WGU D319 OA AWS CLOUD
ARCHITECTURE VERSION 1 LATEST 2025
WITH 250 REAL EXAM PREP QUESTIONS
AND CORRECT ANSWERS/ WGU D319
OBJECTIVE ASSESSMENT 2025 (NEW!)
Which type of customer-managed keys in Key Management Service (KMS) should
be used?
A) Symmetric keys with custom key store
B) Symmetric keys with service's key material
C) Asymmetric keys for encryption and decryption
D) Asymmetric keys for signing and verifying
A
An organization is evaluating the options to protect data in the cloud and has the
following requirements:
Cryptographic secrets need to be hosted in a single-tenant service.
The organization needs to manage the root of trust.
What should this organization use store to the secrets?
A) AWS Parameter Store
B) AWS CloudHSM cluster
C) AWS EBS-encrypted volume
D) AWS KMS-managed keys
B
Which solution provides a customer-managed root of trust?
A) AWS Directory Service
B) AWS Key Management Service
pg. 1
,C) AWS Certificate Manager
D) AWS CloudHSM
D
Which tool reduces time and costs by allowing a customer to automate the creation
and track the changes of entire resource environments?
A) Systems Manager
B) CloudFront
C) Machine Images
D) CloudFormation
D
A client wants to implement redundant network access to EC2 instances with
automatic failover in case the existing AWS Direct Connect connection fails. The
solution must minimize cost.
Which network access option should this client use?
A) Virtual Private Cloud
B) Site-to-Site VPN
C) NAT gateway instance
D) Internet gateway instance
B
A client has 100 on-premises locations in the northwestern United States. Each
location has network access to the same Amazon VPCs in the US West AWS
Region via Internet Protocol Security (IPSec) tunnels. The client plans to create
500 Amazon VPCs in the same Region. The client needs to ensure all Amazon
VPCs will be accessible from each of its on-premises locations. The solution must
minimize cost of on-premises infrastructure.
Which additional network access method should this client include in the solution?
A) AWS Direct Connect
B) AWS Site-to-Site VPN
pg. 2
,C) AWS VPN CloudHub
D) AWS Transit Gateway
D
A company plans to host a public website in AWS. Users will access the website
using SSL/TLS. The company requires the ability to delete keys if they are
compromised.
Which key solution should this company use?
A) Customer-managed asymmetric key
B) Customer-managed symmetric key
C) AWS-managed asymmetric key
D) AWS-managed symmetric key
A
A company is building a high-performance computing (HPC) clustered workload
on AWS using EC2 instances and is looking for a fully managed, shared storage
solution for this workload. Once the HPC portion of the data processing is
complete, the company would like to serve the resulting data directly on the
internet.
Which Amazon service would be the most cost-effective solution for these
requirements?
A) FSx for Lustre
B) Elastic File System (EFS)
C) Elastic Block Store (EBS)
D) FSx for Windows
A
Which Amazon storage class monitors data usage and moves data to the most cost-
effective location?
A) S3 Standard
B) S3 Standard-IA
pg. 3
, C) One Zone-IA
D) S3 Intelligent-Tiering
D
An organization needs a low-cost system to host its website.
Which elastic compute configuration meets the requirement at the least cost?
A) A general purpose instance with a hard disk drive
B) A storage-optimized instance with a hard disk drive
C) A general purpose instance with a provisioned input/output intensive solid-state
drive
D) A storage-optimized instance with a provisioned input/output intensive solid-
state drive
A
A development team needs a system to run recurring benchmark tests for an
artificial intelligence application. To remove variability from one test to the other,
the storage will be reinitialized for each test.
Which elastic compute configuration meets the requirements while minimizing
cost and administration time?
A) A memory-optimized computing instance with a standard solid-state drive
B) An accelerated computing instance with a standard solid-state drive
C) A memory-optimized computing instance with an instance store
D) An accelerated computing instance with an instance store
D
A client wants to use a managed service to replace an EC2 instance that currently
hosts a shared big data analytics store, accessible via the NFS protocol. The
managed service must provide read-after-write consistency and low latency for
read and write operations.
Which Amazon service should this client choose?
A) S3
pg. 4
ARCHITECTURE VERSION 1 LATEST 2025
WITH 250 REAL EXAM PREP QUESTIONS
AND CORRECT ANSWERS/ WGU D319
OBJECTIVE ASSESSMENT 2025 (NEW!)
Which type of customer-managed keys in Key Management Service (KMS) should
be used?
A) Symmetric keys with custom key store
B) Symmetric keys with service's key material
C) Asymmetric keys for encryption and decryption
D) Asymmetric keys for signing and verifying
A
An organization is evaluating the options to protect data in the cloud and has the
following requirements:
Cryptographic secrets need to be hosted in a single-tenant service.
The organization needs to manage the root of trust.
What should this organization use store to the secrets?
A) AWS Parameter Store
B) AWS CloudHSM cluster
C) AWS EBS-encrypted volume
D) AWS KMS-managed keys
B
Which solution provides a customer-managed root of trust?
A) AWS Directory Service
B) AWS Key Management Service
pg. 1
,C) AWS Certificate Manager
D) AWS CloudHSM
D
Which tool reduces time and costs by allowing a customer to automate the creation
and track the changes of entire resource environments?
A) Systems Manager
B) CloudFront
C) Machine Images
D) CloudFormation
D
A client wants to implement redundant network access to EC2 instances with
automatic failover in case the existing AWS Direct Connect connection fails. The
solution must minimize cost.
Which network access option should this client use?
A) Virtual Private Cloud
B) Site-to-Site VPN
C) NAT gateway instance
D) Internet gateway instance
B
A client has 100 on-premises locations in the northwestern United States. Each
location has network access to the same Amazon VPCs in the US West AWS
Region via Internet Protocol Security (IPSec) tunnels. The client plans to create
500 Amazon VPCs in the same Region. The client needs to ensure all Amazon
VPCs will be accessible from each of its on-premises locations. The solution must
minimize cost of on-premises infrastructure.
Which additional network access method should this client include in the solution?
A) AWS Direct Connect
B) AWS Site-to-Site VPN
pg. 2
,C) AWS VPN CloudHub
D) AWS Transit Gateway
D
A company plans to host a public website in AWS. Users will access the website
using SSL/TLS. The company requires the ability to delete keys if they are
compromised.
Which key solution should this company use?
A) Customer-managed asymmetric key
B) Customer-managed symmetric key
C) AWS-managed asymmetric key
D) AWS-managed symmetric key
A
A company is building a high-performance computing (HPC) clustered workload
on AWS using EC2 instances and is looking for a fully managed, shared storage
solution for this workload. Once the HPC portion of the data processing is
complete, the company would like to serve the resulting data directly on the
internet.
Which Amazon service would be the most cost-effective solution for these
requirements?
A) FSx for Lustre
B) Elastic File System (EFS)
C) Elastic Block Store (EBS)
D) FSx for Windows
A
Which Amazon storage class monitors data usage and moves data to the most cost-
effective location?
A) S3 Standard
B) S3 Standard-IA
pg. 3
, C) One Zone-IA
D) S3 Intelligent-Tiering
D
An organization needs a low-cost system to host its website.
Which elastic compute configuration meets the requirement at the least cost?
A) A general purpose instance with a hard disk drive
B) A storage-optimized instance with a hard disk drive
C) A general purpose instance with a provisioned input/output intensive solid-state
drive
D) A storage-optimized instance with a provisioned input/output intensive solid-
state drive
A
A development team needs a system to run recurring benchmark tests for an
artificial intelligence application. To remove variability from one test to the other,
the storage will be reinitialized for each test.
Which elastic compute configuration meets the requirements while minimizing
cost and administration time?
A) A memory-optimized computing instance with a standard solid-state drive
B) An accelerated computing instance with a standard solid-state drive
C) A memory-optimized computing instance with an instance store
D) An accelerated computing instance with an instance store
D
A client wants to use a managed service to replace an EC2 instance that currently
hosts a shared big data analytics store, accessible via the NFS protocol. The
managed service must provide read-after-write consistency and low latency for
read and write operations.
Which Amazon service should this client choose?
A) S3
pg. 4
