a central logging bucket. CloudTrail trails in multiple accounts are configured to deliver logs to this bucket. Recently, logs stopped being delivered. What is the most likely cause?

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The database experiences high write latency during peak hours. The solutions architect suggests using an RDS read replica to offload read traffic. Which THREE steps are necessary to implement this solution?

Drag and drop the steps to set up a Direct Connect private virtual interface in the correct order.

A company is using Amazon S3 to store sensitive documents. The security team requires that all objects be encrypted at rest using a customer-managed key (CMK) stored in AWS KMS. Additionally, the CMK must be rotated automatically every year. How should the company configure this?

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles for cross-account access. They want to ensure that when a role is created in a member account, it automatically adheres to the principle of least privilege and is auditable. What solution should they implement?

A company uses AWS Organizations and wants to centrally manage VPC flow logs for all VPCs across all accounts. Which TWO steps are required to achieve this?

A company is designing a multi-region active-active architecture for a web application using Amazon Route 53 latency-based routing. The application runs on EC2 instances in Auto Scaling groups with Application Load Balancers in each region. The application uses an Amazon Aurora global database for its data tier. The architecture must provide the lowest possible RTO and RPO for regional failures. What should the company do to meet these requirements?

A company is using AWS Migration Hub to track a large-scale migration to AWS. The company wants to automate the replatforming of multiple Windows web servers to Amazon EC2 instances running Amazon Linux 2. The migration must be repeatable and minimize manual intervention. Which AWS service should the company use to achieve this?

A company has a production AWS account that is part of an AWS Organization. The account has a VPC with a NAT gateway for internet access. The security team wants to ensure that all outbound traffic to the internet flows through a centralized inspection VPC in the security account for traffic inspection. Which architecture should be used?

A company has a central IT team that manages networking resources for multiple application teams. Each application team needs to manage its own EC2 instances and RDS databases. Which AWS architecture best supports this separation of duties?

A company is centralizing its logging across multiple AWS accounts using a central logging account. Each application account delivers its CloudTrail logs and VPC Flow Logs to an S3 bucket in the logging account. The security team needs to query these logs using Amazon Athena. The logs are currently in separate S3 prefixes per account. The team wants to create a single Athena table that can query logs from all accounts without having to modify the table definition every time a new account is added. The logs are in CSV format for VPC Flow Logs and JSON format for CloudTrail. What is the MOST efficient solution?

A company is migrating a legacy application to AWS and needs to ensure that the application can access on-premises resources securely. The company has established an AWS Direct Connect connection. Which AWS service should the company use to route traffic between the VPC and the on-premises network?

A company is migrating a monolithic legacy application to a microservices architecture on AWS. The application currently uses a relational database with complex joins. The migration must minimize application changes. Which database strategy should be used for the new architecture?

A company is designing a data lake on AWS using Amazon S3. The data will be ingested from various sources and must be encrypted at rest. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption option should be used?

A security engineer runs the command above and finds an ENI attached to a Lambda function. The security group sg-12345678 allows inbound traffic on port 443 from 0.0.0.0/0. The Lambda function is used to process API requests. The engineer is concerned about security. What should the engineer do?

A company wants to automate the creation of new AWS accounts and apply baseline security configurations. Which combination of services should be used to achieve this?

A company uses AWS Organizations and wants to implement a policy that prevents any account from disabling AWS CloudTrail or deleting CloudTrail log files. The solution must be enforceable across all accounts. Which combination of actions should be taken?

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. A security analyst needs to query the logs to identify traffic to a specific IP address. The analyst has been granted read-only access to the S3 bucket. However, the analyst cannot access the logs. What is the MOST likely cause?

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

A company with multiple AWS accounts wants to centralize CloudTrail logging. They create a CloudTrail trail in the management account that logs all events across all accounts and regions. However, the security team notices that some management events from member accounts are not being logged. What is the most likely cause?

A company uses Amazon S3 to store critical data. The company wants to ensure that data is protected against accidental deletion and that deleted objects can be recovered within 30 days. Which S3 feature should the company enable?

An S3 bucket contains thousands of objects under the 'logs/' prefix. The above AWS CLI command is run to list objects larger than 1000 bytes. The command returns an empty array, but there are known objects larger than 1000 bytes. What is the most likely reason?

A company is using Amazon API Gateway with a Lambda authorizer to authenticate requests. The Lambda authorizer function times out frequently during peak traffic. The company wants to improve authorization performance without changing the authentication logic. Which TWO actions should the company take? (Choose TWO.)

A company uses AWS Organizations with 50 accounts. They need to manage EC2 instance inventory across all accounts. Which THREE steps are necessary to achieve this?

A company is designing a data lake on Amazon S3. Data is ingested from multiple sources and stored as Parquet files partitioned by date. The company needs to ensure that only authorized users can access the data, and that the data is encrypted at rest. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

A startup is using a single AWS account for development, testing, and production. They want to isolate environments and improve security. What is the most aligned AWS best practice?

Which THREE design patterns are recommended for decoupling components in a microservices architecture on AWS?

A solutions architect notices that an Auto Scaling group's instances are continuously being terminated and replaced. CloudWatch logs show that health checks are failing due to high memory usage. The instances run a memory-intensive application. What should the architect do to improve stability?

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences high read traffic. The application is read-heavy and can tolerate eventual consistency for some queries. What is the MOST effective way to improve read performance without significant architectural changes?

A company runs a stateless web application on EC2 instances behind an Application Load Balancer (ALB). During peak traffic, some instances become unhealthy and are replaced by Auto Scaling, but users experience errors. What is the MOST likely cause?

A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires that users' session data be stored and made available across all instances. Which solution is MOST cost-effective and scalable?

A company is designing a new data lake on AWS using Amazon S3. The data must be encrypted at rest. Which TWO options comply with the requirement? (Choose TWO.)

A company is modernizing a legacy .NET application by containerizing it on Amazon ECS. The application currently uses Windows authentication against on-premises Active Directory. After migrating, the application needs to authenticate users against AWS Managed Microsoft AD. The security team requires that credentials never leave the corporate network. Which solution should the company implement?

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance with the tag 'Environment=production'. The action fails. What is the MOST likely reason?

A company runs a critical workload on EC2 instances in an Auto Scaling group. The application is stateless and can handle instance failures. The architect needs to ensure that the application remains available during a regional outage. What is the MOST cost-effective and resilient architecture?

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

A company is running a production web application on Amazon EKS. The application experiences intermittent latency spikes. The operations team suspects that the issue is related to pod networking. Which THREE tools should they use to diagnose the issue? (Choose 3)

A company is deploying a new web application on AWS that requires a highly available and scalable architecture. The application consists of a stateless web tier and a stateful database tier. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The database tier uses Amazon Aurora MySQL. The company expects variable traffic patterns and wants to automatically scale the web tier based on CPU utilization. Additionally, the company wants to ensure that the database can handle increased read traffic without manual intervention. Which combination of actions should the company take?

A company is running a stateful web application on EC2 instances in an Auto Scaling group behind an ALB. The application stores session data locally on the instance. The company notices that users are frequently logged out and lose session data during scaling events. What is the MOST operationally efficient way to preserve session state?

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets be encrypted at rest using SSE-KMS. The company has thousands of existing buckets, some of which are not encrypted. Which approach will enforce encryption on all buckets with minimal effort?

A company is modernizing its application by breaking a monolith into microservices on Amazon EKS. The application uses a shared PostgreSQL database. The company wants to implement a database-per-service pattern. The migration must be done with zero downtime. Which approach should the company use?

A company uses AWS Organizations and wants to ensure that all member accounts have AWS CloudTrail enabled and logs are delivered to a central S3 bucket in the management account. Which approach is MOST efficient?

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group. The application must be able to distribute incoming traffic across multiple instances. Which TWO AWS services can be used for this purpose? (Choose TWO.)

A company is designing a new application that will process images uploaded by users. The application must automatically resize images and store them in Amazon S3. The solution should be serverless and event-driven. Which THREE AWS services should be used together? (Choose three.)

A company is migrating a legacy application to AWS and needs to ensure compliance with data residency requirements. The application stores personally identifiable information (PII) in an on-premises MySQL database. The company wants to encrypt the data at rest and in transit during the migration. The database will be migrated to Amazon RDS for MySQL. The solutions architect must ensure that all data is encrypted end-to-end. Which combination of steps will meet these requirements?

A company is modernizing a monolithic application by decomposing it into microservices. The application currently uses a single MySQL database. The company wants to use a polyglot persistence approach, with different microservices using the most appropriate database type. The team has limited experience with NoSQL databases. Which strategy should the team use to minimize risk during the migration?

A solutions architect attempts to create this stack but receives an error: "Value of property SecurityGroups must be a list of strings". What is the likely cause?

A company is using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application has a health check endpoint at /health. Recently, the ALB is marking instances as unhealthy even though the application is running. The health check settings are: interval 30 seconds, timeout 5 seconds, unhealthy threshold 2. What is the most likely cause?

An administrator runs the above command and sees that the 'Prod' account is suspended. What is the MOST likely cause?

Drag and drop the steps to migrate an on-premises MySQL database to Amazon RDS using AWS DMS in the correct order.

A financial services company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed across multiple Availability Zones. The company recently experienced a DDoS attack that overwhelmed the ALB and caused downtime. The security team wants to implement a solution that can absorb DDoS attacks at the edge and only forward legitimate traffic to the ALB. Additionally, the company needs to protect sensitive data in transit using TLS 1.3. What should the solutions architect do?

A company is designing a new multi-region disaster recovery solution for a critical application running on AWS. The primary region is us-east-1. The application uses Amazon RDS for MySQL with Multi-AZ, and runs on EC2 instances behind an ALB. The RPO must be less than 5 minutes, and RTO less than 30 minutes. The company wants to minimize costs when the DR solution is not in use. Which solution should a Solutions Architect recommend?

A company is designing a new application that will run on Amazon ECS with Fargate. The application must process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. The workload is unpredictable and can scale from 0 to thousands of messages per second. What is the MOST cost-effective and scalable architecture?

A company is migrating a monolithic application to Amazon ECS. The application currently stores session data in local memory. Which migration strategy should the company adopt to ensure scalability and fault tolerance?

A company is designing a serverless application that uses AWS Lambda to process events from Amazon DynamoDB Streams. The Lambda function updates an Amazon RDS for MySQL database. The company expects a high volume of updates and is concerned about the Lambda function causing too many connections to the database. How should the company design the solution to manage the database connection pool effectively?

A company has a production AWS account with multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The firewall must be able to process traffic, and the solution must be highly available. Which THREE steps should the company take?

A global company is using a multi-account AWS Organizations setup with a centralized logging account. They want to aggregate CloudTrail logs from all accounts into a single S3 bucket in the logging account. Which combination of steps will meet this requirement?

Refer to the exhibit. A solutions architect runs the CLI command and gets the output shown. What does the state 'running' indicate about the instance?

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application experiences high latency during peak hours. The operations team suspects that the instances are overloaded. Which TWO actions should the team take to improve performance and scalability? (Choose two.)

A migration engineer is setting up an AWS DMS task to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The engineer attaches this IAM policy to the DMS service role. The DMS task fails with an error indicating insufficient privileges. What is the most likely cause?

A company is designing a disaster recovery solution for a critical database using Amazon RDS Multi-AZ. However, they also need to protect against regional failures. Which additional AWS service should they use?

A company has an S3 bucket policy as shown in the exhibit. The bucket 'my-bucket' is owned by account 111111111111. What access does this policy grant to account 123456789012?

A company is migrating a batch processing workload to AWS. The workload runs on a scheduled basis and processes large files from an on-premises NFS share. The company wants to use AWS services to replace the on-premises server and minimize operational overhead. Which solution is MOST suitable?

A company has a multi-account environment with a central security account. They want to use AWS Security Hub to aggregate findings from all accounts. What is the correct setup?

A global company is using AWS Organizations with hundreds of accounts. The IT team needs to centrally manage DNS records for all accounts using Amazon Route 53 private hosted zones. The solution must be highly available and support cross-account DNS resolution. What should the team do?

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The solution must have a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 5 minutes. The application data is stored on Amazon EBS volumes. Which THREE steps should be taken to meet these requirements? (Choose three.)

A company uses AWS Organizations with hundreds of accounts. The security team needs to ensure that no IAM user in any account can create a new IAM user or access key. What is the most scalable way to enforce this?

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared EFS file system for persistent data. The operations team notices that during scale-in events, some requests fail because the instance is terminated while still processing. What is the BEST way to prevent request failures during scale-in?

A company is designing a new data lake solution on AWS using Amazon S3 as the storage layer. The data lake will be used by multiple teams for analytics and machine learning. The company needs to enforce fine-grained access control at the object level, enable auditing of data access, and ensure that sensitive data is masked for unauthorized users. Which combination of AWS services should be used?

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has a relational database with complex queries. The team wants to minimize changes to the existing codebase. Which database migration strategy should be recommended?

A company is migrating to a multi-account AWS environment. They want to centralize DNS management using Amazon Route 53 private hosted zones. The private zones must be accessible from all VPCs in the organization. Which THREE steps are required to achieve this?

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web frontend, a REST API, and a PostgreSQL database. The migration plan is to containerize the frontend and API using Amazon ECS with Fargate, and use Amazon RDS for PostgreSQL. The company expects variable traffic with peak loads during promotional events. The architecture must be highly available and cost-effective. The operations team wants to minimize manual scaling interventions. Which solution should a Solutions Architect recommend?

A company is designing a new web application that will be deployed on AWS. The application consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server. The application must be highly available across multiple Availability Zones. The company expects variable traffic patterns, including sudden spikes. The operations team wants to minimize manual intervention. The application stores session state in a shared data store. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. The company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates. The ALB must terminate SSL/TLS connections. Which combination of actions should the company take to meet these requirements?

A company uses AWS CloudFormation to deploy infrastructure. They have a stack that creates an Amazon RDS for MySQL database. The stack creation fails with the error 'The following resource(s) failed to create: [DBInstance]'. The solutions architect needs to troubleshoot the issue. Which approach should be taken first?

A company is designing a new web application that will be accessed by users worldwide. The application should have low latency and high availability. The application uses a stateless web tier and a relational database. Which architecture minimizes latency for global users?

Refer to the exhibit. A solutions architect runs the CLI command to list EC2 instances. The output shows three instances. The architect wants to start the stopped instance and ensure it retains its instance store data. What should the architect do?

A company is planning a large-scale migration of hundreds of applications to AWS. Which TWO strategies should the architect consider to reduce migration risks?

A company is designing a new serverless application on AWS. The application consists of multiple AWS Lambda functions that process incoming events from an Amazon SQS queue. The company wants to ensure that each message is processed exactly once. Which configuration should the company use?

A company is running a web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application experiences periodic traffic spikes that cause increased latency. The company wants to implement a solution to automatically adjust capacity in anticipation of traffic changes. What should a solutions architect do?

A company wants to automate the migration of on-premises servers to AWS. The migration plan includes discovery, assessment, and automated replication. Which AWS service should the company use?

A small business is migrating its on-premises infrastructure to AWS. The current environment consists of two VMs running a LAMP stack (Linux, Apache, MySQL, PHP) and a separate file server. The business has limited IT staff and wants to minimize operational overhead. They also want to ensure high availability for the web application. The company has a modest budget and is looking for a cost-effective solution. You need to design the migration. Which approach should be taken?

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to store files in Amazon S3. The company has a strict security requirement that the application must not have any long-term credentials stored in the container image or environment variables. Which THREE steps should the company take to meet this requirement? (Choose THREE.)

A company is migrating a batch processing workload to AWS. The workload runs a Java application that processes files from an S3 bucket. The company wants to minimize operational overhead. Which AWS service should the company use to run the Java application?

A company is using AWS Config to evaluate resource compliance. They want to receive notifications when a noncompliant resource is detected. Which AWS service should be used to send these notifications to an email endpoint?

A company is migrating a legacy .NET Framework 4.7 web application to AWS. The application currently runs on Windows Server 2012 R2 with IIS and uses SQL Server Express for local storage. The company wants to minimize re-architecture and reduce operational overhead. Which migration strategy should the company use?

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. They need to ensure that users can authenticate to AWS resources using their existing corporate credentials. What is the MOST secure and scalable solution?

A company wants to give its developers access to specific Amazon S3 buckets based on their team membership. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which approach should the company use to grant fine-grained access?

A company has a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The queue receives a burst of messages daily. The Lambda function sometimes times out, causing messages to return to the queue and be reprocessed. How can the company improve the application to handle the burst without reprocessing failures?

A company is designing a serverless data processing pipeline using AWS Lambda functions. The pipeline processes messages from an Amazon SQS queue. Each message takes approximately 30 seconds to process, and the pipeline must handle bursts of up to 10,000 messages per minute. The messages must be processed in the order they are received. Which solution meets these requirements?

A company is designing a new application that will process sensitive financial data. They need to ensure that data at rest is encrypted using customer-provided encryption keys (SSE-C) in Amazon S3. Which action is required to enable this?

A company runs a critical application on Amazon ECS Fargate. The application uses an Application Load Balancer as the front end. Recently, the application experienced a spike in traffic, and many tasks were marked as unhealthy and replaced. The team wants to improve resilience to traffic spikes without over-provisioning. What should the team do?

An administrator runs the above commands and observes the outputs. The instance is in a public subnet with an internet gateway. What is the most likely issue preventing users from accessing the web server?

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS. The pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service. Recently, deployments have failed because insufficient IAM permissions cause the pipeline to fail when updating the ECS service. The development team wants to implement least privilege permissions. Which IAM policy statement should be added to the CodePipeline service role to allow it to update the ECS service?

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application experiences high traffic during business hours and low traffic at night. The company wants to automatically scale the instances based on CPU utilization. Which TWO steps are required to achieve this?

A company is migrating its on-premises VMware VMs to AWS. The company wants to use the same management tools and maintain consistency. Which AWS service should be used for this migration?

A company ran the command above. The management account (111111111111) has an SCP attached that denies all actions. The DevAccount (222222222222) has no SCP. What can the root user of the DevAccount do?

A company is designing a new solution to host a static website on AWS. The website content is stored in an Amazon S3 bucket. The company wants to use a custom domain name (e.g., www.example.com) and enforce HTTPS. Which combination of AWS services should the company use?

A company runs a stateless web application on AWS Elastic Beanstalk. The application experiences periodic spikes in traffic that cause CPU utilization to reach 90% on the EC2 instances. The company wants to automatically scale the environment based on CPU usage. They also want to ensure that the scaling is proactive and can handle sudden traffic surges. What should they do?

A company is migrating a legacy application to AWS. The application requires a relational database with high I/O and low latency. The database size is 2 TB and growing. The Solutions Architect must choose a storage solution that provides the best price-performance. Which TWO solutions meet these requirements?

A company is migrating a monolithic application to AWS. The application currently runs on a single on-premises server and uses a MySQL database. The company wants to minimize changes to the application code during migration. Which migration strategy should the company use?

A multinational corporation uses AWS Organizations with hundreds of accounts. The security team requires that all Amazon S3 buckets across the organization be encrypted with a specific AWS KMS key from the security account. Which combination of controls should be implemented to enforce this requirement?

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in a production AWS account. Recently, the application has experienced intermittent timeouts. The operations team notices that the CPU utilization of the instances spikes to 100% for a few minutes during the timeouts. The Auto Scaling group is configured with a target tracking scaling policy based on average CPU utilization at 70%. What should a solutions architect do to improve the application's availability and reduce timeouts?

A company has a multi-account AWS environment with a centralized logging account. They want to collect VPC Flow Logs from all accounts and store them in a centralized S3 bucket in the logging account. What is the MOST scalable and cost-effective solution?

A company is migrating a legacy .NET Framework 4.7 application to AWS. The application currently uses Windows Authentication and stores session state in-process. The company wants to minimize code changes and use AWS managed services. Which TWO strategies should the company adopt?

A company is designing a new data lake on Amazon S3. The data is ingested from various sources and must be encrypted at rest. The company has a strict requirement to use an AWS KMS customer master key (CMK) that is stored in a different AWS account for additional security. The S3 bucket is in Account A, and the KMS key is in Account B. Which steps are necessary to enable server-side encryption with AWS KMS (SSE-KMS) for objects in the S3 bucket?

Match each AWS security service to its purpose.

A company runs a web application on EC2 instances behind an Application Load Balancer. Users report intermittent slowdowns. CloudWatch metrics show high CPU utilization on the instances. The company wants to improve performance with minimal architectural changes. What should a solutions architect do?

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to output logs to CloudWatch Logs. Which configuration should be used to send logs from the container to CloudWatch?

A company has a multi-account AWS environment with a central networking account that hosts all VPCs and a shared services account that hosts common resources like directory services. The company wants to allow all accounts to use the same VPC for their workloads instead of creating separate VPCs. The security team requires that traffic between accounts is encrypted in transit and that accounts cannot directly access each other's resources without going through the central networking account. The network team proposes using AWS Transit Gateway with inter-region peering and VPC attachments. However, the security team is concerned about compliance with encryption requirements. What should the network team do to meet the requirements?

Refer to the exhibit. A security engineer ran this AWS CLI command to investigate who created a CloudTrail trail in January 2024. The command returned no results. However, the security team knows that a trail was created during that period. What is the most likely reason for the empty result?

A company is designing a multi-region disaster recovery solution for a critical application using Amazon RDS for MySQL. They need a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which solution should they choose?

A company is migrating a multi-tier e-commerce application to AWS. The application consists of a web tier, an application tier, and a MySQL database tier. The company wants to improve scalability and availability while reducing administrative overhead. Which THREE actions should the solutions architect take? (Select THREE.)

A company is building a new application that requires a relational database with high availability across multiple Availability Zones. The database must automatically failover with minimal downtime. Which two AWS services or features meet these requirements?

A company has a data lake in AWS using S3 and Glue. The security team requires that all data in the data lake be encrypted at rest using a customer-managed KMS key. However, some users are able to upload data without encryption. What is the most effective way to enforce encryption?

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

A company is designing a microservices architecture on Amazon ECS with AWS Fargate. The services need to communicate with each other using HTTP APIs. The company wants to minimize operational overhead and enable canary deployments. Which solution should the company use for service discovery and traffic routing?

A company's AWS CloudTrail logs are stored in an S3 bucket. A Solutions Architect needs to analyze the logs to identify API calls that created or modified IAM roles in the last 30 days. What is the MOST efficient way to perform this analysis?

A company runs a stateful application on EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that client sessions are maintained to the same instance. The operations team notices that after scaling events, some clients lose their sessions. Which configuration change should the team implement to ensure session persistence?

A company uses AWS Organizations and has a member account that needs to access a shared S3 bucket in another member account. The bucket policy allows access from the account's root user. What is the simplest way to grant an IAM user in the member account access?

A company applies the above IAM policy to an S3 bucket. An IAM user attempts to upload an object without specifying encryption. Will the upload succeed?

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

A company is migrating a large Hadoop cluster to Amazon EMR. The cluster uses HDFS for storage. The company wants to decouple compute and storage to reduce costs. Which approach should the company take?

A company uses AWS Organizations and has a central IT team that manages VPCs. The team wants to ensure that only authorized accounts can create VPCs, and that all VPCs must have a specific tag. Which solution enforces this?

A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?

A company is building a serverless application using AWS Lambda. The Lambda function needs to process files uploaded to an S3 bucket. The function should be triggered as soon as a new object is created. How should the architect configure this?

A company is migrating a monolithic application to microservices on Amazon ECS. They want to implement a service mesh for observability and traffic management. Which THREE AWS services should they consider?

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts. The company has an existing identity provider (IdP) that supports SAML 2.0. Which AWS service should be used to integrate with the IdP?

A company uses AWS CodePipeline for CI/CD. The deployment stage uses AWS CodeDeploy to deploy to EC2 instances. The team wants to automatically test the application after deployment and roll back if tests fail. Which approach should the team use?

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and efficiently. The company wants to implement service-to-service authentication and authorization. Which THREE steps should the company take? (Choose THREE.)

A company is building a new application that will run on AWS Lambda. The application needs to store and retrieve user preferences in a key-value format. The data is accessed frequently and must be highly available. The company expects low latency for reads and writes. Which AWS service should be used as the data store?

Drag and drop the steps to configure an S3 bucket as a static website hosting in the correct order.

A company is designing a new serverless application using AWS Lambda. The function must process a file uploaded to S3 and then send a notification to an external API. The external API has a rate limit of 10 requests per second. Which approach should they use to handle throttling?

A company uses Amazon RDS for PostgreSQL and needs to apply a minor version upgrade. They want to minimize downtime. Which approach should they use?

A company has a multi-account AWS environment with a centralized logging account. The security team needs to analyze VPC Flow Logs from all accounts using Amazon Athena. Which THREE steps are required to enable this analysis? (Choose THREE.)

A company has a centralized logging solution using Amazon OpenSearch Service (Elasticsearch) and wants to ensure logs from all AWS accounts are shipped to a central account. Which AWS service can be used to collect and forward logs from multiple accounts to a single destination?

Which THREE design patterns can help a microservices application achieve loose coupling and independent deployability? (Choose three.)

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts use AWS CloudTrail with logs delivered to a central S3 bucket. Which TWO actions should be taken to enforce this?

A company uses AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization have server-side encryption enabled. Which is the MOST efficient way to enforce this policy?

Refer to the exhibit. A company is using AWS CloudFormation to migrate a serverless application. The stack creation failed. Based on the stack events, what is the root cause of the failure?

A company wants to deploy a new web application on AWS that uses a microservices architecture. The company expects rapid growth and wants to decouple services to allow independent scaling and development. The team wants to use Docker containers for consistency across environments. Which solution should a Solutions Architect recommend?

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which TWO actions should be taken to achieve this? (Choose two.)

A company is migrating a legacy CRM application to AWS. The application uses a proprietary database that is not supported by Amazon RDS. The company wants to minimize licensing costs. The current on-premises deployment uses a single server. Which migration strategy should the company use?

A company uses AWS Organizations with 500 accounts. They want to enforce that all accounts use a specific set of allowed AMIs for EC2. What is the MOST scalable solution?

A company wants to decouple a web application frontend from a backend processing service. The frontend sends jobs that are processed asynchronously. Which AWS service is best suited for this decoupling?

A company is migrating a multi-tier web application to AWS and wants to use Infrastructure as Code (IaC) to automate provisioning. Which AWS services can the company use to define and manage infrastructure declaratively? (Choose TWO.)

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to minimize operational overhead and ensure that service discovery is automatically updated when services scale. Which service discovery option should be used?

A company wants to implement a data lake strategy using Amazon S3 across multiple AWS accounts. They need to ensure that data is encrypted at rest using a centralized AWS KMS key from a security account. Which THREE steps should they take?

A company wants to store configuration data for multiple applications securely. Each application runs on Amazon EC2 instances in an Auto Scaling group. The configuration includes database credentials and API keys. Which TWO services should be used together to achieve this?

A company is planning to migrate a large-scale e-commerce platform from on-premises to AWS. The platform includes a web tier, application tier, and a MySQL database. The company needs to ensure high availability and scalability. Which combination of AWS services should the company use to modernize the application architecture while minimizing operational overhead?

A company is designing a new solution that uses Amazon S3 to store large amounts of archival data. The data must be retained for 7 years and then automatically deleted. Which S3 feature should they use?

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume. To improve recovery time in the event of an AZ failure, which TWO actions should the company take? (Choose two.)

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket. The company wants to use a custom domain name and SSL/TLS termination. Which THREE services should the company use together to meet these requirements? (Choose THREE.)

A company is migrating a large number of files from on-premises to Amazon S3. The files are accessed frequently and require low latency. Which TWO AWS services can help accelerate the migration? (Choose TWO.)

A company needs to share a VPC subnet with multiple accounts in the same AWS Organization. What is the MOST secure way to achieve this?

A company is migrating a 10 TB Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime and support ongoing replication. The application uses stored procedures and advanced Oracle features. The company has already set up an AWS DMS replication instance and validated connectivity. However, during the full load, DMS reports errors for certain tables containing LOBs. What is the most likely cause and solution?

A company is migrating a legacy application to AWS. The application requires a fixed IP address for whitelisting by a third-party service. The application will run on EC2 instances behind an Application Load Balancer. The company needs a solution that provides a static IP address for outbound traffic. What should a solutions architect do?

A company wants to implement a serverless data processing pipeline on AWS. The pipeline reads CSV files from Amazon S3, transforms the data, and loads it into Amazon Redshift. Which THREE AWS services should be used to build this pipeline?

A company is designing a new microservices application on AWS. Each microservice will be deployed as a containerized application using Amazon ECS with Fargate launch type. The company expects variable traffic patterns and needs to ensure that the application can scale automatically based on demand. Which scaling solution should be used?

A company has a decentralized IT structure where each business unit manages its own AWS accounts. The central IT team wants to enforce security policies across all accounts but allow business units to retain administrative control. Which solution should the central IT team implement?

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The team wants to decouple the database layer and allow each microservice to own its data. Which design pattern should the team implement?

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from the 'confidential' folder in 'my-bucket' using HTTP (not HTTPS). What will happen?

A company uses AWS Organizations with a management account and several member accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. What should they do?

A solutions architect is designing a new serverless application using AWS Lambda for business logic, Amazon API Gateway for RESTful APIs, and Amazon DynamoDB for data storage. The application will experience unpredictable traffic spikes. What is the MOST cost-effective way to handle concurrency and scaling?

A company is migrating an on-premises application to AWS and wants to implement a continuous integration/continuous delivery (CI/CD) pipeline. Which TWO AWS services should the company use to build the pipeline?

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with AWS KMS and that bucket policies enforce HTTPS. What is the MOST efficient way to enforce these policies across all accounts?

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. Each device sends a JSON payload every second. The company needs to store the raw data for a month and then aggregate it into hourly summaries for long-term storage. The solution must be serverless and cost-effective. Which combination of AWS services should the company use?

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application has variable traffic patterns, with high traffic during business hours and low traffic at night. They want to optimize costs while maintaining performance. Which scaling strategy should they implement?

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences high latency during peak hours. The company wants to improve performance by enabling HTTP/2. What is the simplest way to achieve this?

A company uses AWS CodeBuild to run unit tests. The build process is taking longer than expected. The buildspec.yml file includes a pre-build phase that downloads dependencies from a public repository. What is the most effective way to reduce build time?

A company wants to ensure that no IAM user in any account can create access keys. The company uses AWS Organizations. Which approach should be used?

A company is migrating a monolithic Java application to AWS. The current architecture uses a single Oracle database. The migration plan is to refactor the application into microservices and use separate Amazon RDS for PostgreSQL databases per service. The company also wants to implement a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. Which tool should the company use to automate the database schema changes for each microservice?

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use to decouple the services while providing durable message storage?

A company wants to assess its on-premises environment for migration to AWS. The assessment should include server utilization, dependencies, and recommendations. Which AWS service provides this capability?

A company is designing a serverless application using AWS Lambda. The application needs to store and retrieve JSON documents. The company wants the lowest cost for infrequent access. Which data store should be used?

A company uses AWS CloudFormation to deploy infrastructure. The team wants to ensure that all resources are tagged with a CostCenter tag. They want to automatically remediate any stack that creates resources without the required tag. Which approach is MOST effective?

A large enterprise uses AWS Organizations with 200 accounts. The central security team has implemented a service control policy (SCP) that denies all actions unless the request comes from a specific set of allowed AWS services. The SCP is attached to the root OU. Recently, the DevOps team reported that they cannot launch Amazon EC2 instances in any account, even though they have full administrator access via IAM roles. The security team verifies that the SCP is correctly configured and that allowed services include EC2. However, the error message states 'Action 'ec2:RunInstances' is not authorized.' The DevOps team is using the AWS Management Console. What is the MOST LIKELY cause?

A company has multiple AWS accounts and wants to centralize CloudTrail logs in a single S3 bucket in the security account. Which policy should be applied to the S3 bucket to allow cross-account delivery from all member accounts?

A company is designing a new data lake on AWS using Amazon S3. The data will be ingested from various sources, including IoT devices, application logs, and streaming data. The data must be processed in near real-time as it arrives. Which combination of services should be used for ingestion and processing?

A company has a single AWS account and wants to implement a multi-account strategy for better isolation. Which AWS service is designed to help centrally manage multiple accounts?

A company uses AWS Organizations with several OUs for different environments (dev, test, prod). They want to restrict the use of specific EC2 instance types in the prod OU only. Which approach should they use?

A company has a multi-account AWS environment with a central logging account. They want to ensure that all VPC Flow Logs are enabled for every VPC in every account and that the logs are sent to a central S3 bucket. What combination of services should they use to automatically enforce this?

A company uses AWS Organizations and has a requirement that all root user activities in member accounts must be immediately reported to the security team. Which combination of actions should be taken to meet this requirement? (Choose the best answer.)

A company wants to deploy a containerized web application on AWS. They need to manage container orchestration, automatic scaling, and service discovery. Which AWS services should they use? (Select TWO.)

A CloudFormation stack creation failed with the status shown in the exhibit. The stack was created using a template that defines an EC2 instance, a security group, and an Elastic IP address. What is the MOST likely cause of the failure?

A company is migrating an on-premises Oracle database to AWS. The database is 2 TB in size and has a low-latency connection to AWS via AWS Direct Connect. The company wants to minimize downtime during the migration. Which AWS service should the architect use for the initial data load?

A company is migrating a web application to AWS and wants to automatically scale the application based on CPU utilization. The application runs on a set of EC2 instances behind an Application Load Balancer. Which combination of AWS services should they use?

A company has a multi-account AWS environment. They want to use AWS CloudTrail to log all API calls across all accounts and deliver the logs to a central S3 bucket in the logging account. They have configured a trail in the management account that logs management events for all accounts. However, they notice that the logs from member accounts are not being delivered to the central S3 bucket. What is the most likely cause?

A company has a central logging account that receives VPC Flow Logs, CloudTrail logs, and AWS Config logs from all accounts in the organization. The logs are stored in S3 buckets. The security team wants to analyze these logs using Amazon Athena. What is the MOST cost-effective way to ensure that the Athena queries only scan the necessary data?

A company wants to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should be used?

A company uses an Amazon RDS for MySQL DB instance. The database is experiencing high read latency. The team wants to improve read performance with minimal application changes. Which TWO actions should the team take? (Choose two.)

Drag and drop the steps to set up a cross-region VPC peering connection in the correct order.

A company has multiple AWS accounts managed through AWS Organizations. The security team wants to enforce that all new member accounts automatically have AWS Config enabled with a specific set of rules. Which solution is the MOST efficient?

A company is migrating its on-premises file server to AWS. The file server contains 50 TB of data stored on a Windows Server with NTFS permissions. The company needs to maintain the folder structure and permissions after migration. The migration must be completed within one week. The company has a 100 Mbps internet connection. Which approach should the solutions architect recommend?

A company is using Amazon S3 to store critical data. The security team requires that all data at rest be encrypted using AWS KMS with automatic rotation of the customer master key (CMK) every year. What should a solutions architect do to meet this requirement?

A company uses an AWS CodePipeline to deploy a serverless application. The pipeline includes a build stage that runs on AWS CodeBuild and a deploy stage that updates an AWS Lambda function. The company wants to add a manual approval step before the deploy stage. What is the most efficient way to implement this?

A company is planning to migrate a large-scale Hadoop cluster to Amazon EMR. The cluster currently processes batch jobs using a mix of MapReduce and Spark. The company wants to minimize changes to the existing code and operational processes. Which migration approach should the architect recommend?

A company is implementing a data lake on Amazon S3. The security policy requires that all data be encrypted at rest using AWS KMS and that access must be logged. The data lake has millions of objects, and the security team wants to detect any changes to bucket policies or encryption settings. Which combination of services should be used?

A company is designing a new microservices architecture on AWS. Each service must be independently deployable and scale based on demand. The company wants to minimize operational overhead for container orchestration. Which AWS service should the company use?

A company is migrating a critical application to AWS and must ensure high availability across multiple Availability Zones. Which TWO AWS services can be used to distribute traffic across instances in multiple AZs?

A company is designing a new serverless application using AWS Lambda. The application must be invoked by an Amazon S3 bucket event. The company wants to ensure that the Lambda function has the necessary permissions to be invoked. Which THREE steps are required?

A company has a web application behind an Application Load Balancer that uses sticky sessions. The application is deployed on EC2 instances in an Auto Scaling group. During a deployment, the team notices that users are experiencing errors after new instances are launched. What is the MOST likely cause?

A company is designing a new application on AWS that requires a highly available and scalable web tier. The web servers must be stateless and scale automatically based on CPU utilization. Which TWO actions should the company take to meet these requirements?

A company attaches the above SCP to the root organizational unit. The development team in a member account wants to launch an EC2 instance in the ap-southeast-1 region. What will happen?

A company is migrating to AWS and plans to use a multi-account strategy. The management account will be used solely for administrative purposes. Which best practice should be followed when setting up AWS Organizations?

A solutions architect is designing a new serverless application using AWS Lambda to process orders from an API Gateway endpoint and store them in DynamoDB. The architect creates the IAM role shown in the exhibit. When testing, the Lambda function fails to write to DynamoDB with an AccessDeniedException. What is the MOST likely cause?

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is CPU-bound and takes close to the 15-minute timeout. The operations team notices that the function sometimes times out during peak hours. What is the SIMPLEST way to improve the function's performance?

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. They need to minimize downtime and ensure data integrity. Which AWS service should they use for the migration?

A company has a multi-account AWS environment with a centralized network account that hosts a transit gateway. The company wants to share the transit gateway with multiple member accounts. Which AWS service should be used to share the transit gateway?

A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by business unit. Each business unit has its own AWS account. The team needs a solution that allows them to generate cost reports filtered by business unit without additional overhead. Which action should be taken?

A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

A company runs a containerized application on Amazon ECS with Fargate. The application needs to securely access an Amazon S3 bucket. The company wants to follow the principle of least privilege. What should a solutions architect recommend?

A company is running a stateful web application on Amazon EC2 instances in an Auto Scaling group. The instances store session data in an Amazon ElastiCache for Redis cluster. The company wants to improve the application's fault tolerance and ensure that session data is not lost if an Availability Zone fails. What should the solutions architect do?

A company is modernizing a monolithic application into microservices on AWS. The application currently uses a single SQL database. Which THREE AWS services can help decouple the data layer and enable event-driven communication between microservices?

A company is migrating a legacy application to AWS and needs to decouple the application components. The application currently uses a monolithic architecture with direct calls between components. Which AWS services can help decouple the components? (Choose THREE.)

A company is migrating its on-premises Oracle database to Amazon Aurora PostgreSQL using AWS DMS. The database has several large tables with hundreds of millions of rows. The migration must complete within a 2-hour downtime window. During the full load, DMS is running slowly on large tables. What should the company do to improve performance?

A company wants to automate the deployment of a three-tier web application on AWS. The deployment should include the network, security groups, EC2 instances, and an Application Load Balancer. Which AWS service should they use?

A company is designing a new application that will process sensitive financial data. The data must be encrypted at rest and in transit. The application runs on EC2 instances. Which combination of services meets these requirements?

A company is designing a microservices architecture using Amazon ECS with Fargate. Each microservice needs to communicate with others via REST APIs. The company wants to ensure that communication is encrypted in transit and that services can discover each other using DNS names. Which set of actions should the company take?

A company is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage and a deploy stage. The company wants to add a test stage that runs automated integration tests after the build stage and before the deploy stage. Which THREE actions should the company take? (Choose three.)

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS keys managed by the security team. What is the MOST scalable and maintainable solution?

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

A company has multiple AWS accounts and wants to centralize operational data such as cost reports, security findings, and resource inventory. The solution should provide a single pane of glass for the operations team. Which AWS service should be used?

Which TWO AWS services can be used to migrate on-premises applications to AWS without modifying the application code?

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

A company is designing a multi-region active-active application using Amazon DynamoDB. They need to ensure low-latency reads and writes globally. Which DynamoDB feature should they use?

A company wants to implement a centralized logging solution for multiple AWS accounts. Which TWO services should be used together?

A company has a production AWS account with multiple VPCs connected via a transit gateway. The security team wants to centrally capture all VPC flow logs for analysis in Amazon Athena. What is the MOST cost-effective way to store the flow logs?

A company uses AWS Organizations with a multi-account strategy. The DevOps team wants to allow developers to launch EC2 instances only in specific Regions and only with approved AMIs. Which AWS service should be used to enforce these controls across all accounts?

A company is designing a new web application that will be accessed by users globally. The application uses Amazon CloudFront as a CDN and stores static content in Amazon S3. The dynamic content is served from EC2 instances in a single AWS Region. Which of the following will improve performance for users in distant regions with the LEAST operational effort?

A company has deployed a web application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database. The security team mandates that the database must not be publicly accessible. What is the best way to securely connect the ECS tasks to the RDS database?

A company runs a critical application on Amazon RDS for MySQL. They want to implement a disaster recovery (DR) strategy across AWS Regions with a Recovery Point Objective (RPO) of 1 second and Recovery Time Objective (RTO) of 1 minute. Which TWO strategies meet these requirements? (Choose TWO.)

A company uses AWS Organizations with a large number of accounts. The networking team wants to centrally manage VPCs and subnets using AWS Resource Access Manager (RAM) and share subnets to member accounts. What must be done in the member accounts to use shared subnets?

A company has multiple AWS accounts managed through AWS Organizations. The central IT team wants to allow developers to launch EC2 instances only in specific Regions, but allow full access to all other services. What is the BEST approach?

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all new accounts created through the organization automatically have a specific AWS Config rule enabled that requires S3 buckets to be encrypted. Which TWO actions should the team take?

A company is migrating a large-scale batch processing system from on-premises to AWS. The system runs millions of short-lived jobs each day. The company wants to minimize operational overhead and cost. Which AWS compute service should the company use?

A company is migrating a batch processing workload to AWS. The workload runs on a schedule and processes large files stored on a network file system. The company wants to use serverless services. Which TWO services should the company use? (Choose TWO.)

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires that users' session data be stored durably and with low latency. The session data is accessed frequently but is rarely updated. Which solution is MOST cost-effective?

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data includes sensitive customer information that must be encrypted at rest. The company also needs to regularly rotate the encryption keys. Which solution meets these requirements with the least operational overhead?

A company wants to decouple a frontend API from backend processing to improve scalability and fault tolerance. The frontend sends requests that can be processed asynchronously. Which AWS service should be used to decouple the components?

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket (input-bucket), which triggers an AWS Lambda function that starts an AWS Glue job. The Glue job processes the video metadata and stores results in a DynamoDB table. Then, a second Lambda function triggers an Amazon ECS Fargate task to transcode the video into multiple formats. The transcoded videos are stored in another S3 bucket (output-bucket). Recently, the company started receiving complaints about delays in video availability. The operations team notices that CloudWatch Logs show no errors, but the ECS tasks often take longer than expected. They also see that the DynamoDB table has a high number of throttled write events. The video upload rate has increased by 50% in the last month. The team needs to improve the pipeline's performance and reduce delays. What should they do?

A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)

A company is migrating a data warehouse from on-premises to Amazon Redshift. The source database is Teradata. The company needs to convert the schema and migrate historical data with minimal downtime. Which THREE services should the company use?

A company uses AWS CodePipeline to deploy a web application to Amazon ECS. The deployment often fails because the ECS service's desired count is not met during the update. The company wants to implement a blue/green deployment with automated rollback on failure. What is the MOST effective approach?

A company is migrating a stateful web application to AWS. The application uses local storage for user sessions. Which AWS service can help make the application stateless and scalable?

A company is using AWS CloudFormation to deploy infrastructure. The security team requires that all Amazon S3 buckets created by CloudFormation must be encrypted at rest. What should a solutions architect do to enforce this requirement?

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

A company has multiple AWS accounts and wants to centralize logging of all API calls. Which TWO services should be used together to achieve this?

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB target group health checks are failing. Which step is MOST likely to resolve the issue?

A company wants to assess its on-premises environment for migration to AWS. The company needs to collect utilization data for servers and applications. Which AWS service should the company use?

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

A Solutions Architect runs the above AWS CLI command and gets the output shown. The instance is 'running' but the application is not accessible. What should the Solutions Architect check next?

A company is migrating a legacy Windows application to AWS. The application requires a shared file system accessible from multiple EC2 instances in the same VPC. Which AWS service should the company use to meet this requirement with minimal application changes?

A company stores sensitive data in Amazon S3. They need to ensure that data is encrypted at rest using a key managed by the company's on-premises hardware security module (HSM). Which S3 encryption option should they use?

A company is migrating a critical application to AWS using the 7 Rs migration strategy. The application has a monolithic architecture and runs on a single large on-premises server. The business wants to reduce operational overhead but cannot afford any downtime. Which strategy should the solutions architect recommend?

A company is modernizing a legacy CRM application to a microservices architecture on AWS. They want to use AWS Lambda for compute and Amazon API Gateway for the API layer. Which THREE design patterns should they consider? (Select THREE.)

A company needs to provide temporary credentials for users to access an S3 bucket for exactly 1 hour. The solution must not require any custom code or user management. Which AWS service should be used?

A company is migrating a critical application from on-premises to AWS using a lift-and-shift approach. The application requires consistent low-latency access to an on-premises database. Which network solution should the company implement to meet the latency requirement during the migration?

A company is designing a new system to ingest and process real-time streaming data from thousands of IoT devices. The system must be able to handle variable throughput and provide durable storage for the data. The data will be processed by a Lambda function and then stored in Amazon S3. Which two services should be used together to build this ingestion pipeline?

A company uses AWS CloudFormation to deploy infrastructure. A recent change to a stack failed because an IAM role name already exists. The company wants to avoid this issue in the future. What should a solutions architect do?

A company is refactoring a legacy .NET application to run on AWS Lambda. The application currently uses Windows authentication and Active Directory. Which approach should the company use to support authentication in the new architecture?

A company is designing a data lake solution on Amazon S3. Data is ingested from multiple sources and stored in a raw bucket. The data must be processed and transformed before being moved to a curated bucket. The processing logic is complex and includes conditional transformations. Which service should be used to orchestrate the transformation pipeline?

A company has a multi-account architecture with a central networking account that hosts a Transit Gateway. Each workload account has VPCs attached to the Transit Gateway. The company wants to centrally manage DNS resolution across all VPCs using Route 53 Resolver. They create a Route 53 Resolver outbound endpoint in the networking account and associate it with the workload VPCs via RAM. However, workload accounts cannot resolve on-premises hostnames. What is the missing configuration?

A company has a multi-account AWS environment and wants to enforce that all IAM roles in member accounts must include a specific tag (e.g., CostCenter). Which THREE steps should be taken to enforce this policy using AWS Organizations?

A company is planning to migrate a web application to AWS. The application currently runs on a single on-premises server with a few thousand users. The company wants to use a managed container service and minimize operational overhead. Which AWS service should the company use to run the application?

A company is migrating a 10 TB Oracle database to Amazon Aurora PostgreSQL. The database is business-critical and must have minimal downtime. The company has set up AWS DMS with ongoing replication from the source. During the migration, the company notices that DMS is failing with an error indicating insufficient memory. What should the company do to resolve this issue and complete the migration?

A company has a management account in AWS Organizations and several member accounts. The security team wants to ensure that any IAM user created in any member account must have a password policy that enforces a minimum length of 14 characters. The team wants a preventive control that is enforced automatically. Which approach should be used?

Refer to the exhibit. A company attached the above SCP to an OU in AWS Organizations. The SCP is intended to allow only t3.micro and t3.small EC2 instances. However, users in accounts within that OU are still able to launch other instance types. What is the most likely reason?

A company uses AWS Control Tower to manage a multi-account environment. They need to deploy a custom CloudFormation template to all accounts in a specific organizational unit (OU) whenever a new account is added. What should they use?

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The architecture must handle sudden spikes in traffic without losing events. Which configuration ensures the highest reliability?

A global e-commerce company uses AWS Organizations with over 500 accounts. They have a central security account that aggregates CloudTrail logs and VPC Flow Logs from all accounts. The security team needs to analyze these logs using Amazon Athena and visualize the results in Amazon QuickSight. The logs are stored in an S3 bucket in the security account, and each member account writes its own prefix. The current setup uses a bucket policy to allow member accounts to write logs. Recently, the security team has been unable to query logs for the past week. They suspect the issue is related to a new SCP that was applied to the root. The SCP denies s3:PutObject unless the request includes a specific tag. Which action should the security team take to restore log delivery without compromising security?

A company wants to implement a least-privilege permission model across all AWS accounts. The security team needs to ensure that no IAM user has full administrator access. However, the operations team occasionally needs emergency access. Which solution meets these requirements?

A company uses AWS CloudFormation to manage infrastructure as code. They have a production stack that includes an EC2 instance, an RDS database, and an S3 bucket. Recently, an engineer manually terminated the EC2 instance from the console. The CloudFormation stack status shows UPDATE_ROLLBACK_FAILED. The company wants to recover the stack to a consistent state. What should they do?

A company uses AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is idempotent and processes each message in about 30 seconds. The SQS queue has a visibility timeout of 60 seconds. Recently, the team notices that the same messages are being processed multiple times. Which TWO actions should the team take to prevent duplicate processing?

A company wants to implement a least-privilege security model across multiple AWS accounts. Which TWO services can help enforce this?

A company is implementing a data lake on Amazon S3. The data lake must be accessible from multiple accounts within the same AWS Organization. Objects must be encrypted at rest, and the company wants to use a single AWS KMS key for simplicity. Which solution meets these requirements?

Which THREE components are required to set up a centralized logging solution for multiple AWS accounts using Amazon S3? (Choose THREE.)

A company has a multi-region architecture using DynamoDB global tables. They notice that write conflicts are occurring frequently between regions. What is the MOST likely cause and how should they resolve it?

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?

Refer to the exhibit. A company has attached this IAM policy to an IAM role used by an application running on an EC2 instance in a VPC with CIDR 10.0.0.0/16. The application is unable to read objects from the S3 bucket. What is the most likely cause?