All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A company is designing a mobile application that allows authenticated external users to upload profile documents directly to a shared Amazon S3 bucket. The application authenticates users via an external OpenID Connect (OIDC) compliant identity provider. The architecture must strictly prevent the storage of long-term credentials on the mobile devices, enforce the principle of least privilege, and avoid manual administrative overhead for user provisioning. Which TWO actions should a solutions architect take to meet these security requirements? (Select TWO).

Select all that apply

Configure an OIDC-compatible identity provider in AWS IAM, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action.

Implement dynamic access control by using policy variables in the IAM role's permissions policy to restrict S3 prefix access to the user's OIDC unique identifier.

Create a dedicated IAM user with long-term credentials for each external application user and distribute these credentials to the mobile devices.

Store a master administrative IAM user's credentials in AWS Systems Manager Parameter Store as a standard plaintext parameter for the mobile application to retrieve.

Enable automatic key rotation on the Customer Managed KMS Key used for S3 encryption, which will immediately re-encrypt all historical user files under the new key version.

Show answer & explanation

Answer: Configure an OIDC-compatible identity provider in AWS IAM, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action.; Implement dynamic access control by using policy variables in the IAM role's permissions policy to restrict S3 prefix access to the user's OIDC unique identifier.

Answer

The solutions architect should configure an OIDC-compatible identity provider in AWS IAM, create an IAM role with a trust policy that allows the web identity federation action, and implement dynamic access control by using policy variables to restrict S3 prefix access.

To support external authentication via an OIDC provider without creating IAM users, we use web identity federation. Registering the OIDC provider in IAM and creating an IAM role with a trust policy for the web identity action allows users to exchange their OIDC token for temporary AWS credentials. By applying an IAM policy with dynamic policy variables, we restrict users to their own S3 prefix without manually managing unique policies for each user.

Step-by-Step Solution

Establish a trust relationship between AWS IAM and the external OIDC identity provider.

Allows AWS to accept authentication assertions from the external provider.

Create an IAM role with AssumeRoleWithWebIdentity trust policy.

Generate a role that authenticated mobile app users can assume dynamically.

Eliminates the need for long-term AWS credentials on mobile devices by using temporary security tokens.

Define dynamic policies with policy variables.

Apply a resource-level restriction using OIDC-specific claims in the policy.

Enforces folder isolation within the S3 bucket dynamically, preventing users from accessing other users' prefixes.

Key Concept

AWS web identity federation allows OIDC authenticated users to obtain temporary credentials to access AWS resources like Amazon S3, using policy variables to enforce least-privilege folder boundaries dynamically.

Question 242Question →

A Solutions Architect is establishing a multi-account AWS environment for a financial organization. The compliance guidelines require that no member accounts can modify VPC flow logs or delete customer managed keys. Additionally, all administrative access to the AWS accounts must be mapped directly to the organization's existing corporate identity provider. Which two actions should the Solutions Architect implement to meet these requirements?

Select all that apply

Configure AWS IAM Identity Center and federate it with the corporate identity provider to centrally manage cross-account permissions.

Create and attach an SCP to the organizational units containing the member accounts to deny actions such as deleting flow logs and scheduling key deletion.

Create individual IAM users in the management account for each corporate employee, and have them assume roles in the member accounts using long-term credentials.

Create SCPs that block these actions and apply them to the management account to restrict its root user credentials.

Generate root access keys for the management account and use them in a custom script to automatically remediate any configuration changes in the member accounts.

Show answer & explanation

Answer: Configure AWS IAM Identity Center and federate it with the corporate identity provider to centrally manage cross-account permissions.; Create and attach an SCP to the organizational units containing the member accounts to deny actions such as deleting flow logs and scheduling key deletion.

Answer

Configure AWS IAM Identity Center integrated with the corporate identity provider, and apply SCPs at the organizational unit level to restrict member accounts.

Establishing centralized authentication through AWS IAM Identity Center integrated with the corporate identity provider represents the best practice for federated access. Enforcing compliance restrictions through SCPs attached to organizational units ensures that policy boundaries are enforced on all member accounts automatically.

Step-by-Step Solution

Configure identity federation using AWS IAM Identity Center.

Centralized identity federation is established with the corporate identity provider.

This allows administrators to log in using their existing credentials and receive temporary credentials, eliminating the need to manage individual IAM users.

Define and attach SCPs at the organizational unit level.

Actions such as deleting flow logs and scheduling KMS key deletion are blocked for all principals within the member accounts.

SCPs are the standard way to enforce strict governance boundaries across multiple member accounts under AWS Organizations.

Key Concept

Multi-Account Governance with SCPs and IAM Identity Center

Question 243Question →

An enterprise is migrating a critical, write-heavy core banking application to AWS. The database architecture must satisfy the following resiliency requirements:
- Within the primary AWS region, the database must achieve high availability with zero data loss (Recovery Point Objective, $\text{RPO} = 0$ ) and automated failover in less than 30 seconds.
- Across a secondary AWS region, the disaster recovery solution must support active read scaling during normal operations, maintain a cross-region replication lag under 2 seconds ( $\text{RPO} < 2$ seconds), and allow failover to the secondary region in less than 5 minutes ( $\text{RTO} < 5$ minutes).

Which database configuration meets these requirements with the lowest operational overhead?

Amazon Aurora PostgreSQL-Compatible Edition with an Aurora Global Database. Deploy the primary cluster in the main region and a secondary cluster in the recovery region, routing read traffic in the secondary region to the local reader instances.

Amazon RDS for PostgreSQL with a Multi-AZ DB instance deployment in the primary region, and a cross-region Read Replica in the secondary region. Use Route 53 Latency Routing to automatically direct database write traffic to the replica in the secondary region if the primary region becomes unavailable.

Amazon RDS for PostgreSQL with a Multi-AZ DB instance deployment in the primary region. In the secondary region, configure a pilot light database environment by restoring daily snapshots transferred from the primary region, scale up the instance class only during failover, and direct traffic using Route 53 Failover Routing.

Amazon RDS for PostgreSQL with a Single-AZ DB instance deployment in the primary region. Configure an asynchronous cross-region Read Replica in the secondary region, and write a custom AWS Lambda script to monitor primary database health and automatically promote the replica during a regional outage.

Show answer & explanation

Answer: Amazon Aurora PostgreSQL-Compatible Edition with an Aurora Global Database. Deploy the primary cluster in the main region and a secondary cluster in the recovery region, routing read traffic in the secondary region to the local reader instances.

Answer

The correct option implements Amazon Aurora Global Database, which matches all constraints. For local high availability, Aurora replicates data synchronously across three AZs, ensuring

\text{RPO} = 0

and automated failover in less than 30 seconds. For multi-region resilience, storage-based physical replication keeps lag below 2 seconds (typically under 1 second), and secondary clusters can serve active read traffic and be promoted to primary in less than a minute.

Step-by-Step Solution

Analyze single-region high availability requirements.

The solution requires

\text{RPO} = 0

(zero data loss) and automated failover in less than 30 seconds within the primary region. Aurora replicates data across three AZs with shared storage, achieving synchronous-like durabilities and automatic failover within 30 seconds, meeting the local HA requirements.

Ensures the database survives an Availability Zone outage without data loss and with minimal recovery time.

Analyze cross-region disaster recovery and read-scaling requirements.

The secondary region needs read scaling,

\text{RPO} < 2

seconds, and

\text{RTO} < 5

minutes. Aurora Global Databases use storage-based replication with a typical lag of less than 1 second, allow reader instances in the secondary region to serve local read traffic, and can be promoted to primary within 1 minute.

Guarantees that regional disaster recovery requirements are met while optimizing read performance for secondary region users.

Evaluate the operational overhead and suitability of alternative services.

RDS PostgreSQL Multi-AZ with cross-region read replicas requires manual intervention or complex automation for cross-region failover and does not support storage-level global replication. Restoring from daily snapshots (pilot light) violates the 2-second RPO requirement.

Selects the option that minimizes custom automation and meets all RPO/RTO constraints natively.

Key Concept

Amazon Aurora Global Databases and Multi-AZ replication

Question 244Question →

A financial technology company operates an online transaction processing (OLTP) application using Amazon RDS for PostgreSQL. The primary database runs in us-east-1 with a Multi-AZ deployment. To comply with disaster recovery regulations, the company requires a secondary database copy in us-west-2. The solution must achieve a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 15 minutes in the event of a total failure of the us-east-1 region. Which strategy should a solutions architect implement to meet these disaster recovery requirements?

Create a cross-region read replica of the primary database in us-west-2. In the event of a region-wide outage in us-east-1, promote the read replica in us-west-2 to a standalone DB instance, and update the application configuration to point to the new database endpoint.

Configure the us-west-2 cross-region read replica to participate in the Multi-AZ replication group. Configure the RDS database to automatically failover to the us-west-2 replica in the event of a us-east-1 failure, utilizing Route 53 Latency routing to redirect application traffic.

Create a cross-region read replica in us-west-2 using a cost-optimized, smaller instance type (e.g., db.t3.micro). Write an AWS Lambda function triggered by a Route 53 health check failure to modify the instance type to match the primary instance size and then promote it to primary.

Configure a Route 53 Active-Active failover policy with latency routing to distribute traffic between the us-east-1 primary instance and the us-west-2 read replica. Enable Route 53 health checks on both endpoints so that writes are automatically routed to us-west-2 if us-east-1 becomes unavailable.

Show answer & explanation

Answer: Create a cross-region read replica of the primary database in us-west-2. In the event of a region-wide outage in us-east-1, promote the read replica in us-west-2 to a standalone DB instance, and update the application configuration to point to the new database endpoint.

Answer

Creating a cross-region read replica in us-west-2 provides asynchronous replication that keeps the replication lag under a few seconds, meeting the 5-minute Recovery Point Objective (RPO). In the event of a region-wide outage, manually promoting the read replica to a standalone database instance takes under 10 minutes, satisfying the 15-minute Recovery Time Objective (RTO). Once promoted, pointing the application configuration to the new endpoint restores write traffic.

Step-by-Step Solution

Deploy a cross-region read replica of the primary Amazon RDS for PostgreSQL instance in us-west-2 to establish asynchronous replication.

Database updates are continuously replicated to us-west-2 with low replication lag, satisfying the 5-minute RPO requirement.

This sets up the target database in the secondary region to act as the recovery destination.

During a region-wide failure in us-east-1, initiate the promotion of the us-west-2 read replica to a standalone DB instance.

The replica is disconnected from replication and becomes a primary read-write database instance, taking approximately 5 to 10 minutes.

Promotion is necessary because read replicas cannot accept write operations, and the promotion process is within the 15-minute RTO.

Update the application's database connection strings or DNS records to route active client traffic to the newly promoted DB endpoint in us-west-2.

Client application traffic is successfully redirected to the new write-capable database instance in the secondary region.

This completes the disaster recovery failover path and restores full write functionality.

Key Concept

Cross-Region Disaster Recovery with Amazon RDS Read Replicas

Question 245Question →

A retail company expects a massive surge in website traffic during an upcoming marketing campaign. The company needs to design a high-performing data ingestion solution to collect clickstream data in JSON format, transform it into Apache Parquet format, and store it in Amazon S3 for near-real-time analytics. The volume of incoming data is highly unpredictable and fluctuates rapidly. The solution must scale automatically to handle peak throughput without any manual intervention or administrative overhead. Which solution meets these requirements with the highest performance and the least operational effort?

Deploy Amazon Kinesis Data Firehose to ingest the clickstream data, configure it to invoke an AWS Lambda function for inline data transformation, and set the destination to Amazon S3.

Create an Amazon Kinesis Data Stream with a fixed pool of provisioned shards, and deploy a custom consumer script running on Amazon EC2 instances to read, transform, and write the data to Amazon S3.

Publish the incoming clickstream events to a standard Amazon SQS queue, and trigger an AWS Lambda function to process the messages, transform the payload, and write them sequentially to Amazon S3.

Configure the web application to write raw log files to Amazon S3, and trigger an AWS Lambda function running continuously on a scheduled basis to poll, transform, and rewrite the files to Parquet format.

Show answer & explanation

Answer: Deploy Amazon Kinesis Data Firehose to ingest the clickstream data, configure it to invoke an AWS Lambda function for inline data transformation, and set the destination to Amazon S3.

Answer

Deploy Amazon Kinesis Data Firehose to ingest the clickstream data, configure it to invoke an AWS Lambda function for inline data transformation, and set the destination to Amazon S3.

The correct option is to use Amazon Kinesis Data Firehose with inline AWS Lambda transformation. Kinesis Data Firehose is a fully managed streaming service that scales automatically to accommodate unpredictable traffic spikes without manual intervention. It offers native integration with AWS Lambda to perform serverless, real-time data transformations (such as converting JSON to Parquet) before delivering the data directly to Amazon S3, maximizing ingestion performance while minimizing operational overhead.

Step-by-Step Solution

Analyze the requirements for data ingestion scale and management overhead.

The ingestion system must handle highly unpredictable peak volume automatically with the least operational effort.

This rules out solutions requiring manual shard provisioning or server management.

Evaluate the transformation and destination requirements.

Data must be transformed from JSON to Parquet and delivered to Amazon S3 in near-real-time.

Kinesis Data Firehose provides native integration with AWS Lambda for inline transformation and outputs directly to Amazon S3.

Compare scaling and integration features of Kinesis Data Streams, SQS, and Firehose.

Kinesis Data Firehose scales automatically without shard provisioning, maintains streaming ingestion, and integrates with Lambda to output Parquet, making it the most performant and low-overhead choice.

It avoids Kinesis Data Streams shard limit throttling, SQS ordering issues, and Lambda continuous running inefficiencies.

Key Concept

High-performing streaming data ingestion with automatic scaling and inline serverless transformation using Kinesis Data Firehose and AWS Lambda.

Estimated Time:1m 30s

Question 246Question →

An enterprise uses a multi-account AWS architecture. Internal auditors authenticate via an identity provider (IdP) federated with a central Identity AWS account. The auditors need to read sensitive audit logs stored in an Amazon S3 bucket located in a separate Production AWS account. The S3 bucket is encrypted using a customer managed AWS KMS key in the Production account. A solutions architect must design a secure access strategy that adheres to the principle of least privilege.

Which strategy should the solutions architect implement to meet these requirements?

Configure SAML 2.0 federation to allow auditors to assume an IAM role in the Identity account, which then assumes a cross-account IAM role in the Production account. Attach an IAM policy to the Production role allowing s3:GetObject on the bucket and kms:Decrypt on the KMS key. Configure the S3 bucket policy and the KMS key policy in the Production account to explicitly trust the Production IAM role.

Create individual IAM users for each auditor in the Production account. Share long-term access keys for these users, and assign them to an IAM group with policies allowing s3:GetObject on the S3 bucket and kms:Decrypt on the KMS key. Configure the S3 bucket policy and the KMS key policy to trust the IAM group.

Configure the federated IdP to allow access using the Production account's root user credentials for audit operations. Modify the KMS key policy to permit all decrypt operations to the root user, and configure the S3 bucket policy to allow public read access restricted only by the root user's session.

Configure the auditors' application to authenticate using an IAM role. Store the S3 bucket credentials and KMS decryption keys as plaintext String parameters in AWS Systems Manager Parameter Store in the Production account, allowing the application to retrieve them at runtime to decrypt the audit logs.

Show answer & explanation

Answer: Configure SAML 2.0 federation to allow auditors to assume an IAM role in the Identity account, which then assumes a cross-account IAM role in the Production account. Attach an IAM policy to the Production role allowing s3:GetObject on the bucket and kms:Decrypt on the KMS key. Configure the S3 bucket policy and the KMS key policy in the Production account to explicitly trust the Production IAM role.

Answer

The correct strategy establishes identity federation to avoid creating long-term IAM users, uses cross-account role assumption to bridge the Identity and Production accounts, and configures the necessary trust/permission policies across IAM, S3, and KMS. In cross-account scenarios, S3 bucket policies and KMS key policies must explicitly grant access to the external role, and the role's policy itself must permit the corresponding API calls.

Step-by-Step Solution

Establish federated identity access using SAML 2.0 with an Identity provider.

Users authenticate against the corporate directory and assume an IAM role in the central Identity account without requiring long-term IAM user credentials.

This centralizes identity management and follows AWS best practices for enterprise user access.

Configure cross-account IAM role assumption from the Identity account to the Production account.

The IAM role in the Identity account is trusted to assume a target role in the Production account.

This enables secure boundaries across different AWS accounts in a multi-account landing zone.

Assign least-privilege permissions to the target IAM role in the Production account and configure resource-based policies.

The target IAM role is granted permission to get objects and decrypt them via KMS. The S3 bucket policy and KMS key policy explicitly trust the target IAM role.

For cross-account resource access (specifically S3 and KMS), both the caller's IAM policy and the resource-based policy must explicitly allow the action.

Key Concept

Cross-Account IAM delegation and Resource Access with KMS Decryption under Federated Identities

Estimated Time:3m 0s

Question 247Question →

A global healthcare SaaS provider hosts its telemedicine platform on AWS. The architecture consists of an Amazon CloudFront distribution caching static web content, an Application Load Balancer (ALB), and an Amazon ECS cluster running containerized microservices on AWS Fargate. During a high-profile launch, the platform experiences a distributed denial of service (DDoS) attack consisting of a massive Layer 3/4 UDP reflection attack, a Layer 7 HTTP GET flood targeting the patient search API endpoint, and concurrent SQL injection attempts on the database through the search parameters. The provider needs to implement a solution that automatically detects and mitigates the Layer 3/4 volumetric attacks at the network edge, identifies and blocks the SQL injection attempts and the Layer 7 HTTP GET flood before they reach the ECS cluster, protects the organization from unexpected billing spikes caused by the scale-up of resources during the attack, and prevents attackers from bypassing CloudFront and targeting the ALB directly. Which combination of configurations should the solutions architect implement to meet these requirements?

Subscribe to AWS Shield Advanced and associate it with the ECS Fargate service. Configure stateless Network ACLs in the public subnets to block the IP addresses associated with the Layer 3/4 UDP reflection and the Layer 7 HTTP GET flood. Deploy AWS WAF on the ALB to inspect and block SQL injection attempts.

Subscribe to AWS Shield Advanced and associate it with both the CloudFront distribution and the ALB. Deploy AWS WAF on the CloudFront distribution with a rate-based rule for the search endpoint and a SQL injection inspection rule. Configure the ALB security group to allow inbound traffic only from the CloudFront managed prefix list, and restrict the ECS security group to allow traffic only from the ALB.

Deploy AWS WAF on the CloudFront distribution with a rate-based rule and SQL injection inspection rules. Configure the ALB listener rules to allow traffic only when a custom HTTP header shared with CloudFront is present. Rely on AWS Shield Standard to automatically mitigate Layer 3/4 attacks and provide financial protection against scaling charges incurred by the ALB and ECS cluster.

Deploy AWS WAF on the CloudFront distribution and associate it with an AWS Shield Standard protection group. Create a security group for the ALB that allows inbound traffic only from the public IP ranges of AWS WAF. Implement rate-limiting at the ECS container level using application-specific middleware.

Show answer & explanation

Answer: Subscribe to AWS Shield Advanced and associate it with both the CloudFront distribution and the ALB. Deploy AWS WAF on the CloudFront distribution with a rate-based rule for the search endpoint and a SQL injection inspection rule. Configure the ALB security group to allow inbound traffic only from the CloudFront managed prefix list, and restrict the ECS security group to allow traffic only from the ALB.

Answer

Subscribing to AWS Shield Advanced and protecting both Amazon CloudFront and the Application Load Balancer (ALB) provides automatic Layer 3/4 protection and cost protection for scaling charges of these resources. Applying AWS WAF rules at the CloudFront distribution allows Layer 7 rate-limiting and SQL injection protection to happen at the edge, blocking malicious requests before they reach the backend. Restricting the ALB security group to the CloudFront managed prefix list prevents attackers from bypassing the CDN to attack the load balancer directly, and restricting the ECS security group to allow traffic only from the ALB ensures proper multi-tier isolation.

Step-by-Step Solution

Select AWS Shield Advanced and associate it with the CloudFront distribution and the Application Load Balancer (ALB).

Establishes automatic mitigation of Layer 3/4 volumetric attacks at the edge and activates DDoS cost protection, allowing the company to request credits for scaling charges on the protected ALB and CloudFront resources.

AWS Shield Standard does not offer cost protection or advanced mitigation for scaling charges.

Deploy AWS WAF on the Amazon CloudFront distribution and configure rate-based rules alongside SQL injection detection rules.

Inspects and filters Layer 7 traffic at the CloudFront edge locations, blocking SQL injection attempts and rate-limiting the HTTP GET flood before they reach the ALB or the ECS Fargate containers.

Blocking malicious requests at the edge prevents backend resources from scaling up unnecessarily, saving costs and protecting performance.

Configure the ALB security group to restrict inbound traffic to the CloudFront managed prefix list.

Ensures that all incoming traffic to the ALB must originate from CloudFront, preventing attackers from bypassing CloudFront and hitting the load balancer directly.

Direct hits to the ALB bypass the AWS WAF rules and Shield Advanced protections configured on CloudFront.

Key Concept

Edge security design combining AWS Shield Advanced for L3/L4 volumetric protection and cost protection, AWS WAF for L7 application-layer filtering and rate-limiting, and CloudFront managed prefix lists to prevent origin bypass.

Estimated Time:3m 0s

Question 248Question →

A company wants to set up a multi-account environment on AWS. They need to automate the provisioning of new accounts with pre-configured security baselines. Additionally, they must manage user access by federating their existing external directory. Which combination of actions should a solutions architect recommend? (Select TWO.)

Select all that apply

Deploy a landing zone using AWS Control Tower and use Account Factory to provision new accounts.

Configure AWS IAM Identity Center to federate user authentication from the external directory.

Create individual IAM users in each member account with long-term credentials for the external directory users.

Use the AWS Organizations management account root user credentials to perform daily administrative tasks in member accounts.

Apply restrictive SCPs directly to the management account root user to limit its administrative capabilities.

Show answer & explanation

Answer: Deploy a landing zone using AWS Control Tower and use Account Factory to provision new accounts.; Configure AWS IAM Identity Center to federate user authentication from the external directory.

Answer

Deploy a landing zone using AWS Control Tower to automate account provisioning, and configure AWS IAM Identity Center to federate user authentication from the external directory.

AWS Control Tower is designed to establish a landing zone and automate the creation of member accounts using Account Factory with pre-defined governance. AWS IAM Identity Center provides centralized federation to external directories, allowing users to authenticate once and access authorized member accounts.

Step-by-Step Solution

Evaluate the requirement for automating multi-account provisioning with security guardrails.

Identify AWS Control Tower as the primary service for creating a landing zone and provisioning accounts via Account Factory.

AWS Control Tower automates the setup of a secure, multi-account AWS environment using best practices.

Evaluate the requirement for central identity federation using an external corporate directory.

Identify AWS IAM Identity Center as the service to connect the external directory and manage centralized single sign-on access.

AWS IAM Identity Center allows federated users to access multiple AWS accounts without managing credentials locally in IAM.

Key Concept

Multi-account management and centralized federation in AWS Organizations.

Estimated Time:1m 0s

Question 249Question →

A company hosts a public-facing web application on AWS. The company needs to protect the application from common web exploits, such as SQL injection, and from infrastructure-layer DDoS attacks, such as UDP floods. Which two AWS services should the solutions architect utilize to meet these requirements? (Select TWO.)

Select all that apply

AWS WAF to inspect incoming HTTP/HTTPS traffic and block common web exploits

AWS Shield Standard to safeguard the application against common Layer 3 and Layer 4 DDoS attacks

Network Access Control Lists (NACLs) to block SQL injection payloads at the subnet boundary

Security Groups to analyze application-layer payloads and prevent cross-site scripting

Amazon Inspector to continuously monitor and block incoming UDP flood attacks in real time

Show answer & explanation

Answer: AWS WAF to inspect incoming HTTP/HTTPS traffic and block common web exploits; AWS Shield Standard to safeguard the application against common Layer 3 and Layer 4 DDoS attacks

Answer

To meet the requirements, the solutions architect should use AWS WAF to inspect HTTP/HTTPS traffic and block web exploits like SQL injection, and use AWS Shield Standard to protect against infrastructure-layer DDoS attacks like UDP floods.

The correct options are the services that inspect and protect different layers of the application network stack. AWS WAF provides Layer 7 inspection to block common web exploits like SQL injection by analyzing the HTTP request payload. AWS Shield Standard provides automatic Layer 3 and Layer 4 DDoS protection to mitigate infrastructure attacks like UDP floods before they reach the application resources.

Step-by-Step Solution

Identify the service required to protect against Layer 7 application-layer exploits (such as SQL injection).

AWS WAF is designed specifically for this purpose, inspecting HTTP/HTTPS traffic at Layer 7.

Web application firewalls inspect the payload of HTTP requests to identify and block patterns associated with SQL injection and cross-site scripting.

Identify the service required to protect against Layer 3 and Layer 4 infrastructure DDoS attacks (such as UDP floods).

AWS Shield Standard provides automatic protection against these types of attacks at the AWS edge.

AWS Shield Standard operates at the network and transport layers to defend resources from high-volume attacks like UDP floods.

Evaluate the remaining options to ensure they do not meet the security and architectural requirements.

Security groups and Network ACLs operate at Layer 3/4 but lack application-layer inspection or automatic managed DDoS mitigation capabilities. Amazon Inspector is a vulnerability scanner, not a real-time traffic filtering or DDoS protection tool.

This confirms that the selected services are the correct and optimal choices for the architecture.

Key Concept

Combining AWS WAF for Layer 7 application protection and AWS Shield Standard for Layer 3/4 infrastructure DDoS protection is the standard AWS best practice for edge security.

Estimated Time:1m 0s

Question 250Question →

A Solutions Architect is designing the multi-account governance and security framework for an enterprise using AWS Organizations. The organization consists of separate Organizational Units (OUs) for Core Services, Production Workloads, and Development Sandboxes. The compliance team requires that no member account be able to modify or delete centralized AWS CloudTrail and AWS Config configurations. Additionally, corporate users must authenticate using an external SAML 2.0 identity provider to access target member accounts using temporary credentials, minimizing administrative overhead in individual accounts. Finally, these controls must not restrict management functions or billing administrative tasks in the management account. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center to federate with the external identity provider using SAML 2.0, and assign permission sets to manage access across member accounts.

Create an SCP that denies the ability to delete or modify AWS CloudTrail and AWS Config resources, and attach it to the organization's root or specific OUs.

Apply an SCP directly to the management account to restrict administrative users and prevent them from deleting or disabling auditing resources.

Create IAM users in the organization's management account for each corporate user, and configure cross-account IAM roles in the member accounts to enable federated access.

Generate long-term IAM access keys for each corporate user in a centralized security account, and configure the external identity provider to pass these keys during federation.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external identity provider using SAML 2.0, and assign permission sets to manage access across member accounts.; Create an SCP that denies the ability to delete or modify AWS CloudTrail and AWS Config resources, and attach it to the organization's root or specific OUs.

Answer

Configure AWS IAM Identity Center to federate with the external identity provider using SAML 2.0, and assign permission sets to manage access across member accounts. Create an SCP that denies the ability to delete or modify AWS CloudTrail and AWS Config resources, and attach it to the organization's root or specific OUs.

Centralizing identity access via AWS IAM Identity Center allows integration with an external SAML 2.0 identity provider to manage users and permission sets centrally, providing short-term credentials without creating IAM users in every account. Additionally, Service Control Policies (SCPs) applied at the organization's root or OUs prevent member accounts from modifying auditing resources, while leaving the management account unaffected because SCPs do not apply to it.

Step-by-Step Solution

Identify the mechanism for centralized identity federation.

AWS IAM Identity Center is selected to federate with the SAML 2.0 identity provider, enabling single sign-on with short-term credentials across member accounts.

This avoids manual IAM user creation and complies with security best practices.

Determine the control policy type for compliance enforcement across member accounts.

An SCP is designed to deny deletion or modification of AWS CloudTrail and AWS Config.

SCPs allow global permission boundaries to be enforced across all member accounts within an OU or the entire organization.

Evaluate the impact on the management account.

The SCP is attached to the organization's root or specific OUs. Since SCPs do not apply to the management account, the management account's administrative and billing functions remain unrestricted.

This satisfies the requirement that governance controls do not disrupt the management account's functions.

Key Concept

Centralized governance via AWS Organizations SCPs and identity federation via AWS IAM Identity Center.

Question 251Question →

A company is running a web application on Amazon EC2 instances deployed across multiple Availability Zones in a single AWS Region. The application requires a shared file system that allows concurrent read and write access from all EC2 instances, while maintaining high availability and durability across the entire region. Which storage service should a Solutions Architect recommend?

Amazon Elastic File System (Amazon EFS)

Amazon Elastic Block Store (Amazon EBS) gp3 volumes

Amazon S3 Glacier Flexible Retrieval

Amazon RDS with Read Replicas in each Availability Zone

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS)

Answer

Amazon Elastic File System (Amazon EFS)

The correct answer is Amazon Elastic File System (Amazon EFS) because it is a managed shared file system that natively replicates data across multiple Availability Zones within an AWS Region. It supports the Network File System (NFSv4) protocol, allowing hundreds of EC2 instances in different Availability Zones to concurrently read and write to the same storage system, thereby meeting the high availability and resilience requirements.

Step-by-Step Solution

Analyze the application requirements.

The application requires a shared file storage solution that supports concurrent read/write operations from EC2 instances across multiple Availability Zones.

This rules out single-AZ block storage systems like standard EBS, as well as database-specific solutions or archival solutions.

Evaluate the capabilities of Amazon EFS.

Amazon EFS provides a serverless, shared file system that is natively designed to span multiple Availability Zones within a region and allows concurrent connections.

This aligns perfectly with the high availability and cross-AZ concurrent access requirements.

Key Concept

Shared file storage spanning multiple Availability Zones

Question 252Question →

A logistics company wants to ingest GPS coordinate telemetry from a fleet of 50,000 delivery vehicles. The telemetry data must be stored in Amazon S3 in near-real-time (within 5 minutes) for operational dashboarding. The system must scale automatically to handle changes in traffic throughout the day while requiring minimal management of infrastructure. Which solution should a solutions architect recommend to meet these requirements?

Configure Amazon Data Firehose to collect the telemetry data and write it directly to the Amazon S3 bucket.

Use Amazon Kinesis Data Streams to ingest the telemetry data and configure a static number of shards to write the data to Amazon S3.

Deploy Amazon SQS standard queues to ingest the telemetry data, and use AWS Lambda to retrieve the messages and write them to Amazon S3 in chronological order.

Configure AWS Lambda functions to run continuously in a loop to poll the telemetry data from the vehicles and write it to Amazon S3.

Show answer & explanation

Answer: Configure Amazon Data Firehose to collect the telemetry data and write it directly to the Amazon S3 bucket.

Answer

Configure Amazon Data Firehose to collect the telemetry data and write it directly to the Amazon S3 bucket.

The correct solution uses Amazon Data Firehose to ingest the GPS telemetry data. Firehose is a fully managed service that automatically scales to match data volume, requires zero operational overhead for infrastructure, and can natively deliver data directly to Amazon S3 based on a time or size buffer (such as the 5-minute requirement).

Step-by-Step Solution

Identify the key requirements of the scenario.

The solution requires streaming data ingestion, automatic scaling, near-real-time delivery to Amazon S3 (within 5 minutes), and minimal operational overhead.

This establishes the criteria needed to select the best AWS service combination.

Evaluate Amazon Data Firehose against the requirements.

Firehose is a fully managed service that scales automatically, allows buffer configuration up to 5 minutes, and natively writes directly to Amazon S3 with zero administration of servers.

Firehose perfectly matches the low-overhead and S3 target requirements.

Compare against the alternative options.

Kinesis Data Streams requires active shard management. SQS standard queues do not guarantee order and require writing custom consumer applications. Continuous Lambda functions violate serverless runtime limits and inflate cost.

This confirms that the other solutions fail to meet the performance scaling or low operational overhead criteria.

Key Concept

Serverless streaming ingestion and delivery to Amazon S3 using Amazon Data Firehose.

Estimated Time:1m 0s

Question 253Question →

A financial services company hosts a latency-sensitive market data API on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. Customers in London and Tokyo are experiencing connection timeouts and high latency when accessing the API. The client applications require static IP addresses to comply with their strict egress firewall policies. Additionally, the network design must minimize TCP connection establishment latency and bypass the routing inefficiencies of the public internet. Which solution should a solutions architect recommend to optimize the network performance for the global clients?

Configure Amazon Route 53 with latency-based routing policies to resolve the API domain name to the ALB in us-east-1.

Establish an AWS Site-to-Site VPN connection using a single VPN tunnel to route all client traffic over the encrypted tunnel directly to the ALB.

Deploy AWS Global Accelerator to provide static Anycast IP addresses, terminating TCP connections at the edge and routing traffic over the AWS global network to the ALB.

Deploy an AWS Client VPN gateway and configure stateful Network Access Control Lists (Network ACLs) at the VPC boundary to track and prioritize client TCP sessions.

Show answer & explanation

Answer: Deploy AWS Global Accelerator to provide static Anycast IP addresses, terminating TCP connections at the edge and routing traffic over the AWS global network to the ALB.

Answer

Deploy AWS Global Accelerator to provide static Anycast IP addresses, terminating TCP connections at the edge and routing traffic over the AWS global network to the ALB.

AWS Global Accelerator provides two static Anycast IP addresses that serve as a single entry point for global clients, satisfying the firewall requirements. By terminating TCP connections at the AWS Edge Location closest to the clients, it reduces the Round-Trip Time (RTT) for connection establishment. The traffic is then routed over the private, congestion-free AWS global network to the Application Load Balancer in the us-east-1 Region, bypassing public internet routing inefficiencies.

Step-by-Step Solution

Analyze client requirements: static IP addresses for egress firewalls, reduced TCP connection establishment latency, and bypassing public internet routing inefficiencies.

Identified that DNS-based routing (Route 53) and traditional VPN solutions over the public internet are insufficient.

DNS resolutions do not provide fixed static IPs for client firewalls, and public routing introduces latency fluctuations.

Evaluate AWS network optimization options that leverage the private AWS backbone.

Determined that AWS Global Accelerator terminates TCP connections at the edge closest to clients and provides two static Anycast IP addresses.

Anycast IPs address the client firewall constraints, and terminating TCP connections at the edge reduces the Round-Trip Time (RTT) for the handshake.

Verify integration with the backend architecture in the target region.

AWS Global Accelerator integrates directly with the Application Load Balancer (ALB) in us-east-1, routing traffic over the AWS private global network.

This provides a highly available, high-performing path that avoids public internet routing fluctuations without requiring backend replication.

Key Concept

AWS Global Accelerator uses Anycast IP addresses and the AWS global network to optimize latency, TCP connection times, and reliability for global users.

Question 254Question →

A financial company hosts an auditing application on AWS. The application stores large transaction logs that must be retained for compliance. In the event of a regional outage, the company needs to recover the application in a secondary AWS Region. The recovery solution must achieve a Recovery Time Objective (RTO) of $20$ minutes and a Recovery Point Objective (RPO) of $1$ hour.

Which storage and disaster recovery configuration meets these requirements?

Store the transaction logs in an Amazon S3 bucket in the primary Region. Configure S3 Cross-Region Replication (CRR) to replicate the logs to an S3 Standard bucket in the secondary Region, and deploy a Warm Standby environment in the secondary Region.

Store the transaction logs in an Amazon S3 bucket. Configure S3 Cross-Region Replication to copy the logs to Amazon S3 Glacier Flexible Retrieval in the secondary Region, and use standard retrieval to access the logs during a disaster.

Store the transaction logs in Amazon S3. In the secondary Region, implement a Pilot Light disaster recovery strategy where all backup storage volumes and compute environments are provisioned and restored from snapshots only after a failover is initiated.

Store the transaction logs in an Amazon RDS database with Multi-AZ enabled, and configure a cross-region Read Replica to automatically perform a failover and promote itself to the primary database when the primary Region goes offline.

Show answer & explanation

Answer: Store the transaction logs in an Amazon S3 bucket in the primary Region. Configure S3 Cross-Region Replication (CRR) to replicate the logs to an S3 Standard bucket in the secondary Region, and deploy a Warm Standby environment in the secondary Region.

Answer

Store the transaction logs in Amazon S3 and replicate them using Cross-Region Replication to a secondary Region with S3 Standard, and deploy a Warm Standby environment in the secondary Region.

The correct answer combines Amazon S3 Cross-Region Replication (CRR) and a Warm Standby DR pattern. S3 CRR replicates transaction logs to a secondary Region within minutes, satisfying the 1-hour RPO. A Warm Standby deployment maintains scaled-down but active compute resources in the secondary Region, allowing the system to be scaled up and serve traffic within 20 minutes, thus satisfying the 1-hour RPO and 20-minute RTO requirements.

Step-by-Step Solution

Analyze RPO requirements

An RPO of 1 hour requires the storage layer to replicate data to the secondary Region in less than 1 hour.

Amazon S3 Cross-Region Replication (CRR) replicates objects within minutes, meeting the 1-hour RPO.

Analyze RTO requirements

An RTO of 20 minutes requires application infrastructure to be ready to handle traffic rapidly, which cannot be met by deploying resources from scratch or restoring backups dynamically.

A Warm Standby disaster recovery strategy provides a scaled-down but active copy of the infrastructure, allowing failover to complete well within the 20-minute limit.

Evaluate the database replication strategy

RDS Read Replicas do not support automatic cross-region failover, meaning manual promotion is required, which may not reliably fit the recovery process without pre-warmed infrastructure.

Correct database failover must be handled as part of the overall application recovery strategy, using multi-region replica promotion or manual orchestration within the Warm Standby framework.

Key Concept

Designing multi-region disaster recovery using S3 Cross-Region Replication and a Warm Standby architecture to meet strict RTO and RPO requirements.

Estimated Time:1m 30s

Question 255Question →

A company is setting up a hybrid network to migrate large application payloads from its on-premises environment to a VPC in the us-east-1 Region. The transfer process requires a secure, encrypted connection with a minimum throughput of $2\text{ Gbps}$ . Which solution should the solutions architect propose to meet this throughput requirement?

Establish an AWS Site-to-Site VPN connection terminating on an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, using multiple VPN tunnels.

Establish a single AWS Site-to-Site VPN connection terminating on a Virtual Private Gateway (VGW) and configure the customer gateway to utilize both IPSec tunnels simultaneously.

Deploy a single AWS Site-to-Site VPN connection and modify the subnet Network Access Control Lists (NACLs) to allow stateful session bypass to increase tunnel throughput.

Deploy multiple AWS Site-to-Site VPN connections and configure an Amazon Route 53 Latency routing policy to balance the payload transfer across the connections.

Show answer & explanation

Answer: Establish an AWS Site-to-Site VPN connection terminating on an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, using multiple VPN tunnels.

Answer

Establish an AWS Site-to-Site VPN connection terminating on an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, using multiple VPN tunnels.

The correct answer proposes utilizing AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing. Since individual AWS VPN tunnels are limited to

1.25\text{ Gbps}

, ECMP routing allows the system to distribute traffic across multiple active tunnels, effectively aggregating the bandwidth to meet the

2\text{ Gbps}

target.

Step-by-Step Solution

Identify the bandwidth requirement and the capabilities of standard AWS VPN connections.

The requirement is

2\text{ Gbps}

of secure throughput. A single AWS Site-to-Site VPN tunnel has a maximum throughput limit of

1.25\text{ Gbps}

This establishes that a single standard tunnel is insufficient to support the required bandwidth.

Determine the service required to aggregate multiple VPN tunnels.

AWS Transit Gateway supports Equal-Cost Multi-Path (ECMP) routing over VPN attachments.

ECMP allows traffic to be balanced across multiple VPN tunnels, effectively scaling the available bandwidth beyond the single tunnel limit.

Formulate the final architecture using AWS Transit Gateway and ECMP.

Establish multiple VPN tunnels terminating on a Transit Gateway and enable ECMP to scale the total throughput to meet the

2\text{ Gbps}

requirement.

This design successfully aggregates multiple

1.25\text{ Gbps}

tunnels to satisfy the bandwidth constraint while maintaining encrypted transit.

Key Concept

AWS Transit Gateway ECMP routing allows the aggregation of multiple Site-to-Site VPN tunnels to scale network throughput beyond the single tunnel limit of

1.25\text{ Gbps}

Estimated Time:2m 0s

Question 256Question →

A media company needs to securely back up large video archives from its on-premises data center to Amazon S3. The daily backup transfers require a secure, encrypted connection over the internet with a minimum throughput of $3\text{ Gbps}$ . Which network architecture should a solutions architect design to meet these throughput and security requirements?

Deploy a single AWS Site-to-Site VPN connection to a virtual private gateway (VGW), and configure stateful Network Access Control Lists (NACLs) to bypass the default tunnel bandwidth limits.

Set up a single AWS Site-to-Site VPN connection to an Amazon VPC virtual private gateway, and configure dynamic BGP routing to allow the tunnel to auto-scale up to

5\text{ Gbps}

Establish multiple AWS Site-to-Site VPN connections terminated on an AWS Transit Gateway, and enable Equal-Cost Multi-Path (ECMP) routing to aggregate the bandwidth of the VPN tunnels.

Implement Amazon Route 53 latency-based routing to distribute the backup data streams across multiple virtual private gateways in different AWS Regions to bypass the VPN tunnel limit.

Show answer & explanation

Answer: Establish multiple AWS Site-to-Site VPN connections terminated on an AWS Transit Gateway, and enable Equal-Cost Multi-Path (ECMP) routing to aggregate the bandwidth of the VPN tunnels.

Answer

Establish multiple AWS Site-to-Site VPN connections terminated on an AWS Transit Gateway, and enable Equal-Cost Multi-Path (ECMP) routing to aggregate the bandwidth of the VPN tunnels.

AWS Site-to-Site VPN connections have a maximum throughput of

1.25\text{ Gbps}

per tunnel. To achieve a throughput higher than this limit (such as the required

3\text{ Gbps}

) over encrypted VPN connections, a solutions architect must terminate the VPN connections on an AWS Transit Gateway. By enabling Equal-Cost Multi-Path (ECMP) routing on the Transit Gateway, traffic is distributed across multiple VPN paths, effectively aggregating their bandwidth to meet the demand.

Step-by-Step Solution

Identify the network throughput and security constraints.

The solution requires an encrypted connection over the public internet (VPN) with at least

3\text{ Gbps}

bandwidth.

Encryption over the internet points to AWS Site-to-Site VPN. However, a single VPN tunnel has a hard limit of

1.25\text{ Gbps}

Evaluate bandwidth aggregation options for VPN connections.

To scale past the

1.25\text{ Gbps}

limit of a single tunnel, multiple tunnels must be combined.

AWS Transit Gateway supports Equal-Cost Multi-Path (ECMP) routing, which allows load balancing traffic across multiple VPN paths simultaneously.

Design the architecture using AWS Transit Gateway and ECMP.

Terminating multiple VPN connections on the Transit Gateway with ECMP enabled aggregates their throughput to meet the

3\text{ Gbps}

requirement.

This configuration meets the performance requirement while maintaining IPsec encryption over the internet.

Key Concept

AWS Site-to-Site VPN throughput limits can be exceeded by terminating multiple VPN connections on an AWS Transit Gateway and enabling Equal-Cost Multi-Path (ECMP) routing.

Question 257Question →

A graphic design firm stores finished project assets averaging $150\text{ MB}$ in an Amazon S3 Standard bucket. The assets are frequently accessed for the first $15\text{ days}$ after creation. After $15\text{ days}$ , they are rarely accessed but must remain immediately retrievable. The firm requires all assets to be permanently deleted $45\text{ days}$ after creation. Which two actions should a solutions architect configure in the S3 Lifecycle policy to meet these requirements in the most cost-effective manner? (Choose two.)

Select all that apply

Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after

15\text{ days}

Configure the objects to expire after

45\text{ days}

Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after

20\text{ days}

Transition the objects to S3 Glacier Flexible Retrieval after

15\text{ days}

Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after

5\text{ days}

Show answer & explanation

Answer: Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after $15\text{ days}$ .; Configure the objects to expire after $45\text{ days}$ .

Answer

Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 15 days, and configure the objects to expire after 45 days.

To satisfy the requirements cost-effectively, objects should remain in S3 Standard for the first

15\text{ days}

when they are active. Transitioning them to S3 Standard-IA after

15\text{ days}

ensures they remain immediately retrievable while reducing storage costs. Because the lifecycle policy deletes the objects after

45\text{ days}

, the objects spend exactly

30\text{ days}

in S3 Standard-IA (

45 - 15 = 30

), which fulfills the minimum storage duration requirement without incurring any early deletion charges. Lastly, configuring the objects to expire after

45\text{ days}

satisfies the deletion requirement.

Step-by-Step Solution

Determine the initial storage period in S3 Standard.

The objects must stay in S3 Standard for the first

15\text{ days}

since they are frequently accessed and to avoid early retrieval fees.

Accessing objects frequently in S3 Standard-IA incurs high retrieval charges.

Select the appropriate storage tier for the rarely accessed phase.

Identify S3 Standard-IA as the cost-effective tier because it supports immediate retrieval.

Glacier tiers do not support the required immediate retrieval time.

Verify the minimum storage duration rule for S3 Standard-IA.

Transitioning at day

15

and expiring at day

45

keeps objects in S3 Standard-IA for exactly

30\text{ days}

(

45 - 15 = 30

This avoids the early deletion storage penalty since S3 Standard-IA has a minimum storage duration of

30\text{ days}

Define the expiration rule.

Configure objects to expire after

45\text{ days}

This satisfies the requirement to delete the assets after

45\text{ days}

Key Concept

S3 Lifecycle policies must align transition timelines with access patterns and storage tier minimum duration requirements (such as the 30-day minimum for S3 Standard-IA) to optimize costs.

Question 258Question →

A logistics company is optimizing the deployment costs of its application portfolio on AWS. The portfolio consists of the following workloads:
- A legacy enterprise resource planning (ERP) system hosted on Amazon EC2 instances that must run $24/7$ and cannot tolerate any service interruptions.
- A batch image-transcoding application hosted on AWS Fargate that processes files uploaded throughout the day, where tasks can be interrupted and retried without affecting the final output.
- A set of AWS Lambda functions that execute periodically to process API event requests.
- An Amazon RDS for PostgreSQL database instance that stores transactional data and must remain online continuously.

Which strategy should a solutions architect recommend to achieve the most cost-effective solution?

Purchase a Compute Savings Plan to cover the Amazon EC2 instances and AWS Lambda functions. Configure the AWS Fargate tasks for the image-transcoding application to use the Fargate Spot capacity provider. Purchase an Amazon RDS Reserved Instance for the PostgreSQL database.

Purchase a single Compute Savings Plan to cover the Amazon EC2 instances, AWS Lambda functions, and the Amazon RDS for PostgreSQL database. Configure the AWS Fargate tasks for the image-transcoding application to use the Fargate Spot capacity provider.

Purchase an EC2 Instance Savings Plan to cover the Amazon EC2 instances and the Amazon RDS for PostgreSQL database. Purchase a Compute Savings Plan to cover the AWS Lambda functions and the AWS Fargate tasks for the image-transcoding application.

Migrate the PostgreSQL database from Amazon RDS to run continuously as a containerized database within AWS Lambda functions configured with provisioned concurrency. Purchase a Compute Savings Plan to cover the Amazon EC2 instances, Fargate tasks, and Lambda functions.

Show answer & explanation

Answer: Purchase a Compute Savings Plan to cover the Amazon EC2 instances and AWS Lambda functions. Configure the AWS Fargate tasks for the image-transcoding application to use the Fargate Spot capacity provider. Purchase an Amazon RDS Reserved Instance for the PostgreSQL database.

Answer

The correct strategy combines a Compute Savings Plan to cover the Amazon EC2 instances and AWS Lambda functions, uses Fargate Spot for the fault-tolerant image-transcoding tasks, and utilizes an Amazon RDS Reserved Instance for the PostgreSQL database. Compute Savings Plans automatically apply across EC2, Fargate, and Lambda. Because the Fargate workload is batch-oriented and tolerant of interruptions, Fargate Spot offers the lowest cost model. Amazon RDS is not covered by Compute Savings Plans, so a dedicated RDS Reserved Instance must be purchased for the database instance.

Step-by-Step Solution

Analyze the workload characteristics and flexibility.

Identify that the legacy ERP system on EC2 and the RDS database require continuous

24/7

availability. The image-transcoding application on Fargate is fault-tolerant and can handle interruptions. The Lambda functions run periodically.

Matching workload needs to the appropriate purchasing models ensures high availability where required and maximum discounts where flexibility exists.

Determine the purchasing model for the Fargate batch application.

Select the Fargate Spot capacity provider.

Since the image-transcoding tasks can tolerate interruptions, Fargate Spot provides up to a

70\%

discount compared to Fargate On-Demand without needing commit-based savings plans.

Determine the coverage scope of Compute Savings Plans.

Map the Compute Savings Plan to the Amazon EC2 instances and AWS Lambda functions.

Compute Savings Plans apply to EC2, Fargate, and Lambda. Since the Fargate component is already optimized via Fargate Spot, the Compute Savings Plan will cover the baseline ERP EC2 instances and the event-driven Lambda functions.

Address the Amazon RDS database instance cost optimization.

Select an Amazon RDS Reserved Instance.

Compute Savings Plans do not cover RDS instances. An RDS Reserved Instance is the correct vehicle to obtain discounts for steady-state RDS database instances.

Key Concept

Compute Savings Plans apply to EC2, Fargate, and Lambda, but not RDS; RDS requires Reserved Instances.

Question 259Question →

A digital assets platform hosts a collaborative content creation application on Amazon EC2 instances distributed across three Availability Zones. The application requires a shared storage solution that supports concurrent read and write operations from all instances while maintaining high availability and durability. Additionally, the platform must archive finalized media assets. These archived assets must be stored with maximum durability, and the platform must guarantee that any archived asset can be retrieved within a Recovery Time Objective (RTO) of 5 minutes. Which combination of storage solutions meets these requirements?

Use Amazon Elastic File System (Amazon EFS) with the One Zone storage class for the shared application files. Store the archived media assets in Amazon S3 Glacier Flexible Retrieval and utilize Standard retrievals.

Use an Amazon EBS volume with Multi-Attach enabled to share files across all EC2 instances. Store the archived media assets in Amazon S3 Glacier Deep Archive and utilize Standard retrievals.

Use Amazon Elastic File System (Amazon EFS) with the Standard storage class for the shared application files. Store the archived media assets in Amazon S3 Glacier Flexible Retrieval and utilize Expedited retrievals.

Configure each EC2 instance with a local Amazon EBS volume and use a pilot light disaster recovery script to synchronize files between volumes. Store the archived media assets in Amazon S3 Standard and use a lifecycle policy to move them to Amazon S3 Glacier Flexible Retrieval with Bulk retrievals.

Show answer & explanation

Answer: Use Amazon Elastic File System (Amazon EFS) with the Standard storage class for the shared application files. Store the archived media assets in Amazon S3 Glacier Flexible Retrieval and utilize Expedited retrievals.

Answer

Use Amazon Elastic File System (Amazon EFS) with the Standard storage class for the shared application files, and store the archived media assets in Amazon S3 Glacier Flexible Retrieval utilizing Expedited retrievals.

The correct option provides a highly available, multi-AZ shared file storage solution using Amazon EFS Standard, which allows multiple EC2 instances to read and write concurrently. It also utilizes Amazon S3 Glacier Flexible Retrieval with Expedited retrievals, which typically complete in 1 to 5 minutes, satisfying the 5-minute RTO requirement.

Step-by-Step Solution

Evaluate the shared storage requirement for multiple EC2 instances distributed across three Availability Zones.

Identify that Amazon EFS Standard provides a fully managed, shared file system that supports simultaneous read/write access across multiple Availability Zones, whereas EBS Multi-Attach is limited to a single Availability Zone.

To ensure high availability and concurrent access across multiple AZs, EFS Standard is the appropriate choice.

Evaluate the recovery time objective (RTO) for retrieving archived media assets.

Identify that Amazon S3 Glacier Flexible Retrieval with Expedited retrievals fulfills the RTO requirement of 5 minutes by retrieving data in 1 to 5 minutes.

Standard and Bulk retrievals, as well as Glacier Deep Archive, have retrieval times ranging from several hours to 12 hours, which fail to meet the 5-minute RTO.

Key Concept

Multi-AZ shared file systems using Amazon EFS and matching S3 Glacier retrieval tiers with strict recovery time objectives.

Estimated Time:1m 30s

Question 260Question →

A healthcare provider runs a radiology application that uploads medical imaging files and associated metadata to Amazon S3. The daily data patterns are as follows:

* High-resolution MRI scans (average size $350\text{ MB}$ ) are accessed frequently by radiologists for the first $45\text{ days}$ . After $45\text{ days}$ , the scans are rarely accessed but must be retained for $5\text{ years}$ to comply with local regulations. The retrieval time for these files must not exceed $5\text{ hours}$ .
* Scan metadata reports (average size $8\text{ KB}$ ) are queried frequently for the first $10\text{ days}$ to generate analytics. After $10\text{ days}$ , these reports are no longer needed and should be deleted.

Which combination of Amazon S3 Lifecycle configurations will meet these requirements in the most cost-effective manner? (Select TWO.)

Select all that apply

Configure a lifecycle rule to transition the MRI scans to S3 Glacier Flexible Retrieval 45 days after creation.

Configure a lifecycle rule to transition the metadata reports to S3 Standard-Infrequent Access (S3 Standard-IA) 5 days after creation, and expire them after 10 days.

Configure a lifecycle rule to expire the metadata reports 10 days after creation.

Configure a lifecycle rule to transition the MRI scans to S3 Glacier Deep Archive 45 days after creation.

Configure a lifecycle rule to transition the metadata reports to S3 One Zone-Infrequent Access (S3 One Zone-IA) 7 days after creation, and expire them after 10 days.

Show answer & explanation

Answer: Configure a lifecycle rule to transition the MRI scans to S3 Glacier Flexible Retrieval 45 days after creation.; Configure a lifecycle rule to expire the metadata reports 10 days after creation.

Answer

Configure a lifecycle rule to transition the MRI scans to S3 Glacier Flexible Retrieval 45 days after creation, and configure a lifecycle rule to expire the metadata files 10 days after creation without transitioning them to another tier.

Transitioning the MRI scans to S3 Glacier Flexible Retrieval after 45 days is highly cost-effective and meets the 5-hour retrieval time SLA because standard retrieval takes 3-5 hours. For the metadata reports, keeping them in S3 Standard and directly expiring them after 10 days avoids the minimum storage duration (30 days) and minimum billing size (128 KB) penalties associated with transitioning small files to S3 Standard-IA or S3 One Zone-IA.

Step-by-Step Solution

Analyze the metadata reports' storage requirements.

The files are very small (

8\text{ KB}

) and have a short lifespan (

10\text{ days}

Knowing the size and lifespan allows us to evaluate if transitioning them to S3 Standard-IA or S3 One Zone-IA is cost-effective, considering their

128\text{ KB}

minimum storage size and

30\text{ day}

minimum duration rules.

Analyze the MRI scans' storage requirements and SLAs.

The scans are large (

350\text{ MB}

) and accessed frequently for

45\text{ days}

, after which they are rarely accessed for

5\text{ years}

with a retrieval time SLA of

5\text{ hours}

This determines which cold tier is suitable. S3 Glacier Flexible Retrieval has standard retrieval of

3\text{--}5\text{ hours}

and is cheaper than Standard or IA for long-term archival, whereas S3 Glacier Deep Archive takes up to

12\text{ hours}

Formulate the optimal S3 Lifecycle rules based on these constraints.

Transition the MRI scans to S3 Glacier Flexible Retrieval after

45\text{ days}

, and expire the metadata reports directly from S3 Standard after

10\text{ days}

This combination avoids early deletion penalties and minimum billing size charges for the small metadata files, while choosing the lowest cost archive tier that meets the retrieval SLA for the MRI scans.

Key Concept

Cost-optimized storage tiering requires matching data access patterns, file sizes, and retention needs with S3 storage class features, specifically respecting minimum storage durations (30 days for S3 Standard-IA and S3 One Zone-IA) and minimum object sizes (128 KB for IA classes).

PreviousPage 13 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept