Question 650
A migrated Java application needs a managed broker supporting existing RabbitMQ AMQP client behavior and queues. The product team cannot rewrite protocol-level acknowledgments before the first cloud release. What AWS managed service should be evaluated?
- Replace RabbitMQ with SQS standard queues without changing AMQP acknowledgment, routing or transaction semantics in the existing Java clients.
- Use Amazon MQ for RabbitMQ with an approved deployment topology and preserve application broker protocol settings.
- Replace RabbitMQ with Amazon SQS without modifying existing AMQP connection and acknowledgment code.
- Use Amazon MSK without converting the existing RabbitMQ producers and consumers from AMQP to Kafka protocol semantics.
Explanation
Correct Answer
B:Amazon MQ offers managed support for compatible RabbitMQ broker behavior, reducing reimplementation during migration.
Incorrect Answers
A:SQS is a different queue API and acknowledgment model; an unmodified RabbitMQ AMQP client cannot directly use it as an AMQP broker.
C:SQS has different APIs and message semantics; an unmodified AMQP client cannot connect to it directly.
D:MSK is a managed Kafka service rather than a drop-in RabbitMQ protocol broker.
Question 651
A legacy application is built on an Apache Kafka event stream with hundreds of existing producers and consumers. The migration should minimize Kafka client rewrites and offload cluster broker operations. Which target architecture is appropriate?
- Use Amazon MQ for RabbitMQ and assume existing Kafka partition keys, consumer offsets and Kafka client protocols work without conversion.
- Create a CloudTrail management trail and consume it as a guaranteed copy of every Kafka message payload.
- Evaluate Amazon Managed Streaming for Apache Kafka with appropriate broker network, authentication and partition configuration.
- Use Kinesis Data Streams as a drop-in Kafka broker without changing any producer or consumer SDK or authentication.
Explanation
Correct Answer
C:MSK preserves Kafka client ecosystem compatibility while reducing manual management of supported Kafka infrastructure.
Incorrect Answers
A:RabbitMQ broker protocols differ from Kafka; the stated native Kafka compatibility strongly favors MSK.
B:CloudTrail API events are not a substitute for the application event stream.
D:Kinesis is a separate stream API; migrating Kafka clients to it requires application integration changes.
Question 652
A relocated social platform stores highly connected relationships and runs repeated multi-hop traversals across users, organizations and interactions. A relational join chain is becoming difficult to operate. What purpose-built datastore should architecture assess?
- Keep a general relational table with unindexed recursive JOINs as the only relationship traversal method while adding more application CPU.
- Move the API to a new ALB and assume load balancing replaces the database relationship query plan.
- Evaluate Amazon Neptune graph database with a modeled property graph or RDF schema aligned to traversal queries.
- Store just one adjacency string per user in S3 and assume ordinary object GET operations expose graph traversals and query language joins.
Explanation
Correct Answer
C:Neptune is designed for connected-data relationships and graph traversal patterns rather than repeated complex relational joins.
Incorrect Answers
A:Adding compute does not resolve the graph-native multi-hop traversal complexity and operational model identified in the case.
B:Load balancing distributes requests but cannot change inefficient multi-hop data modeling.
D:S3 object retrieval does not automatically execute connected-path graph queries or optimized traversals.
Question 653
A content service stores large nested product documents and queries by flexible document attributes. The application expects MongoDB-compatible drivers and basic query patterns, but the team must validate feature differences before a migration. Which managed target is a candidate?
- Migrate the JSON documents to a DynamoDB table and keep the existing MongoDB drivers and unsupported query operations completely unchanged.
- Use Amazon OpenSearch as a primary transactional MongoDB driver-compatible document database without checking application read/write semantics.
- Use EFS mount targets as if they automatically provide MongoDB query and transaction APIs.
- Assess Amazon DocumentDB MongoDB compatibility for required operators, indexing and transaction semantics in a proof of concept.
Explanation
Correct Answer
D:DocumentDB provides a managed document database with selected MongoDB API compatibility subject to explicit feature validation.
Incorrect Answers
A:DynamoDB supports document attributes but not the MongoDB wire protocol and query API compatibility assumed here.
B:OpenSearch is a search/analytics engine; its APIs and transaction behavior differ from MongoDB-compatible operational document storage.
C:Shared file storage does not implement a database query layer or document indexes.
Question 654
A new AWS customer in November 2026 wants to deploy an existing stateless HTTP container image through a managed HTTPS endpoint without independently configuring an ECS service, Fargate task networking, Application Load Balancer, or scaling policies. The customer has no historic AWS App Runner eligibility, and accepts the underlying Fargate, ALB and network costs. Which supported AWS deployment mode best fits?
- Use Amazon ECS Express Mode with an approved image and two IAM roles so ECS provisions the Fargate service, HTTPS load balancer, networking and autoscaling.
- Create a new App Runner account after March 31, 2026 and assume service enrollment is still available to all first-time customers.
- Use plain Amazon ECS EC2 launch type and manually configure cluster nodes, a load balancer and scaling, despite the explicit no-manual-infrastructure requirement.
- Expose the OCI image through an S3 static website endpoint, treating object hosting as running the containerized HTTP service.
Explanation
Correct Answer
A:ECS Express Mode accepts a container image and designated IAM roles and automates a Fargate ECS service, HTTPS load balancing, networking and scaling infrastructure.
Incorrect Answers
B:App Runner stopped accepting new customers starting March 31, 2026; recommending first-time enrollment for this date and customer is invalid.
C:Ordinary ECS EC2 can run containers, but the customer would operate host capacity and configure supporting resources, contrary to the managed one-step requirement.
D:S3 website hosting delivers static objects rather than launching and routing requests to an OCI container runtime.
Question 655
A scientific research application runs thousands of short independent simulation jobs, each requesting a different amount of CPU or memory. Jobs arrive in batches and can use either EC2 or Fargate resources when supported. Which AWS execution service best matches?
- Use AWS Batch with suitably configured compute environments, job queues and container job definitions.
- Use SageMaker Batch Transform as the only synchronous payment authorization endpoint and assume offline batch outputs meet subsecond request latency.
- Use CloudFront distribution invalidation calls as the batch scheduler for CPU simulation processes.
- Use a scheduled SageMaker Processing job to produce scores after the nightly batch instead of invoking a deployed low-latency endpoint.
Explanation
Correct Answer
A:AWS Batch manages queued batch workload scheduling and resource selection for compatible job definitions.
Incorrect Answers
B:Batch Transform is meant for offline large sets, not low-latency per-transaction interactive predictions.
C:CloudFront invalidation manages cached content and does not execute scheduled compute jobs.
D:Periodic offline processing does not meet the payment-transaction synchronous inference requirement.
Question 656
A migrated application runs a SQL-based data warehouse only during irregular dashboard sessions, and the business wants to avoid managing fixed Redshift compute clusters. It also needs SQL analytics and secure access to lake data. Which option is suitable?
- Provision an always-running Redshift provisioned RA3 cluster with the same idle cost during long dashboard-free periods.
- Use Athena SQL directly against an existing Redshift warehouse dataset without exporting or federating the required tables, assuming the Redshift-specific engine is no longer needed.
- Assess Amazon Redshift Serverless with its supported workgroup and namespace configuration and usage controls.
- Use a running RDS OLTP database as the warehouse without assessing read isolation or analytic query workload suitability.
Explanation
Correct Answer
C:Redshift Serverless supplies managed analytical SQL capacity that scales with usage rather than requiring a fixed provisioned cluster.
Incorrect Answers
A:A permanent provisioned cluster does not meet the objective of avoiding fixed compute when analytic demand is sparse.
B:Athena can query supported lake data but does not automatically replace the current Redshift warehouse objects or workload-specific SQL without compatibility review.
D:OLTP tuning and warehouse analytics have different resource and query characteristics, requiring explicit evaluation.
Question 657
A SaaS company runs Amazon OpenSearch Service for multiple customers using a shared index. The search API authenticates users from tenant-specific IAM roles, but a test finds that a customer can omit a `tenantId` query filter and retrieve another tenant's documents. The team must enforce tenant isolation server-side, including direct authorized search API calls. Which control best closes this leak?
- Use OpenSearch Service fine-grained access control with role mappings and document-level security scoped to the authenticated tenant; also enforce required network and index permissions.
- Enable only OpenSearch Dashboards' private tenant workspaces, assuming that Dashboards' saved-object separation automatically filters all direct index searches by tenant ID.
- Rely on the browser frontend to always append `tenantId` to the search JSON and permit its role to query the unrestricted shared index directly.
- Create an index alias without a security role or document-level restriction and assume any arbitrary alias name prevents requests to the underlying shared index.
Explanation
Correct Answer
A:Fine-grained access control can bind roles to index and document-level search permissions, preventing a tenant from retrieving documents outside its authorized scope even if a caller omits an application-supplied filter. This tests data-access enforcement, not choosing OpenSearch as a search engine.
Incorrect Answers
B:Dashboards multi-tenancy separates saved dashboards and visualizations; it is not automatically a document-level authorization rule for direct REST searches on a shared index. A separate data access policy is required.
C:A browser-provided query predicate is under the caller's control and can be omitted or altered by a crafted API request. It does not enforce a security boundary unless the backend and search principal independently restrict accessible documents.
D:Aliases are routing and logical naming tools, not an identity-aware document security mechanism by themselves. A client with broad underlying index privileges could bypass the alias and query data directly.
Question 658
A migrated on-premises analytics tool needs a managed shared filesystem with both SMB and NFS access to the same data and requires enterprise snapshots and data-management controls. Which FSx option is most appropriate?
- Use FSx for Windows File Server for SMB and assume the same filesystem also exposes a supported native NFS endpoint without any separate service.
- Use S3 Glacier Deep Archive objects as a drop-in always-mounted file server with active Windows ACL semantics.
- Use FSx for OpenZFS with NFS and assume every Windows SMB client can mount it with native ONTAP multi-protocol access.
- Assess Amazon FSx for NetApp ONTAP with its supported multi-protocol volumes and data protection functions.
Explanation
Correct Answer
D:FSx for ONTAP supports enterprise file access patterns including SMB and NFS where appropriate volume configuration is used.
Incorrect Answers
A:Windows File Server provides SMB and Windows ACL services, not the requested concurrent multi-protocol ONTAP SMB/NFS access to a shared namespace.
B:Cold object archive does not provide a low-latency shared SMB/NFS filesystem.
C:OpenZFS is NFS-oriented and not the managed dual SMB/NFS volume semantics requested for the shared dataset.
Question 659
A financial application already uses FSx for OpenZFS volumes for shared NFS datasets, with snapshots taken before each quarterly data-model change. Analysts need a space-efficient writable branch of a selected snapshot to rehearse an index rebuild and validate results without modifying the live production volume. The requirement is not to select a new NFS service. Which FSx for OpenZFS feature should be used?
- Create an FSx for OpenZFS volume clone from the selected snapshot, run validation against the writable clone, and retain production volume isolation.
- Restore every snapshot into the same production volume in place before testing and treat the resulting overwrite as a non-disruptive clone.
- Enable an S3 Lifecycle transition on an unrelated object bucket and assume it materializes a writable ZFS filesystem clone.
- Resize the production FSx file system without taking a snapshot, assuming that action produces an isolated historical branch.
Explanation
Correct Answer
A:FSx for OpenZFS supports fast, space-efficient clones of snapshots for writable test copies, allowing investigation without overwriting the live volume.
Incorrect Answers
B:Restoring directly into production risks changing the active dataset and does not provide a separate writable test branch.
C:Object storage lifecycle changes do not clone the ZFS volume or expose a writable filesystem for the test.
D:Storage sizing alone does not create a consistent point-in-time filesystem clone for isolated validation.
Question 660
A migrated ecommerce application holds customer session state in each EC2 process memory. Clients move between servers during scaling and lose their shopping baskets. The business wants a managed low-latency shared session tier. Which architecture is suitable?
- Enable ALB sticky sessions and retain the only session record in one process memory even during a host replacement or fleet scale-in.
- Use CloudTrail event history as a writable low-latency transactional session database.
- Externalize session state to a compatible ElastiCache Redis-compatible cluster with TTL and failure handling.
- Use DynamoDB TTL alone while leaving application session state solely in EC2 process memory with no shared table or read path.
Explanation
Correct Answer
C:Shared in-memory session state lets requests land on different application instances without depending on one process lifetime.
Incorrect Answers
A:Stickiness can reduce redistribution but cannot preserve process-local state when the associated node fails or is replaced.
B:Audit events are not the application session data interface or TTL-controlled session store.
D:A TTL setting on an unused table cannot externalize state across application instances or provide cache-miss reconstruction.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests