Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 – Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Practice Test Question

Select an option, then click Submit answer.

• ○ Add the aws PrincipalOrgID global condition key with a reference to the organization ID to the S3 bucket policy.
• ○ Create an organizational unit (OU) for each department. Add the aws:PrincipalOrgPaths global condition key to the S3 bucket policy.
• ○ Use AWS CloudTrail to monitor the CreateAccount, InviteAccountToOrganization, LeaveOrganization, and RemoveAccountFromOrganization events. Update the S3 bucket policy accordingly.
• ○ Tag each user that needs access to the S3 bucket. Add the aws:PrincipalTag global condition key to the S3 bucket policy.

Select an option, then click Submit answer.

• ○ Use an API Gateway integration to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when the application receives an order. Subscribe an AWS Lambda function to the topic to perform processing.
• ○ Use an API Gateway integration to send a message to an Amazon Simple Queue Service (Amazon SQS) FIFO queue when the application receives an order. Configure the SQS FIFO queue to invoke an AWS Lambda function for processing.
• ○ Use an API Gateway authorizer to block any requests while the application processes an order.
• ○ Use an API Gateway integration to send a message to an Amazon Simple Queue Service (Amazon SQS) standard queue when the application receives an order. Configure the SQS standard queue to invoke an AWS Lambda function for processing.

Select an option, then click Submit answer.

• ○ Use AWS Config rules to define and detect resources that are not properly tagged.
• ○ Use Cost Explorer to display resources that are not properly tagged. Tag those resources manually.
• ○ Write API calls to check all resources for proper tag allocation. Periodically run the code on an EC2 instance.
• ○ Write API calls to check all resources for proper tag allocation. Schedule an AWS Lambda function through Amazon CloudWatch to periodically run the code.

Select an option, then click Submit answer.

• ○ Store the database credentials in the instance metadata. Use Amazon EventBridge (Amazon CloudWatch Events) rules to run a scheduled AWS Lambda function that updates the RDS credentials and instance metadata at the same time.
• ○ Store the database credentials in a configuration file in an encrypted Amazon S3 bucket. Use Amazon EventBridge (Amazon CloudWatch Events) rules to run a scheduled AWS Lambda function that updates the RDS credentials and the credentials in the configuration file at the same time. Use S3 Versioning to ensure the ability to fall back to previous values.
• ○ Store the database credentials as a secret in AWS Secrets Manager. Turn on automatic rotation for the secret. Attach the required permission to the EC2 role to grant access to the secret.
• ○ Store the database credentials as encrypted parameters in AWS Systems Manager Parameter Store. Turn on automatic rotation for the encrypted parameters. Attach the required permission to the EC2 role to grant access to the encrypted parameters.

Select an option, then click Submit answer.

• ○ AWS DataSync over public internet
• ○ AWS DataSync over AWS Direct Connect
• ○ AWS Database Migration Service (AWS DMS) over public internet
• ○ AWS Database Migration Service (AWS DMS) over AWS Direct Connect

Select an option, then click Submit answer.

• ○ Store the database user credentials in AWS Secrets Manager. Grant the necessary IAM permissions to allow the web servers to access AWS Secrets Manager.
• ○ Store the database user credentials in AWS Systems Manager OpsCenter. Grant the necessary IAM permissions to allow the web servers to access OpsCenter.
• ○ Store the database user credentials in a secure Amazon S3 bucket. Grant the necessary IAM permissions to allow the web servers to retrieve credentials and access the database.
• ○ Store the database user credentials in files encrypted with AWS Key Management Service (AWS KMS) on the web server file system. The web server should be able to decrypt the files and access the database.

Select an option, then click Submit answer.

• ○ Use Amazon Aurora MySQL with Multi-AZ Aurora Replicas for production. Populate the staging database by implementing a backup and restore process that uses the mysqldump utility.
• ○ Use Amazon Aurora MySQL with Multi-AZ Aurora Replicas for production. Use database cloning to create the staging database on-demand.
• ○ Use Amazon RDS for MySQL with a Multi-AZ deployment and read replicas for production. Use the standby instance for the staging database.
• ○ Use Amazon RDS for MySQL with a Multi-AZ deployment and read replicas for production. Populate the staging database by implementing a backup and restore process that uses the mysqldump utility.

Select an option, then click Submit answer.

• ○ Configure Amazon EMR to read text files from Amazon S3. Run processing scripts to transform the data. Store the resulting JSON file in an Amazon Aurora DB cluster.
• ○ Configure Amazon S3 to send an event notification to an Amazon Simple Queue Service (Amazon SQS) queue. Use Amazon EC2 instances to read from the queue and process the data. Store the resulting JSON file in Amazon DynamoDB.
• ○ Configure Amazon S3 to send an event notification to an Amazon Simple Queue Service (Amazon SQS) queue. Use an AWS Lambda function to read from the queue and process the data. Store the resulting JSON file in Amazon DynamoDB.
• ○ Configure Amazon EventBridge (Amazon CloudWatch Events) to send an event to Amazon Kinesis Data Streams when a new file is uploaded. Use an AWS Lambda function to consume the event from the stream and process the data. Store the resulting JSON file in an Amazon Aurora DB cluster.

Select an option, then click Submit answer.

• ○ Edit the job to use job bookmarks.
• ○ Edit the job to delete data after the data is processed.
• ○ Edit the job by setting the NumberOfWorkers field to 1.
• ○ Use a FindMatches machine learning (ML) transform.

Select an option, then click Submit answer.

• ○ Server-side encryption with customer-provided keys (SSE-C)
• ○ Server-side encryption with Amazon S3 managed keys (SSE-S3)
• ○ Server-side encryption with AWS KMS keys (SSE-KMS) with manual rotation
• ○ Server-side encryption with AWS KMS keys (SSE-KMS) with automatic rotation

Select an option, then click Submit answer.

• ○ Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SQS) queue for the targets to consume.
• ○ Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SQS) FIFO queue for the targets to consume.
• ○ Subscribe to an RDS event notification and send an Amazon Simple Queue Service (Amazon SQS) queue fanned out to multiple Amazon Simple Notification Service (Amazon SNS) topics. Use AWS Lambda functions to update the targets.
• ○ Subscribe to an RDS event notification and send an Amazon Simple Notification Service (Amazon SNS) topic fanned out to multiple Amazon Simple Queue Service (Amazon SQS) queues. Use AWS Lambda functions to update the targets.

Select an option, then click Submit answer.

• ○ Set up an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive immediately.
• ○ Set up an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 2 years.
• ○ Use S3 Intelligent-Tiering. Activate the archiving option to ensure that data is archived in S3 Glacier Deep Archive.
• ○ Set up an S3 Lifecycle policy to transition objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) immediately and to S3 Glacier Deep Archive after 2 years.

Select an option, then click Submit answer.

• ○ Migrate the Oracle database to an Amazon EC2 instance. Set up database replication to a different AWS Region.
• ○ Migrate the Oracle database to Amazon RDS for Oracle. Activate Cross-Region automated backups to replicate the snapshots to another AWS Region.
• ○ Migrate the Oracle database to Amazon RDS Custom for Oracle. Create a read replica for the database in another AWS Region.
• ○ Migrate the Oracle database to Amazon RDS for Oracle. Create a standby database in another Availability Zone.

Select an option, then click Submit answer.

• ○ Create an ongoing replication task.
• ○ Create a database backup of the on-premises database.
• ○ Create an AWS Database Migration Service (AWS DMS) replication server.
• ○ Convert the database schema by using the AWS Schema Conversion Tool (AWS SCT).
• ○ Create an Amazon EventBridge (Amazon CloudWatch Events) rule to monitor the database synchronization.

Select an option, then click Submit answer.

• ○ Use AWS Transfer Family to configure an SFTP-enabled server with a publicly accessible endpoint. Choose the S3 data lake as the destination.
• ○ Use Amazon S3 File Gateway as an SFTP server. Expose the S3 File Gateway endpoint URL to the new partner. Share the S3 File Gateway endpoint with the new partner.
• ○ Launch an Amazon EC2 instance in a private subnet in a VPInstruct the new partner to upload files to the EC2 instance by using a VPN. Run a cron job script, on the EC2 instance to upload files to the S3 data lake.
• ○ Launch Amazon EC2 instances in a private subnet in a VPC. Place a Network Load Balancer (NLB) in front of the EC2 instances. Create an SFTP listener port for the NLB. Share the NLB hostname with the new partner. Run a cron job script on the EC2 instances to upload files to the S3 data lake.

Select an option, then click Submit answer.

• ○ Store the documents in Amazon S3. Use S3 Object Lock in governance mode.
• ○ Store the documents in Amazon S3. Use S3 Object Lock in compliance mode.
• ○ Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Configure key rotation.
• ○ Use server-side encryption with AWS Key Management Service (AWS KMS) customer managed keys. Configure key rotation.
• ○ Use server-side encryption with AWS Key Management Service (AWS KMS) customer provided (imported) keys. Configure key rotation.

Select an option, then click Submit answer.

• ○ Create an Amazon S3 bucket. Enable static web hosting on the S3 bucket. Upload the static content to the S3 bucket. Use AWS Lambda to process all dynamic content.
• ○ Deploy the web application to an AWS Elastic Beanstalk environment. Use URL swapping to switch between multiple Elastic Beanstalk environments for feature testing.
• ○ Deploy the web application to Amazon EC2 instances that are configured with Java and PHP. Use Auto Scaling groups and an Application Load Balancer to manage the website’s availability.
• ○ Containerize the web application. Deploy the web application to Amazon EC2 instances. Use the AWS Load Balancer Controller to dynamically route traffic between containers that contain the new site features for testing.

Select an option, then click Submit answer.

• ○ Create an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance is located. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access.
• ○ Create a gateway VPC endpoint for Amazon S3 in the Availability Zone where the EC2 instance is located. Attach appropriate security groups to the endpoint. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access.
• ○ Run the nslookup tool from inside the EC2 instance to obtain the private IP address of the S3 bucket’s service API endpoint. Create a route in the VPC route table to provide the EC2 instance with access to the S3 bucket. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access.
• ○ Use the AWS provided, publicly available ip-ranges.json file to obtain the private IP address of the S3 bucket’s service API endpoint. Create a route in the VPC route table to provide the EC2 instance with access to the S3 bucket. Attach a resource policy to the S3 bucket to only allow the EC2 instance’s IAM role for access.

Select an option, then click Submit answer.

• ○ Create a DB instance security group that allows all traffic from the public IP address of the application server in VPC A.
• ○ Configure a VPC peering connection between VPC A and VPC B.
• ○ Make the DB instance publicly accessible. Assign a public IP address to the DB instance.
• ○ Launch an EC2 instance with an Elastic IP address into VPC B. Proxy all requests through the new EC2 instance.

Select an option, then click Submit answer.

• ○ Set up a VPC peering connection between VPC-A and VPC-B.
• ○ Set up VPC gateway endpoints for the EC2 instance running in VPC-B.
• ○ Attach a virtual private gateway to VPC-B and set up routing from VPC-A.
• ○ Create a private virtual interface (VIF) for the EC2 instance running in VPC-B and add appropriate routes from VPC-A.

Select an option, then click Submit answer.

• ○ Deploy an AWS Storage Gateway file gateway as a virtual machine (VM) on premises at each clinic
• ○ Migrate the files to each clinic’s on-premises applications by using AWS DataSync for processing.
• ○ Deploy an AWS Storage Gateway volume gateway as a virtual machine (VM) on premises at each clinic.
• ○ Attach an Amazon Elastic File System (Amazon EFS) file system to each clinic’s on-premises servers.

Select an option, then click Submit answer.

• ○ Reconfigure the target group in the development environment to have only one EC2 instance as a target.
• ○ Change the ALB balancing algorithm to least outstanding requests.
• ○ Reduce the size of the EC2 instances in both environments.
• ○ Reduce the maximum number of EC2 instances in the development environment’s Auto Scaling group.

Select an option, then click Submit answer.

• ○ Replace the ALB with a Network Load Balancer. Configure a NAT gateway in a public subnet to allow internet traffic.
• ○ Move the EC2 instances to public subnets. Add a rule to the EC2 instances’ security groups to allow outbound traffic to 0.0.0.0/0.
• ○ Update the route tables for the EC2 instances’ subnets to send 0.0.0.0/0 traffic through the internet gateway route. Add a rule to the EC2 instances’ security groups to allow outbound traffic to 0.0.0.0/0.
• ○ Create public subnets in each Availability Zone. Associate the public subnets with the ALB. Update the route tables for the public subnets with a route to the private subnets.

Select an option, then click Submit answer.

• ○ Amazon Elastic File System (Amazon EFS)
• ○ Amazon Elastic Block Store (Amazon EBS)
• ○ Amazon S3 Glacier Deep Archive
• ○ AWS Backup

Select an option, then click Submit answer.

• ○ Create a peering connection between the VPCs. Add a route table entry for the peering connection in both VPCs. Configure an inbound rule for the ElastiCache cluster’s security group to allow inbound connection from the application’s security group.
• ○ Create a Transit VPC. Update the VPC route tables in the Cache VPC and the App VPC to route traffic through the Transit VPC. Configure an inbound rule for the ElastiCache cluster's security group to allow inbound connection from the application’s security group.
• ○ Create a peering connection between the VPCs. Add a route table entry for the peering connection in both VPCs. Configure an inbound rule for the peering connection’s security group to allow inbound connection from the application’s security group.
• ○ Create a Transit VPC. Update the VPC route tables in the Cache VPC and the App VPC to route traffic through the Transit VPC. Configure an inbound rule for the Transit VPC’s security group to allow inbound connection from the application’s security group.

Select an option, then click Submit answer.

• ○ Increase the minimum capacity for the Auto Scaling group.
• ○ Increase the maximum capacity for the Auto Scaling group.
• ○ Configure scheduled scaling to scale up to the desired compute level.
• ○ Change the scaling policy to add more EC2 instances during each scaling operation.

Select an option, then click Submit answer.

• ○ Host all three tiers on Amazon EC2 instances. Use Amazon FSx File Gateway for file sharing between the tiers.
• ○ Host all three tiers on Amazon EC2 instances. Use Amazon FSx for Windows File Server for file sharing between the tiers.
• ○ Host the application tier and the business tier on Amazon EC2 instances. Host the database tier on Amazon RDS. Use Amazon Elastic File System (Amazon EFS) for file sharing between the tiers.
• ○ Host the application tier and the business tier on Amazon EC2 instances. Host the database tier on Amazon RDS. Use a Provisioned IOPS SSD (io2) Amazon Elastic Block Store (Amazon EBS) volume for file sharing between the tiers.

Select an option, then click Submit answer.

• ○ Increase the size of the EC2 instance to process messages faster.
• ○ Use Amazon EventBridge to turn off the EC2 instance when the instance is underutilized.
• ○ Migrate the script on the EC2 instance to an AWS Lambda function with the appropriate runtime.
• ○ Use AWS Systems Manager Run Command to run the script on demand.

Select an option, then click Submit answer.

• ○ Launch an Amazon EC2 instance to serve as the HTTPS endpoint and to process the messages. Configure the EC2 instance to save the results to an Amazon S3 bucket.
• ○ Create an HTTPS endpoint in Amazon API Gateway. Configure the API Gateway endpoint to invoke an AWS Lambda function to process the messages and save the results to an Amazon DynamoDB table.
• ○ Use Amazon Route 53 to direct incoming sensor messages to an AWS Lambda function. Configure the Lambda function to process the messages and save the results to an Amazon DynamoDB table.
• ○ Create a gateway VPC endpoint for Amazon S3. Configure a Site-to-Site VPN connection from the facility network to the VPC so that sensor data can be written directly to an S3 bucket by way of the VPC endpoint.

Select an option, then click Submit answer.

• ○ Provision an Amazon S3 File Gateway as a virtual machine (VM) that is hosted on premises. Set the local cache to 10 TB. Modify existing applications to access the files through the NFS protocol. To recover from a disaster, provision an Amazon EC2 instance and mount the S3 bucket that contains the files.
• ○ Provision an AWS Storage Gateway tape gateway. Use a data backup solution to back up all existing data to a virtual tape library. Configure the data backup solution to run nightly after the initial backup is complete. To recover from a disaster, provision an Amazon EC2 instance and restore the data to an Amazon Elastic Block Store (Amazon EBS) volume from the volumes in the virtual tape library.
• ○ Provision an AWS Storage Gateway Volume Gateway cached volume. Set the local cache to 10 TB. Mount the Volume Gateway cached volume to the existing file server by using iSCSI, and copy all files to the storage volume. Configure scheduled snapshots of the storage volume. To recover from a disaster, restore a snapshot to an Amazon Elastic Block Store (Amazon EBS) volume and attach the EBS volume to an Amazon EC2 instance.
• ○ Provision an AWS Storage Gateway Volume Gateway stored volume with the same amount of disk space as the existing file storage volume. Mount the Volume Gateway stored volume to the existing file server by using iSCSI, and copy all files to the storage volume. Configure scheduled snapshots of the storage volume. To recover from a disaster, restore a snapshot to an Amazon Elastic Block Store (Amazon EBS) volume and attach the EBS volume to an Amazon EC2 instance.

Select an option, then click Submit answer.

• ○ Configure an Amazon CloudFront distribution in front of the ALB.
• ○ Configure an EC2 Auto Scaling simple scaling policy based on CPU utilization.
• ○ Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule.
• ○ Configure Amazon ElastiCache to remove some of the workload from the EC2 instances.

Select an option, then click Submit answer.

• ○ Create a new AWS Key Management Service (AWS KMS) encryption key. Use AWS Secrets Manager to create a new secret that uses the KMS key with the appropriate credentials. Associate the secret with the Aurora DB cluster. Configure a custom rotation period of 14 days.
• ○ Create two parameters in AWS Systems Manager Parameter Store: one for the user name as a string parameter and one that uses the SecureString type for the password. Select AWS Key Management Service (AWS KMS) encryption for the password parameter, and load these parameters in the application tier. Implement an AWS Lambda function that rotates the password every 14 days.
• ○ Store a file that contains the credentials in an AWS Key Management Service (AWS KMS) encrypted Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system in all EC2 instances of the application tier. Restrict the access to the file on the file system so that the application can read the file and that only super users can modify the file. Implement an AWS Lambda function that rotates the key in Aurora every 14 days and writes new credentials into the file.
• ○ Store a file that contains the credentials in an AWS Key Management Service (AWS KMS) encrypted Amazon S3 bucket that the application uses to load the credentials. Download the file to the application regularly to ensure that the correct credentials are used. Implement an AWS Lambda function that rotates the Aurora credentials every 14 days and uploads these credentials to the file in the S3 bucket.

Select an option, then click Submit answer.

• ○ Use Amazon EMR to ingest the data directly from the database to the QuickSight SPICE engine. Include only the required columns.
• ○ Use AWS Glue Studio to ingest the data from the database to the S3 data lake. Attach an IAM policy to the QuickSight users to enforce column-level access control. Use Amazon S3 as the data source in QuickSight.
• ○ Use AWS Glue Elastic Views to create a materialized view for the database in Amazon S3. Create an S3 bucket policy to enforce column-level access control for the QuickSight users. Use Amazon S3 as the data source in QuickSight.
• ○ Use a Lake Formation blueprint to ingest the data from the database to the S3 data lake. Use Lake Formation to enforce column-level access control for the QuickSight users. Use Amazon Athena as the data source in QuickSight.

Select an option, then click Submit answer.

• ○ Store the static files on Amazon S3. Use Amazon CloudFront to cache objects at the edge.
• ○ Store the static files on Amazon S3. Use Amazon ElastiCache to cache objects at the edge.
• ○ Store the server-side code on Amazon Elastic File System (Amazon EFS). Mount the EFS volume on each EC2 instance to share the files.
• ○ Store the server-side code on Amazon FSx for Windows File Server. Mount the FSx for Windows File Server volume on each EC2 instance to share the files.
• ○ Store the server-side code on a General Purpose SSD (gp2) Amazon Elastic Block Store (Amazon EBS) volume. Mount the EBS volume on each EC2 instance to share the files.

Select an option, then click Submit answer.

• ○ Process the audio files by using Amazon Kinesis Video Streams. Use an AWS Lambda function to scan for known PII patterns.
• ○ When an audio file is uploaded to the S3 bucket, invoke an AWS Lambda function to start an Amazon Textract task to analyze the call recordings.
• ○ Configure an Amazon Transcribe transcription job with PII redaction turned on. When an audio file is uploaded to the S3 bucket, invoke an AWS Lambda function to start the transcription job. Store the output in a separate S3 bucket.
• ○ Create an Amazon Connect contact flow that ingests the audio files with transcription turned on. Embed an AWS Lambda function to scan for known PII patterns. Use Amazon EventBridge to start the contact flow when an audio file is uploaded to the S3 bucket.

Select an option, then click Submit answer.

• ○ Configure an Amazon Route 53 failover routing policy. Create a Network Load Balancer (NLB) in each of the two Regions. Configure the NLB to invoke an AWS Lambda function to process the data.
• ○ Use AWS Global Accelerator. Create a Network Load Balancer (NLB) in each of the two Regions as an endpoint. Create an Amazon Elastic Container Service (Amazon ECS) cluster with the Fargate launch type. Create an ECS service on the cluster. Set the ECS service as the target for the NLProcess the data in Amazon ECS.
• ○ Use AWS Global Accelerator. Create an Application Load Balancer (ALB) in each of the two Regions as an endpoint. Create an Amazon Elastic Container Service (Amazon ECS) cluster with the Fargate launch type. Create an ECS service on the cluster. Set the ECS service as the target for the ALB. Process the data in Amazon ECS.
• ○ Configure an Amazon Route 53 failover routing policy. Create an Application Load Balancer (ALB) in each of the two Regions. Create an Amazon Elastic Container Service (Amazon ECS) cluster with the Fargate launch type. Create an ECS service on the cluster. Set the ECS service as the target for the ALB. Process the data in Amazon ECS.

Select an option, then click Submit answer.

• ○ Group members are permitted any Amazon EC2 action within the us-east-1 Region. Statements after the Allow permission are not applied.
• ○ Group members are denied any Amazon EC2 permissions in the us-east-1 Region unless they are logged in with multi-factor authentication (MFA).
• ○ Group members are allowed the ec2:StopInstances and ec2:TerminateInstances permissions for all Regions when logged in with multi-factor authentication (MFA). Group members are permitted any other Amazon EC2 action.
• ○ Group members are allowed the ec2:StopInstances and ec2:TerminateInstances permissions for the us-east-1 Region only when logged in with multi-factor authentication (MFA). Group members are permitted any other Amazon EC2 action within the us-east-1 Region.

Select an option, then click Submit answer.

• ○ Launch an Amazon EC2 Spot Instance that downloads the .csv files every hour, generates the image files, and uploads the images to the S3 bucket.
• ○ Design an AWS Lambda function that converts the .csv files into images and stores the images in the S3 bucket. Invoke the Lambda function when a .csv file is uploaded.
• ○ Create S3 Lifecycle rules for .csv files and image files in the S3 bucket. Transition the .csv files from S3 Standard to S3 Glacier 1 day after they are uploaded. Expire the image files after 30 days.
• ○ Create S3 Lifecycle rules for .csv files and image files in the S3 bucket. Transition the .csv files from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA) 1 day after they are uploaded. Expire the image files after 30 days.
• ○ Create S3 Lifecycle rules for .csv files and image files in the S3 bucket. Transition the .csv files from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) 1 day after they are uploaded. Keep the image files in Reduced Redundancy Storage (RRS).

Select an option, then click Submit answer.

• ○ Create a custom AWS Config rule to prevent tag modification except by authorized principals.
• ○ Create a custom trail in AWS CloudTrail to prevent tag modification.
• ○ Create a service control policy (SCP) to prevent tag modification except by authorized principals.
• ○ Create custom Amazon CloudWatch logs to prevent tag modification.

Select an option, then click Submit answer.

• ○ Create an Auto Scaling group and a load balancer in the disaster recovery Region. Configure the DynamoDB table as a global table. Configure DNS failover to point to the new disaster recovery Region's load balancer.
• ○ Create an AWS CloudFormation template to create EC2 instances, load balancers, and DynamoDB tables to be launched when needed Configure DNS failover to point to the new disaster recovery Region's load balancer.
• ○ Create an AWS CloudFormation template to create EC2 instances and a load balancer to be launched when needed. Configure the DynamoDB table as a global table. Configure DNS failover to point to the new disaster recovery Region's load balancer.
• ○ Create an Auto Scaling group and load balancer in the disaster recovery Region. Configure the DynamoDB table as a global table. Create an Amazon CloudWatch alarm to trigger an AWS Lambda function that updates Amazon Route 53 pointing to the disaster recovery load balancer.

Select an option, then click Submit answer.

• ○ Buy reserved DB instances for the total workload. Make the Amazon RDS for PostgreSQL DB instance larger.
• ○ Make the Amazon RDS for PostgreSQL DB instance a Multi-AZ DB instance.
• ○ Buy reserved DB instances for the total workload. Add another Amazon RDS for PostgreSQL DB instance.
• ○ Make the Amazon RDS for PostgreSQL DB instance an on-demand DB instance.

Select an option, then click Submit answer.

• ○ Use AWS Backup to create a backup vault that has a vault lock in governance mode. Create the required backup plan.
• ○ Use Amazon Data Lifecycle Manager to create the required automated snapshot policy.
• ○ Use Amazon S3 File Gateway to create the backup. Configure the appropriate S3 Lifecycle management.
• ○ Use AWS Backup to create a backup vault that has a vault lock in compliance mode. Create the required backup plan.

Select an option, then click Submit answer.

• ○ Amazon EC2
• ○ AWS Lambda
• ○ Amazon RDS
• ○ Amazon DynamoDB
• ○ Amazon Elastic Kubernetes Services (Amazon EKS)

Select an option, then click Submit answer.

• ○ From the Organizations management account billing console, activate a user-defined cost allocation tag named department. Create one cost report in Cost Explorer grouping by tag name, and filter by EC2.
• ○ From the Organizations management account billing console, activate an AWS-defined cost allocation tag named department. Create one cost report in Cost Explorer grouping by tag name, and filter by EC2.
• ○ From the Organizations member account billing console, activate a user-defined cost allocation tag named department. Create one cost report in Cost Explorer grouping by the tag name, and filter by EC2.
• ○ From the Organizations member account billing console, activate an AWS-defined cost allocation tag named department. Create one cost report in Cost Explorer grouping by tag name, and filter by EC2.

Select an option, then click Submit answer.

• ○ Configure Amazon DynamoDB Accelerator (DAX) for the new messages table. Update the code to use the DAX endpoint.
• ○ Add DynamoDB read replicas to handle the increased read load. Update the application to point to the read endpoint for the read replicas.
• ○ Double the number of read capacity units for the new messages table in DynamoDB. Continue to use the existing DynamoDB endpoint.
• ○ Add an Amazon ElastiCache for Redis cache to the application stack. Update the application to point to the Redis cache endpoint instead of DynamoDB.

Select an option, then click Submit answer.

• ○ Use Amazon S3 to host static content. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate for compute power. Use a managed Amazon RDS cluster for the database.
• ○ Use Amazon CloudFront to host static content. Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 for compute power. Use a managed Amazon RDS cluster for the database.
• ○ Use Amazon S3 to host static content. Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate for compute power. Use a managed Amazon RDS cluster for the database.
• ○ Use Amazon EC2 Reserved Instances to host static content. Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 for compute power. Use a managed Amazon RDS cluster for the database.

Select an option, then click Submit answer.

• ○ Amazon FSx Multi-AZ deployments
• ○ Amazon Elastic Block Store (Amazon EBS) Multi-Attach volumes
• ○ Amazon Elastic File System (Amazon EFS) with multiple mount targets
• ○ Amazon Elastic File System (Amazon EFS) with a single mount target and multiple access points

Select an option, then click Submit answer.

• ○ Convert the application to use Amazon DynamoDB. Use a global table for the center reservation table. Use the correct Regional endpoint in each Regional deployment.
• ○ Migrate the database to an Amazon Aurora MySQL database. Deploy Aurora Read Replicas in each Region. Use the correct Regional endpoint in each Regional deployment for access to the database.
• ○ Migrate the database to an Amazon RDS for MySQL database. Deploy MySQL read replicas in each Region. Use the correct Regional endpoint in each Regional deployment for access to the database.
• ○ Migrate the application to an Amazon Aurora Serverless database. Deploy instances of the database to each Region. Use the correct Regional endpoint in each Regional deployment to access the database. Use AWS Lambda functions to process event streams in each Region to synchronize the databases.

Select an option, then click Submit answer.

• ○ Create an Amazon EC2-backed Amazon Machine Image (AMI) lifecycle policy to create a backup based on tags. Schedule the backup to run twice daily. Copy the image on demand.
• ○ Create an Amazon EC2-backed Amazon Machine Image (AMI) lifecycle policy to create a backup based on tags. Schedule the backup to run twice daily. Configure the copy to the us-west-2 Region.
• ○ Create backup vaults in us-west-1 and in us-west-2 by using AWS Backup. Create a backup plan for the EC2 instances based on tag values. Create an AWS Lambda function to run as a scheduled job to copy the backup data to us-west-2.
• ○ Create a backup vault by using AWS Backup. Use AWS Backup to create a backup plan for the EC2 instances based on tag values. Define the destination for the copy as us-west-2. Specify the backup schedule to run twice daily.
• ○ Create a backup vault by using AWS Backup. Use AWS Backup to create a backup plan for the EC2 instances based on tag values. Specify the backup schedule to run twice daily. Copy on demand to us-west-2.

Select an option, then click Submit answer.

• ○ Grant the required permission in AWS Identity and Access Management (IAM) to the AmazonEKSNodeRole IAM role.
• ○ Create interface VPC endpoints to allow nodes to access the control plane.
• ○ Recreate nodes in the public subnet. Restrict security groups for EC2 nodes.
• ○ Allow outbound traffic in the security group of the nodes.

Select an option, then click Submit answer.

• ○ Integrate DynamoDB with AWS Secrets Manager in the inventory application account. Configure the application to use the correct secret from Secrets Manager to authenticate and read the DynamoDB table. Schedule secret rotation for every 30 days.
• ○ In every business account, create an IAM user that has programmatic access. Configure the application to use the correct IAM user access key ID and secret access key to authenticate and read the DynamoDB table. Manually rotate IAM access keys every 30 days.
• ○ In every business account, create an IAM role named BU_ROLE with a policy that gives the role access to the DynamoDB table and a trust policy to trust a specific role in the inventory application account. In the inventory account, create a role named APP_ROLE that allows access to the STS AssumeRole API operation. Configure the application to use APP_ROLE and assume the crossaccount role BU_ROLE to read the DynamoDB table.
• ○ Integrate DynamoDB with AWS Certificate Manager (ACM). Generate identity certificates to authenticate DynamoDB. Configure the application to use the correct certificate to authenticate and read the DynamoDB table.

Select an option, then click Submit answer.

• ○ Use an AWS Lambda function to resize the EKS cluster.
• ○ Use the Kubernetes Metrics Server to activate horizontal pod autoscaling.
• ○ Use the Kubernetes Cluster Autoscaler to manage the number of nodes in the cluster.
• ○ Use Amazon API Gateway and connect it to Amazon EKS.
• ○ Use AWS App Mesh to observe network activity.

Select an option, then click Submit answer.

• ○ Migrate the databases to Amazon EC2. Use an AWS Key Management Service (AWS KMS) AWS managed key for encryption.
• ○ Migrate the databases to Amazon RDS Configure encryption at rest.
• ○ Migrate the data to Amazon S3 Use Amazon Macie for data security and protection
• ○ Migrate the database to Amazon RDS. Use Amazon CloudWatch Logs for data security and protection.

Select an option, then click Submit answer.

• ○ Generate and provide S3 signed cookies to premium customers.
• ○ Generate and provide CloudFront signed URLs to premium customers.
• ○ Use origin access control (OAC) to limit the access of non-premium customers.
• ○ Generate and activate field-level encryption to block non-premium customers.

Select an option, then click Submit answer.

• ○ Create an IAM role to read the DynamoDB tables. Associate the role with the application instances by referencing an instance profile.
• ○ Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances.
• ○ Use the parameter section in the AWS CloudFormation template to have the user input access and secret keys from an already-created IAM user that has the required permissions to read and write from the DynamoDB tables.
• ○ Create an IAM user in the AWS CloudFormation template that has the required permissions to read and write from the DynamoDB tables. Use the GetAtt function to retrieve the access and secret keys, and pass them to the application instances through the user data.

Select an option, then click Submit answer.

• ○ Provision the AWS accounts by using AWS Control Tower. Use account drift notifications to identify the changes to the OU hierarchy.
• ○ Provision the AWS accounts by using AWS Control Tower. Use AWS Config aggregated rules to identify the changes to the OU hierarchy.
• ○ Use AWS Service Catalog to create accounts in Organizations. Use an AWS CloudTrail organization trail to identify the changes to the OU hierarchy.
• ○ Use AWS CloudFormation templates to create accounts in Organizations. Use the drift detection operation on a stack to identify the changes to the OU hierarchy.

Select an option, then click Submit answer.

• ○ Create a route table entry for the endpoint.
• ○ Create a gateway endpoint for DynamoDB.
• ○ Create an interface endpoint for Amazon EC2.
• ○ Create an elastic network interface for the endpoint in each of the subnets of the VPC.
• ○ Create a security group entry in the endpoint's security group to provide access.

Select an option, then click Submit answer.

• ○ Use native MySQL tools to migrate the database to Amazon RDS for MySQL. Configure elastic storage scaling.
• ○ Migrate the database to Amazon Redshift by using the mysqldump utility. Turn on Auto Scaling for the Amazon Redshift cluster.
• ○ Use AWS Database Migration Service (AWS DMS) to migrate the database to Amazon Aurora. Turn on Aurora Auto Scaling.
• ○ Use AWS Database Migration Service (AWS DMS) to migrate the database to Amazon DynamoDB. Configure an Auto Scaling policy.

Select an option, then click Submit answer.

• ○ Create a reminder in Amazon EventBridge to scale the instances.
• ○ Create an Auto Scaling group that has a scheduled action.
• ○ Create an Auto Scaling group that uses manual scaling.
• ○ Create an Auto Scaling group that uses automatic scaling.

Select an option, then click Submit answer.

• ○ Use a local machine to create a certificate that is signed by the third-party CImport the certificate into AWS Certificate Manager (ACM). Create an HTTP API in Amazon API Gateway with a custom domain. Configure the custom domain to use the certificate.
• ○ Create a certificate in AWS Certificate Manager (ACM) that is signed by the third-party CA. Create an HTTP API in Amazon API Gateway with a custom domain. Configure the custom domain to use the certificate.
• ○ Use AWS Certificate Manager (ACM) to create a certificate that is signed by the third-party CA. Import the certificate into AWS Certificate Manager (ACM). Create an AWS Lambda function with a Lambda function URL. Configure the Lambda function URL to use the certificate.
• ○ Create a certificate in AWS Certificate Manager (ACM) that is signed by the third-party CA. Create an AWS Lambda function with a Lambda function URL. Configure the Lambda function URL to use the certificate.

Select an option, then click Submit answer.

• ○ Configure an Auto Scaling group with an Amazon EC2 instance. Use an Amazon FSx for Lustre file system to run the application.
• ○ Host the application on an Amazon EC2 instance. Use an Amazon Elastic Block Store (Amazon EBS) GP2 volume to run the application.
• ○ Configure an Auto Scaling group with an Amazon EC2 instance. Use an Amazon FSx for OpenZFS file system to run the application.
• ○ Host the application on an Amazon EC2 instance. Use an Amazon Elastic Block Store (Amazon EBS) GP3 volume to run the application.

Select an option, then click Submit answer.

• ○ Set the Auto Scaling group's minimum capacity to two. Deploy one On-Demand Instance in one Availability Zone and one On-Demand Instance in a second Availability Zone.
• ○ Set the Auto Scaling group's minimum capacity to four. Deploy two On-Demand Instances in one Availability Zone and two On-Demand Instances in a second Availability Zone.
• ○ Set the Auto Scaling group's minimum capacity to two. Deploy four Spot Instances in one Availability Zone.
• ○ Set the Auto Scaling group's minimum capacity to four. Deploy two On-Demand Instances in one Availability Zone and two Spot Instances in a second Availability Zone.

Select an option, then click Submit answer.

• ○ Read the data from the tapes on premises. Stage the data in a local NFS storage. Use AWS DataSync to migrate the data to Amazon S3 Glacier Flexible Retrieval.
• ○ Use an on-premises backup application to read the data from the tapes and to write directly to Amazon S3 Glacier Deep Archive.
• ○ Order multiple AWS Snowball devices that have Tape Gateway. Copy the physical tapes to virtual tapes in Snowball. Ship the Snowball devices to AWS. Create a lifecycle policy to move the tapes to Amazon S3 Glacier Deep Archive.
• ○ Configure an on-premises Tape Gateway. Create virtual tapes in the AWS Cloud. Use backup software to copy the physical tape to the virtual tape.

Select an option, then click Submit answer.

• ○ Run the EC2 instances in a spread placement group.
• ○ Group the EC2 instances in separate accounts.
• ○ Configure the EC2 instances with dedicated tenancy.
• ○ Configure the EC2 instances with shared tenancy.

Select an option, then click Submit answer.

• ○ Create a read replica of the database. Direct the queries to the read replica.
• ○ Create a backup of the database. Restore the backup to another DB instance. Direct the queries to the new database.
• ○ Export the data to Amazon S3. Use Amazon Athena to query the S3 bucket.
• ○ Resize the DB instance to accommodate the additional workload.

Select an option, then click Submit answer.

• ○ Use Multi-AZ Redis replication groups with shards that contain multiple nodes.
• ○ Use Redis shards that contain multiple nodes with Redis append only files (AOF) turned on.
• ○ Use a Multi-AZ Redis cluster with more than one read replica in the replication group.
• ○ Use Redis shards that contain multiple nodes with Auto Scaling turned on.

Select an option, then click Submit answer.

• ○ Use the AWS Step Functions Map state in Inline mode to process the data in parallel.
• ○ Use the AWS Step Functions Map state in Distributed mode to process the data in parallel.
• ○ Use AWS Glue to process the data in parallel.
• ○ Use several AWS Lambda functions to process the data in parallel.

Select an option, then click Submit answer.

• ○ Configure AWS DataSync to migrate the data to Amazon S3 and to automatically verify the data.
• ○ Use rsync to transfer the data directly to Amazon S3.
• ○ Use the AWS CLI and multiple copy processes to send the data directly to Amazon S3.
• ○ Order multiple AWS Snowball devices. Copy the data to the devices. Send the devices to AWS to copy the data to Amazon S3.

Select an option, then click Submit answer.

• ○ Deploy AWS PrivateLink in front of the application servers. Configure the network ACL to allow only the web servers to access the application servers.
• ○ Deploy a VPC endpoint in front of the application servers. Configure the security group to allow only the web servers to access the application servers.
• ○ Deploy a Network Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the network ACL to allow only the web servers to access the application servers.
• ○ Deploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the security group to allow only the web servers to access the application servers.

Select an option, then click Submit answer.

• ○ Instance store volume
• ○ Amazon ElastiCache for Memcached cluster
• ○ Provisioned IOPS SSD Amazon Elastic Block Store (Amazon EBS) volume
• ○ Throughput Optimized HDD Amazon Elastic Block Store (Amazon EBS) volume

Select an option, then click Submit answer.

• ○ Order an AWS Snowball Edge device. Configure the Snowball Edge device to perform the online data transfer to an S3 bucket
• ○ Deploy an AWS DataSync agent on premises. Configure the DataSync agent to perform the online data transfer to an S3 bucket.
• ○ Create an Amazon S3 File Gateway on premises Configure the S3 File Gateway to perform the online data transfer to an S3 bucket
• ○ Configure an accelerator in Amazon S3 Transfer Acceleration on premises. Configure the accelerator to perform the online data transfer to an S3 bucket.

Select an option, then click Submit answer.

• ○ Configure S3 global tables to replicate data for each agency.
• ○ Make the S3 bucket public for a limited time. Inform only the agencies.
• ○ Configure cross-account access for the S3 bucket to the accounts that the agencies own.
• ○ Set up an IAM user for each analyst in the source data account. Grant each user access to the S3 bucket.

Select an option, then click Submit answer.

• ○ Use AWS Global Accelerator with health checks.
• ○ Use Amazon Route 53 with a geolocation routing policy.
• ○ Create an Amazon CloudFront distribution that includes multiple origins.
• ○ Create an Application Load Balancer that uses path-based routing.

Select an option, then click Submit answer.

• ○ Transition the objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 180 days. S3 Glacier Instant Retrieval after 360 days, and S3 Glacier Deep Archive after 5 years.
• ○ Transition the objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 180 days. S3 Glacier Flexible Retrieval after 360 days, and S3 Glacier Deep Archive after 5 years.
• ○ Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 180 days, S3 Glacier Instant Retrieval after 360 days, and S3 Glacier Deep Archive after 5 years.
• ○ Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 180 days, S3 Glacier Flexible Retrieval after 360 days, and S3 Glacier Deep Archive after 5 years.

Select an option, then click Submit answer.

• ○ Create VPC security groups in the organization's management account. Update the security groups when a CIDR range update is necessary.
• ○ Create a VPC customer managed prefix list that contains the list of CIDRs. Use AWS Resource Access Manager (AWS RAM) to share the prefix list across the organization. Use the prefix list in the security groups across the organization.
• ○ Create an AWS managed prefix list. Use an AWS Security Hub policy to enforce the security group update across the organization. Use an AWS Lambda function to update the prefix list automatically when the CIDR ranges change.
• ○ Create security groups in a central administrative AWS account. Create an AWS Firewall Manager common security group policy for the whole organization. Select the previously created security groups as primary groups in the policy.

Select an option, then click Submit answer.

• ○ Create an IAM group that has a conditional Allow policy that requires the application name tag to be specified for resources to be created.
• ○ Create a cross-account role that has a Deny policy for any resource that has the application name tag.
• ○ Create a resource group in AWS Resource Groups to validate that the tags are applied to all resources in all accounts.
• ○ Create a tag policy in Organizations that has a list of allowed application names.

Select an option, then click Submit answer.

• ○ Migrate the web tier to Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer.
• ○ Migrate the database to Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer.
• ○ Migrate the database to an Amazon RDS Multi-AZ deployment.
• ○ Migrate the web tier to an AWS Lambda function.
• ○ Migrate the database to an Amazon DynamoDB table.

Select an option, then click Submit answer.

• ○ Add functionality to the script to identify the instance that has the fewest active connections. Configure the script to read from that instance to report the total new entries.
• ○ Create a read replica of the database. Configure the script to query only the read replica to report the total new entries.
• ○ Instruct the development team to manually export the new entries for the day in the database at the end of each day.
• ○ Use Amazon ElastiCache to cache the common queries that the script runs against the database.

Select an option, then click Submit answer.

• ○ Create public NAT gateways in the same private subnets as the EC2 instances.
• ○ Create private NAT gateways in the same private subnets as the EC2 instances.
• ○ Create public NAT gateways in public subnets in the same VPCs as the EC2 instances.
• ○ Create private NAT gateways in public subnets in the same VPCs as the EC2 instances.

Select an option, then click Submit answer.

• ○ Use the round robin routing algorithm based on the RequestCountPerTarget and ActiveConnectionCount CloudWatch metrics.
• ○ Use the least outstanding requests algorithm based on the RequestCountPerTarget and ActiveConnectionCount CloudWatch metrics.
• ○ Use the round robin routing algorithm based on the RequestCount and TargetResponseTime CloudWatch metrics.
• ○ Use the least outstanding requests algorithm based on the RequestCount and TargetResponseTime CloudWatch metrics.

Select an option, then click Submit answer.

• ○ Upload and store content in Amazon S3. Use Amazon CloudFront for the uploads.
• ○ Upload and store content in Amazon S3. Use S3 Transfer Acceleration for the uploads.
• ○ Upload content to Amazon EC2 instances in the Region that is closest to the user. Copy the data to Amazon S3.
• ○ Upload and store content in Amazon S3 in the Region that is closest to the user. Use multiple distributions of Amazon CloudFront.

Select an option, then click Submit answer.

• ○ Put the EC2 instances behind Network Load Balancers (NLBs) in each Region. Deploy AWS WAF on the NLBs. Create an accelerator using AWS Global Accelerator and register the NLBs as endpoints.
• ○ Put the EC2 instances behind Application Load Balancers (ALBs) in each Region. Deploy AWS WAF on the ALBs. Create an accelerator using AWS Global Accelerator and register the ALBs as endpoints.
• ○ Put the EC2 instances behind Network Load Balancers (NLBs) in each Region. Deploy AWS WAF on the NLBs. Create an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the NLBs.
• ○ Put the EC2 instances behind Application Load Balancers (ALBs) in each Region. Create an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the ALBs. Deploy AWS WAF on the CloudFront distribution.

Select an option, then click Submit answer.

• ○ Deploy AWS Local Zones in the company's data center.
• ○ Use an AWS Snowmobile in the company's data center.
• ○ Install an AWS Outposts rack in the company's data center.
• ○ Install an AWS Snowball Edge Storage Optimized node in the data center.

Select an option, then click Submit answer.

• ○ Set up an AWS Storage Gateway Volume Gateway. Use an Amazon S3 Lifecycle policy to transition the data to the appropriate storage class.
• ○ Set up an AWS Storage Gateway Amazon S3 File Gateway. Use an Amazon S3 Lifecycle policy to transition the data to the appropriate storage class.
• ○ Use the Amazon Elastic File System (Amazon EFS) Standard-Infrequent Access (Standard-IA) storage class. Activate the infrequent access lifecycle policy.
• ○ Use the Amazon Elastic File System (Amazon EFS) One Zone-Infrequent Access (One Zone-IA) storage class. Activate the infrequent access lifecycle policy.

Select an option, then click Submit answer.

• ○ Configure reserved concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions.
• ○ Configure reserved concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations.
• ○ Configure provisioned concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions.
• ○ Configure provisioned concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations.

Select an option, then click Submit answer.

• ○ Instruct the vendor to sign up for the AWS Hosted Connection Direct Connect Program. Use VPC peering to connect the company's VPC and the vendor's VPC.
• ○ Configure a client VPN connection between the company's VPC and the vendor's VPC. Use VPC peering to connect the company's VPC and the vendor's VPC.
• ○ Instruct the vendor to create a Network Load Balancer (NLB). Place the NLB in front of the Amazon RDS for MySQL database. Use AWS PrivateLink to integrate the company's VPC and the vendor's VPC.
• ○ Use AWS Transit Gateway to integrate the company's VPC and the vendor's VPC. Use VPC peering to connect the company’s VPC and the vendor's VPC.

Select an option, then click Submit answer.

• ○ Configure an AWS Glue Studio visual canvas to transform the data. Share the transformation steps with employees by using AWS Glue jobs.
• ○ Configure Amazon EMR Serverless to transform the data. Share the transformation steps with employees by using EMR Serverless jobs.
• ○ Configure AWS Glue DataBrew to transform the data. Share the transformation steps with employees by using DataBrew recipes.
• ○ Create Amazon Athena tables for the data. Write Athena SQL queries to transform the data. Share the Athena SQL queries with employees.

Select an option, then click Submit answer.

• ○ Create an AWS Lambda function to filter the data that exceeds DynamoDB item size limits. Store the larger data in an Amazon DocumentDB (with MongoDB compatibility) database.
• ○ Store the large data as objects in an Amazon S3 bucket. In a DynamoDB table, create an item that has an attribute that points to the S3 URL of the data.
• ○ Split all incoming large data into a collection of items that have the same partition key. Write the data to a DynamoDB table in a single operation by using the BatchWriteItem API operation.
• ○ Create an AWS Lambda function that uses gzip compression to compress the large objects as they are written to a DynamoDB table.

Select an option, then click Submit answer.

• ○ Deploy AWS Certificate Manager to generate certificates. Use the certificates to encrypt the database volume.
• ○ Deploy AWS CloudHSM, generate encryption keys, and use the keys to encrypt database volumes.
• ○ Configure SSL encryption using AWS Key Management Service (AWS KMS) keys to encrypt database volumes.
• ○ Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes.

Select an option, then click Submit answer.

• ○ Amazon CloudFront
• ○ AWS Global Accelerator
• ○ AWS Client VPN
• ○ Amazon EC2 instances and AWS Elastic IP addresses

Select an option, then click Submit answer.

• ○ Purchase an EC2 Instance Savings Plan. Connect the Lambda functions to the private subnets that contain the EC2 instances.
• ○ Purchase an EC2 Instance Savings Plan. Connect the Lambda functions to new public subnets in the same VPC where the EC2 instances run.
• ○ Purchase a Compute Savings Plan. Connect the Lambda functions to the private subnets that contain the EC2 instances.
• ○ Purchase a Compute Savings Plan. Keep the Lambda functions in the Lambda service VPC.

Select an option, then click Submit answer.

• ○ Move the website to an Amazon S3 bucket. Configure an Amazon CloudFront distribution for the S3 bucket.
• ○ Move the website to an Amazon S3 bucket. Configure an Amazon ElastiCache cluster for the S3 bucket.
• ○ Move the website to AWS Amplify. Configure an ALB to resolve to the Amplify website.
• ○ Move the website to AWS Amplify. Configure EC2 instances to cache the website.

Select an option, then click Submit answer.

• ○ Create an AWS Storage Gateway Volume Gateway. Create a file share that uses the required client protocol. Connect the application server to the file share.
• ○ Create an AWS Storage Gateway Tape Gateway. Configure tapes to use Amazon S3. Connect the application server to the Tape Gateway.
• ○ Create an Amazon EC2 Windows instance. Install and configure a Windows file share role on the instance. Connect the application server to the file share.
• ○ Create an Amazon FSx for Windows File Server file system. Connect the application server to the file system.

Select an option, then click Submit answer.

• ○ Create an Aurora read replica in us-west-1 similar in size to the production application's Aurora MySQL cluster writer instance.
• ○ Convert the Aurora cluster to an Aurora global database. Configure managed failover.
• ○ Create a new Aurora cluster in us-west-1 that has Cross-Region Replication.
• ○ Create a new Aurora cluster in us-west-1. Use AWS Database Migration Service (AWS DMS) to sync both clusters.

Select an option, then click Submit answer.

• ○ Enable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
• ○ Enable AWS WAF on the ALCreate an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the ALB.
• ○ Store the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.
• ○ Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.

Select an option, then click Submit answer.

• ○ Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.
• ○ Implement an Amazon Simple Queue Service (Amazon SQS) queue in the administrator account to buffer messages from the SNS topic that is in the production account. Configure the SQS queue to invoke the Lambda function.
• ○ Create an IAM policy for the SNS topic that allows the Lambda function to subscribe to the topic.
• ○ Use an Amazon EventBridge rule in the production account to capture the SNS topic notifications. Configure the EventBridge rule to forward notifications to the Lambda function that is in the administrator account.
• ○ Store performance metrics in an Amazon S3 bucket in the production account. Use Amazon Athena to analyze the metrics from the administrator account.

Select an option, then click Submit answer.

• ○ Configure the AWS DMS replication instance with a Multi-AZ deployment to provision instances across multiple Availability Zones.
• ○ Create an AWS DMS Serverless replication task to analyze and replicate the data while provisioning the required capacity.
• ○ Use Amazon EC2 Auto Scaling to scale the size of the AWS DMS replication instance up or down based on the amount of data toreplicate.
• ○ Provision AWS DMS replication capacity by using Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type to analyze and replicate the data while provisioning the required capacity.

Select an option, then click Submit answer.

• ○ Configure AWS Direct Connect to connect to the VPC. Configure the VPC route tables to allow and deny traffic between AWS and on premises as required.
• ○ Create an IAM policy to allow access to the AWS Management Console only from a defined set of corporate IP addresses. Restrict user access based on job responsibility by using an IAM policy and roles.
• ○ Configure AWS Site-to-Site VPN to connect to the VPConfigure route table entries to direct traffic from on premises to the VPConfigure instance security groups and network ACLs to allow only required traffic from on premises.
• ○ Configure AWS Transit Gateway to connect to the VPC. Configure route table entries to direct traffic from on premises to the VPC. Configure instance security groups and network ACLs to allow only required traffic from on premises.

Select an option, then click Submit answer.

• ○ Establish an AWS Site-to-Site VPN connection to each VPC.
• ○ Associate an AWS Direct Connect gateway with the transit gateway that is attached to the VPCs.
• ○ Establish an AWS Site-to-Site VPN connection to an AWS Direct Connect gateway.
• ○ Establish an AWS Direct Connect connection. Create a transit virtual interface (VIF) to a Direct Connect gateway.
• ○ Associate AWS Site-to-Site VPN connections with the transit gateway that is attached to the VPCs.

Select an option, then click Submit answer.

• ○ Encrypt the data by using client-side encryption with customer managed keys.
• ○ Encrypt the data by using server-side encryption with AWS KMS keys (SSE-KMS).
• ○ Encrypt the data by using server-side encryption with customer-provided keys (SSE-C).
• ○ Encrypt the data by using client-side encryption with Amazon S3 managed keys.

Select an option, then click Submit answer.

• ○ Amazon S3 Standard
• ○ Amazon S3 Intelligent-Tiering
• ○ Amazon S3 Glacier Deep Archive
• ○ Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

Select an option, then click Submit answer.

• ○ Use Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure each Auto Scaling group's minimum capacity to meet its peak workload value.
• ○ Use Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure a CloudWatch alarm to invoke an Amazon Simple Notification Service (Amazon SNS) topic to create additional Auto Scaling groups on demand.
• ○ Provision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective queues. Scale the Auto Scaling groups based on notifications that the queues send.
• ○ Provision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective queues. Scale the Auto Scaling groups based on the number of messages in each queue.