Question 540
An AWS Organizations consolidated-billing family has an existing underutilized Compute Savings Plan purchased by the tooling account. Two production member accounts have steady eligible On-Demand EC2 usage, but the management account disabled Savings Plans discount sharing for both the plan owner and those receiving accounts. Finance wants to use the already-purchased commitment across permitted accounts before considering another purchase. Which setting should the payer review?
- Create a Cost Category for production accounts but leave Savings Plans benefit sharing disabled for both the plan owner and the receiving accounts.
- In the management account Billing preferences, activate supported Savings Plans discount sharing for the purchasing and receiving accounts, subject to approved organization or group sharing scope.
- Convert the existing Compute Savings Plan into an Availability-Zone-specific EC2 On-Demand Capacity Reservation so both accounts automatically use its commitment.
- Purchase a second identical Compute Savings Plan in the production account while leaving the already-owned underutilized commitment and sharing configuration unchanged.
Explanation
Correct Answer
B:AWS Billing sharing preferences govern how eligible unused commitment discounts apply across consolidated accounts: the plan owner and receiving member accounts must be sharing-active, and the chosen organization/group scope must permit use.
Incorrect Answers
A:Cost Categories can help define sharing groups, but labels alone do not override disabled RI/Savings Plans discount sharing settings for the owner and recipients.
C:On-Demand Capacity Reservations are capacity guarantees for supported EC2 attributes, not a conversion of a compute-spend discount into cross-account Savings Plans eligibility.
D:An additional plan adds commitment cost and leaves the unshared original plan idle; enabling eligible discount sharing addresses the identified billing configuration first.
Question 541
A CloudFront distribution already has an appropriate cache key and a 94% cache-hit ratio. Its Kinesis-backed real-time access logging records every viewer request and the telemetry bill has grown sharply. Security requires prompt geographic and status visibility but agrees that a statistically useful subset of requests is sufficient. What should the team change first?
- Switch to sampled CloudFront standard access logs and assume the delayed delivery guarantees the same seconds-level detection SLA as real-time access logging.
- Configure a lower, risk-tested real-time log sampling percentage and select only necessary fields and cache behaviors, then validate alert sensitivity.
- Increase CloudFront cache TTL on all behaviors without changing the configured 100% real-time access log sampling.
- Increase the Kinesis stream retention duration and shard count while continuing to emit a real-time log record for every viewer request.
Explanation
Correct Answer
B:CloudFront real-time access logs support sampling percentage, selected log fields, and cache behavior selection; reducing justified collection lowers downstream log volume.
Incorrect Answers
A:Standard logs can reduce a different cost component but do not meet the stated prompt real-time monitoring requirement without a latency review.
C:Viewer requests generate real-time log records regardless of whether they are served from cache; a longer TTL does not reduce the specified per-request telemetry volume.
D:More shards and longer stream retention may increase streaming spend and do not reduce CloudFront real-time log sampling.
Question 542
A nightly Redshift analytics cluster runs only four hours each day, and finance identifies long idle hours with little query activity. The workloads can tolerate cluster warm-up outside business hours. What operational savings option is available?
- Enable Redshift Concurrency Scaling only, but keep the original provisioned cluster continuously running all night.
- Elastically resize the cluster to twice its original node count during quiet hours, expecting idle compute billing to stop automatically.
- Lower the Redshift workload-management query queue priority during idle hours and assume that the base provisioned compute stops billing.
- Evaluate scheduled pause and resume for a supported provisioned Redshift cluster, checking storage costs and job schedule dependencies.
Explanation
Correct Answer
D:AWS supports scheduling pause and resume for eligible Redshift provisioned clusters; pausing suspends on-demand compute billing while storage remains billed and dependencies must tolerate startup delay.
Incorrect Answers
A:Concurrency Scaling supplements query processing under load; without pausing the base cluster it does not suspend baseline idle provisioned compute charges.
B:Elastic resize changes available provisioned compute; doubling nodes during idle time is not a pause and cannot eliminate baseline compute cost.
C:WLM queue priority governs query execution but does not pause or stop provisioned Redshift cluster billing.
Question 543
A retired staging VPC has six interface VPC endpoints whose private ENIs still exist in three Availability Zones. Billing shows ongoing interface-endpoint-hours although application owners confirm no workload uses those service endpoints. The VPC NAT gateway was already removed. What cleanup targets the remaining endpoint-specific cost?
- Delete an S3 gateway endpoint with no endpoint-hour cost while keeping the six billed interface endpoint ENIs active.
- Revoke every IAM permission to call the unused endpoints but leave the PrivateLink interface endpoint resources active.
- Delete the validated unused interface endpoints and their endpoint ENIs, preserving only endpoints still required by remaining workloads.
- Disable private DNS on all six unused interface endpoints but leave each endpoint ENI provisioned and billed hourly.
Explanation
Correct Answer
C:Deleting no-longer-needed interface endpoints removes their endpoint network interfaces and avoids future endpoint-hour charges.
Incorrect Answers
A:S3 gateway endpoints do not incur the interface endpoint hourly ENI pricing; removing them misses the measured cost driver.
B:API authorization changes may block use but cannot stop hourly billing for endpoint network interfaces still provisioned.
D:Private DNS selection affects name resolution, not the hourly billing for existing PrivateLink interface endpoints.
Question 544
A financial platform uploads tens of millions of new, small objects every month to one S3 bucket encrypted with a customer-managed SSE-KMS key. Finance attributes a material share of object operations cost to repeated AWS KMS calls; object encryption must remain enabled, and the team can validate changes to any existing KMS encryption-context conditions. Which S3 setting should it evaluate to reduce eligible KMS request volume for new objects?
- Enable supported Amazon S3 Bucket Keys with SSE-KMS on eligible new objects, compare KMS request cost and check that bucket-ARN encryption context is compatible with key policies.
- Replace the customer-managed SSE-KMS key with no server-side encryption on all new data, assuming compliance will accept the resulting plaintext objects.
- Enable S3 Lifecycle expiration on every newly uploaded object immediately, even though the business must retain all uploaded records for seven years.
- Increase the number of distinct customer-managed KMS keys used per request, expecting a larger key count to reduce KMS request traffic automatically.
Explanation
Correct Answer
A:S3 Bucket Keys reduce the frequency of S3-to-KMS requests for SSE-KMS data while maintaining server-side encryption; they use bucket ARN rather than object ARN in the default KMS encryption context, so policy compatibility needs review.
Incorrect Answers
B:Removing required encryption violates the data protection requirement and is not a justified request-volume optimization.
C:Lifecycle deletion conflicts with mandatory record retention and does not target the KMS request pattern while retaining the records.
D:Additional KMS keys change key-management structure but do not cache key generation at the bucket level or reduce per-object request count.
Question 545
A centralized logging account stores high-volume CloudWatch Logs streams for seven years even though operational debugging requires 90 days; compliance allows archival to cheaper storage after that. Which cost-control policy is most appropriate?
- Set log-group retention to one day for all security logs even though compliance requires up to seven years of available audit history.
- Change the log groups to Infrequent Access class in place after ingest and assume the class switch immediately applies to historical bytes.
- Set justified log-group retention for active investigation and export or archive qualifying older records through a compliant pipeline.
- Leave every debug log stream retained forever in the hottest searchable tier without reviewing compliance requirements.
Explanation
Correct Answer
C:CloudWatch Logs retention aligns expensive searchable history with operational needs while an approved archive covers longer regulatory retention.
Incorrect Answers
A:A short unmanaged retention period can destroy required evidence; a governed archival pipeline and retention plan is needed.
B:CloudWatch Logs log class selection is constrained and not an automatic migration of pre-existing historic data to long-term archive storage.
D:Indefinite high-cost searchable retention ignores the documented distinction between short operational access and long archival needs.
Question 546
A high-traffic Lambda function is configured for 3 GB memory but benchmarking shows equivalent p95 latency and CPU for much lower memory sizes. Duration, billed requests and cold-start behavior have been measured at each setting. What optimization should finance approve?
- Choose a lower supported memory setting that meets latency targets and minimizes measured price per successful invocation.
- Increase memory to the service maximum despite benchmark evidence that the application does not use it.
- Switch the Lambda function to an unrelated EC2 instance class but keep the same 3-GiB Lambda memory configuration and invoke it unchanged.
- Force the function to use the minimum permitted memory without testing whether p95 latency or error rates regress under peak demand.
Explanation
Correct Answer
A:Lambda price depends partly on allocated memory and duration, so measured right-sizing can reduce cost without violating SLOs.
Incorrect Answers
B:Higher allocation can increase billed GB-seconds without demonstrated performance benefit.
C:An EC2 instance family choice does not control Lambda GB-second pricing; measured Lambda memory allocation is the relevant parameter.
D:Untested minimum sizing may increase billed duration or breach performance; the supported choice is the measured lowest total cost meeting the SLO.
Question 547
An Athena analytics team scans 8 TB of uncompressed JSON for daily reports, although reports need only five fields and date-level filtering. The source produces immutable daily partitions. What change is likely to reduce query scan charges?
- Increase Athena per-query bytes scanned limits without changing the uncompressed JSON layout or highly selective date predicates.
- Create additional Glue Catalog table aliases over the same raw data and keep scanning SELECT * over all days and fields.
- Write suitably partitioned compressed columnar Parquet and modify queries to prune partitions and project needed columns.
- Convert Parquet data back to uncompressed JSON before every report and scan every date partition.
Explanation
Correct Answer
C:Columnar projection and partition pruning reduce the bytes scanned by query engines compared with repeated full JSON scans.
Incorrect Answers
A:Higher workgroup limits can permit more scanning but do not reduce chargeable scan bytes for the same full JSON data.
B:Catalog aliases do not create compressed columnar data or date-based partition pruning to reduce bytes scanned.
D:Reverting to broad JSON scans preserves expensive scanning of unused fields and dates.
Question 548
A versioning-enabled S3 bucket stores an editable product-image library. Designers overwrite image keys many times a day, and old versions keep consuming storage after ordinary delete operations create delete markers. Legal has approved retaining only the latest five noncurrent versions for at least 30 days; there is no Object Lock requirement. What lifecycle change targets this measured storage waste?
- Configure only S3 AbortIncompleteMultipartUpload to remove unfinished uploads, leaving all completed noncurrent object versions untouched.
- Disable versioning and assume existing noncurrent object versions and their storage charges disappear automatically.
- Configure an S3 Lifecycle NoncurrentVersionExpiration rule with the approved noncurrent-age and newer-version retention controls, and validate exclusions before applying it.
- Enable S3 expiration of the current version after one day and assume the latest five approved noncurrent versions will always remain recoverable for at least 30 days.
Explanation
Correct Answer
C:NoncurrentVersionExpiration can permanently remove aged versions under configured safeguards, matching the approved number and retention of prior revisions.
Incorrect Answers
A:Aborting incomplete uploads does not expire historical versions of successfully completed object writes.
B:Suspending versioning does not by itself delete existing noncurrent object versions or remove their storage costs.
D:Current-version expiration alone does not implement the specified noncurrent age and keep-newer-version controls.
Question 549
A finance team must allocate EC2 and RDS shared-platform spend to internal teams, including reservation amortization and daily usage line items. Simple account-level invoicing hides which service consumed the discounts. What reporting architecture supports this analysis?
- Use Cost Explorer monthly account totals only, without detailed line items or amortized reservation allocation for shared EC2/RDS usage.
- Use detailed Cost and Usage Report billing exports with amortized/effective costs, activated allocation tags and a governed shared-cost attribution model.
- Use AWS Budgets thresholds for each team but omit Cost and Usage Report line items and how RI/Savings Plans discounts are consumed.
- Discard amortized charges and report all upfront commitment purchase costs only on the first purchase day.
Explanation
Correct Answer
B:CUR detail supports line-item and reservation-adjusted analysis rather than equating invoices with direct resource consumption.
Incorrect Answers
A:High-level monthly account charts do not provide the individual usage, tags and commitment amortization required for chargeback.
C:Budgets can alert on configured spend but do not supply the granular billing export needed to allocate shared usage fairly.
D:Purchase-day allocation conceals the economic cost attributable to each month of actual committed usage.
Question 550
An organization runs Kubernetes nonproduction environments in EKS that are idle every night. The worker node groups continue running because minimum capacity is never reduced. Governance approves stopping workloads outside office hours. What cost improvement targets the waste?
- Schedule safe scale-down of nonproduction workloads and compatible node capacity, then restore baseline before business-hour use.
- Increase worker minimum capacity at night so empty clusters always have double the compute allocation.
- Scale only application Pod replicas to zero overnight while leaving idle EKS EC2 worker node groups at unchanged minimum capacity.
- Delete all EKS clusters nightly without preserving cluster state, network configuration or scheduled morning restoration.
Explanation
Correct Answer
A:Automated schedules reduce unused worker compute-hours while allowing planned exceptions and testing stateful constraints.
Incorrect Answers
B:Additional idle node capacity increases the specific measured nightly waste.
C:Scaling Pods down without adjusting node group capacity can leave the core idle EC2 compute charge intact.
D:Destructive recreation introduces availability and configuration risks rather than controlled nonproduction workload and node scheduling.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests