Question 380
A regulated application emits 80 TB of low-urgency diagnostic logs each year. Only an occasional forensic investigation queries the logs, and the workload does not use metric filters, subscriptions or other features unavailable in the cheaper CloudWatch Logs class. The next version can create fresh log groups, but changing existing group class in place is not supported. Which ingest-cost optimization should be tested?
- Switch the existing Standard log group in place to Infrequent Access without recreating it; AWS transparently changes the class when a tag is edited.
- Stop collecting the logs and assume auditors can reconstruct all past event details solely from Cost Explorer billing entries.
- Use CloudWatch Logs Infrequent Access class for new compatible log groups, comparing lower ingestion rates and feature limits while keeping required retention.
- Apply CloudWatch Logs sensitive-data masking to existing Standard log groups and assume masking converts billed ingestion to Infrequent Access pricing.
Explanation
Correct Answer
C:Infrequent Access has lower per-GB ingestion pricing for supported ad hoc log analysis; new groups are needed and feature gaps must be verified.
Incorrect Answers
A:Log group class is chosen at creation time and is immutable, so existing Standard groups cannot be reclassified in place.
B:Dropping required log data fails the stated audit purpose, and billing records are not a replacement for diagnostic event content.
D:Data protection helps privacy but does not change the immutable log class or its ingested GB charges.
Question 381
A private VPC sends millions of calls monthly to several AWS service APIs through one NAT gateway. The team considers replacing those paths with interface VPC endpoints but worries about endpoint-hours and per-GB fees. What should the architect compare?
- Keep NAT for all calls solely because gateway endpoints and interface endpoints always have identical pricing.
- Remove restrictive interface endpoint policies to lower the VPC endpoint hourly rate while keeping the same number of endpoints and AZs.
- Model NAT gateway hourly/data-processing costs against interface-endpoint hourly/processing costs per AZ and expected traffic, then test private routing and policies.
- Create interface endpoints for every possible service without checking per-endpoint hourly fees or usage patterns.
Explanation
Correct Answer
C:Interface endpoints have their own charges; whether replacing NAT reduces cost depends on traffic volume and endpoint/AZ count.
Incorrect Answers
A:Gateway and interface endpoints have different economics and service coverage; an unconditional assumption is misleading.
B:Endpoint permissions do not determine its hourly or per-GB pricing; weakening policy fails security without addressing the cost model.
D:Unused endpoints can increase cost even when NAT processing is reduced.
Question 382
A stable OpenSearch cluster powers a production search service around the clock. After measuring consistent node capacity requirements, finance wants a pricing commitment for eligible instance usage rather than resizing down to an unsafe smaller cluster. Which economic lever should be evaluated?
- Assess eligible Amazon OpenSearch Service Reserved Instances and size the term to steady compatible instance usage.
- Buy an EC2 Savings Plan and assume it covers every OpenSearch managed node under the same pricing rules.
- Remove half the shards and replicas without reviewing query load or data durability to reduce costs immediately.
- Move every actively queried OpenSearch index to a cold data tier without checking latency and assume the change constitutes a compute pricing reservation.
Explanation
Correct Answer
A:Reserved service instance pricing can lower effective cost for predictably utilized supported search nodes without undermining capacity needs.
Incorrect Answers
B:OpenSearch managed service billing has different reservation coverage from ordinary EC2 Savings Plans.
C:Blind removal can damage availability and performance and is not an appropriate response to a stable measured baseline.
D:Storage tiering can be a separate valid optimization but does not deliver the requested commitment discount on stable supported search-node compute usage.
Question 383
A team runs EKS development clusters for only a few hours per day, but their EC2 node groups remain running overnight. The containers do not require persistent node-local state. What operational cost control should be tested?
- Deploy Cluster Autoscaler but keep each nonproduction managed node group minimum size at its current high night-time value.
- Convert pods blindly to EKS Fargate but require all workloads to keep the same always-on task count overnight.
- Scale nonproduction node groups or workloads down on approved schedules, retaining cluster control-plane and storage cost awareness.
- Keep every development node at peak size overnight and assume Kubernetes stops billing when pods are idle.
Explanation
Correct Answer
C:Idle worker compute continues incurring charges; scheduled capacity reduction can save cost while preserving expected startup checks.
Incorrect Answers
A:An autoscaler cannot reduce below configured minimum capacity; the avoidable overnight compute baseline would remain.
B:Fargate removes node management but charges for running workloads; without an approved idle-hour shutdown it does not directly eliminate the documented unused runtime.
D:EC2 nodes incur instance charges whether containers are busy or idle.
Question 384
A company keeps expired sessions in DynamoDB long after their application-defined expiration. The session table grows steadily and writes and backup sizes rise, even though expired items no longer serve business requests. Which feature should be assessed?
- Disable all expiration fields and rely on user logout to remove every abandoned session.
- Enable DynamoDB Streams to emit table mutations but never implement a consumer that deletes expired records.
- Use DynamoDB Time to Live on the expiration attribute and verify deletion timing and downstream stream behavior.
- Create a GSI on the expiration timestamp and assume the index itself deletes past-due session rows on schedule.
Explanation
Correct Answer
C:TTL can automatically remove expired session items, reducing retained table data while recognizing expiration is asynchronous.
Incorrect Answers
A:Abandoned sessions may remain indefinitely without expiry enforcement.
B:Streams describes changes and can trigger processors; it does not automatically expire stale items without a deletion mechanism.
D:A GSI improves queries of indexed attributes but does not delete source records when their timestamps pass.
Question 385
A media processing business runs stable high-volume outbound content transfers directly from its EC2 origin to global consumers. Cost data shows large data transfer out charges and performance suffers at distant clients. Most content is cacheable and immutable. Which architectural optimization should be considered?
- Increase the number of EC2 origin instances without a CDN, preserving repeated long-haul origin transfers.
- Enable S3 Transfer Acceleration for uploads but continue returning every repeated viewer download directly from the EC2 origin.
- Introduce AWS Global Accelerator static anycast paths to the dynamic EC2 origin while leaving cacheable bytes uncached for every request.
- Distribute content through CloudFront with cacheable object versioning and analyze its pricing and origin offload against direct EC2 egress.
Explanation
Correct Answer
D:Edge caching can reduce repeated origin transfer and improve delivery performance for cacheable static content.
Incorrect Answers
A:More instances do not eliminate redundant geographic transfer from origin to every requesting user.
B:Transfer Acceleration optimizes certain S3 transfer paths and does not cache outbound HTTP content near global viewers.
C:Global Accelerator may optimize supported dynamic network paths but cannot substitute for edge caching and repeated origin byte offload.
Question 386
Cloud teams repeatedly deploy S3 buckets with a prohibited public-access configuration. Operations wants a central compliance view and a controlled automated action that reverses newly introduced violations. Which approach most directly meets the requirement?
- Configure AWS Config rules for S3 public access but notify a manual ticket queue only, without the required controlled remediation action.
- Deploy an AWS Config aggregator centrally without enabling Config recorders and applicable rules in the member accounts.
- Record and evaluate the configuration using AWS Config rules and associate an approved automated remediation using Systems Manager Automation or an appropriate supported remediation action.
- Enable S3 Block Public Access in only the shared logging account and assume it automatically removes prohibited ACLs from every unrelated workload account.
Explanation
Correct Answer
C:AWS Config can evaluate configuration compliance, and supported remediation actions can invoke automation to correct drift, with appropriate role permissions and safeguards.
Incorrect Answers
A:Config can detect prohibited configurations, but detection alone does not perform the requested automated rollback of recurrent violations.
B:An aggregator collects supported recorded/evaluated configuration; it does not replace data collection or a remediation action in source accounts.
D:Per-account or organization controls must be scoped to the affected buckets and complemented by evaluation and remediation evidence for the target estate.
Question 387
A payment gateway reports sporadic failures from overseas customers, yet its EC2 CPU and memory remain normal. Operations needs scheduled external synthetic transactions that detect user-visible API failures from multiple geographic locations. Which AWS tool best addresses the missing signal?
- Configure an ALB health check against the service port in one Region, treating a healthy TCP response as proof global checkout calls succeed.
- Use CloudWatch RUM browser telemetry only, depending on organic user sessions to appear in every region on a fixed schedule.
- Use CloudWatch Synthetics canaries executing representative HTTPS workflows from the required geographic locations.
- Instrument EC2 CPU and memory at one-minute resolution and infer transaction success whenever infrastructure utilization is normal.
Explanation
Correct Answer
C:Synthetics canaries perform periodic scripted endpoint checks, revealing application-level failures missed by instance resource metrics.
Incorrect Answers
A:Infrastructure health checks may miss transaction-level failures and customer-facing geography; multilocation scripted canaries test the actual workflow.
B:RUM observes actual user experiences rather than guaranteeing scheduled synthetic transactions from selected geographic locations.
D:Host resource health is not an end-user transaction test; dependencies and connectivity can fail while CPU and memory remain nominal.
Question 388
A microservice pipeline produces an asynchronous request that passes through API Gateway, Lambda and two internal services. Operators cannot determine which hop accounts for occasional extreme latency. The platform wants request-level timing correlation across instrumented components. Which improvement fits?
- Collect independent service metrics in CloudWatch dashboards with no shared trace context or request correlation.
- Implement distributed tracing with trace context propagation and an AWS-supported tracing backend such as X-Ray or OpenTelemetry.
- Emit a request ID only in the ingress API Gateway access log, without propagating it to Lambda and the internal services.
- Increase service timeout limits and report only total end-to-end request duration, not hop-level traces.
Explanation
Correct Answer
B:Correlated spans expose the component-level critical path of a request rather than a single unsegmented end-to-end duration.
Incorrect Answers
A:Aggregate metrics can show health trends but cannot attribute one request latency across the API Gateway, Lambda and downstream hops.
C:An ingress-only identifier does not link spans across instrumented components; distributed context propagation is required.
D:Larger timeouts hide but do not localize latency; request-level distributed traces identify the component and span creating the delay.
Question 389
Operators repeatedly remediate a known EC2 compliance drift by running the same documented SSM command. They now want a controlled, logged, automatically triggered workflow whenever a supported AWS Config noncompliance result is produced. Which design is most suitable?
- Use AWS Config rules with an EventBridge notification to a ticketing queue, but leave all repair actions as undocumented manual commands.
- Run the approved Systems Manager command on a fixed weekly schedule irrespective of Config state, omitting event-triggered remediation and per-resource evidence.
- Associate a remediation action that invokes approved Systems Manager Automation and monitor its executions and rollback controls.
- Grant Systems Manager Automation broad administrator permissions in every account with no scoped runbook or rollback guardrails.
Explanation
Correct Answer
C:Config evaluation can initiate a supported remediation workflow; SSM Automation executes the documented steps with logs and bounded privileges.
Incorrect Answers
A:Event notification is useful but does not execute the supported, controlled SSM Automation remediation whenever Config flags noncompliance.
B:A scheduled command can perform maintenance but does not satisfy automatically reacting to each supported Config compliance change and tracking remediation.
D:Excessive permissions and lack of tested runbooks undermine the requested controlled automated remediation even if a command can be invoked.
Question 390
A CloudFormation stack was created six months ago. Operators made emergency console edits to security group ingress rules that never appeared in the template. An audit needs to identify actual deviations from the declared infrastructure baseline before deciding how to reconcile them. What should the team run?
- Create a CloudFormation change set from the unchanged template and treat the empty preview as proof there were no out-of-band console edits.
- Perform CloudFormation drift detection for supported resources and compare the reported property differences with the approved template.
- Run AWS Config compliance rules for broad security group standards but do not compare the deployed group to the CloudFormation stack template.
- Read CloudTrail update events from the six-month period and assume a complete event log automatically shows each current rule difference from the stack model.
Explanation
Correct Answer
B:Drift detection identifies supported resources whose live properties differ from the last declared stack state, exposing out-of-band edits.
Incorrect Answers
A:Change sets preview proposed updates; drift detection compares current deployed resource properties with the stack template to find out-of-band changes.
C:Compliance may flag security policy violations but does not prove exact deviation from the template-managed baseline.
D:CloudTrail can reveal who changed settings, while drift detection evaluates the actual current resource properties against declared template state.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests