AWS Certified Solutions Architect - Professional

Question 1

A financial services company runs a legacy trading API behind an Application Load Balancer (ALB) in a single region. A newly onboarded partner requires that all traffic to the API traverse a small set of static, allowlisted IP addresses through their corporate firewall, and they demand the lowest possible connection latency for high-frequency requests. The current ALB exposes only DNS names, and the partner cannot allowlist DNS names or the ALB's changing IP ranges. The solutions architect must refactor the ingress without rewriting the application, which relies on host-based HTTP routing rules already configured on the ALB. Which approach best satisfies the requirements?

Accepted Answer

Deploy AWS Global Accelerator in front of the existing ALB to provide two static anycast IP addresses and reduced latency via the AWS global network.

Answer

Replace the ALB with a Network Load Balancer (NLB) that has Elastic IPs, and move the host-based routing logic into the application tier.

Answer

Place an Amazon CloudFront distribution in front of the ALB and provide the partner with CloudFront's IP ranges to allowlist.

Answer

Assign Elastic IPs directly to the ALB and share those addresses with the partner for firewall allowlisting.

Question 2

A media company runs a mobile news application backed by a monolithic REST API on EC2 behind an Application Load Balancer. The API aggregates data from three microservices, and mobile clients frequently over-fetch large JSON payloads on cellular networks, driving high data transfer costs and poor perceived performance. Product analytics show that different app screens need different subsets of the same underlying data, and the team also wants to push live breaking-news updates to active users without polling. The company wants to improve performance and reduce redundant data transfer while minimizing custom server infrastructure to maintain. Which refactoring approach best meets these goals?

Accepted Answer

Introduce an AWS AppSync GraphQL API in front of the microservices, letting clients request only the fields they need per screen and using AppSync subscriptions over WebSockets for real-time breaking-news push.

Answer

Add an Amazon CloudFront distribution in front of the ALB with a long cache TTL and enable gzip compression to reduce payload size for mobile clients.

Answer

Replace the REST API with Amazon API Gateway REST endpoints, one per app screen, and use Amazon SNS mobile push notifications for breaking-news alerts.

Answer

Keep the REST API but add an Amazon ElastiCache for Redis layer to cache aggregated responses and reduce backend load, then poll the API every 30 seconds from clients for updates.

Question 3

A company is planning to migrate roughly 800 on-premises servers to AWS over the next 18 months. The infrastructure team knows the servers exist but has poor documentation about which applications run on them, how the servers communicate with each other, and their current CPU, memory, and network utilization patterns. Leadership wants a data-driven migration plan that groups servers into application move groups and rightsizes EC2 targets, but corporate security policy forbids installing any third-party software agents on the production VMware fleet. Which approach BEST meets these discovery and planning requirements?

Accepted Answer

Deploy the AWS Application Discovery Service Agentless Collector as a virtual appliance in vCenter to continuously collect utilization and network dependency data, then use Migration Hub to group servers into application move groups.

Answer

Install the AWS Application Discovery Agent on each of the 800 servers to gather detailed process-level and network connection data, and view results in Migration Hub.

Answer

Use AWS Migration Evaluator with a manual spreadsheet inventory provided by the infrastructure team, then estimate EC2 sizes based on documented specifications.

Answer

Enable AWS Application Migration Service (MGN) replication on all servers immediately so that CloudWatch metrics from the launched test instances reveal dependencies and utilization.

Question 4

A financial services company runs a monolithic on-premises Java application that relies heavily on a self-managed RabbitMQ cluster for asynchronous messaging between internal components. The company wants to migrate to AWS with minimal application code changes and no re-engineering of the messaging protocol. The messaging middleware must remain compatible with the existing AMQP 0-9-1 clients, and the operations team wants AWS to handle broker patching, high availability, and automated failover across Availability Zones. Which approach best meets these requirements with the least migration effort?

Accepted Answer

Migrate the messaging layer to Amazon MQ for RabbitMQ deployed in a cluster deployment mode across multiple Availability Zones.

Answer

Refactor the application to publish and consume messages using Amazon SQS standard queues and Amazon SNS topics for fan-out.

Answer

Deploy RabbitMQ on a self-managed Amazon EC2 Auto Scaling group with an Application Load Balancer in front of the broker nodes.

Answer

Replatform the messaging layer to Amazon Kinesis Data Streams and update the application to use the Kinesis Client Library.

Question 5

A data analytics team runs interactive Amazon Athena queries against 8 TB of JSON application logs stored in a single Amazon S3 prefix. Analysts complain that queries scanning a few days of data take several minutes and cost far more than expected because each query scans the entire dataset. The team wants to improve query performance and reduce cost with minimal ongoing operational overhead, while continuing to receive newly ingested logs daily. Which combination of changes best achieves this?

Accepted Answer

Convert the logs to Apache Parquet using an AWS Glue ETL job, partition the data by date in S3, and enable Athena partition projection so partitions do not need to be registered in the Glue Data Catalog.

Answer

Increase the Athena workgroup query result reuse window and raise the per-query data scan limit so analysts can scan the full dataset faster.

Answer

Load the JSON logs into an Amazon Redshift cluster and have analysts query Redshift directly instead of Athena.

Answer

Enable S3 Intelligent-Tiering on the log bucket and compress the JSON files with gzip to reduce the amount of data Athena scans.

Question 6

A retail company runs a production Amazon Aurora MySQL-compatible cluster supporting an e-commerce platform that processes thousands of transactions per minute. As part of a modernization effort, the database team must perform a major version upgrade of the Aurora engine. The business requires that the upgrade be tested against production-like data and traffic patterns before cutover, that the switchover to the new version take no more than a few minutes, and that a fast rollback path exists if issues are detected after cutover. Which approach best meets these requirements with the least operational effort?

Accepted Answer

Create an Amazon RDS Blue/Green Deployment for the Aurora cluster, upgrade the engine on the green environment, validate it while replication keeps it in sync with blue, and switch over during a maintenance window.

Answer

Take a manual snapshot of the cluster, restore it to a new cluster running the target engine version, redirect application traffic to the new cluster, and delete the old cluster after validation.

Answer

Use AWS DMS to replicate data from the current cluster to a newly provisioned cluster running the target engine version, then cut over the application endpoint once DMS reports full-load and CDC completion.

Answer

Modify the cluster in place to the target engine version during a scheduled maintenance window and rely on the automated pre-upgrade snapshot for rollback if the upgrade fails.

Question 7

A financial services company runs a mission-critical transaction processing application on Amazon Aurora PostgreSQL in the us-east-1 Region. Regulatory requirements mandate a disaster recovery strategy in eu-west-1 with an RPO of no more than 1 second and an RTO of under 5 minutes. The primary workload sustains heavy write traffic, and the solution must not introduce write latency to the primary database. Cross-region promotion must be fast during a regional failure. Which approach best meets these requirements?

Accepted Answer

Deploy an Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1, using managed cross-region replication and promoting the secondary during a regional outage.

Answer

Enable automated Aurora snapshots and use cross-region snapshot copy on a scheduled basis, restoring the latest snapshot in eu-west-1 during a disaster.

Answer

Create an Aurora cross-region read replica in eu-west-1 using standard binlog-based logical replication and promote it to a standalone cluster during failover.

Answer

Configure synchronous multi-region replication by adding Aurora Replicas in eu-west-1 to the same cluster so every write commits in both Regions before acknowledgment.

Question 8

A company is migrating a 40 TB self-managed MySQL 8.0 database from an on-premises data center to Amazon Aurora MySQL-Compatible Edition. The data center has a 500 Mbps internet connection that is shared with production traffic, and the business requires that ongoing changes be captured and applied so that final cutover downtime is under 15 minutes. The migration team wants to minimize impact on the shared network link during the initial bulk load while still meeting the low-downtime requirement. Which approach best meets these requirements?

Accepted Answer

Export the full database to an AWS Snowball Edge device for the initial bulk load, then use a single AWS DMS task with change data capture (CDC) over the network to replicate ongoing changes until cutover.

Answer

Run a single AWS DMS full-load-plus-CDC task entirely over the existing 500 Mbps internet connection and schedule the full load during a maintenance window.

Answer

Use AWS DataSync to copy the raw MySQL data files to Amazon S3, then restore them directly into Aurora and enable binlog replication for ongoing changes.

Answer

Use AWS Application Migration Service (MGN) to rehost the database server as an EC2 instance, then convert it to Aurora after cutover.

Question 9

A company runs an internal reporting application on an Aurora MySQL provisioned cluster with two db.r6g.2xlarge instances (writer plus reader). The application is heavily used for about four hours each business day and is nearly idle the rest of the time, including nights and weekends. Finance flags the cluster as one of the highest recurring costs, yet the team must keep the database instantly available whenever a user logs in, and they cannot tolerate the multi-minute delays of stopping and starting the cluster on a schedule. Which change best reduces cost while preserving on-demand responsiveness?

Accepted Answer

Migrate the cluster to Aurora Serverless v2, configuring a low minimum ACU capacity and a higher maximum ACU so capacity scales up during the daily peak and scales down to the minimum during idle periods.

Answer

Keep the provisioned cluster but purchase a 3-year All Upfront Reserved Instance for both nodes to lower the hourly rate.

Answer

Create an EventBridge Scheduler rule to stop the Aurora cluster each evening and start it each morning, accepting the startup latency.

Answer

Replace the reader with an Aurora Auto Scaling policy that adds read replicas based on CPU, and downsize the writer to db.r6g.large.

Question 10

A company runs a reporting platform on an Amazon Aurora PostgreSQL cluster (Standard configuration) that has grown to handle heavy, sustained analytical query loads. The finance team reports that the monthly Aurora bill has become unpredictable and dominated by I/O charges, which now exceed 30% of the total cluster cost. Read query volume is consistently high throughout every billing period. The team wants to reduce and stabilize costs without redesigning the application or changing the database engine. Which action provides the greatest cost improvement?

Accepted Answer

Switch the cluster to the Aurora I/O-Optimized configuration to eliminate per-request I/O charges in exchange for a higher predictable compute and storage rate.

Answer

Enable Aurora Storage Auto Scaling and increase the provisioned IOPS on the cluster volume to smooth out I/O spikes.

Answer

Migrate the cluster to Aurora Serverless v2 so that capacity scales automatically and I/O charges are removed.

Answer

Add several Aurora read replicas across Availability Zones to distribute the read queries and lower total I/O cost.

Question 11

A retail company runs a customer-facing web application on an Amazon EC2 Auto Scaling group behind an Application Load Balancer. Traffic follows a highly predictable daily pattern: it ramps up sharply every morning at 8:00 AM as customers log in. The team currently uses target tracking scaling based on average CPU utilization, but they observe elevated latency and HTTP 503 errors for the first 10-15 minutes each morning because instances cannot launch and warm up fast enough to meet the sudden demand. Application startup (bootstrapping and cache warming) takes about 6 minutes per instance. The team wants to improve reliability without permanently over-provisioning. What is the MOST effective way to address this?

Accepted Answer

Enable predictive scaling on the Auto Scaling group in addition to the existing target tracking policy, and configure an instance warm-up period that accounts for the 6-minute startup time.

Answer

Lower the target tracking CPU threshold to 30% so that new instances launch earlier when demand begins to rise each morning.

Answer

Replace the Auto Scaling group with a fixed desired capacity sized for peak morning load to eliminate scaling delays entirely.

Answer

Add a step scaling policy triggered by ALB request count so that instances scale based on incoming requests instead of CPU.

Question 12

A financial services company runs a legacy .NET Framework application on Windows Server 2012 EC2 instances behind an internal load balancer. The application is a monolith that has no source code changes anymore and the original developers have left. Leadership wants to modernize the deployment to reduce OS patching overhead and improve density, ideally moving to containers without rewriting the application. The team has minimal container expertise and needs a repeatable, low-effort path to containerize the running application and generate the necessary deployment artifacts. Which approach best meets these requirements?

Accepted Answer

Use AWS App2Container (A2C) to discover the running application, containerize it into a Windows container image, and generate ECS/EKS deployment artifacts and a CI/CD pipeline template.

Answer

Use AWS Application Migration Service (MGN) to replicate the EC2 instances, then manually write Dockerfiles to package the application into containers after cutover.

Answer

Rewrite the monolith as ASP.NET Core microservices running on AWS Fargate, decomposing functionality by business domain before migrating.

Answer

Use AWS Elastic Beanstalk with the .NET on Windows platform to deploy the application without any code changes and let it manage the underlying instances.

Question 13

A financial services company runs a customer-facing API on Amazon ECS behind an Application Load Balancer. The API calls a downstream third-party payment provider that occasionally becomes slow or unresponsive during peak periods. When the payment provider degrades, threads in the API tier become blocked waiting for responses, cascading failures consume all available connections, and the entire API becomes unavailable — even for endpoints that do not depend on payments. The architecture team must improve resilience so that a slow downstream dependency cannot take down the whole service. Which approach BEST addresses this requirement?

Accepted Answer

Implement a circuit breaker pattern with bulkhead isolation, using separate connection/thread pools per downstream dependency and timeouts, so failures to the payment provider fail fast and are isolated from unrelated endpoints.

Answer

Increase the ECS task count and enable target-tracking auto scaling on CPU utilization so there are always enough tasks to absorb blocked threads during payment provider slowdowns.

Answer

Place an Amazon SQS queue in front of every API endpoint so that all requests are buffered and retried asynchronously until the payment provider recovers.

Answer

Add an Amazon ElastiCache for Redis cluster to cache payment provider responses so that subsequent calls avoid contacting the slow downstream dependency.

Question 14

A financial services company must implement a centralized backup strategy across dozens of AWS accounts for EBS volumes, RDS databases, and DynamoDB tables. Regulatory auditors require that backups be immutable and cannot be deleted or have their retention shortened by anyone — including account administrators and the root user — for a mandatory 7-year retention period. The solution must minimize custom operational tooling and enforce this centrally. Which approach best meets these requirements?

Accepted Answer

Use AWS Backup with a backup vault protected by AWS Backup Vault Lock in compliance mode, apply a backup plan enforcing the 7-year retention, and orchestrate across accounts using AWS Backup's Organizations integration.

Answer

Enable S3 Object Lock in governance mode on a centralized S3 bucket and write custom Lambda functions to copy all backups into it with a 7-year retention tag.

Answer

Use AWS Backup with a backup vault protected by Vault Lock in governance mode and attach an SCP denying deletion of recovery points.

Answer

Create manual EBS snapshots, RDS snapshots, and DynamoDB backups on a schedule via EventBridge, then apply IAM policies denying delete actions to all users.

Question 15

A biotech company is designing a new genomics analysis platform. Thousands of parallel batch jobs must read from and write to a large shared dataset (hundreds of TB) with extremely high aggregate throughput and sub-millisecond latency during compute-intensive alignment steps. Jobs are containerized and run in bursts of up to 5,000 vCPUs, then the cluster scales to zero when idle. The dataset originates in an Amazon S3 bucket, and results must be written back to S3 for long-term retention. The team wants a fully managed solution that minimizes idle cost. Which storage and compute design best meets these requirements?

Accepted Answer

Run jobs on AWS Batch with Amazon FSx for Lustre linked to the S3 bucket, using a scratch (or persistent) file system that imports data from S3 and exports results back, provisioned per batch run.

Answer

Run jobs on AWS Batch with an Amazon EFS General Purpose file system mounted to all containers, copying data from S3 to EFS before processing.

Answer

Mount the S3 bucket directly to each container using Mountpoint for Amazon S3 and rely on S3 request parallelism for the alignment steps.

Answer

Run jobs on an always-on Amazon EMR cluster using HDFS on local NVMe instance store, syncing data to and from S3 with S3DistCp.

Question 16

A media analytics company runs a nightly batch job that transcodes and analyzes user-uploaded video. The workload is highly parallelizable, fault-tolerant (individual tasks can be retried), and must complete within a 6-hour window each night. The rest of the day the compute fleet sits idle. Job volume varies significantly from night to night. The finance team wants to minimize compute cost while ensuring the batch reliably finishes within its window. Which compute strategy should the solutions architect recommend?

Accepted Answer

Use AWS Batch with a compute environment that combines Spot Instances via a diversified allocation strategy across multiple instance types, and configure a fallback to On-Demand capacity if Spot capacity becomes unavailable.

Answer

Provision a fixed fleet of Reserved Instances sized for peak nightly volume so capacity is always guaranteed and reserved pricing lowers cost.

Answer

Run the batch on a single large On-Demand EC2 instance with a Savings Plan applied, scaling vertically as job volume grows.

Answer

Deploy the workload on an Auto Scaling group of On-Demand Instances behind a queue, using scheduled scaling to launch capacity every night at a fixed size.

Question 17

A company runs a customer-facing payment API on AWS Lambda behind API Gateway. Recent production deployments have twice caused elevated error rates that went unnoticed for several minutes, resulting in failed transactions before engineers manually rolled back. The team uses AWS CodePipeline and CodeDeploy for deployments. Leadership wants future deployments to automatically shift only a small portion of traffic to the new version first, monitor for errors, and roll back automatically if problems are detected — all with minimal custom code. Which approach best meets these requirements?

Accepted Answer

Configure CodeDeploy to deploy the Lambda function using a canary traffic-shifting configuration with Lambda aliases, and attach a CloudWatch alarm on the function's error metric as a rollback trigger.

Answer

Publish each new Lambda version and use a weighted Route 53 record to send 10% of traffic to the new API Gateway stage, then update the weights manually after monitoring dashboards.

Answer

Deploy the new Lambda version with an all-at-once CodeDeploy configuration and create an EventBridge rule that invokes a rollback Lambda when the CloudWatch error alarm fires.

Answer

Enable API Gateway stage canary deployments to split traffic, and write a custom CloudWatch Synthetics canary plus a Step Functions workflow to evaluate metrics and revert the stage if errors exceed a threshold.

Question 18

A retail company runs a self-managed Apache Cassandra cluster on 12 EC2 instances backing its product catalog service. Operations staff spend significant time patching nodes, managing repairs, and scaling the ring during seasonal peaks. Leadership wants to eliminate this operational burden while keeping the existing CQL-based application code changes to an absolute minimum, and they require the migration cutover to complete with less than 5 minutes of write downtime. Which approach best meets these requirements?

Accepted Answer

Migrate to Amazon Keyspaces (for Apache Cassandra) using the CQL COPY command for historical data plus a temporary dual-write from the application to both clusters during cutover, then switch reads to Keyspaces.

Answer

Migrate the data to Amazon DynamoDB using AWS Glue to transform the schema, and rewrite the application to use the DynamoDB SDK.

Answer

Rehost the Cassandra cluster onto larger EC2 instances in an Auto Scaling group and use AWS Backup to reduce the operational effort of the ring.

Answer

Use AWS Database Migration Service (DMS) with a full-load-plus-CDC task to replicate the Cassandra cluster into Amazon Aurora PostgreSQL.

Question 19

A large enterprise runs 120 AWS accounts under AWS Organizations with all features enabled and consolidated billing. The finance team needs to: allocate costs to individual business units (each mapped to a set of accounts), enforce a hard organization-wide spending ceiling that automatically prevents new resource creation when exceeded, and receive proactive alerts before any single account crosses its monthly forecast. The team also wants to maximize Reserved Instance and Savings Plans discount sharing across the organization. Which combination of actions BEST meets these requirements?

Accepted Answer

Use AWS Cost Categories to group accounts into business units, create AWS Budgets with forecasted-cost alerts per account, keep RI/Savings Plans discount sharing enabled in the management account's billing preferences, and apply SCPs to deny resource-creating API calls once a manual review determines the ceiling is reached.

Answer

Enable AWS Budgets Actions to automatically apply a restrictive IAM policy and rely on Budgets to hard-stop all spending organization-wide the instant the ceiling is reached, while disabling RI sharing so each account keeps its own discounts.

Answer

Tag every resource with a business-unit tag, use only the AWS Cost and Usage Report for allocation, and configure a single organization-level budget that terminates running EC2 instances automatically when the ceiling is exceeded.

Answer

Create separate AWS Organizations for each business unit to isolate billing, enable Compute Optimizer for cost allocation, and use Service Quotas to cap spending per account.

Question 20

A large enterprise runs 40 AWS accounts under AWS Organizations. The security team wants employees to authenticate using the company's existing Microsoft Entra ID (Azure AD) as the identity provider and access assigned accounts through a single portal. Access to specific accounts must be governed by the employee's group membership in Entra ID, and permissions must be defined once and reused across many accounts. Which approach meets these requirements with the least ongoing operational overhead?

Accepted Answer

Enable IAM Identity Center, configure Entra ID as an external SAML identity provider with SCIM provisioning, create permission sets, and assign groups to accounts.

Answer

Create individual IAM users in each of the 40 accounts and configure a SAML 2.0 identity provider in each account pointing to Entra ID, mapping groups to IAM roles per account.

Answer

Deploy a self-managed Active Directory in a shared services account, establish a trust with Entra ID, and use cross-account IAM roles assumed via the AWS CLI.

Answer

Configure Amazon Cognito user pools federated with Entra ID and use identity pools to vend temporary credentials into each member account.

Question 21

A company runs a multi-account AWS Organizations environment with dozens of VPCs connected through a central AWS Transit Gateway. An on-premises data center is connected via AWS Direct Connect. The company needs bidirectional DNS resolution: EC2 instances in any VPC must resolve on-premises private hostnames, and on-premises servers must resolve private Route 53 hosted zone records used across the organization. The solution must be centrally managed in a shared networking account and minimize the number of resolver endpoints deployed. Which approach meets these requirements?

Accepted Answer

In the networking account, deploy a Route 53 Resolver inbound endpoint and an outbound endpoint in a central VPC, create resolver rules for the on-premises domain, and share those rules and the private hosted zones across the organization using AWS Resource Access Manager.

Answer

Deploy Route 53 Resolver inbound and outbound endpoints in every VPC across all accounts, and configure conditional forwarding rules independently within each account.

Answer

Configure the on-premises DNS servers to forward all queries to the Amazon-provided VPC resolver at the 169.254.169.253 address over the Direct Connect connection.

Answer

Create a public Route 53 hosted zone for the private domains and use Transit Gateway multicast to distribute DNS records to all VPCs and the on-premises network.

Question 22

A company runs 40 workload accounts under AWS Organizations. The central operations team must build unified dashboards and alarms that correlate CloudWatch metrics and logs from all workload accounts without deploying and maintaining custom agents or Lambda functions to copy data between accounts. They also want to minimize ongoing operational overhead. Which approach best meets these requirements?

Accepted Answer

Configure CloudWatch cross-account observability by designating the operations account as the monitoring account and linking the 40 workload accounts as source accounts, then build dashboards and alarms in the monitoring account.

Answer

Enable CloudWatch metric streams in each workload account to push metrics to a central Kinesis Data Firehose, then store data in S3 and query with Athena for dashboards.

Answer

Create a scheduled Lambda function in each workload account that uses GetMetricData to export metrics to the operations account via a cross-account IAM role, then aggregate in a central CloudWatch dashboard.

Answer

Deploy the CloudWatch agent in every workload account configured to write metrics and logs directly to log groups in the operations account using cross-account credentials.

Question 23

A media company serves a large catalog of static images and video thumbnails through Amazon CloudFront, backed by an S3 origin in us-east-1. The site has grown into a global audience, and CloudWatch metrics show the origin fetch rate (requests reaching S3) has climbed steadily as viewers in more regions request the same popular assets simultaneously. Finance flags rising S3 GET request charges and data transfer out to CloudFront. The cache TTLs are already tuned appropriately, and the assets rarely change. The team wants to reduce the number of duplicate origin requests for the same objects across CloudFront's many regional edge caches without changing the application or the S3 bucket structure. Which action best improves the cache efficiency and reduces origin load?

Accepted Answer

Enable CloudFront Origin Shield in a Region close to the S3 origin so all regional edge caches consolidate origin fetches through a single additional caching layer.

Answer

Increase the CloudFront default and maximum TTLs to the maximum allowed values so objects are evicted from edge caches less frequently.

Answer

Add an Amazon ElastiCache for Redis cluster in front of the S3 bucket to cache frequently requested objects and reduce GET requests.

Answer

Replicate the S3 bucket to multiple Regions with Cross-Region Replication and use a Lambda@Edge function to route each edge to the nearest replica bucket.

Question 24

A media company serves static assets to global users from an S3 bucket that is currently configured as a public website endpoint fronted by CloudFront. A recent security audit flagged that the bucket allows anonymous public access and that assets can be retrieved directly from the S3 website URL, bypassing CloudFront (and therefore WAF rules and access logging). The team must remediate this exposure so that assets are only reachable through CloudFront, without changing the object keys or breaking existing viewer URLs. Which approach best meets these requirements with the least ongoing operational overhead?

Accepted Answer

Configure a CloudFront Origin Access Control (OAC) for the distribution, switch the origin to the S3 REST (bucket) endpoint, block all public access on the bucket, and update the bucket policy to allow access only from the CloudFront distribution's service principal.

Answer

Keep the S3 website endpoint origin but add a custom secret header on the CloudFront origin request and configure a bucket policy that requires that header value.

Answer

Enable S3 Block Public Access and rely on a signed-cookie-only viewer policy while leaving the origin pointed at the public website endpoint.

Answer

Create a Lambda@Edge function that authenticates every viewer request and rewrites the origin URL to a presigned S3 URL generated on each request.

Question 25

A financial services company has an existing multi-account AWS environment managed under AWS Organizations. The security team currently exports CloudTrail logs from each account into per-account S3 buckets and manually runs Amazon Athena queries whenever they investigate a suspicious API activity. Investigations frequently span multiple accounts and take days because analysts must manually correlate results across dozens of buckets and re-create Athena tables. Leadership wants to improve the security posture by reducing investigation time and enabling ongoing detection of anomalous API behavior with minimal operational overhead. Which approach BEST meets these requirements?

Accepted Answer

Enable Amazon GuardDuty at the organization level using the delegated administrator, and create an organization-wide CloudTrail Lake event data store to run SQL-based queries across all accounts from a single location.

Answer

Create an organization CloudTrail that delivers events to a centralized S3 bucket, then schedule an AWS Lambda function to periodically scan the bucket and email analysts when it finds unusual event names.

Answer

Consolidate all per-account CloudTrail S3 buckets into one bucket using S3 Replication and continue running manual Athena queries against the consolidated data with pre-built table partitions.

Answer

Deploy Amazon OpenSearch Service in the security account, stream CloudTrail logs from every account via Kinesis Data Firehose, and build custom anomaly detection dashboards that analysts maintain.

Question 26

A SaaS company runs a high-traffic order-processing service on ECS Fargate. The operations team wants per-customer and per-API-endpoint latency and error metrics so they can build dashboards and alarms broken down by both dimensions. There are roughly 8,000 active customers and 40 API endpoints. The team initially implemented this by calling the CloudWatch PutMetricData API from the application on every request with custom dimensions, but the monthly CloudWatch bill has grown dramatically and the API is being throttled during peak load. Which approach improves cost and reliability while preserving the ability to query metrics by customer and endpoint?

Accepted Answer

Emit structured logs using the CloudWatch Embedded Metric Format (EMF) to stdout, letting CloudWatch Logs asynchronously extract metrics, and use CloudWatch Logs Insights or Contributor Insights for high-cardinality per-customer analysis.

Answer

Continue using PutMetricData but batch up to 1,000 metrics per API call and add exponential backoff to eliminate throttling and reduce cost.

Answer

Create a separate custom CloudWatch metric namespace per customer and publish metrics with PutMetricData to isolate cardinality and reduce charges.

Answer

Send all request telemetry to Amazon Managed Service for Prometheus with per-customer labels and visualize it in Amazon Managed Grafana.

Question 27

A SaaS company runs a customer-facing web application behind an Application Load Balancer with an Auto Scaling group of EC2 instances. Support tickets reveal that customers frequently detect broken checkout and login flows before the operations team does. Existing monitoring relies only on ALB target health checks (a TCP check on port 443) and CloudWatch CPU alarms. The team wants to detect user-facing functional failures and latency degradation for critical multi-step workflows proactively, ideally before real users are affected, with minimal application code changes. Which improvement best meets these requirements?

Accepted Answer

Create CloudWatch Synthetics canaries that script the checkout and login workflows on a schedule from multiple regions, and alarm on canary failures and latency thresholds.

Answer

Enable ALB access logs to S3 and build Athena queries with scheduled QuickSight dashboards to spot elevated 5xx error rates in checkout requests.

Answer

Change the ALB target group health check to an HTTP check against the /health endpoint and lower the healthy threshold to fail instances faster.

Answer

Enable Container Insights and increase the frequency of CPU and memory metric collection so scaling reacts sooner to load-related failures.

Question 28

A SaaS company runs a CI/CD pipeline in AWS CodePipeline with a CodeBuild stage that compiles a large monorepo, downloads hundreds of npm and Maven dependencies on every run, and executes a test suite. The build stage now takes 45 minutes, and developers complain that feedback is too slow, delaying releases. Cost is a secondary concern, but the team wants to reduce build duration with minimal changes to the pipeline structure. Which combination of changes will MOST effectively reduce build time?

Accepted Answer

Enable CodeBuild local caching (custom/source/docker layer caches) or S3 dependency caching, and split independent test suites into parallel CodeBuild actions within the same pipeline stage.

Answer

Migrate the CodeBuild project to a smaller compute type to save cost, and add a CloudWatch alarm that notifies the team when builds exceed 45 minutes.

Answer

Replace CodePipeline with a nightly EventBridge-scheduled batch build so all compilation happens once per day outside working hours.

Answer

Move the entire build to a single large EC2 instance managed by an Auto Scaling group and run the pipeline commands via SSM Run Command.

Question 29

A media company runs a fleet of EC2 instances behind an Application Load Balancer in an Auto Scaling group. Deployments use AWS CodeDeploy with an in-place deployment strategy that runs configuration scripts on each existing instance during release. Recently, deployments have caused inconsistent runtime state: some instances end up with drifted package versions, and failed deployments leave the fleet in a partially updated state that is difficult to roll back. Operations wants to eliminate configuration drift, guarantee that every instance runs an identical, tested artifact, and enable fast, reliable rollback. Which approach BEST meets these requirements while improving operational excellence?

Accepted Answer

Build immutable golden AMIs in the CI/CD pipeline with EC2 Image Builder, then deploy new versions by launching a fresh Auto Scaling group from the new AMI using CodeDeploy blue/green with automatic rollback on alarm.

Answer

Continue in-place deployments but add a CodeDeploy lifecycle hook that runs a script to verify and force-correct package versions on each instance after each deployment.

Answer

Replace CodeDeploy with AWS Systems Manager State Manager associations that continuously reapply the desired configuration to running instances on a schedule to prevent drift.

Answer

Enable Auto Scaling instance refresh with a longer health check grace period and keep the existing in-place CodeDeploy scripts so instances are gradually replaced during deployments.

Question 30

A financial services company deploys infrastructure to 40 accounts using AWS CloudFormation StackSets triggered from a central AWS CodePipeline. Recently, engineers have been manually modifying deployed resources in the console during incidents, causing configuration drift that later breaks automated deployments. The platform team wants to continuously detect drift, automatically alert the owning team, and block the pipeline from promoting new changes to any account currently in a drifted state — without manually inspecting each account. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Schedule an EventBridge rule that periodically invokes a Lambda function to call the CloudFormation DetectStackDrift API across accounts, publish drift status to a central store, notify owners via SNS, and add a pipeline stage that fails if any target stack reports DRIFTED before promotion.

Answer

Enable AWS Config in every account with the cloudformation-stack-drift-detection-check managed rule and rely on Config auto-remediation to revert drifted resources, allowing the pipeline to always deploy without additional gating.

Answer

Turn on CloudTrail in all accounts and create a metric filter that alerts whenever an UpdateStack or console modification event occurs, then require engineers to manually re-run drift detection before each release.

Answer

Replace CloudFormation StackSets with Terraform and run terraform plan in the pipeline, treating any non-empty plan as drift and stopping the deployment automatically.

Question 31

A company must vacate its colocation data center in 90 days after a lease was not renewed. The environment contains roughly 250 physical and virtual servers running a mix of Windows and Linux workloads, including several tightly coupled legacy applications whose source code is unavailable. The team has no capacity to refactor or re-architect anything before the deadline, but they want automated, block-level replication with continuous data sync so that final cutover produces minimal downtime and a low RPO. Which approach best meets these requirements within the timeline?

Accepted Answer

Use AWS Application Migration Service (MGN) to install replication agents on the source servers, continuously replicate to a staging area in AWS, then perform test and cutover launches.

Answer

Use AWS Database Migration Service (DMS) with continuous CDC to replicate the servers to AWS and cut over once the target is in sync.

Answer

Order AWS Snowball Edge devices, export VM images and file systems to the devices, ship them to AWS, and import the images as AMIs for launch.

Answer

Re-architect the tightly coupled applications into containers on Amazon ECS and rebuild the databases on Amazon Aurora before the lease expires.

Question 32

A company operates 45 accounts under AWS Organizations. The security team must continuously verify that all accounts comply with a set of standardized rules (encrypted EBS volumes, no public S3 buckets, mandatory tags), and automatically remediate violations without manually configuring each account. They want compliance findings aggregated in a central account and the ability to deploy new rules once and have them apply everywhere, including future accounts. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Deploy AWS Config conformance packs from a delegated administrator account using organization-wide deployment, include SSM automation documents as remediation actions, and enable Config aggregators in the central account.

Answer

Write custom Lambda functions in each account triggered by CloudTrail events to detect and remediate non-compliant resources, and forward results to a central SQS queue.

Answer

Use Security Hub with the AWS Foundational Security Best Practices standard in each account and manually build EventBridge rules per account to trigger remediation.

Answer

Create a StackSet that deploys individual AWS Config managed rules to each account and use a scheduled Lambda in the management account to poll compliance status and remediate.

Question 33

A large enterprise recently acquired a smaller company. The acquired company operates 12 standalone AWS accounts that were each created independently with separate root credentials and their own consolidated billing was never enabled. The enterprise already runs a mature AWS Organizations setup managed by AWS Control Tower with several OUs and SCPs. The security team wants these 12 accounts brought under the enterprise Organization so that governance guardrails and centralized billing apply, while minimizing disruption to running production workloads. What is the correct approach to bring these existing accounts under central management?

Accepted Answer

Send an invitation from the management account to each existing account, accept the invitation from each member account, then enroll the accounts into Control Tower by moving them into a registered OU and running the enrollment/update process.

Answer

Recreate each workload in brand-new accounts provisioned by Control Tower Account Factory, migrate the data, and decommission the original 12 accounts since existing accounts cannot join an Organization.

Answer

Use the Control Tower Account Factory to directly import the 12 accounts by supplying their root credentials, which automatically merges them and applies all SCPs immediately.

Answer

Enable consolidated billing by adding the 12 account IDs to the payer account's billing preferences; this automatically joins them to the Organization and applies the enterprise OU guardrails.

Question 34

A large enterprise is scaling from 15 to over 200 AWS accounts. They currently provision new accounts manually, which leads to inconsistent guardrails, missing centralized logging, and non-standard VPC configurations. The cloud platform team wants a repeatable, governed process that automatically applies preventive and detective controls, enrolls new accounts into the correct organizational units, and configures a standardized network baseline — while allowing application teams to request accounts through a self-service workflow. Which approach best meets these requirements with the least ongoing operational overhead?

Accepted Answer

Deploy AWS Control Tower and use Account Factory (or Account Factory for Terraform) to provision new accounts, enroll them into predefined OUs with mandatory and elective guardrails applied automatically.

Answer

Use AWS Organizations APIs with a custom Lambda function that creates member accounts, then manually attach SCPs and configure CloudTrail and Config in each new account.

Answer

Create a golden account AMI and CloudFormation template that teams launch through the AWS Service Catalog, copying the configuration into each new account they create.

Answer

Enable AWS Config aggregators and AWS Firewall Manager across the management account so that any newly created account inherits the required baseline automatically.

Question 35

A large enterprise deployed AWS Control Tower to establish its multi-account landing zone. A platform engineering team, wanting to add a custom deny policy, manually attached a new Service Control Policy directly to a Control Tower-managed Organizational Unit using the AWS Organizations console. Weeks later, the Control Tower dashboard reports the OU and its accounts as 'Not compliant' / drifted, and the team is concerned that a future landing zone update could break their custom guardrail. What is the recommended approach to maintain the custom SCP while keeping Control Tower governance intact?

Accepted Answer

Detach the manually created SCP and re-implement the control as a Control Tower custom guardrail using Customizations for Control Tower (CfCT) or by managing it through Control Tower-supported mechanisms, then re-register the OU to clear drift.

Answer

Leave the SCP attached directly in AWS Organizations and disable Control Tower drift detection so the dashboard stops reporting the OU as non-compliant.

Answer

Remove the OU from Control Tower governance entirely and manage all its accounts manually through AWS Organizations to avoid conflicts with the landing zone.

Answer

Move all accounts out of the drifted OU into the Root so the SCP applies organization-wide and Control Tower no longer manages those accounts.

Question 36

A company runs a data analytics platform in a dedicated 'analytics' account in the us-east-1 Region. A newly acquired subsidiary operates a customer-facing application in a separate 'subsidiary' account in the eu-west-1 Region. Both accounts belong to the same AWS Organization. The analytics team needs the subsidiary application to send periodic batch uploads (a few gigabytes daily) to an internal service running behind an internal Network Load Balancer in the analytics VPC. Both VPCs use overlapping CIDR ranges (10.0.0.0/16). The solution must be private (no traffic over the public internet), minimize ongoing operational overhead, and avoid re-addressing either VPC. Which approach best meets these requirements?

Accepted Answer

Create a VPC endpoint service (AWS PrivateLink) fronting the NLB in the analytics account and create an interface VPC endpoint in the subsidiary VPC that connects to it across accounts and Regions.

Answer

Establish an inter-Region VPC peering connection between the two VPCs and add routes so the subsidiary can reach the NLB directly.

Answer

Attach both VPCs to a Transit Gateway shared via AWS RAM and configure inter-Region Transit Gateway peering to route traffic between them.

Answer

Re-address one of the VPCs to a non-overlapping CIDR, then use VPC peering with static routes to connect the two VPCs privately.

Question 37

A company runs a centralized fraud-detection microservice in a shared-services AWS account. Dozens of application accounts across multiple VPCs (some with overlapping CIDR ranges) need to consume this service over private connectivity. The security team requires that only the specific service be reachable — not the entire shared-services VPC — and that consumers cannot initiate connections back into the provider VPC. Which approach best meets these requirements with the least ongoing operational overhead?

Accepted Answer

Publish the fraud-detection service behind a Network Load Balancer as an AWS PrivateLink endpoint service, and have each consumer account create interface VPC endpoints to it.

Answer

Attach all VPCs to a Transit Gateway and use route tables to expose only the subnet hosting the fraud-detection service to consumer accounts.

Answer

Create VPC peering connections between the shared-services VPC and each application VPC, then restrict traffic to the service using security groups.

Answer

Deploy the fraud-detection service behind an internet-facing Application Load Balancer and restrict access using IP allow-lists and WAF rules per consumer account.

Question 38

A company runs a centralized CI/CD pipeline in a dedicated Tools account within its AWS Organization. The pipeline must deploy CloudFormation stacks into more than 50 workload accounts spread across multiple OUs. Security requires that the pipeline never use long-lived credentials, that each workload account explicitly control which principal can deploy, and that the solution scale as new accounts are added by the Account Factory without manual credential distribution. Which approach best meets these requirements?

Accepted Answer

Deploy a standardized cross-account IAM role in every workload account via a CloudFormation StackSet with a trust policy allowing the Tools account pipeline role to assume it via sts:AssumeRole.

Answer

Create an IAM user with programmatic access keys in each workload account and store the keys in AWS Secrets Manager in the Tools account for the pipeline to retrieve at deploy time.

Answer

Use IAM Identity Center permission sets assigned to the pipeline execution role so it can federate into each workload account for deployments.

Answer

Enable AWS Resource Access Manager to share the Tools account pipeline role with all workload accounts so they can invoke deployments locally.

Question 39

A media company runs 12 AWS accounts, each with its own VPC in us-east-1. Currently every VPC is connected to every other VPC using VPC peering, creating a full-mesh topology that has become difficult to manage as new accounts are added. The networking team wants to reduce operational overhead, enable centralized route management, and allow new accounts to connect to all existing VPCs without creating dozens of new individual connections. The solution must keep all traffic on the AWS backbone and support transitive routing between VPCs. Which approach best meets these requirements?

Accepted Answer

Deploy a Transit Gateway in a central networking account, share it with the organization using AWS Resource Access Manager (RAM), and attach each VPC to the Transit Gateway.

Answer

Continue using VPC peering but consolidate the peering connections into a single hub VPC that all other VPCs peer with, relying on the hub for transitive routing.

Answer

Create AWS PrivateLink endpoint services in each account and connect them so that every VPC can reach every other VPC's resources.

Answer

Establish a Site-to-Site VPN between each pair of accounts through a customer gateway to centralize connectivity.

Question 40

A company operates a centralized networking account within AWS Organizations. The network team owns and manages a large VPC with carefully allocated subnets, NAT gateways, and route tables. Multiple application teams, each in their own AWS account, need to launch EC2 instances and RDS databases directly into these existing subnets so the network team can retain full control over IP addressing, routing, and network appliances. The solution must avoid duplicate networking infrastructure per account and must not require the application accounts to manage their own subnets or route tables. Which approach best meets these requirements?

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the VPC subnets from the networking account with the participant application accounts, allowing them to launch resources into the shared subnets.

Answer

Establish VPC peering connections between each application account's VPC and the networking account's VPC, and propagate routes so applications can reach shared resources.

Answer

Create a Transit Gateway in the networking account, share it via RAM, and attach each application account's own VPC so traffic flows through a central hub.

Answer

Use AWS PrivateLink to expose the networking account's subnets as endpoint services that application accounts consume through interface endpoints.

Question 41

A logistics company is migrating a 90 TB on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The company's WAN link to AWS is a 500 Mbps connection that is also used for production traffic during business hours, leaving only about 200 Mbps of usable bandwidth for migration. Business rules require the application to remain read-write until a hard 6-hour cutover window on a weekend, during which only minimal downtime is acceptable. The solutions architect must move the bulk data and then apply ongoing changes so the cutover fits within the window. Which approach best meets these requirements?

Accepted Answer

Export the full database to an AWS Snowball Edge device, ship it to AWS to load the bulk data into RDS, and configure an AWS DMS change data capture (CDC) task from the source to keep the target synchronized until the cutover window.

Answer

Run a single AWS DMS full-load task over the existing WAN link, scheduling it to complete before the weekend cutover window and cutting over once the full load finishes.

Answer

Use AWS DataSync to copy the PostgreSQL data files to Amazon S3 over the WAN link, then restore the files directly into the RDS instance during the cutover window.

Answer

Take a native pg_dump during the 6-hour cutover window, transfer the dump file over the WAN link, and restore it into RDS before reopening the application for writes.

Question 42

A media company runs an on-premises NFS file share (approximately 40 TB) that feeds a legacy video-rendering pipeline. The company is migrating the rendering workload to EC2 and EFS in AWS over a 6-week transition window. During the transition, files continue to be created and modified on-premises, and the team needs those changes reflected in EFS on a recurring nightly basis until final cutover. The on-premises site has a 1 Gbps Direct Connect link with spare capacity at night. Which approach minimizes operational effort while keeping the AWS copy incrementally up to date?

Accepted Answer

Deploy an AWS DataSync agent on-premises, create a task from the NFS location to the EFS location, and schedule it to run nightly so only changed data is transferred each run.

Answer

Order an AWS Snowball Edge device, copy the 40 TB once, ship it to AWS, and load it into EFS; repeat the Snowball order weekly to capture incremental changes.

Answer

Write a cron job on the NFS server that uses the AWS CLI to sync files to an S3 bucket, then run a Lambda function to copy objects from S3 into EFS each night.

Answer

Use AWS Database Migration Service (DMS) with change data capture to continuously replicate the file share into EFS until the final cutover.

Question 43

A financial services company is migrating a suite of on-premises applications to AWS. One legacy component stores 40 TB of relational data in an IBM Db2 for z/OS database on a mainframe. The company wants to migrate this data into Amazon Aurora PostgreSQL with the least amount of custom coding for both schema conversion and ongoing replication, while keeping the source database available until cutover. Which approach best meets these requirements?

Accepted Answer

Use the AWS Schema Conversion Tool (SCT) to convert the Db2 schema and code objects to PostgreSQL, then use AWS DMS with a full load plus change data capture (CDC) task to migrate and continuously replicate the data until cutover.

Answer

Use AWS DataSync to transfer the Db2 data files directly to Amazon S3, then use AWS Glue crawlers to load the data into Aurora PostgreSQL.

Answer

Export the Db2 tables to CSV, ship them to AWS using a Snowball Edge device, and write custom Lambda functions to transform the schema and import records into Aurora PostgreSQL.

Answer

Use AWS DMS alone with a full load plus CDC task, relying on DMS to automatically convert all stored procedures, triggers, and schema objects during the migration.

Question 44

A financial services company runs a multi-account AWS Organization with over 80 member accounts. The central security team currently operates entirely from the management (payer) account, where they manage GuardDuty, Security Hub, and IAM Access Analyzer findings for the whole organization. During an audit, the company is told that using the management account for daily operational tasks violates AWS security best practices and increases blast radius. The security team must retain organization-wide visibility and continue enrolling new accounts automatically, while minimizing the privileged actions performed from the management account. What should the solutions architect recommend?

Accepted Answer

Register a dedicated security member account as the delegated administrator for GuardDuty, Security Hub, and IAM Access Analyzer, and have the security team operate those services from that account.

Answer

Create a cross-account IAM role in every member account that the security team assumes from the management account to review findings individually.

Answer

Apply an SCP that denies all actions in the management account except security service APIs, so the team can keep working there safely.

Answer

Move GuardDuty, Security Hub, and IAM Access Analyzer configuration into AWS Control Tower and manage findings through the Control Tower dashboard in the management account.

Question 45

A retail company is migrating a 4 TB self-managed MySQL database running on-premises to Amazon RDS for MySQL. The business requires near-zero downtime during cutover and needs assurance that all rows migrated correctly before the application is repointed. The initial full load has already completed successfully. Which approach best satisfies both the low-downtime and data-integrity requirements?

Accepted Answer

Enable AWS DMS change data capture (CDC) to continuously replicate ongoing changes after the full load, run DMS data validation to compare source and target rows, and cut over during a brief maintenance window once the replication lag is near zero.

Answer

Take a final mysqldump export from the source after stopping writes, restore it to RDS, and manually spot-check a sample of tables before repointing the application.

Answer

Use AWS DataSync to synchronize the underlying MySQL data directory files to the RDS instance and enable checksum verification to confirm integrity.

Answer

Create a read replica of the on-premises database in RDS using native MySQL binlog replication only, then promote it without additional validation to minimize downtime.

Question 46

A company is migrating a 12 TB on-premises PostgreSQL database to Amazon Aurora PostgreSQL using AWS DMS. The source contains several very large tables with columns storing multi-megabyte binary documents (BYTEA / LOB data). The initial full-load task is running extremely slowly and occasionally fails, and the team observes that the LOB-heavy tables are the primary bottleneck. Downtime must be minimized, and the migration must complete reliably. Which approach BEST improves full-load performance and reliability for this workload?

Accepted Answer

Enable DMS limited LOB mode with an appropriately sized max LOB size, split the migration into multiple parallel task threads per table using table-level parallel-load settings, and separate the largest LOB tables into their own DMS tasks.

Answer

Switch the DMS task to full LOB mode with an unlimited LOB size and increase the replication instance to the largest available size to guarantee all LOB data transfers in a single pass.

Answer

Disable LOB migration entirely on the DMS task and use AWS DataSync to copy the binary documents separately after the relational data completes.

Answer

Use AWS Snowball Edge to export the entire database as flat files, then bulk-load into Aurora using pg_restore, bypassing DMS for the LOB tables.

Question 47

A retail company runs a self-managed MySQL 8.0 database on-premises that powers an order-processing application. The analytics team needs a copy of the order tables in Amazon S3, stored in Apache Parquet format, so they can run Amazon Athena queries. The requirement is that S3 must reflect both the existing historical data and any changes made in MySQL going forward, with a delay of no more than a few minutes. The source database must remain online for production use throughout, and the solution should minimize custom code and ongoing operational effort. Which approach best meets these requirements?

Accepted Answer

Use AWS DMS with a full load plus ongoing replication (CDC) task, an S3 target endpoint configured to output Parquet, and enable MySQL binary logging on the source.

Answer

Use AWS DataSync to copy the MySQL data directory to S3 on a scheduled task, then convert the files to Parquet with an AWS Glue job.

Answer

Use AWS DMS with a full-load-only task to S3 in Parquet format, and re-run the task nightly to capture new changes.

Answer

Export mysqldump files to an S3 bucket via a cron job, then trigger an AWS Lambda function to convert each dump to Parquet.

Question 48

A retail company is planning to migrate a 12 TB on-premises PostgreSQL 11 database to Amazon RDS for PostgreSQL. The migration team has a strict requirement that the production database experience no more than 15 minutes of downtime during cutover. The database has a sustained write rate of roughly 200 transactions per second, and a dedicated 1 Gbps AWS Direct Connect link is available. The team wants to validate that the target data matches the source before cutover. Which approach best meets these requirements?

Accepted Answer

Use AWS DMS with a full-load-plus-CDC task to perform the initial bulk load and continuously replicate ongoing changes, enable DMS data validation, then cut over during a short window once the target is in sync.

Answer

Take a native pg_dump of the source, transfer the dump file over Direct Connect, restore it with pg_restore into RDS, and schedule the migration during a maintenance window when writes are paused.

Answer

Use AWS DataSync to copy the database data files to Amazon S3, then load them into RDS for PostgreSQL using the aws_s3 extension after stopping the application.

Answer

Create an RDS read replica of the on-premises database over Direct Connect, allow it to catch up, then promote it to a standalone instance during cutover.

Question 49

A retail company is planning to migrate a 4 TB on-premises Microsoft SQL Server database to Amazon Aurora PostgreSQL. Before committing to the project timeline, the migration team needs a detailed report that quantifies how many database objects (stored procedures, triggers, functions, and views) can be converted automatically versus those requiring manual rework. Which approach provides this analysis with the LEAST effort before any data is moved?

Accepted Answer

Run the AWS Schema Conversion Tool (SCT) or DMS Schema Conversion to generate a database migration assessment report that categorizes objects by conversion complexity.

Answer

Start an AWS DMS full-load-and-CDC task and review the CloudWatch task metrics to identify objects that fail to replicate.

Answer

Use AWS Application Discovery Service agents on the database server to collect object-level conversion estimates.

Answer

Export the SQL Server schema with native tools and manually compare each object against PostgreSQL syntax documentation.

Question 50

A media company is migrating a 400 GB PostgreSQL database from an on-premises data center to Amazon Aurora PostgreSQL. The migration involves an initial full load followed by an ongoing change data capture (CDC) phase to keep the target in sync until cutover. The source database has highly variable write activity: near-zero changes overnight and heavy bursts during business hours. The team wants to minimize operational overhead and pay only for the replication capacity actually consumed, without manually sizing or scaling replication instances. Which approach best meets these requirements?

Accepted Answer

Use AWS DMS Serverless, which automatically provisions and scales replication capacity (in DCUs) based on workload and charges only for capacity used.

Answer

Provision a large AWS DMS replication instance sized for peak load and leave it running for the entire migration window to avoid CDC lag.

Answer

Use AWS DataSync to perform the full load and CDC replication, scheduling incremental tasks hourly to capture ongoing changes.

Answer

Deploy a fleet of small DMS replication instances behind an Auto Scaling group so capacity scales in and out with the source write volume.

Question 51

A retail company runs a 4 TB Microsoft SQL Server transactional database on-premises. The analytics team wants a continuously updated copy of the transactional data landed in Amazon S3 in Parquet format for querying with Amazon Athena, without impacting the production OLTP workload. The initial full load plus ongoing changes (roughly 5,000 transactions per minute) must be replicated with minimal transformation effort and no changes to the source schema. Which approach best meets these requirements?

Accepted Answer

Use AWS DMS with S3 as the target endpoint, configured for full load plus change data capture (CDC), and set the target to write Parquet files.

Answer

Use AWS DataSync to copy the SQL Server data files to S3 on a nightly schedule, then convert them to Parquet with an AWS Glue job.

Answer

Enable SQL Server transactional replication to an Amazon RDS for SQL Server instance, then export snapshots to S3 as CSV.

Answer

Use AWS Snowball Edge to perform the initial 4 TB transfer, then run periodic mysqldump exports uploaded to S3 with a Lambda function.

Question 52

A retail company completed a heterogeneous migration of a 4 TB Oracle database to Amazon Aurora PostgreSQL using AWS DMS with continuous CDC replication. Before the final application cutover, the compliance team requires documented proof that every row in the source and target is identical, without pausing the ongoing CDC replication or introducing significant additional load on the source database. The team wants a repeatable, AWS-native approach to detect row-level and data-type mismatches. Which approach best meets these requirements?

Accepted Answer

Enable DMS data validation on the existing migration task so DMS compares source and target rows and reports mismatches in the validation statistics tables.

Answer

Write custom SQL scripts that compute MD5 checksums of each table on both databases and run them nightly from a scheduled Lambda function.

Answer

Stop the CDC task, take an Aurora snapshot, restore it to a separate cluster, and manually spot-check a sample of tables against the source.

Answer

Use AWS Glue to crawl both databases and run a Glue ETL job that joins the datasets to identify differences.

Question 53

A payments company is building a new order-settlement platform. Each account's transactions must be processed in strict chronological order, and duplicate transaction submissions from retrying upstream systems must not be double-processed. Throughput is expected to reach roughly 2,000 transactions per second at peak, spread across hundreds of thousands of distinct account IDs. Multiple independent downstream services (fraud scoring, ledger update, notification) must each receive every transaction. Which architecture best meets ordering, deduplication, and fan-out requirements while scaling elastically?

Accepted Answer

Publish transactions to an SNS FIFO topic using the account ID as the message group ID and the transaction ID as the deduplication ID, fanning out to an SQS FIFO queue per downstream service.

Answer

Publish transactions to a standard SNS topic fanning out to standard SQS queues, and have each consumer sort messages by timestamp and check a DynamoDB table for previously seen transaction IDs.

Answer

Write transactions to a single Kinesis Data Stream with one shard and have each downstream service run its own consumer application reading from the beginning of the stream.

Answer

Send transactions to a single SQS FIFO queue shared by all three downstream services, using the account ID as the message group ID and enabling content-based deduplication.

Question 54

A gaming company is launching a new mobile leaderboard service expected to reach 50 million users across North America, Europe, and Asia. Player scores must be readable with single-digit millisecond latency from any region, and score writes made in one region should become visible in other regions within a couple of seconds. The workload is highly spiky, with traffic surging 20x during tournaments. The team wants a fully managed solution that minimizes operational overhead and scales automatically without pre-provisioning capacity for peak. Which design best meets these requirements?

Accepted Answer

Deploy Amazon DynamoDB global tables in the three regions using on-demand capacity mode, with a DynamoDB Accelerator (DAX) cluster fronting reads in each region.

Answer

Deploy Amazon Aurora MySQL with a global database spanning the three regions and use Aurora Auto Scaling to add read replicas during tournaments.

Answer

Run a self-managed Redis cluster on EC2 in each region with cross-region replication and place it behind an Application Load Balancer.

Answer

Deploy Amazon DynamoDB in a single region with provisioned capacity sized for peak, and use Amazon CloudFront with regional edge caches to serve reads globally.

Question 55

A company runs a production DynamoDB table backing an internal reporting application. Usage is highly predictable during business hours (9 AM to 6 PM, Monday to Friday) with steady, well-understood read and write rates, and near-zero traffic outside those windows. The table is currently configured with on-demand capacity mode, and the finance team reports that DynamoDB costs are significantly higher than expected. The solutions architect must reduce cost while maintaining performance during business hours and avoiding throttling. Which approach best meets these requirements?

Accepted Answer

Switch the table to provisioned capacity mode and configure application auto scaling with scheduled scaling actions to raise capacity before business hours and lower it afterward.

Answer

Keep on-demand mode but enable DynamoDB Accelerator (DAX) to cache reads and reduce the number of billed read request units.

Answer

Switch to provisioned capacity mode with target-tracking auto scaling only, leaving capacity to react automatically to observed traffic.

Answer

Migrate the table data to Amazon S3 during off-hours and reload it into a new DynamoDB table each morning to avoid paying for idle capacity.

Question 56

A SaaS company runs an event-tracking platform on a DynamoDB table that stores hundreds of millions of records. Only the most recent 30 days of data is queried by the live application, but compliance requires that all records be retained for 7 years for occasional audit queries. The table has grown to over 4 TB and storage costs are rising sharply. Audit queries are infrequent, run offline, and can tolerate multi-second latency. The team wants to reduce ongoing DynamoDB storage costs while preserving queryability of historical data. What is the MOST cost-effective approach?

Accepted Answer

Enable DynamoDB Time to Live (TTL) on the table with a 30-day expiry and use DynamoDB Streams with a Lambda function to write expiring items to Amazon S3 in Parquet, then query the archive with Amazon Athena.

Answer

Switch the table to the DynamoDB Standard-Infrequent Access table class and keep all 7 years of data in the table so audit queries continue to use the DynamoDB API.

Answer

Enable DynamoDB TTL with a 30-day expiry and rely on the deleted items being automatically archived to S3 Glacier by DynamoDB for later retrieval.

Answer

Create an AWS Glue job that periodically scans the entire table each night, copies all records to S3, and deletes records older than 30 days from DynamoDB.

Question 57

A company runs a stable fleet of 200 EC2 instances across production and staging for a monolithic Java application. The workload has been running unchanged for over a year with predictable steady-state utilization. A FinOps review found average CPU utilization is 12% and memory utilization is 30%, and all instances are billed at On-Demand rates. The Solutions Architect must reduce compute cost with minimal application refactoring while preserving the ability to change instance families over time. Which combination of actions provides the greatest sustained cost reduction with the least operational risk?

Accepted Answer

Use AWS Compute Optimizer recommendations to rightsize instances to smaller types, then purchase Compute Savings Plans to cover the reduced steady-state usage.

Answer

Migrate all instances to Spot Instances managed by an Auto Scaling group with mixed instance policies to maximize discounts.

Answer

Purchase Standard Reserved Instances for the current instance types at the current fleet size to lock in the largest discount immediately.

Answer

Enable EC2 Auto Scaling with target tracking on CPU and rely on On-Demand pricing to scale down idle capacity.

Question 58

A company runs a containerized order-management API on Amazon ECS with AWS Fargate behind an Application Load Balancer. Deployments are performed by pushing new task definitions manually, and roughly 15% of releases cause elevated 5xx errors that are only noticed hours later when customers complain. The operations team wants to improve the deployment process so that faulty releases are automatically detected using application health signals and traffic is reverted without manual intervention, while keeping infrastructure changes version-controlled. Which approach best meets these requirements?

Accepted Answer

Migrate the deployment to AWS CodeDeploy with an ECS blue/green deployment configuration, associate CloudWatch alarms on ALB 5xx and target group health metrics as deployment stop conditions, and manage the pipeline with CodePipeline sourced from the version-controlled task definition.

Answer

Enable ECS rolling updates with a minimum healthy percent of 100 and maximum percent of 200 so that new tasks replace old ones gradually, and rely on ECS service health checks to stop the deployment.

Answer

Configure an Amazon EventBridge rule that triggers a Lambda function whenever CloudWatch detects elevated 5xx errors, and have the Lambda function redeploy the previous task definition.

Answer

Add a CloudWatch composite alarm on 5xx errors that publishes to an SNS topic subscribed by the operations team, and document a manual runbook for reverting to the previous task definition.

Question 59

A company operates a public REST API used by mobile clients worldwide. The API is served by an Application Load Balancer in front of Amazon ECS tasks in the us-east-1 Region. Approximately 80% of the requests are idempotent GET calls that return catalog data changing only a few times per day, while the remaining 20% are writes. International users report high and inconsistent latency, and the ECS fleet scales aggressively during peak hours to serve repetitive read traffic. The architecture team wants to reduce global read latency and offload repetitive reads from the origin while keeping the write path unchanged, with minimal application code changes. Which approach best meets these requirements?

Accepted Answer

Deploy Amazon CloudFront in front of the ALB, cache GET responses at edge locations using cache behaviors keyed on the catalog paths with an appropriate TTL, and forward non-cacheable methods to the origin.

Answer

Replicate the ECS service and ALB into multiple Regions and use Route 53 latency-based routing to direct all API traffic to the nearest Region.

Answer

Place an Amazon ElastiCache for Redis cluster in front of the ECS tasks and modify the application to check the cache before querying the catalog datastore.

Answer

Enable AWS Global Accelerator in front of the ALB to route users over the AWS backbone to the us-east-1 origin.

Question 60

A software company is launching a new multi-tenant SaaS analytics platform. Each tenant generates unpredictable, spiky query loads, and the number of tenants is expected to grow from dozens to thousands over 18 months. Tenants require strong data isolation for compliance, and the platform must scale storage and compute independently while minimizing idle capacity costs during off-peak hours. The team wants a relational data store that supports SQL analytics with automatic scaling and near-zero administrative overhead. Which design best meets these requirements?

Accepted Answer

Use Amazon Aurora Serverless v2 with PostgreSQL compatibility, isolating tenants across separate databases/schemas, so compute (ACUs) scales automatically with load while storage grows independently and idle capacity shrinks.

Answer

Provision a single large Amazon RDS for PostgreSQL Multi-AZ instance and use PostgreSQL schemas to separate each tenant, scaling the instance class up as tenant count grows.

Answer

Deploy a fixed fleet of Amazon EC2 instances running PostgreSQL behind a Network Load Balancer, and add read replicas manually as tenant demand increases.

Answer

Store all tenant data in Amazon DynamoDB with a tenant-ID partition key and run analytics queries using PartiQL, relying on on-demand capacity mode for elasticity.

Question 61

A media company is building a new product catalog API for a global streaming service. The backend uses Amazon Aurora PostgreSQL, and product metadata is read extremely frequently but updated only when editors publish changes (roughly a few hundred times per day). The team adds an Amazon ElastiCache for Redis cluster to reduce database load. They require that reads served from the cache always reflect the most recent published metadata immediately after an editor saves a change, while minimizing unnecessary cache writes for products that are rarely read. Which caching strategy best meets these requirements?

Accepted Answer

Use a write-through strategy that updates the cache synchronously on every publish, combined with lazy loading on read misses and a TTL to bound staleness.

Answer

Use lazy loading (cache-aside) alone, populating the cache only on read misses and relying on a long TTL to eventually refresh entries.

Answer

Use write-through caching only, writing every product to the cache on publish and disabling TTL so entries never expire.

Answer

Disable ElastiCache and instead enable Aurora read replicas with a reader endpoint to absorb all catalog read traffic.

Question 62

A retail company runs a self-managed Elasticsearch cluster on EC2 that indexes product catalog data. They are migrating to Amazon OpenSearch Service. The catalog is updated continuously by an application that writes to a relational database, and downstream search queries must never return stale results for more than a few minutes during the migration. The migration team wants the lowest-risk cutover with the ability to roll back if the new domain underperforms. Which approach best meets these requirements?

Accepted Answer

Configure the application's indexing pipeline to dual-write to both the self-managed cluster and the OpenSearch domain, backfill historical data via snapshot restore, validate query parity, and cut clients over gradually while keeping the old cluster available for rollback.

Answer

Take a snapshot of the self-managed cluster to Amazon S3, restore it into the OpenSearch domain, then immediately repoint all clients to the new domain and delete the old cluster.

Answer

Use AWS DMS to replicate the Elasticsearch indices directly into the OpenSearch domain with change data capture enabled, then switch clients once replication lag reaches zero.

Answer

Export the indices to CSV, load them into Amazon S3, use AWS Glue to transform the data, and bulk-load into OpenSearch before repointing clients.

Question 63

A retail company runs a monolithic Java order-management application on 40 on-premises VMs. Leadership wants to reduce total cost of ownership over the next 3 years and improve deployment agility, but only has a small team with limited AWS experience and a hard 6-month deadline to exit the data center. The application has tightly coupled modules and a large Oracle database. Which migration approach best balances the deadline, team capacity, and long-term modernization goals?

Accepted Answer

Rehost all VMs with AWS MGN now to meet the deadline, then incrementally refactor the monolith into microservices and replatform the database after the data center exit is complete.

Answer

Refactor the entire monolith into containerized microservices on Amazon ECS and migrate the Oracle database to Aurora PostgreSQL before the data center exit.

Answer

Repurchase by replacing the custom order-management application with a SaaS product and retire the existing codebase within the 6-month window.

Answer

Retain the application on-premises and use AWS Direct Connect to burst compute to AWS until the team gains enough experience to refactor.

Question 64

A media company stores original video assets in an S3 bucket in us-east-1, encrypted with a customer managed AWS KMS key. For disaster recovery, they must replicate all objects to a bucket in eu-west-1, and the replicated objects must remain encrypted at rest in the destination region. A compliance requirement states that KMS key material must never leave the region in which it was created. The solution must minimize operational overhead and avoid decryption failures in the destination region. Which approach meets these requirements?

Accepted Answer

Configure S3 Cross-Region Replication and specify a separate customer managed KMS key created in eu-west-1 for the destination objects, granting the replication IAM role permission to decrypt with the source key and encrypt with the destination key.

Answer

Configure S3 Cross-Region Replication using the same us-east-1 customer managed KMS key for both source and destination buckets, enabling multi-Region replication of key material.

Answer

Disable encryption on the source bucket, replicate the plaintext objects with Cross-Region Replication, then apply an S3 bucket policy in eu-west-1 that enforces default encryption with a local KMS key.

Answer

Use an AWS Lambda function triggered by S3 events to download each object, re-encrypt it with a eu-west-1 KMS key, and upload it to the destination bucket.

Exam domain	Exam weight	Practice
Design Solutions for Organizational Complexity	26%	Practice this topic
Design for New Solutions	29%	Practice this topic
Continuous Improvement for Existing Solutions	25%	Practice this topic
Accelerate Workload Migration and Modernization	20%	Practice this topic

AWS Certified Solutions Architect - Professional (SAP-C02) practice exam & study guide

Start studying SAP-C02

All SAP-C02 study resources

SAP-C02 exam domains

Sample SAP-C02 questions

Key SAP-C02 terms

SAP-C02 frequently asked questions

Design Solutions for Organizational Complexity (26%)

Design for New Solutions (29%)

Continuous Improvement for Existing Solutions (25%)

Accelerate Workload Migration and Modernization (20%)