All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

As a solutions architect, you are tasked with securing a gaming studio's environment within AWS Organizations. The security team wants to enforce a policy where no member accounts can disable GuardDuty, while ensuring the management account retains administrative control and is not restricted by this policy. Additionally, the studio wants to manage employee permissions centrally from an external identity provider without creating static credentials. Which combination of actions will meet these governance requirements with the least operational overhead?

Set up IAM Identity Center integrated with the external identity provider. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.

Provision unique IAM users in each member account and configure access keys for external identity provider integration. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.

Set up IAM Identity Center integrated with the external identity provider. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root. Mandate the use of the management account's root user credentials for daily administrative tasks.

Provision unique IAM users in a centralized hub VPC and establish trust relationships with member accounts, syncing passwords with the external identity provider. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.

Show answer & explanation

Answer: Set up IAM Identity Center integrated with the external identity provider. Create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.

Answer

Set up IAM Identity Center integrated with the external identity provider, and create an SCP that denies GuardDuty disabling actions and attach it to the organization's root.

Integrating IAM Identity Center with an external identity provider enables native identity federation, satisfying the requirement to avoid static credentials. Creating an SCP that denies GuardDuty disabling actions and attaching it to the root of the organization enforces the security requirement on all member accounts. Because SCPs do not restrict permissions in the management account, administrative control is preserved without impacting the management account itself.

Step-by-Step Solution

Integrate the external identity provider with IAM Identity Center to enable centralized federation without static access credentials.

Centralized, federated identity management is established across all AWS accounts.

This satisfies the requirement to manage employee permissions centrally from an external provider without using static access keys or credentials.

Create an SCP denying GuardDuty disablement actions (such as guardduty:DeleteDetector) and apply it at the organization's root.

All member accounts are restricted from disabling GuardDuty, while the management account remains unrestricted.

SCPs apply to all member accounts within an organization but do not apply to the management account itself, meeting both security and administrative requirements.

Key Concept

Centralized identity federation and multi-account policy governance using SCPs

Question 362Question →

A smart grid utility company operates a real-time energy telemetry API on AWS. The API is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). During grid fluctuations, the API suffers from coordinated Layer 7 HTTP flood attacks disguised as legitimate smart meter reporting traffic. The legitimate meter reports always target a specific URI path and include a custom header X-Meter-Token. The security team wants to mitigate these attacks at the edge before they reach the ALB, without blocking legitimate traffic or modifying the backend application code. Which solution meets these requirements with the least operational overhead?

Deploy an Amazon CloudFront distribution in front of the ALB. Associate an AWS WAF web ACL with the CloudFront distribution. Configure an AWS WAF rate-based rule that limits requests targeting the API's URI path that do not contain the expected X-Meter-Token header. Restrict the ALB to accept traffic only from the CloudFront distribution.

Associate an AWS WAF web ACL directly with the ALB. Configure a stateless Network ACL on the public subnets that inspects incoming packets for the X-Meter-Token header and blocks traffic exceeding a specified threshold of connections per second.

Enable AWS Shield Standard on the Application Load Balancer. Create a security group rule on the ALB that restricts traffic rates and blocks any requests containing invalid values in the HTTP header.

Deploy an Amazon CloudFront distribution in front of the ALB. Configure the security groups on the backend EC2 instances to dynamically block traffic based on AWS Shield Standard alerts, and use an AWS WAF web ACL on the ALB to drop requests without the X-Meter-Token header.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the ALB. Associate an AWS WAF web ACL with the CloudFront distribution. Configure an AWS WAF rate-based rule that limits requests targeting the API's URI path that do not contain the expected X-Meter-Token header. Restrict the ALB to accept traffic only from the CloudFront distribution.

Answer

Deploy Amazon CloudFront in front of the ALB, associate an AWS WAF web ACL with the CloudFront distribution, use a rate-based rule to restrict requests missing the X-Meter-Token header, and restrict the ALB to accept traffic only from CloudFront.

Deploying Amazon CloudFront in front of the Application Load Balancer (ALB) and associating it with AWS WAF protects the application at the edge of the AWS network. Configuring an AWS WAF rate-based rule matching requests that target the API path and do not contain the custom X-Meter-Token header ensures that flood traffic is blocked before hitting the origin, while legitimate meter traffic remains unaffected. Restricting the ALB to accept traffic only from CloudFront ensures that attackers cannot bypass the edge protections.

Step-by-Step Solution

Deploy Amazon CloudFront in front of the Application Load Balancer.

Establishes a global cache and edge networking front-end that can absorb large-scale infrastructure and application-layer traffic before it hits origin servers.

This is necessary to satisfy the security requirement of mitigating the DDoS attack at the edge of the network.

Create and associate an AWS WAF web ACL with the CloudFront distribution with a targeted rate-based rule.

Evaluates incoming requests at the CloudFront edge locations, applying rate-limiting specifically to traffic matching the API path that is missing the X-Meter-Token header.

This distinguishes legitimate meter traffic from the malicious HTTP flood and mitigates it automatically at the layer 7 level.

Restrict the ALB to only accept requests forwarded from the CloudFront distribution.

Ensures that clients cannot bypass CloudFront and AWS WAF protections by targeting the ALB public IP address directly.

To secure the origin and maintain edge-protection enforcement.

Key Concept

Deploying CloudFront with AWS WAF at the edge for Layer 7 DDoS mitigation and protecting the origin from direct access.

Estimated Time:2m 0s

Question 363Question →

An enterprise hosts a batch processing application on Amazon EC2 instances in a private VPC subnet. The application must securely upload large datasets to a specific Amazon S3 bucket within the same AWS Region. Security policy requires that all traffic to Amazon S3 must remain within the AWS network, and no other outbound internet access should be permitted from the EC2 instances. The architecture must minimize data transfer costs and administrative overhead. Which combination of actions should a solutions architect perform to meet these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC Endpoint for Amazon S3, associate it with the private subnet's route table, and apply an endpoint policy that restricts access to the organization's specific S3 bucket.

Configure the security group attached to the EC2 instances to allow outbound HTTPS traffic to the AWS-managed prefix list for Amazon S3, and remove the default rule allowing all outbound traffic (0.0.0.0/0).

Configure the private subnet's Network ACL to allow outbound traffic only to the Amazon S3 Gateway Endpoint ID, and deny all other outbound traffic.

Deploy a NAT Gateway in the private subnet and create a route in the route table for Amazon S3 traffic pointing to the NAT Gateway with an attached AWS WAF web ACL to filter bucket access.

Create an Interface VPC Endpoint for Amazon S3, manually add a route to the subnet's route table targeting the endpoint interface's Elastic Network Interface (ENI) for all destinations, and restrict access using a Security Group outbound rule targeting the S3 DNS name.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon S3, associate it with the private subnet's route table, and apply an endpoint policy that restricts access to the organization's specific S3 bucket.; Configure the security group attached to the EC2 instances to allow outbound HTTPS traffic to the AWS-managed prefix list for Amazon S3, and remove the default rule allowing all outbound traffic (0.0.0.0/0).

Answer

Create a Gateway VPC Endpoint for Amazon S3, associate it with the private subnet's route table, and apply an endpoint policy that restricts access to the organization's specific S3 bucket. Additionally, configure the security group attached to the EC2 instances to allow outbound HTTPS traffic to the AWS-managed prefix list for Amazon S3, and remove the default rule allowing all outbound traffic.

The correct strategy combines the creation of a Gateway VPC Endpoint for Amazon S3 with security group outbound rules. The Gateway Endpoint provides secure, private access to Amazon S3 at no additional cost and automatically handles routing updates. The endpoint policy secures S3 access by ensuring instances can only interact with the specified bucket. By configuring the EC2 security group to permit outbound HTTPS traffic only to the AWS-managed prefix list for S3 and removing the default open outbound rule, the instances are prevented from reaching any other public internet destinations.

Step-by-Step Solution

Analyze the connectivity requirements.

The application needs access to Amazon S3 but must not have general outbound internet access.

This establishes the scope of VPC network security controls needed.

Select the most cost-effective and secure private connectivity option for Amazon S3.

A Gateway VPC Endpoint for Amazon S3 is chosen over an Interface VPC Endpoint because it is free of charge and automatically routes traffic using prefix lists in the subnet's route table.

Gateway endpoints are the standard, zero-cost method for connecting to S3 from within a VPC.

Enforce the security restriction for the specific S3 bucket.

Apply a VPC Endpoint policy to the Gateway VPC Endpoint that permits access only to the target S3 bucket.

VPC Endpoint policies allow fine-grained access control to AWS resources from within the VPC.

Restrict outbound traffic on the EC2 instances using security groups.

Modify the instance security group to allow outbound traffic on port 443 only to the AWS-managed prefix list for Amazon S3 (pl-xxxxxx) and delete the default 0.0.0.0/0 outbound rule.

This ensures the instances cannot connect to any other destinations on the public internet, satisfying the zero-internet egress security policy.

Key Concept

Combining S3 Gateway Endpoints with Security Group prefix list filtering allows secure, cost-effective, private resource access while preventing all other egress to the internet.

Question 364Question →

A solutions architect is configuring a security group for an Amazon EC2 instance that hosts a simple web server. The architect adds an inbound rule to allow TCP traffic on port $80$ from any source ( $0.0.0.0/0$ ). What outbound rule must the solutions architect add to the security group to allow the HTTP response traffic to reach the clients?

No outbound rule is required because security groups are stateful, meaning return traffic is automatically allowed.

An outbound rule allowing TCP traffic to destination

0.0.0.0/0

on ephemeral ports (

1024

65535

) is required.

An outbound rule allowing TCP traffic to destination

0.0.0.0/0

on port

80

is required.

An outbound rule must be configured in AWS WAF to permit the response traffic, since security groups only inspect incoming packets.

Show answer & explanation

Answer: No outbound rule is required because security groups are stateful, meaning return traffic is automatically allowed.

Answer

No outbound rule is required because security groups are stateful, meaning return traffic is automatically allowed.

Security groups in AWS VPCs are stateful. When you create an inbound rule to allow traffic on a specific port (like port

80

), the security group automatically tracks the connection state and allows the return response traffic to flow outbound to the client. No corresponding outbound rule is required.

Step-by-Step Solution

Identify the type of firewalls being configured.

The architect is configuring an AWS Security Group at the EC2 instance level.

Determining the security resource type is critical because Security Groups and Network ACLs exhibit different connection-tracking behaviors.

Apply the stateful connection-tracking behavior of Security Groups.

Security groups are stateful. Once inbound traffic is allowed on port

80

, return traffic is automatically permitted.

This explains why no outbound rule is necessary to send responses back to the clients.

Key Concept

AWS Security Groups are stateful firewalls that operate at the instance level. They automatically track connection states and allow return traffic without requiring matching outbound rules.

Question 365Question →

A solutions architect is configuring network security for a standard multi-tier application within an Amazon VPC. The architect needs to establish the proper boundaries using Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the characteristics of Security Groups and Network ACLs? (Select TWO.)

Select all that apply

Security groups are stateful, so allowed inbound traffic automatically permits return outbound traffic.

Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed.

Security groups operate at the subnet level and apply to all instances within that subnet.

Network ACLs operate at the network interface level to protect individual EC2 instances.

Security groups evaluate rules in numbered order starting with the lowest number.

Show answer & explanation

Answer: Security groups are stateful, so allowed inbound traffic automatically permits return outbound traffic.; Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed.

Answer

Security groups are stateful, so allowed inbound traffic automatically permits return outbound traffic, and Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed.

Security groups are stateful, which means any traffic allowed inbound is automatically allowed to return outbound, regardless of outbound rules. Network ACLs are stateless, meaning they evaluate traffic inbound and outbound independently, requiring explicit rules in both directions.

Step-by-Step Solution

Analyze the statefulness of Security Groups and Network ACLs.

Security groups are stateful (inbound allows outbound response), whereas Network ACLs are stateless (both directions require rules).

This establishes the basic traffic evaluation behavior of the two network security layers.

Analyze the scope of application for each component.

Security groups apply at the instance or Elastic Network Interface (ENI) level. Network ACLs apply at the subnet boundary level.

This determines where the traffic filtering takes place in the VPC topology.

Evaluate rule processing methods.

Security groups evaluate all rules together, allowing traffic if any rule matches. Network ACLs evaluate rules in numerical order, applying the first match.

This clarifies how rules are matched and executed for both controls.

Key Concept

VPC Network Security layer differences (Security Groups vs Network ACLs)

Question 366Question →

A company is hosting a secure data processing application on Amazon EC2 instances in a private subnet (Subnet A: $172.16.1.0/24$ ) within a VPC ( $172.16.0.0/16$ ). To comply with strict security requirements, the instances must not have internet access. Instead, they must interact with AWS Systems Manager (SSM) using an Interface VPC Endpoint located in a dedicated endpoint subnet (Subnet B: $172.16.2.0/24$ ). Both subnets are associated with custom Network ACLs (NACLs) that currently deny all inbound and outbound traffic. The security groups associated with the EC2 instances and the VPC endpoint are already correctly configured to allow HTTPS traffic (TCP port $443$ ) between them. Which configuration must the solutions architect apply to the Network ACL of Subnet A to allow the EC2 instances to successfully establish connections to and communicate with the SSM Interface VPC Endpoint?

An outbound rule allowing TCP port

443

to destination

172.16.2.0/24

, and an inbound rule allowing TCP ports

1024

65535

from source

172.16.2.0/24

An outbound rule allowing TCP port

443

to destination

172.16.2.0/24

. No inbound rule is required because security groups are stateful and will automatically allow the return traffic.

An outbound rule allowing TCP port

443

to destination

172.16.2.0/24

, and an inbound rule allowing TCP port

443

from source

172.16.2.0/24

An inbound rule allowing TCP port

443

from source

172.16.2.0/24

, and an outbound rule allowing TCP ports

1024

65535

to destination

172.16.2.0/24

Show answer & explanation

Answer: An outbound rule allowing TCP port $443$ to destination $172.16.2.0/24$ , and an inbound rule allowing TCP ports $1024$ - $65535$ from source $172.16.2.0/24$ .

Answer

An outbound rule allowing TCP port

443

to destination

172.16.2.0/24

, and an inbound rule allowing TCP ports

1024

65535

from source

172.16.2.0/24

Network ACLs are stateless. Therefore, to allow a connection, rules must allow traffic in both directions. The client EC2 instances initiate HTTPS traffic to the Systems Manager (SSM) Interface VPC Endpoint on port

443

, which requires an outbound rule to destination

172.16.2.0/24

on TCP port

443

. The return traffic from the SSM endpoint will be sent back to the client's dynamically allocated ephemeral ports (

1024

65535

). Consequently, an inbound rule from source

172.16.2.0/24

on TCP ports

1024

65535

is required to allow the response traffic.

Step-by-Step Solution

Identify the communication flow and port numbers.

The client EC2 instances in Subnet A initiate HTTPS traffic (TCP port

443

) to the Interface VPC Endpoint (which uses ENIs in Subnet B).

Systems Manager Interface VPC Endpoints receive traffic on HTTPS port

443

Determine the outbound Network ACL requirements for Subnet A.

An outbound rule allowing TCP traffic to destination

172.16.2.0/24

(Subnet B) on port

443

is required.

To allow the outbound request from the EC2 instances to reach the VPC Endpoint's network interfaces.

Determine the inbound Network ACL requirements for Subnet A considering NACL statelessness.

An inbound rule allowing TCP traffic from source

172.16.2.0/24

(Subnet B) on ephemeral ports

1024

65535

is required.

Network ACLs are stateless, meaning return traffic is not automatically allowed. When the EC2 instances initiate the connection, they use dynamically allocated source ports (ephemeral ports

1024

65535

), which will be the destination ports for the response traffic.

Key Concept

Statelessness of Network ACLs and the requirement of ephemeral ports for return traffic in VPC communications.

Question 367Question →

A digital publishing company hosts a subscription-based platform on AWS. The static frontend is stored in an Amazon S3 bucket, and the dynamic subscription API runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During a high-profile release, the platform suffers from a Layer 7 HTTP flood attack targeting the login API endpoint, causing database connection exhaustion. Concurrently, the infrastructure experiences a Layer 4 SYN flood attack that threatens to saturate the internet bandwidth. The company needs to block the application-layer attack, mitigate infrastructure-layer attacks at the network edge, and secure financial protection against EC2 auto-scaling charges incurred during DDoS attacks. Which combination of actions will meet these requirements with the least operational overhead?

Deploy an Amazon CloudFront distribution in front of the S3 bucket and the ALB. Enable AWS Shield Standard on the distribution, and configure AWS WAF on the ALB with custom rate-limiting rules to block the Layer 7 flood and claim automatic credit refunds for resource scaling.

Configure stateless Network Access Control Lists (NACLs) at the VPC boundary to drop traffic from the attacking IP addresses. Enable AWS Shield Advanced on the backend EC2 instances to mitigate the Layer 7 HTTP flood and provide scaling cost protection.

Deploy an Amazon CloudFront distribution in front of the S3 bucket and the ALB. Enable AWS Shield Advanced on the CloudFront distribution and associate an AWS WAF web ACL with a rate-based rule targeting the login endpoint.

Associate an AWS WAF web ACL directly with the ALB to mitigate the Layer 7 attack. Rely on AWS Shield Standard at the ALB to automatically block the Layer 4 SYN flood, and configure AWS Budgets to automatically shut down EC2 instances to prevent scaling charges.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the S3 bucket and the ALB. Enable AWS Shield Advanced on the CloudFront distribution and associate an AWS WAF web ACL with a rate-based rule targeting the login endpoint.

Answer

Deploying Amazon CloudFront in front of the S3 bucket and ALB places the entry point of the application at the AWS edge locations, providing a resilient outer layer. Associating an AWS WAF web ACL with a rate-based rule on the CloudFront distribution allows the system to identify and drop Layer 7 HTTP flood attacks targeting the login API endpoint before they reach the origin infrastructure. Furthermore, enabling AWS Shield Advanced on the CloudFront distribution provides dedicated Layer 3 and Layer 4 mitigation, access to the AWS Shield Response Team (SRT), and cost protection to cover scaling charges incurred due to auto-scaling during a DDoS attack.

Step-by-Step Solution

Determine the optimal location to place the entry point for DDoS mitigation.

Deploy Amazon CloudFront in front of both the S3 bucket and the Application Load Balancer.

Placing CloudFront at the edge locations ensures that malicious traffic is absorbed and filtered at the AWS network edge before reaching the origin servers.

Address the Layer 7 HTTP flood targeting the login endpoint.

Create an AWS WAF web ACL with a rate-based rule matching the login URI and associate it with the CloudFront distribution.

AWS WAF rate-based rules automatically track request rates from client IP addresses and temporarily block IPs exceeding the threshold, neutralizing the Layer 7 flood before it exhausts backend database connections.

Apply infrastructure protection and scaling charge safeguards.

Enable AWS Shield Advanced on the CloudFront distribution.

AWS Shield Advanced mitigates Layer 3/4 network and transport layer attacks (such as SYN floods) and provides financial protection to refund auto-scaling costs caused by DDoS-related traffic spikes.

Key Concept

Using Amazon CloudFront combined with AWS WAF and AWS Shield Advanced provides comprehensive edge-based Layer 3/4 and Layer 7 protection, along with financial safeguards against scaling charges.

Estimated Time:2m 30s

Question 368Question →

A smart home automation company processes real-time state change events, such as lock and unlock actions, from millions of smart door locks globally. For security auditing compliance, the events from each individual lock must be processed in the exact sequence they are generated. During peak hours, the backend database experiences write throttling due to sudden spikes in traffic. A solutions architect needs to decouple the ingestion and processing layers to handle the spikes while guaranteeing lock-level event ordering. Which combination of actions should the solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon SNS FIFO topic to receive the lock events, and subscribe an Amazon SQS FIFO queue to the topic.

Configure the event generator to use the unique lock ID as the Message Group ID when publishing events to the SNS FIFO topic.

Create a standard Amazon SQS queue to buffer the events, and configure the processing application to sort the messages by timestamp.

Create a standard Amazon SNS topic and subscribe multiple standard Amazon SQS queues, using Message Deduplication IDs to guarantee lock-level sequencing.

Configure an Amazon Kinesis Data Firehose stream to write the events directly to the database, setting a buffer interval to absorb spikes.

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic to receive the lock events, and subscribe an Amazon SQS FIFO queue to the topic.; Configure the event generator to use the unique lock ID as the Message Group ID when publishing events to the SNS FIFO topic.

Answer

To decouple the ingestion and processing layers while preserving ordering, the solutions architect must use an Amazon SNS FIFO topic to receive the events and subscribe an Amazon SQS FIFO queue to it, while setting the Message Group ID to the unique lock ID.

To meet compliance requirements, events must be processed in the exact order they occurred. Creating an Amazon SNS FIFO topic and subscribing an Amazon SQS FIFO queue provides a decoupled, resilient architecture that guarantees ordered message delivery. By utilizing the unique lock ID as the Message Group ID, the system ensures that messages for a specific lock are serialized and processed in order, while multiple consumers can still process events for different locks concurrently.

Step-by-Step Solution

Establish an ingestion and queuing system that supports ordering.

Use Amazon SNS FIFO topics and Amazon SQS FIFO queues to decouple messaging.

FIFO services guarantee that messages are delivered in the exact order they are received, preventing out-of-order processing.

Configure ordering granularity per lock ID.

Use the unique lock ID as the Message Group ID when publishing events.

The Message Group ID specifies that all messages belonging to the same group (lock ID) must be processed sequentially, while allowing parallel processing for different locks to ensure high throughput.

Key Concept

Decoupled architecture using SNS FIFO and SQS FIFO with Message Group IDs to preserve ordering per logical entity.

Estimated Time:1m 30s

Question 369Question →

A company is designing a microservices application on Amazon EC2 instances. The application requires local EBS volumes to be encrypted at rest, and the encryption key must be rotated annually without requiring the re-encryption of existing data. Additionally, the database credentials used by the application must be stored securely, cannot be stored in plaintext, and must be rotated every 30 days. Which combination of actions should the solutions architect take to meet these security requirements? (Select TWO.)

Select all that apply

Create a symmetric customer managed key (CMK) in AWS KMS and enable automatic key rotation for EBS volume encryption.

Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.

Store the database credentials in AWS Systems Manager Parameter Store as a String parameter and write a custom script to rotate the value.

Enable automatic key rotation for the KMS key, and configure an AWS Lambda function to immediately re-encrypt all existing EBS volumes and snapshots with the new key version.

Configure manual key rotation by creating a new customer managed key each year, updating the EBS volume configurations, and deleting the old key to prevent unauthorized access.

Show answer & explanation

Answer: Create a symmetric customer managed key (CMK) in AWS KMS and enable automatic key rotation for EBS volume encryption.; Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.

Answer

Create a symmetric customer managed key (CMK) in AWS KMS and enable automatic key rotation for EBS volume encryption, and store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.

The correct strategy combines using AWS Secrets Manager for credentials and a symmetric KMS Customer Managed Key (CMK) with automatic rotation enabled for EBS volume encryption. Secrets Manager securely stores the database credentials and manages rotation using Lambda. For EBS, KMS automatically rotates the key material annually without affecting the key ID or requiring manual re-encryption of existing data.

Step-by-Step Solution

Determine the secure storage and rotation mechanism for database credentials.

AWS Secrets Manager is chosen to securely store credentials and automate rotation via an AWS Lambda function.

Storing credentials in plaintext violates security rules, and Secrets Manager is designed for this specific use case.

Determine the encryption and rotation strategy for EBS volumes.

A symmetric Customer Managed Key (CMK) in AWS KMS is created with automatic rotation enabled.

Symmetric keys support automatic annual rotation of key material without needing manual re-encryption of existing data.

Key Concept

AWS KMS key rotation mechanics and secure secrets management

Question 370Question →

A financial services company processes transactions using an application hosted on AWS. The company needs to store transaction records in an Amazon S3 bucket. Compliance regulations mandate that the records must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). Additionally, the key material must be rotated annually, and the company must ensure that rotating the key does not require re-encrypting existing transaction data, while maintaining access to historical records. Which solution meets these requirements with the least operational effort?

Enable automatic key rotation for the customer managed key in AWS KMS.

Manually create a new customer managed key each year, update the S3 bucket configuration, and run an S3 Batch Operations job to re-encrypt all existing objects under the new key.

Store the encryption key in AWS Systems Manager Parameter Store as a standard parameter of type String, and write a custom AWS Lambda function to update the parameter value annually.

Use the AWS root account to create a new AWS managed key (aws/s3) each year and manually update the key policy to rotate the backing key material.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key in AWS KMS.

Answer

Enable automatic key rotation for the customer managed key in AWS KMS.

Enabling automatic key rotation for a customer managed key in AWS KMS automatically generates new key material annually. AWS KMS saves older key material to decrypt objects that were encrypted with those versions, avoiding the need to re-encrypt existing objects and minimizing operational effort.

Step-by-Step Solution

Analyze the encryption and compliance requirements.

The company needs to encrypt S3 data with a customer managed key, rotate it annually, keep access to historical data, and avoid re-encrypting existing data.

Understanding the security constraints helps eliminate options that do not support automatic rotation or require unnecessary re-encryption.

Evaluate the behavior of AWS KMS key rotation.

AWS KMS automatic key rotation creates new backing key material without changing the key ID. It retains older key material versions to decrypt historical data automatically without requiring object re-encryption.

This determines that enabling automatic rotation provides a zero-downtime, low-operational-overhead solution.

Identify and eliminate options that violate best practices or introduce operational overhead.

Discard manual key recreation and object re-encryption due to operational overhead, discard Parameter Store String parameters due to plaintext exposure, and discard root account usage due to privilege violations.

Ensures the selected answer is both compliant with security best practices and requires the least operational effort.

Key Concept

AWS KMS Automatic Key Rotation Mechanics

Question 371Question →

A logistics company is deploying a two-tier application in a new VPC. The web tier consists of Amazon EC2 instances in a public subnet ( $10.0.1.0/24$ ) behind an Application Load Balancer. The database tier consists of Amazon RDS MySQL instances in a private subnet ( $10.0.2.0/24$ ). The security team requires that the database subnet be isolated such that it only receives database connections from the web tier. Additionally, they must ensure the return traffic from the database can reach the web tier, while preventing any other egress traffic.

Which combination of Security Group and Network Access Control List (NACL) configurations meets these security requirements?

Associate a security group with the database instances that allows inbound TCP port

3306

traffic from the public subnet CIDR block (

10.0.1.0/24

). Configure the database subnet Network ACL (NACL) to allow inbound TCP port

3306

traffic from the web servers' security group, and allow outbound TCP traffic on ephemeral ports

1024-65535

to the public subnet CIDR block (

10.0.1.0/24

Associate a security group with the database instances that allows inbound TCP port

3306

traffic from the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port

3306

traffic from the public subnet CIDR block (

10.0.1.0/24

), and set the outbound Network ACL rules to deny all outbound traffic to prevent unauthorized database egress.

Associate a security group with the database instances that allows inbound TCP port

3306

traffic from the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port

3306

traffic from the public subnet CIDR block (

10.0.1.0/24

), and allow outbound TCP traffic on ephemeral ports

1024-65535

to the public subnet CIDR block (

10.0.1.0/24

Associate a security group with the database instances that allows inbound TCP port

3306

traffic from the web servers' security group, and outbound TCP traffic on ephemeral ports

1024-65535

to the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port

3306

traffic from the public subnet CIDR block (

10.0.1.0/24

), but configure no outbound rules in the Network ACL.

Show answer & explanation

Answer: Associate a security group with the database instances that allows inbound TCP port $3306$ traffic from the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port $3306$ traffic from the public subnet CIDR block ( $10.0.1.0/24$ ), and allow outbound TCP traffic on ephemeral ports $1024-65535$ to the public subnet CIDR block ( $10.0.1.0/24$ ).

Answer

Associate a security group with the database instances that allows inbound TCP port 3306 traffic from the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port 3306 traffic from the public subnet CIDR block (10.0.1.0/24), and allow outbound TCP traffic on ephemeral ports 1024-65535 to the public subnet CIDR block (10.0.1.0/24).

The correct answer provides the necessary stateful and stateless configurations to achieve isolation. The Security Group configuration references the web servers' security group for strict instance-to-instance access, which automatically allows stateful outbound responses. The Network ACL configuration defines stateless inbound rules for port

3306

and stateless outbound rules for the ephemeral ports (

1024-65535

) back to the public subnet, ensuring response packets are not dropped at the subnet boundary.

Step-by-Step Solution

Configure the database security group rule.

Create an inbound rule allowing TCP port

3306

from the source Web Security Group.

Security groups are stateful and allow least-privilege tracking of individual EC2 instances rather than hardcoded CIDRs.

Configure the database subnet inbound Network ACL rule.

Create an inbound rule allowing TCP port

3306

from the public subnet CIDR block (

10.0.1.0/24

Network ACLs operate at the subnet boundary and filter traffic using CIDR blocks. This allows incoming database requests from the web tier.

Configure the database subnet outbound Network ACL rule.

Create an outbound rule allowing TCP ports

1024-65535

to the public subnet CIDR block (

10.0.1.0/24

Since Network ACLs are stateless, return traffic must be explicitly allowed. MySQL client requests originating from the web servers use ephemeral ports (

1024-65535

) to receive the database response.

Key Concept

Stateful vs. Stateless Filtering in VPC Security

Question 372Question →

A company wants to set up an active-passive disaster recovery (DR) strategy for its primary web application running on an Application Load Balancer in the us-east-1 Region. The backup environment is a static maintenance page hosted in an Amazon S3 bucket in the us-west-2 Region. Which Amazon Route 53 configuration will meet this requirement with the least administrative effort during a failover event?

Configure an Amazon Route 53 Latency routing policy pointing to both the Application Load Balancer and the S3 bucket, relying on Route 53 to automatically direct all traffic to the S3 bucket if the primary Region experiences high latency.

Configure an Amazon Route 53 Weighted routing policy with the Application Load Balancer set to a weight of 100 and an Amazon RDS Read Replica in us-west-2 set to a weight of 0, expecting Route 53 to automatically promote and route traffic to the replica if the primary load balancer fails.

Configure an Amazon Route 53 Failover routing policy, designating the Application Load Balancer as the primary record associated with an active health check, and the S3 bucket as the secondary record.

Configure an Amazon Route 53 Geolocation routing policy pointing to the Application Load Balancer, and rely on a database replication mechanism to dynamically rewrite the DNS record to point to the S3 bucket during a failover.

Show answer & explanation

Answer: Configure an Amazon Route 53 Failover routing policy, designating the Application Load Balancer as the primary record associated with an active health check, and the S3 bucket as the secondary record.

Answer

The correct configuration uses a Route 53 Failover routing policy. In this setup, the primary record points to the active application endpoint (the Application Load Balancer) and is associated with a health check. The secondary record points to the disaster recovery resource (the S3 bucket hosting the static page). Route 53 continuously monitors the health of the primary endpoint and automatically shifts traffic to the secondary endpoint if the primary endpoint fails the health check, requiring no manual intervention.

Step-by-Step Solution

Identify the primary active resource and the secondary passive resource.

The Application Load Balancer is the primary active endpoint, and the S3 bucket is the secondary passive endpoint.

Active-passive disaster recovery requires establishing a clear primary path for regular traffic and a secondary path for failover situations.

Select the Route 53 routing policy designed for active-passive recovery.

Select the Failover routing policy.

Failover routing is built specifically to redirect traffic when a primary resource becomes unhealthy.

Associate an active health check with the primary record.

Route 53 will monitor the health of the Application Load Balancer and fail over to the S3 bucket if the health check fails.

Without a health check on the primary record, Route 53 cannot determine whether the primary endpoint is healthy and will not trigger the failover.

Key Concept

Route 53 Failover routing policy allows solutions architects to implement active-passive disaster recovery configurations by directing traffic to a secondary resource when the primary resource's health check fails.

Question 373Question →

A company is configuring a newly created AWS account. A solutions architect must set up secure administrative access for a newly hired systems engineer who will perform daily operations, such as managing Amazon EC2 instances and configuring Amazon S3 buckets. The systems engineer should not have access to billing information.

Which actions should the solutions architect take to configure this access securely? (Select TWO.)

Select all that apply

Create an IAM user for the systems engineer and attach a policy that grants only the permissions required for daily operations.

Enable multi-factor authentication (MFA) on both the AWS account root user and the systems engineer's IAM user.

Provide the systems engineer with the email address and password of the AWS account root user to perform daily operations.

Manually create individual IAM users with long-term access keys for each engineer in the corporate directory instead of configuring single sign-on federation.

Store the systems engineer's AWS access keys as plaintext String parameters in Systems Manager Parameter Store to automate command-line tasks.

Show answer & explanation

Answer: Create an IAM user for the systems engineer and attach a policy that grants only the permissions required for daily operations.; Enable multi-factor authentication (MFA) on both the AWS account root user and the systems engineer's IAM user.

Answer

Create an IAM user with least-privilege permissions and enable multi-factor authentication (MFA) for both the root user and the systems engineer's IAM user.

Creating a dedicated IAM user with only the necessary permissions ensures that the systems engineer cannot access billing or perform unauthorized actions, adhering to the principle of least privilege. Enabling multi-factor authentication (MFA) on both the root user and the IAM user provides an essential layer of security to prevent unauthorized access.

Step-by-Step Solution

Analyze requirements for the newly hired systems engineer.

The systems engineer requires access to manage EC2 and S3 for daily tasks but must not have access to billing or the ability to close the account.

This establishes that the systems engineer should not use the root account and requires restricted permissions.

Select the correct IAM identity type and permissions model.

Create an IAM user for the systems engineer and apply a policy granting only the necessary permissions.

This implements the principle of least privilege, isolating standard administrative work from billing and account ownership.

Apply multi-factor authentication (MFA) requirements.

Enable MFA on both the AWS account root user and the systems engineer's IAM user.

MFA is essential to secure administrative access and protect the account from unauthorized access.

Key Concept

Principle of least privilege and securing credentials using IAM users and MFA.

Estimated Time:1m 0s

Question 374Question →

A financial technology company is migrating two performance-critical workloads to AWS. The first workload is a transactional database that requires block storage with consistent sub-millisecond latency and a minimum of $60,000\text{ IOPS}$ on a single volume. The second workload is a distributed data analysis tool that requires a shared file system capable of scaling to tens of gigabytes per second of throughput while supporting POSIX file operations for multiple compute instances. Which two storage configurations should a solutions architect select to meet these performance requirements? (Select TWO.)

Select all that apply

An Amazon EBS io2 volume to store the database files.

An Amazon FSx for Lustre file system to store the data analysis tool's shared dataset.

An Amazon EBS gp3 volume to store the database files.

An Amazon Elastic File System (Amazon EFS) file system with Provisioned Throughput for the data analysis tool's shared dataset.

An Amazon S3 bucket mounted using Mountpoint for Amazon S3 for the data analysis tool's shared dataset.

Show answer & explanation

Answer: An Amazon EBS io2 volume to store the database files.; An Amazon FSx for Lustre file system to store the data analysis tool's shared dataset.

Answer

An Amazon EBS io2 volume to store the database files, and an Amazon FSx for Lustre file system to store the data analysis tool's shared dataset.

The database requirement of

60,000\text{ IOPS}

requires Amazon EBS io2 volumes because Amazon EBS gp3 volumes are capped at

16,000\text{ IOPS}

. The data analysis tool requires a shared POSIX file system that can handle tens of gigabytes per second of throughput, which is the primary use case for Amazon FSx for Lustre. Amazon EFS does not scale to this level of throughput, and Mountpoint for Amazon S3 does not support a full POSIX-compliant file system (such as random writes or file locking).

Step-by-Step Solution

Analyze the database performance requirement.

The database requires

60,000\text{ IOPS}

on a single block storage volume with sub-millisecond latency.

This requirement exceeds the maximum IOPS limit of Amazon EBS gp3 volumes (

16,000\text{ IOPS}

). Therefore, Provisioned IOPS SSD (io2) must be used, which supports up to

64,000\text{ IOPS}

on a single volume.

Analyze the data analysis tool performance and compatibility requirements.

The tool requires shared, POSIX-compliant storage scaling to tens of gigabytes per second of throughput.

Amazon FSx for Lustre is a high-performance shared file system that provides POSIX-compliant access and scales to hundreds of gigabytes per second of throughput. Standard EFS or S3 mounts cannot scale to tens of gigabytes per second under these conditions or lack complete POSIX compatibility.

Key Concept

High-Performing and Scalable Storage Solutions

Estimated Time:2m 0s

Question 375Question →

A company is setting up an automated deployment pipeline. A third-party CI/CD platform hosted outside of AWS needs to deploy infrastructure changes to the company's AWS account. The company's security policy prohibits the use of long-term credentials for external integrations. Which combination of actions should a solutions architect perform to grant the CI/CD platform access to the AWS account? (Select TWO.)

Select all that apply

Configure an OpenID Connect (OIDC) identity provider in IAM that trusts the external CI/CD provider as the issuer.

Create an IAM user with programmatic access keys, store these credentials in the CI/CD service's secrets settings, and write an AWS Lambda function to rotate the keys daily.

Create an IAM user for the CI/CD pipeline, and save the access key ID and secret access key as standard String parameters in AWS Systems Manager Parameter Store to allow external retrieval.

Create an IAM role with a trust policy that allows the external CI/CD provider's OIDC identity provider to assume the role using the sts:AssumeRoleWithWebIdentity action.

Generate access keys for the AWS account root user and store them in the external CI/CD platform's repository secrets to ensure administrative deployment privileges.

Show answer & explanation

Answer: Configure an OpenID Connect (OIDC) identity provider in IAM that trusts the external CI/CD provider as the issuer.; Create an IAM role with a trust policy that allows the external CI/CD provider's OIDC identity provider to assume the role using the sts:AssumeRoleWithWebIdentity action.

Answer

To grant secure access without long-term credentials, configure an OpenID Connect (OIDC) identity provider in IAM that trusts the external CI/CD provider as the issuer, and create an IAM role with a trust policy that allows the external OIDC provider to assume the role using the sts:AssumeRoleWithWebIdentity action.

To grant secure access without long-term credentials, the architect should use OpenID Connect (OIDC) identity federation. First, configuring an OpenID Connect (OIDC) identity provider in IAM establishes a trust relationship between AWS and the external CI/CD platform. Second, creating an IAM role with a trust policy that allows the external OIDC provider to assume the role using the sts:AssumeRoleWithWebIdentity action enables the CI/CD pipeline to exchange OIDC tokens for short-lived, temporary AWS credentials.

Step-by-Step Solution

Establish trust with the external provider.

An OpenID Connect (OIDC) identity provider (IdP) is registered in the company's AWS account, trusting the external CI/CD platform as the token issuer.

This allows AWS to validate authentication tokens issued by the external CI/CD provider without needing long-term AWS access keys.

Create an IAM role for authorization.

An IAM role is created with a trust policy allowing the OIDC provider to assume it via the sts:AssumeRoleWithWebIdentity action, and permissions are attached to it.

This grants temporary credentials to the external provider specifically during pipeline runs, adhering to the principle of least privilege.

Key Concept

OpenID Connect (OIDC) Federation for temporary AWS credentials

Question 376Question →

An e-commerce company hosts its inventory application tier on Amazon EC2 instances inside a public subnet with CIDR block $172.16.10.0/24$ . The application connects to a MySQL database cluster running on EC2 instances in a private subnet with CIDR block $172.16.20.0/24$ . A solutions architect is configuring a new custom Network ACL for the private subnet. The architect adds an inbound rule to the Network ACL allowing TCP port $3306$ from the public subnet CIDR block $172.16.10.0/24$ . The database security group already permits inbound traffic on port $3306$ from the application instances. However, after applying the new Network ACL, database connections from the application tier fail. Which action will resolve this issue?

Add an outbound rule to the database instances' security group that allows outbound TCP traffic to

172.16.10.0/24

on port

3306

Add an outbound rule to the private subnet's Network ACL that allows outbound TCP traffic to

172.16.10.0/24

on ephemeral ports

1024-65535

Change the private subnet's Network ACL inbound rule to allow all traffic, and configure the database instances' security group as stateless to handle the return traffic dynamically.

Add an outbound rule to the private subnet's Network ACL that allows outbound TCP traffic to

172.16.10.0/24

on port

3306

Show answer & explanation

Answer: Add an outbound rule to the private subnet's Network ACL that allows outbound TCP traffic to $172.16.10.0/24$ on ephemeral ports $1024-65535$ .

Answer

Add an outbound rule to the private subnet's Network ACL that allows outbound TCP traffic to

172.16.10.0/24

on ephemeral ports

1024-65535

The correct answer is to add an outbound rule to the private subnet's Network ACL allowing traffic to the public subnet on ephemeral ports. Network ACLs are stateless network boundaries. When an inbound connection on port

3306

is allowed into the private subnet, the return traffic from the database to the application tier uses a high-numbered ephemeral destination port. Because Network ACLs do not automatically track session state, an outbound rule must explicitly permit this return traffic on ephemeral ports (

1024-65535

) for the connection to succeed.

Step-by-Step Solution

Analyze the stateful and stateless characteristics of the security controls in place.

The database security group is stateful, meaning it automatically allows outbound return traffic. The Network ACL is stateless, meaning it evaluates inbound and outbound traffic independently.

Understanding that Network ACLs require explicit rules for both directions is critical to resolving connectivity issues.

Determine the destination port used by the return traffic from the database to the application client.

The client establishes a connection from an ephemeral source port (typically

1024-65535

) to the database destination port (

3306

). The return traffic from the database back to the client will have a destination port in the ephemeral range.

Stateless filtering requires configuring outbound rules that match the destination ports of the response packets.

Configure the outbound rule on the private subnet's Network ACL to allow the ephemeral port range to the client's subnet.

Adding an outbound rule allowing TCP traffic to the public subnet (

172.16.10.0/24

) on ports

1024-65535

enables the return traffic to pass successfully.

This completes the bidirectional path required by stateless Network ACLs for TCP handshakes and data exchange.

Key Concept

Network ACLs are stateless and require explicit outbound rules to permit return traffic. When a client connects to a server, the server responds to the client's ephemeral source port. Therefore, the stateless firewall protecting the server must allow outbound traffic to the client's IP address range on ephemeral ports (

1024-65535

Question 377Question →

A logistics company is building a high-throughput route optimization engine on Amazon EC2. The workload requires a fleet of compute-optimized instances to communicate with each other over a low-latency network using Message Passing Interface (MPI). The instances also run a management daemon on port 9090 which needs to be monitored by an Application Load Balancer (ALB) target group. Which two actions should the solutions architect take to meet these performance and monitoring requirements?

Select all that apply

Launch the EC2 instances in a cluster placement group.

Configure the ALB target group health checks to specifically query port 9090.

Launch the EC2 instances in a spread placement group.

Launch the EC2 instances in a partition placement group.

Configure the ALB target group health checks to use the default traffic port while setting the daemon port to 9090.

Show answer & explanation

Answer: Launch the EC2 instances in a cluster placement group.; Configure the ALB target group health checks to specifically query port 9090.

Answer

Launch the EC2 instances in a cluster placement group and configure the ALB target group health checks to specifically query port 9090.

The correct configuration requires launching the instances in a cluster placement group to minimize network latency for the MPI workload, and configuring the target group health checks to target the custom port where the daemon is listening to prevent false unhealthy states.

Step-by-Step Solution

Determine the networking placement requirement for tightly coupled MPI compute nodes.

Identify that a cluster placement group is required to achieve the necessary low-latency and high-throughput node-to-node network performance.

MPI workloads require tight synchronization and minimal latency, which cluster placement groups provide by locating instances close together on the underlying hardware.

Determine the health monitoring configuration for the management daemon.

Identify that the health check must be explicitly configured to monitor port 9090.

By default, health checks use the traffic port or default port 80. If the daemon runs on custom port 9090, health checks to other ports will fail, marking the instances as unhealthy.

Key Concept

Low-latency EC2 placement groups and custom port target group health checking

Question 378Question →

A company is setting up a hybrid network connection between their on-premises database and a VPC in AWS. They require a secure connection with a minimum throughput of $2\text{ Gbps}$ to replicate database logs. They provision a single AWS Site-to-Site VPN connection, but find that the throughput per tunnel does not meet their requirement. Which of the following options correctly identifies the throughput limit of a single AWS Site-to-Site VPN tunnel and the solution to scale the bandwidth?

A single VPN tunnel can scale dynamically to support up to

5\text{ Gbps}

of throughput by increasing the MTU size on the virtual private gateway, so no additional tunnels are necessary.

A single VPN tunnel is limited to

1.25\text{ Gbps}

due to stateful packet tracking. The company should replace all stateful Security Groups with stateless Network ACLs to allow the tunnel to scale up to

10\text{ Gbps}

A single VPN tunnel is limited to a maximum throughput of

1.25\text{ Gbps}

. To scale the throughput, the company should establish multiple VPN tunnels to an AWS Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing.

A single VPN tunnel is limited to

1.25\text{ Gbps}

. The company should implement Amazon Route 53 latency-based routing at the customer gateway to automatically distribute the VPN traffic across different AWS Regions.

Show answer & explanation

Answer: A single VPN tunnel is limited to a maximum throughput of $1.25\text{ Gbps}$ . To scale the throughput, the company should establish multiple VPN tunnels to an AWS Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing.

Answer

A single VPN tunnel is limited to a maximum throughput of

1.25\text{ Gbps}

. To scale the throughput, the company should establish multiple VPN tunnels to an AWS Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing.

The correct option correctly states that each Site-to-Site VPN tunnel is limited to

1.25\text{ Gbps}

. To scale capacity beyond this point, multiple VPN connections can be attached to an AWS Transit Gateway. By enabling Equal-Cost Multi-Path (ECMP) routing on the Transit Gateway and the Customer Gateway, AWS can load balance packets across multiple tunnels, aggregating the overall bandwidth to meet or exceed the

2\text{ Gbps}

requirement.

Step-by-Step Solution

Identify the hard limit of a single AWS Site-to-Site VPN tunnel.

Each VPN tunnel supports a maximum bandwidth of

1.25\text{ Gbps}

Understanding the inherent physical and configuration limits of AWS networking services is necessary to determine if a simple setup meets the requirements.

Evaluate the required capacity against the single-tunnel limit.

The required database replication bandwidth (

2\text{ Gbps}

) exceeds the single-tunnel capacity of

1.25\text{ Gbps}

Comparing the target metric against the single-resource capability dictates the architectural pattern needed (scaling out).

Choose a scalable architecture to aggregate multiple tunnels.

Establish multiple VPN connections terminating at an AWS Transit Gateway with ECMP enabled.

Transit Gateway supports ECMP, which allows traffic to be dynamically distributed across multiple paths, effectively multiplying the overall connection throughput.

Key Concept

AWS Site-to-Site VPN throughput limits and Transit Gateway ECMP scaling

Estimated Time:1m 0s

Question 379Question →

A startup is launching a mobile fitness tracking application. The application's database must handle write-heavy transaction workloads that are highly unpredictable, with sudden bursts of traffic when popular workouts are shared. The company wants to minimize costs and avoid paying for idle resources, while ensuring no write requests are throttled. Which database configuration should the solutions architect recommend to meet these requirements most cost-effectively?

Use Amazon DynamoDB configured with provisioned capacity mode and enable auto-scaling to adjust capacity based on utilization.

Use Amazon DynamoDB configured with on-demand capacity mode.

Use Amazon RDS for PostgreSQL with a Multi-AZ deployment and purchase a Compute Savings Plan to reduce compute costs during peak hours.

Use Amazon RDS for MySQL with a Single-AZ deployment and configure an RDS Read Replica as the primary automatic failover target to ensure cost-optimal disaster recovery.

Show answer & explanation

Answer: Use Amazon DynamoDB configured with on-demand capacity mode.

Answer

Use Amazon DynamoDB configured with on-demand capacity mode.

The correct answer is the option recommending Amazon DynamoDB in on-demand capacity mode. For highly spiky and unpredictable write workloads with idle periods, on-demand capacity mode is the most cost-effective solution. It automatically scales to accommodate the write bursts instantly, ensuring no requests are throttled, and charges only for the request units consumed, resulting in zero cost during idle periods.

Step-by-Step Solution

Analyze the workload characteristics

The workload is characterized by highly unpredictable, spiky write transactions with long idle times.

Understanding the traffic pattern is essential to choosing between provisioned and on-demand database capacities.

Evaluate the cost and performance trade-offs of the database engines and capacity modes

Amazon DynamoDB with on-demand capacity mode accommodates instant traffic spikes without throttling and incurs zero cost when there is no traffic.

This step ensures that the recommended solution satisfies both the performance requirement (no throttling) and the cost requirement (no paying for idle resource capacity).

Eliminate incorrect cost-saving and database options

Discard options suggesting Compute Savings Plans for RDS (which are unsupported) and reactive auto-scaling or read replica failovers (which fail to handle instant write spikes or high-availability requirements cost-effectively).

Eliminating invalid configurations confirms that the serverless on-demand option is the only structurally sound and cost-optimal recommendation.

Key Concept

Selecting the cost-optimal database engine and capacity planning strategy for unpredictable, spiky workloads.

Question 380Question →

An e-commerce company is migrating its ordering database to AWS and requires a resilient design using Amazon RDS for PostgreSQL. The database must survive an Availability Zone (AZ) outage with a Recovery Time Objective (RTO) of under 60 seconds, and it must support horizontal read scaling for search queries within the same AWS Region. Which configuration meets these requirements with the lowest operational overhead?

Deploy a Single-AZ DB instance and create an asynchronous Read Replica in a different Availability Zone, configuring the application to promote the replica during an outage.

Deploy a Multi-AZ DB cluster with one primary and two readable standby DB instances.

Deploy a Multi-AZ DB instance deployment, and configure Route 53 latency-based routing to load balance write operations across a replica in another AWS Region.

Deploy a Single-AZ DB instance, and configure a warm standby DB instance in a separate Availability Zone that is synchronized daily using Amazon RDS snapshots.

Show answer & explanation

Answer: Deploy a Multi-AZ DB cluster with one primary and two readable standby DB instances.

Answer

Deploy a Multi-AZ DB cluster with one primary and two readable standby DB instances.

The correct configuration is a Multi-AZ DB cluster with one primary and two readable standby DB instances. This option provides high availability by automatically failing over in less than 35 seconds, which satisfies the RTO requirement. It also natively supports horizontal read scaling because both standby DB instances can accept read requests through the reader endpoint.

Step-by-Step Solution

Analyze high availability and read scaling requirements.

The configuration must support a failover time (RTO) of less than 60 seconds during an Availability Zone outage and offer read scalability within the same region.

This establishes the constraints needed to rule out configurations that do not support automated failover or read endpoint integration.

Compare Multi-AZ DB instances against Multi-AZ DB clusters.

A standard Multi-AZ DB instance provides failover but the standby instance cannot serve read traffic. A Multi-AZ DB cluster provides automated failover and allows its two standby instances to process read queries.

Choosing the cluster configuration satisfies both failover and read scaling within a single native RDS architecture, minimizing operational complexity.

Verify compliance with the RTO constraint.

Amazon RDS Multi-AZ DB clusters fail over in under 35 seconds, which is well within the 60-second RTO.

This confirms the proposed architecture meets all defined service level requirements.

Key Concept

Amazon RDS Multi-AZ DB clusters combine high availability (automated failover) and read scalability by deploying a primary and two readable standby instances across three Availability Zones.

Estimated Time:2m 0s

PreviousPage 19 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept