amazon AWS Certified Solutions Architect - Professional Exam practice test

Last exam update: Nov 18 ,2025
Page 1 out of 38. Viewing questions 1-15 out of 569

Question 1

A company uses a service to collect metadata from applications that the company hosts on premises.
Consumer devices such as TVs and internet radios access the applications. Many older devices do not
support certain HTTP headers and exhibit errors when these headers are present in responses. The
company has configured an on-premises load balancer to remove the unsupported headers from
responses sent to older devices, which the company identified by the User-Agent headers.
The company wants to migrate the service to AWS, adopt serverless technologies, and retain the
ability to support the older devices. The company has already migrated the applications into a set of
AWS Lambda functions.
Which solution will meet these requirements?

  • A. Create an Amazon CloudFront distribution for the metadata service. Create an Application Load Balancer (ALB). Configure the CloudFront distribution to forward requests to the ALB. Configure the ALB to invoke the correct Lambda function for each type of request. Create a CloudFront function to remove the problematic headers based on the value of the User-Agent header.
  • B. Create an Amazon API Gateway REST API for the metadata service. Configure API Gateway to invoke the correct Lambda function for each type of request. Modify the default gateway responses to remove the problematic headers based on the value of the User-Agent header.
  • C. Create an Amazon API Gateway HTTP API for the metadata service. Configure API Gateway to invoke the correct Lambda function for each type of request. Create a response mapping template to remove the problematic headers based on the value of the User-Agent. Associate the response data mapping with the HTTP API.
  • D. Create an Amazon CloudFront distribution for the metadata service. Create an Application Load Balancer (ALB). Configure the CloudFront distribution to forward requests to the ALB. Configure the ALB to invoke the correct Lambda function for each type of request. Create a Lambda@Edge function that will remove the problematic headers in response to viewer requests based on the value of the User-Agent header.
Mark Question:
Answer:

D


Explanation:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-examples.html

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 2

A company is running a traditional web application on Amazon EC2 instances. The company needsto
refactor the application as microservices that run on containers. Separate versions of the application
exist in two distinct environments: production and testing. Load for the application is variable, but
the minimum load and the maximum load are known. A solutions architect needs to design the
updated application with a serverless architecture that minimizes operational complexity.
Which solution will meet these requirements MOST cost-effectively?

  • A. Upload the container images to AWS Lambda as functions. Configure a concurrency limit for the associated Lambda functions to handle the expected peak load. Configure two separate Lambda integrations within Amazon API Gateway: one for production and one for testing.
  • B. Upload the container images to Amazon Elastic Container Registry (Amazon ECR). Configure two auto scaled Amazon Elastic Container Service (Amazon ECS) clusters with the Fargate launch type to handle the expected load. Deploy tasks from the ECR images. Configure two separate Application Load Balancers to direct traffic to the ECS clusters.
  • C. Upload the container images to Amazon Elastic Container Registry (Amazon ECR). Configure two auto scaled Amazon Elastic Kubernetes Service (Amazon EKS) clusters with the Fargate launch type to handle the expected load. Deploy tasks from the ECR images. Configure two separate Application Load Balancers to direct traffic to the EKS clusters.
  • D. Upload the container images to AWS Elastic Beanstalk. In Elastic Beanstalk, create separate environments and deployments for production and testing. Configure two separate Application Load Balancers to direct traffic to the Elastic Beanstalk deployments.
Mark Question:
Answer:

B


Explanation:
minimizes operational + microservices that run on containers = AWS Elastic Beanstalk

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3

A company has a multi-tier web application that runs on a fleet of Amazon EC2 instances behind an
Application Load Balancer (ALB). The instances are in an Auto Scaling group. The ALB and the Auto
Scaling group are replicated in a backup AWS Region. The minimum value and the maximum value
for the Auto Scaling group are set to zero. An Amazon RDS Multi-AZ DB instance stores the
application’s dat
a. The DB instance has a read replica in the backup Region. The application presents an endpoint to
end users by using an Amazon Route 53 record.
The company needs to reduce its RTO to less than 15 minutes by giving the application the ability to
automatically fail over to the backup Region. The company does not have a large enough budget for
an active-active strategy.
What should a solutions architect recommend to meet these requirements?

  • A. Reconfigure the application’s Route 53 record with a latency-based routing policy that load balances traffic between the two ALBs. Create an AWS Lambda function in the backup Region to promote the read replica and modify the Auto Scaling group values. Create an Amazon CloudWatch alarm that is based on the HTTPCode_Target_5XX_Count metric for the ALB in the primary Region. Configure the CloudWatch alarm to invoke the Lambda function.
  • B. Create an AWS Lambda function in the backup Region to promote the read replica and modify the Auto Scaling group values. Configure Route 53 with a health check that monitors the web application and sends an Amazon Simple Notification Service (Amazon SNS) notification to the Lambda function when the health check status is unhealthy. Update the application’s Route 53 record with a failover policy that routes traffic to the ALB in the backup Region when a health check failure occurs.
  • C. Configure the Auto Scaling group in the backup Region to have the same values as the Auto Scaling group in the primary Region. Reconfigure the application’s Route 53 record with a latency-based routing policy that load balances traffic between the two ALBs. Remove the read replica. Replace the read replica with a standalone RDS DB instance. Configure Cross-Region Replicationbetween the RDS DB instances by using snapshots and Amazon S3.
  • D. Configure an endpoint in AWS Global Accelerator with the two ALBs as equal weighted targets. Create an AWS Lambda function in the backup Region to promote the read replica and modify the Auto Scaling group values. Create an Amazon CloudWatch alarm that is based on the HTTPCode_Target_5XX_Count metric for the ALB in the primary Region. Configure the CloudWatch alarm to invoke the Lambda function.
Mark Question:
Answer:

B


Explanation:
an AWS Lambda function in the backup region to promote the read replica and modify the Auto
Scaling group values, and then configuring Route 53 with a health check that monitors the web
application and sends an Amazon SNS notification to the Lambda function when the health check
status is unhealthy. Finally, the application's Route 53 record should be updated with a failover policy
that routes traffic to the ALB in the backup region when a health check failure occurs. This approach
provides automatic failover to the backup region when a health check failure occurs, reducing the
RTO to less than 15 minutes. Additionally, this approach is cost-effective as it does not require an
active-active strategy.

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

A company is hosting a critical application on a single Amazon EC2 instance. The application uses an
Amazon ElastiCache for Redis single-node cluster for an in-memory data store. The application uses
an Amazon RDS for MariaDB DB instance for a relational database. For the application to function,
each piece of the infrastructure must be healthy and must be in an active state.
A solutions architect needs to improve the application's architecture so that the infrastructure can
automatically recover from failure with the least possible downtime.
Which combination of steps will meet these requirements? (Select THREE.)

  • A. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances. Ensure that the EC2 instances are part of an Auto Scaling group that has a minimum capacity of two instances.
  • B. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances Ensure that the EC2 instances are configured in unlimited mode.
  • C. Modify the DB instance to create a read replica in the same Availability Zone. Promote the read replica to be the primary DB instance in failure scenarios.
  • D. Modify the DB instance to create a Multi-AZ deployment that extends across two Availability Zones.
  • E. Create a replication group for the ElastiCache for Redis cluster. Configure the cluster to use an Auto Scaling group that has a minimum capacity of two instances.
  • F. Create a replication group for the ElastiCache for Redis cluster. Enable Multi-AZ on the cluster.
Mark Question:
Answer:

A,D,F


Explanation:
Option A is correct because using an Elastic Load Balancer and an Auto Scaling group with a
minimum capacity of two instances can improve the availability and scalability of the EC2 instances
that host the application. The load balancer can distribute traffic across multiple instances and the
Auto Scaling group can replace any unhealthy instances automatically1
Option D is correct because modifying the DB instance to create a Multi-AZ deployment that extends
across two Availability Zones can improve the availability and durability of the RDS for MariaDB
database. Multi-AZ deployments provide enhanceddata protection and minimize downtime by
automatically failing over to astandby replica in another Availability Zone in case of a planned or
unplanned outage4
Option F is correct because creating a replication group for the ElastiCache for Redis cluster and
enabling Multi-AZ on the cluster can improve the availability and fault tolerance of the in-memory
data store. A replication group consists of a primary node and up to five read-only replica nodes that
are synchronized with the primary node using asynchronous replication. Multi-AZ allows automatic
failover to one of the replicas if the primary node fails or becomes unreachable6
Reference: 1: https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-
balancing-works.html 2: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/burstable-performance-instances-unlimited-mode.html 3:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html 4:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html 5:
https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/AutoScaling.html 6:
https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Replication.Redis.Groups.html

User Votes:
A
50%
B
50%
C
50%
D
50%
E
50%
F
50%
Discussions
vote your answer:
A
B
C
D
E
F
0 / 1000

Question 5

A retail company is operating its ecommerce application on AWS. The application runs on Amazon
EC2 instances behind an Application Load Balancer (ALB). The company uses an Amazon RDS DB
instance as the database backend. Amazon CloudFront is configured with one origin that points to
the ALB. Static content is cached. Amazon Route 53 is used to host all public zones.
After an update of the application, the ALB occasionally returns a 502 status code (Bad Gateway)
error. The root cause is malformed HTTP headers that are returned to the ALB. The webpage returns
successfully when a solutions architect reloads the webpage immediately after the error occurs.
While the company is working on the problem, the solutions architect needs to provide a custom
error page instead of the standard ALB error page to visitors.
Which combination of steps will meet this requirement with the LEAST amount of operational
overhead? (Choose two.)

  • A. Create an Amazon S3 bucket. Configure the S3 bucket to host a static webpage. Upload the custom error pages to Amazon S3.
  • B. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Target.FailedHealthChecks is greater than 0. Configure the Lambda function to modify the forwarding rule at the ALB to point to a publicly accessible web server.
  • C. Modify the existing Amazon Route 53 records by adding health checks. Configure a fallback target if the health check fails. Modify DNS records to point to a publicly accessible webpage.
  • D. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Elb.InternalError is greater than 0. Configure the Lambda function to modify the forwarding rule at the ALB to point to a public accessible web server.
  • E. Add a custom error response by configuring a CloudFront custom error page. Modify DNS records to point to a publicly accessible web page.
Mark Question:
Answer:

C,E


Explanation:
"Save your custom error pages in a location that is accessible to CloudFront. We recommend that you
store them in an Amazon S3 bucket, and that you don’t store them in the same place as the rest of
your website or application’s content. If you store the custom error pages on the same origin as your
website or application, and the origin starts to return 5xx errors, CloudFront can’t get the custom
error pages because the origin server is
unavailable."https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/GeneratingCustomErrorResponses.html

User Votes:
A
50%
B
50%
C
50%
D
50%
E
50%
Discussions
vote your answer:
A
B
C
D
E
0 / 1000

Question 6

A company has many AWS accounts and uses AWS Organizations to manage all of them. A solutions
architect must implement a solution that the company can use to share a common network across
multiple accounts.
The company's infrastructure team has a dedicated infrastructure account that has a VPC. The
infrastructure team must use this account to manage the network. Individual accounts cannot have
the ability to manage their own networks. However, individual accounts must be able to create AWS
resources within subnets.
Which combination of actions should the solutions architect perform to meet these requirements?
(Select TWO.)

  • A. Create a transit gateway in the infrastructure account.
  • B. Enable resource sharing from the AWS Organizations management account.
  • C. Create VPCs in each AWS account within the organization in AWS Organizations. Configure the VPCs to share the same CIDR range and subnets as the VPC in the infrastructure account. Peer the VPCs in each individual account with the VPC in the infrastructure account,
  • D. Create a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share.
  • E. Create a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each prefix list to associate with the resource share.
Mark Question:
Answer:

A,E


Explanation:
https://docs.aws.amazon.com/vpc/latest/userguide/sharing-managed-prefix-lists.html

User Votes:
A
50%
B
50%
C
50%
D
50%
E
50%
Discussions
vote your answer:
A
B
C
D
E
0 / 1000

Question 7

A company wants to use a third-party software-as-a-service (SaaS) application. The third-party SaaS
application is consumed through several API calls. The third-party SaaS application also runs on AWS
inside a VPC.
The company will consume the third-party SaaS application from inside a VPC. The company has
internal security policies that mandate the use of private connectivity that does not traverse the
internet. No resources that run in the company VPC are allowed to be accessed from outside the
company’s VPC. All permissions must conform to the principles of least privilege.
Which solution meets these requirements?

  • A. Create an AWS PrivateLink interface VPC endpoint. Connect this endpoint to the endpoint service that the third-party SaaS application provides. Create a security group to limit the access to the endpoint. Associate the security group with the endpoint.
  • B. Create an AWS Site-to-Site VPN connection between the third-party SaaS application and thecompany VPC. Configure network ACLs to limit access across the VPN tunnels.
  • C. Create a VPC peering connection between the third-party SaaS application and the company VPUpdate route tables by adding the needed routes for the peering connection.
  • D. Create an AWS PrivateLink endpoint service. Ask the third-party SaaS provider to create an interface VPC endpoint for this endpoint service. Grant permissions for the endpoint service to the specific account of the third-party SaaS provider.
Mark Question:
Answer:

A


Explanation:
Reference architecture -https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-saas.html
Note from documentation that Interface Endpoint is at client side

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8

A company needs to implement a patching process for its servers. The on-premises servers and
Amazon EC2 instances use a variety of tools to perform patching. Management requires a single
report showing the patch status of all the servers and instances.
Which set of actions should a solutions architect take to meet these requirements?

  • A. Use AWS Systems Manager to manage patches on the on-premises servers and EC2 instances. Use Systems Manager to generate patch compliance reports.
  • B. Use AWS OpsWorks to manage patches on the on-premises servers and EC2 instances. Use Amazon OuickSight integration with OpsWorks to generate patch compliance reports.
  • C. Use an Amazon EventBridge (Amazon CloudWatch Events) rule to apply patches by scheduling an AWS Systems Manager patch remediation job. Use Amazon Inspector to generate patch compliance reports.
  • D. Use AWS OpsWorks to manage patches on the on-premises servers and EC2 instances. Use AWS X- Ray to post the patch status to AWS Systems Manager OpsCenter to generate patch compliance reports.
Mark Question:
Answer:

A


Explanation:
https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

A company is running an application on several Amazon EC2 instances in an Auto Scaling group
behind an Application Load Balancer. The load on the application varies throughout the day, and EC2
instances are scaled in and out on a regular basis. Log files from the EC2 instances are copied to a
central Amazon S3 bucket every 15 minutes. The security team discovers that log files are missing
from some of the terminated EC2 instances.
Which set of actions will ensure that log files are copied to the central S3 bucket from the terminated
EC2 instances?

  • A. Create a script to copy log files to Amazon S3, and store the script in a file on the EC2 instance. Create an Auto Scaling lifecycle hook and an Amazon EventBridge (Amazon CloudWatch Events) rule to detect lifecycle events from the Auto Scaling group. Invoke an AWS Lambda function on the autoscaling:EC2_INSTANCE_TERMINATING transition to send ABANDON to the Auto Scaling group to prevent termination, run the script to copy the log files, and terminate the instance using the AWS SDK.
  • B. Create an AWS Systems Manager document with a script to copy log files to Amazon S3. Create an Auto Scaling lifecycle hook and an Amazon EventBridge (Amazon CloudWatch Events) rule to detect lifecycle events from the Auto Scaling group. Invoke an AWS Lambda function on the autoscaling:EC2_INSTANCE_TERMINATING transition to call the AWS Systems Manager API SendCommand operation to run the document to copy the log files and send CONTINUE to the Auto Scaling group to terminate the instance.
  • C. Change the log delivery rate to every 5 minutes. Create a script to copy log files to Amazon S3, and add the script to EC2 instance user data. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to detect EC2 instance termination. Invoke an AWS Lambda function from the EventBridge (CloudWatch Events) rule that uses the AWS CLI to run the user-data script to copy the log files and terminate the instance.
  • D. Create an AWS Systems Manager document with a script to copy log files to Amazon S3. Create an Auto Scaling lifecycle hook that publishes a message to an Amazon Simple Notification Service (Amazon SNS) topic. From the SNS notification, call the AWS Systems Manager API SendCommand operation to run the document to copy the log files and send ABANDON to the Auto Scaling group to terminate the instance.
Mark Question:
Answer:

B


Explanation:
https://docs.aws.amazon.com/autoscaling/ec2/userguide/adding-lifecycle-hooks.html
- Refer to Default Result section - If the instance is terminating, both abandon and continue allow the
instance to terminate. However, abandon stops any remaining actions, such as other lifecycle hooks,
and continue allows any other lifecycle hooks to complete.
https://aws.amazon.com/blogs/infrastructure-and-automation/run-code-before-terminating-an-ec2-
auto-scaling-instance/
https://github.com/aws-samples/aws-lambda-lifecycle-hooks-function
https://github.com/aws-samples/aws-lambda-lifecycle-hooks-
function/blob/master/cloudformation/template.yaml

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10

A company is using multiple AWS accounts The DNS records are stored in a private hosted zone for
Amazon Route 53 in Account A The company's applications and databases are running in Account B.
A solutions architect win deploy a two-net application In a new VPC To simplify the configuration, the
db.example com CNAME record set tor the Amazon RDS endpoint was created in a private hosted
zone for Amazon Route 53.
During deployment, the application failed to start. Troubleshooting revealed that db.example com is
not resolvable on the Amazon EC2 instance The solutions architect confirmed that the record set was
created correctly in Route 53.
Which combination of steps should the solutions architect take to resolve this issue? (Select TWO )

  • A. Deploy the database on a separate EC2 instance in the new VPC Create a record set for the instance's private IP in the private hosted zone
  • B. Use SSH to connect to the application tier EC2 instance Add an RDS endpoint IP address to the /eto/resolv.conf file
  • C. Create an authorization lo associate the private hosted zone in Account A with the new VPC In Account B
  • D. Create a private hosted zone for the example.com domain m Account B Configure Route 53 replication between AWS accounts
  • E. Associate a new VPC in Account B with a hosted zone in Account A. Delete the association authorization In Account A.
Mark Question:
Answer:

C,E


Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/private-hosted-zone-different-
account/

User Votes:
A
50%
B
50%
C
50%
D
50%
E
50%
Discussions
vote your answer:
A
B
C
D
E
0 / 1000

Question 11

A company used Amazon EC2 instances to deploy a web fleet to host a blog site The EC2 instances
are behind an Application Load Balancer (ALB) and are configured in an Auto ScaSng group The web
application stores all blog content on an Amazon EFS volume.
The company recently added a feature 'or Moggers to add video to their posts, attracting 10 times
the previous user traffic At peak times of day. users report buffering and timeout issues while
attempting to reach the site or watch videos
Which is the MOST cost-efficient and scalable deployment that win resolve the issues for users?

  • A. Reconfigure Amazon EFS to enable maximum I/O.
  • B. Update the Nog site to use instance store volumes tor storage. Copy the site contents to the volumes at launch and to Amazon S3 al shutdown.
  • C. Configure an Amazon CloudFront distribution. Point the distribution to an S3 bucket, and migrate the videos from EFS to Amazon S3.
  • D. Set up an Amazon CloudFront distribution for all site contents, and point the distribution at the ALB.
Mark Question:
Answer:

C


Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-https-connection-fails/
Using an Amazon S3 bucket
Using a MediaStore container or a MediaPackage channel
Using an Application Load Balancer
Using a Lambda function URL
Using Amazon EC2 (or another custom origin)
Using CloudFront origin groups
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/restrict-access-to-load-balancer.html

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 12

A company with global offices has a single 1 Gbps AWS Direct Connect connection to a single AWS
Region. The company's on-premises network uses the connection to communicate with the
company's resources in the AWS Cloud. The connection has a single private virtual interface that
connects to a single VPC.
A solutions architect must implement a solution that adds a redundant Direct Connect connection in
the same Region. The solution also must provide connectivity to other Regions through the same pair
of Direct Connect connections as the company expands into other Regions.
Which solution meets these requirements?

  • A. Provision a Direct Connect gateway. Delete the existing private virtual interface from the existing connection. Create the second Direct Connect connection. Create a new private virtual interlace on each connection, and connect both private victual interfaces to the Direct Connect gateway. Connect the Direct Connect gateway to the single VPC.
  • B. Keep the existing private virtual interface. Create the second Direct Connect connection. Create a new private virtual interface on the new connection, and connect the new private virtual interface to the single VPC.
  • C. Keep the existing private virtual interface. Create the second Direct Connect connection. Create a new public virtual interface on the new connection, and connect the new public virtual interface to the single VPC.
  • D. Provision a transit gateway. Delete the existing private virtual interface from the existing connection. Create the second Direct Connect connection. Create a new private virtual interface on each connection, and connect both private virtual interfaces to the transit gateway. Associate the transit gateway with the single VPC.
Mark Question:
Answer:

A


Explanation:
A Direct Connect gateway is a globally available resource. You can create the Direct Connect gateway
in any Region and access it from all other Regions. The following describe scenarios where you can
use a Direct Connect gateway.https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

A company has a web application that allows users to upload short videos. The videos are stored on
Amazon EBS volumes and analyzed by custom recognition software for categorization.
The website contains stat c content that has variable traffic with peaks in certain months. The
architecture consists of Amazon EC2 instances running in an Auto Scaling group for the web
application and EC2 instances running in an Auto Scaling group to process an Amazon SQS queue The
company wants to re-architect the application to reduce operational overhead using AWS managed
services where possible and remove dependencies on third-party software.
Which solution meets these requirements?

  • A. Use Amazon ECS containers for the web application and Spot Instances for the Auto Scaling group that processes the SQS queue. Replace the custom software with Amazon Recognition to categorize the videos.
  • B. Store the uploaded videos n Amazon EFS and mount the file system to the EC2 instances for Te web application. Process the SOS queue with an AWS Lambda function that calls the Amazon Rekognition API to categorize the videos.
  • C. Host the web application in Amazon S3. Store the uploaded videos in Amazon S3. Use S3 event notifications to publish events to the SQS queue Process the SQS queue with an AWS Lambda function that calls the Amazon Rekognition API to categorize the videos.
  • D. Use AWS Elastic Beanstalk to launch EC2 instances in an Auto Scaling group for the web application and launch a worker environment to process the SQS queue Replace the custom software with Amazon Rekognition to categorize the videos.
Mark Question:
Answer:

C


Explanation:
Option C is correct because hosting the web application in Amazon S3, storing the uploaded videos in
Amazon S3, and using S3 event notifications to publish events to the SQS queue reduces the
operational overhead of managing EC2 instances and EBS volumes. Amazon S3 can serve static
content such as HTML, CSS, JavaScript, and media files directly from S3 buckets. Amazon S3 can also
trigger AWS Lambda functions through S3 event notifications when new objects are created or
existing objects are updated or deleted. AWS Lambda can process the SQS queue with an AWS
Lambda function that calls the Amazon Rekognition API to categorize thevideos. This solution
eliminates the need for custom recognition software and third-party dependencies345
Reference: 1: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html 2:
https://aws.amazon.com/efs/pricing/ 3:https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html 4:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/NotificationHowTo.html 5:
https://docs.aws.amazon.com/rekognition/latest/dg/what-
is.html 6:https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/Welcome.html

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

A company has a serverless application comprised of Amazon CloudFront, Amazon API Gateway, and
AWS Lambda functions. The current deployment process of the application code is to create a new
version number of the Lambda function and run an AWS CLI script to update. If the new function
version has errors, another CLI script reverts by deploying the previous working version of the
function. The company would like to decrease the time to deploy new versions of the application
logic provided by the Lambda functions, and also reduce the time to detect and revert when errors
are identified.
How can this be accomplished?

  • A. Create and deploy nested AWS CloudFormation stacks with the parent stack consisting of the AWS CloudFront distribution and API Gateway, and the child stack containing the Lambda function. For changes to Lambda, create an AWS CloudFormation change set and deploy; if errors are triggered, revert the AWS CloudFormation change set to the previous version.
  • B. Use AWS SAM and built-in AWS CodeDeploy to deploy the new Lambda version, gradually shift traffic to the new version, and use pre-traffic and post-traffic test functions to verify code. Rollback if Amazon CloudWatch alarms are triggered.
  • C. Refactor the AWS CLI scripts into a single script that deploys the new Lambda version. When deployment is completed, the script tests execute. If errors are detected, revert to the previous Lambda version.
  • D. Create and deploy an AWS CloudFormation stack that consists of a new API Gateway endpoint that references the new Lambda version. Change the CloudFront origin to the new API Gateway endpoint, monitor errors and if detected, change the AWS CloudFront origin to the previous API Gateway endpoint.
Mark Question:
Answer:

B


Explanation:
https://aws.amazon.com/about-aws/whats-new/2017/11/aws-lambda-supports-traffic-shifting-and-
phased-deployments-with-aws-codedeploy/

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

A company is using an on-premises Active Directory service for user authentication. The company
wants to use the same authentication service to sign in to the company's AWS accounts, which are
using AWS Organizations. AWS Site-to-Site VPN connectivity already exists between the on-premises
environment and all the company's AWS accounts.
The company's security policy requires conditional access to the accounts based on user groups and
roles. User identities must be managed in a single location.
Which solution will meet these requirements?

  • A. Configure AWS Single Sign-On (AWS SSO) to connect to Active Directory by using SAML 2.0. Enable automatic provisioning by using the System for Cross- domain Identity Management (SCIM) v2.0 protocol. Grant access to the AWS accounts by using attribute-based access controls (ABACs).
  • B. Configure AWS Single Sign-On (AWS SSO) by using AWS SSO as an identity source. Enable automatic provisioning by using the System for Cross-domain Identity Management (SCIM) v2.0 protocol. Grant access to the AWS accounts by using AWS SSO permission sets.
  • C. In one of the company's AWS accounts, configure AWS Identity and Access Management (IAM) to use a SAML 2.0 identity provider. Provision IAM users that are mapped to the federated users. Grant access that corresponds to appropriate groups in Active Directory. Grant access to the required AWS accounts by using cross-account IAM users.
  • D. In one of the company's AWS accounts, configure AWS Identity and Access Management (IAM) to use an OpenID Connect (OIDC) identity provider. Provision IAM roles that grant access to the AWS account for the federated users that correspond to appropriate groups in Active Directory. Grant access to the required AWS accounts by using cross-account IAM roles.
Mark Question:
Answer:

D


Explanation:
https://aws.amazon.com/blogs/aws/new-attributes-based-access-control-with-aws-single-sign-on/

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2