Amazon Practice Questions, Discussions & Exam Topics by our Authors

A company is running a web application in the AWS Cloud. The application consists of dynamic content that is created on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group that is configured as a target group for an Application Load Balancer (ALB). The company is using an Amazon CloudFront distribution to distribute the application globally. The CloudFront distribution uses the ALB as an origin. The company uses Amazon Route 53 for DNS and has created an ...

Let's break down the requirements and evaluate each solution based on the need for high availability, fault tolerance, and scalability across AWS Regions. Key Factors: 1. Application Architecture: The application is running on EC2 instances in an Auto Scaling group behind an ALB and is distributed globally using CloudFront. 2. High Availability: The solution must ensure that the application remains available even if one AWS Region fails. 3. Fault Tolerance: The solution must be resilient to failures and must provide a mechanism to failover to another region or instance set in case of issues. 4. Route 53 and CloudFront: Route 53 is used for DNS management, and CloudFront is being used to distribute the application globally. The solution must take advantage of these services to maintain high availability. Option A: Provision a full, secondary application deployment in a different AWS Region. Update the Route 53 A record to be a failover record. Add both of the CloudFront distributions as values. Create Route 53 health checks. - Why it might work: This option proposes setting up a secondary deployment in a different AWS Region and using Route 53's failover capability to ensure high availability. By creating health checks for both regions, Route 53 can route traffic to the healthy region in case of failure. - Why it's rejected: While this provides high availability and failover, it's not an efficient approach. Since the CloudFront distribution is already set to use the ALB, introducing a secondary deployment across regions with failover DNS would require additional complexity in maintaining two CloudFront distributions. This introduces potential issues with cache invalidation and synchronization across regions. - Scenario for use: This would be suitable if you want to explicitly separate the deployment into two regions and have an active-passive failover approach using Route 53. Option B: Provision an ALB, an Auto Scaling group, and EC2 instances in a different AWS Region. Update the CloudFront distribution, and create a second origin for the new ALB. Create an origin group for the two origins. Configure one origin as primary and one origin as secondary. - Why it works: This option involves creating a second Auto Scaling group and ALB in a different region and updating CloudFront to use both origins in an origin group. This provides automatic...

Author: Maya · Last updated Jul 6, 2026

A company has an organization in AWS Organizations that has a large number of AWS accounts. One of the AWS accounts is designated as a transit account and has a transit gateway that is shared with all of the other AWS accounts. AWS Site-to-Site VPN connections are configured between all of the company's global offices and the transit account. The company has AWS Config enabled on all of its accounts. The company's networking team needs to centrally manage a list of internal IP address r...

Let's break down the requirements and evaluate each option based on the need to centrally manage the list of internal IP address ranges, minimize operational overhead, and ensure that developers can securely reference the list for access to applications. Key Factors: 1. Centralized Management of IP Address Ranges: The IP address list should be easily accessible and managed centrally, minimizing the operational overhead. 2. Security: The IP ranges need to be used in security group rules for secure application access. 3. Least Operational Overhead: The solution should be easy to maintain with minimal effort, ideally with automatic updates to security configurations. 4. Integration with AWS Config: AWS Config is already enabled, so any solution should ideally integrate with AWS Config for compliance management. Option A: Create a JSON file that is hosted in Amazon S3 and that lists all of the internal IP address ranges. Configure an Amazon Simple Notification Service (Amazon SNS) topic in each of the accounts that can be invoked when the JSON file is updated. Subscribe an AWS Lambda function to the SNS topic to update all relevant security group rules with the updated IP address ranges. - Why it’s rejected: - While this approach would work to update security group rules across multiple accounts, it introduces a high operational overhead. Every time the IP list is updated, an SNS notification triggers a Lambda function to update security groups in every account. This adds complexity with multiple components that need to be maintained: the S3 file, SNS topics, Lambda functions, and security group updates. - This approach requires manual management of the JSON file and tracking of updates, which could introduce errors and more effort in the long term. - Scenario for use: This could be useful if the list of IP address ranges were not dynamic and changes were infrequent, but it's not the least operationally intensive option. Option B: Create a new AWS Config managed rule that contains all of the internal IP address ranges. Use the rule to check the security groups in each of the accounts to ensure compliance with the list of IP address ranges. Configure the rule to automatically remediate any noncompliant security group that is detected. - Why it’s rejected: - AWS Config managed rules are typically used for compliance checks and configuration auditing, but they are not ideal for dynamically updating or referencing an external list of IP address ranges. - While AWS Config can help enforce security group rules once they are configured, it is not a good fit for the requirement to centrally manage and reference a list of IP ranges in real-time. This solution would likely require manual intervention or constant remediation checks, which adds more operational overh...

Author: David · Last updated Jul 6, 2026

A company runs a new application as a static website in Amazon S3. The company has deployed the application to a production AWS account and uses Amazon CloudFront to deliver the website. The website calls an Amazon API Gateway REST API. An AWS Lambda function backs each API method. The company wants to create a CSV report every 2 weeks to show each API Lambda function's recommended configured memory, recommended cost, and the price differ...

Let's evaluate each option based on the requirements of generating a CSV report every 2 weeks that shows the recommended Lambda configurations, recommended costs, and the price difference between current and recommended configurations, while minimizing development time. Key Factors: 1. Recommended Memory and Cost for Lambda Functions: The report should show Lambda functions' recommended memory configuration and cost. 2. CSV Report: The output should be a CSV file. 3. Automated Process: The report should be generated every 2 weeks with minimal development time. 4. Cost and Operational Overhead: The solution should minimize operational overhead, especially regarding manual effort for monitoring or gathering data. Option A: Create a Lambda function that extracts metrics data for each API Lambda function from Amazon CloudWatch Logs for the 2-week period. Collate the data into tabular format. Store the data as a .csv file in an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda function to run every 2 weeks. - Why it's rejected: - This option involves CloudWatch Logs, which could work for tracking Lambda performance, but it would require custom development to extract the appropriate data, perform calculations, and generate the CSV report. It also involves manually processing the data for memory recommendations and costs, which adds complexity. - The development time for gathering performance data and manually determining cost differences would be significant. - Scenario for use: This might be suitable if you need highly customized reports, but it doesn't provide an out-of-the-box solution for Lambda memory optimization and recommendations. Option B: Opt in to AWS Compute Optimizer. Create a Lambda function that calls the `ExportLambdaFunctionRecommendations` operation. Export the .csv file to an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda function to run every 2 weeks. - Why it's selected: - AWS Compute Optimizer provides a pre-built service for recommending optimized memory configurations for Lambda functions. It also directly supports exporting the recommendations, which is what is needed. - The ExportLambdaFunctionRecommendations operation provides a straightforward and automatic way to generate memory configuration recommendations and related costs. - The process requires minimal development. You just need to set up the Lambda function to export the recommendations, and EventBridge can trigger it on a 2-week schedule. - Scenario for use: This is the most efficient solution since it leverages AWS Compute Optimizer, w...

Author: Mia · Last updated Jul 6, 2026

A company runs its legacy web application on AWS. The web application server runs on an Amazon EC2 instance in the public subnet of a VPC. The web application server collects images from customers and stores the image files in a locally attached Amazon Elastic Block Store (Amazon EBS) volume. The image files are uploaded every night to an Amazon S3 bucket for backup. A solutions architect discovers that the image files are being uploade...

Let's evaluate each option based on the requirement to ensure traffic to Amazon S3 does not use the public endpoint. The goal is to ensure that traffic to S3 stays within the private network, ideally using a secure and cost-effective solution. Option A: Create a gateway VPC endpoint for the S3 bucket that has the necessary permissions for the VPC. Configure the subnet route table to use the gateway VPC endpoint. - Pros: - VPC Endpoint: A gateway VPC endpoint allows private communication between resources in the VPC and supported AWS services (such as Amazon S3) without using the public internet. - Security: Traffic between the EC2 instance and S3 would stay within the AWS network, avoiding public endpoints. - No Data Charges: Data transfer between the VPC and S3 using a VPC endpoint does not incur internet data transfer charges. - Cons: - Permission Configuration: Proper IAM policies need to be configured to ensure that only authorized traffic from the VPC can access the S3 bucket. - Conclusion: This is the most cost-effective and secure solution. The VPC endpoint ensures private, secure access to S3 without using the public internet. Option B: Move the S3 bucket inside the VPC. Configure the subnet route table to access the S3 bucket through private IP addresses. - Pros: - Moving the S3 bucket inside the VPC could theoretically help with access control. - Cons: - Not Possible: S3 is a global service and cannot be moved inside a VPC. It always resides outside the VPC in AWS infrastructure. - Complexity: Even if the S3 bucket could be moved inside the VPC, managing such a setup would add unnecessary complexity without any additional benefits. - Conclusion: This option is not feasible, as S3 cannot be moved inside a VPC. Option C: Create an Amazon S3 access point for the Amazon EC2 instance inside the VPC. Configure the web application to upload by using the Amazon S3 access point. - Pros: - Access Control: S3 access points can help manage access control, allowing the EC2 instance to interact with S3 in a more controlled manner. - Private Communication: An access point can be used to ensure that the EC2 instance accesses S3 using private network paths (if combin...

Author: Oscar · Last updated Jul 12, 2026

A company's factory and automation applications are running in a single VPC. More than 20 applications run on a combination of Amazon EC2, Amazon Elastic Container Service (Amazon ECS), and Amazon RDS. The company has software engineers spread across three teams. One of the three teams owns each application, and each time is responsible for the cost and performance of all of its applications. Team resources have tags that represent their application and team. The teams use IAM access for daily activities. The company needs to determine which costs on the monthly AWS bill are attributable to each application or team. The company also must be able to create rep...

To meet the company's requirements of tracking costs for each application and team, creating reports, and forecasting costs, let's go through each option and explain why they are chosen or rejected based on key factors. Key Requirements: 1. Cost Attribution to Applications and Teams: The company needs a way to determine which costs are attributable to each application or team. 2. Reporting and Forecasting: The company needs to compare costs from the last 12 months and forecast future costs. 3. Minimal Development: The solution should rely on built-in AWS Billing and Cost Management tools with minimal manual overhead. Option Analysis: A) Activate the user-defined cost allocation tags that represent the application and the team. - Why it's selected: - Cost allocation tags allow you to track and categorize your AWS costs and usage by applying custom tags to AWS resources. These tags can represent the application and team and allow you to track costs for each. - Activating user-defined cost allocation tags will enable the company to track costs per application and team based on the tags attached to the relevant resources. - This aligns with the company's requirement to categorize costs by application and team. - Scenario for use: This is ideal for tagging resources like EC2 instances, ECS tasks, and RDS databases according to the responsible team and application. It allows for granular cost tracking and reporting. B) Activate the AWS generated cost allocation tags that represent the application and the team. - Why it's rejected: - AWS generated cost allocation tags are automatically created by AWS to track costs by service, but they don't track custom tags like the application name or team, which are critical in this scenario. - This option would not directly meet the requirement to attribute costs to the correct application or team. - Scenario for use: This option is more relevant for basic AWS service cost tracking, but it doesn't provide the level of granularity needed in this case. C) Create a cost category for each application in Billing and Cost Management. - Why it's selected: - Cost categories allow you to group your AWS resources into logical categories for easier tracking and reporting. - By creating a cost category for each application, the company can categorize and allocate costs to those applications at a high level in the Billing dashboard. This aligns with the need to track costs for each application. - It complements cost allocation tags by providing a broader categorization ...

Author: NebulaEagle11 · Last updated Jul 6, 2026

An AWS customer has a web application that runs on premises. The web application fetches data from a third-party API that is behind a firewall. The third party accepts only one public CIDR block in each client's allow list. The customer wants to migrate their web application to the AWS Cloud. The application will be hosted on a set of Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The ALB is located in public subnets. The EC2 instances are located in...

In this case, the AWS customer needs a way for the EC2 instances (located in private subnets) to make requests to a third-party API that accepts only one public CIDR block in the allow list. The solution should ensure that the third-party API sees a single, consistent public IP address when requests are made from the EC2 instances behind the Application Load Balancer (ALB). Let's evaluate each option: A) Associate a block of customer-owned public IP addresses to the VPC. Enable public IP addressing for public subnets in the VPC. - This option doesn't address the core requirement because the EC2 instances are located in private subnets and would not be able to use public IPs directly without a public-facing network component (like a NAT gateway or an ALB). Additionally, enabling public IP addressing on the public subnets wouldn't necessarily route traffic through a single public IP for the EC2 instances in private subnets. B) Register a block of customer-owned public IP addresses in the AWS account. Create Elastic IP addresses from the address block and assign them to the NAT gateways in the VPC. - This option assigns Elastic IPs (EIPs) to the NAT gateway, which is responsible for routing traffic from private subnets to the internet. Since the EC2 instances are behind the ALB and use NAT gateways to access the internet, using EIPs for the NAT gateway ensures that the outgoing traffic from the private subnets (where the EC2 instances reside) will have a consistent public IP address. This will allow the third-party API to recognize the requests coming from a specific public CIDR block. This solution is ideal for maintaining a consistent, one-to-one relationship between the private EC2 instances and the third-party API's allow list. C) ...

Author: FrostFalcon88 · Last updated Jul 6, 2026

A company is creating a prototype of an ecommerce website on AWS. The website consists of an Application Load Balancer, an Auto Scaling group of Amazon EC2 instances for web servers, and an Amazon RDS for MySQL DB instance that runs with the Single-AZ configuration. The website is slow to respond during searches of the product catalog. The product catalog is a group of tables in the MySQL database that the company does not update frequently. A solutions architect has determined that th...

To address the issue of slow response times during searches of the product catalog, let's evaluate each option based on the following key factors: performance improvement, cost-effectiveness, and simplicity. Option A: Migrate the product catalog to an Amazon Redshift database. Use the COPY command to load the product catalog tables. - Pros: - Redshift is a fast, scalable data warehouse solution optimized for complex queries and large-scale data analytics. - Cons: - Overkill: Redshift is designed for analytical workloads, not for real-time transactional workloads. Using it for product catalog searches might introduce unnecessary complexity and cost, especially when the product catalog does not require real-time updates. - Migration Complexity: Migrating to Redshift would involve significant changes in the architecture, including modifying queries, managing data loads, and potentially requiring different data access patterns. - Conclusion: This option is excessive for the described problem, as Redshift is intended for different use cases (analytics) rather than high-performance, real-time transaction queries. Option B: Implement an Amazon ElastiCache for Redis cluster to cache the product catalog. Use lazy loading to populate the cache. - Pros: - Caching: Caching the product catalog with Amazon ElastiCache for Redis can significantly reduce database load by offloading frequently accessed data (such as product catalog entries) from the database. - Lazy Loading: Lazy loading ensures that only the required product catalog data is loaded into the cache on demand, optimizing resource usage. - Scalability: Redis can scale easily to accommodate high traffic and provide faster response times for repeated queries. - Cons: - Cache Invalidation: Cache management and invalidation strategies must be carefully designed to ensure the cache is updated with fresh data when the product catalog changes. - Conclusion: This is the best solution for improving performance, as it offloads read-heavy queries from the database to a high-performance caching layer. It addresses the high CPU utilization issue by reducing the database workload, especially for frequently accessed data. Option C: Add an additional scaling policy to the Auto Scaling group to launch additional EC2 instances when database response is slow. - P...

Author: Nia · Last updated Jul 12, 2026

A company with several AWS accounts is using AWS Organizations and service control policies (SCPs). An administrator created the following SCP and has attached it to an organizational unit (OU) that contains AWS account 1111-1111-1111: Developers working in account ...

To solve this issue, let's first analyze the problem and the possible solutions. Problem: - The administrator has applied a Service Control Policy (SCP) to an organizational unit (OU) containing AWS account 1111-1111-1111, but the developers in that account cannot create Amazon S3 buckets. - SCPs are used to restrict what actions can be performed in accounts, but they do not grant permissions directly. Instead, they control the maximum permissions that can be granted to an account or IAM users within the account. - The issue is likely that the current SCP is blocking the `s3:CreateBucket` action for the developers. Option A: Add s3:CreateBucket with “Allow” effect to the SCP. - Reasoning: - SCPs specify the maximum allowed actions for accounts or users. If the current SCP is blocking the `s3:CreateBucket` action, adding an explicit `Allow` for `s3:CreateBucket` would resolve the issue, as it would enable the developers to create S3 buckets. - SCPs must have explicit allows for the required actions. If there’s an implicit deny (which is the default), the action will be blocked, even if the IAM policy allows it. - Why it’s selected: - This solution directly addresses the problem of blocking the `s3:CreateBucket` action. By adding an explicit allow for this action in the SCP, the developers will be able to create S3 buckets again while maintaining the overall security and policy structure. Option B: Remove the account from the OU, and attach the SCP directly to account 1111-1111-1111. - Reasoning: - This option would move the account out of the OU, potentially detaching it from the current SCPs applied to the OU. However, this doesn't necessarily resolve the problem, as the SCPs applied at the account level would need to be modified separately. - This is more of a restructuring action, which does not directl...

Author: Leah · Last updated Jul 6, 2026

A company currently stores 5 TB of data in on-premises block storage systems. The company's current storage solution provides limited space for additional data. The company runs applications on premises that must be able to retrieve frequently accessed data with low latency. The company r...

Let’s evaluate each option based on the following requirements: 1. Cloud-based storage solution. 2. Ability to retrieve frequently accessed data with low latency. 3. Operational efficiency. 4. Current on-premises application integration. Option A: Use Amazon S3 File Gateway. Integrate S3 File Gateway with the on-premises applications to store and directly retrieve files by using the SMB file system. - Pros: - File-Based Access: S3 File Gateway allows on-premises applications to access cloud storage like local files using the SMB or NFS protocol, which makes it compatible with existing applications that require file-based access. - Cloud Storage: Data is stored in Amazon S3, which is a scalable, durable, and cost-effective cloud storage service. - Efficient Integration: With this solution, the company can integrate with existing applications that require low-latency access to frequently used files. - Cons: - Latency Considerations: S3 File Gateway works well for most use cases, but for very low-latency, high-performance access to block storage (like traditional disk-based storage), it may introduce some slight latency, especially for frequent data retrieval at very high speeds. - Conclusion: This option is a great fit for scenarios where the applications can access file-based storage and where data retrieval latency requirements are moderate. It's operationally efficient, as it seamlessly integrates with on-premises applications while providing cloud-based storage. Option B: Use an AWS Storage Gateway Volume Gateway with cached volumes as iSCSI targets. - Pros: - Cached Volumes: With cached volumes, frequently accessed data is stored on-premises, while the bulk of the data is stored in Amazon S3. This ensures low-latency access to frequently used data. - iSCSI Integration: Volume Gateway integrates with on-premises applications using the iSCSI protocol, which is widely supported by many applications. - Cons: - Operational Complexity: The setup can be more complex than the S3 File Gateway, and requires ensuring that the on-premises cache is appropriately sized and managed. - Storage Cost: Storing a portion of data locally can incur additional costs for local storage hardware and management. - Latency: While cached volumes provide low-latency access to frequently accessed data, for applications requiring high throughput and very low latency, the local cache may still be limiting. - Conclusion: This option works well for situations where most data can be offloaded to the cloud, but some data needs to be readily available on-premises. However, it r...

Author: Layla · Last updated Jul 12, 2026

A company has a monolithic application that is critical to the company's business. The company hosts the application on an Amazon EC2 instance that runs Amazon Linux 2. The company's application team receives a directive from the legal department to back up the data from the instance's encrypted Amazon Elastic Block Store (Amazon EBS) volume to an Amazon S3 bucket. The application t...

The company needs to back up data from an Amazon EC2 instance with an encrypted Amazon Elastic Block Store (EBS) volume to an Amazon S3 bucket, but they do not have SSH access to the instance. Additionally, the application must remain operational while the backup process takes place. Let's evaluate the provided solutions. Option Evaluation: A) Attach a role to the instance with permission to write to Amazon S3. Use the AWS Systems Manager Session Manager option to gain access to the instance and run commands to copy data into Amazon S3. - Explanation: AWS Systems Manager Session Manager allows secure access to EC2 instances without requiring SSH access. This can be used to run commands directly on the EC2 instance, even if SSH keys are not available. Attaching a role with the required S3 permissions would enable the instance to write data to an S3 bucket. This solution allows for direct interaction with the instance without disrupting the application and provides the necessary backup functionality. - Why it’s selected: This option meets all the requirements: it provides access to the EC2 instance without SSH, allows data to be backed up to Amazon S3, and keeps the application running. Additionally, no new instances or images need to be created, minimizing complexity. B) Create an image of the instance with the reboot option turned on. Launch a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3. - Explanation: This solution involves creating an AMI (Amazon Machine Image) of the instance and then launching a new EC2 instance. The new instance is then used to copy data to Amazon S3. However, the application would likely experience downtime during the reboot and image creation process, which is a significant drawback when the application must remain operational. Additionally, it adds the overhead of managing a new instance and ensuring that the application is correctly restored on the new ins...

Author: Elijah · Last updated Jul 6, 2026

A solutions architect needs to copy data from an Amazon S3 bucket m an AWS account to a new S3 bucket in a new AWS account. The solutions architect must implement a solution that uses the AWS ...

To successfully copy data from an S3 bucket in one AWS account to a new S3 bucket in another AWS account using the AWS CLI, the correct solution should involve proper access permissions and using the AWS CLI `s3 sync` command to transfer data between the two buckets. Let's break down and evaluate each option: Option Evaluation: A) Create a bucket policy to allow the source bucket to list its contents and to put objects and set object ACLs in the destination bucket. Attach the bucket policy to the destination bucket. - Explanation: While it's necessary for the destination bucket to allow writing objects, the source bucket should allow the proper permissions to list and read objects, not the destination. The destination bucket policy should permit writing objects but does not necessarily need to allow listing the source bucket’s contents. This option doesn't fully cover the required permissions. - Why it's rejected: It incorrectly focuses on the destination bucket and doesn't address the key permissions needed on the source bucket for reading its contents. B) Create a bucket policy to allow a user in the destination account to list the source bucket’s contents and read the source bucket’s objects. Attach the bucket policy to the source bucket. - Explanation: This is a valid option because it grants the necessary permissions on the source bucket for the destination account user to list its contents and read its objects. However, this alone doesn't address the need for the destination bucket to accept the copied data. - Why it's rejected: While the permissions on the source bucket are correct, the destination bucket also needs specific permissions to allow writing data to it. C) Create an IAM policy in the source account. Configure the policy to allow a user in the source account to list contents and get objects in the source bucket, and to list contents, put objects, and set object ACLs in the destination bucket. Attach the policy to the user. - Explanation: This option suggests an IAM policy that grants permissions to both the source and destination buckets, which is generally good. However, this policy is more relevant if you are trying to execute the operation from a user in the source account. The main requirement here is to copy data from the source to the destination, which typically involves a user in the destination account running the operation. - Why it's rejected: This option suggests an overly broad IAM policy applied to a user in the source account, which isn't ideal for the intended operation of copying data from the source to the destination account. D) Cr...

Author: Ella · Last updated Jul 6, 2026

A company operates a food delivery service. Because of recent growth, the company's order processing system is experiencing scaling problems during peak traffic hours. The current architecture includes Amazon EC2 instances in an Auto Scaling group that collect orders from an application. A second group of EC2 instances in an Auto Scaling group fulfills the orders. The order collection process occurs quickly, but the order fulfillment process can take longer. Data must not be lost because of a sca...

Let's evaluate each option and identify which one best addresses the scaling issue while ensuring that data isn't lost during scaling events. Option A: Use Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure each Auto Scaling group's minimum capacity to meet its peak workload value. - Pros: This option ensures that the Auto Scaling groups can handle peak workloads by adjusting the minimum capacity. - Cons: While setting the minimum capacity can handle peak traffic, it doesn't address the key issue: order fulfillment may take longer, and scaling based on CPU utilization may not necessarily align with how long the order fulfillment process takes. There could still be delays or bottlenecks if the fulfillment instances are overloaded. - Why Rejected: Scaling based purely on CPU utilization doesn't account for the varying load on the order fulfillment system, which may not directly correlate with CPU usage. It also doesn't provide the necessary mechanism to handle asynchronous processing of orders. Option B: Use Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure a CloudWatch alarm to invoke an Amazon Simple Notification Service (Amazon SNS) topic to create additional Auto Scaling groups on demand. - Pros: This option uses CloudWatch to monitor instance performance and Auto Scaling to respond automatically to changes in workload. - Cons: Similar to Option A, scaling based on CPU utilization doesn't consider the fact that order fulfillment can take longer than order collection. Also, this approach doesn't provide a mechanism to ensure that data is not lost, especially in the case of sudden scaling events. - Why Rejected: The reliance on CPU utilization as a scaling metric does not optimally address the issue of asynchronous order processing. Furthermore, using SNS and creating additional Auto Scaling groups on demand could lead to unnecessary complexity and does not directly solve the problem of scaling based on order queue size. Option C: Provision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective q...

Author: Harper · Last updated Jul 12, 2026

An online gaming company is transitioning user data storage to Amazon DynamoDB to support the company's growing user base. The current architecture includes DynamoDB tables that contain user profiles, achievements, and in-game transactions. The company needs to design a robust, continuously available, and resilient Dyna...

To evaluate the best option for ensuring a robust, continuously available, and resilient DynamoDB architecture while maintaining cost-effectiveness, let's review each option carefully. Option A: Create DynamoDB tables in a single AWS Region. Use on-demand capacity mode. Use global tables to replicate data across multiple Regions. - Pros: - On-demand capacity mode is cost-effective for unpredictable workloads, as it automatically adjusts to traffic. - Global tables provide cross-region replication, which ensures data is available in multiple regions for resilience and high availability. - Cons: - Using global tables across regions could increase costs, particularly if the replication traffic between regions is high. - If the company's user base spans globally, a single-region approach (for the main data) may still risk downtime in the event of a region failure. - Why Rejected: Although global tables provide cross-region replication, having a single region for your core data storage doesn't fully leverage the resilience of a multi-region design. Additionally, using on-demand capacity may not be as cost-efficient for high-volume, predictable workloads. Option B: Use DynamoDB Accelerator (DAX) to cache frequently accessed data. Deploy tables in a single AWS Region and enable auto scaling. Configure Cross-Region Replication manually to additional Regions. - Pros: - DAX can improve read performance significantly by caching frequently accessed data. - Auto scaling ensures that the capacity adjusts based on demand. - Cons: - Cross-Region replication must be manually configured, which adds complexity and potential maintenance overhead. - Single-region deployment still introduces a potential single point of failure, and manual replication between regions isn't as streamlined or reliable as global tables. - Why Rejected: While DAX improves read performance, the manual configuration of Cross-Region replication makes this option less resilient and more complex compared to automatic solutions like global tables. Also, a single-region deployment still carries risks of downtime. Option C: Create DynamoDB tables in multiple AWS Regions. Use on-demand capacity mode. Use DynamoDB Streams for Cross-Region Replica...

Author: Leo · Last updated Jul 12, 2026

A company built an application based on AWS Lambda deployed in an AWS CloudFormation stack. The last production release of the web application introduced an issue that resulted in an outage lasting several minutes. A solutions architect must a...

A canary release is a technique used to minimize the impact of new code deployments by gradually rolling out changes to a small subset of users first, and then progressively increasing the percentage of users exposed to the new version if no issues are detected. This is particularly useful for applications built with AWS Lambda, as it can help prevent large-scale outages in case of bugs or misconfigurations in the new release. Let's break down each option to find the best solution for implementing a canary release with AWS Lambda: Option Evaluation: A) Create an alias for every new deployed version of the Lambda function. Use the AWS CLI `update-alias` command with the `routing-config` parameter to distribute the load. - Explanation: This option leverages AWS Lambda aliases to manage different versions of a function. Aliases are pointers to specific Lambda function versions, and the `routing-config` parameter allows the routing of a percentage of traffic to one version (the canary release) while the rest of the traffic is routed to the stable version. This setup enables a gradual rollout of the new version. - Why it's selected: This option directly supports the canary release methodology using AWS Lambda aliases and routing configuration. It allows for traffic to be split between different versions of the Lambda function, which is the essence of a canary release. B) Deploy the application into a new CloudFormation stack. Use an Amazon Route 53 weighted routing policy to distribute the load. - Explanation: This solution involves creating a new CloudFormation stack and using Route 53 weighted routing to direct traffic. However, Route 53 weighted routing is typically used for distributing traffic across different resources (e.g., EC2 instances, S3 buckets) at the DNS level. While it could distribute load across different stacks, it's not a native or direct solution for managing AWS Lambda versions, and it wouldn't directly solve the problem of implementing a canary release for a Lambda function. - Why it's rejected: This is not the most efficient or appropriate solution for a Lambda function canary release. AWS Lambda aliases are specifically designed to handle version management, and this option adds unnecessary complexity with CloudFormation and Route...

Author: Benjamin · Last updated Jul 6, 2026

A company runs its media rendering application on premises. The company wants to reduce storage costs and has moved all data to Amazon S3. The on-premises rendering application needs low-latency access to storage. The company needs to design a storage solution for the application. The storage solution must...

To determine the most cost-effective storage solution that meets the needs of the media rendering application while ensuring low-latency access and maintaining application performance, let’s evaluate each option in detail. Option A: Use Mountpoint for Amazon S3 to access the data in Amazon S3 for the on-premises application. - Pros: - Mountpoint for Amazon S3 allows applications to access S3 data as if it were a local file system, providing seamless integration. - It provides direct access to the data in S3 without needing additional infrastructure. - Cons: - This solution provides low-latency access only when the S3 data is frequently accessed. However, it may not be as optimized for high-performance, low-latency use cases like media rendering, especially if large files or complex file operations are involved. - Why Rejected: While this method enables direct access to S3, it does not optimize for the specific needs of media rendering applications, which often require faster data retrieval speeds. The latency may still be an issue for demanding performance applications. Option B: Configure an Amazon S3 File Gateway to provide storage for the on-premises application. - Pros: - An Amazon S3 File Gateway enables on-premises applications to access data stored in S3 using a file interface. It acts as a bridge, allowing applications to interact with S3 as if it were a local file server. - It offers low-latency access for read/write operations while maintaining the durability and scalability of S3 storage. - Cons: - While it provides low-latency access to S3, the performance may not be optimal for media rendering applications with intensive I/O needs, especially if the application requires high throughput and low latency for large media files. - Why Rejected: Although the S3 File Gateway is good for accessing S3 from on-premises environments, it may not be the most efficient for high-performance workloads such as media rendering, where a more dedicated file system with optimized performance is needed. Option C: Copy the data from Amazon S3 to Amazon FSx for Windows File Server. Configure an Amazon FSx File Gateway to provide storage for the on-premises application. - Pros: - Amazon FSx for Windows File Server provides high-performance file storage optimized for Windows-based applications, supporting features like SMB protocol, which is often used by media applications. - It allows for lo...

Author: Lina Zhang · Last updated Jul 12, 2026

A finance company hosts a data lake in Amazon S3. The company receives financial data records over SFTP each night from several third parties. The company runs its own SFTP server on an Amazon EC2 instance in a public subnet of a VPC. After the files are uploaded, they are moved to the data lake by a cron job that runs on the same instance. The SFTP server is reachable on ...

To improve the reliability and scalability of the SFTP solution, we need to consider several factors like high availability, automatic scaling, ease of management, and security. Option A: Move the EC2 instance into an Auto Scaling group. Place the EC2 instance behind an Application Load Balancer (ALB). Update the DNS record sftp.example.com in Route 53 to point to the ALB. - Reasoning: While an Auto Scaling group and ALB can provide scalability and load balancing for web traffic, they are not suitable for SFTP. ALBs are primarily designed for HTTP/HTTPS traffic and do not support the SFTP protocol, which relies on TCP. Therefore, this option is not viable for improving the scalability of an SFTP solution. - Rejected because: ALBs don't support TCP-based protocols like SFTP, and SFTP requires direct communication between clients and servers using a TCP connection. Option B: Migrate the SFTP server to AWS Transfer for SFTP. Update the DNS record sftp.example.com in Route 53 to point to the server endpoint hostname. - Reasoning: AWS Transfer for SFTP is a fully managed service designed specifically for securely transferring files over SFTP. It is scalable, highly available, and integrates directly with Amazon S3, which is the destination for the files in the data lake. AWS Transfer for SFTP simplifies management, and scaling is handled automatically by AWS. Additionally, security is improved as the service manages user authentication and encryption. - Selected because: This solution addresses scalability, reliability, and ease of management. It eliminates the need for manual intervention (such as cron jobs), improves fault tolerance, and ensures a seamless integration with Amazon S3, which is critical for ...

Author: Suresh · Last updated Jul 6, 2026

A company wants to migrate an application to Amazon EC2 from VMware Infrastructure that runs in an on-premises data center. A solutions architect must preserve the software and configuration settings dur...

To migrate an application from an on-premises VMware Infrastructure to Amazon EC2 while preserving the software and configuration settings, it is important to choose an approach that effectively handles both the transfer of the virtual machine (VM) image and its configuration. Let’s evaluate each option: Option A: Configure the AWS DataSync agent to start replicating the data store to Amazon FSx for Windows File Server. Use the SMB share to host the VMware data store. Use VM Import/Export to move the VMs to Amazon EC2. - Reasoning: DataSync is a service for transferring data, but it is primarily designed for moving large amounts of data between on-premises storage and AWS, and not specifically for migrating VMs. Using it to replicate a VMware datastore to Amazon FSx would not preserve the VMware VM configuration or system settings. VM Import/Export would be a better approach for converting VMware VMs to EC2, but DataSync does not address the preservation of VM images. - Rejected because: DataSync is not intended for VM migration, and using it with FSx adds unnecessary complexity without directly solving the VM migration and configuration preservation issue. Option B: Use the VMware vSphere client to export the application as an image in Open Virtualization Format (OVF) format. Create an Amazon S3 bucket to store the image in the destination AWS Region. Create and apply an IAM role for VM Import. Use the AWS CLI to run the EC2 import command. - Reasoning: This is a valid and commonly used method for migrating VMware VMs to EC2. The OVF format can encapsulate the VM image, and using VM Import/Export allows you to transfer the VM image into Amazon EC2. It preserves the configuration settings and software of the VM, making it suitable for the use case. The IAM role for VM Import ensures proper permissions for the migration process. - Selected because: This option effectively handles both the VM migration and the preservation of its configuration, and it is a well-established method for moving VMware VMs to EC2. Option C: Configure AWS Storage Gateway for file service to export a Common Internet...

Author: Ethan Smith · Last updated Jul 6, 2026

A company hosts its enterprise resource planning (ERP) system in the us-east-1 Region. The system runs on Amazon EC2 instances. Customers use a public API that is hosted on the EC2 instances to exchange information with the ERP system. International customers report slow API response times ...

To address the issue of slow API response times for international customers, we need a solution that improves global latency and is cost-effective. Let's evaluate each option: Option A: Create an AWS Direct Connect connection that has a public virtual interface (VIF) to provide connectivity from each customer's data center to us-east-1. Route customer API requests by using a Direct Connect gateway to the ERP system API. - Pros: - Direct Connect provides a high-performance and dedicated connection between the customer's data center and AWS, offering low latency and reliable network performance. - It would bypass the public internet, reducing latency and improving the overall speed. - Cons: - Direct Connect is expensive to set up and maintain, especially for international customers. It requires physical connections and infrastructure, making it less cost-effective for a global user base. - It doesn't inherently optimize for global API response times as it's more suited for enterprise-level, high-throughput requirements. - Why Rejected: While Direct Connect can improve performance, it's costly, especially for international customers. It also requires infrastructure setup, which is not ideal for a cost-effective solution for improving API response times globally. Option B: Set up an Amazon CloudFront distribution in front of the API. Configure the CachingOptimized managed cache policy to provide improved cache efficiency. - Pros: - Amazon CloudFront is a Content Delivery Network (CDN) designed to improve the speed of content delivery globally by caching content at edge locations near customers. - It helps reduce latency for API responses, especially for static content or data that doesn’t change frequently. - It is highly cost-effective because CloudFront uses a pay-as-you-go pricing model and leverages AWS's global edge locations. - Cons: - CloudFront is best suited for caching content. If the API involves dynamic data that changes frequently, caching may not be as effective because CloudFront caches based on HTTP headers and may not cache dynamic content well. - Why Rejected: While CloudFront improves the performance of static content, it may not be the best solution for APIs with dynamic or real-time data that changes frequently. However, it could still be considered if the API responses are relatively cacheable. Option C: Set...

Author: Amira · Last updated Jul 12, 2026

A video processing company has an application that downloads images from an Amazon S3 bucket, processes the images, stores a transformed image in a second S3 bucket, and updates metadata about the image in an Amazon DynamoDB table. The application is written in Node.js and runs by using an AWS Lambda function. The Lambda function is invoked when a new image is uploaded to Amazon S3. The application ran without incident for a while. However, the size of the images has grown significantly. The Lambda function is now failing frequently with timeout errors. The function timeout is set to its maximum value. A solution...

To refactor the architecture of the application to address Lambda function timeouts while still meeting the requirement of not managing underlying infrastructure, the solutions architect should focus on addressing the Lambda timeout issue while ensuring that the application is scalable and efficient. Let's evaluate the options one by one: Option A: Modify the application deployment by building a Docker image that contains the application code. Publish the image to Amazon Elastic Container Registry (Amazon ECR). - Reasoning: While this option prepares the application code in a container format and uploads it to Amazon ECR, it doesn't inherently address the timeout issue with Lambda. Building a Docker image and storing it in ECR would only be useful if the application were going to be deployed in a containerized environment like Amazon ECS or AWS Fargate, which are better suited for handling longer-running or resource-intensive tasks. - Rejected because: This step alone doesn't solve the core problem, which is the Lambda timeout caused by large image processing. Option B: Create a new Amazon Elastic Container Service (Amazon ECS) task definition with a compatibility type of AWS Fargate. Configure the task definition to use the new image in Amazon Elastic Container Registry (Amazon ECR). Adjust the Lambda function to invoke an ECS task by using the ECS task definition when a new file arrives in Amazon S3. - Reasoning: This option addresses the problem by shifting from Lambda to Amazon ECS with AWS Fargate. Fargate allows for longer-running tasks and more computing resources, which would solve the Lambda timeout issue for image processing. ECS tasks with Fargate are fully managed and do not require infrastructure management, which meets the requirement of not managing underlying infrastructure. - Selected because: AWS Fargate provides an ideal solution for handling longer-running tasks that Lambda cannot process due to time limits, while maintaining the "serverless" characteristic by removing the need to manage infrastructure. Option C: Create an AWS Step Functions state machine with a Parallel state to invoke the Lambda function. Increase the provisioned concurrency of the Lambda function. - Reasoning: While AWS Step Functions with a Parallel state could be useful for orchestrating multiple tasks, it doesn't directly solve the issue of Lambda timeouts caused by the increasing image sizes. Increasing the provisioned concurrency of the Lambda function won't p...

Author: Emma · Last updated Jul 6, 2026

A company tracks customer satisfaction by using surveys that the company hosts on its website. The surveys sometimes reach thousands of customers every hour. Survey results are currently sent in email messages to the company so company employees can manually review results and assess customer sentiment. The company wants to automate the customer...

To address the company's need to automate the survey process, provide scalable sentiment analysis, and ensure that survey results are available for the previous 12 months, let's evaluate each option based on scalability, cost-effectiveness, and data retention. Option A: Send the survey results data to an Amazon API Gateway endpoint that is connected to an Amazon Simple Queue Service (Amazon SQS) queue. Create an AWS Lambda function to poll the SQS queue, call Amazon Comprehend for sentiment analysis, and save the results to an Amazon DynamoDB table. Set the TTL for all records to 365 days in the future. - Pros: - Using Amazon SQS to queue survey data ensures reliable message delivery, as SQS decouples the data ingestion process from processing. - AWS Lambda provides a serverless compute solution that can automatically scale to handle the volume of incoming data. - Amazon Comprehend is a powerful service for sentiment analysis, which can be integrated easily. - DynamoDB is a scalable, managed database that handles large amounts of data and supports TTL (time-to-live) for automatic data expiration, ensuring data is stored only for 12 months. - Cons: - While scalable, this solution involves multiple AWS services (SQS, Lambda, Comprehend, and DynamoDB), which might increase complexity and operational overhead for monitoring and debugging. - Why Chosen: This option is highly scalable and cost-effective, as AWS Lambda scales automatically based on the number of incoming survey results, and SQS can handle high throughput. The TTL setting on DynamoDB is convenient for automatic data expiration after 12 months. Option B: Send the survey results data to an API that is running on an Amazon EC2 instance. Configure the API to store the survey results as a new record in an Amazon DynamoDB table, call Amazon Comprehend for sentiment analysis, and save the results in a second DynamoDB table. Set the TTL for all records to 365 days in the future. - Pros: - EC2 provides more control over the application hosting and processing logic. - Amazon Comprehend is integrated for sentiment analysis, and DynamoDB handles storage and TTL. - Cons: - EC2 introduces additional complexity and operational overhead, such as maintaining the instance, handling scaling, and ensuring fault tolerance. - Unlike Lambda, EC2 does not scale automatically, so managing a large number of incoming survey results would require manual intervention to scale EC2 instances, leading to potential cost inefficiencies. - This setup is less serverless and requires more management than the serverless approach in Option A. - Why Rejected: Using EC2 adds unnecessary complexity and does not provide the same scalability as serverless options. It requires more maintenance and...

Author: Emma · Last updated Jul 12, 2026

A company uses AWS Systems Manager for routine management and patching of Amazon EC2 instances. The EC2 instances are in an IP address type target group behind an Application Load Balancer (ALB). New security protocols require the company to remove EC2 instances from service during a patch. When the company attempts to follow the security protocol...

In this scenario, the company needs to patch EC2 instances that are in an IP address type target group behind an Application Load Balancer (ALB), while ensuring the instances are properly removed from service during the patching process. Let's evaluate the options provided to resolve the errors: A) Change the target type of the target group from IP address type to instance type. - Reasoning: This option changes the target type of the ALB target group to "instance" instead of using IP addresses. However, this might not be the best option because the issue described is with the patching process and managing the instances during the patch, not with the type of target. Changing the target type can introduce unnecessary complexity without addressing the core problem of removing instances during patching. - Rejection: This does not directly address the issue at hand, which is related to the patching process. B) Continue to use the existing Systems Manager document without changes because it is already optimized to handle instances that are in an IP address type target group behind an ALB. - Reasoning: While the existing Systems Manager document might work for some patching scenarios, it does not address the specific need to remove instances from service during the patching process, which is required by the new security protocols. The error likely occurs because the current Systems Manager document does not handle the required steps for managing the target group during patching. - Rejection: This solution does not resolve the issue of instance removal during patching, which is why it’s not effective. C) Implement the AWSEC2-PatchLoadBalancerInstance Systems Manager Automation document to manage the patching process. - Reasoning: The AWSEC2-PatchLoadBalancerInstance document is designed specifically to manage the patching of EC2 instances that are part of an ALB target group. It automates the process of safely removing instances from the target group...

Author: Samuel · Last updated Jul 12, 2026

A company has an organization in AWS Organizations. The company is using AWS Control Tower to deploy a landing zone for the organization. The company wants to implement governance and policy enforcement. The company must implement a policy that will detect Amazon RDS DB i...

To address the requirement of detecting Amazon RDS DB instances that are not encrypted at rest within the company’s production OU, let's evaluate the available options based on the solution’s ability to enforce governance and detect non-compliance with encryption policies. Option A: Turn on mandatory guardrails in AWS Control Tower. Apply the mandatory guardrails to the production OU. - Reasoning: - Mandatory guardrails in AWS Control Tower are designed to enforce security, compliance, and operational best practices. These guardrails can apply to specific actions that are critical to governance in your environment. - However, mandatory guardrails don’t specifically focus on detecting whether Amazon RDS DB instances are encrypted. They typically handle higher-level compliance controls (e.g., preventing non-compliant configurations), but specific service checks, such as checking RDS encryption status, are generally not covered by mandatory guardrails. - Why it’s rejected: - While mandatory guardrails enforce some security standards, they don’t directly address the detection of RDS encryption status, which is the primary requirement here. This option does not provide the necessary enforcement for the encryption rule. Option B: Enable the appropriate guardrail from the list of strongly recommended guardrails in AWS Control Tower. Apply the guardrail to the production OU. - Reasoning: - Recommended guardrails are designed to offer guidance and best practices for securing your environment, but they aren't mandatory. They are typically advisory rather than enforcement-based. - AWS Control Tower's recommended guardrails may not include a specific check for RDS encryption, making this option less suitable for the company’s requirement to detect unencrypted RDS instances. - Why it’s rejected: - Similar to mandatory guardrails, recommended guardrails in AWS Control Tower might not specifically focus on enforcing RDS encryption at rest. The need here is for a targeted policy that detects the encryption state, which recommended guardrails may not provide. ...

Author: Maya · Last updated Jul 6, 2026

A medical company wants to perform transformations on a large amount of clinical trial data that comes from several customers. The company must extract the data from a relational database that contains the customer data. Then the company will transform the data by using a series of complex rules. The company will load the data to Amazon S3 when the transformations are complete. All data must be encrypted where it is processed before the...

To determine which solution meets the requirements with the least amount of operational effort, let’s carefully evaluate each option based on the company's needs: Key Requirements: 1. Data transformation needs to be done on clinical trial data, which comes from several customers. 2. Encryption is required both during processing and storage. 3. Customer-specific encryption keys are required. 4. Least amount of operational effort is the priority. --- A) Create one AWS Glue job for each customer. Attach a security configuration to each job that uses server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data. - Reasoning: AWS Glue jobs can perform the necessary ETL (Extract, Transform, Load) tasks for large datasets. However, SSE-S3 is Amazon S3-managed encryption and doesn’t allow for customer-specific encryption keys. It uses AWS-managed keys rather than customer-provided keys (AWS KMS), which doesn’t meet the requirement for customer-specific keys. - Rejection: It does not meet the requirement of using customer-specific keys (AWS KMS) for encryption. B) Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses client-side encryption with a custom client-side root key (CSE-Custom) to encrypt the data. - Reasoning: Amazon EMR is a good solution for processing large datasets with complex transformations. Client-side encryption (CSE-Custom) allows encryption before the data is uploaded to Amazon S3. However, managing client-side encryption keys can add significant operational overhead, especially when dealing with large amounts of data and customer-specific keys. The need to manage encryption manually on the client side could introduce complexity and operational overhead. - Rejection: This option involves more operational effort and complexity, especially with managing encryption keys on the client side. C) Create one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS manage...

Author: Alexander · Last updated Jul 12, 2026

A company hosts a website analytics application on a single Amazon EC2 On-Demand Instance. The analytics application is highly resilient and is designed to run in stateless mode. The company notices that the application is showing signs of performance degradation during busy times and is presenting 5xx err...

To address the performance degradation and 5xx errors during busy times, the goal is to scale the website analytics application efficiently and cost-effectively. Let’s evaluate each option: A) Create an Amazon Machine Image (AMI) of the web application. Use the AMI to launch a second EC2 On-Demand Instance. Use an Application Load Balancer to distribute the load across the two EC2 instances. - Reasoning: This solution scales horizontally by adding a second EC2 instance and using an Application Load Balancer (ALB) to distribute traffic. This is a basic scaling solution and can provide immediate scaling during peak loads. However, relying on On-Demand EC2 instances can be costly compared to other options, especially when traffic fluctuates. It may also not handle the scaling needs dynamically as demand increases or decreases. - Rejection: While the solution provides horizontal scaling, the cost may not be optimal since it uses On-Demand EC2 instances. Additionally, this doesn’t include dynamic scaling or cost-saving mechanisms like Spot Instances. B) Create an Amazon Machine Image (AMI) of the web application. Use the AMI to launch a second EC2 On-Demand Instance. Use Amazon Route 53 weighted routing to distribute the load across the two EC2 instances. - Reasoning: This option adds a second EC2 instance like option A, but uses Route 53 weighted routing to distribute traffic. Route 53 can be useful for distributing traffic across different resources, but it is not as efficient or flexible as using an Application Load Balancer (ALB) for dynamic load balancing. This solution lacks the ability to adjust automatically to varying traffic loads and might not perform as efficiently as an ALB. - Rejection: While it introduces weighted routing, Route 53 does not offer the same level of load balancing and auto-scaling features as an ALB, making it less efficient for handling high traffic loads or automatically adjusting to changes in traffic patterns. C) Create an AWS Lambda function to stop the EC2 instance and change the instance type. Create an Amazon CloudWatch alarm to invoke the Lambda function when CPU utilization is more than 75%. - Reasoning: This option suggests using AWS Lambda to adjust the EC2 instance type based on CPU utilization. While scaling the instance type ma...

Author: FrozenWolf2022 · Last updated Jul 12, 2026

A startup company hosts a fleet of Amazon EC2 instances in private subnets using the latest Amazon Linux 2 AMI. The company's engineers rely heavily on SSH access to the instances for troubleshooting. The company's existing architecture includes the following: * A VPC with private and public subnets, and a NAT gateway. * Site-to-Site VPN for connectivity with the on-premises environment. * EC2 security groups with direct SSH access from the on-p...

The company needs to increase security controls around SSH access to its EC2 instances and provide auditing of commands run by engineers. The key requirements are to improve security by controlling SSH access, enhance auditing capabilities, and ensure that the engineering team can still perform necessary troubleshooting tasks. Let's evaluate the options: Option A: Install and configure EC2 Instance Connect on the fleet of EC2 instances. Remove all security group rules attached to EC2 instances that allow inbound TCP on port 22. Advise the engineers to remotely access the instances by using the EC2 Instance Connect CLI. - Reasoning: EC2 Instance Connect allows secure SSH access to EC2 instances without opening port 22 to the public internet. It requires no persistent SSH key management and enhances security. However, it does not directly address auditing the commands run by engineers, which is a critical requirement in this case. - Rejected because: While EC2 Instance Connect provides more secure access by removing open SSH ports, it doesn't offer detailed auditing of commands. The lack of command-level auditing makes this option less ideal for meeting the full requirements. Option B: Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineers' devices. Install the Amazon CloudWatch agent on all EC2 instances and send operating system audit logs to CloudWatch Logs. - Reasoning: This option limits SSH access by allowing only specific IP addresses for the engineers. Installing the CloudWatch agent helps with logging system-level events, which could be useful for some level of auditing. However, this option lacks a built-in mechanism to specifically audit SSH commands (such as which commands the engineers run during their SSH sessions). It's a partial solution for controlling access and logging, but it doesn't fully address the auditing requirement. - Rejected because: While it increases security by limiting access to specific IPs and provides system logs, it doesn't offer detailed SSH session command auditing, which is a critical aspect of the company's needs. Option C: Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineers' devices. Enable AWS Config for EC2 security group resource changes. Enabl...

Author: Ethan · Last updated Jul 6, 2026

A company runs an environment where data is stored in an Amazon S3 bucket. The objects are accessed frequently throughout the day. The company has strict da ta encryption requirements for data that is stored in the S3 bucket. The company currently uses AWS Key Management Service (AWS KMS) for encryption. The company wants to o...

To address the company's requirements of optimizing costs associated with encrypting S3 objects while adhering to strict data encryption requirements using AWS KMS, let's evaluate the available options: A) Use server-side encryption with Amazon S3 managed keys (SSE-S3). - Reasoning: SSE-S3 is a built-in encryption mechanism provided by Amazon S3 where AWS handles the encryption and decryption using keys managed by Amazon. It does not use AWS KMS, so it doesn't meet the requirement of using KMS for encryption. Additionally, SSE-S3 is less customizable than using KMS, and it doesn’t meet the company's strict KMS-based encryption policy. - Rejection: This option doesn't satisfy the requirement for AWS KMS encryption, as it uses Amazon S3 managed keys, not customer-specific keys or KMS keys. B) Use an S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the new objects. - Reasoning: The S3 Bucket Key is a feature that reduces the cost associated with using AWS KMS for server-side encryption. With SSE-KMS, each object is encrypted with a unique key, and the encryption metadata (like the KMS key) is stored alongside the object. By using the S3 Bucket Key, the metadata encryption is simplified and optimized, reducing the number of calls to AWS KMS. This decreases costs associated with KMS calls while still maintaining the required encryption via AWS KMS. - Selected: This solution meets the requirement of using AWS KMS for encryption and optimizes the costs by reducing the number of calls to KMS, making it the most suitable option. C) Use client-side encryption with AWS KMS customer managed keys. - Reasoning: Client...

Author: CrimsonViperX · Last updated Jul 12, 2026

A company that uses AWS Organizations allows developers to experiment on AWS. As part of the landing zone that the company has deployed, developers use their company email address to request an account. The company wants to ensure that developers are not launching costly services or running services unnecessarily. The company mus...

To meet the requirements of providing a fixed monthly budget for developers while ensuring they don't launch costly services or run services unnecessarily, the company needs a combination of strategies for cost control, notification, and enforcement. Let’s evaluate each option and choose the most suitable ones: A) Create an SCP to set a fixed monthly account usage limit. Apply the SCP to the developer accounts. - Rejected: Service Control Policies (SCPs) in AWS Organizations are used to control which AWS services can be accessed across accounts, but they do not provide a mechanism for setting a fixed monthly budget or usage limit. SCPs are focused on permissions rather than cost management, so this would not directly help enforce a budget. B) Use AWS Budgets to create a fixed monthly budget for each developer's account as part of the account creation process. - Selected: AWS Budgets allows setting a specific monthly budget for individual accounts. This helps in tracking the costs incurred by each developer’s account, and can trigger notifications when the budget threshold is crossed. Using AWS Budgets aligns well with the requirement to limit spending and provides the ability to monitor and control costs effectively. C) Create an SCP to deny access to costly services and components. Apply the SCP to the developer accounts. - Rejected: While this can prevent developers from using specific expensive services (e.g., restricting access to EC2, RDS), it does not directly enforce a fixed monthly budget. An SCP is more about restricting access rather than managing costs within a predefined budget. ...

Author: Krishna · Last updated Jul 6, 2026

A company runs multiple workloads on virtual machines (VMs) in an on-premises data center. The company is expanding rapidly. The on-premises data center is not able to scale fast enough to meet business needs. The company wants to migrate the workloads to AWS. The migration is time sensitive. The company wants ...

To meet the company's requirements of migrating workloads to AWS using a lift-and-shift strategy for non-critical workloads, let's break down the steps and evaluate the options based on the migration strategy, time sensitivity, and nature of the workloads. A) Use the AWS Schema Conversion Tool (AWS SCT) to collect data about the VMs. - Reasoning: AWS SCT is primarily used for migrating databases from one platform to another (for example, from Oracle to Amazon RDS or Amazon Aurora). It is not designed for migrating VMs and thus does not support the lift-and-shift migration of VMs. The use case for this tool does not align with the requirements of migrating virtual machines to AWS. - Rejection: AWS SCT is not applicable for VM migrations, so it is not a suitable option. B) Use AWS Application Migration Service. Install the AWS Replication Agent on the VMs. - Reasoning: AWS Application Migration Service (formerly known as Server Migration Service or SMS) is specifically designed for lift-and-shift migrations of on-premises workloads (like VMs) to AWS. This service simplifies and automates the migration process, and installing the AWS Replication Agent on the VMs enables replication of the data and configuration to AWS. This approach is ideal for time-sensitive migrations and is a widely used solution for lifting and shifting VMs to AWS. - Selected: This solution is optimal for the company’s use case and meets the requirement for migrating non-critical workloads to AWS in a time-sensitive manner. C) Complete the initial replication of the VMs. Launch test instances to perform acceptance tests on the VMs. - Reasoning: After using AWS Application Migration Service to replicate the VMs to AWS, it is essential to perform acceptance tests on the migrated instances to ensure they are functioning as expected. This step allows for validation of the migration and checking that the VMs are running properly on AWS before performing the cutover. Since the company is migrating non-critical workloads, testing is essential to avoid unforeseen issues but doesn't need to be as intensive as for critical workloads. - Selected: Testing the migrated instances is a critical step in the lift-and-shift migration process to ensure that the workloads are functioning properly in the AWS environment. D) Stop all operations on the VMs. Launch a cutover in...

Author: StarryEagle42 · Last updated Jul 12, 2026

A company has applications in an AWS account that is named Source. The account is in an organization in AWS Organizations. One of the applications uses AWS Lambda functions and stores inventory data in an Amazon Aurora database. The application deploys the Lambda functions by using a deployment package. The company has configured automated backups for Aurora. The company wants to migrate the Lambda functions and the Aur...

Let's evaluate the options for migrating Lambda functions and Amazon Aurora to a new AWS account named Target, while ensuring minimal downtime. The goal is to migrate the application quickly and efficiently, considering that it processes critical data. Key Considerations: 1. Lambda functions: The migration must allow the functions to be redeployed in the Target account. 2. Amazon Aurora: The Aurora database must be transferred with minimal downtime. Automated backups have been configured, and the database needs to be available in the new account with minimal disruption. 3. Minimizing downtime: Since the application processes critical data, downtime should be minimized, and the solution must allow for smooth transition between accounts without affecting application availability. Option A: Download the Lambda function deployment package from the Source account. Use the deployment package and create new Lambda functions in the Target account. Share the automated Aurora DB cluster snapshot with the Target account. - Reasoning: - Lambda functions: This option allows the deployment package to be transferred and redeployed in the Target account, which is a straightforward solution for migrating Lambda functions. - Aurora database: Sharing the automated Aurora DB cluster snapshot with the Target account allows the database to be restored or used in the Target account. Automated backups are typically used for restoring a database, so this method could be effective in minimizing downtime. - Why it’s selected: This is a viable solution because the database snapshot can be used to restore the Aurora database in the Target account with minimal downtime, and redeploying the Lambda functions from the deployment package ensures they are available in the new account. - Why it’s not rejected: Sharing the snapshot ensures that the Aurora database can be migrated without excessive downtime. This is a widely used method for migrating databases across AWS accounts. Option B: Download the Lambda function deployment package from the Source account. Use the deployment package and create new Lambda functions in the Target account. Share the Aurora DB cluster with the Target account by using AWS Resource Access Manager (AWS RAM). Grant the Target account permission to clone the Aurora DB cluster. - Reasoning: - Lambda functions: Again, this option allows Lambda functions to be redeployed ...

Author: Sofia · Last updated Jul 6, 2026

A company hosts an application in a private subnet. The company has already integrated the application with Amazon Cognito. The company uses an Amazon Cognito user pool to authenticate users. The company needs to modify the application so the application can securely store user document...

To securely integrate Amazon S3 with the application that is hosted in a private subnet and already integrated with Amazon Cognito, the selected options should ensure secure access and control while following AWS best practices for such environments. Let's analyze each option: Option A: Create an Amazon Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in. - Explanation: Amazon Cognito identity pools allow users to authenticate using the credentials from an associated user pool (or external identity providers) and generate temporary security credentials for access to AWS services like S3. This is a secure method to provide users with access to S3 while ensuring that access is controlled and limited based on user roles. - Why selected: This option is directly relevant for providing users with the required temporary access to S3. It leverages Cognito’s integration with AWS IAM to generate and manage the access credentials securely. Option B: Use the existing Amazon Cognito user pool to generate Amazon S3 access tokens for users when they successfully log in. - Explanation: The user pool itself doesn't generate access tokens for direct AWS resource access. The user pool is primarily used for user authentication. For AWS resource access (like S3), the application would need to use an identity pool to get the required AWS credentials. - Why rejected: The user pool does not directly issue AWS credentials (such as access tokens or temporary security credentials for S3 access). Therefore, this approach won’t work for granting secure S3 access directly. Option C: Create an Amazon S3 VPC endpoint in the same VPC where the company hosts the application. - Explanation: An S3 VPC endpoint allows traffic from your VPC to Ama...

Author: Ming88 · Last updated Jul 12, 2026

A company runs a Python script on an Amazon EC2 instance to process data. The script runs every 10 minutes. The script ingests files from an Amazon S3 bucket and processes the files. On average, the script takes approximately 5 minutes to process each file The script will not reprocess a file that the script has already processed. The company reviewed Amazon CloudWatch metrics and noticed that the EC2 instance is idle for approximately 40% of the time because of the file processing...

To meet the company’s goal of making the workload highly available and scalable while reducing long-term management overhead, we need to carefully consider cost-effectiveness, scalability, and the ability to reduce idle time and manageability. Let’s evaluate the options in detail. A) Migrate the data processing script to an AWS Lambda function. Use an S3 event notification to invoke the Lambda function to process the objects when the company uploads the objects. - Selected: This option is highly scalable and cost-effective. AWS Lambda is a fully managed, serverless compute service that can scale automatically in response to events. Since the script processes files that are uploaded to an S3 bucket, using S3 event notifications to invoke Lambda functions is an efficient solution. Lambda will only incur costs while processing files, and it will automatically scale based on the number of files being uploaded, without needing idle resources. Furthermore, it eliminates the need to manage EC2 instances, reducing long-term management overhead. Given that the average file processing time is about 5 minutes, Lambda's execution time fits well within the allowed execution limits. B) Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure Amazon S3 to send event notifications to the SQS queue. Create an EC2 Auto Scaling group with a minimum size of one instance. Update the data processing script to poll the SQS queue. Process the S3 objects that the SQS message identifies. - Rejected: While this option introduces scalability through EC2 Auto Scaling and SQS, it still requires significant management overhead (e.g., managing EC2 instances, scaling policies, and maintaining the EC2 Auto Scaling group). The EC2 instance may still remain idle when the...

Author: Zara · Last updated Jul 6, 2026

A company has a three-tier web application that processes orders from customers. The web tier consists of Amazon EC2 instances behind an Application Load Balancer. The processing tier consists of EC2 instances. The company decoupled the web tier and processing tier by using Amazon Simple Queue Service (Amazon SQS). The storage layer uses Amazon DynamoDB. At peak times, some users report order processing delays and halls. The company has noticed that during these delays, the EC2 instances are r...

To address the performance issue of order processing delays and high CPU utilization in the processing tier, the key consideration is to manage unpredictable peak traffic efficiently by scaling the processing tier dynamically. Let’s review each option: Option A: Use scheduled scaling for Amazon EC2 Auto Scaling to scale out the processing tier instances for the duration of peak usage times. Use the CPU Utilization metric to determine when to scale. - Explanation: Scheduled scaling allows you to define specific times when scaling should occur based on anticipated traffic patterns. Using CPU utilization as a metric would scale the EC2 instances based on the high CPU usage. However, peak usage times are variable and unpredictable, making this approach less flexible and potentially inefficient during unpredictable spikes. - Why rejected: Scheduled scaling relies on predefined schedules, which is unsuitable in this scenario since the peak times are unpredictable. Also, scaling based solely on CPU utilization may not address the issue of the SQS queue filling up. Option B: Use Amazon ElastiCache for Redis in front of the DynamoDB backend tier. Use target utilization as a metric to determine when to scale. - Explanation: ElastiCache for Redis can improve read-heavy workloads by caching frequently accessed data and reducing the load on DynamoDB. However, this solution mainly helps with reducing read traffic to DynamoDB and is not directly related to the issue of SQS queue backlog or EC2 processing delays in the processing tier. - Why rejected: The problem here is related to the processing tier and the backlog in the SQS queue, not DynamoDB's performance. Caching the database won’t ...

Author: Nia · Last updated Jul 12, 2026

A financial services company in North America plans to release a new online web application to its customers on AWS. The company will launch the application in the us-east-1 Region on Amazon EC2 instances. The application must be highly available and must dynamically scale to meet user traffic. The company also wants to implement a disaster...

To meet the requirements of a highly available web application that can dynamically scale and implement a disaster recovery (DR) solution using active-passive failover between two AWS regions (us-east-1 and us-west-1), the solution must focus on regional availability, failover capabilities, and auto-scaling. Let’s evaluate the options based on these factors. A) Create a VPC in us-east-1 and a VPC in us-west-1. Configure VPC peering. In the us-east-1 VPC, create an Application Load Balancer (ALB) that extends across multiple Availability Zones in both VPCs. Create an Auto Scaling group that deploys the EC2 instances across the multiple Availability Zones in both VPCs. Place the Auto Scaling group behind the ALB. - Rejected: This solution uses VPC peering between the regions, but VPC peering is typically designed for connecting VPCs within the same region or for small-scale, private communication between VPCs. In this case, peering VPCs across regions (us-east-1 and us-west-1) and using an ALB across both VPCs isn't a practical and scalable solution. ALBs cannot span multiple regions, and VPC peering does not provide a way to set up failover between regions. This option also lacks a clear disaster recovery setup. B) Create a VPC in us-east-1 and a VPC in us-west-1. In the us-east-1 VPC, create an Application Load Balancer (ALB) that extends across multiple Availability Zones in that VPC. Create an Auto Scaling group that deploys the EC2 instances across the multiple Availability Zones in the us-east-1 VPC. Place the Auto Scaling group behind the ALB. Set up the same configuration in the us-west-1 VPC. Create an Amazon Route 53 hosted zone. Create separate records for each ALB. Enable health checks to ensure high availability between Regions. - Rejected: This solution partially addresses the requirements but still has some issues. While it creates an ALB and an Auto Scaling group in both regions, it lacks a failover mechanism. Although Route 53 can be used for DNS routing and health checks, there’s no clear configuration for managing active-passive failover between the regions. The application will still ...

Author: Ethan · Last updated Jul 6, 2026

A company's production environment consists of Amazon EC2 On-Demand Instances that run constantly between Monday and Saturday. The instances must run for only 12 hours on Sunday and cannot tolerate interruptions. The company wants to cost-op...

In this scenario, the company needs a cost-effective solution for EC2 instances running constantly from Monday to Saturday and only for 12 hours on Sunday, with the added constraint that the Sunday instances cannot tolerate interruptions. Let’s analyze each option in detail: Option A: Purchase Scheduled Reserved Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday. - Explanation: Scheduled Reserved Instances are designed for workloads that have predictable, recurring usage during specific times. This would be a good option for the 12-hour Sunday usage. Standard Reserved Instances are ideal for the constant Monday-Saturday usage as they provide a significant discount over On-Demand Instances for long-term, consistent use. - Why rejected: While this solution is appropriate for the Monday-Saturday instances (Standard Reserved Instances), Scheduled Reserved Instances are not the most cost-effective choice for Sunday, as they require a commitment to specific time slots and might not offer the most flexibility or optimal pricing for the Sunday use case. Option B: Purchase Convertible Reserved Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday. - Explanation: Convertible Reserved Instances allow for the flexibility to change instance types or families over the term of the reservation. While Convertible Reserved Instances are more flexible, they are typically more expensive than Standard Reserved Instances and may not provide the most cost-effective option for the 12-hour Sunday usage. - Why rejected: The use of Convertible Reserved Instances for the Sunday instances is unnecessary, as the company only requires a predictable 12-hour usage window on Sunday, and the flexibility of Convertible Reserved Instances isn't needed in this case. It's not the most ...

Author: RadiantPhoenixX · Last updated Jul 12, 2026

A company has an environment that has a single AWS account. A solutions architect is reviewing the environment to recommend what the company could improve specifically in terms of access to the AWS Management Console. The company's IT support workers currently access the console for administrative tasks, authenticating with named IAM users that have been mapped to their job role. The IT support workers no longer want to maintain both their Active Directory and IAM user accounts. They want to be able to access the console by u...

Requirements: - Access to AWS Management Console: IT support workers should be able to use their existing Active Directory credentials to access the AWS Management Console. - Cost-effective: The solution should not involve excessive overhead or unnecessary features. Key Options Review: Option A: - AWS Organization: The company would create an organization in AWS Organizations and enable IAM Identity Center, which is a good approach for managing users' access centrally. - AWS Managed Microsoft AD: This would involve creating an AWS Managed Microsoft AD with a two-way trust to the on-premises Active Directory. The IAM Identity Center would be configured to use this directory as the identity source. - Cost considerations: AWS Managed Microsoft AD comes with significant costs associated with maintaining a fully managed Active Directory in AWS. While it provides high availability and tight integration with Active Directory, it's not the most cost-effective approach when the requirement is only to authenticate users and connect to AWS. Option B: - AD Connector: AD Connector is a directory service that allows AWS to connect to an existing on-premises Active Directory without the need for a fully managed directory in AWS. - IAM Identity Center configuration: Configuring IAM Identity Center to use AD Connector as the identity source would allow the company to continue using their existing Active Directory setup while leveraging IAM Identity Center...

Author: Victoria · Last updated Jul 6, 2026

A video streaming company recently launched a mobile app for video sharing. The app uploads various files to an Amazon S3 bucket in the us-east-1 Region. The files range in size from 1 GB to 10 GB. Users who access the app from Australia have experienced uploads that take long periods of time. Sometimes the files fail to completely upload for t...

To improve the upload performance for users in Australia, we need to focus on reducing latency and ensuring reliable and fast file transfers. Let's evaluate each option: A) Enable S3 Transfer Acceleration on the S3 bucket. Configure the app to use the Transfer Acceleration endpoint for uploads. - Reasoning: S3 Transfer Acceleration optimizes the upload process by routing the traffic through Amazon CloudFront's globally distributed edge locations. This significantly reduces the time it takes to upload large files to an S3 bucket, especially for users who are geographically distant from the S3 bucket's region (in this case, users in Australia uploading to a bucket in the `us-east-1` region). It accelerates uploads by using the optimized global network of CloudFront. - Why it's selected: This option directly addresses the problem of slow uploads for users in Australia, as it reduces the time it takes to upload large files by using a faster, more efficient route. B) Configure an S3 bucket in each Region to receive the uploads. Use S3 Cross-Region Replication to copy the files to the distribution S3 bucket. - Reasoning: Setting up multiple S3 buckets in different regions and replicating files between them using Cross-Region Replication (CRR) can reduce the upload time for users in specific regions. The app could upload files to an S3 bucket in a nearby region, such as one in Asia or Australia, to improve performance for Australian users. CRR then ensures that the files are replicated to the main distribution bucket in `us-east-1`. - Why it's not selected: While this solution reduces latency by uploading to a geographically closer region, it introduces additional complexity. The setup is more complicated, and it involves more infrastructure, especially with the replication step. It's more efficient to use S3 Transfer Acceleration, which doesn't require as much configuration and provides faster uploads without needing multiple buckets. C) Set up Amazon Route 53 with latency-based routing to route the uploads to the nearest S3 bucket Region. - Reasoning: This would involve setting up multiple S3 buckets in different regions, and using Route 53 to route requests based on latency to direct users to the closest bucket. While this may help reduce latency, it also requires mul...

Author: Amira · Last updated Jul 6, 2026

A digital image processing company wants to migrate its on-premises monolithic application to the AWS Cloud. The company processes thousands of images and generates large files as part of the processing workflow. The company needs a solution to manage the growing number of image processing jobs. The solution must also reduce the manual tasks in the image processing workflow. T...

To meet the company's requirements of managing the growing number of image processing jobs, reducing manual tasks, and avoiding the management of underlying infrastructure, let’s analyze each option: Option A: Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 Spot Instances to process the images. Configure Amazon Simple Queue Service (Amazon SQS) to orchestrate the workflow. Store the processed files in Amazon Elastic File System (Amazon EFS). - Explanation: Amazon ECS with EC2 Spot Instances can be a cost-effective option for processing tasks, and SQS can help manage the job queue. However, managing ECS clusters and configuring Spot Instances would still require some level of operational oversight, even though ECS abstracts much of the underlying infrastructure. Amazon EFS can provide scalable storage for processed files, but it requires ongoing management and configuration. - Why rejected: Although ECS with Spot Instances is a valid option for scaling, it still requires some infrastructure management, such as handling Spot instance interruptions, managing the ECS cluster, and configuring persistent storage. It doesn't provide the least operational overhead compared to other options that are fully managed by AWS. Option B: Use AWS Batch jobs to process the images. Use AWS Step Functions to orchestrate the workflow. Store the processed files in an Amazon S3 bucket. - Explanation: AWS Batch is a fully managed service designed for running batch computing workloads, which is ideal for the company’s image processing jobs. It automatically provisions resources and manages job execution, thus reducing the operational overhead. AWS Step Functions can be used to orchestrate the image processing workflow, and Amazon S3 provides scalable, durable, and cost-effective storage for processed files. - Why selected: AWS Batch is specifically designed for processing large numbers of jobs like the company's image processing tasks, and it abstracts the infrastructure management, which aligns with the requirement of reducing manual tasks. Using S3 as the storage solution makes it easy to scale without worrying about infrastructure management....

Author: Vivaan · Last updated Jul 12, 2026

A company's image-hosting website gives users around the world the ability to up load, view, and download images from their mobile devices. The company currently hosts the static website in an Amazon S3 bucket. Because of the website's growing popularity, the website's performance has decreased. Users have reported latency issues when they upload and downl...

To address the performance issues with the image-hosting website and improve upload and download speeds with minimal implementation effort, we need to focus on optimizing content delivery and reducing latency. Let’s break down each option: Option A: Configure an Amazon CloudFront distribution for the S3 bucket to improve the download performance. Enable S3 Transfer Acceleration to improve the upload performance. - Explanation: CloudFront is a Content Delivery Network (CDN) that can cache and serve content closer to users, improving download speeds. S3 Transfer Acceleration uses Amazon CloudFront's edge locations to speed up uploads to the S3 bucket, reducing upload times from anywhere in the world. - Why selected: This is the least complex solution because CloudFront and S3 Transfer Acceleration are easy to implement, especially with an existing S3-hosted website. CloudFront will accelerate download performance, and S3 Transfer Acceleration will speed up upload performance, addressing both latency issues with minimal effort. No major changes to the application are required. Option B: Configure Amazon EC2 instances of the right sizes in multiple AWS Regions. Migrate the application to the EC2 instances. Use an Application Load Balancer to distribute the website traffic equally among the EC2 instances. Configure AWS Global Accelerator to address global demand with low latency. - Explanation: This solution involves moving away from using S3 for static website hosting and migrating to EC2 instances in multiple AWS Regions. While AWS Global Accelerator would improve network performance globally, managing EC2 instances adds complexity, especially when compared to using a fully managed service like CloudFront. The implementation of EC2 instances and load balancers would involve significant effort and maintenance. - Why rejected: This option requires a complete redesign of the application architecture and introduces substantial operational overhead. The company does not need to manage EC2 instances for a simple static website; a more straightforward solution like CloudFront will be more efficient. Option C: Configure an Amazon CloudFront distribution that uses the S3 bucket as an origin to improve ...

Author: Ava · Last updated Jul 12, 2026

An application is using an Amazon RDS for MySQL Multi-AZ DB instance in the us-east-1 Region. After a failover test, the application lost the connections to the database and could not re-establish the connections. After a restart of the application, the application re-established the connections. A solutions architect must implement a solut...

To address the problem where the application loses connections during a failover and cannot re-establish them without a restart, the key issue here is ensuring that the application can recover from a failover without requiring manual intervention (like restarting the application). Let's evaluate each option: A) Create an Amazon Aurora MySQL Serverless v1 DB instance. Migrate the RDS DB instance to the Aurora Serverless v1 DB instance. Update the connection settings in the application to point to the Aurora reader endpoint. - Reasoning: Aurora Serverless v1 is designed for use cases with variable or unpredictable database workloads. It can automatically scale the database based on the demand, but it does not provide high availability with automatic failover in the same way that Multi-AZ deployments for RDS do. Aurora Serverless v1 also has a different architecture and may not fully address the failover issue in a Multi-AZ configuration. Additionally, Aurora Serverless v1 is not as reliable in terms of failover times and would not solve the issue of reconnecting quickly. - Why it's rejected: Aurora Serverless v1 is not an ideal solution for high availability and failover scenarios where constant connections need to be maintained without requiring a restart. B) Create an RDS proxy. Configure the existing RDS endpoint as a target. Update the connection settings in the application to point to the RDS proxy endpoint. - Reasoning: RDS Proxy is a fully managed, highly available database proxy that sits between the application and the database. It allows for better handling of database connections, automatically retrying failed connections during failovers without requiring the application to be restarted. This ensures that the application can continue operating smoothly during failovers, as RDS Proxy manages the connection pooling and re-establishes connections automatically. - Why it's selected: This is the most suitable solution as RDS Proxy helps manage database connections, including during failovers, without requiring a restart of the application. It provides high availability by transparently handling connection retries during failovers, which is exactly what is ...

Author: Benjamin · Last updated Jul 6, 2026

A company runs an application in a private subnet behind an Application Load Balancer (ALB) in a VPC. The VPC has a NAT gateway and an internet gateway. The application calls the Amazon S3 API to store objects. According to the company's security policy, traffic from the ...

To meet the company's requirement of ensuring that traffic from the application does not traverse the internet while storing objects in Amazon S3, we need to choose the most cost-effective solution that doesn't route traffic over the internet. Let's analyze each option based on the requirements: Option A: Configure an S3 interface endpoint. Create a security group that allows outbound traffic to Amazon S3. - S3 Interface Endpoint: This option would create a private connection between your VPC and Amazon S3 using AWS PrivateLink. It ensures that traffic to S3 stays within the AWS network, which aligns with the security policy of not traversing the internet. - Security Group: The security group allows outbound traffic to Amazon S3, ensuring proper routing. However, interface endpoints are typically more expensive because you are billed for data processing through the endpoint. - Cost: Higher due to data processing and endpoint costs. - Why Rejected: While secure, this option incurs higher costs and isn't the most cost-effective solution for S3 access. Option B: Configure an S3 gateway endpoint. Update the VPC route table to use the endpoint. - S3 Gateway Endpoint: This option allows traffic from the VPC to reach Amazon S3 without traversing the internet, using the AWS private network. This is the recommended approach for accessing Amazon S3 securely within a VPC. - Route Table Update: The VPC route table must be updated to route traffic for S3 through the gateway endpoint. This avoids using the NAT gateway or internet gateway for S3 traffic. - Cost: Significantly more cost-effective compared to an interface endpoint, as there are no data processing charges for gateway endpoints. You only pay for the data transferred to/from S3. - Why Selected: This is the most cost-effective solution t...

Author: Ava · Last updated Jul 12, 2026

A company is building a solution in the AWS Cloud. Thousands or devices will connect to the solution and send data. Each device needs to be able to send and receive data in real time over the MQTT protocol. Each device must authenticate by using a u...

To meet the requirements of authenticating thousands of devices using unique X.509 certificates and supporting real-time communication over the MQTT protocol, we need a solution that offers scalability, real-time message delivery, and minimal operational overhead. Let's evaluate each option: A) Set up AWS IoT Core. For each device, create a corresponding Amazon MQ queue and provision a certificate. Connect each device to Amazon MQ. - Reasoning: AWS IoT Core is a managed service designed specifically for IoT devices and supports real-time communication via MQTT. While Amazon MQ can be used for message queuing, it is not optimized for MQTT communication or device management. Using Amazon MQ would add unnecessary complexity for handling real-time device connections and MQTT-specific protocols, and would introduce higher operational overhead for scaling. - Why it's rejected: AWS IoT Core is the more appropriate solution for handling MQTT communication with minimal overhead, whereas Amazon MQ is more suited for message queuing rather than real-time device communication. Therefore, using Amazon MQ in this context is inefficient and more complex than needed. B) Create a Network Load Balancer (NLB) and configure it with an AWS Lambda authorizer. Run an MQTT broker on Amazon EC2 instances in an Auto Scaling group. Set the Auto Scaling group as the target for the NLB. Connect each device to the NLB. - Reasoning: This solution involves using EC2 instances and an MQTT broker, which would require significant manual setup, scaling, and management. Using a Network Load Balancer (NLB) for routing MQTT traffic and an AWS Lambda authorizer for authentication introduces unnecessary complexity. Managing MQTT brokers on EC2 instances also increases operational overhead, as you need to ensure the brokers are highly available, scalable, and properly secured. - Why it's rejected: This solution requires more management effort for scaling, monitoring, and maintaining EC2 instances, making it more operationally intensive compared to a fully managed service like AWS IoT Core. Additionally, Lambda authorizers add complexity when there is a simpler option available in AWS IoT Core for device authentication. C) Set up AWS IoT Core. For each device, create a correspondi...

Author: ShadowWolf101 · Last updated Jul 6, 2026

A company has an application that runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a UI that uses Amazon DynamoDB and data services that use Amazon S3 as part of the application deployment. The company must ensure that the EKS Pods for the UI can access only Amazon DynamoDB and that the EKS Po...

To meet the company's requirement of ensuring that the EKS Pods for the UI can access only Amazon DynamoDB and the EKS Pods for the data services can access only Amazon S3, let's review and analyze the proposed solutions. The goal is to restrict access using AWS Identity and Access Management (IAM) and ensure the proper segregation of duties between services in the EKS cluster. Option A: Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach both IAM policies to the EC2 instance profile. Use role-based access control (RBAC) to control access to Amazon S3 or DynamoDB for the respective EKS Pods. - EC2 Instance Profile: By attaching IAM policies to the EC2 instance profile, this approach grants the EC2 instances in the EKS cluster access to S3 and DynamoDB. However, this means that all Pods running on those EC2 instances inherit these permissions, potentially violating the principle of least privilege. - RBAC Control: While Kubernetes RBAC can manage access to resources within the Kubernetes cluster, it does not natively control AWS service access (S3, DynamoDB). This makes RBAC unsuitable for restricting access to Amazon S3 and DynamoDB. - Why Rejected: This approach grants unnecessary permissions to all Pods on the EC2 instances and relies on Kubernetes RBAC, which cannot restrict access to AWS services like S3 and DynamoDB. This is not a secure or efficient solution. Option B: Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions. Attach the Amazon S3 IAM policy directly to the EKS Pods for the data services and the DynamoDB policy to the EKS Pods for the UI. - IAM Policies Attached to EKS Pods: Attaching IAM policies directly to EKS Pods requires the use of IAM roles for the Pods. While this could work, it would require configuring each Pod individually and managing IAM roles manually for each service, which can quickly become complex and difficult to maintain. - Why Rejected: Although it appears to be a potential solution, managing IAM roles directly for individual Pods is not a scalable or efficient approach for a growing application. It's better to manage access via Kubernetes service accounts. Option C: Create se...

Author: NightmareDragon2025 · Last updated Jul 12, 2026

A company needs to give a globally distributed development team secure access to the company's AWS resources in a way that complies with security policies. The company currently uses an on-premises Active Directory for internal authentication. The company uses AWS Organizations to manage multiple AWS accounts that support multiple projects. The company needs a solution to integrate with the...

To meet the company's requirements for centralized identity management and access control with minimal operational overhead, let’s analyze the provided options. The company needs a solution that integrates with their existing on-premises Active Directory, supports multiple AWS accounts, and provides secure access to AWS resources for a globally distributed development team. Option A: Set up AWS Directory Service to create an AWS managed Microsoft Active Directory on AWS. Establish a trust relationship with the on-premises Active Directory. Use IAM roles that are assigned to Active Directory groups to access AWS resources within the company's AWS accounts. - AWS Managed AD: This option creates an AWS managed Active Directory (AD) that can be connected to on-premises AD using a trust relationship. This solution allows for centralized management of identities and groups. - IAM Role Integration: The company can assign IAM roles to AD groups, allowing access to AWS resources based on group membership. - Complexity: This solution requires significant setup to establish and maintain the trust relationship between on-premises AD and AWS Managed AD. It also requires additional operational overhead for synchronization and maintenance of both AD environments. - Why Rejected: While secure, this approach involves managing two separate Active Directory environments (on-premises and AWS Managed AD), which introduces unnecessary complexity and operational overhead. It also lacks tight integration with other AWS services like IAM Identity Center. Option B: Create an IAM user for each developer. Manually manage permissions for each IAM user based on each user's involvement with each project. Enforce multi-factor authentication (MFA) as an additional layer of security. - IAM Users: This option creates individual IAM users for each developer. Permissions are manually managed for each user, which can become burdensome as the team grows or as developers move between projects. - Operational Overhead: Managing individual IAM users and manually assigning permissions based on project involvement creates significant operational overhead, especially for a globally distributed team. It is also prone to errors and does not scale well with changing team members or projects. - Why Rejected: This approach is highly manual and does not provide centralized identity management, making it difficult to manage access securely at scale. It’s not an efficient or sustainable solution. Option C: Use AD Connector in AWS Directory Service to connect to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Configure permission sets to give each AD group access to specific AWS accounts and resources. - AD Connector: A...

Author: SilverBear · Last updated Jul 12, 2026

A company is developing an application in the AWS Cloud. The application's HTTP API contains critical information that is published in Amazon API Gateway. The critical information must be accessible from only a limited set of trusted IP a...

To meet the requirement of restricting access to an HTTP API in Amazon API Gateway to a limited set of trusted IP addresses, we need to evaluate each of the given solutions based on their suitability for the task. Option A: Set up an API Gateway private integration to restrict access to a predefined set of IP addresses. - Private Integration: While API Gateway private integrations are useful for connecting API Gateway to internal AWS resources (like VPC endpoints), they do not directly control access based on IP addresses. This option focuses on making the API accessible only within a VPC, not restricting access by specific IP addresses. - Why Rejected: This option does not directly address the requirement of limiting access based on trusted IP addresses; it’s more about limiting access within a VPC, which may not fit the exact need of restricting by specific IP ranges. Option B: Create a resource policy for the API that denies access to any IP address that is not specifically allowed. - API Gateway Resource Policy: API Gateway allows you to define a resource policy that controls access to your API based on conditions like source IP addresses. You can specify allowed IP address ranges to restrict access to the API. This solution works effectively for the requirement of limiting access to specific trusted IP addresses. - Granular Control: This option provides a highly flexible and centralized way to control access to the API by IP addresses, and it integrates well with AWS's security model. - Why Selected: This is the most appropriate solution for the given scenario. The API Gateway resource policy allows fine-grained access control, and it's the easiest to configure and manage for IP-based restrictions. Option C: Directly deploy the API in a private subnet. Cr...

Author: ShadowWolf101 · Last updated Jul 12, 2026

A company is running several workloads in a single AWS account. A new company policy states that engineers can provision only approved resources and that engineers must use AWS CloudFormation to provision these resources. A solutions architect needs to create a solution to enforce the new re...

Requirements: - Enforcing approved resources: Engineers should only be able to provision approved resources using AWS CloudFormation. - Restriction through IAM role: The restriction should be applied to the IAM role the engineers use to access AWS. Key Options Review: Option A: - S3 and CloudFormation Permissions: This option allows engineers to access Amazon S3 and AWS CloudFormation but does not specifically limit which resources can be provisioned. - Problem: The engineers would still be able to deploy any CloudFormation stack, including unapproved resources, as there is no mechanism to restrict the resource types or configurations. Simply allowing CloudFormation and S3 access does not enforce the company’s policy of only approved resources. Option B: - IAM Policy for CloudFormation and Approved Resources: This approach restricts the engineers’ IAM policy to allow only CloudFormation actions and provisioning of approved resources. - Benefit: This approach ensures that engineers can only create resources that are explicitly allowed by the IAM policy, which meets the requirement to enforce the restriction. - Reason for rejection of other options: This solution effectively limits access to the desired resources, directly aligning with the co...

Author: Isabella1 · Last updated Jul 6, 2026

A solutions architect is designing the data storage and retrieval architecture for a new application that a company will be launching soon. The application is designed to ingest millions of small records per minute from devices all around the world. Each record is less than 4 KB in size and needs to be stored in a durable location where it can be retrieved with low latency. The data is ephemeral and the company is required to store the data for 120 days only, after which the data can be delet...

Let's evaluate each option based on the key requirements: storing millions of small records, durability, low-latency retrieval, ephemeral data for 120 days, and cost-effectiveness. A) Design the application to store each incoming record as a single .csv file in an Amazon S3 bucket to allow for indexed retrieval. Configure a lifecycle policy to delete data older than 120 days. - Reasoning: Storing each incoming record as a single .csv file in an S3 bucket is inefficient because S3 objects are typically optimized for larger files. Storing millions of small records as individual files would result in a large number of small objects in S3, leading to high overhead for both storage and retrieval. Although S3 offers lifecycle policies to delete objects after 120 days, managing millions of small files in this way would be cumbersome and inefficient. - Why it's rejected: This approach is not ideal for small records because it will incur excessive overhead in terms of file management and retrieval performance. S3 is not designed for high-frequency, low-latency access to small objects. B) Design the application to store each incoming record in an Amazon DynamoDB table properly configured for the scale. Configure the DynamoDB Time to Live (TTL) feature to delete records older than 120 days. - Reasoning: Amazon DynamoDB is designed for high throughput and low-latency access to individual records, which makes it a good option for this use case. With DynamoDB, the records can be stored and retrieved quickly, and the TTL feature can automatically delete data after 120 days. DynamoDB can scale horizontally to handle the millions of small records being ingested. The cost of DynamoDB can be higher than alternatives like S3, but it offers lower-latency access to individual records, which may be important if quick retrieval is needed. - Why it’s selected: This is a very cost-effective and scalable solution, especially if low-latency access is required. The TTL feature automates the deletion of data, which aligns with the ephemeral nature of the data. However, DynamoDB could become expensive if there are high read/write throughput requirements, but in this case, the requirements suggest a balanced approach that DynamoDB can support efficiently. C) Design the application to store each incoming record ...

Author: Elizabeth · Last updated Jul 6, 2026

A retail company is hosting an ecommerce website on AWS across multiple AWS Regions. The company wants the website to be operational at all times for online purchases. The website stores data in an Amazon RDS for ...

To determine the best option for achieving the highest availability for the database in this multi-region setup, let's evaluate each option based on key factors such as availability, durability, latency, and ease of recovery. Option A: Configure automated backups on Amazon RDS. In the case of disruption, promote an automated backup to be a standalone DB instance. Direct database traffic to the promoted DB instance. Create a replacement read replica that has the promoted DB instance as its source. - Reasoning: Automated backups provide a snapshot-based recovery option, which is not ideal for achieving high availability. While promoting a backup to a DB instance works in recovery scenarios, it introduces significant downtime since the recovery process can take some time (from hours to minutes, depending on backup size). Additionally, there is no cross-region failover to ensure low-latency access across regions. This option relies on manual intervention or additional automation for traffic redirection, but it doesn’t guarantee immediate recovery or real-time failover, which impacts high availability. - Why rejected: This solution does not provide high availability because of its reliance on backup and recovery, which involves downtime. Option B: Configure global tables and read replicas on Amazon RDS. Activate the cross-Region scope. In the case of disruption, use AWS Lambda to copy the read replicas from one Region to another Region. - Reasoning: Global tables are a feature of Amazon DynamoDB, not Amazon RDS. RDS doesn't support global tables. Therefore, while cross-region read replicas in RDS are possible, the inclusion of global tables in this option is technically incorrect. - Why rejected: The presence of global tables (a DynamoDB feature) renders this solution incompatible with Amazon RDS, makin...

Author: FlamePhoenix2025 · Last updated Jul 6, 2026

Example Corp. has an on-premises data center and a VPC named VPC A in the Example Corp. AWS account. The on-premises network connects to VPC A through an AWS Site-To-Site VPN. The on-premises servers can properly access VPC A. Example Corp. just acquired AnyCompany, which has a VPC named VPC B. There is no IP address overlap among these networks. Example Corp. has peered VPC A and VPC B. Example Corp. wants to connect from...

Let's break down each option and evaluate it based on operational effort, network topology, and ease of implementation to achieve the goal of connecting on-premises servers to VPC B with the least operational effort. Option A: Create a transit gateway. Attach the Site-to-Site VPN, VPC A, and VPC B to the transit gateway. Update the transit gateway route tables for all networks to add IP range routes for all other networks. - Reasoning: A transit gateway is a highly scalable and centralized hub for connecting multiple networks, including VPCs and on-premises networks. By attaching both VPC A and VPC B to the transit gateway along with the Site-to-Site VPN, traffic between the on-premises network, VPC A, and VPC B can be routed through the transit gateway. This option requires updating the route tables in the transit gateway to ensure all networks know how to reach each other. This solution is efficient and centralizes routing, reducing complexity and manual configuration. - Why selected: Transit Gateway provides a streamlined and scalable approach with the least manual effort required. It automatically handles routing between the VPN and VPCs, significantly reducing operational overhead compared to other methods. Option B: Create a transit gateway. Create a Site-to-Site VPN connection between the on-premises network and VPC B, and connect the VPN connection to the transit gateway. Add a route to direct traffic to the peered VPCs, and add an authorization rule to give clients access to the VPCs A and B. - Reasoning: This option proposes adding a separate Site-to-Site VPN directly between the on-premises network and VPC B, which would involve additional configuration for the VPN connection, authorization rules, and routing. While it utilizes a transit gateway, the introduction of a second VPN connection adds complexity to the setup and operations. - Why rejected: While this option can work, it introduces more manual setup (additional VPN) and configuration complexity (authorization rules and multiple VPN connections...

Author: Liam · Last updated Jul 6, 2026

A company recently completed the migration from an on-premises data center to the AWS Cloud by using a replatforming strategy. One of the migrated servers is running a legacy Simple Mail Transfer Protocol (SMTP) service that a critical application relies upon. The application sends outbound email messages to the company's customers. The legacy SMTP server does not support TLS encryption and uses TCP port 25. The application can use SMTP only. The company decides to use Amazon Simple Email Service (Amazon SES) and to ...

To modify the application to send email messages from Amazon Simple Email Service (Amazon SES), it’s important to consider the method of email delivery, compatibility with the existing application setup, and the best practices for authentication and authorization in AWS. Option A: Configure the application to connect to Amazon SES by using TLS Wrapper. Create an IAM role that has `ses:SendEmail` and `ses:SendRawEmail` permissions. Attach the IAM role to an Amazon EC2 instance. - Reasoning: TLS Wrapper is not a typical solution for SMTP integration with Amazon SES. Although it might allow the application to connect securely to SES, it's not the standard or most direct approach for integrating SMTP with SES. Moreover, the use of an IAM role for this purpose isn't fully relevant since SMTP authentication typically involves specific SMTP credentials. - Why rejected: This option involves unnecessary complexity and does not directly align with Amazon SES’s standard configurations for SMTP access. It’s not the most efficient or secure method for connecting via SMTP. Option B: Configure the application to connect to Amazon SES by using STARTTLS. Obtain Amazon SES SMTP credentials. Use the credentials to authenticate with Amazon SES. - Reasoning: This is a valid option for applications that still need to use SMTP. Amazon SES supports SMTP access with STARTTLS (a method of upgrading an unencrypted connection to a secure one), which aligns with the application's requirement to send outbound emails using SMTP. To authenticate with SES, the application needs SMTP credentials that are generated in the SES console. This is a direct and compatible way to integrate SES with applications relying on SMTP. - Why selected: STARTTLS and SMTP credentials provide the most straightforward solution for continuing to use the existing SMTP protocol while migrating to Amazon SES. It requires minimal changes to the application and supports the...

Author: Sophia Clark · Last updated Jul 6, 2026

A company recently acquired several other companies. Each company has a separate AWS account with a different billing and reporting method. The acquiring company has consolidated all the accounts into one organization in AWS Organizations. However, the acquiring company has found it difficult to generate a cost report that contains meaningful groups for all the teams. The acquirin...

Let's evaluate each option and determine the best solution to meet the requirements of generating a consolidated cost report that includes meaningful groups for all the companies, and is self-managed by the finance team. Option A: Create an AWS Cost and Usage Report for the organization. Define tags and cost categories in the report. Create a table in Amazon Athena. Create an Amazon QuickSight dataset based on the Athena table. Share the dataset with the finance team. - Reasoning: This solution involves using AWS Cost and Usage Report (CUR) to get detailed usage and cost data for the entire organization. Tags and cost categories can be defined in the CUR to group costs meaningfully across multiple accounts. The CUR data can be stored in an Amazon S3 bucket and queried using Amazon Athena, which enables flexible querying and grouping. Then, an Amazon QuickSight dataset can be created based on the Athena table, which provides easy-to-use data visualization and reporting capabilities. - Why selected: This approach is highly flexible and scalable. The finance team can use QuickSight to create interactive and visual cost reports. Using Athena and QuickSight allows for powerful querying and custom reporting based on organizational structure, tags, and cost categories. Additionally, it is self-managed by the finance team without needing continuous manual intervention. The integration of Athena with QuickSight ensures an easy-to-use reporting environment for non-technical users. Option B: Create an AWS Cost and Usage Report for the organization. Define tags and cost categories in the report. Create a specialized template in AWS Cost Explorer that the finance department will use to build reports. - Reasoning: AWS Cost Explorer allows users to visualize and analyze their costs and usage with pre-built templates or custom reports. It integrates directly with Cost and Usage Reports (CUR) and allows for filtering by tags and cost categories. However, Cost Explorer is more focused on providing basic reporting and analysis, and does not provide the same level of customization and flexibility as using Athena with QuickSight. - Why rejected: While Cost Explorer is a valid ...

Author: Kai99 · Last updated Jul 6, 2026

What Our Friends Say