A solutions architect is designing an asynchronous application to process credit card data validation requests for a bank. The application must be secure and be able to process each request at least once.Which solution will meet these requirements MOST cost-effectively?
Answer(s): A
Lambda with SQS standard queue and SSE-KMS provides cost-effective at-least-once processing and secure encryption; standard queues support at-least-once delivery, while KMS ensures encryption in transit at rest with proper permissions (kms:Decrypt) for Lambda. A) correctly combines standard SQS, SSE-KMS, and necessary decrypt permission for the Lambda role, ensuring at-least-once processing and security with low cost.B) FIFO queues guarantee exactly-once processing but at higher cost and may reduce throughput, not as cost-effective for this use case.C) FIFO + SSE-KMS without correct permission model may risk limited access; also FIFO costlier.D) Standard queues with SSE-KMS but uses incorrect permission type (encryption key invocation) and unclear permission scope.
A company has multiple AWS accounts for development work. Some staff consistently use oversized Amazon EC2 instances, which causes the company to exceed the yearly budget for the development accounts. The company wants to centrally restrict the creation of AWS resources in these accounts.Which solution will meet these requirements with the LEAST development effort?
Answer(s): B
A concise justification:B) Using AWS Organizations with SCPs to restrict EC2 instance types across accounts provides centralized, scalable policy enforcement with minimal per-account effort.A) Systems Manager templates require custom CI/CD or runbooks per team; adds development overhead and maintenance.C) EventBridge/Lambda stop-trigger approach is reactive and incurs latency; does not prevent creation or enforce policy consistently.D) Service Catalog controls launch options but requires catalog setup for each allowed type and ongoing governance; higher initial effort than SCP-based guardrails.
A company wants to use artificial intelligence (AI) to determine the quality of its customer service calls. The company currently manages calls in four different languages, including English. The company will offer new languages in the future. The company does not have the resources to regularly maintain machine learning (ML) models.The company needs to create written sentiment analysis reports from the customer service call recordings. The customer service call recording text must be translated into English.Which combination of steps will meet these requirements? (Choose three.)
Answer(s): D,E,F
The correct choice combines scalable, language-agnostic transcription, translation to English, and sentiment analysis without ongoing model maintenance: D) Amazon Transcribe converts audio from any language to text, E) Amazon Translate translates non-English text to English, and F) Amazon Comprehend performs sentiment analysis on English text. A is incorrect because Transcribe, not Translate, handles transcription; Comprehend can do sentiment, but translation is needed after transcription, not translation of audio directly. B is incorrect because Lex is a conversational AI service, not required for sentiment reporting. C is incorrect because Polly is a text-to-speech service, not for transcription.
A company uses Amazon EC2 instances to host its internal systems. As part of a deployment operation, an administrator tries to use the AWS CLI to terminate an EC2 instance. However, the administrator receives a 403 (Access Denied) error message.The administrator is using an IAM role that has the following IAM policy attached:What is the cause of the unsuccessful request?
Answer(s): D
Terminating an EC2 instance requires explicit permission for the action from the IAM policy, and the given scenario indicates an IP-origin restriction is the cause; the policy likely includes a condition restricting source IPs, so requests from other CIDRs are denied (403). The correct answer D is right because the policy enforces source IP conditions not met by the request.A is incorrect because Deny in a resource policy would be explicit, but the error shown is due to IP-based condition rather than a Deny statement on the resource.B is incorrect because a missing principal would generally cause an authorization failure at the assume-role level, not an IP-based 403 during API call.C is incorrect because the actions required to terminate an EC2 instance (TerminateInstances) would be covered by the Action field; the issue is the source IP condition, not missing actions.
A company is conducting an internal audit. The company wants to ensure that the data in an Amazon S3 bucket that is associated with the company’s AWS Lake Formation data lake does not contain sensitive customer or employee data. The company wants to discover personally identifiable information (PII) or financial information, including passport numbers and credit card numbers.Which solution will meet these requirements?
Answer(s): C
Amazon Macie can perform data discovery using built-in and managed identifiers to detect PII and sensitive data (PCI, financial data, passport numbers) across S3, making it suitable for audit-focused data protection in a Lake Formation data lake.A) Audit Manager audits compliance frameworks; it does not natively perform data content discovery for PII/financial data across S3.B) S3 Inventory and Athena enable listing and querying objects but do not provide automated sensitive-data discovery or classification.D) S3 Select runs queries on objects and does not offer broad, policy-driven data discovery or managed PII classifiers.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.