A company needs to create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to host a digital media streaming application. The EKS cluster will use a managed node group that is backed by Amazon Elastic Block Store (Amazon EBS) volumes for storage. The company must encrypt all data at rest by using a customer managed key that is stored in AWS Key Management Service (AWS KMS).Which combination of actions will meet this requirement with the LEAST operational overhead? (Choose two.)
Answer(s): C,D
Enabling EBS encryption by default with a customer managed key ensures all EBS volumes (including those in managed node groups) are encrypted at rest without per-volume actions, meeting the requirement with minimal operational overhead. Associating an IAM role with the EKS cluster to allow access to the CMK provides the necessary permissions for encryption/decryption by AWS services automatically.A) Incorrect: Kubernetes plugins are not required; this adds overhead and not standard for EBS encryption at rest.B) Incorrect: Encrypting existing volumes is manual and not scalable for new volumes.E) Incorrect: Storing keys as Kubernetes secrets is insecure and not how AWS handles CMK-backed EBS encryption.
A company wants to migrate an Oracle database to AWS. The database consists of a single table that contains millions of geographic information systems (GIS) images that are high resolution and are identified by a geographic code.When a natural disaster occurs, tens of thousands of images get updated every few minutes. Each geographic code has a single image or row that is associated with it. The company wants a solution that is highly available and scalable during such events.Which solution meets these requirements MOST cost-effectively?
Answer(s): B
Store the images in S3 and index them via DynamoDB with the code as the key and the S3 URL as the value. This provides highly available, scalable object storage for large GIS images and a fast, key-value lookup for metadata, with low cost and automatic scaling during mass updates. A) RDS Multi-AZ Oracle is not cost-effective for large binary data and high write throughput during disasters. C) DynamoDB with DAX adds caching but stores data in DynamoDB, not directly the image payload; managing large binary data in DynamoDB is less cost-efficient than S3. D) Combines S3 with a relational table, increasing complexity and cost without added resilience.
A company has an application that collects data from IoT sensors on automobiles. The data is streamed and stored in Amazon S3 through Amazon Kinesis Data Firehose. The data produces trillions of S3 objects each year. Each morning, the company uses the data from the previous 30 days to retrain a suite of machine learning (ML) models.Four times each year, the company uses the data from the previous 12 months to perform analysis and train other ML models. The data must be available with minimal delay for up to 1 year. After 1 year, the data must be retained for archival purposes.Which storage solution meets these requirements MOST cost-effectively?
Answer(s): D
D) Correct because starting in S3 Standard and aging data to cheaper tiers: 30 days access window for frequent retrieval, then Glacier Deep Archive after 1 year, minimizes cost for large, infrequent access after long term. S3 Lifecycle transitions from Standard to Standard-IA at 30 days reduces storage cost while preserving reasonable access, and then to Glacier Deep Archive after 1 year satisfies archival requirement.A) Incorrect: Intelligent-Tiering + 1-year transition does not guarantee the 30-day access peak period before archiving and may incur higher frequent-access monitoring costs for trillions of objects.B) Incorrect: Automatic tiering to Glacier Deep Archive after 1 year skips the required 30-day frequent-access window and can complicate retrieval timing.C) Incorrect: Standard-IA is more expensive for near-term access versus starting in Standard; not optimal for trillions of objects with 30-day access needs.
A company is running several business applications in three separate VPCs within the us-east-1 Region. The applications must be able to communicate between VPCs. The applications also must be able to consistently send hundreds of gigabytes of data each day to a latency-sensitive application that runs in a single on-premises data center.A solutions architect needs to design a network connectivity solution that maximizes cost-effectiveness.Which solution meets these requirements?
AWS Direct Connect with a transit gateway (D) provides a single, cost-efficient, low-latency path from on-premises to multiple VPCs in us-east-1 and enables centralized routing between VPCs via the transit gateway, while leveraging one DX connection for all VPCs.A) Three separate Site-to-Site VPNs increase cost and management overhead; not optimal for large, latency-sensitive, high-volume data transfer.B) Third-party appliances add cost and complexity and may not meet scale/latency requirements compared with DX with a TGW.C) Direct Connect with a gateway per-VPC still requires multiple DX connections; higher cost and underutilization risk versus a single DX connection shared through a TGW.D) Correct: a single DX connection to a TGW centrally connects multiple VPCs and scales for high-throughput, low-latency transfers to on-premises.
An ecommerce company is building a distributed application that involves several serverless functions and AWS services to complete order-processing tasks. These tasks require manual approvals as part of the workflow. A solutions architect needs to design an architecture for the order-processing application. The solution must be able to combine multiple AWS Lambda functions into responsive serverless applications. The solution also must orchestrate data and services that run on Amazon EC2 instances, containers, or on-premises servers.Which solution will meet these requirements with the LEAST operational overhead?
Answer(s): A
AWS Step Functions coordinates multiple Lambda functions and other AWS services into serverless workflows with built-in orchestration, human approval steps, and error handling, minimizing operational overhead. It can orchestrate tasks across Lambda, EC2, containers, and on-premises endpoints via activities and API Gateway, fulfilling the requirement for cross-service orchestration with minimal management.A) Correct. Step Functions provides visual workflows, state management, and task coordination across diverse compute resources with low maintenance.B) Glue is for ETL/data processing, not general workflow orchestration across services or human approvals.C) SQS enables decoupled messaging but does not provide workflow orchestration or end-to-end process state management.D) EventBridge handles event routing but lacks built-in complex workflow orchestration and human-in-the-loop approvals.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.