All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A global financial services enterprise uses AWS Organizations to manage its multi-account environment. The security team needs to implement governance controls with the following requirements:
- Security audit teams require read-only access across all member accounts without managing local IAM credentials.
- No member account administrator can disable CloudTrail or delete the S3 buckets containing audit logs.
- Developers in sandbox accounts must have administrative privileges but must be prevented from launching GPU-based instance types (such as `p*` or `g*`) or creating resources outside of approved regions (`us-east-1` and `us-west-2`).
- Day-to-day administration of the AWS Organization must be delegated to administrators using temporary credentials, preventing the use of the management account's root credentials for routine tasks.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center integrated with the enterprise identity provider (IdP). Create a read-only permission set and assign it to the security audit team's group across the organization. Create administrative permission sets for day-to-day organization management in the management account.

Attach a Service Control Policy (SCP) at the organization root that denies log deletion and CloudTrail modification API calls. Attach a separate SCP to the Sandbox Organizational Unit (OU) that denies the `ec2:RunInstances` action for non-approved regions and GPU instance types.

Create individual IAM users in each member account for the security auditors, generating access keys and secret keys. Set up an IAM policy on the management account root user that denies organization modifications to prevent routine root user access.

Create a Service Control Policy (SCP) and attach it directly to the management account to restrict its root user from performing routine administration. Implement a custom IAM policy in the management account to block GPU instances and replicate it to all member accounts.

Attach an SCP to the Sandbox OU that allows GPU instances only in approved regions. For the audit access, configure a cross-account IAM role in each member account that trusts individual IAM user credentials created specifically for the audit team in the management account.

Show answer & explanation

Answer: Configure AWS IAM Identity Center integrated with the enterprise identity provider (IdP). Create a read-only permission set and assign it to the security audit team's group across the organization. Create administrative permission sets for day-to-day organization management in the management account.; Attach a Service Control Policy (SCP) at the organization root that denies log deletion and CloudTrail modification API calls. Attach a separate SCP to the Sandbox Organizational Unit (OU) that denies the `ec2:RunInstances` action for non-approved regions and GPU instance types.

Answer

The correct strategy combines configuring AWS IAM Identity Center integrated with the enterprise identity provider to govern administrative and audit access, along with deploying Service Control Policies (SCPs) at the organization root and organizational unit levels to enforce log protection and developer resource constraints.

The correct solution uses AWS IAM Identity Center to federate user access, allowing administrative and audit teams to log in using temporary credentials, which complies with the mandate to avoid root credentials. The application of SCPs at the organization root secures CloudTrail and S3 logs against member account admin modifications, and applying another SCP to the Sandbox OU isolates resource constraints to the developer environments.

Step-by-Step Solution

Address the centralized access and root credential requirements by setting up AWS IAM Identity Center.

Federation is established with the enterprise identity provider, mapping the audit group to a read-only permission set and the admin group to administrative permission sets. This avoids local credentials and management account root user usage.

AWS IAM Identity Center provides centralized access management with temporary credentials, adhering to compliance and least-privilege mandates.

Address the log protection requirement by writing a Service Control Policy (SCP) that restricts S3 bucket deletion and CloudTrail modifications.

An SCP containing deny actions for S3 and CloudTrail is applied at the root of the AWS Organization.

SCPs apply to all member accounts in the organization, preventing even local administrators from disabling logs or deleting audit trails.

Address the sandbox constraints by writing an SCP that restricts regions and instance types.

An SCP is attached directly to the Sandbox Organizational Unit (OU), preventing developers from running unauthorized instance types or operating in unauthorized regions.

Applying the SCP at the OU level ensures sandbox constraints do not affect production workloads or core security operations.

Key Concept

Centralized multi-account governance using AWS Organizations SCPs for policy guardrails combined with AWS IAM Identity Center for federated identity control.

Estimated Time:3m 0s

Question 302Question →

A financial services startup is establishing its AWS cloud architecture. The organization needs to centralize authentication using its external Okta directory and restrict member accounts from modifying or deleting baseline security auditing configurations. Additionally, the security policy prohibits the use of long-term credentials for daily operations. Which two actions should be performed to establish this administrative governance model? (Select TWO.)

Select all that apply

Integrate AWS IAM Identity Center with the Okta directory to allow users to sign in and assume permission sets using temporary security credentials.

Deploy a Service Control Policy (SCP) at the root level of the organization to prevent member accounts from stopping or modifying CloudTrail logging configurations.

Create individual IAM users in each member account with long-term security credentials and configure local trust policies for Okta integration.

Configure the daily administrative tasks to be run directly by using the management account's root user credentials to ensure complete oversight.

Configure the API access keys for the external identity provider by storing them as plaintext String parameters in Systems Manager Parameter Store across all member accounts.

Show answer & explanation

Answer: Integrate AWS IAM Identity Center with the Okta directory to allow users to sign in and assume permission sets using temporary security credentials.; Deploy a Service Control Policy (SCP) at the root level of the organization to prevent member accounts from stopping or modifying CloudTrail logging configurations.

Answer

Integrating AWS IAM Identity Center with Okta for temporary credential generation, and deploying an organization-level Service Control Policy to protect CloudTrail logging configurations.

Integrating AWS IAM Identity Center with the external directory allows federated users to obtain short-term credentials, eliminating static credential storage. Implementing a Service Control Policy at the organization root enforces compliance and protects logging systems from modifications by administrators in individual member accounts.

Step-by-Step Solution

Centralize identity governance and single sign-on access.

Integrate Okta with AWS IAM Identity Center using SAML and SCIM protocols.

This allows users to authenticate using their existing enterprise credentials and obtain temporary security credentials for AWS access, satisfying the requirement to avoid long-term credentials.

Enforce organization-wide audit policies.

Create and attach a Service Control Policy (SCP) to the organization's root OU that denies the cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.

SCPs define permission guardrails across all member accounts, ensuring that local administrators in member accounts cannot modify the auditing configurations.

Key Concept

Centralized identity federation and multi-account security guardrails using Service Control Policies.

Question 303Question →

A Solutions Architect is designing the governance strategy for a company's multi-account environment managed by AWS Organizations. The company requires central control over user access using an external identity provider. Additionally, they must ensure that CloudTrail logging cannot be disabled in any member account. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center to federate access with the company's external identity provider.

Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.

Create IAM users in each member account and share long-term credentials with users in the external directory.

Use the management account root credentials to configure daily security policies and perform user authorization.

Attach a Service Control Policy (SCP) to the management account to prevent its own administrator users from stopping CloudTrail logging.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate access with the company's external identity provider.; Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.

Answer

Configure AWS IAM Identity Center to federate access with the company's external identity provider, and create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.

Centralized access control is best achieved by integrating AWS IAM Identity Center with the external identity provider. Enforcing organization-wide security boundaries (such as preventing the disabling of CloudTrail) is done via Service Control Policies (SCPs) attached to the organization's root or organizational units (OUs), which restrict actions in all member accounts.

Step-by-Step Solution

Set up centralized identity federation.

AWS IAM Identity Center is connected to the external identity provider, allowing users to log into member accounts without needing local credentials.

This simplifies governance and complies with single sign-on security standards.

Establish guardrails against disabling logging.

A Service Control Policy denying the cloudtrail:StopLogging action is created and attached to the root of the organization.

SCPs allow centralized restriction of actions across all member accounts in the organization, preventing users from altering vital security logging.

Key Concept

Centralized multi-account governance using AWS Organizations Service Control Policies (SCPs) and federated access with AWS IAM Identity Center.

Question 304Question →

A retail company hosts a web application on AWS. The solutions architect needs to configure a security solution that blocks malicious SQL injection payloads in incoming HTTP requests before they reach the backend application. Which AWS service should the solutions architect deploy to meet this requirement?

AWS WAF

AWS Shield Standard

Network Access Control Lists (NACLs)

Security Groups

Show answer & explanation

Answer: AWS WAF

Answer

AWS WAF

AWS WAF (Web Application Firewall) operates at the application layer (Layer 7) and allows you to monitor HTTP and HTTPS requests that are forwarded to protected resources, such as an Application Load Balancer or Amazon CloudFront. It includes built-in managed rules to detect and block common exploits, including SQL injection payloads, before they reach backend servers.

Step-by-Step Solution

Identify the target layer of the threat.

The threat is SQL injection, which occurs at the application layer (Layer 7) of the OSI model.

Security controls must be chosen based on the network layer they operate on.

Evaluate the capabilities of the proposed services.

Only AWS WAF operates at Layer 7 and is capable of inspecting HTTP/HTTPS payloads to block SQL injection patterns.

Layer 3/4 controls like Shield Standard, Network ACLs, and Security Groups do not have visibility into HTTP payload contents.

Key Concept

AWS WAF protects applications at the application layer (Layer 7) from web exploits like SQL injection, whereas AWS Shield Standard and VPC security controls operate at lower layers (Layer 3/4) to mitigate network-level attacks.

Estimated Time:45s

Question 305Question →

An enterprise uses AWS IAM Identity Center to federate identity provider users into their AWS development account. The junior solutions architects in this account need the ability to create and manage IAM roles for Amazon EC2 instances. However, the senior security team requires that these junior architects must not be able to elevate their own permissions or assign administrative permissions to the EC2 instances they configure. Which TWO actions should the solutions architect take to meet these requirements?

Select all that apply

Create a permissions boundary IAM policy that defines the maximum permissions that the junior architects can delegate to the EC2 roles.

Attach an IAM policy to the junior architects' federated role that permits role creation only when the request includes the permissions boundary condition referencing the boundary policy.

Create individual IAM users with long-term access keys for each junior architect to bypass identity federation and assign them direct administrative access.

Provide the junior architects with temporary access to the AWS account root user credentials to perform administrative role creation tasks.

Store the role permissions as a plaintext String in an AWS Systems Manager Parameter Store parameter, and configure the EC2 instances to retrieve and apply the permissions at startup.

Show answer & explanation

Answer: Create a permissions boundary IAM policy that defines the maximum permissions that the junior architects can delegate to the EC2 roles.; Attach an IAM policy to the junior architects' federated role that permits role creation only when the request includes the permissions boundary condition referencing the boundary policy.

Answer

To secure delegated role creation, the solutions architect should create a permissions boundary policy to define the maximum delegated permissions and require the junior architects to apply this boundary policy whenever they create an IAM role.

Delegating the creation of IAM roles to non-administrator users without risk of privilege escalation is achieved using IAM Permissions Boundaries. First, a permissions boundary policy defines the upper limit of permissions. Second, the policy governing the creators (junior architects) is configured to require this permissions boundary when executing role creation commands. This prevents them from granting administrative rights or access they do not possess.

Step-by-Step Solution

Define the boundaries of delegation.

A permissions boundary policy is created in IAM that outlines the maximum set of permissions a junior architect can assign.

This establishes a hard limit on what the newly created roles can do, regardless of the policies attached to them.

Enforce boundary usage on role creation.

An IAM policy is attached to the junior architects' role containing a condition that permits iam:CreateRole and iam:PutRolePolicy/iam:AttachRolePolicy only if the iam:PermissionsBoundary matches the boundary policy ARN.

This prevents junior architects from creating unmanaged or administrative roles that could bypass security limits.

Key Concept

Delegated Administration with IAM Permissions Boundaries

Question 306Question →

A media streaming company is organizing its cloud footprint using AWS Organizations. To enforce compliance, the security team must restrict specific activities within member accounts without affecting the management account. The environment consists of a Production OU and a Sandbox OU. The compliance rules are:

1. Production accounts must not be able to disable AWS Security Hub or modify resource-tagging policies.
2. Sandbox accounts must be prohibited from launching EC2 instances that are not of the 't3' or 'm5' instance families.

Which combination of actions should a Solutions Architect implement to meet these governance requirements? (Select TWO.)

Select all that apply

Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes.

Attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.

Attach the compliance SCPs directly to the Organization Root to ensure they inherit down to the management account and all member OUs.

Create individual IAM users in each member account for developers and administrators, and configure IAM inline policies to restrict these actions.

Configure the root credentials of the management account to run a daily scheduled script that terminates non-compliant EC2 instances and recreates deleted tag policies in all member accounts.

Show answer & explanation

Answer: Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes.; Attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.

Answer

Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes, and attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.

The correct strategy combines target-specific Service Control Policies (SCPs) attached directly to the respective Organizational Units (OUs). Attaching a policy to prevent disabling Security Hub and modifying tag policies directly to the Production OU ensures that compliance is enforced only for production resources. Similarly, attaching an SCP restricting instance types to the Sandbox OU ensures developers have freedom to experiment within cost-effective boundaries. In both cases, the policies do not affect the management account, which satisfies the requirement to exclude it from the restrictions.

Step-by-Step Solution

Analyze the scope of the governance requirements for the Production OU and the Sandbox OU.

Identified that the Production OU requires restriction of Security Hub and tag policy modifications, while the Sandbox OU requires restricting EC2 instance types to t3 and m5 families. The management account must remain unaffected.

To design the correct AWS Organizations structure and policy placement without causing unintended policy inheritance across OUs.

Select the appropriate mechanism to enforce governance across member accounts centrally.

Determined that Service Control Policies (SCPs) are the native tool in AWS Organizations to restrict actions at the member account level, and they do not apply to the management account.

SCPs act as guardrails that define the maximum permissions for member accounts without affecting the management account's administrative access.

Formulate the SCPs and attach them to their target Organizational Units.

Created one SCP targeting Security Hub and tagging controls, attaching it to the Production OU. Created a second SCP targeting EC2 instance type restrictions using the ec2:InstanceType condition key, attaching it to the Sandbox OU.

Attaching the policies directly to the specific OUs applies the rules target-selectively, preventing policies from bleeding over to unintended OUs (e.g. preventing sandbox restrictions from affecting production).

Key Concept

AWS Organizations Service Control Policies (SCPs) and Organizational Unit (OU) policy inheritance.

Question 307Question →

A company is migrating its on-premises web application to AWS. The application will run on Amazon ECS containers. The solutions architect must design a security strategy to grant database administrators (DBAs) administrative access to the Amazon RDS DB instances using their existing corporate identity provider (IdP). Furthermore, the ECS application containers must securely access the database credentials, which must be rotated every 30 days without hardcoding them in the application or storing them in plaintext.

Which combination of actions should the solutions architect take to meet these security requirements?

Configure AWS IAM Identity Center to federate the corporate identity provider, granting DBAs federated access to manage RDS. Store the database credentials in AWS Secrets Manager, enable automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.

Create individual IAM users for each DBA in the AWS account, configure long-term credentials for AWS Management Console access, and manually synchronize their passwords with the corporate identity provider. Store the database credentials in AWS Secrets Manager with automatic 30-day rotation.

Configure AWS IAM Identity Center to federate the corporate identity provider for DBA access. Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to avoid KMS encryption overhead, and reference the parameter in the ECS task definition.

Instruct DBAs to use the AWS account root user credentials to perform administrative database tasks to ensure uninterrupted access. Store the database credentials in AWS Secrets Manager, and rely on AWS KMS automatic key rotation to automatically update the database password.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the corporate identity provider, granting DBAs federated access to manage RDS. Store the database credentials in AWS Secrets Manager, enable automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.

Answer

Configure AWS IAM Identity Center to federate the corporate identity provider for DBA access, store the database credentials in AWS Secrets Manager with automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.

The correct solution integrates AWS IAM Identity Center with the existing corporate identity provider to handle DBA access securely without creating long-term IAM users. It also utilizes AWS Secrets Manager to encrypt, store, and automatically rotate database credentials every 30 days, while using the ECS task execution role to dynamically retrieve the secret at runtime.

Step-by-Step Solution

Integrate the corporate identity provider with AWS IAM Identity Center.

Database administrators can log in to the AWS Management Console using their existing corporate credentials, eliminating the need to manage individual IAM users with long-term keys.

Aligns with the principle of least privilege and simplifies identity management via single sign-on.

Store the database credentials in AWS Secrets Manager.

The sensitive database password is encrypted at rest and stored securely.

Allows AWS Secrets Manager to manage the lifecycle of the credentials, preventing exposure in plaintext parameter store parameters or container images.

Configure AWS Secrets Manager to automatically rotate the secret every 30 days and update the Amazon RDS database.

Automatic rotation of the password is handled natively by AWS Secrets Manager via an integration with Amazon RDS.

Meets the security requirement for monthly credential rotation without manual intervention or custom script scheduling.

Grant retrieval permissions to the ECS task execution role and inject the secret into the container task definition.

The application container retrieves the credentials at startup without hardcoding the password in the image or exposing it in task environment variables.

Ensures secure, runtime access to the database credentials using IAM role-based authorization.

Key Concept

Centralized identity federation and secure, automated secrets management

Question 308Question →

An enterprise is designing a secure multi-account AWS environment using AWS Organizations to comply with regulatory standards. The architecture contains a management account and multiple member accounts grouped into OUs, including a Production OU and a Development OU.

The security team has specified the following requirements:
1. Centralize administrative access management by integrating with the enterprise's corporate Active Directory.
2. Prevent administrators in any member account from deleting or modifying a specific compliance auditing IAM role named SecurityAuditRole.
3. Restrict member accounts under the Development OU to only run Amazon EC2 and Amazon S3 workloads, while ensuring that the management account is never blocked from performing administrative recovery actions.

Which combination of actions will meet these requirements with the least operational overhead?

Create individual IAM users in the management account for all corporate directory users and configure cross-account roles in each member account. Apply local IAM policies in each member account that prevent administrators from deleting or modifying the SecurityAuditRole. Create an SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.

Enable AWS IAM Identity Center and configure Active Directory synchronization. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. In the SCP's condition block, explicitly exclude the root user of the management account from the deny statement, and use the management account's root user credentials for daily administrative tasks to bypass the SCP limits.

Enable AWS IAM Identity Center and configure Active Directory synchronization for user federation. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. Create a second SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.

Create individual IAM users in each member account and synchronize them with the corporate Active Directory using an identity agent. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. To bypass the SCP restrictions in the Development OU, instruct developers to log in using the member account root user credentials, which are exempt from SCP policies.

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure Active Directory synchronization for user federation. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. Create a second SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.

Answer

The correct answer uses AWS IAM Identity Center to federate user identity from the on-premises Active Directory, matching AWS best practices for centralized identity management. To protect the auditing IAM role across all member accounts, a Service Control Policy (SCP) is attached to the root of the organization. Because SCPs do not apply to the management account, the management account administrators can still manage the role if necessary for recovery. Restricting services via a separate SCP attached to the Development OU ensures only the workloads within that OU are constrained, satisfying the requirements with minimal operational overhead.

Step-by-Step Solution

Identify the proper service for centralizing authentication with corporate identity providers in a multi-account setup.

AWS IAM Identity Center is selected over manual IAM user creation.

Reduces operational overhead and eliminates long-term credentials.

Determine the mechanism to protect the auditing IAM role across all member accounts.

An SCP denying modifications to the role is attached to the organization root.

SCPs apply to all member accounts but naturally do not restrict the management account, preserving recovery access.

Apply service restrictions specifically to the Development OU.

A separate SCP denying unauthorized services is attached directly to the Development OU.

Ensures developers are restricted to EC2 and S3 without affecting accounts in other OUs or the management account.

Key Concept

Centralized multi-account identity federation and Service Control Policy scoping rules

Question 309Question →

A Solutions Architect is designing a secure multi-account environment for a growing enterprise. The company's security policy requires centralized access management for employee identities, enforcement of compliance guardrails across all member accounts in the organization, and preventing individual account administrators from disabling logging or modifying centralized security resources. Which architectural strategy best meets these requirements?

Configure AWS IAM Identity Center for centralized single sign-on access, and use AWS Organizations to apply a Service Control Policy (SCP) at the organizational unit level that denies CloudTrail deletion and S3 log bucket modifications.

Create individual IAM users in each member account with long-term credentials synchronized to the corporate directory, and use IAM policies in each account to restrict access to log settings.

Use the management account root credentials to configure administrative access across member accounts, and attach an IAM policy to the root user to enforce logging compliance.

Configure federated access using individual IAM users in the management account, and store administrative access keys as plaintext in Systems Manager Parameter Store parameters for automated compliance checking.

Show answer & explanation

Answer: Configure AWS IAM Identity Center for centralized single sign-on access, and use AWS Organizations to apply a Service Control Policy (SCP) at the organizational unit level that denies CloudTrail deletion and S3 log bucket modifications.

Answer

The correct strategy combines AWS IAM Identity Center for centralized, federated access (avoiding individual IAM users and long-term credentials) with AWS Organizations SCPs applied at the OU level to prevent member account administrators from disabling CloudTrail or altering S3 logging resources.

Step-by-Step Solution

Implement centralized identity management.

Enable AWS IAM Identity Center, integrating it with the enterprise identity provider to allow centralized authentication and role assignment without provisioning long-term IAM user credentials.

This establishes federated access control in line with security best practices.

Enforce multi-account governance guardrails.

Use AWS Organizations to define a Service Control Policy (SCP) that explicitly denies actions like `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteBucket` on the centralized log repository.

SCPs act as organizational guardrails that apply to all principal identities in member accounts, including the root user of those accounts.

Apply the policy to the organization structure.

Attach the SCP to the relevant Organizational Units (OUs) containing the member accounts.

This ensures the guardrails are inherited by all accounts within the targeted OUs without manually configuring permissions in each individual account.

Key Concept

Centralized multi-account governance using Service Control Policies and federated identity integration via AWS IAM Identity Center.

Question 310Question →

A logistics company is designing a multi-account environment on AWS using AWS Organizations. The company has several business units, each requiring separate development and production environments. To comply with corporate security standards, the solutions architect must implement a solution that enforces federated identity management via the company's external identity provider. Additionally, the solution must guarantee that security auditing cannot be disabled by stopping or deleting AWS CloudTrail trails in any member account. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Configure AWS IAM Identity Center to federate with the external identity provider, and assign permission sets to centralized groups.

Implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the Organizational Units (OUs) containing the member accounts.

Provision individual IAM users with long-term security credentials in each member account to map to external directory accounts, and delegate administrative roles.

Use the management account root user credentials to deploy inline policies directly to all accounts to restrict CloudTrail modifications.

Establish federated access by creating matching IAM users in the management account and using cross-account roles to access member accounts.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external identity provider, and assign permission sets to centralized groups.; Implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the Organizational Units (OUs) containing the member accounts.

Answer

Configure AWS IAM Identity Center to federate with the external identity provider, and implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions attached to the Organizational Units (OUs) containing the member accounts.

Centralizing identity access using AWS IAM Identity Center federated with an external identity provider allows administrative access without managing individual IAM users. Additionally, creating and applying a service control policy (SCP) that denies CloudTrail modification/deletion actions (cloudtrail:StopLogging and cloudtrail:DeleteTrail) at the Organizational Unit level prevents member account administrators from disabling auditing, satisfying the compliance requirements securely.

Step-by-Step Solution

Set up centralized identity federation.

AWS IAM Identity Center is configured to synchronize and authenticate users against the external identity provider.

This removes the need to create static IAM users in individual member accounts and enables single sign-on using temporary security credentials.

Enforce auditing compliance across the Organization.

A service control policy (SCP) is drafted with explicit Deny rules for cloudtrail:StopLogging and cloudtrail:DeleteTrail.

SCPs allow the organization's administration to set guardrails that member account administrators cannot override.

Apply the guardrails to the appropriate scope.

The SCP is attached to the OUs containing the member accounts.

This ensures the guardrails are inherited by all existing and future accounts under those OUs without impacting the management account itself.

Key Concept

AWS multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center.

Alternative Method

An alternative method is to use AWS Control Tower to set up the landing zone, which automatically configures AWS IAM Identity Center and applies default guardrails (implemented as SCPs) that prevent disabling CloudTrail across the managed accounts.

Estimated Time:2m 0s

Question 311Question →

A solutions architect is configuring baseline security controls for a new AWS account. The company wants to secure administrative access and protect resources in accordance with AWS Identity and Access Management (IAM) best practices. Which of the following security practices should the solutions architect implement? (Select TWO.)

Select all that apply

Enable Multi-Factor Authentication (MFA) for the AWS account root user and all administrative identities.

Apply the principle of least privilege by granting only the minimum permissions necessary to perform a task.

Use the AWS account root user access keys for daily administrative tasks to avoid authorization issues.

Create individual IAM users with long-term passwords for corporate directory users who need AWS Console access.

Store sensitive database credentials as plaintext parameters in Systems Manager Parameter Store to simplify configuration.

Show answer & explanation

Answer: Enable Multi-Factor Authentication (MFA) for the AWS account root user and all administrative identities.; Apply the principle of least privilege by granting only the minimum permissions necessary to perform a task.

Answer

Enable Multi-Factor Authentication (MFA) for the AWS account root user and all administrative identities, and apply the principle of least privilege by granting only the minimum permissions necessary to perform a task.

The correct practices are to enable Multi-Factor Authentication (MFA) on the root user and administrative accounts to prevent unauthorized access, and to apply the principle of least privilege so that users only have the permissions necessary to do their job.

Step-by-Step Solution

Analyze administrative account security.

Identify that the root user and other administrative accounts represent high-privilege entry points requiring MFA.

MFA adds an extra layer of protection beyond a standard password, which is essential for administrative credentials.

Analyze standard credential management guidelines.

Confirm that permission policies should follow the least privilege model, while avoiding root credentials and individual IAM users for federated employees.

Applying least privilege limits security exposure, while using identity federation avoids creating unnecessary long-term IAM credentials.

Key Concept

AWS Identity and Access Management (IAM) Best Practices

Question 312Question →

A logistics firm hosts its web portal on AWS. The firm requires advanced DDoS protection, direct access to the AWS Shield Response Team (SRT) during an active event, and financial protection to mitigate scaling costs associated with a DDoS attack. Which AWS service should the solutions architect recommend to meet these requirements?

AWS Shield Advanced

AWS Shield Standard

AWS WAF

Amazon VPC Security Groups

Show answer & explanation

Answer: AWS Shield Advanced

Answer

AWS Shield Advanced

The correct answer is AWS Shield Advanced. This subscription-based service provides enhanced DDoS protection for resource types such as Elastic IP, CloudFront, Route 53, and Elastic Load Balancing. It features 24/7 access to the AWS Shield Response Team (SRT) and provides cost protection to mitigate billing spikes resulting from DDoS attacks.

Step-by-Step Solution

Analyze the requirements: advanced DDoS protection, specialized team support (SRT), and billing protection for scaling costs.

Identify that the requirements point to a paid tier of AWS DDoS protection.

Standard services or firewalls do not include human support or financial guarantees.

Compare Shield tiers and related security services.

Confirm Shield Advanced covers all three criteria.

AWS Shield Advanced is specifically designed to provide cost protection and SRT support.

Key Concept

AWS Shield Advanced Features

Question 313Question →

A global e-learning platform delivers video-on-demand content and user profile APIs using Amazon CloudFront, an Application Load Balancer (ALB), and Amazon EC2 instances. Recently, the platform experienced a distributed denial of service (DDoS) attack targeting the application layer (Layer 7) with a flood of HTTP POST requests, which overwhelmed the backend EC2 instances. A solutions architect must design a secure architecture to mitigate future Layer 7 DDoS attacks and prevent unauthorized traffic from bypassing CloudFront to access the ALB directly.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule.

Configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Enable AWS Shield Standard on the Application Load Balancer and configure a rate-limiting rule.

Configure stateless Network ACLs on the public subnets to block all traffic except for the specific IP addresses of the application users.

Associate an AWS WAF Web ACL directly with the Amazon EC2 instances and configure an HTTP header validation rule.

Show answer & explanation

Answer: Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule.; Configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Answer

Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule, and configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

To mitigate Layer 7 HTTP floods, AWS WAF rate-based rules must be deployed on the CloudFront distribution. To prevent users from bypassing CloudFront and accessing the Application Load Balancer directly, the ALB's security group must restrict inbound traffic using the AWS-managed prefix list for CloudFront.

Step-by-Step Solution

Address the Layer 7 DDoS requirement.

Identify that AWS WAF associated with Amazon CloudFront supports rate-based rules to limit incoming HTTP flood requests at the edge.

AWS WAF inspects HTTP/HTTPS traffic and can dynamically rate-limit traffic exceeding thresholds to prevent origin exhaustion.

Address the bypass prevention requirement.

Configure the ALB's security group to only permit inbound traffic originating from CloudFront's edge servers.

Using the AWS-managed prefix list for CloudFront ensures that only traffic coming from CloudFront's IP space is allowed into the ALB, preventing direct internet access.

Key Concept

Securing web applications at the edge using Amazon CloudFront IP range security groups and AWS WAF rate-limiting.

Estimated Time:2m 0s

Question 314Question →

A company hosts its core transactional platform on Amazon EC2 instances behind an Application Load Balancer (ALB) in us-east-1 as the primary region. The company maintains a fully functional but scaled-down warm standby environment behind an ALB in us-west-2 as the secondary region. The database layer is replicated across both regions. A solutions architect must design a DNS routing strategy using Amazon Route 53 to automatically redirect user traffic from the primary region to the secondary region if the primary region's ALB or backend instances fail. Which configuration should the solutions architect implement to meet these requirements?

Create Route 53 Failover Alias records for the application's domain. Point the primary record to the us-east-1 ALB and the secondary record to the us-west-2 ALB, with 'Evaluate Target Health' set to Yes for both records.

Create Route 53 Latency routing records pointing to the primary and secondary ALBs, relying on Route 53 to naturally steer traffic to the secondary region when the primary region's latency increases during an outage.

Create Route 53 Failover records where the primary record points to the us-east-1 ALB, and the secondary record points directly to the Amazon RDS Read Replica endpoint in us-west-2 to automatically promote it and accept write traffic.

Create Route 53 Failover records where the secondary record points to a shut-down pilot light EC2 environment, relying on the Route 53 health check failure to automatically start the EC2 instances in us-west-2 without administrative intervention.

Show answer & explanation

Answer: Create Route 53 Failover Alias records for the application's domain. Point the primary record to the us-east-1 ALB and the secondary record to the us-west-2 ALB, with 'Evaluate Target Health' set to Yes for both records.

Answer

The correct configuration is to create Route 53 Failover Alias records pointing to the primary and secondary Application Load Balancers (ALBs) and to enable 'Evaluate Target Health'. Route 53 Failover routing is designed specifically for active-passive disaster recovery setups. By using Alias records and enabling 'Evaluate Target Health', Route 53 utilizes the health check configuration of the ALBs. If the primary ALB or all backend EC2 instances registered to it fail their health checks, Route 53 automatically detects this and redirects traffic to the secondary ALB in the warm standby region.

Step-by-Step Solution

Select Route 53 Failover routing policy for the domain's record set.

Defines an active-passive configuration where traffic is directed to the primary resource by default and to the secondary resource when the primary is unhealthy.

This matches the requirement to redirect traffic to the warm standby in us-west-2 only if the primary us-east-1 environment becomes unavailable.

Configure the primary Failover record as an Alias record pointing to the primary ALB, and the secondary Failover record as an Alias record pointing to the secondary ALB.

Allows Route 53 to map the domain name directly to the AWS ALB DNS names without incurring CNAME lookup costs or delays.

Alias records are the recommended way to integrate Route 53 with AWS load balancers.

Enable 'Evaluate Target Health' on both the primary and secondary Alias records.

Route 53 actively monitors the health of the underlying ALB target groups using the load balancer's configured health checks.

If target health evaluation is disabled, Route 53 will continue to route traffic to the primary ALB even if all backend instances behind it are unhealthy.

Key Concept

Route 53 Routing Policies and DNS Failover Strategies

Question 315Question →

A financial technology startup has multiple AWS accounts managed under an AWS Organizations organization. The startup needs to implement a centralized logging and threat detection strategy. The security team must be alerted within minutes of any unauthorized IAM privilege escalation attempts or modifications to critical network infrastructure across all accounts. Additionally, they must ensure that all API activity log files are protected against modification or deletion, even by administrative users. Which combination of steps should the solutions architect recommend to meet these security monitoring and threat detection requirements? (Select TWO.)

Select all that apply

Enable an AWS CloudTrail organization trail in the management account, configure it to deliver log files to a centralized Amazon S3 bucket in a dedicated security account, and enable CloudTrail log file integrity validation.

Designate a security account as the Amazon GuardDuty delegated administrator, enable GuardDuty across all organization member accounts, and configure Amazon EventBridge to route GuardDuty findings to the security team.

Deploy AWS Shield Advanced across all accounts to monitor AWS CloudTrail logs for threat patterns and automatically block unauthorized IAM API calls.

Configure stateful Network ACLs at the subnet level to block any administrative users from performing API actions that modify S3 buckets containing CloudTrail logs.

Deploy AWS WAF at the VPC level for all EC2 instances to monitor AWS CloudTrail API calls for privilege escalation and block traffic from administrative users.

Show answer & explanation

Answer: Enable an AWS CloudTrail organization trail in the management account, configure it to deliver log files to a centralized Amazon S3 bucket in a dedicated security account, and enable CloudTrail log file integrity validation.; Designate a security account as the Amazon GuardDuty delegated administrator, enable GuardDuty across all organization member accounts, and configure Amazon EventBridge to route GuardDuty findings to the security team.

Answer

The correct options are: enabling an AWS CloudTrail organization trail with log file integrity validation delivered to a centralized S3 bucket, and designating a delegated administrator for Amazon GuardDuty to monitor the logs and route findings via Amazon EventBridge.

Centralizing CloudTrail logs in a dedicated security account under an Organization trail provides a tamper-resistant architecture. Enabling CloudTrail log file integrity validation allows the detection of unauthorized modifications. Amazon GuardDuty analyses CloudTrail logs across accounts to identify privilege escalation and other security threats, and EventBridge provides the routing mechanism for alerts.

Step-by-Step Solution

Address log security and auditing requirements.

Create a centralized AWS CloudTrail trail across the entire organization that deposits logs into a secure Amazon S3 bucket within a designated security account. Enable log file integrity validation to detect unauthorized modifications.

This establishes a tamper-evident audit trail of all API activity across the organization, satisfying the requirement to protect logs from deletion or modification by administrative users.

Address real-time threat detection and alerting requirements.

Enable Amazon GuardDuty in all accounts by delegating administration to the security account, and set up an Amazon EventBridge rule to route GuardDuty findings to the security team.

GuardDuty natively analyzes CloudTrail logs to detect anomalous IAM activity and potential privilege escalation. EventBridge allows automated routing of these findings for rapid alerting.

Key Concept

Centralized security monitoring, log integrity, and multi-account threat detection in AWS Organizations using CloudTrail and GuardDuty.

Question 316Question →

A company is designing a serverless architecture to process data files uploaded to Amazon S3. The processing of each file is CPU-intensive and takes between 20 to 25 minutes to complete. The metadata and processing results must be saved to a database. The file uploads occur in highly unpredictable bursts throughout the day, with long periods of complete inactivity. The company wants to minimize costs and avoid paying for idle compute resources. Which two options should the solutions architect recommend to meet these requirements in a cost-optimized manner? (Select two.)

Select all that apply

Run the processing application as containerized tasks using Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.

Use Amazon DynamoDB with On-Demand capacity mode to store the metadata and results.

Use AWS Lambda functions to execute the file processing logic directly.

Configure the database table in Amazon DynamoDB with a high Provisioned Capacity mode to handle peak processing bursts.

Show answer & explanation

Answer: Run the processing application as containerized tasks using Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.; Use Amazon DynamoDB with On-Demand capacity mode to store the metadata and results.

Answer

Deploy the processing application as containerized tasks on Amazon Elastic Container Service (Amazon ECS) running on AWS Fargate, and store the metadata and results in Amazon DynamoDB configured with On-Demand capacity mode.

The correct architecture uses Amazon ECS on AWS Fargate for computing because Fargate tasks can run for up to 24 hours, easily accommodating the 20 to 25-minute execution duration while remaining serverless and charging only for active runtime. For storage, using Amazon DynamoDB with On-Demand capacity mode ensures that database costs automatically scale to zero during idle periods and immediately scale up to meet processing spikes without manual intervention or over-provisioning.

Step-by-Step Solution

Analyze the compute requirements, specifically the job execution duration.

The processing jobs run for 20 to 25 minutes, which exceeds the AWS Lambda maximum execution timeout of 15 minutes.

This rules out AWS Lambda for hosting the file processing logic directly, pointing to Amazon ECS on AWS Fargate as the serverless container compute choice.

Analyze the database capacity needs and traffic patterns.

The workload is highly unpredictable with spikes and long periods of complete inactivity.

This rules out Provisioned Capacity mode for Amazon DynamoDB due to high idle costs, and dictates using On-Demand capacity mode to align cost directly with actual usage.

Key Concept

Selecting cost-optimized serverless compute and database capacity modes based on workload duration and traffic patterns.

Question 317Question →

A company hosts a web application on Amazon EC2 instances within an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The solutions architect notices that when the application on an EC2 instance crashes and returns HTTP 5xx errors, the ALB marks the instance as unhealthy, but the ASG does not terminate or replace the instance. What configuration change should the solutions architect make to ensure that the ASG automatically replaces instances that fail the application-level health checks?

Change the target group health check port settings to query port 80, while the application server remains bound to port 8080.

Configure a stateful rule in the subnet's Network Access Control List (NACL) to track and automatically allow return traffic for the health check requests.

Configure the Auto Scaling group to use ELB health checks instead of EC2 health checks.

Replace the Application Load Balancer with an Amazon Route 53 latency routing policy configured with health checks to route user traffic directly to the EC2 instances.

Show answer & explanation

Answer: Configure the Auto Scaling group to use ELB health checks instead of EC2 health checks.

Answer

Configure the Auto Scaling group to use ELB health checks instead of EC2 health checks.

The correct action is to configure the Auto Scaling group (ASG) to use Elastic Load Balancing (ELB) health checks. By default, an ASG only monitors EC2 status checks (system and instance status). When the ELB health check type is enabled, the ASG monitors the health status of the instances in the target group. If the Application Load Balancer (ALB) marks an instance as unhealthy (e.g., due to failing application-level HTTP health checks), the ASG will automatically terminate and replace that instance, maintaining application availability.

Step-by-Step Solution

Analyze why the Auto Scaling group is not replacing the instances.

By default, the Auto Scaling group uses EC2 status checks (hardware and hypervisor checks), which show the instances as healthy even if the application running on them has crashed.

To fix this, the ASG must be configured to check the application health rather than just the instance status.

Select the appropriate health check mechanism.

The Application Load Balancer already performs application-level health checks and marks instances as unhealthy when they return 5xx errors.

By changing the ASG's health check type to ELB, the ASG will query the target group's health status and replace instances that fail ELB health checks.

Key Concept

Auto Scaling Group Health Check Configuration

Question 318Question →

A company is deploying a distributed telemetry processing system on a fleet of Amazon EC2 instances. The system requires sub-millisecond node-to-node network latency to synchronize internal state variables. The instances receive external ingest traffic from an Application Load Balancer (ALB) on TCP port 8090. Which two configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy the EC2 instances in a spread placement group to distribute the instances across distinct underlying hardware.

Launch the EC2 instances in a cluster placement group within a single Availability Zone.

Configure the ALB target group health check to use the traffic port or explicitly specify port 8090.

Deploy the EC2 instances in a partition placement group with a partition count of seven.

Configure the target group to perform health checks on the default HTTP port 80 to offload health check traffic from the application.

Show answer & explanation

Answer: Launch the EC2 instances in a cluster placement group within a single Availability Zone.; Configure the ALB target group health check to use the traffic port or explicitly specify port 8090.

Answer

To meet the requirements, the solutions architect should launch the EC2 instances in a cluster placement group within a single Availability Zone and configure the Application Load Balancer target group health check to use the traffic port or explicitly specify port 8090.

To achieve the required sub-millisecond node-to-node latency, the instances must be launched in a cluster placement group within a single Availability Zone. Additionally, because the application listens on custom port 8090, the target group health check port must be configured to check the traffic port or port 8090 directly to avoid false negatives where healthy instances are marked as unhealthy.

Step-by-Step Solution

Analyze the node-to-node communication latency requirement.

Identify that sub-millisecond latency is required for state synchronization, pointing to a cluster placement group.

Cluster placement groups position instances physically close to each other in a single Availability Zone to maximize network performance and minimize latency.

Evaluate and eliminate incorrect placement group strategies.

Rule out spread and partition placement groups.

Spread and partition placement groups are designed to reduce correlated hardware failures by separating instances, which inherently increases latency between instances.

Analyze the load balancer health check port requirements.

Identify that the application is running on custom port 8090, which requires matching target group health checks.

If the health check port is left at default values (like port 80), the load balancer will try to reach a service that is not listening, resulting in failed health checks and healthy nodes being marked as unhealthy.

Key Concept

Selecting cluster placement groups for low-latency node-to-node communication and aligning load balancer health check ports with custom application ports.

Estimated Time:2m 0s

Question 319Question →

A financial services company hosts a critical transaction application on Amazon EC2 instances within a private subnet. The security team must implement a solution to monitor all inbound and outbound network traffic at the subnet level to detect network anomalies, such as active port scanning and unauthorized SSH connection attempts, without impacting application performance. Which solution meets these requirements?

Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.

Configure stateful Network ACLs at the subnet level to log all rejected traffic, and use AWS Shield Standard to analyze the logs for network anomalies.

Deploy AWS WAF at the subnet level to inspect all inbound TCP packets, and configure a custom rule to detect and block port scanning.

Configure Security Groups to statelessly log traffic at the subnet level, and use Amazon CloudWatch Logs to trigger alerts for unauthorized SSH attempts.

Show answer & explanation

Answer: Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.

Answer

Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.

The correct solution involves enabling VPC Flow Logs and Amazon GuardDuty. VPC Flow Logs capture network traffic data at the subnet level without introducing any performance overhead on the EC2 instances. Amazon GuardDuty automatically processes these flow logs out-of-band to identify malicious activity, such as port scanning or unauthorized SSH brute-force attempts.

Step-by-Step Solution

Enable VPC Flow Logs for the target subnet.

Network traffic metadata (source, destination, protocol, port, action) is captured out-of-band and published to Amazon CloudWatch Logs or Amazon S3.

This establishes subnet-level traffic visibility without installing agent software or introducing CPU/memory latency on the EC2 instances.

Enable Amazon GuardDuty in the AWS account.

GuardDuty automatically reads VPC Flow Logs, Route 53 resolver query logs, and CloudTrail events at the platform level.

This offloads threat detection analysis to a managed service that uses threat intelligence feeds to identify signatures like port scanning.

Process GuardDuty findings.

Alerts and findings are generated inside the GuardDuty console and can be sent to Amazon EventBridge for automated notification or remediation.

This ensures the security team receives immediate notification of anomalous activity.

Key Concept

Out-of-band network threat detection using VPC Flow Logs and Amazon GuardDuty

Estimated Time:2m 0s

Question 320Question →

A logistics company runs a fleet tracking application on AWS. The application database is hosted on Amazon RDS for PostgreSQL in a Multi-AZ deployment within the primary Region. The company requires a disaster recovery (DR) strategy in a secondary Region with a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of 15 minutes, while minimizing ongoing costs. Which architecture will meet these requirements at the lowest cost?

Configure a cross-region Amazon RDS read replica and a duplicate application tier in the secondary Region. Implement Amazon Route 53 Latency routing without health checks to automatically redirect traffic to the secondary Region when the primary Region experiences an outage.

Configure a Pilot Light environment with application servers running at a minimal scale in the secondary Region. Rely on the Pilot Light servers to handle the immediate full production traffic load with zero startup or scaling latency during a failover event.

Configure a cross-region Amazon RDS read replica in the secondary Region. Deploy a Pilot Light environment for the application tier in the secondary Region with Auto Scaling group capacity set to zero. Upon failover, promote the read replica to a standalone DB instance, scale up the Auto Scaling groups, and update Route 53 failover records.

Configure a cross-region Amazon RDS read replica in the secondary Region. If a disaster occurs, redirect all application write traffic directly to the read replica without promoting it, assuming the database will automatically promote itself to a primary instance upon receiving write requests.

Show answer & explanation

Answer: Configure a cross-region Amazon RDS read replica in the secondary Region. Deploy a Pilot Light environment for the application tier in the secondary Region with Auto Scaling group capacity set to zero. Upon failover, promote the read replica to a standalone DB instance, scale up the Auto Scaling groups, and update Route 53 failover records.

Answer

Configure a cross-region Amazon RDS read replica in the secondary Region, deploy a Pilot Light environment for the application tier with Auto Scaling group capacity set to zero, and promote the replica and scale the instances during failover.

The configuration utilizing a cross-region RDS read replica satisfies the 15-minute RPO requirement because data is continuously replicated asynchronously. Using a Pilot Light strategy with Auto Scaling groups set to zero instances minimizes running compute costs during normal operations while allowing the servers to boot and scale within the 30-minute RTO during a disaster scenario.

Step-by-Step Solution

Set up a cross-region Amazon RDS read replica in the secondary Region.

Asynchronous replication is established, achieving an RPO of under 15 minutes.

Ensures that database changes in the primary Region are continually replicated to the recovery Region.

Deploy a Pilot Light environment for the application servers in the secondary Region, configuring the Auto Scaling groups with a desired capacity of zero.

Compute costs are minimized since no instances run during normal operations, but launch configurations/templates are prepared.

Allows quick provisioning of the compute layer within the 30-minute RTO window when a disaster is declared.

Configure a Route 53 routing policy with health checks to manage failover.

Traffic can be redirected to the secondary Region after promotion and scaling are complete.

Ensures client traffic is pointed to the promoted infrastructure in the disaster recovery Region.

Key Concept

Disaster recovery strategies involving Pilot Light environments and RDS cross-region replication to balance RTO, RPO, and cost.

PreviousPage 16 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution