Practice Test #4

Amazon SageMaker JumpStart can help deploy prebuilt or foundation-model-based solutions, but it still requires selecting, deploying, and operating an inference endpoint. That introduces more complexity and operational overhead than necessary for a requirement already covered by a native managed moderation API. The question explicitly says no custom model development or training is required, which strongly favors Rekognition over SageMaker. While technically possible, this is not the most direct, lowest-latency, or most AWS-native solution for image moderation.

Amazon CloudFront Functions are extremely lightweight edge functions intended for simple HTTP request and response manipulation, not for calling AI services or performing heavy processing. They cannot directly invoke Amazon Textract, and Textract itself is designed for OCR, form extraction, and document text analysis rather than inappropriate image detection. Even if text were extracted from an image, that would not determine whether the image content itself is inappropriate or non-medical. This option is incorrect both because of service mismatch and because the execution environment is unsuitable.

Amazon Rekognition Video is intended for analyzing video files or streams, not still images uploaded through a web portal. The question specifically concerns uploaded images, so the correct Rekognition feature would be image moderation rather than video analysis. In addition, an S3-triggered Lambda runs after the object has already been uploaded, which does not inherently provide real-time blocking during the upload transaction. That makes this option a poor fit for both the media type and the timing requirement.

Incorrect. Multi-AZ is primarily for high availability and automatic failover, not for scaling reads. In standard RDS Multi-AZ, the standby cannot accept traffic, so you cannot use it for writes or reads. Directing reads to the primary and writes to the standby is not supported and would not address the read-driven CPU bottleneck causing increased latency.

Incorrect. This option assumes the standby in a Multi-AZ deployment can serve read traffic. In standard Amazon RDS Multi-AZ, the standby is not readable; it is maintained for failover only. Therefore, you cannot offload analytical reads to the standby, and the primary would remain CPU-constrained during peak trading hours.

Partially reasonable but not the best choice given "minimal infrastructure changes." Read replicas are correct, but matching the primary size (8 vCPU/32 GB) may be unnecessary and increases cost without evidence that smaller replicas won't meet the analytics workload. A better approach is to start with smaller replicas, monitor performance/lag, and scale up/out only if required.

Incorrect. NAT instances can provide outbound access, but they are self-managed EC2 instances requiring patching, scaling, and careful configuration (source/destination check disabled, security groups, failover scripts). Placing them in private subnets is also wrong because a NAT device must be able to reach the internet via an IGW, which typically requires being in a public subnet with a public IP/EIP.

Incorrect. You cannot attach an internet gateway to a subnet; an IGW attaches to a VPC. Also, routing private subnets directly to an IGW would make them effectively public (if instances have public IPs) and violates the requirement that trading application servers must not be directly accessible from the internet. A “secondary IGW” is not a valid construct for this purpose.

Incorrect. An egress-only internet gateway is used for IPv6 to allow outbound-only internet access while blocking inbound-initiated connections. It does not provide IPv4 NAT functionality, which is what most patch repositories, market data feeds, and third-party endpoints commonly use. Also, egress-only IGWs are attached to the VPC (not placed in a subnet) and do not replace NAT gateways for IPv4.

Lambda is a good compute choice for bursty workloads, but DynamoDB is not appropriate for storing video files. DynamoDB has a 400 KB item size limit and is optimized for key-value/document metadata, not large binaries. Even if videos were chunked, costs and complexity would be high and performance unpredictable. This option fails the storage requirement for large uploaded media.

Kinesis Data Firehose is designed to ingest and deliver streaming data to targets like S3, Redshift, or OpenSearch with optional lightweight transformations. It is not a general-purpose video processing service and does not run arbitrary thumbnail generation workloads. It also is not intended to store configuration metadata as a primary database. This option mismatches the workload type.

A fixed increase to five EC2 instances does not provide automatic scaling from 50 to 2000+ concurrent users; it is unlikely to meet peak demand and wastes capacity off-peak. EBS volumes are attached storage and not a scalable shared repository for uploads across instances without additional architecture. This approach increases operational burden and reduces resilience compared to managed/serverless options.

VPC peering provides private IP connectivity between two VPCs, but it is network-level access. Once routes and security rules allow it, the consumer can potentially reach many resources in the provider VPC, not just a single market data service. This fails the requirement to restrict connectivity only to the specific service and is often disallowed in regulated environments due to broader blast radius.

A virtual private gateway (VGW) is used for Site-to-Site VPN or Direct Connect, not for AWS PrivateLink. PrivateLink does not require a VGW on the provider side; it requires a VPC endpoint service backed by an NLB. This option reflects a common confusion between private connectivity mechanisms (VPN/DX) and service-level private access (PrivateLink).

A NAT gateway enables instances in private subnets to initiate outbound connections to the internet via a public IP. It does not create private connectivity to a third-party VPC service and would typically route traffic over the public internet (even if the destination is in AWS). This violates the “completely private” requirement and does not restrict access to only the specific service.