Free AWS Solutions Architect Professional Practice Exam (SAP-C03)

Your score by topic

Get a free AWS Solutions Architect Professional study plan on WhatsApp See AWS Solutions Architect Professional Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Cloud Architecture Design⚑ Flag

A retail company runs 40 workload accounts in AWS Organizations, and each account publishes order events to its default Amazon EventBridge event bus. A central analytics account must receive all order events in near real time. New consumers will be added every month, and the analytics team wants to add them only in the central account. Which solution meets these requirements with the LEAST operational overhead?

ARun a central Lambda function that assumes a role in each workload account and polls for new order events every minute. BSend order events from each workload account to Kinesis Data Streams and replicate the records into the central account. CUse StackSets to create one rule per workload account that forwards order events to a central bus allowing the organization ID. DCreate a rule in each workload account for every new consumer that targets that consumer's SQS queue in another account directly.

Correct answer: C. Use StackSets to create one rule per workload account that forwards order events to a central bus allowing the organization ID.
A single forwarding rule per workload account sends every order event to a central custom event bus, and a resource policy with the aws:PrincipalOrgID condition authorizes all accounts at once. New consumers then become rules on the central bus only. Direct cross-account targets work, but each new consumer would require changes in all 40 workload accounts.

Question 2Security & Governance⚑ Flag

A retailer runs 60 AWS accounts in AWS Organizations and uses Okta as its only corporate identity provider. It has no Active Directory. Today, engineers sign in through IAM SAML providers configured separately in each account. The security team wants a single sign-in portal, access assigned by Okta group, and automatic removal of AWS access when an employee is deactivated in Okta. Which solution meets these requirements with the LEAST operational overhead?

AEnable IAM Identity Center with AD Connector to a new self-managed directory and map its groups to permission sets in each account. BEnable IAM Identity Center with Okta as the external identity provider, turn on SCIM provisioning, and assign Okta groups to permission sets. CKeep the per-account IAM SAML providers and use CloudFormation StackSets to deploy matching IAM roles and trust policies to every account. DEnable IAM Identity Center with its built-in directory, recreate the users and groups there, and assign them to permission sets in each account.

Correct answer: B. Enable IAM Identity Center with Okta as the external identity provider, turn on SCIM provisioning, and assign Okta groups to permission sets.
IAM Identity Center with Okta as the external IdP gives one portal, and SCIM keeps users and group memberships in sync, so deactivating a user in Okta removes AWS access automatically. The built-in directory would need manual user management and would not follow Okta deactivations. Per-account SAML providers keep the high overhead the company wants to remove.

Question 3Operational Excellence⚑ Flag

A company uses AWS Organizations with 140 accounts. The security team maintains a CloudFormation template that creates an audit IAM role and an EventBridge rule. Every account placed in the Workloads OU must receive this baseline within minutes, and the resources must be removed when an account leaves the OU. The team wants the LEAST operational overhead. Which solution meets these requirements?

APublish the template as an AWS Service Catalog product shared with the Workloads OU and ask account owners to launch it. BAdd a CloudFormation deploy action per account to a central pipeline and edit the pipeline whenever an account joins the OU. CCreate a StackSet with self-managed permissions and use a Lambda function triggered by CreateAccount events to add stack instances. DCreate a StackSet with service-managed permissions that targets the Workloads OU, with automatic deployment on and retention off.

Correct answer: D. Create a StackSet with service-managed permissions that targets the Workloads OU, with automatic deployment on and retention off.
A service-managed StackSet with automatic deployment deploys to accounts as they join the target OU and deletes the stack instances when they leave if stack retention is off. The self-managed approach adds custom Lambda code to maintain and does not remove resources when an account moves out of the OU.

Question 4Cost Optimization⚑ Flag

A retail company runs 420 EC2 instances across 35 member accounts in AWS Organizations. Average CPU utilization is below 20%, but application owners will not downsize unless they see proof that memory will not become a bottleneck. The workloads follow steady daily patterns with no monthly or seasonal peaks. The FinOps team wants rightsizing recommendations for every account at the lowest cost. Which solution is MOST cost-effective?

AOpt in to Compute Optimizer for the organization and collect memory metrics with the CloudWatch agent. BOpt in to Compute Optimizer for the organization and turn on enhanced infrastructure metrics for all instances. CRun the Trusted Advisor low utilization check in each account and pick smaller instance types from its results. DDeploy a third-party rightsizing tool on a dedicated EC2 instance in every member account of the organization.

Correct answer: A. Opt in to Compute Optimizer for the organization and collect memory metrics with the CloudWatch agent.
Compute Optimizer is free at its default level and covers every member account when the organization opts in from the management account. Memory data from the CloudWatch agent lets it make memory-aware recommendations. Enhanced infrastructure metrics is a paid feature that only extends the lookback period, which steady daily workloads do not need, and it does not supply memory data by itself.

Question 5Resilience & Migration⚑ Flag

A logistics company runs its order management system on Amazon EC2 instances and an Amazon RDS for PostgreSQL DB instance in us-east-1. The business requires an RTO of 2 hours and an RPO of 5 minutes if the entire Region becomes unavailable. Finance wants the monthly cost in the recovery Region kept as low as possible while still meeting both targets. Which disaster recovery approach BEST meets these requirements?

ARun full-size copies of the stack in both Regions on Aurora Global Database with Route 53 latency-based routing records. BKeep a cross-Region RDS read replica in us-west-2 and launch the app tier from AMIs with CloudFormation at failover. CCopy daily RDS snapshots and AMIs to us-west-2 with AWS Backup and rebuild the full stack from those copies at failover. DRun a scaled-down but fully working copy of the application and database in us-west-2 and scale it out at failover.

Correct answer: B. Keep a cross-Region RDS read replica in us-west-2 and launch the app tier from AMIs with CloudFormation at failover.
A pilot light keeps only the data layer running through a cross-Region read replica, which meets the 5-minute RPO, and launches the stopped application tier from templates well within 2 hours. Daily snapshot copies cannot meet a 5-minute RPO. A warm standby or active/active design also meets the targets, but it costs more because compute runs all the time.

Question 6Cloud Architecture Design⚑ Flag

A logistics company publishes shipment status updates from a legacy monolith. Three new microservices each need only certain status types, must process messages at their own pace, and must not lose messages while a service is down for maintenance. The company does not want to add routing logic to the monolith. Which solution BEST meets these requirements?

APublish to one SNS topic and subscribe one SQS queue per service, each with a filter policy on the status type. BPublish to one SQS standard queue and have each service delete only the messages that match its status types. CPublish to three separate SQS queues from the monolith and pick the target queue in code based on the status type. DPublish to one SNS topic and subscribe each service's HTTPS endpoint with a filter policy on the status type.

Correct answer: A. Publish to one SNS topic and subscribe one SQS queue per service, each with a filter policy on the status type.
SNS fan-out to one SQS queue per service lets each subscription filter policy deliver only the relevant status types, and the queues buffer messages while a service is offline. HTTPS subscriptions also support filter policies, but SNS stops retrying once its delivery policy is exhausted, so a long maintenance window can lose messages. Choosing queues inside the monolith adds the routing logic the company wants to avoid.

Question 7Security & Governance⚑ Flag

A media company lets application developers create IAM roles for their AWS Lambda functions in a shared development account. The security team is concerned that a developer could create a role with more permissions than the developer has and then use it to escalate privileges. Developers must still be able to create and manage roles without opening a ticket. Which solution BEST meets these requirements?

AAttach an SCP to the development account that denies iam:CreateRole and iam:PutRolePolicy for all principals except the security team. BRequire developers to pass a session policy when they assume their role so that the session cannot exceed a defined set of permissions. CEnable IAM Access Analyzer policy validation and send weekly findings about overly permissive new roles to the security team for review. DAllow iam:CreateRole only when a specific permissions boundary is attached, and deny changes to or removal of that boundary policy.

Correct answer: D. Allow iam:CreateRole only when a specific permissions boundary is attached, and deny changes to or removal of that boundary policy.
A permissions boundary condition on role creation caps the maximum permissions of every role developers create, and denying edits to the boundary closes the escalation path. An SCP that denies role creation stops the threat but removes the self-service ability developers need. Session policies only limit the developer's own session, not the roles the developer creates.

Question 8Operational Excellence⚑ Flag

A fintech company deploys CloudFormation templates through a CodePipeline pipeline. Security requires that a template be rejected before deployment if any S3 bucket lacks default encryption or any RDS DB instance has StorageEncrypted set to false. The rules must be versioned in Git next to the application code, and developers must be able to run the same checks on their laptops. Which solution BEST meets these requirements?

AWrite AWS CloudFormation Guard rules in the repository and run cfn-guard validate in a CodeBuild stage that fails on violations. BDeploy AWS Config managed rules for bucket and database encryption with automatic remediation through Systems Manager. CRun IAM Access Analyzer policy validation on each template in a CodeBuild stage that runs before the deploy stage. DAttach a service control policy that denies s3:CreateBucket and rds:CreateDBInstance unless the request carries an approved tag.

Correct answer: A. Write AWS CloudFormation Guard rules in the repository and run cfn-guard validate in a CodeBuild stage that fails on violations.
CloudFormation Guard rules live in Git, run with the same CLI on laptops and in CodeBuild, and stop the pipeline before any resource is created. AWS Config rules evaluate resources only after they are deployed, so they cannot reject a template before deployment.

Question 9Resilience & Migration⚑ Flag

A media company uses an Amazon Aurora PostgreSQL global database with the primary cluster in eu-west-1 and a secondary cluster in eu-central-1. Auditors require a documented Region rotation test each quarter in which the secondary Region becomes the writer. The test must not lose any committed transactions. The global database topology must stay intact afterward so that replication continues without a rebuild. Which action BEST meets these requirements?

ADetach the eu-central-1 cluster from the global database and promote it to a standalone cluster. BStop writes, take a snapshot of the primary, and restore it as a new primary cluster in eu-central-1. CPerform a global database switchover to promote the eu-central-1 cluster to primary. DPerform a global database failover with data loss allowed to the eu-central-1 cluster.

Correct answer: C. Perform a global database switchover to promote the eu-central-1 cluster to primary.
A switchover is the managed operation for planned events. It waits until the secondary is fully synchronized before changing roles, so no committed data is lost and the old primary becomes a secondary in the same global database. A failover that allows data loss is meant for unplanned outages, and detaching a cluster breaks the topology and forces a rebuild of replication.

Question 10Cloud Architecture Design⚑ Flag

An insurance company automates claims processing with AWS Step Functions. Claims above a set amount must pause until an adjuster approves or rejects them in an internal web application, which can take up to two weeks. The company wants no compute running while the workflow waits and a complete execution history for auditors. Which design meets these requirements?

AUse a Standard workflow with a .waitForTaskToken task, and have the web application call SendTaskSuccess or SendTaskFailure. BUse a Standard workflow with a Lambda function that stays running and checks an approval table until a decision appears. CUse a Standard workflow with an activity task, and run an EC2 worker that polls GetActivityTask for adjuster decisions. DUse an Express workflow with a callback task, and have the web application return the task token when the adjuster decides.

Correct answer: A. Use a Standard workflow with a .waitForTaskToken task, and have the web application call SendTaskSuccess or SendTaskFailure.
Standard workflows can run for up to one year, keep a full execution history, and support the callback pattern, so the execution waits at no compute cost until the application returns the task token. Express workflows run for at most five minutes and do not support the .waitForTaskToken pattern. A Lambda function cannot run longer than 15 minutes, and an EC2 activity worker is compute that keeps running while it waits.

Question 11Security & Governance⚑ Flag

A financial services company has 300 accounts in AWS Organizations with all features enabled. An audit found an S3 bucket policy and a KMS key policy that granted access to a principal in an external AWS account. The company wants a preventive control that stops any principal outside the organization from accessing S3 buckets and KMS keys in every account, even if a resource policy is misconfigured. AWS services acting on the company's behalf must keep working. Which solution meets these requirements with the LEAST operational overhead?

AAttach an SCP to the organization root that denies S3 and KMS actions when aws:ResourceOrgID does not match the organization ID. BDeploy an AWS Config organization rule that detects resource policies granting external access and triggers automatic remediation. CEnable IAM Access Analyzer with the organization as the zone of trust and have the security team review external access findings daily. DAttach an RCP to the organization root that denies S3 and KMS access when aws:PrincipalOrgID does not match, except for AWS services.

Correct answer: D. Attach an RCP to the organization root that denies S3 and KMS access when aws:PrincipalOrgID does not match, except for AWS services.
Resource control policies set the maximum permissions on resources in member accounts, so an RCP with an aws:PrincipalOrgID condition blocks external principals even when a bucket or key policy allows them. SCPs only restrict principals inside the organization, so they cannot stop an external account from using a misconfigured resource policy. Config rules and Access Analyzer are detective and act only after the exposure exists.

Question 12Cost Optimization⚑ Flag

A media company spends a steady amount every hour on x86 EC2 instances in two Regions. Over the next 9 months it plans to move most workloads to Graviton instance families and shift its API tier to AWS Fargate. Finance will approve a commitment of no more than 1 year and wants no upfront payment. Which purchase option is MOST cost-effective while still covering the usage after the migration?

ABuy a 1-year No Upfront EC2 Instance Savings Plan for the current x86 instance families. BBuy a 1-year No Upfront Compute Savings Plan sized to the steady hourly spend. CBuy 1-year Convertible Reserved Instances and exchange them as instance families change. DBuy a 3-year No Upfront Compute Savings Plan to lock in the deepest discount rate.

Correct answer: B. Buy a 1-year No Upfront Compute Savings Plan sized to the steady hourly spend.
Compute Savings Plans apply across instance families, Regions and compute services, including Fargate, so the discount follows the workloads after the migration. EC2 Instance Savings Plans are tied to one instance family in one Region, and Convertible Reserved Instances never cover Fargate. The 3-year plan breaks the 1-year limit.

Question 13Operational Excellence⚑ Flag

A company runs an application in us-east-1 with a warm standby copy in us-west-2 that uses an Aurora global database. The application reads database credentials from AWS Secrets Manager, and the secret rotates every 30 days in us-east-1. During a Regional failover, the standby must read current credentials locally in us-west-2 without manual steps. Which solution meets these requirements with the LEAST operational overhead?

AStore a copy of the credentials as a SecureString parameter in us-west-2 and update it with a Lambda function after rotation. BConfigure the standby application to call the Secrets Manager endpoint in us-east-1 directly whenever it needs credentials. CReplicate the secret to us-west-2 with Secrets Manager replication so that each rotation in us-east-1 updates the replica. DCreate a separate secret in us-west-2 with its own 30-day rotation schedule that targets the secondary Aurora cluster.

Correct answer: C. Replicate the secret to us-west-2 with Secrets Manager replication so that each rotation in us-east-1 updates the replica.
A replica secret stays in sync with its primary, so each rotation in us-east-1 reaches us-west-2 automatically and the standby reads it locally. A separate secret with its own rotation would change the password independently, so the two Regions would hold conflicting credentials for the same database user.

Question 14Cloud Architecture Design⚑ Flag

A fintech company has microservices in 12 AWS accounts. Some run on Amazon ECS, some on AWS Lambda, and some on EC2 Auto Scaling groups, and several VPCs use overlapping CIDR ranges. The company needs service-to-service HTTPS calls across accounts with IAM-based authorization for each service. Which solution meets these requirements with the LEAST operational overhead?

AAttach all of the VPCs to a transit gateway and control access between services with security groups and network ACLs. BCreate an Amazon VPC Lattice service network, share it through AWS RAM, and attach an auth policy to each service. CCreate ECS Service Connect namespaces in each account and register the Lambda functions as Service Connect clients. DExpose each service through its own PrivateLink endpoint service and create interface endpoints in every consumer VPC.

Correct answer: B. Create an Amazon VPC Lattice service network, share it through AWS RAM, and attach an auth policy to each service.
VPC Lattice connects services across accounts and VPCs, including VPCs with overlapping CIDRs, and supports ECS, Lambda, and EC2 targets with IAM auth policies on each service. A transit gateway cannot route between overlapping CIDR ranges and offers no IAM authorization. PrivateLink handles overlapping ranges but needs an endpoint service and interface endpoints for every service and consumer pair, which is far more to operate.

Question 15Security & Governance⚑ Flag

A fitness startup is building a mobile app where users sign in with Google or Apple and upload workout videos directly to Amazon S3. Each user must be able to read and write only objects under a prefix that matches the user's own identity. The company does not want to run backend servers for uploads or embed long-term credentials in the app. Which solution BEST meets these requirements?

AUse a Cognito user pool and have the app send its access token to Amazon S3, which validates the token before accepting each upload. BUse a Cognito identity pool that maps all authenticated users to one IAM role with read and write access to the whole bucket. CCreate an IAM user for each app user at registration and store the access keys in the device keychain for direct S3 uploads. DUse a Cognito user pool with social federation and an identity pool role that limits S3 keys to the caller's identity ID.

Correct answer: D. Use a Cognito user pool with social federation and an identity pool role that limits S3 keys to the caller's identity ID.
A Cognito identity pool exchanges user pool tokens for temporary AWS credentials, and the ${cognito-identity.amazonaws.com:sub} policy variable limits each user to the matching S3 prefix. Amazon S3 does not accept Cognito JWTs directly, so the app needs AWS credentials. A single role with access to the whole bucket would let users read each other's videos.

Question 16Resilience & Migration⚑ Flag

An insurance company stores claim documents in an Amazon S3 bucket in us-east-1. A new regulation requires a copy of each new object in us-west-2, with 99.99% of objects copied within 15 minutes under a contractual service commitment. The operations team must be alerted about any object that does not replicate within that time. The solution must have the least operational overhead. Which solution BEST meets these requirements?

ASend S3 event notifications to an AWS Lambda function that copies each new object to the us-west-2 bucket and logs failures. BConfigure S3 Cross-Region Replication with Replication Time Control and use its metrics and event notifications. CConfigure S3 Cross-Region Replication without Replication Time Control and alarm on the replication latency metric in CloudWatch. DRun an S3 Batch Replication job every 10 minutes from an Amazon EventBridge schedule to copy any new objects to us-west-2.

Correct answer: B. Configure S3 Cross-Region Replication with Replication Time Control and use its metrics and event notifications.
S3 Replication Time Control is backed by an SLA to replicate 99.99% of objects within 15 minutes, and it provides replication metrics and event notifications when an object misses the threshold. Standard Cross-Region Replication usually finishes quickly but carries no time commitment. Scheduled Batch Replication jobs and Lambda copy functions add operational overhead and give no guarantee.

Question 17Cost Optimization⚑ Flag

A visual effects studio renders frames every night on about 600 vCPUs of EC2 capacity for roughly 6 hours. Each frame is an independent task that can be retried, and the whole job must finish before 8 AM. The current Spot request uses a single instance type in one Availability Zone with the lowest-price allocation strategy, and it suffers frequent interruptions. Which change is MOST cost-effective?

AKeep lowest-price allocation and add a second instance type in the same Availability Zone. BReplace the Spot capacity with On-Demand Instances covered by a Compute Savings Plan. CUse an EC2 Fleet with many instance types in all AZs and capacity-optimized allocation. DBuy Reserved Instances for the full 600 vCPUs and run the nightly renders on them.

Correct answer: C. Use an EC2 Fleet with many instance types in all AZs and capacity-optimized allocation.
Spreading Spot requests across many instance types and Availability Zones gives the fleet more capacity pools, and capacity-optimized allocation launches into the pools least likely to be interrupted. Because tasks can be retried, Spot stays far cheaper than any On-Demand option. Savings Plans and Reserved Instances bill for the commitment during the 18 hours each day the fleet sits idle.

Question 18Operational Excellence⚑ Flag

A media company deploys a Lambda-based API about 10 times a week with AWS SAM. A recent release returned 5xx errors to all users for 20 minutes before anyone noticed. The company wants each new version to receive 10 percent of traffic for 10 minutes and then all traffic, with automatic rollback if errors increase. The solution must add the LEAST operational overhead. Which solution meets these requirements?

ASet the SAM deployment preference to Canary10Percent10Minutes on an alias, with a CloudWatch error alarm for rollback. BSet the SAM deployment preference to Linear10PercentEvery10Minutes on an alias, with a CloudWatch error alarm for rollback. CEnable an API Gateway canary release on the stage at 10 percent and promote it manually after reviewing the error metrics. DUse a Step Functions workflow that updates alias routing weights and calls a Lambda function that checks the error rate.

Correct answer: A. Set the SAM deployment preference to Canary10Percent10Minutes on an alias, with a CloudWatch error alarm for rollback.
With Canary10Percent10Minutes, CodeDeploy shifts 10 percent of traffic, waits 10 minutes, then shifts the rest, and the attached alarm triggers an automatic rollback. The linear option moves traffic in 10 percent steps every 10 minutes, so the release takes far longer than the required pattern.

Question 19Cloud Architecture Design⚑ Flag

A sports betting startup must push live odds to about 50,000 mobile clients and accept bet placements from those clients over the same persistent connection. The backend runs on AWS Lambda, and backend processes must be able to send a message to one specific connected client. The team wants a fully managed solution. Which solution meets these requirements?

AUse an API Gateway REST API with Lambda integrations and have the clients poll an odds endpoint every second. BUse an Application Load Balancer with Lambda targets and rely on the listener's built-in WebSocket support. CUse Amazon SNS mobile push notifications for the odds and have the clients publish their bets to an SNS topic. DUse an API Gateway WebSocket API, store connection IDs in DynamoDB, and reply through the @connections API.

Correct answer: D. Use an API Gateway WebSocket API, store connection IDs in DynamoDB, and reply through the @connections API.
A WebSocket API keeps a two-way connection open, invokes Lambda for routes such as $connect and a bet route, and lets backend code post to a specific connection ID through the @connections API. An Application Load Balancer rejects WebSocket upgrade requests for Lambda targets. Polling a REST API is not a push model and adds cost and delay.

Question 20Security & Governance⚑ Flag

A platform team runs 40 Amazon EKS clusters across several accounts and creates new clusters every month. Pods need different IAM permissions, and the team is tired of creating an IAM OIDC provider for each cluster and editing role trust policies whenever a cluster is added. The node IAM role must not carry application permissions. Which solution meets these requirements with the LEAST operational overhead?

AInstall the EKS Pod Identity Agent add-on and create pod identity associations that map service accounts to IAM roles. BUse IAM roles for service accounts and automate OIDC provider creation and trust policy updates with a Lambda function. CAttach all application permissions to the node instance role and use Kubernetes network policies to isolate the pods. DStore IAM user access keys in Kubernetes secrets and mount a separate secret into each application pod when it starts.

Correct answer: A. Install the EKS Pod Identity Agent add-on and create pod identity associations that map service accounts to IAM roles.
EKS Pod Identity uses one trust relationship with the pods.eks.amazonaws.com service principal, so a role can be reused across clusters without an OIDC provider or a trust policy edit per cluster. IAM roles for service accounts works but needs exactly the per-cluster OIDC setup the team wants to avoid. Putting permissions on the node role would share them with every pod on the node.

Question 21Cloud Architecture Design⚑ Flag

A SaaS provider stores data for 3,000 small tenants in one shared Amazon DynamoDB table that uses the tenant ID as the partition key. An audit found that a coding error could let a request for one tenant read another tenant's items. The provider wants to keep the pooled model for cost reasons but enforce tenant isolation outside of application code. Which solution BEST meets these requirements?

AAdd a tenant ID check to every query through a shared data access library used by all services. BEncrypt each tenant's items with its own KMS key and rely on decrypt failures to block access. CUse tenant-scoped STS credentials whose policy limits dynamodb:LeadingKeys to that tenant ID. DMove each tenant to a dedicated DynamoDB table and grant every service access by table ARN.

Correct answer: C. Use tenant-scoped STS credentials whose policy limits dynamodb:LeadingKeys to that tenant ID.
Assuming a role with a session policy or session tag that restricts dynamodb:LeadingKeys to the current tenant ID makes IAM reject any request for another tenant's partition keys, even if the code has a bug. A shared library is still application code and can contain the same error. Dedicated tables are a silo model that the provider wants to avoid for cost reasons.

Question 22Security & Governance⚑ Flag

A SaaS company runs a document collaboration product built from 15 microservices. Authorization rules such as owners, editors, shared folders and tenant boundaries are hardcoded in each service, and every rule change requires redeploying several services. The company wants centralized, auditable authorization policies that change without code deployments and are evaluated on every request. Which solution BEST meets these requirements?

ACreate an IAM role for each end user and evaluate access by calling the IAM policy simulator from each microservice per request. BAdd Cognito user pool groups to the ID token and keep the authorization logic in a shared library that every service imports. CUse API Gateway resource policies to allow or deny each tenant's requests based on the source IP address and the request path. DStore the rules as Cedar policies in Amazon Verified Permissions and have each service call the authorization API per request.

Correct answer: D. Store the rules as Cedar policies in Amazon Verified Permissions and have each service call the authorization API per request.
Amazon Verified Permissions stores fine-grained Cedar policies centrally, evaluates them per request through its authorization API, and logs each decision, so rules change without redeploying services. A shared library with Cognito groups still needs code deployments for every rule change. IAM roles per end user do not scale for application users and are not designed for in-app authorization.

Question 23Operational Excellence⚑ Flag

A company runs 40 microservices on Amazon ECS with AWS Fargate and deploys them with rolling updates from CodePipeline. When a release contains a bad image, the new tasks fail health checks repeatedly and the deployment stays in progress for hours. The company wants failed deployments detected and the previous working revision restored automatically. The team does not want to move to blue/green deployments. Which solution meets these requirements?

ACreate an EventBridge rule on task stop events that invokes a Lambda function to restore the prior task definition. BSet the minimum healthy percent to 100 so that ECS keeps the old tasks running until the new tasks pass health checks. CSwitch each service to the CodeDeploy deployment controller and use an all-at-once blue/green configuration with rollback. DEnable the ECS deployment circuit breaker with rollback on each service that uses the rolling update controller.

Correct answer: D. Enable the ECS deployment circuit breaker with rollback on each service that uses the rolling update controller.
The deployment circuit breaker detects when new tasks cannot reach a steady state and, with rollback enabled, returns the service to the last completed deployment. Setting minimum healthy percent to 100 keeps old tasks running but leaves the failed deployment stuck instead of rolling it back.

Question 24Cost Optimization⚑ Flag

A logistics company runs 120 Lambda functions written in Python and Node.js that use no native x86 binaries. Together they consume a steady, very large number of GB-seconds each month. The company will not make any spending commitment, and throughput must stay the same. The team wants to lower compute cost without rewriting code or changing event sources. Which solution is MOST cost-effective?

ASet reserved concurrency on each function to cap the billed environments. BSwitch the functions to the arm64 architecture after testing in staging. CBuy a 1-year Compute Savings Plan that covers the steady Lambda usage. DRepackage the functions as containers and run them on ECS with Fargate.

Correct answer: B. Switch the functions to the arm64 architecture after testing in staging.
Lambda functions on arm64 (Graviton) are billed at a lower price per GB-second, and interpreted Python and Node.js code without x86 binaries usually runs unchanged. A Compute Savings Plan would also cut cost, but the company does not want a commitment. Reserved concurrency does not lower the price and would throttle events at peak.

Question 25Resilience & Migration⚑ Flag

A retailer runs a web application on an Amazon EC2 Auto Scaling group behind an Application Load Balancer across three Availability Zones. Last quarter, a partial impairment in one Availability Zone caused errors for 40 minutes before engineers noticed and acted. The company wants traffic moved away from an impaired Availability Zone automatically when AWS detects the problem, without building custom health monitoring. Capacity in the remaining zones is already sized for full load. Which solution BEST meets these requirements?

ACreate CloudWatch alarms for each zone that invoke a Lambda function to deregister the targets in the failing zone. BConfigure Route 53 failover records with health checks that send users to a standby stack in another Region. CEnable zonal autoshift for the Application Load Balancer as a managed resource in Application Recovery Controller. DStart a zonal shift in Application Recovery Controller from a runbook when the on-call engineer gets an alarm.

Correct answer: C. Enable zonal autoshift for the Application Load Balancer as a managed resource in Application Recovery Controller.
Zonal autoshift lets AWS shift traffic away from an Availability Zone when its own telemetry detects an impairment, with no custom monitoring and no human action. A manual zonal shift also moves traffic, but it still depends on engineers noticing the problem, which caused the 40-minute delay. Custom Lambda logic adds overhead, and a Regional failover is far broader than a single zone issue requires.

Question 26Cloud Architecture Design⚑ Flag

A law firm wants an internal assistant that answers questions about 200,000 PDF contracts stored in Amazon S3. Answers must cite the source documents, newly added contracts must become searchable without custom pipelines, and the firm has no machine learning engineers. Which solution meets these requirements with the LEAST operational overhead?

AIndex the contracts in Amazon Kendra and show users the ranked document excerpts that match each question. BFine-tune a foundation model in Amazon Bedrock on the contract text each week and send questions to the custom model. CRun an open-source embedding model and a vector database on Amazon EKS behind a custom retrieval service. DCreate an Amazon Bedrock knowledge base on the S3 bucket, sync it on a schedule, and call RetrieveAndGenerate.

Correct answer: D. Create an Amazon Bedrock knowledge base on the S3 bucket, sync it on a schedule, and call RetrieveAndGenerate.
A Bedrock knowledge base handles parsing, chunking, embedding, and vector storage, and RetrieveAndGenerate returns generated answers with citations to the source documents. Scheduled ingestion jobs pick up new contracts without a custom pipeline. Fine-tuning does not provide citations, and the model would always lag behind the newest contracts.

Question 27Security & Governance⚑ Flag

A payments company encrypts card tokens on the client side with the AWS Encryption SDK before writing them to an Amazon DynamoDB global table in us-east-1 and us-west-2. During an outage of us-east-1, applications in us-west-2 must decrypt every item without calling AWS KMS in us-east-1. The company wants the key to stay managed by AWS KMS with minimal operational overhead. Which solution meets these requirements?

AKeep a single-Region key in us-east-1 and configure applications in us-west-2 to call that key through its Regional endpoint. BDeploy an AWS CloudHSM cluster in each Region and synchronize the key material between the clusters with a scheduled job. CCreate a multi-Region primary key in us-east-1, replicate it to us-west-2, and decrypt with the local replica key. DCreate a separate single-Region KMS key in each Region and encrypt each item with the key in the Region where it is written.

Correct answer: C. Create a multi-Region primary key in us-east-1, replicate it to us-west-2, and decrypt with the local replica key.
Multi-Region keys share the same key material and key ID, so ciphertext created with the primary key can be decrypted by the replica in us-west-2 with no cross-Region call. Separate single-Region keys cannot decrypt each other's ciphertext, so items written in us-east-1 would be unreadable in us-west-2. Calling the us-east-1 key fails during the outage, and CloudHSM adds heavy operational overhead.

Question 28Operational Excellence⚑ Flag

A healthcare company runs containers on Amazon ECS with AWS Fargate from 300 images stored in Amazon ECR. Basic scanning on push is enabled, but images pushed months ago are never checked against newly published CVEs. The security team must be notified within minutes when any image gets a new critical finding. The solution must require the LEAST operational overhead. Which solution meets these requirements?

AEnable Amazon GuardDuty Runtime Monitoring for ECS on Fargate and alert the security team on any high severity finding. BEnable ECR enhanced scanning with continuous scanning and route critical Inspector findings to SNS with an EventBridge rule. CKeep basic scanning and use EventBridge Scheduler to invoke a Lambda function that calls StartImageScan on every image daily. DTurn on Amazon Inspector EC2 scanning for the account and send critical findings to the security team through Amazon SNS.

Correct answer: B. Enable ECR enhanced scanning with continuous scanning and route critical Inspector findings to SNS with an EventBridge rule.
Enhanced scanning uses Amazon Inspector to rescan images automatically when new CVEs are published, and Inspector findings arrive in EventBridge for near real-time alerts. A scheduled daily basic scan adds custom code and cannot alert within minutes of a new CVE.

Question 29Cloud Architecture Design⚑ Flag

A medical imaging company runs a computer vision model on scans of up to 800 MB each, and each inference takes 10 to 20 minutes. Requests arrive in unpredictable bursts with idle periods of several hours. The company wants to stop paying for idle instances and must notify the uploading system when each result is ready. Which SageMaker AI inference option BEST meets these requirements?

AA serverless inference endpoint that the uploading system calls and then waits on for a synchronous response. BA real-time endpoint with target tracking auto scaling and a minimum capacity of one GPU instance. CAn asynchronous inference endpoint that scales to zero instances and publishes results to an SNS topic. DA batch transform job that starts for each scan as soon as the file lands in the input S3 bucket.

Correct answer: C. An asynchronous inference endpoint that scales to zero instances and publishes results to an SNS topic.
Asynchronous inference accepts payloads up to 1 GB, allows processing times up to one hour, can scale the instance count to zero, and sends success or error notifications through Amazon SNS. A serverless endpoint has a small payload limit and a short timeout that an 800 MB, 20-minute request exceeds. A real-time endpoint with a minimum of one instance keeps paying during idle hours.

Question 30Security & Governance⚑ Flag

A data platform account stores reports in an S3 bucket encrypted with SSE-KMS using a customer managed key. An analytics role in another account in the same organization needs to read these objects. The bucket policy allows the analytics role to call s3:GetObject, and the role's IAM policy also allows s3:GetObject on the bucket. Reads still fail with an access denied error. Which additional change BEST resolves the issue while following least privilege?

AAllow the analytics role kms:Decrypt in the key policy, and grant kms:Decrypt on the key ARN in the role's IAM policy. BRe-encrypt the objects with the AWS managed aws/s3 key and add the analytics account to that key's key policy for decryption. CAttach an SCP to the analytics account that allows kms:Decrypt on all keys that are owned by accounts in the organization. DAdd kms:Decrypt for the analytics role to the bucket policy so that Amazon S3 decrypts the objects on the role's behalf.

Correct answer: A. Allow the analytics role kms:Decrypt in the key policy, and grant kms:Decrypt on the key ARN in the role's IAM policy.
Cross-account use of a KMS key requires both the key policy in the owning account and an IAM policy in the caller's account to allow kms:Decrypt. The AWS managed aws/s3 key policy cannot be edited, so it cannot be shared across accounts. SCPs never grant permissions, and a bucket policy cannot grant access to a KMS key.

Question 31Resilience & Migration⚑ Flag

A healthcare company uses AWS Backup for Amazon EBS and Amazon RDS backups. After a ransomware incident at a peer company, auditors require that recovery points be retained for 7 years. No user, including the account root user, may delete them or shorten their retention. The security team wants a short testing period before the controls become permanent. Which solution BEST meets these requirements?

AAdd a backup vault access policy that denies delete actions, and restrict changes to that policy with IAM. BApply AWS Backup Vault Lock in compliance mode with a 3-day grace time and a 7-year minimum retention. CApply AWS Backup Vault Lock in governance mode with a 7-year minimum retention on the backup vault. DAttach an SCP that denies backup:DeleteRecoveryPoint to every principal in the account that owns the vault.

Correct answer: B. Apply AWS Backup Vault Lock in compliance mode with a 3-day grace time and a 7-year minimum retention.
Vault Lock in compliance mode becomes immutable when the grace time ends, and after that no user, including the root user, can remove the lock or delete recovery points early. The grace time, which is at least 3 days, gives the team a window to test. Governance mode can be removed by users with sufficient IAM permissions, so it does not meet the requirement.

Question 32Cost Optimization⚑ Flag

An insurance company runs an internal claims API on two always-on m6i.large instances behind an Application Load Balancer. The API receives about 40,000 requests per day, almost all during business hours, and each request finishes in under 300 ms. The API is stateless and sits idle at night and on weekends. Which architecture is MOST cost-effective while keeping the API available at all times?

ARun the API on AWS Lambda behind an Amazon API Gateway HTTP API. BRun the API as two always-on AWS Fargate tasks behind the existing ALB. CKeep the instances and cover them with a 3-year EC2 Instance Savings Plan. DRun the API on an Amazon EKS cluster with a small managed node group.

Correct answer: A. Run the API on AWS Lambda behind an Amazon API Gateway HTTP API.
At 40,000 short requests per day, Lambda with an HTTP API costs very little because it bills per request and per millisecond of compute, with no charge while idle. Fargate tasks, EC2 instances and EKS nodes bill for every hour they run, including nights and weekends. A Savings Plan only discounts capacity that would still sit idle most of the week.

Question 33Operational Excellence⚑ Flag

A company has 60 accounts in AWS Organizations, and all workloads run in us-east-1. The SRE team must search logs, view metrics, and follow X-Ray traces for every account from one monitoring account without switching roles. New accounts must be included automatically. Which solution meets these requirements with the LEAST operational overhead?

ABuild Amazon Managed Grafana dashboards with one data source per account and add a data source for each new account. BCreate an IAM role in each account and have SRE engineers switch into it from the monitoring account during investigations. CConfigure CloudWatch cross-account observability with a sink in the monitoring account linked to the organization. DStream each account's log groups to the monitoring account with subscription filters and Amazon Data Firehose streams.

Correct answer: C. Configure CloudWatch cross-account observability with a sink in the monitoring account linked to the organization.
CloudWatch cross-account observability links source accounts to a sink in the monitoring account, so metrics, logs, and traces are searchable in one place, and linking through Organizations covers new accounts automatically. Log subscription filters move only logs, need resources in every account, and do not cover metrics or traces.

Question 34Cloud Architecture Design⚑ Flag

A marketing analytics SaaS company trains a separate small XGBoost model for each of its 4,000 customers. Each model is invoked only a few times per hour and must answer in under one second once loaded. Hosting each model on its own SageMaker AI real-time endpoint has become too expensive. Which solution is the MOST cost-effective?

AHost each model on its own serverless inference endpoint and configure provisioned concurrency for each. BScore all customers in a nightly batch transform job and serve the cached predictions from DynamoDB. CDeploy all models to one real-time endpoint and create a separate production variant for each customer. DHost the models on a SageMaker multi-model endpoint that loads each model from Amazon S3 when invoked.

Correct answer: D. Host the models on a SageMaker multi-model endpoint that loads each model from Amazon S3 when invoked.
A multi-model endpoint shares one fleet of instances across thousands of models, loads each model from S3 on first use, and keeps frequently used models cached in memory. An endpoint supports at most 10 production variants, so one variant per customer is not possible. Nightly batch scoring cannot answer requests for new inputs in real time.

Question 35Security & Governance⚑ Flag

A European bank must meet a regulation that requires encryption key material to stay in HSMs that the bank operates in its own data centers, outside AWS. The bank must be able to stop AWS from using the keys at any time by cutting off access on its side. Workloads must keep using native SSE-KMS integration with Amazon S3 and Amazon EBS. Which solution BEST meets these requirements?

ACreate KMS keys in a custom key store backed by an AWS CloudHSM cluster that only the bank's administrators manage. BGenerate key material in the on-premises HSMs and import it into KMS keys with an expiration date set on the material. CEncrypt data on the client side with keys from the on-premises HSMs before uploading objects and writing to EBS volumes. DCreate KMS keys in an external key store that connects through an XKS proxy to the bank's on-premises HSMs.

Correct answer: D. Create KMS keys in an external key store that connects through an XKS proxy to the bank's on-premises HSMs.
An external key store keeps key material in the bank's own HSMs outside AWS, and every cryptographic operation goes through the bank's XKS proxy, which the bank can disconnect at any time. A CloudHSM key store still holds the key material inside AWS. Imported key material places a copy of the material in AWS KMS, which fails the residency rule, and client-side encryption loses native SSE-KMS integration.

Question 36Resilience & Migration⚑ Flag

A travel company runs a booking platform on Amazon EC2, Amazon EBS, and Amazon Aurora across three Availability Zones. Leadership wants to prove in production that the platform keeps serving customers if one Availability Zone loses power. The test must stop automatically if the customer-facing error rate goes above 2%. The team wants to use a prebuilt test definition where possible. Which solution BEST meets these requirements?

ARun an AWS FIS experiment from the AZ Availability: Power Interruption scenario with a CloudWatch alarm stop condition. BRun an AWS FIS experiment from the AZ Availability: Power Interruption scenario with a fixed experiment duration of 10 minutes. CRun an AWS Resilience Hub assessment of the platform against a resiliency policy that includes Availability Zone disruption. DRun a Systems Manager Automation runbook that stops every instance in one Availability Zone while engineers watch a dashboard.

Correct answer: A. Run an AWS FIS experiment from the AZ Availability: Power Interruption scenario with a CloudWatch alarm stop condition.
AWS FIS provides a prebuilt AZ Availability: Power Interruption scenario, and a CloudWatch alarm set as a stop condition halts the experiment as soon as the error threshold is crossed. A fixed duration ends the test on time but does not stop it when customers are affected. A Resilience Hub assessment estimates resilience but does not inject real faults.

Question 37Cost Optimization⚑ Flag

A research institute stores 2 PB of genomics files in S3 Standard, and each file is between 50 MB and 5 GB. Some datasets are read daily for months, while others sit untouched for a year and are then suddenly reanalyzed. The access pattern of any dataset cannot be predicted. Every file must be readable within milliseconds, and the institute wants to avoid retrieval fees. Which storage approach is MOST cost-effective?

AAdd a lifecycle rule that moves objects to Glacier Instant Retrieval after 90 days. BMove the objects to S3 Intelligent-Tiering and leave the optional archive tiers off. CMove the objects to S3 Intelligent-Tiering and also enable the Deep Archive Access tier. DAdd a lifecycle rule that moves all objects to S3 Standard-IA after 30 days.

Correct answer: B. Move the objects to S3 Intelligent-Tiering and leave the optional archive tiers off.
S3 Intelligent-Tiering moves each object between its frequent, infrequent and archive instant access tiers based on that object's own access, with millisecond reads and no retrieval fees, and the per-object monitoring fee is small for large files. Standard-IA and Glacier Instant Retrieval charge per-GB retrieval fees that add up when old datasets are suddenly reanalyzed. The Deep Archive Access tier takes hours to restore, which breaks the millisecond requirement.

Question 38Cloud Architecture Design⚑ Flag

A bank is launching a customer chat assistant on Amazon Bedrock. Compliance requires that account numbers and other personal data be masked in responses, that the assistant refuse to discuss investment advice, and that the same controls apply to several different foundation models. The team wants to avoid writing custom filtering code. Which solution meets these requirements?

APass every model response through Amazon Comprehend PII detection in a Lambda function before returning it. BFine-tune each foundation model with examples of refused investment questions and masked account numbers. CAdd system prompt instructions telling each model never to reveal personal data or give investment advice. DCreate a Bedrock guardrail with sensitive information filters and a denied topic, and apply it to each call.

Correct answer: D. Create a Bedrock guardrail with sensitive information filters and a denied topic, and apply it to each call.
Amazon Bedrock Guardrails can mask or block personal data with sensitive information filters and block subjects with denied topics, and one guardrail can be applied to any model in Bedrock. System prompt instructions are not enforced and can be bypassed by users. A Comprehend Lambda function is custom code and does not handle the denied topic.

Question 39Security & Governance⚑ Flag

An industrial IoT manufacturer signs firmware images that devices verify offline using an embedded public key. The devices will stay in the field for more than 15 years, so the security team requires a signature algorithm that resists attacks from future quantum computers. The private signing key must never leave AWS KMS. Which solution BEST meets these requirements?

ACreate an HMAC KMS key and have each device call the VerifyMac API to check every firmware image before it is installed. BGenerate an ML-DSA key pair, store the private key in Secrets Manager, and sign each firmware image in a Lambda function. CCreate an asymmetric KMS key with an ML-DSA key spec for signing and verification, and embed its public key in the devices. DCreate an asymmetric KMS key with the RSA 4096 key spec for signing and verification, and embed its public key in the devices.

Correct answer: C. Create an asymmetric KMS key with an ML-DSA key spec for signing and verification, and embed its public key in the devices.
ML-DSA is a NIST-standardized post-quantum signature algorithm, and AWS KMS supports ML-DSA asymmetric keys whose private key never leaves KMS while the public key can be shared for offline verification. RSA signatures are expected to be breakable by large quantum computers. An HMAC key requires a call to KMS for verification, and a private key in Secrets Manager has left KMS.

Question 40Operational Excellence⚑ Flag

A retailer's checkout flow spans a web front end and three backend APIs. Failures that start overnight, when few customers shop, are not noticed until complaints arrive in the morning. The operations team wants the login, cart, and payment steps tested every 5 minutes, with screenshots of the failing step and an alarm on failure. Which solution BEST meets these requirements?

ACreate Route 53 health checks for the front end and each API endpoint, with CloudWatch alarms on the health check status. BCreate a CloudWatch Synthetics browser canary that scripts the checkout steps on a 5-minute schedule, with a failure alarm. CEnable X-Ray tracing on the front end and APIs and alarm when the fault rate on the checkout path rises above 1 percent. DEnable ALB access logs for the front end and alarm when the number of 5xx responses in the logs exceeds a threshold.

Correct answer: B. Create a CloudWatch Synthetics browser canary that scripts the checkout steps on a 5-minute schedule, with a failure alarm.
A Synthetics browser canary runs a scripted user journey on a schedule even when no real users are active, and it saves screenshots of each step for troubleshooting. Route 53 health checks only confirm that endpoints respond and cannot walk through a multi-step login and payment flow.

Question 41Cloud Architecture Design⚑ Flag

A semiconductor manufacturer runs a quality inspection application that must respond to machines on the factory floor within 5 milliseconds. Regulations require production data to stay inside the plant. The company wants to use the same AWS APIs, tools, and EC2 instance types it uses in the Region, and the plant has data center space and power available. Which solution meets these requirements?

ARun the application on Amazon EKS Anywhere clusters built on the company's existing plant servers. BDeploy the application in the closest AWS Region and use AWS Global Accelerator to reduce the latency. CInstall an AWS Outposts rack at the plant and run the application on EC2 instances in an Outpost subnet. DDeploy the application in the nearest AWS Local Zone and connect the plant to it with AWS Direct Connect.

Correct answer: C. Install an AWS Outposts rack at the plant and run the application on EC2 instances in an Outpost subnet.
An Outposts rack brings AWS-managed EC2 capacity into the plant, so data stays on site and the application uses the same APIs and instance types as the Region with very low local latency. A Local Zone is still an AWS facility outside the plant, so production data would leave the site. EKS Anywhere runs on customer hardware and does not provide EC2 instances or EC2 APIs.

Question 42Security & Governance⚑ Flag

A company is moving 200 accounts into a new AWS Organizations structure. It wants stricter preventive controls for production than for development, a sandbox area where builders experiment without access to the corporate network, and a protected home for log archive and security tooling accounts. Policies must be applied by group, not account by account. Which OU design BEST meets these requirements?

ACreate Security, Sandbox and Workloads OUs, split Workloads into Prod and SDLC child OUs, and attach SCPs per OU. BCreate one OU for each business department, mirroring the company org chart, and attach SCPs to each department OU. CKeep all accounts directly under the organization root and attach a tailored SCP to each account based on its purpose. DCreate one OU for each AWS Region the company uses and place every account in the OU that matches its primary Region.

Correct answer: A. Create Security, Sandbox and Workloads OUs, split Workloads into Prod and SDLC child OUs, and attach SCPs per OU.
Grouping accounts by function and environment, with Security, Sandbox and Workloads OUs and separate Prod and SDLC OUs, lets the company attach different SCPs to each group. OUs that mirror the org chart mix production and development accounts, so environment-specific controls cannot be applied cleanly. Per-account SCPs at the root create exactly the account-by-account overhead the company wants to avoid.

Question 43Operational Excellence⚑ Flag

An insurance company serves a fraud detection model from a SageMaker real-time endpoint. Seasonal changes in the input features reduced model accuracy for weeks before anyone noticed. Confirmed fraud labels arrive about 90 days after each claim. The company wants an alert soon after incoming feature distributions move away from the training data. Which solution meets these requirements?

ACreate a CloudWatch alarm on the endpoint ModelLatency metric and retrain the model whenever the alarm enters the ALARM state. BEnable data capture, baseline the training data with SageMaker Model Monitor, and schedule data quality jobs with alarms. CRun a SageMaker Clarify pre-training bias report on each new training dataset and retrain the model when it shows issues. DSchedule SageMaker Model Monitor model quality jobs that compare predictions with labeled outcomes and alarm on accuracy drops.

Correct answer: B. Enable data capture, baseline the training data with SageMaker Model Monitor, and schedule data quality jobs with alarms.
Data quality monitoring compares captured inference inputs with statistics and constraints from the training baseline, so drift is reported without waiting for labels. Model quality monitoring needs ground truth labels, which arrive 90 days late and would delay the alert.

Question 44Cost Optimization⚑ Flag

A data platform runs Spark jobs on EC2 instances in private subnets across three Availability Zones. The jobs read and write about 300 TB per month to S3 buckets in the same Region, and all of that traffic passes through a single NAT gateway in one AZ. NAT gateway data processing and cross-AZ transfer are now a large share of the bill. Security policy requires the instances to stay in private subnets. Which change is MOST cost-effective?

AAdd a gateway VPC endpoint for S3 and associate it with the private route tables. BCreate an interface VPC endpoint for S3 in each AZ and point the jobs at its DNS name. CRoute S3 traffic through a transit gateway to a shared egress VPC with NAT gateways. DDeploy a NAT gateway in each AZ and route every subnet to its local NAT gateway.

Correct answer: A. Add a gateway VPC endpoint for S3 and associate it with the private route tables.
A gateway VPC endpoint for S3 has no hourly or data processing charge, and same-Region S3 traffic goes straight from the route table to S3 without touching the NAT gateway. A NAT gateway in every AZ removes the cross-AZ charge but still bills for every GB processed. An interface endpoint for S3 works but adds hourly and per-GB fees that the gateway endpoint does not have.

Question 45Resilience & Migration⚑ Flag

A financial services firm plans to rehost 300 servers to Amazon EC2. The fleet includes VMware VMs, Hyper-V VMs, and physical servers running Windows and Linux. Each migration wave has a cutover window of 1 hour. Teams must test the migrated servers in AWS before cutover without affecting the source servers. Which solution BEST meets these requirements?

AUse AWS DataSync to copy each server's file systems to Amazon EBS volumes, and then attach the volumes to new EC2 instances. BRebuild each server on EC2 with CloudFormation templates, and then copy application data with AWS Database Migration Service. CUse AWS Application Migration Service with continuous block-level replication, test instances, and cutover instances. DUse VM Import/Export to convert exported VM images into AMIs for each wave, and then launch the instances from those AMIs.

Correct answer: C. Use AWS Application Migration Service with continuous block-level replication, test instances, and cutover instances.
Application Migration Service replicates VMware, Hyper-V, and physical servers continuously at the block level, so teams can launch nondisruptive test instances and finish cutover in minutes. VM Import/Export needs a fresh export of each VM at cutover, which does not fit a 1-hour window, and it cannot import physical servers directly. DataSync copies files to AWS storage services, not to EBS volumes, and rebuilding servers is not a rehost.

Question 46Cloud Architecture Design⚑ Flag

A media archive company has on-premises applications that write files over NFS to a NAS that is running out of capacity. The company wants the files stored as objects in Amazon S3 so it can apply lifecycle policies and process them with AWS analytics services. Recently used files must still be read with low latency on premises, and the applications cannot be changed. Which solution meets these requirements?

ADeploy Volume Gateway in cached mode and mount the iSCSI volumes on the application servers. BDeploy Amazon S3 File Gateway on premises and point the applications to an NFS file share. CMove the files to Amazon EFS and mount the file system over Direct Connect from the servers. DUse AWS DataSync to copy the NAS files to S3 every night and delete the oldest local copies.

Correct answer: B. Deploy Amazon S3 File Gateway on premises and point the applications to an NFS file share.
S3 File Gateway presents an NFS share, stores each file as an S3 object that lifecycle rules and analytics services can use, and keeps a local cache for recently used data. Volume Gateway exposes iSCSI block volumes, so the applications would need to change and the data would not be usable as individual S3 objects. EFS keeps the data out of S3 and has no local cache on premises.

Question 47Security & Governance⚑ Flag

A company uses AWS Control Tower, and application teams deploy infrastructure only through AWS CloudFormation. Security wants to stop stacks from creating S3 buckets without versioning or RDS instances without encryption, and the check must happen before the resource is provisioned. The team prefers managed controls over custom code. Which solution BEST meets these requirements?

AEnable the matching Control Tower detective controls on the workload OUs and alert the owning team when a resource is noncompliant. BDeploy AWS Config rules with automatic remediation that turn on versioning and encryption shortly after each resource is created. CAttach an SCP to the workload OUs that denies s3:CreateBucket and rds:CreateDBInstance unless the request includes compliant settings. DEnable the matching Control Tower proactive controls on the workload OUs so CloudFormation hooks block noncompliant resources.

Correct answer: D. Enable the matching Control Tower proactive controls on the workload OUs so CloudFormation hooks block noncompliant resources.
Control Tower proactive controls are implemented as CloudFormation hooks that evaluate resource properties and block noncompliant resources before they are provisioned. Detective controls and Config remediation act only after the resource exists. SCPs cannot inspect most resource properties, and bucket versioning is set through a separate API call that an SCP on s3:CreateBucket cannot evaluate.

Question 48Operational Excellence⚑ Flag

A logistics company patches 800 Amazon Linux 2023 instances in one account with the AWS default patch baseline through a State Manager association. A recent kernel update broke a proprietary agent, so that kernel version must never be installed. Patching must occur only between 01:00 and 04:00 on Saturdays, no instance may start patching after 03:00, and compliance must appear in Patch Manager. Which solution meets these requirements?

AUse a custom baseline that rejects the kernel as Blocked, and patch from a 3-hour maintenance window with a 1-hour cutoff. BUse a custom baseline that rejects the kernel as Allowed as dependency, and patch from a window with a 1-hour cutoff. CUse EventBridge Scheduler at 01:00 on Saturdays to run a Run Command script that upgrades packages except the kernel. DAdd the kernel version to the rejected patches of the AWS default baseline and move the association to 01:00 on Saturdays.

Correct answer: A. Use a custom baseline that rejects the kernel as Blocked, and patch from a 3-hour maintenance window with a 1-hour cutoff.
AWS predefined baselines cannot be edited, so a custom baseline is needed, and the Blocked action keeps the package from being installed even as a dependency. A maintenance window with a 3-hour duration and a 1-hour cutoff stops new patch tasks after 03:00, while the Allowed as dependency action could still install the kernel when another package requires it.

Question 49Cloud Architecture Design⚑ Flag

A retailer runs containerized inventory services on Amazon ECS in AWS. It must also run the same services on existing servers in 30 distribution centers that have reliable internet connections. The operations team wants to manage all deployments through the ECS console and APIs without running a separate orchestration control plane on premises. Which solution meets these requirements?

AOrder an AWS Outposts rack for each distribution center and run the ECS tasks on the Outpost capacity. BRegister the servers with Amazon ECS Anywhere and deploy the services with the EXTERNAL launch type. CAdd the distribution center servers to an AWS Fargate capacity provider in the existing ECS cluster. DInstall Amazon EKS Anywhere clusters in each distribution center and manage them from the EKS console.

Correct answer: B. Register the servers with Amazon ECS Anywhere and deploy the services with the EXTERNAL launch type.
ECS Anywhere installs the SSM Agent and the ECS agent on existing servers, registers them as external instances, and lets the team deploy with the same ECS control plane and APIs. EKS Anywhere runs a Kubernetes control plane on premises that the team would have to operate. Outposts adds new hardware instead of using the existing servers.

Question 50Security & Governance⚑ Flag

A healthcare company must capture management API activity from every current and future account in its organization, in all Regions. Logs must be stored in a dedicated log archive account, and member account administrators must not be able to stop or change logging. No one, including the root user, may delete log files for 7 years. Which solution BEST meets these requirements?

ACreate an organization trail that delivers to an S3 bucket in the log archive account with Object Lock in governance mode. BUse CloudFormation StackSets to create a multi-Region trail in every account that delivers to the central log archive bucket. CStream CloudTrail events from each account to Amazon CloudWatch Logs and copy them to the log archive account every week. DCreate an organization trail that delivers to an S3 bucket in the log archive account with Object Lock in compliance mode.

Correct answer: D. Create an organization trail that delivers to an S3 bucket in the log archive account with Object Lock in compliance mode.
An organization trail covers all accounts and Regions automatically and cannot be stopped or changed from member accounts, and Object Lock in compliance mode prevents any user, including root, from deleting objects during the retention period. Governance mode lets users with special permissions bypass retention. Per-account trails from StackSets can be stopped by member account administrators.

Question 51Resilience & Migration⚑ Flag

A retail company is moving a 6 TB Oracle Database 19c OLTP system to Amazon Aurora PostgreSQL. The database contains hundreds of PL/SQL stored procedures, triggers, and packages. The business allows no more than 30 minutes of downtime. The team wants managed AWS tooling with as little custom scripting as possible. Which solution BEST meets these requirements?

ARun a DMS full load and CDC task that lets DMS create the target tables, and then switch the application at cutover. BConvert the schema and code with DMS Schema Conversion, and then run a full-load-only DMS task during a weekend outage. CExport the database with Oracle Data Pump to Amazon S3, and import the dump files into Aurora PostgreSQL at cutover. DConvert the schema and code with DMS Schema Conversion, then run a DMS full load and CDC task until cutover.

Correct answer: D. Convert the schema and code with DMS Schema Conversion, then run a DMS full load and CDC task until cutover.
DMS Schema Conversion converts Oracle schemas, procedures, and triggers to PostgreSQL, and a full load plus change data capture keeps the target in sync so cutover takes minutes. DMS on its own creates only basic tables and does not convert stored code. A full-load-only task needs the source frozen for the whole load, which takes far longer than 30 minutes for 6 TB.

Question 52Cost Optimization⚑ Flag

A software company gives each of its 200 developers a sandbox account in a dedicated OU in AWS Organizations. Developers sometimes leave large instances running, and some sandbox accounts exceed their monthly budget. Leadership wants new resource launches in a sandbox account to be blocked automatically once its spend reaches the budget. The solution must not require custom code. Which solution is MOST cost-effective?

ACreate a budget per account with an AWS Budgets action that applies a deny SCP at 100%. BCreate a billing alarm per account that invokes a Lambda function to stop its instances. CEnable Cost Anomaly Detection for each account and email the developers about anomalies. DExport the Cost and Usage Report to Athena and run a daily query to find accounts over budget.

Correct answer: A. Create a budget per account with an AWS Budgets action that applies a deny SCP at 100%.
An AWS Budgets action can automatically attach a service control policy that denies new launches when an account reaches its threshold, with no custom code and only a small per-budget fee. A billing alarm that invokes Lambda requires writing and maintaining code. Cost Anomaly Detection and Athena queries only report on spend and do not block anything.

Question 53Operational Excellence⚑ Flag

A company runs 25 services that are instrumented with the AWS X-Ray SDK and use the default centralized sampling rule. During an investigation, the team must trace every request to the /checkout path of the payment service for one week. All other requests must keep the default sampling rate, and the services must not be redeployed. What should a solutions architect do?

AAdd a local sampling rules file to the payment service that samples /checkout at 100 percent, and redeploy the service. BCreate a CloudWatch Synthetics canary that calls the /checkout path every minute with X-Ray active tracing turned on. CCreate an X-Ray sampling rule that outranks the default and samples /checkout on the payment service at 100 percent. DChange the fixed rate of the default sampling rule to 100 percent so that every request, including checkout, is traced.

Correct answer: C. Create an X-Ray sampling rule that outranks the default and samples /checkout on the payment service at 100 percent.
SDKs that use centralized sampling poll X-Ray for rules, so a new higher priority rule for the payment service and the /checkout path takes effect without a redeployment. Raising the default rule to 100 percent would trace every path in every service and raise cost, which breaks the requirement to keep other requests at the default rate.

Question 54Cloud Architecture Design⚑ Flag

A manufacturing company has 60 VPCs in three AWS Regions, and each VPC is attached to the transit gateway in its Region. The company has one 10 Gbps AWS Direct Connect connection from its data center. Every VPC must reach the data center over this connection, and the network team wants the fewest virtual interfaces to manage. Which solution meets these requirements?

ACreate a transit virtual interface to a Direct Connect gateway and associate all three transit gateways. BCreate one private virtual interface to a Direct Connect gateway and associate every virtual private gateway. CCreate a Site-to-Site VPN connection from the data center to each transit gateway over the internet. DCreate a private virtual interface for each VPC and attach it to that VPC's virtual private gateway.

Correct answer: A. Create a transit virtual interface to a Direct Connect gateway and associate all three transit gateways.
One transit virtual interface to a Direct Connect gateway can be associated with transit gateways in multiple Regions, so all 60 VPCs reach the data center through their existing transit gateways. A private virtual interface with virtual private gateways bypasses the transit gateways and needs more gateway associations than a Direct Connect gateway allows. A private virtual interface per VPC is the opposite of the fewest interfaces.

Question 55Security & Governance⚑ Flag

A company with 250 accounts wants Amazon GuardDuty, including S3 Protection and EKS Runtime Monitoring, running in every existing and future account in all used Regions. A security tooling account must manage GuardDuty and see all findings, and the management account must not be used for daily security work. Which solution meets these requirements with the LEAST operational overhead?

AFrom the security tooling account, send GuardDuty membership invitations to all accounts and ask each owner to accept them. BMake the security account the GuardDuty delegated administrator in each Region and turn on auto-enable for all accounts. CFrom the management account, enable GuardDuty as the administrator in each Region and invite every member account by email. DUse CloudFormation StackSets to enable a standalone GuardDuty detector with all protection plans in every account and Region.

Correct answer: B. Make the security account the GuardDuty delegated administrator in each Region and turn on auto-enable for all accounts.
A delegated administrator manages GuardDuty for the whole organization from a non-management account, and auto-enable turns on GuardDuty and its protection plans for existing and new accounts. Invitation-based membership does not cover new accounts automatically and needs manual acceptance. Standalone detectors from StackSets give no central view of findings.

Question 56Resilience & Migration⚑ Flag

A research institute must move 150 TB from an on-premises NFS file server to Amazon EFS over an existing 10 Gbps AWS Direct Connect connection. Scientists keep writing new files until the final cutover, which has a 4-hour window. The team wants built-in data integrity checks and minimal custom scripting. Which solution BEST meets these requirements?

AWrite rsync scripts on an EC2 instance that pull data over NFS from the file server, and run them on a cron schedule. BDeploy an AWS DataSync agent, run an initial copy to EFS, schedule incremental runs, and run a final pass at cutover. CMount the EFS file system on premises over Direct Connect and copy all data with one parallel copy job during the window. DDeploy an Amazon S3 File Gateway on premises, move scientists to its share, and copy the data from S3 into EFS after cutover.

Correct answer: B. Deploy an AWS DataSync agent, run an initial copy to EFS, schedule incremental runs, and run a final pass at cutover.
DataSync copies data in parallel, verifies integrity, and transfers only changed files on later runs, so the final pass fits in the 4-hour window. Copying all 150 TB during the window is impossible because 10 Gbps moves at most about 4.5 TB per hour. Custom rsync scripts can work, but they add the scripting and verification effort the team wants to avoid.

Question 57Cloud Architecture Design⚑ Flag

A company has a shared networking account with a VPC that is connected to its on-premises data center. Workloads in 25 other accounts must resolve hostnames in the domain corp.example.internal, which is hosted on on-premises DNS servers. The company wants a centrally managed solution and does not want to run DNS servers on EC2. Which solution meets these requirements?

AChange the DHCP options set in each VPC so that instances send all DNS queries to the on-premises servers. BCreate a Route 53 Resolver inbound endpoint in the networking account and point the on-premises servers to it. CCreate a Resolver outbound endpoint and forwarding rule centrally, and share the rule through AWS RAM. DCreate a private hosted zone for corp.example.internal and copy the on-premises records into it every night.

Correct answer: C. Create a Resolver outbound endpoint and forwarding rule centrally, and share the rule through AWS RAM.
An outbound endpoint with a forwarding rule for corp.example.internal sends those queries to the on-premises servers, and sharing the rule through AWS RAM lets each account associate it with its own VPCs. An inbound endpoint handles the opposite direction, letting on-premises servers resolve names in AWS. Copying records into a private hosted zone requires a sync process, and the data goes stale between runs.

Question 58Security & Governance⚑ Flag

A company in the EU uses AWS Control Tower to govern 90 accounts. A new data residency policy says workloads may run only in eu-central-1 and eu-west-1. Global services such as IAM, Amazon CloudFront and Amazon Route 53 must keep working, and the team wants the least custom policy maintenance. Which solution BEST meets these requirements?

ADeploy an AWS Config rule in all accounts that flags any resource that is created outside the two approved Regions. BTurn on the Control Tower Region deny control in the landing zone settings and govern only the two approved Regions. CAttach a custom SCP to the organization root that denies all actions when aws:RequestedRegion is not one of the two Regions. DAdd a condition on aws:RequestedRegion to every IAM role and permission set that is used in the workload accounts.

Correct answer: B. Turn on the Control Tower Region deny control in the landing zone settings and govern only the two approved Regions.
The Control Tower Region deny control blocks access to services in ungoverned Regions while exempting the global services that Control Tower maintains, so no custom policy upkeep is needed. A plain SCP that denies every action outside the two Regions also breaks global services such as IAM and CloudFront unless it carries a maintained exemption list. A Config rule only detects violations after resources exist.

Question 59Operational Excellence⚑ Flag

An order service calls a downstream inventory API that sometimes throttles requests for a few seconds. All service instances retry failed calls every 1 second, and the synchronized retries keep the inventory API overloaded long after the throttling starts. The company wants to smooth the retry load during recovery without dropping orders that can still succeed. Which approach BEST meets these requirements?

ARetry with exponential backoff that doubles a fixed delay on each attempt, using the same schedule on every instance. BIncrease the fixed retry interval from 1 second to 5 seconds and allow unlimited retries until each call succeeds. CRemove client retries and return an error to the caller as soon as the inventory API throttles any single request. DRetry with capped exponential backoff and random jitter, with a maximum number of attempts before the request fails.

Correct answer: D. Retry with capped exponential backoff and random jitter, with a maximum number of attempts before the request fails.
Exponential backoff spreads retries over longer intervals, and jitter randomizes each delay so that instances stop retrying in lockstep. Backoff without jitter still makes all instances retry at the same moments, so the load keeps arriving in synchronized waves.

Question 60Cost Optimization⚑ Flag

A legal services firm uses a foundation model on Amazon Bedrock to summarize about 2 million contract pages each month. Pages are uploaded during the day, and the summaries are only needed by the next morning. Today a queue worker sends each page as a separate on-demand API call. The firm wants to keep using the same model. Which change is MOST cost-effective?

AWrite the pages to JSONL files in S3 and run Bedrock batch inference jobs each night. BPurchase Bedrock provisioned throughput for the model to cover the daily page volume. CCall the model through an application inference profile that is tagged for cost tracking. DSwitch to a smaller model in the same family to lower the price of every processed token.

Correct answer: A. Write the pages to JSONL files in S3 and run Bedrock batch inference jobs each night.
Batch inference reads prompts from files in S3 and processes them asynchronously at a lower price per token than on-demand calls for supported models, and the next-morning deadline allows that delay. Provisioned throughput bills for dedicated model units every hour, which costs more for a workload that does not need reserved capacity. An application inference profile only tracks and allocates cost, and a smaller model breaks the same-model requirement.

Question 61Cloud Architecture Design⚑ Flag

A SaaS analytics vendor wants 300 customers to send data privately from their own VPCs to its ingestion service. Many customer VPCs use the same CIDR ranges as the vendor's VPC. Customers must not be able to reach any other resource in the vendor's network, and traffic must never cross the internet. Which solution meets these requirements?

ACreate a VPC peering connection to each customer VPC and restrict the access with security groups. BAttach every customer VPC to a vendor transit gateway and isolate each one with its own route table. CPlace the service behind a Network Load Balancer and offer it as a PrivateLink endpoint service. DPublish the service through a public API Gateway endpoint that allows only each customer's IP addresses.

Correct answer: C. Place the service behind a Network Load Balancer and offer it as a PrivateLink endpoint service.
A PrivateLink endpoint service exposes only the service behind the Network Load Balancer, and interface endpoints in customer VPCs work even when CIDR ranges overlap. VPC peering and transit gateway attachments cannot route between overlapping CIDR ranges and expose more of the network. A public API Gateway endpoint sends traffic over the internet.

Question 62Security & Governance⚑ Flag

A payments company is preparing for its annual PCI DSS assessment. Auditors want evidence such as resource configuration snapshots, AWS Config rule results and CloudTrail user activity collected continuously and mapped to each PCI DSS control. Control owners must review the evidence, and the compliance team must produce an audit-ready report. Which solution BEST meets these requirements?

ACreate an AWS Audit Manager assessment from the prebuilt PCI DSS framework and generate assessment reports for the auditors. BDownload the AWS PCI DSS attestation of compliance from AWS Artifact and share it with the auditors as the company's evidence. CEnable the PCI DSS standard in AWS Security Hub and export the current failed and passed findings to a spreadsheet for auditors. DDeploy the PCI DSS conformance pack in AWS Config and send the auditors screenshots of the compliance dashboard each quarter.

Correct answer: A. Create an AWS Audit Manager assessment from the prebuilt PCI DSS framework and generate assessment reports for the auditors.
Audit Manager collects evidence continuously from Config, CloudTrail and Security Hub, maps it to the controls of a prebuilt PCI DSS framework, supports review and delegation, and generates assessment reports. The Artifact attestation covers only AWS's side of the shared responsibility model, not the company's own controls. Security Hub findings show current status but do not provide control-mapped audit evidence and reports.

Question 63Operational Excellence⚑ Flag

A ticketing platform runs on an EC2 Auto Scaling group. Traffic jumps sharply at 09:00 every weekday, and new instances need 8 minutes to boot and warm their caches. A target tracking policy adds capacity, but users see high latency for the first 10 minutes. The daily pattern repeats every week but grows each month, and the team does not want to run extra capacity all day or maintain schedules by hand. Which solution meets these requirements?

AReplace target tracking with a step scaling policy that adds more instances for each step that CPU exceeds the threshold. BLower the target value of the target tracking policy so that the group always keeps a larger amount of spare capacity. CAdd scheduled actions that raise the desired capacity at 08:50 every weekday and lower it again after the morning peak. DAdd a predictive scaling policy in forecast and scale mode with a scheduling buffer so instances launch before the spike.

Correct answer: D. Add a predictive scaling policy in forecast and scale mode with a scheduling buffer so instances launch before the spike.
Predictive scaling learns the weekly pattern, adjusts as traffic grows, and with a scheduling buffer launches instances ahead of forecast demand, while target tracking still handles unexpected changes. Scheduled actions would also add capacity early, but someone must update them by hand as traffic grows each month.

Question 64Resilience & Migration⚑ Flag

During discovery for a data center exit, a company finds that its inventory application and pricing service both make thousands of synchronous queries per minute to the same SQL Server database. Both applications need query latency under 5 ms, and different business units own them. Other applications exchange data with them only through nightly batch files. The company has a Direct Connect link with about 30 ms of latency to AWS. How should the company plan its migration waves to BEST reduce performance risk?

AMove the inventory application, the pricing service, and the shared database together in one wave. BMove the shared database in an early wave, and move both applications in later waves over Direct Connect. CMove both applications in an early wave, and keep the database on premises until the final wave of the program. DGroup workloads by owning business unit, and move each unit's applications in its own wave over Direct Connect.

Correct answer: A. Move the inventory application, the pricing service, and the shared database together in one wave.
Tightly coupled components that need very low latency must move in the same wave, because a 30 ms link between them would break the 5 ms requirement. Splitting the database from either application, or splitting the two applications by business unit, creates exactly that problem. The batch-connected applications can move in other waves because nightly file transfers tolerate network latency.

Question 65Cost Optimization⚑ Flag

A fintech company ingests about 20 TB of application debug logs per month into CloudWatch Logs log groups that never expire. Engineers query these logs with CloudWatch Logs Insights only during incident investigations. No metric filters, subscription filters or alarms use these logs. Policy requires the logs to stay searchable for 90 days. Which solution is MOST cost-effective?

ASend the logs to new Infrequent Access log groups and keep the never expire setting. BKeep the Standard log groups and change their retention setting to 90 days. CSend the logs to new Infrequent Access log groups with 90-day retention. DKeep Standard log groups with 1-day retention and export the logs to S3 for Athena.

Correct answer: C. Send the logs to new Infrequent Access log groups with 90-day retention.
The Infrequent Access log class has a much lower ingestion price than Standard and still supports Logs Insights queries, which is all these logs need, and 90-day retention stops storage from growing. A log group's class cannot be changed after creation, so new log groups are required. Changing only the retention keeps the higher Standard ingestion price, which is the largest part of this bill.

Question 66Cloud Architecture Design⚑ Flag

A healthcare company runs a data lake in a central account, cataloged in the AWS Glue Data Catalog, with hundreds of tables. Analysts in four consumer accounts query the data with Amazon Athena. Each consumer account must see only columns classified as non-sensitive, and new tables must be shared automatically based on their classification without per-table grants. Which solution meets these requirements?

AUse Lake Formation named resource grants to share each table and its allowed columns with every consumer account. BBuild filtered copies of each table with AWS Glue jobs and store them in a separate bucket for each consumer account. CWrite S3 bucket policies that let each consumer account read only the prefixes that hold non-sensitive tables. DTag tables and columns with classification LF-Tags and grant the consumer accounts access by LF-Tag expression.

Correct answer: D. Tag tables and columns with classification LF-Tags and grant the consumer accounts access by LF-Tag expression.
Lake Formation tag-based access control grants permissions on LF-Tag expressions, so any new table or column tagged as non-sensitive becomes visible to the consumer accounts without new grants. Named resource grants also support column-level access, but every new table needs its own grant. S3 bucket policies cannot restrict access to individual columns.

Question 67Security & Governance⚑ Flag

A company has more than 4,000 S3 buckets across 100 accounts and needs continuous visibility into which buckets contain personal data such as passport numbers. The security team wants one view of results across all accounts and wants to control cost by not scanning every object every day. New accounts must be covered automatically. Which solution BEST meets these requirements?

ADesignate a Macie delegated administrator and schedule daily sensitive data discovery jobs that scan all objects in every bucket. BEnable GuardDuty S3 Protection in all accounts and review the findings about sensitive data from the security tooling account. CTrigger a Lambda function on each object upload that calls Amazon Comprehend to detect PII and writes results to a central table. DDesignate a Macie delegated administrator, auto-enable Macie for member accounts, and turn on automated sensitive data discovery.

Correct answer: D. Designate a Macie delegated administrator, auto-enable Macie for member accounts, and turn on automated sensitive data discovery.
Macie automated sensitive data discovery samples objects across the estate every day, giving continuous visibility at much lower cost than full scans, and a delegated administrator with auto-enable covers all current and new accounts. Daily jobs that scan every object meet the visibility goal but break the cost constraint. GuardDuty S3 Protection detects threats, not sensitive data.

Question 68Operational Excellence⚑ Flag

A company has 25 accounts in AWS Organizations. Engineers sometimes add security group rules that allow SSH from 0.0.0.0/0 through the console. Security requires these rules to be removed automatically within minutes in every account, with a compliance history for auditors. The solution must have the LEAST operational overhead. Which solution meets these requirements?

AAdd CloudFormation Guard rules to the deployment pipeline that reject any security group that allows SSH from 0.0.0.0/0. BDeploy an organization conformance pack with the restricted-ssh rule and an automatic Systems Manager remediation. CReview the AWS Trusted Advisor security group check every week and remove the open rules with a Systems Manager script. DAttach a service control policy that denies ec2:AuthorizeSecurityGroupIngress to all principals except the network team.

Correct answer: B. Deploy an organization conformance pack with the restricted-ssh rule and an automatic Systems Manager remediation.
An organization conformance pack deploys the restricted-ssh rule and its automatic remediation to every account, and AWS Config keeps a compliance timeline for auditors. Guard rules only check templates in the pipeline, so they miss rules that engineers add through the console.

Question 69Cloud Architecture Design⚑ Flag

An ad-tech company receives clickstream events at 200 MB per second from producers that already write to Amazon Kinesis Data Streams. Analysts need the data in Apache Iceberg tables in Amazon S3 within a few minutes of arrival, with support for row-level updates and schema evolution. The company does not want to manage any servers or clusters. Which solution meets these requirements?

AUse Firehose to write raw JSON files to S3 and run a daily AWS Glue job that converts them into Iceberg. BConsume the stream with Lambda functions that write Parquet files to S3 partitioned by event hour. CCreate a Firehose stream that reads from the Kinesis stream and delivers to an Iceberg table. DRun a Spark Structured Streaming job on a long-running Amazon EMR cluster that writes to Iceberg tables.

Correct answer: C. Create a Firehose stream that reads from the Kinesis stream and delivers to an Iceberg table.
Amazon Data Firehose can read from an existing Kinesis data stream and write directly into Apache Iceberg tables in S3, including row-level updates and deletes, with no infrastructure to manage. A Spark job on EMR also meets the latency target but requires a cluster to operate. A daily Glue conversion misses the requirement for data within minutes.

Question 70Security & Governance⚑ Flag

A retail bank is launching a generative AI assistant on Amazon Bedrock that may switch between several foundation models. The assistant must refuse to give investment advice, block hateful or insulting content in both prompts and responses, and detect prompt injection attempts. The controls must work the same way regardless of which model is used. Which solution BEST meets these requirements?

ACreate a Bedrock guardrail with a word filter that lists common investment terms and apply that guardrail to every model invocation. BCreate a Bedrock guardrail with an investment advice denied topic and content filters, including prompt attacks, for all calls. CAdd detailed instructions to the system prompt that tell each model to refuse investment questions and to ignore injected instructions. DFine-tune each foundation model on examples of refused investment questions and blocked harmful prompts before the assistant goes live.

Correct answer: B. Create a Bedrock guardrail with an investment advice denied topic and content filters, including prompt attacks, for all calls.
A Bedrock guardrail works with any supported model, and its denied topics and content filters, including the prompt attack filter, are evaluated on inputs and outputs. System prompt instructions are not enforced and can be overridden by prompt injection. A word filter only matches exact terms, so paraphrased investment questions would get through.

Question 71Cost Optimization⚑ Flag

A company runs a self-managed PostgreSQL database on EC2 with a 2 TB io1 volume provisioned for 10,000 IOPS. Monitoring shows the volume never needs more than 9,000 IOPS or 400 MB/s of throughput. Single-digit millisecond latency is acceptable for this database. The company wants to keep current performance and cut storage cost without downtime. Which solution is MOST cost-effective?

AChange the volume to gp2 with Elastic Volumes and grow it to about 3.4 TB to reach the IOPS. BChange the volume to st1 with Elastic Volumes and grow it to get higher sequential throughput. CChange the volume to gp3 with Elastic Volumes and provision 10,000 IOPS and 500 MB/s. DChange the volume to io2 with Elastic Volumes and keep the 10,000 provisioned IOPS level.

Correct answer: C. Change the volume to gp3 with Elastic Volumes and provision 10,000 IOPS and 500 MB/s.
gp3 lets you provision IOPS and throughput separately from size at a lower price than io1 or io2, and 10,000 IOPS with 500 MB/s is well within its limits. Elastic Volumes changes the volume type while it stays attached and in use. gp2 would need a much larger volume to reach the IOPS and still caps throughput at 250 MB/s, while io2 keeps the higher provisioned IOPS pricing.

Question 72Resilience & Migration⚑ Flag

A shipping company runs an on-premises SFTP server that 400 external partners use with SSH key authentication. The company wants to move the service to AWS, store files in Amazon S3, and stop managing servers. Partners must not need to change anything, including the hostname they connect to. Partners must also not see host key warnings. Which solution BEST meets these requirements?

AKeep the on-premises SFTP server, and use AWS DataSync to copy uploaded partner files to Amazon S3 on an hourly schedule. BCreate an AWS Transfer Family SFTP server, import the current host key and partner keys, and point the hostname to it. CCreate an AWS Transfer Family SFTP server with a new service-generated host key, and point the current hostname to it. DRun OpenSSH on Amazon EC2 instances behind a Network Load Balancer, and mount the S3 bucket on them with a FUSE client.

Correct answer: B. Create an AWS Transfer Family SFTP server, import the current host key and partner keys, and point the hostname to it.
Transfer Family is a managed SFTP service that stores files in S3, and it lets you import an existing host key so clients see the same fingerprint. Importing partner public keys and pointing the existing hostname at the endpoint means partners change nothing. A new service-generated host key would trigger a host key warning for every partner.

Question 73Operational Excellence⚑ Flag

A bank runs a customer support assistant built on Amazon Bedrock Knowledge Bases. Before it switches the generating model to a newer foundation model, the team must compare both models on 2,000 curated prompts for correctness, completeness, and faithfulness to the retrieved passages. The comparison must not use human reviewers and must be repeatable for every future model change. Which solution meets these requirements?

AAdd a guardrail with a contextual grounding check to both models and compare how many responses each model gets blocked. BCreate a human-based model evaluation job with a private work team that rates each model's answers to the curated prompts. CRun Amazon Bedrock RAG evaluation jobs that use an LLM as a judge for each model and compare the built-in metric reports. DEnable model invocation logging and compare the latency and token count metrics of both models in CloudWatch dashboards.

Correct answer: C. Run Amazon Bedrock RAG evaluation jobs that use an LLM as a judge for each model and compare the built-in metric reports.
Amazon Bedrock Evaluations can run retrieve-and-generate evaluations in which a judge model scores correctness, completeness, and faithfulness, and the same jobs can be rerun for each model change. A contextual grounding check filters responses at runtime and does not produce a comparative quality score across models.

Question 74Cloud Architecture Design⚑ Flag

A streaming media company and a consumer goods brand want to measure how many of the brand's customers watched a sponsored series. Neither company may share raw customer records with the other, and the brand may run only approved aggregate queries that meet a minimum result size. Both companies keep their data in Amazon S3 in their own AWS accounts. Which solution meets these requirements?

ACreate an AWS Clean Rooms collaboration with aggregation analysis rules on each company's configured table. BExchange hashed email lists through a shared S3 bucket and let the brand join them with its own data in Athena. CGrant each company cross-account access to the other's tables with Lake Formation and query them with Athena. DCopy both datasets into a jointly owned Amazon Redshift cluster and restrict access with row-level security.

Correct answer: A. Create an AWS Clean Rooms collaboration with aggregation analysis rules on each company's configured table.
AWS Clean Rooms lets both companies query data where it lives without sharing the underlying records, and aggregation analysis rules limit queries to approved columns and functions with minimum aggregation thresholds. Lake Formation cross-account grants give each party direct access to the other's raw rows. Copying data into a shared Redshift cluster moves raw records into an environment both companies can access.

Question 75Security & Governance⚑ Flag

A logistics company gives an AI agent built on Amazon Bedrock AgentCore access to internal APIs for shipment lookups and refund processing. Security requires that the agent authenticate to each API with its own identity, with permissions scoped to the agent rather than inherited from the calling user or a shared service account. What should the architect use?

AAttach the invoking Lambda function's execution role to the agent BEmbed a long-lived IAM user access key in the agent's prompt template CStore one API key for all agents in AWS Secrets Manager DUse AgentCore Identity to give the agent its own credentials for each API

Correct answer: D. Use AgentCore Identity to give the agent its own credentials for each API
AgentCore Identity provides workload identities for agents, so each agent authenticates to downstream APIs and tools with its own scoped credentials. A shared API key or a borrowed execution role cannot distinguish the agent's permissions, and credentials never belong in a prompt.