A company moved its on-premises PostgreSQL database to an Amazon RDS for PostgreSQL DB instance. The company successfully launched a new product. The workload on the database has increased. The company wants to accommodate the larger workload without adding infrastructure.Which solution will meet these requirements MOST cost-effectively?
Answer(s): A
Reserved instances for the total workload provide cost savings for predictable, sustained DB usage and allow right-sizing a single RDS instance to handle the increased load without provisioning additional capacity, making it most cost-effective. A) Reserved DB instances optimize both compute and storage costs for long-term use and upgrading the instance size within the same DB instance preserves cost advantages. B) Multi-AZ adds high availability and failover, not capacity or cost efficiency for scaling; it increases cost. C) Adding another instance increases overall cost and complexity, reducing cost efficiency compared with resizing a single reserved instance. D) On-demand pricing is the most expensive for steady workloads.
A company operates an ecommerce website on Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The site is experiencing performance issues related to a high request rate from illegitimate external systems with changing IP addresses. The security team is worried about potential DDoS attacks against the website. The company must block the illegitimate incoming requests in a way that has a minimal impact on legitimate users.What should a solutions architect recommend?
Answer(s): B
The correct answer is B. AWS WAF attached to the ALB with a rate-limiting rule enables filtering of malicious traffic while allowing legitimate users, and can block requests from abusive IPs without affecting normal traffic. A) Amazon Inspector is for vulnerability assessment of EC2 instances, not real-time traffic filtering. C) Network ACLs operate at the subnet level and are coarse-grained; they’re not stateful and would risk blocking legitimate traffic or require constant updates. D) GuardDuty detects threats but does not provide built-in rate-limiting or granular traffic filtering on ALB traffic.
A company wants to share accounting data with an external auditor. The data is stored in an Amazon RDS DB instance that resides in a private subnet. The auditor has its own AWS account and requires its own copy of the database.What is the MOST secure way for the company to share the database with the auditor?
Answer(s): D
A concise explanation of why D is correct and others are not.D) Creating an encrypted snapshot and sharing the KMS key allows secure, auditable external access to a point-in-time copy of the private database, using client-side or AWS-managed access controls without exposing database credentials or building ongoing connections. The data at rest remains encrypted with a KMS key, and access is governed by IAM/KMS policies.A) Read replica in a private subnet expands access surface and may expose ongoing DB credentials; not ideal for external auditor.B) Export to S3 with IAM user yields data in text format and relies on static credentials; less secure and auditable.C) Sharing AWS credentials or keys is insecure; snapshots should be shared with controlled encryption, not by distributing keys.
A solutions architect configured a VPC that has a small range of IP addresses. The number of Amazon EC2 instances that are in the VPC is increasing, and there is an insufficient number of IP addresses for future workloads.Which solution resolves this issue with the LEAST operational overhead?
Adding an additional IPv4 CIDR block to the existing VPC directly increases available IP addresses and subnet capacity with minimal operational overhead, allowing seamless resource placement in new subnets without complex networking changes.A) Correct. Expands IP space within the same VPC; low overhead, scalable.B) Requires managing a second VPC, VPC peering, and route updates; increases management overhead and has limitations like transitive routing.C) Transit Gateway adds cost and complexity; still requires multi-VPC peering patterns and routing updates.D) Site-to-Site VPN between VPCs introduces VPN hardware, maintenance, and higher latency; not optimal for internal AWS-only resources.
A company used an Amazon RDS for MySQL DB instance during application testing. Before terminating the DB instance at the end of the test cycle, a solutions architect created two backups. The solutions architect created the first backup by using the mysqldump utility to create a database dump. The solutions architect created the second backup by enabling the final DB snapshot option on RDS termination.The company is now planning for a new test cycle and wants to create a new DB instance from the most recent backup. The company has chosen a MySQL-compatible edition ofAmazon Aurora to host the DB instance.Which solutions will create the new DB instance? (Choose two.)
Answer(s): A,C
A) The RDS snapshot can be restored into an Aurora MySQL-compatible DB cluster, allowing a new instance to be created from the snapshot; Aurora can restore from RDS snapshots when migrating between RDS engines of compatible editions.B) Incorrect because RDS snapshots are not imported by uploading to S3; direct snapshot restore is required.C) Correct because a mysqldump-based dump can be stored in S3 and then imported into an Aurora MySQL-compatible instance using appropriate import methods.D) DMS cannot import from an RDS snapshot; DMS migrates data between engines but not from an RDS snapshot directly into Aurora.E) Not needed since the dump-based approach in C suffices; DMS is unnecessary for this path.
Post your Comments and Discuss Amazon AWS-SOLUTION-ARCHITECT-ASSOCIATE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTION-ARCHITECT-ASSOCIATE content, but please register or login to continue.