A retail company has several businesses. The IT team for each business manages its own AWS account. Each team account is part of an organization in AWS Organizations. Each team monitors its product inventory levels in an Amazon DynamoDB table in the team's own AWS account.The company is deploying a central inventory reporting application into a shared AWS account. The application must be able to read items from all the teams' DynamoDB tables.Which authentication option will meet these requirements MOST securely?
Answer(s): C
C) This uses cross-account IAM roles with least-privilege access and STS AssumeRole, enabling the central app to securely assume a role in each business account to read their DynamoDB tables without long-term credentials. It follows IAM roles and cross-account access best practices.A) Secrets Manager integration is not a authentication mechanism for DynamoDB; it would store secrets but does not grant cross-account read access with proper least privilege.B) Creating IAM users per account and rotating keys is less secure and scalable; long-lived access keys are riskier.D) DynamoDB does not support authentication via ACM certificates for access control.
A company runs container applications by using Amazon Elastic Kubernetes Service (Amazon EKS). The company's workload is not consistent throughout the day. The company wants Amazon EKS to scale in and out according to the workload.Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
Answer(s): B,C
The correct combination is B and C because they enable automatic scaling with minimal ops: Metrics Server provides pod metrics for Horizontal Pod Autoscaler, and the Kubernetes Cluster Autoscaler adjusts node count in the cluster based on pending pods and resource requests. A is incorrect because Lambda resizing of EKS clusters is not a standard, scalable, low-ops method and introduces custom scripting dependencies. D is irrelevant to auto-scaling behavior, as API Gateway is for routing API traffic, not cluster/node autoscaling. E is not related to autoscaling decisions; App Mesh focuses on service mesh observability and traffic routing, not scaling.
A company runs a microservice-based serverless web application. The application must be able to retrieve data from multiple Amazon DynamoDB tables A solutions architect needs to give the application the ability to retrieve the data with no impact on the baseline performance of the application.Which solution will meet these requirements in the MOST operationally efficient way?
Answer(s): D
D) Using Amazon Athena Federated Query with a DynamoDB connector allows cross-table queries without impacting the baseline application performance, offloading data retrieval to Athena while keeping compute separate from the main application flow.A) AppSync pipeline resolvers would couple data fetching to GraphQL execution and may impact latency and complexity for multiple tables.B) CloudFront with Lambda@Edge is for CDN edge processing, not efficient cross-table DynamoDB querying exempt from app performance.C) Edge-optimized API Gateway with Lambda still runs in Lambda, risking added latency and management overhead for multi-table data aggregation.
A company wants to analyze and troubleshoot Access Denied errors and Unauthorized errors that are related to IAM permissions. The company has AWS CloudTrail turned on.Which solution will meet these requirements with the LEAST effort?
The correct answer is C) Search CloudTrail logs with Amazon Athena queries to identify the errors.C) Athena directly queries CloudTrail logs stored in S3 using standard SQL, enabling quick identification of Access Denied and Unauthorized events with minimal setup and no ETL. It requires no data movement or custom tooling.A) Glue with custom scripts adds unnecessary ETL and maintenance. B) Batch with scripts increases orchestration and overhead. D) QuickSight dashboards visualize data but do not efficiently identify error events without predefined data preparation; Athena is the leaner, query-first approach for troubleshooting IAM errors.
A company wants to add its existing AWS usage cost to its operation cost dashboard. A solutions architect needs to recommend a solution that will give the company access to its usage cost programmatically. The company must be able to access cost data for the current year and forecast costs for the next 12 months.Which solution will meet these requirements with the LEAST operational overhead?
Answer(s): A
The AWS Cost Explorer API with pagination (A) provides programmatic, up-to-date cost and usage data for the current year and forecasts via the right API endpoints with minimal overhead. It supports automated retrieval without manual file handling, meeting the requirement for programmatic access and forecasting.B is incorrect because downloadable CSV reports require manual or scheduled extraction and processing, increasing operational overhead. C is incorrect because FTP delivery via AWS Budgets actions is not a standard, low-overhead, programmatic API for cost data. D is incorrect because Budgets Reports are not as suitable for ongoing programmatic consumption and forecasting as the Cost Explorer API, and SMTP delivery adds additional integration steps.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.