Amazon Practice Questions, Discussions & Exam Topics by our Authors
A company is migrating five on-premises applications to VPCs in the AWS Cloud. Each application is currently deployed in isolated virtual networks on premises and should be deployed similarly in the AWS Cloud. The applications need to reach a shared services VPC. All the applications must be able to communicate with each other.
If the migration is successful, the c...
Key Requirements:
- Five on-premises applications need to be migrated to isolated VPCs in AWS.
- All applications must reach a shared services VPC and communicate with each other.
- The solution needs to scale for the migration of over 100 applications in the future with minimal administrative overhead.
Option A: Deploy software VPN tunnels between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC.
- Scalability: Managing VPN tunnels between every application VPC and the shared services VPC becomes complex as the number of VPCs grows. For more than 100 VPCs, the administrative overhead of managing multiple VPN tunnels and route configurations increases significantly.
- Administrative Overhead: This solution would require continuous management of VPN tunnels, including encryption keys and tunnel health checks, along with routing updates as new VPCs are added.
- Conclusion: This option does not scale well and would become difficult to manage as the number of applications increases.
Option B: Deploy VPC peering connections between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC through the peering connection.
- Scalability: While VPC peering can work well for small numbers of VPCs, as the number of VPCs increases, it requires the creation of many peering connections. Each new VPC would need to be peered with every other VPC that needs communication, which leads to a full mesh of peering relationships.
- Administrative Overhead: Managing a full mesh of peering connections becomes increasingly complex and error-prone as the number of VPCs grows. You also need to manage the route tables for each VPC and ensure that they correctly reflect the peering connections.
- Conclusion: This option will lead to high administrative overhead and complexity as the network grows, making it less suitable for scaling with hundreds of applications.
Option C: Deploy an AWS Direct Connect connection between the application VPCs and the shared services VPC. Add routes from the application VPCs in their subnets ...
Author: Maya · Last updated Aug 7, 2026
A company wants to use Amazon Elastic Container Service (Amazon ECS) to run its on-premises application in a hybrid environment. The application currently runs on containers on premises.
The company needs a single container solution that can scale in an on-premises, hybrid, or cloud environment. The company must run new application con...
Key Requirements:
- The company wants to run its on-premises application in a hybrid environment using Amazon ECS.
- The application must run on containers in both on-premises and cloud environments.
- The solution must scale for both on-premises and cloud environments.
- HTTP traffic must be managed using a load balancer.
Option A: Set up an ECS cluster that uses the AWS Fargate launch type for the cloud application containers. Use an Amazon ECS Anywhere external launch type for the on-premises application containers.
- ECS Fargate (cloud): Fargate is ideal for serverless container orchestration, meaning you don't need to manage EC2 instances directly. It scales automatically and is well-suited for cloud-based containers.
- ECS Anywhere (on-premises): ECS Anywhere allows the management of on-premises containers as part of an ECS cluster. This makes it an appropriate solution for hybrid environments. The on-premises containers will still be part of the ECS cluster and can be managed centrally.
- Load Balancer: Using a load balancer (whether an Application Load Balancer or Network Load Balancer) will be compatible with this setup.
- Conclusion: This option is ideal because it uses ECS Fargate for cloud containers (scalable and easy to manage) and ECS Anywhere for on-premises containers, providing a seamless hybrid environment.
Option B: Set up an Application Load Balancer for cloud ECS services.
- Suitability: The Application Load Balancer is a good choice for managing HTTP/HTTPS traffic in the cloud environment. It can distribute traffic to ECS tasks running in the cloud (Fargate or EC2 instances).
- Limitation: This option only addresses the cloud environment. It doesn’t handle the hybrid nature of the application (on-premises + cloud) and doesn’t address the scaling of on-premises containers.
- Conclusion: While useful for cloud-based ECS services, this option does not meet the requirement for a hybrid environment where both on-premises and cloud containers need to be managed together.
Option C: Set up a Network Load Balancer for cloud ECS services.
- Suitability: A Network Load Balancer (NLB) is suitable for managing traffic to applications that require low-latency or TCP/UDP traffic. It can be used with E...
Author: Emma · Last updated Aug 7, 2026
A company is migrating its workloads to AWS. The company has sensitive and critical data in on-premises relational databases that run on SQL Server instances.
The company wants to use the AWS Cloud to increase security an...
To select the most suitable solution, let's analyze each option based on the company’s goal of increasing security and reducing operational overhead for sensitive and critical data in on-premises SQL Server databases.
A) Migrate the databases to Amazon EC2 instances. Use an AWS Key Management Service (AWS KMS) AWS managed key for encryption.
- Reasoning: Using EC2 instances to run SQL Server would essentially replicate the on-premises setup in the cloud. While you can control the EC2 instances and use AWS KMS for encryption, this option would still require the company to manage the underlying operating system, patches, SQL Server configurations, backups, and high availability. This would not significantly reduce operational overhead compared to the on-premises solution, as the company would still be responsible for a large portion of the infrastructure.
- Rejected because: The need to manage EC2 instances and SQL Server configurations would result in high operational overhead. Additionally, while encryption is provided by KMS, this doesn't necessarily increase security over a managed service.
B) Migrate the databases to a Multi-AZ Amazon RDS for SQL Server DB instance. Use an AWS Key Management Service (AWS KMS) AWS managed key for encryption.
- Reasoning: Amazon RDS (Relational Database Service) for SQL Server provides a fully managed database service, meaning AWS handles patching, backups, high availability, and other administrative tasks. Using Multi-AZ deployments ensures high availability and data durability, automatically replicating data between availability zones for fault tolerance. RDS also supports AWS KMS for encryption, ensuring that sensitive data is encrypted both at rest and in transit.
- Advantages: This option significantly reduces operational overhead by automating management tasks like patching and backups. It also enhances security through encryption and ensures high availability with Multi-AZ. This is ideal for workloads that require security, high availability, and reduc...
Author: Elizabeth · Last updated Aug 7, 2026
A company wants to migrate an application to AWS. The company wants to increase the application's current availability. The company wants to use AWS WAF in the appl...
To select the best solution, we need to evaluate the requirements: increasing the application's availability and using AWS WAF in the architecture.
A) Create an Auto Scaling group that contains multiple Amazon EC2 instances that host the application across two Availability Zones. Configure an Application Load Balancer (ALB) and set the Auto Scaling group as the target. Connect a WAF to the ALB.
- Reasoning: This option provides high availability by distributing the EC2 instances across multiple Availability Zones using Auto Scaling, which automatically adjusts the number of instances based on load. The Application Load Balancer (ALB) will distribute traffic across the EC2 instances, and the AWS WAF can be connected to the ALB to filter and protect the traffic. This setup increases both availability and security, aligning well with the company's goals.
- Selected because: It ensures high availability and scalability with Auto Scaling and ALB, while also integrating AWS WAF for enhanced security.
B) Create a cluster placement group that contains multiple Amazon EC2 instances that host the application. Configure an Application Load Balancer and set the EC2 instances as the targets. Connect a WAF to the placement group.
- Reasoning: A placement group is a way to control the placement of EC2 instances within a single Availability Zone to meet low-latency or high-throughput needs. However, it does not provide automatic scaling or high availability across multiple Availability Zones. Using a placement group would not increase availability as effectively as an Auto Scaling group across multiple Availability Zones. AWS WAF cannot be directly associated with a placement group; it can only be associated with an ALB or CloudFront distribution.
- Rejected because: This solution doesn’t improve availability across multiple Availability Zones and cannot integrate WAF with the placement group. It's less suitable for high-availability scenarios.
...
Author: Emma · Last updated Aug 7, 2026
A company manages a data lake in an Amazon S3 bucket that numerous applications access. The S3 bucket contains a unique prefix for each application. The company wants to restrict each application to its specific prefix and to have granular control of the ...
To meet the company's goal of restricting each application to its specific prefix in the S3 bucket with granular control and minimal operational overhead, let's evaluate the provided options:
A) Create dedicated S3 access points and access point policies for each application.
- Reasoning: S3 access points are designed to provide fine-grained access control to specific parts of an S3 bucket (like prefixes) for different applications. Each access point can be restricted to a specific prefix in the bucket, and access can be controlled using policies. This allows for granular control over the objects under each prefix with minimal operational overhead. Each application would access its specific data using its corresponding access point, making it easy to manage permissions.
- Advantages: This approach is simple, scalable, and reduces operational overhead. By using access points and policies, access to each prefix can be tightly controlled without needing to replicate data or set complex access control lists (ACLs).
- Selected because: It meets the requirements directly and efficiently, with the least operational overhead and easy management.
B) Create an S3 Batch Operations job to set the ACL permissions for each object in the S3 bucket.
- Reasoning: S3 Batch Operations allow you to perform bulk operations on objects within the S3 bucket, such as setting ACLs. However, using batch jobs to manage ACLs would require creating and maintaining ACLs for each object, which is more error-prone and requires more ongoing management. It also doesn't provide the granularity of access control needed for specific prefixes in an efficient way.
- Rejected because: While this solution can provide some level of access control, it is not the most efficient approach and adds unnecessary complexity in managing individual object-level ACLs, especially as the number of o...
Author: Siddharth · Last updated Aug 7, 2026
A company has an application that customers use to upload images to an Amazon S3 bucket. Each night, the company launches an Amazon EC2 Spot Fleet that processes all the images that the company received that day. The processing for each image takes 2 minutes and requires 512 MB of memory.
A solutions architect needs to ch...
Let's evaluate each of the options based on the requirement of processing images immediately when uploaded, while being cost-effective.
A) Use S3 Event Notifications to write a message with image details to an Amazon Simple Queue Service (Amazon SQS) queue. Configure an AWS Lambda function to read the messages from the queue and to process the images.
- Reasoning: This solution uses S3 event notifications to trigger an action whenever a new image is uploaded. The message containing the image details is sent to an SQS queue. An AWS Lambda function can then read from the queue and process the image. Lambda is well-suited for this use case since it is serverless, scales automatically with the load, and charges based on execution time, making it very cost-effective for workloads that require short processing times, like image processing (2 minutes per image).
- Advantages: Lambda is highly scalable, cost-efficient (since you're only charged for execution time), and can easily handle the processing for each image. SQS ensures reliable message delivery.
- Selected because: This solution meets the requirements with minimal cost and management overhead. It leverages serverless computing (Lambda), which is perfect for handling event-driven processing like image uploads.
B) Use S3 Event Notifications to write a message with image details to an Amazon Simple Queue Service (Amazon SQS) queue. Configure an EC2 Reserved Instance to read the messages from the queue and to process the images.
- Reasoning: This option involves using EC2 instances (with Reserved Instances) to process the images. While Reserved Instances may reduce costs for long-term EC2 usage, it still requires the company to manage and maintain the EC2 instances, which adds operational overhead. Additionally, EC2 instances are more expensive than Lambda for this use case, especially for short-lived, event-driven tasks.
- Rejected because: This solution introduces unnecessary complexity and cost. Reserved Instances are intended for consistent, long-term workloads, and they would be more costly compared to Lam...
Author: Ethan · Last updated Aug 7, 2026
A company wants to improve the availability and performance of its hybrid application. The application consists of a stateful TCP-based workload hosted on Amazon EC2 instances in different AWS Regions and a stateless UDP-based workload hosted on premises.
Whic...
To improve the availability and performance of the hybrid application, let's analyze each of the options:
A) Create an accelerator using AWS Global Accelerator. Add the load balancers as endpoints.
- Reasoning: AWS Global Accelerator is designed to improve the availability and performance of applications with global users. By using Global Accelerator, traffic can be routed to the closest AWS Region based on health checks and routing policies, improving both availability and performance. Global Accelerator works well for TCP-based applications, such as the stateful workload running on EC2 instances. It can route traffic to both the EC2 endpoints in different AWS Regions and the on-premises endpoints if needed. This would improve both the performance (due to low-latency routing) and availability (by ensuring high availability of endpoints).
- Selected because: This is a great option for improving availability and performance across multiple AWS Regions. It also works well for TCP workloads.
B) Create an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the load balancers.
- Reasoning: CloudFront is a content delivery network (CDN) optimized for static content, but it is not typically used for TCP-based stateful workloads. While Route 53 can perform latency-based routing, CloudFront does not natively support TCP load balancing, especially for stateful applications. Therefore, this option would not be as suitable for the TCP-based workload that requires stateful connections.
- Rejected because: CloudFront is more suited for static content and does not handle TCP connections in the same way as a load balancer would. It's not the best fit for stateful TCP workloads.
C) Configure two Application Load Balancers in each Region. The first will route to the EC2 endpoints, and the second will route to the on-premises endpoints.
- Reasoning: Application Load Balancers (ALBs) are designed for HTTP and HTTPS traffic, making them a good fit for stateless UDP-based workloads. However, since the UDP-based workload is on-premises and the EC2 workload is TCP-based, this configuration introduces unnecessary complexity an...
Author: Isabella · Last updated Aug 7, 2026
A company runs a self-managed Microsoft SQL Server on Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS). Daily snapshots are taken of the EBS volumes.
Recently, all the company's EBS snapshots were accidentally deleted while running a snapshot cleaning script that deletes all expired EBS snapshots. A solutions architect needs to update the arch...
To meet the requirement of preventing data loss without retaining EBS snapshots indefinitely, let's evaluate each option based on the key factors: simplicity, cost, development effort, and scalability.
A) Change the IAM policy of the user to deny EBS snapshot deletion.
- Pros: This is a simple and low-cost solution since it involves updating IAM policies.
- Cons: While this prevents deletion of EBS snapshots by the user, it does not address the issue of keeping snapshots for a reasonable period of time. It merely blocks accidental deletions but does not automate snapshot management or retention, which is crucial in this case.
- Use case: This could be used in scenarios where preventing deletion is important, but there’s still a need for manual snapshot retention policies.
B) Copy the EBS snapshots to another AWS Region after completing the snapshots daily.
- Pros: This provides a level of disaster recovery by having snapshots in a separate region. It adds some protection against region-specific issues.
- Cons: This requires setting up cross-region replication, which could add complexity and increase costs. Additionally, it doesn’t address the need for managing snapshot retention or automating the cleanup of old snapshots. It introduces more development effort for automation.
- Use case: This could be used for disaster recovery purposes, but it doesn't specifically address the issue of ensuring snapshots aren’t deleted prematurely or ensuring that retention policies are adhered to.
C) Create a 7-day EBS snapshot retention rule in Recycle Bin and apply the rule for all snapshots.
- Pros: The Recycle Bin feature allows snapshots to be retained for a specified period (in this case, 7 days) before they are permanently dele...
Author: Ryan · Last updated Aug 7, 2026
A company wants to use an AWS CloudFormation stack for its application in a test environment. The company stores the CloudFormation template in an Amazon S3 bucket that blocks public access. The company wants to grant CloudFormation access to the template in the S3 bucket based on specific user request...
To meet the requirements of granting CloudFormation access to an S3 bucket that blocks public access while maintaining security best practices, we need to carefully evaluate each option based on factors such as security, ease of implementation, and suitability for temporary access.
A) Create a gateway VPC endpoint for Amazon S3. Configure the CloudFormation stack to use the S3 object URL.
- Pros: A VPC endpoint for S3 allows private communication between the VPC and S3, which means no traffic goes over the internet. This maintains security by not exposing S3 to the public internet.
- Cons: This option doesn’t address the specific requirement for granting temporary access to CloudFormation based on user requests. The VPC endpoint is generally used for secure communication between EC2 instances in a VPC and S3, not for granting temporary access to CloudFormation. Additionally, configuring CloudFormation to use the S3 URL may still require more manual steps, and it doesn't solve the problem of controlled, temporary access.
- Use case: This is suitable for environments where you want private communication between EC2 instances and S3, but it’s not ideal for granting temporary access to CloudFormation.
B) Create an Amazon API Gateway REST API that has the S3 bucket as the target. Configure the CloudFormation stack to use the API Gateway URL.
- Pros: Using API Gateway could allow for more complex, controlled access to the S3 bucket.
- Cons: This approach is unnecessarily complex. You would need to set up an API Gateway with proper security configurations (IAM roles, Lambda, etc.), which adds overhead and development effort. Also, it doesn't directly address the need for temporary, specific access by CloudFormation. Furthermore, this increases complexity and potentially introduces more points of failure.
- Use case: This option would be better if you needed to create a custom API to handle S3 access or transform data between S3 and CloudFormation, but it introduces unnecessary complexity for this specific scenario.
C) Create a ...
Author: Chloe · Last updated Aug 7, 2026
A company has applications that run in an organization in AWS Organizations. The company outsources operational support of the applications. The company needs to provide access for the external support engineers without compromising security.
The external support engineers need access to the AWS Management Console. The external support engineers also need operating sy...
To meet the requirements of providing external support engineers with access to both the AWS Management Console and EC2 instances in a secure and efficient manner, let’s analyze the given options based on security, ease of implementation, and best practices.
A) Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use AWS IAM Identity Center to provide the external support engineers console access. Use Systems Manager Session Manager to assign the required permissions.
- Pros:
- No need for direct SSH access: This approach avoids exposing the EC2 instances to the internet by using Systems Manager (SSM) for access, which is secure and managed.
- Centralized console access: IAM Identity Center provides secure, centralized management for console access to external support engineers.
- No additional key management: SSM eliminates the need for managing SSH keys and credentials on individual instances.
- Security best practices: Using SSM and IAM Identity Center adheres to security best practices, as it does not rely on SSH, and there is no direct network access needed to the instances.
- Cons: This solution requires ensuring that the SSM Agent is installed on all instances and that the necessary IAM policies are in place. However, this is generally a best practice for managing EC2 instances.
- Use case: Ideal when secure access is required without the need for SSH access to the EC2 instances, and when centralized management of user access is needed through IAM Identity Center.
B) Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use Systems Manager Session Manager to provide local IAM user credentials in each AWS account to the external support engineers for console access.
- Pros:
- SSM is used to provide access to instances, which is secure and scalable.
- Cons:
- Providing local IAM user credentials for console access is a security risk as it requires managing individual IAM users for each support engineer across all accounts. This is more complex and increases the attack surface.
- It’s less efficient and harder to scale than using IAM Identity Center, which can manage access across multiple accounts with a single set of credentials.
- Use case: This approach might work in isolated scenarios, but it does not follow security best practices as well as using IAM Identity Center.
C) Confirm that all instances have a security group that allows SSH access only from the external support engineers’ source IP address ra...
Author: Ravi Patel · Last updated Aug 7, 2026
A company uses Amazon RDS for PostgreSQL to run its applications in the us-east-1 Region. The company also uses machine learning (ML) models to forecast annual revenue based on near real-time reports. The reports are generated by using the same RDS for PostgreSQL database. The database performance slows during b...
To improve database performance, it's essential to reduce the load on the primary database instance during business hours when reports are being generated. Let's analyze the solutions based on their cost-effectiveness, simplicity, and ability to meet the requirements:
A) Create a cross-Region read replica. Configure the reports to be generated from the read replica.
- Pros: A cross-Region read replica could offload reporting tasks from the primary database, improving performance. However, cross-region replication introduces significant latency due to data transfer between regions.
- Cons: Cross-Region replication incurs additional costs for inter-region data transfer, and the added latency between the primary region and the replica might be a concern for near real-time reporting. Also, this solution is not cost-effective because of the complexity and the cost of transferring data across regions.
- Use case: This might be appropriate if there were strict requirements to have a replica in a different region, but it is not the best option for performance improvement in this case due to latency and cost concerns.
B) Activate Multi-AZ DB instance deployment for RDS for PostgreSQL. Configure the reports to be generated from the standby database.
- Pros: Multi-AZ deployments improve availability and disaster recovery but do not directly address performance concerns during peak business hours. The standby instance is meant to be a failover, not for read queries, and it would not offload reporting traffic effectively.
- Cons: This option increases costs because it involves duplicating resources for high availability but does not provide a solution to offload read traffic. Multi-AZ is primarily for fault tolerance and cannot be used to scale read capacity during high load.
- Use case: Suitable for improving availability but not performance under normal load conditions.
C) Use AWS Data Migration Service (AWS DMS) to logically replicate data to a new database. Configure the reports to be generated from the new databas...
Author: Krishna · Last updated Aug 7, 2026
A company hosts its multi-tier, public web application in the AWS Cloud. The web application runs on Amazon EC2 instances, and its database runs on Amazon RDS. The company is anticipating a large increase in sales during an upcoming holiday weekend. A solutions architect needs to build a solution to analyze the performan...
To analyze the performance of a web application with a granularity of no more than 2 minutes, we need a solution that provides real-time or near-real-time monitoring and analysis. Let's evaluate the options based on cost, ease of implementation, and ability to meet the granularity requirement.
A) Send Amazon CloudWatch logs to Amazon Redshift. Use Amazon QuickSight to perform further analysis.
- Pros: Redshift can handle large volumes of data and is suitable for running complex queries for analysis. QuickSight integrates well with Redshift for visualizing data.
- Cons: Sending CloudWatch logs to Redshift requires a more complex setup. Additionally, CloudWatch logs are generally not designed for real-time analysis; they typically have a delay in log delivery and processing. This approach may not meet the requirement for granularity of 2 minutes and could introduce latency.
- Use case: This option is useful for deep, historical data analysis on large datasets, but it’s not ideal for near real-time monitoring with granular intervals.
B) Enable detailed monitoring on all EC2 instances. Use Amazon CloudWatch metrics to perform further analysis.
- Pros: CloudWatch detailed monitoring provides a 1-minute granularity, which is within the required 2-minute granularity. This allows you to monitor EC2 instance performance metrics such as CPU utilization, memory, disk I/O, and network I/O in near real time.
- Cons: This solution focuses on EC2 instance metrics but does not directly address application-level performance or database metrics. However, for the purposes of general EC2 performance analysis, this is a very cost-effective and simple solution.
- Use case: Ideal when you need to analyze EC2 instance performance at fine granularity, such as CPU or memory utilization, with minimal setup.
C) Create an AWS Lambda function to fetch EC2 logs from Amazon CloudWatch Logs. Use Amazon CloudWatch metrics to p...
Author: Olivia · Last updated Aug 7, 2026
A company runs an application that stores and shares photos. Users upload the photos to an Amazon S3 bucket. Every day, users upload approximately 150 photos. The company wants to design a solution that creates a thumbnail of each new photo and store...
Let's analyze each option based on cost-effectiveness, scalability, and how well it aligns with the requirements of the company.
A) Configure an Amazon EventBridge scheduled rule to invoke a script every minute on a long-running Amazon EMR cluster. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket.
- Reasoning:
- Cost: Running a long-running EMR cluster 24/7 to check for new uploads would likely incur higher costs due to the cluster's compute resources being continuously available.
- Scalability: While EMR can scale, this approach is overkill for the small, predictable number of new uploads (150 photos daily) and doesn't justify the operational overhead.
- Latency: This solution has higher latency since it only runs once per minute, which isn't ideal for real-time photo processing.
- Rejection: This option is less cost-effective because of the continuous operation of an EMR cluster, which introduces unnecessary costs and complexity for the task.
B) Configure an Amazon EventBridge scheduled rule to invoke a script every minute on a memory-optimized Amazon EC2 instance that is always on. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket.
- Reasoning:
- Cost: Like option A, this involves running an EC2 instance continuously, which may incur higher costs than needed. The instance needs to be always on to check for uploads and generate thumbnails, leading to inefficient resource usage.
- Scalability: EC2 instances can scale, but for 150 photos per day, an EC2 instance running constantly would not be an optimal solution.
- Latency: The solution runs on a fixed schedule (every minute), which may not be ideal for handling the new photos immediately after upload.
- Rejection: This option has higher costs compared to serverless solutions and does not offer efficient scaling.
C) Configure an S3 event notification to invoke an AWS Lambda function each time a user uploads a new photo to the application...
Author: Amira · Last updated Aug 7, 2026
A company has stored millions of objects across multiple prefixes in an Amazon S3 bucket by using the Amazon S3 Glacier Deep Archive storage class. The company needs to delete all data older than 3 years except for a subset of data that must be retained. The company has identified th...
Let's analyze each option based on the requirements: deleting all data older than 3 years except for a subset of data to be retained, while implementing a serverless solution. We will focus on cost-effectiveness, scalability, ease of use, and how well each solution meets the needs of deleting objects in an S3 Glacier Deep Archive storage class.
A) Use S3 Inventory to list all objects. Use the AWS CLI to create a script that runs on an Amazon EC2 instance that deletes objects from the inventory list.
- Reasoning:
- Cost: Running an EC2 instance to execute a script introduces unnecessary costs, as you'd need to manage and run the EC2 instance constantly.
- Scalability: EC2-based solutions are not serverless and require manual scaling. Handling millions of objects with a script could become cumbersome and difficult to manage, especially as the dataset grows.
- Latency: The deletion process may not be fully automated and real-time.
- Rejection: This option involves managing EC2 instances, which contradicts the goal of implementing a serverless solution. It introduces unnecessary complexity and overhead for large-scale object deletions.
B) Use AWS Batch to delete objects older than 3 years except for the data that must be retained.
- Reasoning:
- Cost: AWS Batch provides serverless compute for batch jobs, but it is generally more suited for large-scale compute-intensive processing. Deleting objects from an S3 bucket is not compute-intensive, making AWS Batch a more complex and costlier solution than needed.
- Scalability: While AWS Batch is scalable, it requires job definitions and infrastructure management, which is more complex than a straightforward serverless approach.
- Latency: The batch jobs are not real-time and would process in intervals.
- Rejection: AWS Batch is not a natural fit for this use case. The requirement here is to delete S3 objects, which can be done much more efficiently and cost-effectively with serverless services like Lambda or S3 Batch Operations.
C) ...
Author: Leah Davis · Last updated Aug 7, 2026
A company is building an application on AWS. The application uses multiple AWS Lambda functions to retrieve sensitive data from a single Amazon S3 bucket for processing. The company must ensure that only authorized Lambda functions can access the data. T...
Let's analyze the options based on the requirement to ensure that only authorized Lambda functions can access sensitive data in an S3 bucket while adhering to the principle of least privilege.
A) Grant full S3 bucket access to all Lambda functions through a shared IAM role.
- Reasoning:
- Security: This approach violates the principle of least privilege because it gives all Lambda functions full access to the S3 bucket, regardless of which specific Lambda function actually needs the data.
- Management: Using a shared IAM role for multiple Lambda functions could lead to a security risk, as it would be difficult to enforce fine-grained access control.
- Rejection: This option is not secure because it grants broad access to all Lambda functions, including those that may not need access to the S3 bucket. It doesn't minimize the permissions for each Lambda function.
B) Configure the Lambda functions to run within a VPC. Configure a bucket policy to grant access based on the Lambda functions' VPC endpoint IP addresses.
- Reasoning:
- Complexity: This solution adds unnecessary complexity by requiring the Lambda functions to run within a VPC and relying on VPC endpoint IP addresses for access control.
- Scalability: If there are multiple Lambda functions, managing access based on IP addresses can become difficult to scale and maintain.
- Security: Using VPC endpoint IP addresses to control access is not the most robust or straightforward solution, as IP addresses can be less precise and harder to manage in the long term.
- Rejection: While this option provides a way to restrict access, it complicates the setup unnecessarily and doesn't provide the simplest or most secure method for restricting S3 access based on Lambda functions.
C) Create individual IAM roles for each Lambda function. Grant the IAM roles access to the S3 bucket. Assign each IAM role as the Lambda execution role for its corresponding Lambda function.
- Reasoning:
- Security...
Author: Henry · Last updated Aug 7, 2026
A company has developed a non-production application that is composed of multiple microservices for each of the company's business units. A single development team maintains all the microservices.
The current architecture uses a static web frontend and a Java-based backend that contains the application logic. The architecture also uses a MySQL database that the company hosts on an Amazon EC2 insta...
Let's evaluate each option based on the company's requirements: ensuring security, global availability, and minimizing operational overhead.
A) Use Amazon CloudFront and AWS Amplify to host the static web frontend. Refactor the microservices to use AWS Lambda functions that the microservices access by using Amazon API Gateway. Migrate the MySQL database to an Amazon EC2 Reserved Instance.
- Reasoning:
- CloudFront and AWS Amplify: CloudFront provides global content delivery, and AWS Amplify is great for managing static web frontends. However, Amplify is generally intended for smaller or serverless applications and may not be ideal for a large-scale, enterprise-level microservice architecture.
- Lambda and API Gateway: Refactoring microservices to use AWS Lambda and API Gateway aligns with serverless principles and offers good scalability and reduced operational overhead.
- EC2 Reserved Instance for MySQL: While EC2 Reserved Instances could provide savings, this introduces higher operational overhead because managing a MySQL database on EC2 requires more effort in terms of scaling, patching, backups, and availability. Additionally, it doesn't leverage the managed database service benefits like automatic backups and scaling.
- Rejection: The use of EC2 for MySQL doesn't align with minimizing operational overhead, as it requires more management compared to a fully managed database solution like Amazon RDS.
B) Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the microservices to use AWS Lambda functions that the microservices access by using Amazon API Gateway. Migrate the MySQL database to Amazon RDS for MySQL.
- Reasoning:
- CloudFront and S3: CloudFront for global distribution and S3 for hosting a static web frontend are optimal choices to ensure low latency and global availability.
- Lambda and API Gateway: Refactoring to serverless architecture using Lambda and API Gateway offers scalability, low operational overhead, and easy maintenance.
- RDS for MySQL: Moving the MySQL database to Amazon RDS for MySQL eliminates the operational overhead of managing MySQL on EC2, as RDS takes care of patching, scaling, backups, and high availability.
- Selection: This option minimizes operational overhead while maintaining scalability and global availability, making i...
Author: Amira · Last updated Aug 7, 2026
A video game company is deploying a new gaming application to its global users. The company requires a solution that will provide near real-time reviews and rankings of the players.
A solutions architect must design a solution to provide fast access to the data. The solution must also ensure the data persists on disks ...
Let's evaluate each option based on the need to provide fast access to player data, ensure data persistence, and minimize operational overhead.
A) Configure an Amazon CloudFront distribution with an Amazon S3 bucket as the origin. Store the player data in the S3 bucket.
- Reasoning:
- CloudFront and S3: CloudFront is used for content delivery and would help with globally distributing the data. However, S3 is designed for object storage and is not optimized for real-time applications like player rankings and reviews, which require fast read and write access.
- Latency: Accessing player data from S3 is typically slower than from an in-memory data store, as S3 is optimized for durability and cost, not for low-latency access.
- Data Persistence: S3 does provide data persistence, but it is not suited for the need to constantly read and write real-time data with low latency.
- Rejection: S3 is not ideal for fast, real-time access to player data, and while it provides data persistence, it doesn't meet the performance requirements for real-time player reviews and rankings.
B) Create Amazon EC2 instances in multiple AWS Regions. Store the player data on the EC2 instances. Configure Amazon Route 53 with geolocation records to direct users to the closest EC2 instance.
- Reasoning:
- EC2 Instances: Using EC2 instances for data storage introduces significant operational overhead because the company would need to manage EC2 instances, disk storage, scaling, patching, and backups.
- Global Distribution: While EC2 instances in multiple regions can help with low latency, managing data consistency across regions becomes challenging and requires additional tools like database replication, leading to more complexity.
- Latency: While EC2 instances in different regions would reduce latency by directing users to the closest region, managing and ensuring data persistence across regions would require complex configurations like database replication or distributed storage systems.
- Rejection: This solution introduces unnecessary complexity and high operational overhead compared to more streamlined services like ElastiCache or managed databases.
C) Deploy an Amazon ElastiCache ...
Author: Rohan · Last updated Aug 7, 2026
A company is designing an application on AWS that processes sensitive data. The application stores and processes financial data for multiple customers.
To meet compliance requirements, the data for each customer must be encrypted separately at rest by using a secure, centralized key management solution. The company wants to use A...
Let's evaluate each of the options and see which meets the requirements of encrypting data separately for each customer using a centralized key management solution, while minimizing operational overhead:
Option A: Generate a unique encryption key for each customer. Store the keys in an Amazon S3 bucket. Enable server-side encryption.
- Rejection Reasoning: Storing the keys in an Amazon S3 bucket introduces additional operational complexity and risk. S3 is not specifically designed for key management, and storing sensitive keys in S3 would require additional controls for access management, encryption of the keys themselves, and audit logging. It does not provide a centralized, managed, and compliant solution for encryption at scale.
- Why this option is not suitable: It lacks the centralization and automated management capabilities of AWS KMS, increasing the operational burden for key management.
Option B: Deploy a hardware security appliance in the AWS environment that securely stores customer-provided encryption keys. Integrate the security appliance with AWS KMS to encrypt the sensitive data in the application.
- Rejection Reasoning: Deploying a hardware security appliance introduces significant overhead in terms of hardware management, maintenance, and compliance. The integration with AWS KMS adds complexity and cost. This approach is more suited for extremely high-security environments requiring hardware-based key storage, which is beyond the compliance requirements in the question.
- Why this option is not suitable: It involves unnecessary operational overhead, additional costs, and complexity for key management, which is not needed in this scenario.
Option C: Create a single AWS KMS key to encrypt all sensitive data across the application.
- Rejection Re...
Author: Elijah · Last updated Aug 7, 2026
A company needs to design a resilient web application to process customer orders. The web application must automatically handle increases in web traffic and application usage without affecting the custom...
Let's evaluate the options based on the requirement of a resilient web application that can handle increases in web traffic and process customer orders without affecting the customer experience or losing data.
Option A: Use a NAT gateway to manage web traffic. Use Amazon EC2 Auto Scaling groups to receive, process, and store processed customer orders. Use an AWS Lambda function to capture and store unprocessed orders.
- Rejection Reasoning:
- NAT Gateway Misuse: A NAT gateway is typically used to enable outbound internet access from private subnets. It is not suitable for managing web traffic, as it does not provide load balancing or traffic distribution functionality.
- AWS Lambda for Capturing Orders: AWS Lambda could be used for small-scale processing tasks, but it isn't typically ideal for capturing and storing unprocessed orders at high traffic volumes. It lacks durability in this scenario, as Lambda functions are designed for short-lived tasks.
- EC2 Auto Scaling: While Auto Scaling helps with scaling EC2 instances, it requires more management and doesn't inherently solve traffic distribution. Using EC2 instances for order processing introduces complexity when compared to serverless or containerized solutions.
- Why this option is not suitable: It misuses the NAT gateway and AWS Lambda in a way that doesn't meet the scaling or resilience needs. EC2 Auto Scaling is viable but not as efficient as other solutions for this specific use case.
Option B: Use a Network Load Balancer (NLB) to manage web traffic. Use an Application Load Balancer to receive customer orders from the NLB. Use Amazon Redshift with a Multi-AZ deployment to store unprocessed and processed customer orders.
- Rejection Reasoning:
- Redshift is not designed for transactional data storage: Amazon Redshift is a data warehousing service optimized for analytics workloads, not for handling high-throughput transactional workloads like order processing. Redshift would introduce latency in real-time transaction processing and is unsuitable for unprocessed and processed order storage.
- Redundant Load Balancers: Using both a Network Load Balancer and an Application Load Balancer introduces unnecessary complexity, as both are typically used for different types of traffic (NLB for low-latency, TCP traffic and ALB for HTTP/HTTPS traffic). Using both is not ideal and could cause unnecessary complexity.
- Why this option is not suitable: The use of Redshift for transactional data and the redundant load balancers complicates the solution without meeting the scalability and resilience requirements.
Option C: Use a Gateway Load Balancer (GWLB) to manage web traffic. Use Amazon Elastic Container Service (Amazon ECS) to receive and process customer orders. Use the GWLB to capture and store unprocessed orders. Use Ama...
Author: Olivia · Last updated Aug 7, 2026
A company is using AWS DataSync to migrate millions of files from an on-premises system to AWS. The files are 10 KB in size on average.
The company wants to use Amazon S3 for file storage. For the first year after the migration, the files will be accessed once or twice and must be immediately available. ...
Let's evaluate each option based on the requirements of cost-effectively migrating files to AWS, ensuring that the files are immediately available for the first year, and then archived for at least 7 years.
Key Considerations:
- First Year (immediate access): Files need to be immediately accessible but will only be accessed once or twice.
- After 1 Year (archiving for 7 years): Files should be archived for cost-effectiveness but still accessible for rare access.
Option A: Use an archive tool to group the files into large objects. Use DataSync to migrate the objects. Store the objects in S3 Glacier Instant Retrieval for the first year. Use a lifecycle configuration to transition the files to S3 Glacier Deep Archive after 1 year with a retention period of 7 years.
- Why this option is suitable:
- S3 Glacier Instant Retrieval: This storage class is optimized for immediate access to archived data, providing low-cost access to infrequently accessed files for the first year. It ensures the files are accessible with low retrieval times.
- S3 Glacier Deep Archive: After the first year, files transition to Glacier Deep Archive, which is the most cost-effective solution for long-term data archiving. It meets the requirement of being archived for at least 7 years while ensuring low-cost storage.
- Lifecycle policy: The lifecycle policy ensures automatic transition after one year, making it seamless to manage and control costs.
- Why this option is the most cost-effective: This option minimizes costs in both phases (first year and long-term archiving), as Glacier Instant Retrieval provides low-cost access, and Glacier Deep Archive is the lowest-cost solution for long-term storage.
Option B: Use an archive tool to group the files into large objects. Use DataSync to copy the objects to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Glacier Instant Retrieval after 1 year with a retention period of 7 years.
- Rejection Reasoning:
- S3 Standard-IA: Standard-IA is designed for infrequent access, but it is more expensive than Glacier Instant Retrieval for the first year. Given that the files will be accessed only once or twice in the first year, using Standard-IA is not as cost-effective as Glacier Instant Retrieval.
- Transition to Glacier Instant Retrieval: Transitioning to Glacier Instant Retrieval after 1 year is fine, but the upfront cost for Standard-IA is higher than using Glacier Instan...
Author: Aria · Last updated Aug 7, 2026
A company recently performed a lift and shift migration of its on-premises Oracle database workload to run on an Amazon EC2 memory optimized Linux instance. The EC2 Linux instance uses a 1 TB Provisioned IOPS SSD (io1) EBS volume with 64,000 IOPS.
The database storage performance after ...
Let's evaluate each of the options to improve the storage performance of the Oracle database workload after the migration to AWS.
Key Factors to Consider:
- Provisioned IOPS SSD (io1) Performance: The io1 volume provides high-performance storage with up to 64,000 IOPS, which is already quite high, but there may be bottlenecks in how it's being utilized, or additional resources may be needed.
- Instance Type: The EC2 instance type itself plays a significant role in overall storage and compute performance, especially when dealing with high I/O workloads.
- EBS Volume Sizing: Increasing the size of the volume can potentially increase performance, but it needs to be done in a way that aligns with the database’s needs and doesn't cause unnecessary overhead.
- Storage Configuration: How the storage is configured (e.g., through Logical Volume Management or using multiple volumes) can affect performance.
Option A: Add more Provisioned IOPS SSD (io1) EBS volumes. Use OS commands to create a Logical Volume Management (LVM) stripe.
- Why this option could help:
- LVM striping across multiple io1 volumes can increase overall throughput by distributing I/O across multiple volumes, thus potentially improving performance.
- The idea of adding more volumes could help distribute the I/O load if the current single volume is becoming a bottleneck.
- Why this option is not ideal:
- Complexity: Adding more volumes and using LVM increases complexity in the configuration and maintenance of the storage. LVM striping can sometimes lead to increased latency if not properly managed.
- Potential Overhead: Managing multiple volumes could lead to additional overhead, and if not tuned properly, it may not achieve the desired performance improvement.
- Scenario Use: This could be useful if you are running into I/O bottlenecks from a single volume and have the ability to properly manage multiple volumes. However, this requires careful setup and may not be the most straightforward solution.
Option B: Increase the Provisioned IOPS SSD (io1) EBS volume to more than 64,000 IOPS.
- Why this option is not feasible:
- 64,000 IOPS is the maximum: The io1 volume type has a maximum limit of 64,000 IOPS, so this option is not possible. The maximum IOPS that can be provisioned for a single io1 volume is 64,000, and there is no way to exceed this.
- Scenario Use: This would only be viable if the underlying hardware or limitations could be increased, but since 64,000 IOPS is the ceiling for a single io1 volume, this option isn't practical.
Option C: Increase the size of the Provisioned IOPS SSD (io1) EBS volume to 2 TB.
- Why this option might help:
- Increased throughput: EBS volumes like io1 provide more IOPS as the volume size increases. Specific...
Author: Aria · Last updated Aug 7, 2026
A company is migrating from a monolithic architecture for a web application that is hosted on Amazon EC2 to a serverless microservices architecture. The company wants to use AWS services that support an event-driven, loosely coupled architecture. The company wants to...
Let's evaluate the options to determine which solution would be the most cost-effective and meet the company's requirements for a serverless, event-driven, loosely coupled microservices architecture that follows the publish/subscribe (pub/sub) pattern.
Key Requirements:
- Serverless architecture: The solution should leverage AWS managed services for scalability and cost-effectiveness without managing infrastructure.
- Event-driven architecture: Events should trigger actions, and different components (services) should be loosely coupled.
- Pub/sub pattern: The solution should support the publish/subscribe model where a publisher sends messages to a topic, and multiple subscribers can receive messages.
Option A: Configure an Amazon API Gateway REST API to invoke an AWS Lambda function that publishes events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure one or more subscribers to read events from the SQS queue.
- Rejection Reasoning:
- SQS: SQS supports event-driven architecture but is not inherently a pub/sub system. It operates as a point-to-point messaging system, where each message is typically consumed by a single consumer, making it unsuitable for the pub/sub pattern where multiple subscribers can receive the same message.
- Cost Considerations: While SQS is cost-effective, the pub/sub pattern is better supported by services like SNS, which are designed for multiple subscribers to receive the same message.
- Why this option is not the best: SQS is a point-to-point service, not a true pub/sub system, making it less suitable for the company's requirements.
Option B: Configure an Amazon API Gateway REST API to invoke an AWS Lambda function that publishes events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure one or more subscribers to receive events from the SNS topic.
- Why this option is ideal:
- Amazon SNS: SNS is a fully managed pub/sub messaging service, which is perfect for the publish/subscribe pattern. Multiple subscribers can subscribe to the same SNS topic and receive the events, fulfilling the requirement for a loosely coupled architecture where the publisher doesn't need to know about the subscribers.
- Cost-Effective: SNS pricing is pay-as-you-go, based on the number of messages published and delivered, making it highly cost-effective for event-driven architectures with low operational overhead.
- Scalability: SNS is designed to scale automatically without needing manual intervention, making it well-suited for dynamic, serverless microservices architectures.
- Why this option is the best: This option is directly...
Author: Mia · Last updated Aug 7, 2026
A company recently migrated a monolithic application to an Amazon EC2 instance and Amazon RDS. The application has tightly coupled modules. The existing design of the application gives the application the ability to run on only a single EC2 instance.
The company has noticed high CPU utilization on the EC2 instance during peak usage times. The high CPU utilization corresponds to degraded performanc...
The goal is to reduce the high CPU utilization on the EC2 instance and improve read request performance on Amazon RDS. Let's evaluate each option to determine the best approach.
Option A:
Resize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Configure an RDS read replica for read requests.
- EC2 scaling: Resizing the EC2 instance to a more powerful instance might help with CPU utilization on the application layer.
- Auto Scaling group: Setting the Auto Scaling group to a minimum and maximum size of 1 means that the EC2 instance cannot scale beyond 1 instance, which does not address the performance concerns when there is a spike in demand.
- RDS Read Replica: This would improve performance for read-heavy workloads, as the read traffic can be offloaded to the read replica. However, write traffic would still go to the primary instance, which might still lead to performance bottlenecks.
- Limitation: The EC2 instance is still limited to a single instance. This does not resolve the issue of scaling the application in case of high load, and it doesn't fully address CPU utilization under high traffic conditions.
Option B:
Resize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Add an RDS read replica and redirect all read/write traffic to the replica.
- EC2 scaling: Similar to Option A, resizing the EC2 instance may help with high CPU utilization, but the Auto Scaling group is still set to a single instance (min = max = 1).
- Auto Scaling: Setting the Auto Scaling group to always run only one EC2 instance does not allow the application to scale with demand, meaning that performance may degrade during traffic spikes.
- Redirecting all traffic to the read replica: This is not a valid solution. Read replicas are intended for read-only operations, and redirecting write traffic to a read replica would cause data consistency and application errors.
- Limitation: This setup could cause issues with write operations, and the single EC2 instance cannot scale to handle high traffic.
Option C:
Configure an Auto Scaling group with a minimum size of 1 and maximum size of 2. Resize the RDS DB instance to an instance type that has more CPU capacity.
- Auto Scaling: Setting the Auto Scaling group with a minimum size...
Author: Stella · Last updated Aug 7, 2026
A company needs to grant a team of developers access to the company's AWS resources. The company must maintain a high level of security for the resources.
The company requires an access control solution that will pre...
The goal here is to grant developers access to the company’s AWS resources while maintaining a high level of security and preventing unauthorized access to sensitive data. Let's analyze each option and explain why it may or may not be suitable.
Option A: Share the IAM user credentials for each development team member with the rest of the team to simplify access management and streamline development workflows.
- Security concern: Sharing IAM user credentials, especially across the entire team, is highly insecure. It would allow anyone with the credentials to access resources, violating the principle of least privilege and increasing the risk of unauthorized access or misuse.
- Best practice: Sharing credentials is a bad practice in cloud security and violates basic principles of identity and access management.
- Limitation: This method compromises security and is not scalable, as it also makes tracking actions difficult.
Option B: Define IAM roles that have fine-grained permissions based on the principle of least privilege. Assign an IAM role to each developer.
- Best practice: This is the most secure and recommended solution. IAM roles allow you to define granular permissions (using policies) that grant developers only the permissions they need to perform their tasks. This adheres to the principle of least privilege, ensuring that developers are not given unnecessary access to sensitive data or resources.
- Scalability: IAM roles are scalable and manageable. You can easily grant or revoke access to developers by assigning and removing roles.
- Security: IAM roles can also be assigned to specific resources or services, ensuring a fine level of control over who can access what.
- Auditability: IAM roles make it easy to audit and monitor who has access to what, which is essential for security in a team environment.
Option C: Create IAM access keys to grant programmatic access to AWS resources. Allow only developers to interac...
Author: Emily · Last updated Aug 7, 2026
A company hosts a monolithic web application on an Amazon EC2 instance. Application users have recently reported poor performance at specific times. Analysis of Amazon CloudWatch metrics shows that CPU utilization is 100% during the periods of poor performance.
The company wants to resolve this performance issu...
To resolve the performance issue and improve application availability while keeping costs in mind, we need to analyze both vertical and horizontal scaling approaches. Let's evaluate the options to select the most effective combination.
Option A: Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale vertically.
- Explanation: AWS Compute Optimizer provides recommendations on the best instance types based on your usage patterns. Scaling vertically means upgrading to a larger EC2 instance with more CPU power, which might help reduce CPU utilization.
- Cost Consideration: Vertical scaling often involves upgrading to a larger instance type, which might solve the issue temporarily but does not improve availability or fault tolerance. It's typically less cost-effective in the long run, especially for fluctuating traffic, as it doesn't utilize the full elasticity of the cloud.
- Limitation: While it may solve the immediate CPU issue, it doesn't address potential spikes in traffic or improve availability.
Option B: Create an Amazon Machine Image (AMI) from the web server. Reference the AMI in a new launch template.
- Explanation: Creating an AMI would allow you to quickly launch new instances with the same configuration. This step is necessary if you want to use Auto Scaling later, but it is a preparatory action rather than a direct solution for scaling.
- Limitation: While this action is helpful for enabling horizontal scaling, it doesn’t directly resolve the issue of CPU utilization or improve availability by itself. You would still need Auto Scaling and Load Balancing for an effective solution.
Option C: Create an Auto Scaling group and an Application Load Balancer to scale vertically.
- Explanation: Auto Scaling with a load balancer typically helps scale horizontally, but configuring Auto Scaling for vertical scaling (scaling up/down the instance size) is not a best practice. Auto Scaling groups are typically used for horizontal scaling, not vertical.
- Limitation: Scali...
Author: Isabella1 · Last updated Aug 7, 2026
A company runs all its business applications in the AWS Cloud. The company uses AWS Organizations to manage multiple AWS accounts.
A solutions architect needs to review all permissions that are granted to IAM users to determine which IAM users have more pe...
The goal is to review the permissions granted to IAM users across multiple AWS accounts in a way that is efficient and requires minimal administrative overhead. Let's evaluate each option to identify the best solution:
Option A: Use Network Access Analyzer to review all access permissions in the company's AWS accounts.
- Explanation: The Network Access Analyzer is a tool focused on analyzing network-level access (like VPCs, subnets, security groups, and network ACLs), not IAM user permissions. It does not provide visibility into IAM user permissions or roles directly.
- Limitation: This tool is not suited for reviewing IAM permissions and thus cannot address the requirement to assess IAM user permissions.
Option B: Create an AWS CloudWatch alarm that activates when an IAM user creates or modifies resources in an AWS account.
- Explanation: CloudWatch alarms are used to monitor metrics and trigger actions based on specific conditions. While you can set up alarms to detect activity related to IAM users, this approach does not review or audit the IAM permissions themselves. It focuses on monitoring actions, not assessing whether permissions are too broad.
- Limitation: This option doesn't directly address the need to review IAM permissions, nor does it provide insights into users who have more permissions than required.
Option C: Use AWS Identity and Access Management (IAM) Access Analyzer to review all the company’s resources and accounts.
- Explanation: IAM Access Analyzer is specifically designed to help you analyze IAM policies and id...
Author: Vivaan · Last updated Aug 7, 2026
A company needs to implement a new data retention policy for regulatory compliance. As part of this policy, sensitive documents that are stored in an Amazon S3 bucket must be protected from deletion or m...
The goal is to implement a data retention policy for sensitive documents stored in Amazon S3, ensuring that the documents are protected from deletion or modification for a fixed period of time. Let's evaluate each option to identify the best solution.
Option A: Activate S3 Object Lock on the required objects and enable governance mode.
- Explanation: S3 Object Lock in governance mode allows users to protect objects from being deleted or overwritten, but with some exceptions. Users with specific permissions can override the lock, which could lead to accidental or unauthorized changes.
- Limitation: Governance mode offers flexibility for authorized users, which may not meet strict regulatory compliance requirements, as it doesn't guarantee 100% protection from modifications or deletions.
Option B: Activate S3 Object Lock on the required objects and enable compliance mode.
- Explanation: S3 Object Lock in compliance mode ensures that objects are protected from deletion or modification for the duration of the retention period, even by users with administrative privileges. This meets regulatory compliance requirements because no one can bypass the lock, making it ideal for sensitive data that requires strong protection.
- Best fit: Compliance mode is designed for strict regulatory compliance and would meet the requirement of protecting sensitive documents from deletion or modification during the retention period.
Option C: Enable versioning on the S3 bucket. Set a lifecycle policy to delete the objects after a specified period.
- Explanation: ...
Author: Evelyn · Last updated Aug 7, 2026
A company runs its customer-facing web application on containers. The workload uses Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The web application is resource intensive.
The web application needs to be available 24 hours a day, 7 days a week for customers. The company expects the application to experien...
Let's analyze the options to determine which will meet the requirements most cost-effectively and explain the reasoning behind selecting the appropriate solution.
Key Requirements:
1. 24/7 availability: The application must be available at all times.
2. Resource-intensive: The application requires significant compute resources.
3. Burst traffic: The workload needs to handle short bursts of high traffic.
4. Highly available: The solution must be able to scale up or down as needed while ensuring high availability.
5. Cost-efficiency: The solution should help save costs, particularly considering the unpredictable nature of burst traffic.
Option A: Configure an ECS capacity provider with Fargate. Conduct load testing by using a third-party tool. Rightsize the Fargate tasks in Amazon CloudWatch.
- Explanation:
- This approach involves configuring ECS with Fargate and adjusting the tasks after performing load testing and monitoring via CloudWatch.
- Why not ideal: Fargate alone (without any additional burst handling capability) might lead to inefficient resource allocation and higher costs during bursts of traffic. Also, conducting manual load testing might not be cost-effective, and manual right-sizing could lead to over-provisioning or under-provisioning, which would be inefficient for dynamic traffic.
Option B: Configure an ECS capacity provider with Fargate for steady state and Fargate Spot for burst traffic.
- Explanation:
- This option configures ECS to use Fargate for steady-state workloads and Fargate Spot for burst traffic. Fargate Spot allows AWS to provision spare capacity, which is cheaper but can be interrupted.
- Why this could be a good fit: Fargate Spot is cost-effective, especially for burst traffic. However, there is a risk that the Spot capacity could be interrupted, which might cause availability issues during critical times if not managed well. While Spot instance...
Author: Lucas Carter · Last updated Aug 7, 2026
A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS.
The company needs a managed solution wit...
Key Requirements:
- Managed solution: The solution should be fully managed, requiring minimal maintenance and intervention.
- Proactive engagement: The solution should be able to detect and mitigate DDoS attacks automatically or with minimal action required by the company.
- Detection against DDoS attacks: The solution must specifically address and prevent Distributed Denial of Service (DDoS) attacks.
Option A: Enable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
- Explanation: AWS Config is a service for monitoring and evaluating the configuration of AWS resources. It is mainly used for auditing purposes and compliance, not for real-time detection of DDoS attacks.
- Why not ideal: AWS Config does not provide proactive DDoS attack detection or mitigation. It is more focused on ensuring resources comply with a desired configuration and is not suited for mitigating or defending against active DDoS attacks.
Option B: Enable AWS WAF on the ALB. Create an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the ALB.
- Explanation: AWS Web Application Firewall (WAF) can be used to create rules to protect applications from common web exploits and attacks, including SQL injection and cross-site scripting. While it can help with certain types of attacks, AWS WAF is not specifically designed for large-scale DDoS attack detection.
- Why not ideal: Although WAF is useful for mitigating certain attack patterns, it doesn't offer a fully managed and proactive solution against large-scale DDoS attacks. It is better suited for application layer attacks rather than network-level DDoS attacks, which are typically the focus of DDoS protection.
Option C: Store the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.
- Explanation: Amazon GuardDuty is a thr...
Author: Aria · Last updated Aug 7, 2026
A company hosts a video streaming web application in a VPC. The company uses a Network Load Balancer (NLB) to handle TCP traffic for real-time data processing. There have been unauthorized attempts to access the application.
The company wants to improve application security with minimal ar...
Key Requirements:
- Improve application security: The company wants to prevent unauthorized access attempts without significant architectural changes.
- Minimal architectural change: The solution should avoid significant modifications to the current architecture.
- Prevent unauthorized access: Focus is on restricting access from unauthorized sources.
Option A: Implement a series of AWS WAF rules directly on the NLB to filter out unauthorized traffic.
- Explanation: AWS WAF is designed to protect applications at the web layer (HTTP/HTTPS), but a Network Load Balancer (NLB) operates at the transport layer (TCP). AWS WAF does not support filtering on NLB, which is limited to layer 4 (TCP/UDP) traffic.
- Why not ideal: Since NLB operates at the transport layer, AWS WAF cannot be used directly to filter TCP traffic. AWS WAF is designed for use with Application Load Balancers (ALBs) or Amazon CloudFront, making this option unfeasible for the scenario.
Option B: Recreate the NLB with a security group to allow only trusted IP addresses.
- Explanation: Network Load Balancers (NLBs) cannot have security groups directly applied because security groups work at the instance level or ENI (Elastic Network Interface) level, while NLB operates at the network layer.
- Why not ideal: NLBs cannot be associated with security groups, so this solution is not applicable for restricting access based on IP address for an NLB. This would work with an Application Load Balancer, but not with an NLB.
Option C: Deploy a second NLB in parallel with the existing NLB configured with a strict IP address allow list.
- Explanation: This option involves deploying a second NLB and configuring it with a strict allow list to restrict access based on IP addresses. This can be useful if you need to enforce more granular access control.
- Why it may be effective: While deploying a second NLB may allow for more controlled access, this would require a significant architectural change. It w...
Author: Madison · Last updated Aug 7, 2026
A healthcare company is developing an AWS Lambda function that publishes notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic. The notifications contain protected health information (PHI).
The SNS topic uses AWS Key Management Service (AWS KMS) customer managed keys for encryption. The company must ensure that the applicati...
Key Requirements:
1. Lambda function must securely publish to SNS: The Lambda function needs to have the necessary permissions to publish messages to the SNS topic.
2. Use KMS customer managed keys for encryption: The SNS topic is encrypted using customer managed keys in AWS KMS.
3. Ensure PHI is securely handled: The solution must ensure secure handling of sensitive data and proper permission management for encryption.
Option A: Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.
- Explanation: SNS resource policies can control who has permission to publish messages to an SNS topic. By creating a resource policy for the SNS topic, the Lambda function will have the correct permissions to send messages to the topic.
- Why this is ideal: This ensures that the SNS topic specifically allows the Lambda function to publish messages. Without this resource policy, the Lambda function may not be authorized to publish notifications, especially if fine-grained access control is needed.
Option B: Use server-side encryption with AWS KMS keys (SSE-KMS) for the SNS topic instead of customer managed keys.
- Explanation: Using server-side encryption (SSE) with AWS KMS allows SNS to encrypt messages. However, the question specifies that the SNS topic uses customer managed keys for encryption.
- Why not ideal: This would switch the encryption method to AWS managed keys, which may not meet the company's security and compliance requirements. The company needs to use customer managed keys, so this option doesn't meet the specified requirements.
Option C: Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.
- Explanation: When using AWS KMS customer managed keys for encryption, a resource policy can be applied to the KMS key itself. This policy controls which IAM entities (like Lambda) are allowed to use the encryption key.
- Why this is ideal: The Lambda function must have permissions to use the encryption key, so defining a resource policy for the KMS key will grant it the necessary permissions for encrypting and decrypting messages when publishing to the SNS topic. This is essential for the secure handling of PHI.
Option D: Specify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's reso...
Author: Leah Davis · Last updated Aug 7, 2026
A company has an employee web portal. Employees log in to the portal to view payroll details. The company is developing a new system to give employees the ability to upload scanned documents for reimbursement. The company runs a program to extract text-based data from the documents and attach the extracted information to each employee's reimbursement IDs for processing.
The employee web portal requires 100% uptime. The document extract program runs infrequently throughout the day on an on-demand basis. The company wants to build a sca...
Key Requirements:
1. 100% uptime for the employee web portal: The web portal must remain highly available without downtime.
2. Scalable and cost-effective system: The system needs to scale based on demand and be cost-efficient, especially considering the document extraction runs infrequently.
3. Minimal changes to the existing portal: The company doesn't want to make any changes to the existing web portal code.
4. On-demand document extraction: The document extraction process should run on-demand, triggered by employee document uploads.
Option A: Run Amazon EC2 On-Demand Instances in an Auto Scaling group for the web portal. Use an AWS Lambda function to run the document extract program. Invoke the Lambda function when an employee uploads a new reimbursement document.
- Explanation:
- Web Portal: Running the web portal on EC2 On-Demand instances within an Auto Scaling group ensures 100% uptime, as the Auto Scaling group can automatically adjust the number of instances based on traffic demand. EC2 On-Demand instances provide flexibility and reliability, without being tied to a specific availability window.
- Document Extraction: The document extraction is run using AWS Lambda, which scales automatically depending on the number of document uploads. Lambda is cost-effective since it only incurs costs when the function is invoked.
- Why this is ideal: This solution is highly scalable (Lambda automatically scales) and cost-efficient (using Lambda only when needed). It also requires minimal changes to the existing web portal, as the Lambda function can be invoked via API or event triggers without modifying the portal code.
Option B: Run Amazon EC2 Spot Instances in an Auto Scaling group for the web portal. Run the document extract program on EC2 Spot Instances. Start document extract program instances when an employee uploads a new reimbursement document.
- Explanation:
- Web Portal: EC2 Spot Instances are cheaper but can be terminated with little notice, which makes them unsuitable for the employee web portal that requires 100% uptime.
- Document Extraction: While EC2 Spot Instances can be used for the document extraction program, they are unreliable for tasks that need to run consistently, especially when the program is triggered on-demand. The Spot Instances may be terminated during high-demand periods, leading to potential failures or delays in the document extraction process.
- Why not ideal: EC2 Spot Instances are not suitable for the web portal because they cannot guarantee 100% uptime. The document extraction process could be affected by interruptions, which may lead to failure in handling employee reimbursements...
Author: Mia · Last updated Aug 7, 2026
A media company has a multi-account AWS environment in the us-east-1 Region. The company has an Amazon Simple Notification Service (Amazon SNS) topic in a production account that publishes performance metrics. The company has an AWS Lambda function in an administrator account to process and analyze log data.
The Lambda function that is in the administrator account must be invoked by messa...
To solve this problem, we need to ensure that the Lambda function in the administrator account can be triggered by the SNS topic in the production account when significant metrics are reported. Let's analyze each option based on the requirements:
A) Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.
- Explanation: An IAM resource policy is required to allow the Lambda function to be invoked by an SNS topic from a different AWS account (cross-account invocation). This policy will explicitly grant permission for SNS to invoke the Lambda function in the administrator account.
- Why Selected: This is a necessary step because SNS needs permission to invoke the Lambda function in the administrator account, and this permission is granted via an IAM resource policy attached to the Lambda function.
- Key Factor: Lambda functions cannot be directly invoked by SNS without proper permissions, and the resource policy is specifically for cross-account access.
B) Implement an Amazon Simple Queue Service (Amazon SQS) queue in the administrator account to buffer messages from the SNS topic that is in the production account. Configure the SQS queue to invoke the Lambda function.
- Explanation: Using an SQS queue to buffer messages from SNS before invoking the Lambda function could work, but it introduces additional complexity, and the direct invocation from SNS to Lambda is typically simpler. The use of SQS is an extra step that might not be necessary unless message buffering is required.
- Why Rejected: While it’s a valid solution, it adds unnecessary complexity because SNS can directly invoke the Lambda function if the correct permissions are set (as in option A).
C) Create an IAM policy for the SNS topic that allows the Lambda function to subscribe to the topic.
- Explanation: IAM policies control access between AWS resources. However, SNS topics don’t subscribe to Lambda functions; instead, the L...
Author: CrimsonViperX · Last updated Aug 7, 2026
A company is migrating an application from an on-premises location to Amazon Elastic Kubernetes Service (Amazon EKS). The company must use a custom subnet for pods that are in the company's VPC to comply with requirements. The company also needs to ensur...
To meet the requirements of using a custom subnet for pods and ensuring secure communication within the VPC for Amazon EKS, let's evaluate each option:
A) Configure AWS Transit Gateway to directly manage custom subnet configurations for the pods in Amazon EKS.
- Explanation: The AWS Transit Gateway is used to connect multiple VPCs or on-premises networks, allowing them to communicate with each other. However, Transit Gateway is not directly involved in managing custom subnets for EKS pods. It is more for managing network traffic between VPCs and on-premises environments.
- Why Rejected: AWS Transit Gateway is not the correct tool for configuring custom subnets for pods in EKS. It's more about VPC-to-VPC or hybrid cloud networking and not directly related to the EKS pod network configuration.
B) Create an AWS Direct Connect connection from the company's on-premises IP address ranges to the EKS pods.
- Explanation: AWS Direct Connect establishes a dedicated network connection from the on-premises data center to AWS. However, Direct Connect primarily helps in connecting on-premises networks to AWS VPCs and does not provide a direct solution for configuring custom subnets for EKS pods. It focuses on connectivity, not Kubernetes networking.
- Why Rejected: This option addresses connectivity between on-premises infrastructure and AWS but does not provide a way to configure custom subnets for pods or enable secure communication within the pods' VPC.
C) Use the Amazon VPC CNI plugin for Kubernetes. Define custom subnets in...
Author: Elizabeth · Last updated Aug 7, 2026
A company hosts an ecommerce application that stores all data in a single Amazon RDS for MySQL DB instance that is fully managed by AWS. The company needs to mitigate the risk of a single point of failur...
To meet the requirement of mitigating the risk of a single point of failure with minimal implementation effort, let's evaluate each option:
A) Modify the RDS DB instance to use a Multi-AZ deployment. Apply the changes during the next maintenance window.
- Explanation: Amazon RDS supports Multi-AZ deployments, where AWS automatically provisions a synchronous standby replica in another Availability Zone. This setup ensures high availability and failover capability. This option can be implemented directly on the existing RDS DB instance with minimal effort, as RDS will manage the failover process, and there is no need to migrate data or manage additional infrastructure.
- Why Selected: This option provides the least implementation effort because it leverages RDS's built-in Multi-AZ feature, which is fully managed by AWS. It requires minimal manual intervention, and it automatically handles failover and availability.
B) Migrate the current database to a new Amazon DynamoDB Multi-AZ deployment. Use AWS Database Migration Service (AWS DMS) with a heterogeneous migration strategy to migrate the current RDS DB instance to DynamoDB tables.
- Explanation: DynamoDB is a NoSQL database, while the company’s application is currently using Amazon RDS for MySQL, which is a relational database. This would require a significant migration effort to change the database architecture, including reworking the application logic to be compatible with DynamoDB. Additionally, AWS DMS would be needed for migration, which can add complexity.
- Why Rejected: This option involves a major change in database type (relational to NoSQL) and requires substantial re-architecture, which is not minimal implementation effort. It is also more time...
Author: Emma · Last updated Aug 7, 2026
A company has multiple Microsoft Windows SMB file servers and Linux NFS file servers for file sharing in an on-premises environment. As part of the company's AWS migration plan, the company wants to consolidate the file servers in the AWS Cloud.
The company needs a managed AWS storage service that supports both NFS and SMB access. The solution mus...
Let's evaluate each of the options to determine which best meets the company's needs for consolidating file servers in AWS, supporting both NFS and SMB access, redundancy at the Availability Zone level, and sharing between protocols:
A) Use Amazon FSx for NetApp ONTAP for storage. Configure multi-protocol access.
- Explanation: Amazon FSx for NetApp ONTAP supports both NFS and SMB protocols and allows you to configure multi-protocol access, which means clients can access the same file system using different protocols. Additionally, Amazon FSx provides built-in redundancy at the Availability Zone level, ensuring high availability and data durability.
- Why Selected: This solution is the most fitting because it directly addresses the need to support both SMB and NFS protocols with a single managed service. It also offers redundancy at the Availability Zone level, aligning with the company's requirements. Multi-protocol access in FSx for NetApp ONTAP enables the seamless sharing of files between Windows and Linux clients.
B) Create two Amazon EC2 instances. Use one EC2 instance for Windows SMB file server access and one EC2 instance for Linux NFS file server access.
- Explanation: This option would require the creation of two separate EC2 instances to handle each protocol (one for SMB and one for NFS), which would involve manual configuration, management, and scaling of the instances. This setup wouldn't provide a unified file storage service and lacks the high-level management features offered by AWS managed services.
- Why Rejected: While this would technically work, it would require more management and maintenance, and it doesn't provide the same level of ease of use, redu...
Author: FrozenWolf2022 · Last updated Aug 7, 2026
A software company needs to upgrade a critical web application. The application currently runs on a single Amazon EC2 instance that the company hosts in a public subnet. The EC2 instance runs a MySQL database. The application's DNS records are published in an Amazon Route 53 zone.
A solutions architect must reconfigure the application to be scalable and h...
To meet the requirements of making the web application scalable, highly available, and reducing MySQL read latency, let’s evaluate each option:
A) Launch a second EC2 instance in a second AWS Region. Use a Route 53 failover routing policy to redirect the traffic to the second EC2 instance.
- Explanation: This solution would introduce a secondary EC2 instance in a different AWS Region and use Route 53 failover routing to handle traffic. While failover routing could help with high availability, launching an EC2 instance in a separate region doesn't improve scalability or reduce read latency in the same Region. Furthermore, managing cross-region traffic increases complexity and latency.
- Why Rejected: Cross-region configurations add unnecessary complexity, and the company does not need to operate in multiple regions to meet scalability and high availability within the same region. Additionally, the solution does not address reducing read latency within the same region.
B) Create and configure an Auto Scaling group to launch private EC2 instances in multiple Availability Zones. Add the instances to a target group behind a new Application Load Balancer.
- Explanation: This solution involves creating an Auto Scaling group to manage EC2 instances across multiple Availability Zones for high availability and scalability. The Application Load Balancer (ALB) would distribute traffic across the EC2 instances, helping with scaling the web application. This configuration ensures the application is fault-tolerant and scalable.
- Why Selected: This option addresses both scalability and high availability. By distributing traffic across multiple Availability Zones, the EC2 instances will be highly available, and Auto Scaling will ensure that capacity adjusts according to demand.
C) Migrate the database to an Amazon Aurora MySQL cluster. Create the primary DB instance and reader DB instance in separate Availability Zones.
- Explanation: Amazon Aurora MySQL offers enhanced performanc...
Author: Ella · Last updated Aug 7, 2026
A company runs thousands of AWS Lambda functions. The company needs a solution to securely store sensitive information that all the Lambda functions use. The solution must also manage the automatic rotation of the sensitive information.
Wh...
To meet the requirement of securely storing sensitive information for AWS Lambda functions while also managing automatic rotation with minimal operational overhead, the optimal solution involves using services designed specifically for sensitive data management with automation features.
Let's review each option and explain why it is selected or rejected:
Option A: Create HTTP security headers by using Lambda@Edge to retrieve and create sensitive information
- Rejected: Lambda@Edge is typically used for managing HTTP requests and responses at CloudFront. It is not designed for securely storing or managing sensitive information across multiple Lambda functions. It would not provide the necessary features for secure storage or automatic rotation of sensitive data.
Option B: Create a Lambda layer that retrieves sensitive information
- Rejected: Lambda layers allow you to share code or libraries between Lambda functions, but they don't provide an optimal solution for securely storing or managing sensitive information. Layers are not a dedicated service for sensitive data storage or automatic rotation, and it would add more operational complexity as you would need to manage secrets manually within the layer.
Option C: Store sensitive information in AWS Secrets Manager
- Selected: AWS Secrets Manager is designed for securely storing sensitive information such as API keys, database credentials, and other secrets. It also provides built-in support for automatic rotation of secrets, which significantly reduces operational overhead. Lambda functions can retrieve secrets easily via API calls, and Secrets Manager handles encryption and access contr...
Author: NightmareDragon2025 · Last updated Aug 7, 2026
A company has an internal application that runs on Amazon EC2 instances in an Auto Scaling group. The EC2 instances are compute optimized and use Amazon Elastic Block Store (Amazon EBS) volumes.
The company wants to identify cost optimizations across the EC2 instances, the Auto...
To identify cost optimizations for EC2 instances, Auto Scaling groups, and EBS volumes with the most operational efficiency, the solution should provide actionable recommendations specific to compute and storage usage. Let's evaluate each option:
Option A: Create a new AWS Cost and Usage Report. Search the report for cost recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.
- Rejected: The AWS Cost and Usage Report provides detailed billing and usage data but does not automatically offer cost optimization recommendations. It requires manual effort to analyze cost patterns and usage, making it less efficient for ongoing cost optimization. Additionally, the report does not specifically provide guidance on optimizing EC2 instance types or EBS volume sizes or usage.
Option B: Create new Amazon CloudWatch billing alerts. Check the alert statuses for cost recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.
- Rejected: Amazon CloudWatch billing alerts can notify you when usage costs exceed certain thresholds, but they do not provide detailed cost optimization recommendations. CloudWatch billing alerts are more about tracking budget and usage, not specifically optimizing cost or resource usage.
Option C: Configure AWS Compute Optimizer for cost recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.
- Selected: AWS Compute Optimizer is designed to provide cost optimization recomme...
Author: Emma · Last updated Aug 7, 2026
A company is running a media store across multiple Amazon EC2 instances distributed across multiple Availability Zones in a single VPC. The company wants a high-performing solution to share data between all the EC2 instances, ...
In this scenario, the company is running multiple EC2 instances across different Availability Zones in a single VPC and needs a high-performance solution for sharing data among these instances while keeping the data within the VPC. Let's evaluate the options based on the requirements:
Option A: Create an Amazon S3 bucket and call the service APIs from each instance's application
- Rejected: While Amazon S3 is a durable and scalable solution for storing data, it is not ideal for high-performance data sharing across EC2 instances. The S3 APIs are typically slower than file systems designed for low-latency access. Additionally, S3 is an object storage service and not suitable for scenarios requiring fast, high-throughput data sharing across multiple EC2 instances.
Option B: Create an Amazon S3 bucket and configure all instances to access it as a mounted volume
- Rejected: S3 is an object storage service, and it does not natively support mounting like a file system (e.g., NFS). While tools like `s3fs` can mount an S3 bucket as a file system, this is not recommended for high-performance workloads. Mounting S3 in this manner introduces latency, inefficiencies, and potential consistency issues that would impact performance.
Option C: Configure an Amazon Elastic Block Store (Amazon EBS) volume and mount it ac...
Author: Leo · Last updated Aug 7, 2026
A company uses an Amazon RDS for MySQL instance. To prepare for end-of-year processing, the company added a read replica to accommodate extra read-only queries from the company's reporting tool. The read replica CPU usage was 60% and the primary instance CPU usage was 60%.
After end-of-year activities are complete, the read replica has a constant 25% CPU usage. The primary instance still has a...
In this scenario, the company has a MySQL RDS instance and a read replica. After end-of-year activities are complete, the CPU usage of the read replica has decreased to 25%, while the primary instance's CPU usage remains constant at 60%. The company needs to rightsize the database while ensuring enough performance for future growth. Let's evaluate the options:
Option A: Delete the read replica. Do not make changes to the primary instance.
- Rejected: Deleting the read replica would eliminate the additional capacity for handling read queries. While the read replica is underutilized now, keeping it could be useful for future growth when the load increases again. The primary instance's CPU usage remains high, indicating it might not be sufficient for future growth if the load increases. This option does not address the performance of the primary instance or provide a clear path for future scalability.
Option B: Resize the read replica to a smaller instance size. Do not make changes to the primary instance.
- Rejected: While resizing the read replica to a smaller instance size could save costs, it does not address the primary instance's high CPU usage, which remains at 60%. The high CPU usage of the primary instance indicates that it is under more strain, and resizing the read replica does not help with that. The read replica's CPU usage is low (25%), so reducing its size may save some costs but is not the most efficient solution for the entire system's perfo...
Author: Samuel · Last updated Aug 7, 2026
A company is migrating its databases to Amazon RDS for PostgreSQL. The company is migrating its applications to Amazon EC2 instances. The company wants to optimize costs for long-runnin...
When optimizing costs for long-running workloads, particularly for Amazon RDS for PostgreSQL and EC2 instances, the company needs to consider cost-effective purchasing options that balance up-front costs and long-term savings. Let's evaluate each option:
Option A: Use On-Demand Instances for the Amazon RDS for PostgreSQL workloads. Purchase a 1-year Compute Savings Plan with the No Upfront option for the EC2 instances.
- Rejected: Using On-Demand instances for RDS is not the most cost-effective approach for long-running workloads, as On-Demand instances do not offer any discounts compared to Reserved Instances or Savings Plans. For EC2, purchasing a Compute Savings Plan (with No Upfront) offers flexibility but still requires ongoing payments. While this is a flexible solution, it doesn’t take advantage of the best possible cost savings for long-term workloads, especially for RDS, where Reserved Instances can offer greater savings.
Option B: Purchase Reserved Instances for a 1-year term with the No Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 1-year EC2 Instance Savings Plan with the No Upfront option for the EC2 instances.
- Rejected: Purchasing Reserved Instances for RDS for PostgreSQL is a good approach to saving costs for long-term workloads, but the "No Upfront" option still results in higher costs over time compared to paying partially or fully upfront. For EC2, the 1-year EC2 Instance Savings Plan with No Upfront might be flexible, but this setup isn't as optimal as committing to longer terms (like 3 years) when the workloads are long-running.
Option C: Purchase Reserved Instances for a 1-year term with the Partial Upfront option for the Ama...
Author: Ahmed · Last updated Aug 7, 2026
A company is using an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company must ensure that Kubernetes service accounts in the EKS cluster have secure and granular access to specific AWS resources by using IAM roles for ...
To meet the requirement of ensuring secure and granular access to specific AWS resources by using IAM roles for service accounts (IRSA) in Amazon EKS, let's analyze each option based on the best practices for implementing IRSA.
Option A: Create an IAM policy that defines the required permissions. Attach the policy directly to the IAM role of the EKS nodes.
- Reasoning: This option is not ideal because it involves attaching the policy directly to the EKS nodes' IAM role. However, service accounts should have granular access to AWS resources, and using the IAM role of the nodes doesn't allow for fine-grained control at the service account level. The policy should be applied to individual IAM roles for Kubernetes service accounts, not to the nodes as a whole.
- Rejection Reason: This approach does not meet the granular access control requirement at the service account level.
Option B: Implement network policies within the EKS cluster to prevent Kubernetes service accounts from accessing specific AWS services.
- Reasoning: Network policies control network traffic between Kubernetes pods, but they do not directly address access control to AWS resources. IRSA aims to provide access to AWS services such as S3 or DynamoDB, so network policies would not fulfill the requirement for controlling access to AWS services.
- Rejection Reason: Network policies are not designed for managing access to AWS services, so this does not fulfill the requirement.
Option C: Modify the EKS cluster's IAM role to include permissions for each Kubernetes service account. Ensure a one-to-one mapping between IAM roles and Kubernetes roles.
- Reasoning: This option suggests modifying the EKS cluster's IAM role, but IAM roles for EKS nodes and service accounts are separate concepts. Modifying the cluster's IAM role won't achieve the goal of associating specific AWS p...
Author: Aarav2020 · Last updated Aug 7, 2026
A company regularly uploads confidential data to Amazon S3 buckets for analysis.
The company's security policies mandate that the objects must be encrypted at rest. The company must automatically rotate the encryption key every year. The company must be able to track key rotation by usin...
Let's analyze each option in the context of the given requirements: encryption at rest, automatic key rotation, CloudTrail logging, and minimizing encryption costs.
Option A: Use server-side encryption with customer-provided keys (SSE-C)
- Reasoning: SSE-C allows you to manage your own encryption keys and pass them to S3 for encrypting objects. However, it does not support automatic key rotation. You'll need to manage the lifecycle and rotation of keys manually, which adds complexity. Additionally, SSE-C does not automatically integrate with AWS CloudTrail for key rotation tracking.
- Rejection Reason: Since the solution requires manual management of encryption keys and doesn’t provide automatic key rotation or CloudTrail logging, this option does not meet the requirements.
Option B: Use server-side encryption with Amazon S3 managed keys (SSE-S3)
- Reasoning: SSE-S3 uses S3-managed keys for encryption. While this is simple and cost-effective, it does not support automatic key rotation every year as required. Key management is entirely handled by Amazon, but there is no control over key rotation, and there is no logging through CloudTrail for key rotation.
- Rejection Reason: Although SSE-S3 is cost-effective and simplifies encryption management, it doesn't support the required automatic key rotation or CloudTrail integration for key rotation tracking.
Option C: Use server-side encryption with AWS KMS keys (SSE-KMS)
- Reasoning: SSE-KMS allows encryption using AWS Key Management Service (KMS) keys. With KMS, the encryption keys can be rotated automatically every year (through the automatic key rotation feature of KMS). Furthermore, AWS CloudTrail logs all actions related to KMS, including key creation, rotation, and usage, which meets the requirement for tracking key rotation. However, this solution cou...
Author: SilverBear · Last updated Aug 7, 2026
A company has migrated several applications to AWS in the past 3 months. The company wants to know the breakdown of costs for each of these applications. The company wants to receive a regular report that inclu...
To determine the most cost-effective solution for receiving a regular report on costs for each application, let's evaluate each option:
Option A: Use AWS Budgets to download data for the past 3 months into a .csv file. Look up the desired information.
- Reasoning: AWS Budgets can track spending and provide cost estimates, but it is not designed for detailed, historical cost breakdowns. Budgets are more focused on tracking and alerting for future cost predictions rather than giving a granular breakdown of costs across services or applications over a specific past period.
- Rejection Reason: AWS Budgets is more suited for cost forecasting and monitoring than detailed historical reporting. It doesn't offer the necessary level of granularity or flexibility for the detailed application-based cost breakdown that the company requires.
Option B: Load AWS Cost and Usage Reports into an Amazon RDS DB instance. Run SQL queries to get the desired information.
- Reasoning: AWS Cost and Usage Reports (CUR) provide detailed billing information, and loading this data into an Amazon RDS instance allows you to run custom queries for cost analysis. However, setting up and maintaining an RDS instance for this purpose introduces complexity, ongoing management costs, and additional overhead. It's more suited for advanced analytics or custom reporting setups.
- Rejection Reason: This solution could be more complex and expensive compared to other options. While it provides flexibility, it also requires significant setup and maintenance overhead that could be avoided with more straightforward solutions.
Option C: Tag all the AWS resources with a key for cost and a value of the application's name. Activate cost allocation tags. Use Cost Explorer to ge...
Author: Jack · Last updated Aug 7, 2026
An ecommerce company is preparing to deploy a web application on AWS to ensure continuous service for customers. The architecture includes a web application that the company hosts on Amazon EC2 instances, a relational database in Amazon RDS, and static assets that the company stores in Amazon S3.
Th...
Let's break down the requirements and evaluate each solution:
Key Requirements:
1. Continuous service: The company needs high availability and resilience to ensure service continuity.
2. Web application hosted on EC2: The application needs to be scalable and highly available.
3. Relational database in Amazon RDS: The database must be resilient and highly available.
4. Static assets in S3: Ensure scalability and availability of static assets.
Option A: Deploy Amazon EC2 instances in a single Availability Zone. Deploy an RDS DB instance in the same Availability Zone. Use Amazon S3 with versioning enabled to store static assets.
- Reasoning: While S3 with versioning provides durability for static assets, hosting both EC2 and RDS in a single Availability Zone introduces a single point of failure. If that Availability Zone goes down, both the application and database would be impacted. This does not meet the requirement for continuous service.
- Rejection Reason: Lack of high availability for EC2 and RDS makes this solution unsuitable for a robust and resilient architecture.
Option B: Deploy Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. Deploy a Multi-AZ RDS DB instance. Use Amazon CloudFront to distribute static assets.
- Reasoning: This option meets all the requirements:
- EC2 in multiple Availability Zones with Auto Scaling: Ensures high availability and automatic scaling to handle traffic spikes.
- Multi-AZ RDS: Provides high availability for the database, with automatic failover between Availability Zones.
- CloudFront for static assets: Distributes static assets globally with low latency, enhancing availability and reducing the load on S3.
- Selection Reason: This solution provides a highly available, scalable, and resilient architecture for both the application and database, ensuring continuous service. CloudFront enhances performance by serving static assets efficiently.
Option C: Deploy Amazon EC2 instances in a single Availability Zone. Deploy an RDS DB i...
Author: Akash · Last updated Aug 7, 2026
An ecommerce company runs several internal applications in multiple AWS accounts. The company uses AWS Organizations to manage its AWS accounts.
A security appliance in the company's networking account must inspect intera...
Let's evaluate the options based on the company's requirements for inspecting traffic between applications across multiple AWS accounts using a security appliance in the networking account.
Key Requirements:
1. Inter-Account Traffic Inspection: The security appliance must inspect traffic between different AWS accounts.
2. Networking Account: The appliance resides in the networking account, meaning it needs to receive and inspect traffic from the application accounts.
3. Solution Scalability: The solution should allow efficient traffic routing to the appliance for inspection.
Option A: Deploy a Network Load Balancer (NLB) in the networking account to send traffic to the security appliance. Configure the application accounts to send traffic to the NLB by using an interface VPC endpoint in the application accounts.
- Reasoning: An NLB is designed for high-performance, low-latency routing, and it can route traffic to the security appliance. Configuring the application accounts to route traffic through an interface VPC endpoint in the application accounts ensures secure, private communication with the networking account. However, an NLB typically routes traffic at the transport layer (Layer 4) and does not offer the specific functionality needed for inspecting traffic, especially for application-level inspections.
- Rejection Reason: While the NLB can route traffic effectively, it does not provide deep packet inspection or specialized routing for security appliances like a Gateway Load Balancer does. It is not optimized for integrating with security appliances that need to inspect traffic.
Option B: Deploy an Application Load Balancer (ALB) in the application accounts to send traffic directly to the security appliance.
- Reasoning: An ALB is used for routing HTTP/HTTPS traffic and operates at the application layer (Layer 7). It is well-suited for routing web application traffic and providing load balancing, but it is not typically designed to route traffic for security inspection at the network layer. Moreover, deploying ALBs in the application accounts does not meet the requirement of routing traffic to the security appliance in the networking account for inspec...
Author: Deepak · Last updated Aug 7, 2026
A company runs its production workload on an Amazon Aurora MySQL DB cluster that includes six Aurora Replicas. The company wants near-real-time reporting queries from one of its departments to be automatically distributed across three of the Aurora Replicas. Those three replicas have...
Solution Overview:
The company needs near-real-time reporting queries to be automatically distributed across three of the Aurora Replicas. These replicas have different compute and memory specifications from the other replicas, meaning they need to be managed and selected specifically for this workload.
Analysis of the Options:
1. A) Create and use a custom endpoint for the workload:
- Reasoning: Aurora allows creating custom endpoints that can target specific nodes within a cluster. By creating a custom endpoint, the company can directly target the three Aurora Replicas with different compute and memory specifications. This ensures that reporting queries go to the specific replicas required. This also provides fine-grained control over how traffic is routed.
- When to use: This option is suitable when you want to explicitly manage the workload and direct specific queries to certain replicas.
- Why it's selected: Since the replicas have different compute and memory specifications, using a custom endpoint allows control over which replicas the workload is distributed to, fulfilling the requirement for near-real-time reporting queries.
2. B) Create a three-node cluster clone and use the reader endpoint:
- Reasoning: A cluster clone is essentially a copy of the database for testing or reporting purposes. Using the reader endpoint would distribute read queries to all the replicas, but it doesn't guarantee the distribution to just the three selected replicas.
- When to use: This is typically used for scaling or testing environments where a full copy of the data is needed. It's not suitable for the requirement where specific replicas (based on compute/memory specs) are needed.
- Why it's rejected: It would involve creating a...
Author: Vivaan · Last updated Aug 7, 2026
A company runs a Node js function on a server in its on-premises data center. The data center stores data in a PostgreSQL database. The company stores the credentials in a connection string in an environment variable on the server. The company wants to migrate its application to AWS and to replace the Node.js application server with AWS Lambda. The company also wants to migrate to Amazon ...
Solution Overview:
The company wants to migrate its Node.js application to AWS Lambda and ensure that the PostgreSQL database credentials are securely managed with minimal operational overhead.
Analysis of the Options:
1. A) Store the database credentials as a parameter in AWS Systems Manager Parameter Store. Configure Parameter Store to automatically rotate the secrets every 30 days. Update the Lambda function to retrieve the credentials from the parameter.
- Reasoning: AWS Systems Manager Parameter Store can securely store credentials. However, Parameter Store does not have built-in automatic rotation for database credentials like Secrets Manager does. While it's a valid option, it still requires additional effort to implement credential rotation manually, which can increase operational overhead.
- When to use: This option could be used for simpler cases where the user does not need automatic rotation of credentials.
- Why it's rejected: The lack of built-in rotation and the extra effort needed to implement it reduces its appeal compared to Secrets Manager.
2. B) Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret.
- Reasoning: AWS Secrets Manager is specifically designed to manage sensitive credentials and secrets, offering automatic rotation and integration with services like RDS. It provides a secure, automated way to manage and rotate credentials, and it integrates well with Lambda, making it easy to retrieve the credentials securely without manual intervention.
- When to use: This is the ideal solution when automatic rotation and ease of integration with other AWS services (like RDS and Lambda) are required.
- Why it's selected: Secrets Manager offers the least operational overhead by automatically handling credential rotation and providing built-in support for securely storing and retrieving secrets. This aligns perfec...
Author: Chloe · Last updated Aug 7, 2026
A company wants to replicate existing and ongoing data changes from an on-premises Oracle database to Amazon RDS for Oracle. The amount of data to replicate varies throughout each day. The company wants to use AWS Database Migration Service (AWS DMS) for data replication. The soluti...
Solution Overview:
The company needs a solution to replicate data from an on-premises Oracle database to Amazon RDS for Oracle using AWS Database Migration Service (AWS DMS). The solution should automatically allocate the required capacity based on the amount of data to replicate, with minimal manual intervention or excess provisioning.
Analysis of the Options:
1. A) Configure the AWS DMS replication instance with a Multi-AZ deployment to provision instances across multiple Availability Zones.
- Reasoning: Multi-AZ deployments provide high availability and failover support, but they don’t automatically scale based on the replication workload. In a scenario where data replication volume varies, this option would result in over-provisioning of resources since the instance would always be provisioned for the maximum required capacity (to account for failover). It doesn't address the need for automatically adjusting capacity based on variable data replication demands.
- When to use: Multi-AZ is best for high-availability needs but not for automatically scaling the replication capacity based on demand.
- Why it's rejected: It doesn't address the need for dynamically adjusting capacity based on the data replication requirements.
2. B) Create an AWS DMS Serverless replication task to analyze and replicate the data while provisioning the required capacity.
- Reasoning: AWS DMS Serverless is designed specifically to automatically scale the replication instance based on the data replication load. It adjusts the resources dynamically to match the replication task’s needs, which makes it the best option for handling varying data loads with minimal manual configuration. This option meets the requirement of allocating only the capacity needed for data replication at any given time.
- When to use: This option is ideal for environments where the replication workload fluctuates, and you want AWS to automatically allocate and deallocate resources based on the actual workload.
- Why it's selected: AWS DMS Serverless automatically adjusts the replication capacity based on the actual amount of data to...
