Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 461Question →

A smart grid utility company collects hourly electricity consumption metrics from 7.27.2 million smart meters. Each meter sends a 1 KB write payload once per hour, distributed evenly throughout the day, establishing a highly predictable baseline rate. However, during grid maintenance or unexpected outages, up to 33 million smart meters simultaneously send status updates, causing sudden, unpredictable ingestion spikes of up to 100,000100,000 writes/second that last for less than 5 minutes. The company wants to minimize overall database and ingestion costs while ensuring no data is throttled or lost.

Which architecture meets these requirements most cost-effectively?

Show answer & explanation

Answer: Configure the Amazon DynamoDB table in provisioned capacity mode with Auto Scaling to handle the steady baseline. Buffer the incoming meter payloads using an Amazon SQS queue, and consume messages using AWS Lambda to write to the table at a controlled rate.

Answer

Configure the Amazon DynamoDB table in provisioned capacity mode with Auto Scaling to handle the steady baseline. Buffer the incoming meter payloads using an Amazon SQS queue, and consume messages using AWS Lambda to write to the table at a controlled rate.
The correct architecture uses an Amazon SQS queue to buffer the high-volume ingestion spikes, decoupling the ingestion layer from the database layer. This allows the DynamoDB table to be provisioned for the steady baseline rate (2,0002,000 WCUs), saving significant costs compared to DynamoDB On-Demand capacity mode or provisioning for the peak capacity of 100,000100,000 WCUs. AWS Lambda consumes from the queue and writes to DynamoDB at a controlled rate, ensuring no writes are lost or throttled.

Step-by-Step Solution

1
Analyze the baseline and peak workload characteristics.
Baseline requires 2,0002,000 WCUs (since 7.27.2 million writes per hour is 2,0002,000 writes/sec, and 1 KB requires 1 WCU). Peak requires 100,000100,000 WCUs but lasts for less than 5 minutes.
Understanding the workload helps evaluate the cost tradeoffs of different capacity planning strategies.
2
Compare the costs of DynamoDB capacity modes.
On-demand capacity mode for 172.8172.8 million daily writes costs ≈$216\approx \$216/day (≈$6,480\approx \$6,480/month). Provisioned capacity mode for the baseline of 2,0002,000 WCUs costs ≈$31.20\approx \$31.20/day (≈$936\approx \$936/month).
To achieve cost-optimization, provisioned capacity is preferred for the high steady baseline, provided spikes can be handled without throttling.
3
Evaluate buffering mechanisms to handle the short-duration spikes.
An Amazon SQS queue can absorb the sudden 100,000100,000 writes/sec write spikes. An AWS Lambda function can pull from SQS and write to DynamoDB at a throttled, controlled pace.
Decoupling with SQS flattens the ingestion curve, allowing the database to be provisioned for baseline throughput without throttling or data loss.

Key Concept

Decoupling architectures to flatten ingestion spikes and optimize database provisioned capacity costs.
Question 462Question →

An enterprise is launching a new multi-tenant application on AWS. The finance team requires a proactive cost monitoring strategy to alert them immediately if the daily cost of a specific project (tracked via the cost allocation tag Project:Apollo) exceeds a budgeted threshold of $500. Additionally, the operations team needs to receive automated alerts if there is any anomalous, unexpected spending spike across the entire AWS account, regardless of historical benchmarks or tags, to quickly investigate potential resource misconfigurations. Which combination of AWS cost management features should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a daily cost budget in AWS Budgets, filter by the Project:Apollo tag, and configure a notification to email the finance team when the actual or forecasted daily spend exceeds $500.; Configure an AWS Cost Anomaly Detection monitor for the AWS account, and set up an Amazon Simple Notification Service (Amazon SNS) topic to alert the operations team when unusual spending is detected.

Answer

Create a daily cost budget in AWS Budgets, filter by the Project:Apollo tag, and configure email alerts for threshold breaches. Additionally, configure an AWS Cost Anomaly Detection monitor for the account with an Amazon SNS topic to alert on unexpected spending spikes.
To proactively monitor specific tag-based daily budgets, AWS Budgets is the correct tool because it allows filtering by the 'Project:Apollo' tag and sending email notifications when daily thresholds are breached. To detect sudden account-wide spikes in spend, AWS Cost Anomaly Detection uses machine learning to identify unexpected costs and can alert the operations team immediately via Amazon SNS.

Step-by-Step Solution

1
Identify the requirement for proactive, tag-based alerts.
Determine that AWS Budgets supports daily granularity tracking filtered by cost allocation tags (Project:Apollo) with threshold alerts based on actual or forecasted amounts.
This directly satisfies the finance team's need to be alerted when the project daily cost exceeds $500.
2
Identify the requirement for anomalous spend detection.
Select AWS Cost Anomaly Detection with an AWS account monitor and Amazon SNS alerts.
AWS Cost Anomaly Detection is the designated service to detect unexpected spikes in spending using machine learning, addressing the operations team's requirement.
3
Evaluate and eliminate incorrect cost monitoring approaches.
Reject retrospective or administrative tools such as AWS Cost Explorer and AWS Billing Conductor for real-time alerting, and reject Savings Plans as they do not apply to RDS and S3.
Ensures the selected solutions are the most efficient and accurate tools for the specific monitoring requirements.

Key Concept

AWS Cost Monitoring, Budgeting, and Optimization Tools
Question 463Question →

A media streaming company is launching an on-demand video platform on AWS. The application database workload is highly unpredictable, experiencing sudden surges of read and write queries during popular content releases, followed by extended periods of low activity. The company requires a database design that supports high availability within a single AWS Region with a Recovery Time Objective (RTO) of less than 30 seconds and a Recovery Point Objective (RPO) of 0 (no data loss) during an Availability Zone outage. Additionally, the database must dynamically scale compute capacity up and down to match workload demands without manual intervention or connection disruption, while allowing read workloads to scale independently. Which database configuration will meet these requirements?

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL Serverless v2 DB cluster with a writer instance and a reader instance in different Availability Zones, and configure the application to use the cluster endpoint for writes and the reader endpoint for reads.

Answer

Deploy an Amazon Aurora PostgreSQL Serverless v2 DB cluster with a writer instance and a reader instance in different Availability Zones, and configure the application to use the cluster endpoint for writes and the reader endpoint for reads.
The correct configuration utilizes Amazon Aurora Serverless v2 in a Multi-AZ deployment with both a writer and a reader instance. Aurora Serverless v2 automatically scales compute capacity up and down based on application demand without causing connection disruption. By having a reader instance in a separate Availability Zone, Aurora can automatically fail over to the reader in less than 30 seconds (meeting the RTO constraint). Because both instances share the same distributed Aurora storage volume across multiple Availability Zones, no data loss occurs during a failover (meeting the RPO of 0). The reader endpoint allows the application to route read queries to the reader instance, scaling read capacity independently.

Step-by-Step Solution

1
Identify the RTO, RPO, and compute scaling constraints from the scenario.
The solution requires high availability with RTO < 30 seconds, RPO = 0 (no data loss) in a single Region, dynamic compute scaling without connection drops, and read scaling.
Understanding these metrics eliminates disaster recovery options (which have RPO > 0 due to asynchronous cross-region replication) and standard RDS scaling options (which require downtime to change instance classes).
2
Evaluate the replication and failover mechanisms of the database engines.
Amazon Aurora replicates data across three Availability Zones using a shared storage volume, ensuring RPO = 0. Failover to an Aurora replica takes less than 30 seconds.
This guarantees the required HA and recovery objectives are met automatically during an Availability Zone outage.
3
Determine the scaling mechanism that prevents connection disruptions.
Amazon Aurora Serverless v2 scales compute capacity dynamically in place, preventing connection drops during workload spikes.
This satisfies the requirement for seamless scaling under unpredictable workloads.

Key Concept

Amazon Aurora Serverless v2 Multi-AZ deployments with reader instances provide high availability (RTO < 30 seconds), zero data loss (RPO = 0), and instant compute scaling without connection disruption.
Estimated Time:2m 0s
Question 464Question →

A company is developing a mobile game and needs a cost-optimized database solution. The game has highly unpredictable traffic, experiencing short bursts of intense activity followed by hours of zero usage. The game stores temporary player session data that is only valid for 2424 hours.

Which two configurations should a Solutions Architect recommend? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Create an Amazon DynamoDB table using On-Demand Capacity mode to scale automatically with the unpredictable traffic.; Enable DynamoDB Time to Live (TTL) to automatically delete expired player session data and minimize storage costs.

Answer

Create an Amazon DynamoDB table using On-Demand Capacity mode, and enable DynamoDB Time to Live (TTL) on the session data table.
For unpredictable, spiky workloads with long periods of zero activity, Amazon DynamoDB On-Demand capacity mode provides the most cost-optimized scaling by charging only for actual read and write requests. Combining this with DynamoDB Time to Live (TTL) allows automatic deletion of expired temporary player sessions after 24 hours, preventing unnecessary storage costs without additional compute overhead.

Step-by-Step Solution

1
Analyze the workload traffic pattern.
The traffic is highly unpredictable and spiky with long periods of zero activity.
This helps determine the optimal database capacity mode. A serverless, auto-scaling option like DynamoDB On-Demand capacity is ideal because it charges only for the requests made and avoids idle capacity costs.
2
Analyze the data lifecycle requirement.
The player session data is temporary and only valid for 24 hours.
This identifies opportunities to reduce storage costs. DynamoDB Time to Live (TTL) automatically deletes expired items, which minimizes stored data size and reduces ongoing storage costs without execution charges.

Key Concept

Selecting the cost-optimal capacity mode and data retention policy for unpredictable, transient database workloads.
Question 465Question →

A media distribution company serves static high-resolution graphics and dynamic personalized recommendations from a web application. The static assets are stored in an Amazon S3 bucket in the us-east-1 Region, with a cross-region replication bucket in the us-west-2 Region. The dynamic recommendations are generated by an Application Load Balancer (ALB) in us-east-1. The company wants to implement a solution that reduces latency for global users and provides automatic failover for the static assets if the primary S3 bucket becomes unavailable. Which two actions should a solutions architect take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create an Amazon CloudFront distribution. Configure an origin group with the S3 bucket in us-east-1 as the primary origin and the S3 bucket in us-west-2 as the secondary origin. Point the static cache behavior to this origin group.; Configure the CloudFront distribution to use the ALB in us-east-1 as the origin for dynamic requests, and configure the dynamic cache behavior to forward cookies, headers, and query strings to the origin.

Answer

To meet the requirements, the solutions architect should create an Amazon CloudFront distribution, configure an origin group with the primary S3 bucket as the primary origin and the secondary S3 bucket as the backup origin, and route the static cache behavior to this group. Additionally, the ALB should be configured as a CloudFront origin for dynamic requests, with the dynamic cache behavior forwarding headers, cookies, and query strings to the origin.
The correct actions involve configuring CloudFront with an origin group for the static assets, and setting up the ALB as an origin with a dynamic cache behavior that forwards necessary user context. CloudFront origin groups provide automatic failover for static content by switching to the backup S3 bucket in us-west-2 if the primary bucket in us-east-1 is down or returns errors. Forwarding cookies, headers, and query strings to the ALB ensures dynamic recommendations are processed correctly while using CloudFront's optimized network path to reduce latency.

Step-by-Step Solution

1
Analyze the requirements for latency reduction and resiliency.
Identify that CloudFront is the appropriate service for global edge caching of static content and optimized routing of dynamic content.
CloudFront reduces latency by caching static assets at edge locations and routing dynamic traffic over the AWS global network.
2
Configure automatic failover for the static S3 origins.
Create a CloudFront origin group containing the us-east-1 S3 bucket as primary and the us-west-2 S3 bucket as secondary.
CloudFront origin groups automatically route requests to the secondary origin if the primary origin is unavailable or returns error status codes.
3
Configure dynamic request handling.
Add the ALB as an origin and configure a separate cache behavior for dynamic paths to bypass caching by forwarding query strings, cookies, and headers.
This allows personalized recommendation requests to reach the ALB directly while benefiting from CloudFront's optimized network routing.

Key Concept

Leveraging Amazon CloudFront origin groups for static asset failover and optimizing dynamic API performance by routing Application Load Balancer traffic through the edge network.
Estimated Time:2m 0s
Question 466Question →

A multinational enterprise uses AWS Organizations to manage a multi-account environment. The finance team needs to establish a proactive cost management strategy to meet two specific requirements. First, they must detect and receive alerts for sudden, unexpected spending anomalies within individual accounts without manually configuring static cost thresholds. Second, they need to monitor monthly data transfer costs across the entire organization and receive notifications before these costs exceed a set limit of 10,00010,000.

Which combination of actions should a solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create AWS Cost Anomaly Detection monitors for the individual accounts, and configure an Amazon SNS subscription with an immediate alerting frequency to notify the team of cost spikes.; Create a cost budget in AWS Budgets filtered by the data transfer usage type, and configure an alert threshold to trigger when forecasted monthly spend exceeds 10,00010,000.

Answer

The solutions architect should configure AWS Cost Anomaly Detection monitors for individual accounts with an immediate alerting frequency, and create a cost budget in AWS Budgets filtered by data transfer usage to alert when the forecasted spend exceeds 10,00010,000.
AWS Cost Anomaly Detection uses machine learning to dynamically establish spending baselines and detect spikes across accounts without manual threshold setup, alerting immediately via Amazon SNS. AWS Budgets allows setting up proactive alerts for specific usage types, such as data transfer, triggered when forecasted monthly spend exceeds the specified threshold, thus notifying the team before the threshold is actually breached.

Step-by-Step Solution

1
Evaluate the requirement for detecting unexpected spending anomalies without manual static thresholds.
Identify AWS Cost Anomaly Detection as the service that leverages machine learning to identify anomalous spend with minimal configuration overhead.
AWS Cost Anomaly Detection dynamically creates baselines and alerts on deviations automatically.
2
Address the requirement to monitor data transfer costs and receive proactive alerts before the 10,00010,000 limit is breached.
Select AWS Budgets, filter by the data transfer usage type, and set the alert trigger type to 'Forecasted' spend exceeding 10,00010,000.
AWS Budgets supports proactive monitoring based on forecasted parameters, enabling notifications before costs are actually incurred.

Key Concept

Combining AWS Cost Anomaly Detection for ML-driven anomaly detection and AWS Budgets for proactive forecasted spend tracking.
Estimated Time:2m 0s
Question 467Question →

A financial services company is designing a serverless batch data-processing pipeline. External clients upload transaction logs to an Amazon S3 bucket at unpredictable times. The ingestion rate varies from zero uploads during weekends to thousands of simultaneous uploads during end-of-month processing. The pipeline must write metadata to Amazon DynamoDB and execute an analysis script on each uploaded log. The analysis script takes between 2020 and 3030 minutes to complete per log. For audit compliance, transaction logs must be processed in the exact order they are uploaded. Which architecture meets these requirements in the most cost-effective manner?

Show answer & explanation

Answer: Configure Amazon S3 Event Notifications to send events to an Amazon SQS FIFO queue. Configure an AWS Lambda function to poll the queue, write metadata to Amazon DynamoDB in on-demand capacity mode, and launch Amazon ECS tasks on AWS Fargate using the Fargate Spot capacity provider to run the analysis script.

Answer

Configure Amazon S3 Event Notifications to send events to an Amazon SQS FIFO queue, use AWS Lambda to write metadata to Amazon DynamoDB in on-demand capacity mode, and launch Amazon ECS tasks on AWS Fargate Spot to execute the analysis script.
The correct solution satisfies the compliance requirement by routing event notifications through an Amazon SQS FIFO queue, which guarantees strict ordering. It handles the 2020-to-3030 minute runtime constraint by using AWS Lambda to launch Amazon ECS tasks on AWS Fargate on-demand, bypassing the 1515-minute Lambda execution limit. It optimizes costs by selecting Fargate Spot (which reduces compute costs by up to 70%70\%) and Amazon DynamoDB in on-demand capacity mode (which automatically scales to zero, eliminating idle charges during weekends).

Step-by-Step Solution

1
Select the correct compute service based on workload duration and limits.
Choose Amazon ECS on AWS Fargate instead of running the script directly inside AWS Lambda.
The analysis script takes 2020 to 3030 minutes to complete. AWS Lambda has a strict maximum timeout limit of 1515 minutes, which makes it unsuitable for long-running scripts.
2
Determine the optimal queue configuration for the ordering requirement.
Select Amazon SQS FIFO queues.
The company's audit compliance requires transaction logs to be processed in the exact order they are uploaded. Standard SQS queues only guarantee best-effort ordering, whereas SQS FIFO guarantees first-in, first-out sequence.
3
Choose cost-optimized compute capacity providers and database capacity modes for unpredictable scaling.
Select Fargate Spot capacity providers for ECS tasks, and configure Amazon DynamoDB in on-demand capacity mode.
Fargate Spot offers significant discounts of up to 70%70\% for batch processing that can tolerate interruptions. DynamoDB on-demand mode scales instantly to handle spikes and incurs zero costs when there are no read or write requests during weekends.

Key Concept

Serverless and Automated Scaling Architectures for Cost Efficiency
Question 468Question →

An enterprise runs a containerized web application on Amazon Elastic Container Service (Amazon ECS) with AWS Fargate. The application consists of two main microservices:

1. A core transactional service that runs continuously 24/724/7 and requires a stable baseline of 88 tasks.
2. A non-urgent data processing worker service that processes jobs from an Amazon SQS queue. The workload for this worker service is highly unpredictable, can be delayed if necessary, and the application code is designed to tolerate task interruptions.

The application database is hosted on Amazon RDS for MySQL.

Which two strategies should a solutions architect recommend to minimize compute costs for this architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Purchase a Compute Savings Plan to cover the baseline Fargate tasks running the core transactional service.; Use AWS Fargate Spot capacity providers to run the tasks for the non-urgent data processing worker service.

Answer

Purchase a Compute Savings Plan to cover the baseline Fargate tasks running the core transactional service, and use AWS Fargate Spot capacity providers to run the tasks for the non-urgent data processing worker service.
To achieve a cost-optimized compute architecture on AWS Fargate, steady-state baseline workloads should leverage Compute Savings Plans, which offer significant discounts in exchange for a commitment to a consistent amount of compute usage. For interruption-tolerant, non-urgent workloads, AWS Fargate Spot is the most cost-effective option as it provides spare capacity at a steep discount.

Step-by-Step Solution

1
Analyze compute requirement profiles.
The core transactional service requires a continuous baseline of 88 tasks, while the data processing service is unpredictable and interruption-tolerant.
Identifying the stability and tolerance of workloads dictates the appropriate compute purchasing models.
2
Select the cost-optimized purchasing strategy for baseline tasks.
Commitment-based Compute Savings Plans are selected to cover the core Fargate tasks.
Compute Savings Plans provide significant discounts compared to On-Demand rates for steady-state workloads and apply to AWS Fargate.
3
Select the cost-optimized purchasing strategy for unpredictable, interruption-tolerant tasks.
AWS Fargate Spot capacity provider is selected.
Fargate Spot provides up to a 70%70\% discount for workloads that can handle interruptions, matching the characteristics of the worker service.

Key Concept

Selecting cost-optimized compute purchasing strategies (Compute Savings Plans for steady-state Fargate workloads and AWS Fargate Spot for interruption-tolerant, non-urgent workloads).
Question 469Question →

A financial services company hosts a high-frequency trading application on Amazon EC2 instances inside a private subnet of a VPC. A security architect needs to implement a threat detection and automated remediation system to identify and block outbound command-and-control (C2) traffic from these instances. The solution must immediately block outbound traffic to the identified malicious IP addresses at the subnet boundary to prevent data exfiltration, while ensuring that the rest of the legitimate application traffic in the subnet continues to flow without interruption. Which architecture should the security architect implement to meet these requirements with the lowest operational overhead?

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS logs. Create an Amazon EventBridge rule to trigger an AWS Lambda function when a C2 threat is detected. The Lambda function dynamically adds a stateless outbound DENY rule for the malicious destination IP address to the Network Access Control List (NACL) associated with the private subnet.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs and DNS logs. Create an Amazon EventBridge rule to trigger an AWS Lambda function when a C2 threat is detected. The Lambda function dynamically adds a stateless outbound DENY rule for the malicious destination IP address to the Network Access Control List (NACL) associated with the private subnet.
The correct architecture utilizes Amazon GuardDuty to monitor network logs natively and trigger an automated EventBridge rule. The triggered Lambda function applies an explicit deny rule in the stateless Network ACL at the subnet boundary. This successfully isolates the outbound C2 communication at the perimeter while keeping other subnet traffic unaffected.

Step-by-Step Solution

1
Detect malicious C2 activity using a native AWS threat detection service.
Amazon GuardDuty is enabled, which natively analyzes VPC Flow Logs and DNS query logs to identify suspicious outbound patterns such as command-and-control server communication.
This avoids custom log parsing and maintains the lowest operational overhead for complex threat detection.
2
Automate threat remediation using EventBridge and Lambda.
An EventBridge rule matches GuardDuty finding types for C2 activity and triggers an AWS Lambda function, passing the metadata of the malicious destination IP.
This establishes a real-time, event-driven orchestration pipeline.
3
Implement the blocking mechanism at the subnet boundary.
The Lambda function updates the Network Access Control List (NACL) associated with the subnet, adding an explicit outbound DENY rule for the specific IP.
Network ACLs operate statelessly at the subnet boundary, allowing targeted blocking of traffic before it leaves the subnet while leaving legitimate traffic to other destinations unaffected.

Key Concept

Automated security threat detection and mitigation using Amazon GuardDuty, Amazon EventBridge, AWS Lambda, and Network ACLs.
Question 470Question →

A company is deploying a secure internal microservice on a fleet of Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The microservice is configured to listen on port 84438443. The target group is configured to route HTTPS traffic to port 84438443 with the health check port set to 'traffic-port'. The EC2 instances are launched in private subnets, while the ALB resides in public subnets. The private subnets are associated with a custom Network ACL (NACL) that permits inbound traffic on port 84438443 from the public subnets and outbound traffic on port 84438443 to the public subnets. The EC2 security group allows inbound traffic on port 84438443 from the ALB security group, and has the default outbound rule allowing all traffic. However, the ALB marks all EC2 instances as unhealthy, and clients receive HTTP 502502 Bad Gateway errors. Which of the following actions should the solutions architect take to resolve the health check issue and restore normal operation?

Show answer & explanation

Answer: Update the custom Network ACL rules on the private subnets to allow outbound traffic on ephemeral ports (10241024-6553565535) to the public subnets.

Answer

Update the custom Network ACL rules on the private subnets to allow outbound traffic on ephemeral ports (10241024-6553565535) to the public subnets.
The correct option is the one suggesting to update the custom Network ACL rules on the private subnets. Network ACLs are stateless, meaning that outbound return traffic must be explicitly allowed. When the Application Load Balancer sends health check requests to the EC2 instances on port 84438443, the instances respond using ephemeral source ports (10241024-6553565535). Because the outbound NACL rule only allowed traffic on port 84438443, the return traffic was blocked, causing the load balancer to mark the instances as unhealthy. Allowing outbound traffic to ephemeral ports resolves this issue.

Step-by-Step Solution

1
Analyze the statefulness of the security group and Network ACL configuration.
Identify that the security group is stateful and does not block the return path, whereas the Network ACL (NACL) is stateless and requires explicit rules for return traffic.
To pinpoint which security filter is blocking the health check responses from the EC2 instances.
2
Determine the source and destination ports for the load balancer health checks.
The ALB sends health checks to the instances on port 84438443 (destination). The instances reply back to the ALB's ephemeral ports in the range 10241024-6553565535 (destination).
To verify if the return traffic matches the allowed outbound rule of the private subnets' custom NACL.
3
Apply the correction to the stateless Network ACL.
Add an outbound rule allowing TCP traffic in the range 10241024-6553565535 to the public subnets where the ALB is located.
This allows the return traffic from the instances to reach the ALB, allowing the health check to succeed.

Key Concept

Stateless nature of Network ACLs compared to stateful Security Groups in Elastic Load Balancing architectures.
Estimated Time:2m 30s
Question 471Question →

A company runs a telemetry ingestion and processing platform on AWS. The workload has the following components:
- A baseline of four Amazon EC2 instances that run continuously 24/7 to receive telemetry data.
- An Auto Scaling group of EC2 instances that adds between two and eight additional instances during peak daytime hours.
- A daily batch analytics job running on Amazon EC2 for two hours that is fault-tolerant and can be interrupted or resumed.
- An Amazon RDS PostgreSQL database instance that runs continuously 24/7 to store the processed telemetry.

Which combination of purchasing options will provide the most cost-effective solution for this workload?

Show answer & explanation

Answer: Purchase a Compute Savings Plan to commit to the baseline EC2 usage, use On-Demand Instances for the peak scaling instances, use Spot Instances for the batch analytics job, and purchase an RDS Reserved Instance for the database.

Answer

Purchase a Compute Savings Plan to commit to the baseline EC2 usage, use On-Demand Instances for the peak scaling instances, use Spot Instances for the batch analytics job, and purchase an RDS Reserved Instance for the database.
The correct strategy combines a Compute Savings Plan for the baseline EC2 workload, On-Demand Instances for the variable peak scaling compute, Spot Instances for the short-term and fault-tolerant batch processing, and an RDS Reserved Instance to discount the database layer. This maximizes discounts while avoiding over-commitment and maintaining application availability.

Step-by-Step Solution

1
Analyze the 24/7 baseline compute requirements.
The baseline of four EC2 instances running 24/7 represents a predictable, continuous compute workload suitable for a commitment-based discount model like a Compute Savings Plan.
Savings Plans offer significant discounts over On-Demand rates in exchange for a commitment to a consistent amount of usage.
2
Evaluate the peak scaling and batch compute requirements.
The peak scaling instances (2 to 8 instances) are unpredictable and short-lived, making them best suited for On-Demand Instances to avoid paying for idle committed capacity. The daily batch analytics job is fault-tolerant and runs for only 2 hours, making it ideal for Spot Instances.
Spot Instances offer up to a 90% discount compared to On-Demand instances, with the trade-off of potential interruption, which is acceptable for fault-tolerant batch jobs.
3
Determine the purchasing option for the database tier.
The Amazon RDS PostgreSQL instance runs continuously 24/7. Since Compute Savings Plans do not cover RDS, an RDS Reserved Instance must be purchased to optimize costs.
RDS Reserved Instances provide a discount for database instances with a one- or three-year commitment.

Key Concept

Selecting cost-optimized compute purchasing models based on workload predictability, fault tolerance, and service support boundaries.
Question 472Question →

A company is deploying a serverless microservice on AWS Lambda that requires access to a third-party payment gateway's API key. Security policies mandate that the API key must be encrypted at rest and rotated every 30 days. The rotation process must be automated, and the Lambda function should retrieve the latest key at runtime without requiring manual updates or redeployments. Which solution should a Solutions Architect implement to meet these requirements with the least administrative effort?

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager. Configure automatic rotation using a custom AWS Lambda rotation function, and configure the application to retrieve the key dynamically at runtime using the AWS SDK.

Answer

Store the API key in AWS Secrets Manager, configure automatic rotation using a custom AWS Lambda rotation function, and retrieve the key dynamically at runtime using the AWS SDK.
AWS Secrets Manager securely stores the API key encrypted at rest and supports built-in integration with AWS Lambda to orchestrate custom rotation workflows. By fetching the secret dynamically using the AWS SDK, the client application always receives the active credential version without requiring redeployment.

Step-by-Step Solution

1
Store the sensitive credentials.
The third-party API key is saved as a secret in AWS Secrets Manager, ensuring it is encrypted at rest using an AWS KMS key.
AWS Secrets Manager is the recommended service for managing, rotating, and retrieving database credentials, API keys, and other secrets.
2
Configure the rotation mechanism.
An AWS Lambda rotation function is associated with the secret, and a rotation schedule of 30 days is configured.
Since the API key belongs to a third-party gateway, standard RDS rotation templates do not apply, so a custom Lambda function is required to communicate with the external API provider and update the secret.
3
Update the client application code.
The Lambda function uses the AWS SDK to retrieve the secret value dynamically during execution.
Retrieving the secret at runtime ensures that the application always uses the most current API key version without requiring configuration changes or code redeployments when rotation occurs.

Key Concept

AWS Secrets Manager supports native, automated rotation of secrets via custom AWS Lambda functions, enabling secure retrieval of credentials at runtime without application redeployment.
Question 473Question →

A financial services firm is designing a real-time transaction ledger. The ledger must process deposit and withdrawal events in the exact order they are initiated for each individual bank account to prevent overdrafts. The event volume routinely spikes to 2,5002,500 transactions per second. Two independent downstream applications—a ledger database writer and a real-time fraud detection engine—must process every transaction. The architecture must guarantee that duplicate messages sent within a 5-minute window are discarded, and it must minimize operational overhead.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon Simple Notification Service (Amazon SNS) FIFO topic and subscribe two Amazon Simple Queue Service (Amazon SQS) FIFO queues to the topic, one for each downstream application.; Enable high-throughput mode on the SQS FIFO queues, and configure the transaction events to use the bank account ID as the message group ID.

Answer

Create an Amazon SNS FIFO topic with two SQS FIFO queues subscribed to it, enable high-throughput mode on the SQS FIFO queues, and use the bank account ID as the message group ID.
To achieve both event fan-out and strict sequencing under a high-throughput scenario, the architecture must utilize Amazon SNS FIFO and Amazon SQS FIFO. An SNS FIFO topic preserves ordering and deduplication when forwarding events to subscribed SQS FIFO queues. Setting the bank account ID as the message group ID allows the SQS FIFO queue to group related messages together for ordered processing while enabling horizontal scaling across multiple partitions. High-throughput mode allows the FIFO queues to scale dynamically and accommodate the 2,5002,500 TPS volume, while SQS FIFO's native deduplication satisfies the 5-minute window without custom application logic.

Step-by-Step Solution

1
Analyze ordering and throughput constraints.
The system requires strict ordering per bank account. The throughput can reach 2,5002,500 TPS, which exceeds the standard SQS FIFO queue limit of 300300 TPS.
This establishes that SQS FIFO queues with high-throughput mode enabled are necessary to handle the traffic while guaranteeing order.
2
Design the fan-out mechanism.
Use an Amazon SNS FIFO topic to publish the events, and subscribe two separate Amazon SQS FIFO queues to this topic.
This allows both independent downstream applications to receive a copy of every transaction event without competing for messages, while preserving ordering and deduplication properties.
3
Configure message grouping and deduplication.
Set the bank account ID as the message group ID and leverage SQS FIFO's native 5-minute deduplication window.
Using the bank account ID as the message group ID ensures that events for the same account are sequenced correctly while allowing different accounts to be processed concurrently. SQS FIFO's native deduplication discards duplicates within 5 minutes without additional coding.

Key Concept

Combining Amazon SNS FIFO and SQS FIFO queues to achieve high-throughput event fan-out with strict ordering and native deduplication.
Estimated Time:3m 0s
Question 474Question →

A global multiplayer gaming platform hosts player profile statistics in an Amazon RDS for PostgreSQL database and stores downloadable game patch files in an Amazon S3 bucket. The game client retrieves profile statistics via read-heavy API queries and downloads patch files whenever a new update is released. Player traffic is highly distributed globally and spikes unpredictably. A solutions architect needs to design a high-performing content delivery and caching solution that minimizes latency for both assets and queries while reducing load on the database. Which two configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon CloudFront distribution with the Amazon S3 bucket as the origin to cache and serve the game patch files closer to users.; Implement an Amazon ElastiCache for Redis cluster in front of the Amazon RDS database to cache frequent and repetitive query results for player profiles.

Answer

To optimize performance, the solutions architect should configure an Amazon CloudFront distribution to cache static game patch files from the Amazon S3 bucket and deploy an Amazon ElastiCache for Redis cluster to cache read-heavy player profile queries from the Amazon RDS database.
The correct solution involves combining edge caching for static patch files via Amazon CloudFront and database query caching using Amazon ElastiCache for Redis. CloudFront brings static assets closer to the users, while ElastiCache speeds up repetitive database read queries, lowering overall latency and origin load.

Step-by-Step Solution

1
Analyze the requirements for static assets (patch files) and query latency.
Identify that the patch files are static and accessed globally, making them ideal for edge caching with Amazon CloudFront.
CloudFront reduces latency by caching files at edge locations closer to global users and prevents S3 from being overloaded.
2
Analyze the requirements for database read performance.
Identify that player profile queries are read-heavy and repetitive, which can be accelerated by an in-memory caching layer like Amazon ElastiCache.
ElastiCache handles high-throughput, low-latency reads, reducing the direct load on the Amazon RDS for PostgreSQL instance.
3
Evaluate the remaining options for design flaws or misconfigurations.
Discard options containing zero TTL configurations, incorrect read replica failover roles, and hot-key database partition designs.
These options introduce latency bottlenecks, violate proper failover architecture patterns, or cause operational throttling.

Key Concept

Multi-tier caching separates static content caching at the edge using CloudFront from database query acceleration using an in-memory database cache like ElastiCache.
Question 475Question →

A healthcare telemedicine platform processes patient consultation records in its primary AWS Region, us-east-1. The architecture consists of a containerized application running on Amazon EKS and a transactional database on Amazon RDS for PostgreSQL. To comply with national health regulations, the platform must implement a disaster recovery (DR) strategy in a secondary Region, us-west-2, with a Recovery Time Objective (RTO) of 10 minutes and a Recovery Point Objective (RPO) of 5 minutes. The strategy must also allow the company to perform quarterly DR drills in an isolated environment without affecting the production workload. Which of the following strategies meets these requirements while minimizing costs during normal operations?

Show answer & explanation

Answer: Migrate the database to Amazon Aurora PostgreSQL-Compatible Edition and configure an Aurora Global Database with the primary cluster in us-east-1 and a single-node secondary cluster in us-west-2. Deploy a scaled-down Amazon EKS cluster in us-west-2 with the minimum node capacity required to run core services. Configure Amazon Route 53 with failover routing. For quarterly drills, clone the secondary Aurora database cluster using the database cloning feature, and run testing workloads against the clone and the secondary EKS cluster.

Answer

Migrate the database to Amazon Aurora PostgreSQL-Compatible Edition, configure an Aurora Global Database with a single-node secondary cluster, deploy a scaled-down Amazon EKS cluster in the secondary Region, and use Aurora's database cloning feature for isolated testing.
Migrating the database to Amazon Aurora PostgreSQL and setting up an Aurora Global Database ensures sub-second replication lag, meeting the 5-minute RPO. Deploying a scaled-down EKS cluster (Warm Standby) keeps the control plane active and instances warmed up, allowing fast scaling within 10 minutes (meeting the RTO). Aurora's fast database cloning feature allows creating an isolated copy of the secondary database cluster in the DR region, which can be modified during drills without affecting production data replication.

Step-by-Step Solution

1
Analyze the RPO requirement of 5 minutes.
Determine that asynchronous cross-region database replication is required (data lag must be minimal). Daily backups copied to S3 Glacier are eliminated due to potential 24-hour data loss.
Ensures that data loss is within acceptable regulatory limits.
2
Analyze the RTO requirement of 10 minutes.
Rule out pilot light compute strategies with zero active nodes and cold recoveries from templates, since EC2 node instantiation, cluster registration, and container deployment exceed 10 minutes. A warm standby with active, scaled-down node groups is necessary.
Ensures the application can be scaled up and serve traffic within the RTO window.
3
Identify the mechanism for non-disruptive, isolated DR drills.
Recognize that Aurora Fast Database Cloning provides an instant, isolated, writeable database clone at no initial cost and without breaking cross-region replication. Promoting an RDS Read Replica is ruled out as it breaks replication and disrupts production.
Allows compliance validation without impacting production workload or failover readiness.

Key Concept

Disaster Recovery strategies (Warm Standby vs. Pilot Light) and Cross-Region replication configurations using Amazon Aurora Global Databases and database cloning.
Question 476Question →

A media company is planning a disaster recovery (DR) strategy on AWS. The solutions architect recommends implementing a Pilot Light strategy in a secondary AWS Region to achieve a low Recovery Time Objective (RTO) while keeping idle resource costs to a minimum.

Which of the following actions should the solutions architect take to implement this strategy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Replicate the primary database to a continuously running database instance in the secondary AWS Region to keep the data up to date.; Maintain application server configurations as Amazon Machine Images (AMIs) and launch the instances only during a failover event.

Answer

Replicate the primary database to a continuously running database instance in the secondary AWS Region, and maintain application server configurations as Amazon Machine Images (AMIs) to launch only during failover.
In a Pilot Light disaster recovery (DR) strategy, the data tier (such as the database) is kept running and continuously updated in the recovery region to minimize recovery time. Compute and application infrastructure are kept dormant or stored as configuration templates (like AMIs) to minimize idle running costs. These templates are only used to provision active instances when a failover is triggered.

Step-by-Step Solution

1
Identify the key constraints of a Pilot Light disaster recovery strategy.
Pilot Light requires databases (the 'pilot light') to be running and replicating data, while application servers and other compute infrastructure are kept turned off or defined as templates to minimize costs.
This establishes the baseline architectural pattern for Pilot Light, separating the data layer (always running/replicating) from the compute layer (decommissioned/dormant).
2
Evaluate the database tier configuration.
The database must be replicated to the recovery region in real-time or near real-time, requiring a running database instance to host and apply the replicated data.
This guarantees that the data is current and ready for use without lengthy restore operations from backups, keeping RTO low.
3
Evaluate the compute tier configuration.
Application servers should not be running. Instead, they should be prepared as AMIs or CloudFormation templates, ready to be provisioned only when a disaster is declared.
This satisfies the requirement to minimize idle compute cost, distinguishing Pilot Light from Warm Standby (where scaled-down servers are running).

Key Concept

Pilot Light Disaster Recovery Strategy
Question 477Question →

An enterprise application running on Amazon Elastic Kubernetes Service (EKS) requires access to two configuration settings: a database connection port (33063306) and a highly sensitive database password. The database password must be automatically rotated every 3030 days. The solutions architect must design a secure and cost-optimized solution that stores these parameters and supports the rotation requirement.

Which configuration management strategy should the solutions architect recommend?

Show answer & explanation

Answer: Store the database port as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation for the secret.

Answer

Store the database port as a String parameter in AWS Systems Manager Parameter Store, and store the database password in AWS Secrets Manager with automatic rotation configured.
Storing the non-sensitive database port as a String parameter in AWS Systems Manager Parameter Store is cost-effective because Standard parameters are free. AWS Secrets Manager is designed to secure sensitive credentials like database passwords and natively supports automatic credential rotation. This combination provides a secure and cost-optimized architecture that meets the rotation requirement.

Step-by-Step Solution

1
Analyze the security and rotation requirements for both configuration settings.
The database port (33063306) is non-sensitive and does not require encryption or rotation. The database password is highly sensitive and requires automatic rotation every 3030 days.
Separating parameters by security classification allows for a cost-effective design.
2
Select the storage mechanism for the non-sensitive configuration parameter.
Store the port as a standard String parameter in Systems Manager Parameter Store.
Standard parameters in Parameter Store are free of charge, minimizing operational costs for non-sensitive data.
3
Select the storage and rotation mechanism for the sensitive database credential.
Store the database password in AWS Secrets Manager and configure automatic rotation.
Secrets Manager provides native integration for rotating database credentials automatically, satisfying the compliance requirement securely.

Key Concept

Selecting and configuring secure storage and automatic rotation mechanisms for sensitive and non-sensitive configurations using Parameter Store and Secrets Manager.
Estimated Time:1m 30s
Question 478Question →

A company is deploying a new web application on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The solutions architect needs to ensure that the ALB only routes traffic to instances that are running the web service successfully, and that the ASG automatically terminates and replaces any instance where the web service has failed. Which two configurations should the solutions architect implement to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Set the Auto Scaling group health check type to ELB.; Configure the Application Load Balancer target group health check to monitor the specific port and path where the web application is running.

Answer

To meet the requirements, the solutions architect must set the Auto Scaling group health check type to ELB and configure the Application Load Balancer target group health check to monitor the specific port and path where the web application is running.
Configuring the Auto Scaling group to use ELB health checks ensures that the group will replace instances if they fail the application-level load balancer health checks. Configuring the Application Load Balancer target group health check to monitor the specific port and path where the web application is running ensures that the load balancer correctly identifies whether the application itself is healthy, rather than just the underlying EC2 instance.

Step-by-Step Solution

1
Determine how the Auto Scaling group monitors instance health.
By default, the Auto Scaling group only performs EC2 status checks (system and instance status checks), which do not detect if the web server process has crashed.
To ensure the Auto Scaling group replaces instances when the web application fails, the health check type must be updated to ELB.
2
Determine how the Application Load Balancer monitors application health.
The target group health check must be configured to query the specific port and path where the web application is active.
This ensures the load balancer accurately tracks application health and redirects traffic away from failed instances.

Key Concept

ELB and Auto Scaling Group Health Check Integration
Estimated Time:1m 0s
Question 479Question →

A fleet management system collects real-time telemetry from 20,00020,000 active vehicles. The data is ingested into an Amazon DynamoDB table. The application uses the current date (formatted as `YYYY-MM-DD`) as the partition key. During peak commuting hours, the application experiences frequent write throttling (`ProvisionedThroughputExceededException`), even though the total consumed capacity is well below the table's overall provisioned write capacity. Which design modification should a solutions architect implement to resolve this database performance bottleneck?

Show answer & explanation

Answer: Modify the partition key design to append a random integer suffix to the date, distributing the write operations across multiple physical partitions.

Answer

Modify the partition key design to append a random integer suffix to the date, distributing the write operations across multiple physical partitions.
The correct option outlines write sharding. By appending a random integer suffix to the date partition key, the writes are spread across multiple physical partitions. This distributes the high write rate and stays well within individual partition limits.

Step-by-Step Solution

1
Analyze the cause of the write throttling.
Since all writes for a given day use the same partition key (`YYYY-MM-DD`), they are routed to the same physical partition in DynamoDB. Individual partition throughput is capped at 1,0001,000 Write Capacity Units (WCUs) per second.
This is a classic 'hot partition' problem where total provisioned capacity is sufficient but partition-level limits are exceeded.
2
Select an optimization technique that distributes writes.
Adding a random suffix (e.g., 11 to 1010) to the partition key (creating values like `2026-07-15.1`, `2026-07-15.2`) distributes the writes across up to 10 different partition keys.
This write sharding technique increases the effective write throughput limits for the daily ingestion partition.
3
Validate against alternative database configurations.
Alternative approaches either fail to solve the partitioning bottleneck or introduce incorrect replication architectures.
Ensures the selected partition strategy is the most performant and correct solution.

Key Concept

Write Sharding / Synthetic Partition Keys in DynamoDB
Question 480Question →

A financial services company is deploying a distributed, real-time fraud detection engine on a fleet of Amazon EC2 instances. The engine requires high-throughput, low-latency node-to-node communication for parallel transaction analysis. The instances are registered with an Application Load Balancer (ALB). The fraud detection service listens on a custom port 8085, while a standard system logging daemon runs on port 80. The solutions architect needs to configure the environment to minimize inter-node network latency and ensure that the ALB only routes traffic to instances where the fraud detection service is actively running. Which two actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Launch the EC2 instances in a cluster placement group.; Configure the ALB target group health check to perform HTTP or TCP checks on port 8085.

Answer

To meet the performance and health monitoring requirements, launch the EC2 instances in a cluster placement group to achieve low-latency communication, and configure the Application Load Balancer target group health check to monitor port 8085 to verify the actual application status.
Launching the EC2 instances in a cluster placement group ensures they are located physically close to one another on the same underlying network fabric, yielding the lowest possible inter-node latency. Configuring the ALB target group health check to query the custom service port (8085) ensures that instances are marked as healthy only when the actual fraud detection service is running.

Step-by-Step Solution

1
Select the correct placement group configuration for low-latency node-to-node networking.
Identify that a cluster placement group is required because it packs instances close together within a single Availability Zone, enabling high-performance networking.
Spread and partition placement groups are meant for reliability and high availability across different physical hardware racks, which increases latency.
2
Determine the correct target group health check port configuration.
Configure the target group to perform health checks on the application port (8085) rather than the logging daemon port (80).
If the health check is set to the default port (80), the load balancer will continue routing traffic to the instance even if the fraud detection engine on port 8085 fails.

Key Concept

Low-latency compute node orchestration using cluster placement groups coupled with service-aligned load balancer health checks.
PreviousPage 24 / 74Next
All practice questions — AWS Certified Solutions Architect - Associate | Examkin