Deck 9: AWS Certified Solutions Architect - Associate SAA-C02

Question 1

A company is planning to migrate a business-critical dataset to Amazon S3. The current solution design uses a single S3 bucket in the us-east-1 Region with versioning enabled to store the dataset. The company's disaster recovery policy states that all data multiple AWS Regions. How should a solutions architect design the S3 solution?

A) Create an additional S3 bucket in another Region and configure cross-Region replication.
B) Create an additional S3 bucket in another Region and configure cross-origin resource sharing (CORS).
C) Create an additional S3 bucket with versioning in another Region and configure cross-Region replication.
D) Create an additional S3 bucket with versioning in another Region and configure cross-origin resource (CORS).

Answer 1

Create an additional S3 bucket with versioning in another Region and configure cross-Region replication.

Question 2

A company runs an internal browser-based application. The application runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. The Auto Scaling group scales up to 20 instances during work hours, but scales down to 2 instances overnight. Staff are complaining that the application is very slow when the day begins, although it runs well by mid-morning. How should the scaling be changed to address the staff complaints and keep costs to a minimum?

A) Implement a scheduled action that sets the desired capacity to 20 shortly before the office opens.
B) Implement a step scaling action triggered at a lower CPU threshold, and decrease the cooldown period.
C) Implement a target tracking action triggered at a lower CPU threshold, and decrease the cooldown period.
D) Implement a scheduled action that sets the minimum and maximum capacity to 20 shortly before the office opens.

Answer 2

Implement a scheduled action that sets the desired capacity to 20 shortly before the office opens.

Question 3

A company's website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). There is also an Amazon CloudFront distribution, and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website. What should a solutions architect do to protect the application?

A) Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address.
B) Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.
C) Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
D) Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.

Answer 3

Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.

Question 4

A solutions architect has created a new AWS account and must secure AWS account root user access. Which combination of actions will accomplish this? (Choose two.)

A) Ensure the root user uses a strong password.
B) Enable multi-factor authentication to the root user.
C) Store root user access keys in an encrypted Amazon S3 bucket.
D) Add the root user to a group containing administrative permissions.
E) Apply the required permissions to the root user with an inline policy document.

Question 5

An application runs on Amazon EC2 instances across multiple Availability Zones. The instances run in an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The application performs best when the CPU utilization of the EC2 instances is at or near 40%. What should a solutions architect do to maintain the desired performance across all instances in the group?

A) Use a simple scaling policy to dynamically scale the Auto Scaling group.
B) Use a target tracking policy to dynamically scale the Auto Scaling group.
C) Use an AWS Lambda function to update the desired Auto Scaling group capacity.
D) Use scheduled scaling actions to scale up and scale down the Auto Scaling group.

Question 6

A company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. On the first day of every month at midnight, the application becomes much slower when the month-end financial calculation batch executes. This causes the CPU utilization of the EC2 instances to immediately peak to 100%, which disrupts the application. What should a solutions architect recommend to ensure the application is able to handle the workload and avoid downtime?

A) Configure an Amazon CloudFront distribution in front of the ALB.
B) Configure an EC2 Auto Scaling simple scaling policy based on CPU utilization.
C) Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule.
D) Configure Amazon ElastiCache to remove some of the workload from the EC2 instances.

Question 7

A solutions architect is designing a solution to access a catalog of images and provide users with the ability to submit requests to customize images. Image customization parameters will be in any request sent to an AWS API Gateway API. The customized image will be generated on demand, and users will receive a link they can click to view or download their customized image. The solution must be highly available for viewing and customizing images. What is the MOST cost-effective solution to meet these requirements?

A) Use Amazon EC2 instances to manipulate the original image into the requested customization. Store the original and manipulated images in Amazon S3. Configure an Elastic Load Balancer in front of the EC2 instances.
B) Use AWS Lambda to manipulate the original image to the requested customization. Store the original and manipulated images in Amazon S3. Configure an Amazon CloudFront distribution with the S3 bucket as the origin.
C) Use AWS Lambda to manipulate the original image to the requested customization. Store the original images in Amazon S3 and the manipulated images in Amazon DynamoDB. Configure an Elastic Load Balancer in front of the Amazon EC2 instances.
D) Use Amazon EC2 instances to manipulate the original image into the requested customization. Store the original images in Amazon S3 and the manipulated images in Amazon DynamoDB. Configure an Amazon CloudFront distribution with the S3 bucket as the origin.

Question 8

A company's website runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The website has a mix of dynamic and static content. Users around the globe are reporting that the website is slow. Which set of actions will improve website performance for users worldwide?

A) Create an Amazon CloudFront distribution and configure the ALB as an origin. Then update the Amazon Route 53 record to point to the CloudFront distribution.
B) Create a latency-based Amazon Route 53 record for the ALB. Then launch new EC2 instances with larger instance sizes and register the instances with the ALB.
C) Launch new EC2 instances hosting the same web application in different Regions closer to the users. Then register instances with the same ALB using cross-Region VPC peering.
D) Host the website in an Amazon S3 bucket in the Regions closest to the users and delete the ALB and EC2 instances. Then update an Amazon Route 53 record to point to the S3 buckets.

Question 9

A company's application is running on Amazon EC2 instances in a single Region. In the event of a disaster, a solutions architect needs to ensure that the resources can also be deployed to a second Region. Which combination of actions should the solutions architect take to accomplish this? (Choose two.)

A) Detach a volume on an EC2 instance and copy it to Amazon S3.
B) Launch a new EC2 instance from an Amazon Machine Image (AMI) in a new Region.
C) Launch a new EC2 instance in a new Region and copy a volume from Amazon S3 to the new instance.
D) Copy an Amazon Machine Image (AMI) of an EC2 instance and specify a different Region for the destination.
E) Copy an Amazon Elastic Block Store (Amazon EBS) volume from Amazon S3 and launch an EC2 instance in the destination Region using that EBS volume.

Question 10

A company serves content to its subscribers across the world using an application running on AWS. The application has several Amazon EC2 instances in a private subnet behind an Application Load Balancer (ALB). Due to a recent change in copyright restrictions, the chief information officer (CIO) wants to block access for certain countries. Which action will meet these requirements?

A) Modify the ALB security group to deny incoming traffic from blocked countries.
B) Modify the security group for EC2 instances to deny incoming traffic from blocked countries.
C) Use Amazon CloudFront to serve the application and deny access to blocked countries.
D) Use ALB listener rules to return access denied responses to incoming traffic from blocked countries.

Question 11

A solutions architect is designing a new service behind Amazon API Gateway. The request patterns for the service will be unpredictable and can change suddenly from 0 requests to over 500 per second. The total size of the data that needs to be persisted in a backend database is currently less than 1 GB with unpredictable future growth. Data can be queried using simple key-value requests. Which combination of AWS services would meet these requirements? (Choose two.)

A) AWS Fargate
B) AWS Lambda
C) Amazon DynamoDB
D) Amazon EC2 Auto Scaling
E) MySQL-compatible Amazon Aurora

Question 12

Organizers for a global event want to put daily reports online as static HTML pages. The pages are expected to generate millions of views from users around the world. The files are stored in an Amazon S3 bucket. A solutions architect has been asked to design an efficient and effective solution. Which action should the solutions architect take to accomplish this?

A) Generate presigned URLs for the files.
B) Use cross-Region replication to all Regions.
C) Use the geoproximity feature of Amazon Route 53.
D) Use Amazon CloudFront with the S3 bucket as its origin.

Question 13

A company has application running on Amazon EC2 instances in a VPC. One of the applications needs to call an Amazon S3 API to store and read objects. The company's security policies restrict any internet-bound traffic from the applications. Which action will fulfill these requirements and maintain security?

A) Configure an S3 interface endpoint.
B) Configure an S3 gateway endpoint.
C) Create an S3 bucket in a private subnet.
D) Create an S3 bucket in the same Region as the EC2 instance.

Question 14

A product team is creating a new application that will store a large amount of data. The data will be analyzed hourly and modified by multiple Amazon EC2 Linux instances. The application team believes the amount of space needed will continue to grow for the next 6 months. Which set of actions should a solutions architect take to support these needs?

A) Store the data in an Amazon EBS volume. Mount the EBS volume on the application instances.
B) Store the data in an Amazon EFS file system. Mount the file system on the application instances.
C) Store the data in Amazon S3 Glacier. Update the vault policy to allow access to the application instances.
D) Store the data in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Update the bucket policy to allow access to the application instances.

Question 15

A company has been storing analytics data in an Amazon RDS instance for the past few years. The company asked a solutions architect to find a solution that allows users to access this data using an API. The expectation is that the application will experience periods of inactivity but could receive bursts of traffic within seconds. Which solution should the solutions architect suggest?

A) Set up an Amazon API Gateway and use Amazon ECS.
B) Set up an Amazon API Gateway and use AWS Elastic Beanstalk.
C) Set up an Amazon API Gateway and use AWS Lambda functions.
D) Set up an Amazon API Gateway and use Amazon EC2 with Auto Scaling.

Question 16

A company is migrating a three-tier application to AWS. The application requires a MySQL database. In the past, the application users reported poor application performance when creating new entries. These performance issues were caused by users generating different real-time reports from the application during working hours. Which solution will improve the performance of the application when it is moved to AWS?

A) Import the data into an Amazon DynamoDB table with provisioned capacity. Refactor the application to use DynamoDB for reports.
B) Create the database on a compute optimized Amazon EC2 instance. Ensure compute resources exceed the on-premises database.
C) Create an Amazon Aurora MySQL Multi-AZ DB cluster with multiple read replicas. Configure the application to use the reader endpoint for reports.
D) Create an Amazon Aurora MySQL Multi-AZ DB cluster. Configure the application to use the backup instance of the cluster as an endpoint for the reports.

Question 17

A company is migrating from an on-premises infrastructure to the AWS Cloud. One of the company's applications stores files on a Windows file server farm that uses Distributed File System Replication (DFSR) to keep data in sync. A solutions architect needs to replace the file server farm. Which service should the solutions architect use?

A) Amazon EFS
B) Amazon FSx
C) Amazon S3
D) AWS Storage Gateway

Question 18

A company captures clickstream data from multiple websites and analyzes it using batch processing. The data is loaded nightly into Amazon Redshift and is consumed by business analysts. The company wants to move towards near-real-time data processing for timely insights. The solution should process the streaming data with minimal effort and operational overhead. Which combination of AWS services are MOST cost-effective for this solution? (Choose two.)

A) Amazon EC2
B) AWS Lambda
C) Amazon Kinesis Data Streams
D) Amazon Kinesis Data Firehose
E) Amazon Kinesis Data Analytics

Question 19

A recently acquired company is required to build its own infrastructure on AWS and migrate multiple applications to the cloud within a month. Each application has approximately 50 TB of data to be transferred. After the migration is complete, this company and its parent company will both require secure network connectivity with consistent throughput from their data centers to the applications. A solutions architect must ensure one-time data migration and ongoing network connectivity. Which solution will meet these requirements?

A) AWS Direct Connect for both the initial transfer and ongoing connectivity.
B) AWS Site-to-Site VPN for both the initial transfer and ongoing connectivity.
C) AWS Snowball for the initial transfer and AWS Direct Connect for ongoing connectivity.
D) AWS Snowball for the initial transfer and AWS Site-to-Site VPN for ongoing connectivity.

Question 20

A company currently operates a web application backed by an Amazon RDS MySQL database. It has automated backups that are run daily and are not encrypted. A security audit requires future backups to be encrypted and the unencrypted backups to be destroyed. The company will make at least one encrypted backup before destroying the old backups. What should be done to enable encryption for future backups?

A) Enable default encryption for the Amazon S3 bucket where backups are stored.
B) Modify the backup section of the database configuration to toggle the Enable encryption check box.
C) Create a snapshot of the database. Copy it to an encrypted snapshot. Restore the database from the encrypted snapshot.
D) Enable an encrypted read replica on RDS for MySQL. Promote the encrypted read replica to primary. Remove the original database instance.

Question 21

A company is hosting a web application on AWS using a single Amazon EC2 instance that stores user-uploaded documents in an Amazon EBS volume. For better scalability and availability, the company duplicated the architecture and created a second EC2 instance and EBS volume in another Availability Zone, placing both behind an Application Load Balancer. After completing this change, users reported that each time they refreshed the website, they could see one subset of their documents or the other, but never all of the documents at the same time. What should a solutions architect propose to ensure users see all of their documents at once?

A) Copy the data so both EBS volumes contain all the documents.
B) Configure the Application Load Balancer to direct a user to the server with the documents.
C) Copy the data from both EBS volumes to Amazon EFS. Modify the application to save new documents to Amazon EFS.
D) Configure the Application Load Balancer to send the request to both servers. Return each document from the correct server.

Question 22

A marketing company is storing CSV files in an Amazon S3 bucket for statistical analysis. An application on an Amazon EC2 instance needs permission to efficiently process the CSV data stored in the S3 bucket. Which action will MOST securely grant the EC2 instance access to the S3 bucket?

A) Attach a resource-based policy to the S3 bucket.
B) Create an IAM user for the application with specific permissions to the S3 bucket.
C) Associate an IAM role with least privilege permissions to the EC2 instance profile.
D) Store AWS credentials directly on the EC2 instance for applications on the instance to use for API calls.

Question 23

A company allows its developers to attach existing IAM policies to existing IAM roles to enable faster experimentation and agility. However, the security operations team is concerned that the developers could attach the existing administrator policy, which would allow the developers to circumvent any other security policies. How should a solutions architect address this issue?

A) Create an Amazon SNS topic to send an alert every time a developer creates a new policy.
B) Use service control policies to disable IAM activity across all account in the organizational unit.
C) Prevent the developers from attaching any policies and assign all IAM duties to the security operations team.
D) Set an IAM permissions boundary on the developer IAM role that explicitly denies attaching the administrator policy.

Question 24

A company built a food ordering application that captures user data and stores it for future analysis. The application's static front end is deployed on an Amazon EC2 instance. The front-end application sends the requests to the backend application running on separate EC2 instance. The backend application then stores the data in Amazon RDS. What should a solutions architect do to decouple the architecture and make it scalable?

A) Use Amazon S3 to serve the front-end application, which sends requests to Amazon EC2 to execute the backend application. The backend application will process and store the data in Amazon RDS.
B) Use Amazon S3 to serve the front-end application and write requests to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe Amazon EC2 instances to the HTTP/HTTPS endpoint of the topic, and process and store the data in Amazon RDS.
C) Use an EC2 instance to serve the front end and write requests to an Amazon SQS queue. Place the backend instance in an Auto Scaling group, and scale based on the queue depth to process and store the data in Amazon RDS.
D) Use Amazon S3 to serve the static front-end application and send requests to Amazon API Gateway, which writes the requests to an Amazon SQS queue. Place the backend instances in an Auto Scaling group, and scale based on the queue depth to process and store the data in Amazon RDS.

Question 25

A solutions architect is implementing a document review application using an Amazon S3 bucket for storage. The solution must prevent an accidental deletion of the documents and ensure that all versions of the documents are available. Users must be able to download, modify, and upload documents. Which combination of actions should be taken to meet these requirements? (Choose two.)

A) Enable a read-only bucket ACL.
B) Enable versioning on the bucket.
C) Attach an IAM policy to the bucket.
D) Enable MFA Delete on the bucket.
E) Encrypt the bucket using AWS KMS.

Question 26

A company has a two-tier application architecture that runs in public and private subnets. Amazon EC2 instances running the web application are in the public subnet and a database runs on the private subnet. The web application instances and the database are running in a single Availability Zone (AZ). Which combination of steps should a solutions architect take to provide high availability for this architecture? (Choose two.)

A) Create new public and private subnets in the same AZ for high availability.
B) Create an Amazon EC2 Auto Scaling group and Application Load Balancer spanning multiple AZs.
C) Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer.
D) Create new public and private subnets in a new AZ. Create a database using Amazon EC2 in one AZ.
E) Create new public and private subnets in the same VPC, each in a new AZ. Migrate the database to an Amazon RDS multi-AZ deployment.

Question 27

A company is planning to use Amazon S3 to store images uploaded by its users. The images must be encrypted at rest in Amazon S3. The company does not want to spend time managing and rotating the keys, but it does want to control who can access those keys. What should a solutions architect use to accomplish this?

A) Server-Side Encryption with keys stored in an S3 bucket
B) Server-Side Encryption with Customer-Provided Keys (SSE-C)
C) Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
D) Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)

Question 28

A company's web application is using multiple Linux Amazon EC2 instances and storing data on Amazon EBS volumes. The company is looking for a solution to increase the resiliency of the application in case of a failure and to provide storage that complies with atomicity, consistency, isolation, and durability (ACID). What should a solutions architect do to meet these requirements?

A) Launch the application on EC2 instances in each Availability Zone. Attach EBS volumes to each EC2 instance.
B) Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Mount an instance store on each EC2 instance.
C) Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Store data on Amazon EFS and mount a target on each instance.
D) Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Store data using Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA).

Question 29

A company has deployed an API in a VPC behind an internet-facing Application Load Balancer (ALB). An application that consumes the API as a client is deployed in a second account in private subnets behind a NAT gateway. When requests to the client application increase, the NAT gateway costs are higher than expected. A solutions architect has configured the ALB to be internal. Which combination of architectural changes will reduce the NAT gateway costs? (Choose two.)

A) Configure a VPC peering connection between the two VPCs. Access the API using the private address.
B) Configure an AWS Direct Connect connection between the two VPCs. Access the API using the private address.
C) Configure a ClassicLink connection for the API into the client VPC. Access the API using the ClassicLink address.
D) Configure a PrivateLink connection for the API into the client VPC. Access the API using the PrivateLink address.
E) Configure an AWS Resource Access Manager connection between the two accounts. Access the API using the private address.

Question 30

A security team to limit access to specific services or actions in all of the team's AWS accounts. All accounts belong to a large organization in AWS Organizations. The solution must be scalable and there must be a single point where permissions can be maintained. What should a solutions architect do to accomplish this?

A) Create an ACL to provide access to the services or actions.
B) Create a security group to allow accounts and attach it to user groups.
C) Create cross-account roles in each account to deny access to the services or actions.
D) Create a service control policy in the root organizational unit to deny access to the services or actions.

Question 31

An application hosted on AWS is experiencing performance problems, and the application vendor wants to perform an analysis of the log file to troubleshoot further. The log file is stored on Amazon S3 and is 10 GB in size. The application owner will make the log file available to the vendor for a limited time. What is the MOST secure way to do this?

A) Enable public read on the S3 object and provide the link to the vendor.
B) Upload the file to Amazon WorkDocs and share the public link with the vendor.
C) Generate a presigned URL and have the vendor download the log file before it expires.
D) Create an IAM user for the vendor to provide access to the S3 bucket and the application. Enforce multi-factor authentication.

Question 32

A solutions architect is designing a system to analyze the performance of financial markets while the markets are closed. The system will run a series of compute-intensive jobs for 4 hours every night. The time to complete the compute jobs is expected to remain constant, and jobs cannot be interrupted once started. Once completed, the system is expected to run for a minimum of 1 year. Which type of Amazon EC2 instances should be used to reduce the cost of the system?

A) Spot Instances
B) On-Demand Instances
C) Standard Reserved Instances
D) Scheduled Reserved Instances

Question 33

A company has a three-tier image-sharing application. It uses an Amazon EC2 instance for the front-end layer, another for the backend tier, and a third for the MySQL database. A solutions architect has been tasked with designing a solution that is highly available, and requires the least amount of changes to the application Which solution meets these requirements?

A) Use Amazon S3 to host the front-end layer and AWS Lambda functions for the backend layer. Move the database to an Amazon DynamoDB table and use Amazon S3 to store and serve users' images.
B) Use load-balanced Multi-AZ AWS Elastic Beanstalk environments for the front-end and backend layers. Move the database to an Amazon RDS instance with multiple read replicas to store and serve users' images.
C) Use Amazon S3 to host the front-end layer and a fleet of Amazon EC2 instances in an Auto Scaling group for the backend layer. Move the database to a memory optimized instance type to store and serve users' images.
D) Use load-balanced Multi-AZ AWS Elastic Beanstalk environments for the front-end and backend layers. Move the database to an Amazon RDS instance with a Multi-AZ deployment. Use Amazon S3 to store and serve users' images.

Question 34

A solutions architect is designing the cloud architecture for a new application being deployed on AWS. The process should run in parallel while adding and removing application nodes as needed based on the number of jobs to be processed. The processor application is stateless. The solutions architect must ensure that the application is loosely coupled and the job items are durably stored. Which design should the solutions architect use?

A) Create an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch configuration that uses the AMI. Create an Auto Scaling group using the launch configuration. Set the scaling policy for the Auto Scaling group to add and remove nodes based on CPU usage.
B) Create an Amazon SQS queue to hold the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch configuration that uses the AMI. Create an Auto Scaling group using the launch configuration. Set the scaling policy for the Auto Scaling group to add and remove nodes based on network usage.
C) Create an Amazon SQS queue to hold the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch template that uses the AMI. Create an Auto Scaling group using the launch template. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of items in the SQS queue.
D) Create an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch template that uses the AMI. Create an Auto Scaling group using the launch template. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of messages published to the SNS topic.

Question 35

A company has on-premises servers running a relational database. The current database serves high read traffic for users in different locations. The company wants to migrate to AWS with the least amount of effort. The database solution should support disaster recovery and not affect the company's current traffic flow. Which solution meets these requirements?

A) Use a database in Amazon RDS with Multi-AZ and at least one read replica.
B) Use a database in Amazon RDS with Multi-AZ and at least one standby replica.
C) Use databases hosted on multiple Amazon EC2 instances in different AWS Regions.
D) Use databases hosted on Amazon EC2 instances behind an Application Load Balancer in different Availability Zones.

Question 36

A company hosts its product information webpages on AWS. The existing solution uses multiple Amazon C2 instances behind an Application Load Balancer in an Auto Scaling group. The website also uses a custom DNS name and communicates with HTTPS only using a dedicated SSL certificate. The company is planning a new product launch and wants to be sure that users from around the world have the best possible experience on the new website. What should a solutions architect do to meet these requirements?

A) Redesign the application to use Amazon CloudFront.
B) Redesign the application to use AWS Elastic Beanstalk.
C) Redesign the application to use a Network Load Balancer.
D) Redesign the application to use Amazon S3 static website hosting.

Question 37

A solutions architect is tasked with transferring 750 TB of data from a network-attached file system located at a branch office Amazon S3 Glacier. The solution must avoid saturating the branch office's low-bandwidth internet connection. What is the MOST cost-effective solution?

A) Create a site-to-site VPN tunnel to an Amazon S3 bucket and transfer the files directly. Create a bucket policy to enforce a VPC endpoint.
B) Order 10 AWS Snowball appliances and select an S3 Glacier vault as the destination. Create a bucket policy to enforce a VPC endpoint.
C) Mount the network-attached file system to Amazon S3 and copy the files directly. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier.
D) Order 10 AWS Snowball appliances and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier.

Question 38

A media streaming company collects real-time data and stores it in a disk-optimized database system. The company is not getting the expected throughput and wants an in-memory database storage solution that performs faster and provides high availability using data replication. Which database should a solutions architect recommend?

A) Amazon RDS for MySQL
B) Amazon RDS for PostgreSQL.
C) Amazon ElastiCache for Redis
D) Amazon ElastiCache for Memcached

Question 39

A company has a multi-tier application that runs six front-end web servers in an Amazon EC2 Auto Scaling group in a single Availability Zone behind an Application Load Balancer (ALB). A solutions architect needs to modify the infrastructure to be highly available without modifying the application. Which architecture should the solutions architect choose that provides high availability?

A) Create an Auto Scaling group that uses three instances across each of two Regions.
B) Modify the Auto Scaling group to use three instances across each of two Availability Zones.
C) Create an Auto Scaling template that can be used to quickly create more instances in another Region.
D) Change the ALB in front of the Amazon EC2 instances in a round-robin configuration to balance traffic to the web tier.

Question 40

A company is running an ecommerce application on Amazon EC2. The application consists of a stateless web tier that requires a minimum of 10 instances, and a peak of 250 instances to support the application's usage. The application requires 50 instances 80% of the time. Which solution should be used to minimize costs?

A) Purchase Reserved Instances to cover 250 instances.
B) Purchase Reserved Instances to cover 80 instances. Use Spot Instances to cover the remaining instances.
C) Purchase On-Demand Instances to cover 40 instances. Use Spot Instances to cover the remaining instances.
D) Purchase Reserved Instances to cover 50 instances. Use On-Demand and Spot Instances to cover the remaining instances.

Question 41

A company built an application that lets users check in to places they visit, rank the places, and add reviews about their experiences. The application is successful with a rapid increase in the number of users every month. The chief technology officer fears the database supporting the current Infrastructure may not handle the new load the following month because the single Amazon RDS for MySQL instance has triggered alarms related to resource exhaustion due to read requests. What can a solutions architect recommend to prevent service Interruptions at the database layer with minimal changes to code?

A) Create RDS read replicas and redirect read-only traffic to the read replica endpoints. Enable a Multi-AZ deployment.
B) Create an Amazon EMR cluster and migrate the data to a Hadoop Distributed File System (HDFS) with a replication factor of 3.
C) Create an Amazon ElastiCache cluster and redirect all read-only traffic to the cluster. Set up the cluster to be deployed in three Availability Zones.
D) Create an Amazon DynamoDB table to replace the RDS instance and redirect all read-only traffic to the DynamoDB table. Enable DynamoDB Accelerator to offload traffic from the main table.

Question 42

A company is looking for a solution that can store video archives in AWS from old news footage. The company needs to minimize costs and will rarely need to restore these files. When the files are needed, they must be available in a maximum of five minutes. What is the MOST cost-effective solution?

A) Store the video archives in Amazon S3 Glacier and use Expedited retrievals.
B) Store the video archives in Amazon S3 Glacier and use Standard retrievals.
C) Store the video archives in Amazon S3 Standard-Infrequent Access (S3 Standard-IA).
D) Store the video archives in Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA).

Question 43

A company recently implemented hybrid cloud connectivity using AWS Direct Connect and is migrating data to Amazon S3. The company is looking for a fully managed solution that will automate and accelerate the replication of data between the on-premises storage systems and AWS storage services. Which solution should a solutions architect recommend to keep the data private?

A) Deploy an AWS DataSync agent for the on-premises environment. Configure a sync job to replicate the data and connect it with an AWS service endpoint.
B) Deploy an AWS DataSync agent for the on-premises environment. Schedule a batch job to replicate point-in-time snapshots to AWS.
C) Deploy an AWS Storage Gateway volume gateway for the on-premises environment. Configure it to store data locally, and asynchronously back up point-in-time snapshots to AWS.
D) Deploy an AWS Storage Gateway file gateway for the on-premises environment. Configure it to store data locally, and asynchronously back up point-in-time snapshots to AWS.

Question 44

A solutions architect observes that a nightly batch processing job is automatically scaled up for 1 hour before the desired Amazon EC2 capacity is reached. The peak capacity is the same every night and the batch jobs always start at 1 AM. The solutions architect needs to find a cost-effective solution that will allow for the desired EC2 capacity to be reached quickly and allow the Auto Scaling group to scale down after the batch jobs are complete. What should the solutions architect do to meet these requirements?

A) Increase the minimum capacity for the Auto Scaling group.
B) Increase the maximum capacity for the Auto Scaling group.
C) Configure scheduled scaling to scale up to the desired compute level.
D) Change the scaling policy to add more EC2 instances during each scaling operation.

Question 45

A company recently deployed a new auditing system to centralize information about operating system versions, patching, and installed software for Amazon EC2 instances. A solutions architect must ensure all instances provisioned through EC2 Auto Scaling groups successfully send reports to the auditing system as soon as they are launched and terminated. Which solution achieves these goals MOST efficiently?

A) Use a scheduled AWS Lambda function and execute a script remotely on all EC2 instances to send data to the audit system.
B) Use EC2 Auto Scaling lifecycle hooks to execute a custom script to send data to the audit system when instances are launched and terminated.
C) Use an EC2 Auto Scaling launch configuration to execute a custom script through user data to send data to the audit system when instances are launched and terminated.
D) Execute a custom script on the instance operating system to send data to the audit system. Configure the script to be executed by the EC2 Auto Scaling group when the instance starts and is terminated.

Question 46

An application runs on Amazon EC2 instances in private subnets. The application needs to access an Amazon DynamoDB table. What is the MOST secure way to access the table while ensuring that the traffic does not leave the AWS network?

A) Use a VPC endpoint for DynamoDB.
B) Use a NAT gateway in a public subnet.
C) Use a NAT instance in a private subnet.
D) Use the internet gateway attached to the VPC.

Question 47

A company's web application is running on Amazon EC2 instances behind an Application Load Balancer. The company recently changed its policy, which now requires the application to be accessed from one specific country only. Which configuration will meet this requirement?

A) Configure the security group for the EC2 instances.
B) Configure the security group on the Application Load Balancer.
C) Configure AWS WAF on the Application Load Balancer in a VPC.
D) Configure the network ACL for the subnet that contains the EC2 instances.

Question 48

A company has 150 TB of archived image data stored on-premises that needs to be moved to the AWS Cloud within the next month. The company's current network connection allows up to 100 Mbps uploads for this purpose during the night only. What is the MOST cost-effective mechanism to move this data and meet the migration deadline?

A) Use AWS Snowmobile to ship the data to AWS.
B) Order multiple AWS Snowball devices to ship the data to AWS.
C) Enable Amazon S3 Transfer Acceleration and securely upload the data.
D) Create an Amazon S3 VPC endpoint and establish a VPN to upload the data.

Question 49

A Solutions Architect must design a web application that will be hosted on AWS, allowing users to purchase access to premium, shared content that is stored in an S3 bucket. Upon payment, content will be available for download for 14 days before the user is denied access. Which of the following would be the LEAST complicated implementation?

A) Use an Amazon CloudFront distribution with an origin access identity (OAI). Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design a Lambda function to remove data that is older than 14 days.
B) Use an S3 bucket and provide direct access to the file. Design the application to track purchases in a DynamoDB table. Configure a Lambda function to remove data that is older than 14 days based on a query to Amazon DynamoDB.
C) Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design the application to set an expiration of 14 days for the URL.
D) Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design the application to set an expiration of 60 minutes for the URL and recreate the URL as necessary.

Question 50

A company's operations team has an existing Amazon S3 bucket configured to notify an Amazon SQS queue when new objects are created within the bucket. The development team also wants to receive events when new objects are created. The existing operations team workflow must remain intact. Which solution would satisfy these requirements?

A) Create another SQS queue. Update the S3 events in the bucket to also update the new queue when a new object is created.
B) Create a new SQS queue that only allows Amazon S3 to access the queue. Update Amazon S3 to update this queue when a new object is created.
C) Create an Amazon SNS topic and SQS queue for the bucket updates. Update the bucket to send events to the new topic. Updates both queues to poll Amazon SNS.
D) Create an Amazon SNS topic and SQS queue for the bucket updates. Update the bucket to send events to the new topic. Add subscriptions for both queues in the topic.

Question 51

A company has an application that calls AWS Lambda functions. A recent code review found database credentials stored in the source code. The database credentials need to be removed from the Lambda source code. The credentials must then be securely stored and rotated on an ongoing basis to meet security policy requirements. What should a solutions architect recommend to meet these requirements?

A) Store the password in AWS CloudHSM. Associate the Lambda function with a role that can retrieve the password from CloudHSM given its key ID.
B) Store the password in AWS Secrets Manager. Associate the Lambda function with a role that can retrieve the password from Secrets Manager given its secret ID.
C) Move the database password to an environment variable associated with the Lambda function. Retrieve the password from the environment variable upon execution.
D) Store the password in AWS Key Management Service (AWS KMS). Associate the Lambda function with a role that can retrieve the password from AWS KMS given its key ID.

Question 52

A company runs multiple Amazon EC2 Linux instances in a VPC with applications that use a hierarchical directory structure. The applications need to rapidly and concurrently read and write to shared storage. How can this be achieved?

A) Create an Amazon EFS file system and mount it from each EC2 instance.
B) Create an Amazon S3 bucket and permit access from all the EC2 instances in the VPC.
C) Create a file system on an Amazon EBS Provisioned IOPS SSD (io1) volume. Attach the volume to all the EC2 instances.
D) Create file systems on Amazon EBS volumes attached to each EC2 instance. Synchronize the Amazon EBS volumes across the different EC2 instances.

Question 53

A healthcare company stores highly sensitive patient records. Compliance requires that multiple copies be stored in different locations. Each record must be stored for 7 years. The company has a service level agreement (SLA) to provide records to government agencies immediately for the first 30 days and then within 4 hours of a request thereafter. What should a solutions architect recommend?

A) Use Amazon S3 with cross-Region replication enabled. After 30 days, transition the data to Amazon S3 Glacier using lifecycle policy.
B) Use Amazon S3 with cross-origin resource sharing (CORS) enabled. After 30 days, transition the data to Amazon S3 Glacier using a lifecycle policy.
C) Use Amazon S3 with cross-Region replication enabled. After 30 days, transition the data to Amazon S3 Glacier Deep Achieve using a lifecycle policy.
D) Use Amazon S3 with cross-origin resource sharing (CORS) enabled. After 30 days, transition the data to Amazon S3 Glacier Deep Archive using a lifecycle policy.

Question 54

A public-facing web application queries a database hosted on an Amazon EC2 instance in a private subnet. A large number of queries involve multiple table joins, and the application performance has been degrading due to an increase in complex queries. The application team will be performing updates to improve performance. What should a solutions architect recommend to the application team? (Choose two.)

A) Cache query data in Amazon SQS
B) Create a read replica to offload queries
C) Migrate the database to Amazon Athena
D) Implement Amazon DynamoDB Accelerator to cache data.
E) Migrate the database to Amazon RDS

Question 55

A solutions architect needs to design a managed storage solution for a company's application that includes high-performance machine learning. This application runs on AWS Fargate, and the connected storage needs to have concurrent access to files and deliver high performance. Which storage option should the solutions architect recommend?

A) Create an Amazon S3 bucket for the application and establish an IAM role for Fargate to communicate with Amazon S3.
B) Create an Amazon FSx for Lustre file share and establish an IAM role that allows Fargate to communicate with FSx for Lustre.
C) Create an Amazon Elastic File System (Amazon EFS) file share and establish an IAM role that allows Fargate to communicate with Amazon EFS.
D) Create an Amazon Elastic Block Store (Amazon EBS) volume for the application and establish an IAM role that allows Fargate to communicate with Amazon EBS.

Question 56

An application requires a development environment (DEV) and production environment (PROD) for several years. The DEV instances will run for 10 hours each day during normal business hours, while the PROD instances will run 24 hours each day. A solutions architect needs to determine a compute instance purchase strategy to minimize costs. Which solution is the MOST cost-effective?

A) DEV with Spot Instances and PROD with On-Demand Instances
B) DEV with On-Demand Instances and PROD with Spot Instances
C) DEV with Scheduled Reserved Instances and PROD with Reserved Instances
D) DEV with On-Demand Instances and PROD with Scheduled Reserved Instances

Question 57

A company wants to use Amazon S3 for the secondary copy of its on-premises dataset. The company would rarely need to access this copy. The storage solution's cost should be minimal. Which storage solution meets these requirements?

A) S3 Standard
B) S3 Intelligent-Tiering
C) S3 Standard-Infrequent Access (S3 Standard-IA)
D) S3 One Zone-Infrequent Access (S3 One Zone-IA)

Question 58

A company is seeing access requests by some suspicious IP addresses. The security team discovers the requests are from different IP addresses under the same CIDR range. What should a solutions architect recommend to the team?

A) Add a rule in the inbound table of the security to deny the traffic from that CIDR range.
B) Add a rule in the outbound table of the security group to deny the traffic from that CIDR range.
C) Add a deny rule in the inbound table of the network ACL with a lower number than other rules.
D) Add a deny rule in the outbound table of the network ACL with a lower rule number than other rules.

Question 59

A company must migrate 20 TB of data from a data center to the AWS Cloud within 30 days. The company's network bandwidth is limited to 15 Mbps and cannot exceed 70% utilization. What should a solutions architect do to meet these requirements?

A) Use AWS Snowball.
B) Use AWS DataSync.
C) Use a secure VPN connection.
D) Use Amazon S3 Transfer Acceleration.

Question 60

A company is managing health records on-premises. The company must keep these records indefinitely, disable any modifications to the records once they are stored, and granularly audit access at all levels. The chief technology officer (CTO) is concerned because there are already millions of records not being used by any application, and the current infrastructure is running out of space. The CTO has requested a solutions architect design a solution to move existing data and support future records. Which services can the solutions architect recommend to meet these requirements?

A) Use AWS DataSync to move existing data to AWS. Use Amazon S3 to store existing and new data. Enable Amazon S3 object lock and enable AWS CloudTrail with data events.
B) Use AWS Storage Gateway to move existing data to AWS. Use Amazon S3 to store existing and new data. Enable Amazon S3 object lock and enable AWS CloudTrail with management events.
C) Use AWS DataSync to move existing data to AWS. Use Amazon S3 to store existing and new data. Enable Amazon S3 object lock and enable AWS CloudTrail with management events.
D) Use AWS Storage Gateway to move existing data to AWS. Use Amazon Elastic Block Store (Amazon EBS) to store existing and new data. Enable Amazon S3 object lock and enable Amazon S3 server access logging.

Question 61

A company delivers files in Amazon S3 to certain users who do not have AWS credentials. These users must be given access for a limited time. What should a solutions architect do to securely meet these requirements?

A) Enable public access on an Amazon S3 bucket.
B) Generate a presigned URL to share with the users.
C) Encrypt files using AWS KMS and provide keys to the users.
D) Create and assign IAM roles that will grant GetObject permissions to the users.

Question 62

A three-tier web application processes orders from customers. The web tier consists of Amazon EC2 instances behind an Application Load Balancer, a middle tier of three EC2 instances decoupled from the web tier using Amazon SQS, and an Amazon DynamoDB backend. At peak times, customers who submit orders using the site have to wait much longer than normal to receive confirmations due to lengthy processing times. A solutions architect needs to reduce these processing times. Which action will be MOST effective in accomplishing this?

A) Replace the SQS queue with Amazon Kinesis Data Firehose.
B) Use Amazon ElastiCache for Redis in front of the DynamoDB backend tier.
C) Add an Amazon CloudFront distribution to cache the responses for the web tier.
D) Use Amazon EC2 Auto Scaling to scale out the middle tier instances based on the SQS queue depth.

Question 63

An application running on an Amazon EC2 instance in VPC-A needs to access files in another EC2 instance in VPC-B. Both are in separate. AWS accounts. The network administrator needs to design a solution to enable secure access to EC2 instance in VPC-B from VPC-A. The connectivity should not have a single point of failure or bandwidth concerns. Which solution will meet these requirements?

A) Set up a VPC peering connection between VPC-A and VPC-B.
B) Set up VPC gateway endpoints for the EC2 instance running in VPC-B.
C) Attach a virtual private gateway to VPC-B and enable routing from VPC-A.
D) Create a private virtual interface (VIF) for the EC2 instance running in VPC-B and add appropriate routes from VPC-B.

Question 64

A solutions architect must create a highly available bastion host architecture. The solution needs to be resilient within a single AWS Region and should require only minimal effort to maintain. What should the solutions architect do to meet these requirements?

A) Create a Network Load Balancer backed by an Auto Scaling group with a UDP listener.
B) Create a Network Load Balancer backed by a Spot Fleet with instances in a partition placement group.
C) Create a Network Load Balancer backed by the existing servers in different Availability Zones as the target.
D) Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple Availability Zones as the target.

Question 65

A company has created an isolated backup of its environment in another Region. The application is running in warm standby mode and is fronted by an Application Load Balancer (ALB). The current failover process is manual and requires updating a DNS alias record to point to the secondary ALB in another Region. What should a solutions architect do to automate the failover process?

A) Enable an ALB health check
B) Enable an Amazon Route 53 health check.
C) Crate an CNAME record on Amazon Route 53 pointing to the ALB endpoint.
D) Create conditional forwarding rules on Amazon Route 53 pointing to an internal BIND DNS server.

Question 66

A company has a mobile chat application with a data store based in Amazon DynamoDB. Users would like new messages to be read with as little latency as possible. A solutions architect needs to design an optimal solution that requires minimal application changes. Which method should the solutions architect select?

A) Configure Amazon DynamoDB Accelerator (DAX) for the new messages table. Update the code to use the DAX endpoint.
B) Add DynamoDB read replicas to handle the increased read load. Update the application to point to the read endpoint for the read replicas.
C) Double the number of read capacity units for the new messages table in DynamoDB. Continue to use the existing DynamoDB endpoint.
D) Add an Amazon ElastiCache for Redis cache to the application stack. Update the application to point to the Redis cache endpoint instead of DynamoDB.

Question 67

A company runs a website on Amazon EC2 instances behind an ELB Application Load Balancer. Amazon Route 53 is used for the DNS. The company wants to set up a backup website with a message including a phone number and email address that users can reach if the primary website is down. How should the company deploy this solution?

A) Use Amazon S3 website hosting for the backup website and Route 53 failover routing policy.
B) Use Amazon S3 website hosting for the backup website and Route 53 latency routing policy.
C) Deploy the application in another AWS Region and use ELB health checks for failover routing.
D) Deploy the application in another AWS Region and use server-side redirection on the primary website.

Question 68

An application is running on Amazon EC2 instances. Sensitive information required for the application is stored in an Amazon S3 bucket. The bucket needs to be protected from internet access while only allowing services within the VPC access to the bucket. Which combination of actions should solutions archived take to accomplish this? (Choose two.)

A) Create a VPC endpoint for Amazon S3.
B) Enable server access logging on the bucket.
C) Apply a bucket policy to restrict access to the S3 endpoint.
D) Add an S3 ACL to the bucket that has sensitive information.
E) Restrict users using the IAM policy to use the specific bucket.

Question 69

A company currently stores symmetric encryption keys in a hardware security module (HSM). A solutions architect must design a solution to migrate key management to AWS. The solution should allow for key rotation and support the use of customer provided keys. Where should the key material be stored to meet these requirements?

A) Amazon S3
B) AWS Secrets Manager
C) AWS Systems Manager Parameter store
D) AWS Key Management Service (AWS KMS)

Question 70

A company has an on-premises data center that is running out of storage capacity. The company wants to migrate its storage infrastructure to AWS while minimizing bandwidth costs. The solution must allow for immediate retrieval of data at no additional cost. How can these requirements be met?

A) Deploy Amazon S3 Glacier Vault and enable expedited retrieval. Enable provisioned retrieval capacity for the workload.
B) Deploy AWS Storage Gateway using cached volumes. Use Storage Gateway to store data in Amazon S3 while retaining copies of frequently accessed data subsets locally.
C) Deploy AWS Storage Gateway using stored volumes to store data locally. Use Storage Gateway to asynchronously back up point-in-time snapshots of the data to Amazon S3.
D) Deploy AWS Direct Connect to connect with the on-premises data center. Configure AWS Storage Gateway to store data locally. Use Storage Gateway to asynchronously back up point-in-time snapshots of the data to Amazon S3.

Question 71

A company wants to migrate a workload to AWS. The chief information security officer requires that all data be encrypted at rest when stored in the cloud. The company wants complete control of encryption key lifecycle management. The company must be able to immediately remove the key material and audit key usage independently of AWS CloudTrail. The chosen services should integrate with other storage services that will be used on AWS. Which services satisfies these security requirements?

A) AWS CloudHSM with the CloudHSM client
B) AWS Key Management Service (AWS KMS) with AWS CloudHSM
C) AWS Key Management Service (AWS KMS) with an external key material origin
D) AWS Key Management Service (AWS KMS) with AWS managed customer master keys (CMKs)

Question 72

A company recently launched its website to serve content to its global user base. The company wants to store and accelerate the delivery of static content to its users by leveraging Amazon CloudFront with an Amazon EC2 instance attached as its origin. How should a solutions architect optimize high availability for the application?

A) Use Lambda@Edge for CloudFront.
B) Use Amazon S3 Transfer Acceleration for CloudFront.
C) Configure another EC2 instance in a different Availability Zone as part of the origin group.
D) Configure another EC2 instance as part of the origin server cluster in the same Availability Zone.

Question 73

A company running an on-premises application is migrating the application to AWS to increase its elasticity and availability. The current architecture uses a Microsoft SQL Server database with heavy read activity. The company wants to explore alternate database options and migrate database engines, if needed. Every 4 hours, the development team does a full copy of the production database to populate a test database. During this period, users experience latency. What should a solutions architect recommend as replacement database?

A) Use Amazon Aurora with Multi-AZ Aurora Replicas and restore from mysqldump for the test database.
B) Use Amazon Aurora with Multi-AZ Aurora Replicas and restore snapshots from Amazon RDS for the test database.
C) Use Amazon RDS for MySQL with a Multi-AZ deployment and read replicas, and use the standby instance for the test database.
D) Use Amazon RDS for SQL Server with a Multi-AZ deployment and read replicas, and restore snapshots from RDS for the test database.

Question 74

A company hosts its website on Amazon S3. The website serves petabytes of outbound traffic monthly, which accounts for most of the company's AWS costs. What should a solutions architect do to reduce costs?

A) Configure Amazon CloudFront with the existing website as the origin.
B) Move the website to Amazon EC2 with Amazon EBS volumes for storage.
C) Use AWS Global Accelerator and specify the existing website as the endpoint.
D) Rearchitect the website to run on a combination of Amazon API Gateway and AWS Lambda.

Question 75

A solutions architect is moving the static content from a public website hosted on Amazon EC2 instances to an Amazon S3 bucket. An Amazon CloudFront distribution will be used to deliver the static assets. The security group used by the EC2 instances restricts access to a limited set of IP ranges. Access to the static content should be similarly restricted. Which combination of steps will meet these requirements? (Choose two.)

A) Create an origin access identity (OAI) and associate it with the distribution. Change the permissions in the bucket policy so that only the OAI can read the objects.
B) Create an AWS WAF web ACL that includes the same IP restrictions that exist in the EC2 security group. Associate this new web ACL with the CloudFront distribution.
C) Create a new security group that includes the same IP restrictions that exist in the current EC2 security group. Associate this new security group with the CloudFront distribution.
D) Create a new security group that includes the same IP restrictions that exist in the current EC2 security group. Associate this new security group with the S3 bucket hosting the static content.
E) Create a new IAM role and associate the role with the distribution. Change the permissions either on the S3 bucket or on the files within the S3 bucket so that only the newly created IAM role has read and download permissions.

Question 76

A media company is evaluating the possibility of moving its systems to the AWS Cloud. The company needs at least 10 TB of storage with the maximum possible I/O performance for video processing, 300 TB of very durable storage for storing media content, and 900 TB of storage to meet requirements for archival media that is not in use anymore. Which set of services should a solutions architect recommend to meet these requirements?

A) Amazon EBS for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage
B) Amazon EBS for maximum performance, Amazon EFS for durable data storage, and Amazon S3 Glacier for archival storage
C) Amazon EC2 instance store for maximum performance, Amazon EFS for durable data storage, and Amazon S3 for archival storage
D) Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage

Question 77

An ecommerce company is running a multi-tier application on AWS. The front-end and backend tiers both run on Amazon EC2, and the database runs on Amazon RDS for MySQL. The backend tier communicates with the RDS instance. There are frequent calls to return identical datasets from the database that are causing performance slowdowns. Which action should be taken to improve the performance of the backend?

A) Implement Amazon SNS to store the database calls.
B) Implement Amazon ElastiCache to cache the large datasets.
C) Implement an RDS for MySQL read replica to cache database calls.
D) Implement Amazon Kinesis Data Firehose to stream the calls to the database.

Question 78

A company's application hosted on Amazon EC2 instances needs to access an Amazon S3 bucket. Due to data sensitivity, traffic cannot traverse the internet. How should a solutions architect configure access?

A) Create a private hosted zone using Amazon Route 53.
B) Configure a VPC gateway endpoint for Amazon S3 in the VPC.
C) Configure AWS PrivateLink between the EC2 instance and the S3 bucket.
D) Set up a site-to-site VPN connection between the VPC and the S3 bucket.

Question 79

A company plans to store sensitive user data on Amazon S3. Internal security compliance requirement mandate encryption of data before sending it to Amazon S3. What should a solutions architect recommend to satisfy these requirements?

A) Server-side encryption with customer-provided encryption keys
B) Client-side encryption with Amazon S3 managed encryption keys
C) Server-side encryption with keys stored in AWS key Management Service (AWS KMS)
D) Client-side encryption with a master key stored in AWS Key Management Service (AWS KMS)

Question 80

A company is running a highly sensitive application on Amazon EC2 backed by an Amazon RDS database. Compliance regulations mandate that all personally identifiable information (PII) be encrypted at rest. Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure?

A) Deploy AWS Certificate Manager to generate certificates. Use the certificates to encrypt the database volume.
B) Deploy AWS CloudHSM, generate encryption keys, and use the customer master key (CMK) to encrypt database volumes.
C) Configure SSL encryption using AWS Key Management Service customer master keys (AWS KMS CMKs) to encrypt database volumes.
D) Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes.