Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 21Question →

A weather research institute is deploying a distributed numerical weather prediction model on Amazon EC2. The application consists of tightly-coupled compute nodes that require sub-millisecond node-to-node network latency and maximum throughput to exchange state data. Additionally, a Solutions Architect must configure an Application Load Balancer (ALB) to route incoming analysis requests to the compute nodes, which listen on custom port 8080. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the EC2 instances in a cluster placement group.; Configure the Application Load Balancer target group health check to query port 8080.

Answer

Deploying the EC2 instances in a cluster placement group and configuring the Application Load Balancer target group health check to query port 8080.
Deploying the EC2 instances in a cluster placement group places the instances close together within a single Availability Zone, which satisfies the requirement for sub-millisecond node-to-node latency and maximum network throughput. Additionally, because the application is listening on a custom port 8080, the target group health check must be explicitly configured to query port 8080 to ensure the load balancer can correctly monitor the application's status.

Step-by-Step Solution

1
Analyze the networking requirements of the distributed weather forecasting simulation nodes.
The nodes are tightly coupled and require sub-millisecond node-to-node latency and high network throughput.
This requirement determines the type of EC2 placement group needed.
2
Select the correct EC2 placement group style.
A cluster placement group is selected because it packs instances close together inside a single Availability Zone, achieving the lowest possible latency and highest network performance.
Spread and partition placement groups do not guarantee low-latency node-to-node communication.
3
Configure the Application Load Balancer target group settings for the simulation service.
The target group's health check is explicitly configured to query port 8080, matching the custom port on which the simulation service runs.
If the health check defaults to another port like 80, the load balancer will fail to reach the service, marking the healthy instances as unhealthy.

Key Concept

High-Performance Compute placement groups and target group health check port synchronization.
Estimated Time:2m 0s
Question 22Question →

A smart home IoT telemetry company runs its device monitoring platform in the us-east-1 Region. The database tier uses Amazon RDS for PostgreSQL. The compute tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The company needs to design a disaster recovery (DR) plan in the us-west-2 Region. The design must achieve a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 30 minutes, while keeping costs as low as possible. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a cross-region read replica of the database in the secondary Region, and promote the replica to a standalone DB instance during a failover event.; Maintain a warm standby compute environment in the secondary Region with a scaled-down Auto Scaling group of EC2 instances, and scale it up to handle production traffic during a failover.

Answer

The correct combination of actions is to configure a cross-region read replica of the database in the secondary Region, promoting it to a standalone DB instance during failover, and to maintain a warm standby compute environment in the secondary Region with a scaled-down Auto Scaling group of EC2 instances, scaling it up to handle production traffic during failover.
The correct strategy combines a database cross-region read replica and a warm standby compute environment. The cross-region read replica replicates data asynchronously, meeting the 5-minute RPO, and can be promoted to primary within minutes. A warm standby compute tier runs at a minimal capacity to reduce costs, and can be scaled out within 30 minutes to satisfy the RTO.

Step-by-Step Solution

1
Analyze the disaster recovery objectives: RPO is 5 minutes, and RTO is 30 minutes.
The replication lag must be under 5 minutes, and the recovery process (database promotion and compute scaling) must take less than 30 minutes.
This establishes the boundaries for data replication and infrastructure restoration speed.
2
Select the database replication strategy.
An Amazon RDS cross-region read replica provides asynchronous replication with low lag (meeting RPO) and can be promoted quickly (meeting RTO). RDS Multi-AZ is rejected because it is limited to a single Region.
Choosing the database configuration that provides cross-region capabilities is necessary to meet both RPO and RTO constraints.
3
Select the compute recovery strategy.
A warm standby compute environment keeps a scaled-down Auto Scaling group running in the secondary Region, keeping costs low while allowing quick scale-up during failover to meet the RTO.
This ensures the compute capacity is ready to serve traffic within the 30-minute RTO window without incurring the full cost of an active-active setup.

Key Concept

Disaster recovery strategies differ in RTO, RPO, and cost. A warm standby approach combined with cross-region read replicas provides a cost-effective solution for low RTO and RPO requirements across AWS Regions.
Question 23Question →

An enterprise application hosted on Amazon ECS tasks in a private VPC must connect to a legacy PostgreSQL database hosted on-premises via an AWS Direct Connect connection. The database credentials must be rotated every 30 days to comply with security regulations. The rotation process must be automated, secure at rest, and must not require changes to the application deployment pipeline. Which database credential management solution meets these security requirements with the least operational overhead?

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager. Configure a 30-day rotation schedule for the secret and deploy a custom AWS Lambda function within the VPC to update the credentials on both the PostgreSQL database and the Secrets Manager secret.

Answer

Store the database credentials in AWS Secrets Manager, configuring a 30-day rotation schedule along with a custom AWS Lambda function in the VPC to update the credentials in both the database and the secret.
The correct solution uses AWS Secrets Manager, which natively orchestrates credential rotation. Because the target PostgreSQL database is legacy and on-premises, a custom Lambda function running in the private VPC is required to bridge the connectivity over AWS Direct Connect and safely update both the database password and the secrets store.

Step-by-Step Solution

1
Select a secrets management service that supports secure storage and automated rotation.
AWS Secrets Manager is chosen over Systems Manager Parameter Store because Secrets Manager has built-in integration for automated rotation schedules.
Parameter Store lacks native credential rotation orchestration and requires building custom schedulers and notification flows.
2
Ensure network connectivity for the rotation mechanism.
The Lambda rotation function must be associated with the VPC to route traffic over the AWS Direct Connect connection to the on-premises database.
Since the database is private on-premises, a Lambda function running outside the VPC cannot resolve or connect to the database endpoints.
3
Configure rotation mechanics using the rotation Lambda function.
The Lambda function updates the credential on the PostgreSQL database first, verifies connectivity, and then calls the Secrets Manager API to update the secret value.
This guarantees that the credential in the secret manager is always synchronized with the database, avoiding service disruption.

Key Concept

Secrets Manager vs Parameter Store Rotation and Encryption Mechanics
Question 24Question →

A company is using AWS Organizations to manage a multi-account environment. The security team wants to implement a centralized identity management solution that allows corporate employees to authenticate using their existing external Identity Provider (IdP) credentials and access resources across multiple AWS accounts. Additionally, the security team needs to prevent individual member accounts from disabling AWS CloudTrail logging. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external IdP. Assign permission sets to users and groups for AWS Organizations member accounts. Apply a Service Control Policy (SCP) at the root level of the organization that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions on all member Organizational Units (OUs).

Answer

Configure AWS IAM Identity Center to federate with the external Identity Provider (IdP), assign permission sets to users and groups for AWS Organizations member accounts, and apply a Service Control Policy (SCP) at the root level of the organization to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions on all member Organizational Units (OUs).
The correct solution uses AWS IAM Identity Center to establish federation with the external Identity Provider, enabling centralized authentication without creating individual IAM users. By applying a Service Control Policy at the Organization root level, the policy is inherited by all member accounts and organizational units, preventing administrators in member accounts from stopping or deleting AWS CloudTrail.

Step-by-Step Solution

1
Configure AWS IAM Identity Center to federate with the external Identity Provider (IdP).
Establishes a single sign-on (SSO) gateway allowing enterprise users to access AWS accounts using their existing corporate credentials without local IAM user provisioning.
Reduces operational overhead and centralizes identity management by delegating authentication to the external IdP.
2
Create permission sets and assign them to users and groups across the organization accounts.
Users and groups receive permissions defined by the permission sets in specific AWS accounts.
Allows fine-grained access control across multiple accounts in AWS Organizations.
3
Create and attach a Service Control Policy (SCP) to the organization's root or member OUs that denies CloudTrail deletion and stop logging actions.
Ensures all member accounts inherit the policy, prohibiting users (including account administrators) from stopping or deleting trails.
Enforces governance and compliance controls uniformly across all member accounts in a multi-account organization.

Key Concept

Centralized federation and organization-wide governance policies using AWS IAM Identity Center and Service Control Policies (SCPs).
Estimated Time:2m 0s
Question 25Question →

A company is designing a secure architecture for an application running on Amazon EC2 instances. The application needs to retrieve data from an Amazon RDS database and store reports in an Amazon S3 bucket. The security policy mandates that:

1. The EC2 instances must use short-term credentials to access the S3 bucket.
2. The database credentials must be rotated every 30 days without downtime.
3. The AWS KMS Customer Managed Key (CMK) used to encrypt S3 reports must be rotated annually without interrupting access to historical reports.

Which combination of actions should the company perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM role to the EC2 instances to grant S3 permissions, and use AWS Secrets Manager to store and automatically rotate the database credentials every 30 days.; Enable automatic annual rotation for the KMS Customer Managed Key, which creates a new backing key version for new writes while keeping old versions available for decryption.

Answer

The correct options are the ones suggesting to attach an IAM role to the EC2 instances and store database credentials in AWS Secrets Manager, and to enable automatic annual rotation for the KMS Customer Managed Key.
Attaching an IAM role to the EC2 instances allows them to retrieve temporary credentials to access the S3 bucket safely. AWS Secrets Manager can store database credentials and rotate them automatically without downtime. Enabling automatic annual key rotation on KMS Customer Managed Keys manages the backing keys seamlessly: it uses the new backing key for encryption, while keeping older backing key versions available to decrypt historical data without needing manual re-encryption or application updates.

Step-by-Step Solution

1
Address the requirement for secure, temporary credentials for the EC2 instances.
Attach an IAM role to the EC2 instances instead of using long-term IAM user access keys.
IAM roles utilize AWS Security Token Service (STS) to provide temporary security credentials, reducing credential leakage risks.
2
Address the requirement for database credential storage and automated rotation.
Use AWS Secrets Manager to store credentials and configure a 30-day automatic rotation schedule.
AWS Secrets Manager natively integrates with RDS to rotate credentials using Lambda without application downtime.
3
Address the requirement for KMS Customer Managed Key rotation.
Enable automatic annual rotation for the customer managed key.
Automatic KMS key rotation generates a new backing key for encryption while preserving older backing key versions for seamless decryption of historical data, requiring no manual re-encryption.

Key Concept

AWS Identity and Access Management (IAM) Roles, Secrets Manager rotation integration, and AWS KMS automatic key rotation mechanics.
Question 26Question →

A ride-sharing platform is designing an event-driven system to process ride status updates (such as requested, accepted, driver_arrived, and ride_ended) sent from driver mobile applications. To maintain a correct trip history, updates for each specific ride must be processed in the exact sequence they are generated. The platform must handle sudden spikes in traffic during peak hours without losing messages, and the upstream ingestion layer must be decoupled from the downstream processing application. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Publish the updates to an Amazon SNS FIFO topic. Subscribe an Amazon SQS FIFO queue to the topic, and configure the downstream application to process messages from the queue using the ride ID as the message group ID.

Answer

Publish the updates to an Amazon SNS FIFO topic. Subscribe an Amazon SQS FIFO queue to the topic, and configure the downstream application to process messages from the queue using the ride ID as the message group ID.
The correct solution uses an Amazon SNS FIFO topic subscribed to by an Amazon SQS FIFO queue. SNS FIFO and SQS FIFO queues guarantee first-in, first-out (FIFO) delivery within a message group. By setting the ride ID as the message group ID, the platform ensures that updates for any single ride are processed in the order they were sent. This serverless solution handles scaling and message buffering automatically, minimizing operational overhead.

Step-by-Step Solution

1
Analyze the requirements for message ordering and decoupling.
Identified that the solution must guarantee strict ordering of messages per ride ID (sequence of status updates) and decouple upstream mobile apps from downstream processing.
This helps narrow down the choices to AWS messaging services that support FIFO (First-In-First-Out) capabilities.
2
Evaluate the capabilities of Amazon SNS and SQS for ordering.
Standard SNS and SQS queues do not guarantee ordering, whereas SNS FIFO and SQS FIFO queues guarantee strict ordering of messages within the same message group.
The ride ID must be used as the message group ID to ensure that messages belonging to the same ride are processed in sequence.
3
Select the option with the least operational overhead.
The serverless combination of SNS FIFO and SQS FIFO requires no infrastructure management and satisfies all decoupling and ordering constraints.
Custom solutions using ElastiCache or other databases require provisioning and management of compute resources, resulting in higher operational overhead.

Key Concept

Decoupling event-driven architectures requiring strict message ordering using SNS/SQS FIFO.
Question 27Question →

An organization operates a multi-account AWS environment managed under AWS Organizations. An application running on Amazon EC2 instances in a production member account must securely access and decrypt highly confidential financial data stored in an Amazon S3 bucket within a shared services account. The S3 bucket is encrypted with an AWS KMS customer managed key located in the shared services account. The solution must also retrieve database credentials that require rotation every 3030 days.

Which design should a solutions architect implement to meet these security requirements?

Show answer & explanation

Answer: Attach an IAM instance profile to the EC2 instances that references an IAM role. Configure the KMS key policy and the S3 bucket policy in the shared services account to grant permissions to the EC2 role. Store the database credentials in AWS Secrets Manager and enable automatic rotation every 3030 days using an AWS Lambda function.

Answer

Attach an IAM instance profile to the EC2 instances that references an IAM role, configure cross-account permissions in the shared services account's S3 bucket policy and KMS key policy to trust the role, and store and automatically rotate the credentials in AWS Secrets Manager using a Lambda function.
The correct solution uses an IAM instance profile to assign temporary credentials to the EC2 instances. For cross-account access to S3 and KMS in the shared services account, both the S3 bucket policy and the KMS key policy must trust the EC2 role from the production account. Storing and rotating database credentials every 3030 days is a native capability of AWS Secrets Manager using AWS Lambda, representing the most secure and low-overhead solution.

Step-by-Step Solution

1
Configure the identity foundation for the EC2 instances using temporary credentials.
Create an IAM role and associate it with an IAM instance profile attached to the EC2 instances, eliminating the need for hardcoded credentials.
This follows the security principle of least privilege and avoids storing long-term credentials on EC2 instances.
2
Establish trust and permissions across AWS accounts.
Update the S3 bucket policy and KMS key policy in the shared services account to grant the required permissions (such as s3:GetObject and kms:Decrypt) to the ARN of the IAM role in the production account.
For cross-account access, both the IAM policy in the source account and the resource policies in the target account must allow the operations.
3
Securely store and automate rotation of the database credentials.
Store the database credentials in AWS Secrets Manager, and configure the built-in rotation mechanism with an AWS Lambda function set to trigger every 3030 days.
AWS Secrets Manager is designed to manage database secrets securely and provides out-of-the-box integration with AWS Lambda to rotate credentials automatically.

Key Concept

Cross-account resource access using IAM roles combined with secure secrets management and rotation.
Estimated Time:2m 30s
Question 28Question →

A logistics company is designing an event-driven delivery tracking system. Status updates for each delivery package must be processed in the exact chronological order in which they are generated by drivers. The updates need to be delivered to two separate systems: an analytics dashboard that requires strict ordering of events per package, and an audit service that does not require ordered processing. The solution must scale to handle traffic spikes during peak hours without losing any updates.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic to receive the updates, and subscribe an Amazon SQS FIFO queue to the topic for the analytics dashboard.; Subscribe an Amazon SQS Standard queue to the Amazon SNS FIFO topic for the audit service.

Answer

Create an Amazon SNS FIFO topic and subscribe an Amazon SQS FIFO queue to it for the ordered analytics dashboard, and subscribe an Amazon SQS Standard queue to the same SNS FIFO topic for the unordered audit service.
To preserve message ordering during a fan-out pattern, an Amazon SNS FIFO topic must be used. SQS FIFO queues can be subscribed to the SNS FIFO topic to receive messages in chronological order, satisfying the requirements of the analytics dashboard. SQS Standard queues can also be subscribed to the same SNS FIFO topic, which satisfies the audit service's requirement since it does not need ordered processing.

Step-by-Step Solution

1
Identify the ordering requirements and fan-out architecture.
The analytics dashboard requires strict chronological order per package, while the audit service can process updates out of order. Both must receive all updates, necessitating a fan-out pattern.
This establishes that we need a messaging service capable of fan-out (such as Amazon SNS) combined with queuing (Amazon SQS) to decouple the publishers and subscribers.
2
Select the appropriate Amazon SNS topic type.
Choose Amazon SNS FIFO because it guarantees message ordering and deduplication, and supports delivering to SQS FIFO queues.
Standard SNS topics do not guarantee ordering and cannot deliver to SQS FIFO queues.
3
Select and subscribe the queues for each consumer.
Subscribe an Amazon SQS FIFO queue to the SNS FIFO topic for the ordered analytics dashboard. Subscribe an Amazon SQS Standard queue to the same SNS FIFO topic for the unordered audit service.
This setup preserves ordering for the dashboard through the end-to-end FIFO path while allowing the audit service to consume messages using a standard queue, since ordering is not required for auditing.

Key Concept

FIFO Fan-out using SNS FIFO and SQS FIFO/Standard
Question 29Question →

An organization hosts a legacy payroll application on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The payroll application runs on port 8088. The target group is configured to route HTTP traffic to the EC2 instances on port 8088. The EC2 instances are in a security group that allows inbound traffic on port 8088 from the ALB's security group. However, the ALB marks all registered EC2 instances as unhealthy. A solutions architect discovers that the target group's health checks are configured to use HTTP on port 80. How should the solutions architect resolve this issue and restore the system to a healthy state?

Show answer & explanation

Answer: Modify the target group's health check settings to use port 8088 or set the health check port to traffic-port.

Answer

Modify the target group's health check settings to use port 8088 or set the health check port to traffic-port.
The correct option is to modify the target group's health check settings to use port 8088 or 'traffic-port'. By default, the ALB target group health check uses the port configured for traffic routing ('traffic-port') unless overridden. If it was overridden to port 80, the health check requests will be sent to port 80 on the EC2 instances. Since the payroll application is listening on port 8088 and no service is listening on port 80, the health checks will fail. Correcting the health check port resolves this mismatch.

Step-by-Step Solution

1
Analyze the application listening port and the target group health check configuration.
The application is listening on port 8088, but health checks are being sent to port 80.
Identify the mismatch between where the service is active and where the load balancer is querying for health status.
2
Determine the impact of the configuration mismatch.
Since no process on the EC2 instances is listening on port 80, connection attempts by the ALB fail, and instances are marked unhealthy.
Explain why the instances are failing the health checks despite having security group rules permitting traffic on port 8088.
3
Align the health check port with the application port.
Change the health check port configuration to port 8088 or specify 'traffic-port' to dynamically match the target group's routing port.
Ensures the health check queries the port where the payload application is running, allowing successful health status updates.

Key Concept

ELB Target Group Health Check Port Configuration
Estimated Time:1m 30s
Question 30Question →

A company hosts a containerized backend application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application listens on custom port 8443, and the ALB terminates SSL/TLS on port 443. The solutions architect notices two issues: first, when instances fail internally, the ALB marks them as unhealthy, but the ASG continues to treat them as healthy and does not replace them; second, newly launched instances fail health checks immediately because traffic is blocked between the ALB and the instances. Which actions should the solutions architect take to resolve these issues and ensure a resilient architecture? (Select two.)

Select all that apply

Show answer & explanation

Answer: Update the health check type of the Auto Scaling group from EC2 to ELB.; Configure the target group's health check to use port 8443, and ensure the EC2 instances' security group allows inbound traffic from the ALB security group on port 8443.

Answer

The correct actions are to update the health check type of the Auto Scaling group from EC2 to ELB, configure the target group's health check to use port 8443, and ensure the EC2 instances' security group allows inbound traffic from the ALB security group on port 8443.
To ensure that unhealthy application instances are replaced, the Auto Scaling group's health check type must be updated from EC2 to ELB so that target group health status changes trigger auto-replacement. Additionally, because the application runs on custom port 8443, the target group's health check must be explicitly set to port 8443, and the security group of the EC2 instances must allow inbound traffic from the ALB security group on port 8443.

Step-by-Step Solution

1
Analyze the Auto Scaling group health check settings.
Identify that EC2 health checks only monitor the hardware/hypervisor level, meaning application failures are ignored. Setting the ASG health check type to ELB aligns instance replacement with the ALB's status.
This guarantees that instances failing application-level checks are automatically terminated and replaced by the Auto Scaling group.
2
Verify communication paths and ports between the ALB and EC2 instances.
Confirm that the application listens on custom port 8443, meaning target group health checks must query 8443, and security groups must permit inbound traffic on port 8443 from the ALB security group.
This establishes a valid connection path for the ALB health checks, preventing newly launched healthy instances from being flagged as unhealthy.

Key Concept

Auto Scaling health check configurations and load balancer target group routing over custom ports.
Question 31Question →

A company is deploying a secure database client application on Amazon EC2 instances in a private application subnet (CIDR 10.100.2.0/2410.100.2.0/24) of a VPC. The application must securely query an AWS service using an Interface VPC Endpoint. To enhance security boundaries, the Interface VPC Endpoint is deployed in a separate dedicated endpoint subnet (CIDR 10.100.10.0/2410.100.10.0/24). Both subnets are associated with custom Network Access Control Lists (NACLs) that deny all inbound and outbound traffic by default. The EC2 instances must initiate HTTPS connections on port 443443 to the Interface VPC Endpoint. Which configuration steps must be implemented to allow this communication while maintaining the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the Network ACL associated with the private application subnet, add an outbound rule that allows outbound TCP traffic on port 443443 to the destination CIDR 10.100.10.0/2410.100.10.0/24, and an inbound rule that allows inbound TCP traffic on ports 1024−655351024-65535 from the source CIDR 10.100.10.0/2410.100.10.0/24.; In the Network ACL associated with the VPC endpoint subnet, add an inbound rule that allows inbound TCP traffic on port 443443 from the source CIDR 10.100.2.0/2410.100.2.0/24, and an outbound rule that allows outbound TCP traffic on ports 1024−655351024-65535 to the destination CIDR 10.100.2.0/2410.100.2.0/24.

Answer

To establish communication under a default-deny Network ACL architecture, the Network ACL for the application subnet must allow outbound traffic on port 443443 and inbound traffic on ephemeral ports 1024−655351024-65535. Concurrently, the Network ACL for the endpoint subnet must allow inbound traffic on port 443443 and outbound traffic on ephemeral ports 1024−655351024-65535.
Because Network ACLs are stateless, they evaluate traffic in each direction independently. Since the EC2 client initiates an HTTPS request to the Interface VPC Endpoint across subnet boundaries, the application subnet's Network ACL must permit outbound TCP traffic on port 443443 and inbound return traffic on the ephemeral port range (1024−655351024-65535). Reciprocally, the endpoint subnet's Network ACL must permit inbound TCP traffic on port 443443 and outbound return traffic on the ephemeral port range (1024−655351024-65535) back to the application subnet.

Step-by-Step Solution

1
Analyze the statefulness of the firewalls involved.
Security groups are stateful (automatically tracking connections), whereas Network ACLs are stateless (requiring separate rules for inbound and outbound traffic).
This determines whether return traffic rules are required for each layer.
2
Determine the necessary rules for the stateless Network ACL in the client application subnet.
An outbound rule allowing destination port 443443 to the endpoint subnet, and an inbound rule allowing source ephemeral ports 1024−655351024-65535 from the endpoint subnet.
Since the client initiates the connection, outbound traffic leaves on port 443443 and returns on ephemeral ports.
3
Determine the necessary rules for the stateless Network ACL in the VPC endpoint subnet.
An inbound rule allowing destination port 443443 from the application subnet, and an outbound rule allowing target ephemeral ports 1024−655351024-65535 to the application subnet.
Since the VPC endpoint receives the connection, inbound traffic enters on port 443443 and return traffic is sent back to the client's ephemeral port range.

Key Concept

The stateless nature of Network ACLs requiring explicit configuration for both request and response traffic paths, compared to the stateful nature of Security Groups.
Estimated Time:2m 30s
Question 32Question →

A data processing application is deployed on Amazon EC2 instances in a private subnet (Subnet A: 10.0.2.0/2410.0.2.0/24). The application must initiate outbound database queries to an Amazon RDS PostgreSQL DB instance in another private subnet (Subnet B: 10.0.3.0/2410.0.3.0/24) on port 54325432. The application must also download external software updates over HTTPS (port 443443) through a NAT Gateway located in a public subnet (Subnet C: 10.0.1.0/2410.0.1.0/24). Custom Network Access Control Lists (NACLs) are used to secure the subnets. Which configuration of NACL rules for Subnet A will allow the required traffic while following the principle of least privilege?

Show answer & explanation

Answer: Inbound: Allow traffic from Source 0.0.0.0/00.0.0.0/0 on Port Range 1024−655351024-65535. Outbound: Allow traffic to Destination 10.0.3.0/2410.0.3.0/24 on Port 54325432 and to Destination 0.0.0.0/00.0.0.0/0 on Port 443443.

Answer

Inbound: Allow traffic from Source 0.0.0.0/00.0.0.0/0 on Port Range 1024−655351024-65535. Outbound: Allow traffic to Destination 10.0.3.0/2410.0.3.0/24 on Port 54325432 and to Destination 0.0.0.0/00.0.0.0/0 on Port 443443.
Network Access Control Lists (NACLs) are stateless network filters applied at the subnet boundary. Because they are stateless, both outbound request traffic and inbound response traffic must be explicitly permitted. When the EC2 instances in Subnet A initiate outbound connections to the database (port 54325432) and the external update repository (port 443443), they select a random source port from the ephemeral port range (1024−655351024-65535). The returning packets from these services will target these ephemeral ports on the EC2 instances. Therefore, the inbound NACL rules must allow return traffic from any source (0.0.0.0/00.0.0.0/0) targeting the ephemeral port range (1024−655351024-65535).

Step-by-Step Solution

1
Analyze the traffic requirements and directions for the EC2 instances in Subnet A.
Outbound traffic consists of database queries to Subnet B (10.0.3.0/2410.0.3.0/24) on port 54325432 and HTTPS requests to the internet (via NAT Gateway) on port 443443.
Understanding the traffic destination and ports determines the outbound NACL rules.
2
Determine how the stateless nature of NACLs impacts return traffic.
Return traffic from both the database and the internet will target the ephemeral port range (1024−655351024-65535) on the EC2 instances in Subnet A.
NACLs are stateless, so return traffic must be explicitly allowed by inbound rules.
3
Select the minimum required NACL rules to allow both outbound and inbound traffic.
Outbound rules must permit port 54325432 to 10.0.3.0/2410.0.3.0/24 and port 443443 to 0.0.0.0/00.0.0.0/0. Inbound rules must permit port range 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.
This configuration allows initiating requests and receiving responses while keeping other ports blocked.

Key Concept

Stateless behavior of Network Access Control Lists (NACLs) and ephemeral port configurations
Estimated Time:2m 0s
Question 33Question →

A company is designing the access control mechanism for its development team. The developers need to access AWS resources to deploy applications. The security team mandates that developers must use their existing corporate directory credentials to log in, and no long-term AWS credentials should be stored on developer machines. Additionally, sensitive database credentials used by the applications must be stored securely and rotated automatically every 30 days. Which combination of AWS services and configurations should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the corporate directory, allowing developers to assume short-term IAM roles. Use AWS Secrets Manager to store the database credentials and configure automatic rotation.

Answer

Configure AWS IAM Identity Center to federate with the corporate directory, allowing developers to assume short-term IAM roles. Use AWS Secrets Manager to store the database credentials and configure automatic rotation.
The correct configuration uses AWS IAM Identity Center to federate with the corporate directory, allowing developers to authenticate with their existing credentials and assume short-term roles instead of using long-term credentials. Additionally, using AWS Secrets Manager to store and automatically rotate the database credentials satisfies the security policy for encrypting and rotating sensitive data.

Step-by-Step Solution

1
Address the federated access requirement by configuring AWS IAM Identity Center to integrate with the corporate directory, which enables single sign-on using corporate credentials without creating permanent IAM users.
Developers can authenticate using their existing corporate credentials and obtain short-term credentials via IAM roles.
This removes the need to store long-term access keys on developer machines, meeting the primary security constraint.
2
Address the sensitive database credentials requirement by storing them in AWS Secrets Manager.
Credentials are encrypted at rest and can be retrieved programmatically.
Secrets Manager provides native support for encrypting secrets and automatically rotating them using built-in integration with databases.

Key Concept

AWS identity federation using IAM Identity Center combined with secure secrets management using AWS Secrets Manager.
Question 34Question →

A logistics company hosts a shipment tracking portal on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The portal has recently experienced HTTP flood attacks targeting the search endpoint, which overloads the ALB and causes application downtime. A solutions architect must design a secure architecture that mitigates these Layer 7 DDoS attacks at the AWS edge network before they reach the ALB.

Which solution meets these requirements?

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the ALB. Create an AWS WAF web ACL with a rate-based rule and associate it with the CloudFront distribution.

Answer

Deploy an Amazon CloudFront distribution in front of the ALB. Create an AWS WAF web ACL with a rate-based rule and associate it with the CloudFront distribution.
The correct option is to deploy Amazon CloudFront in front of the ALB and associate it with an AWS WAF web ACL configured with a rate-based rule. AWS WAF rate-based rules track the number of requests from each originating IP address and block requests that exceed a defined threshold. Deploying this at the CloudFront distribution leverages the AWS edge network, stopping the DDoS traffic before it reaches the backend infrastructure.

Step-by-Step Solution

1
Shift the application entry point to the AWS edge network by deploying Amazon CloudFront.
Inbound user traffic is routed through AWS edge locations rather than directly hitting the ALB.
This establishes an edge protection layer and absorbs traffic closer to the users.
2
Create an AWS WAF web ACL with a rate-based rule.
A security rule is established that tracks the rate of requests from individual IP addresses over a rolling 5-minute period.
Rate-limiting is the standard mechanism to mitigate HTTP flood attacks at the application layer.
3
Associate the AWS WAF web ACL with the CloudFront distribution.
Excessive requests are blocked at the edge network, ensuring only legitimate traffic is forwarded to the ALB.
This prevents malicious Layer 7 traffic from consuming ALB resources or reaching the EC2 origin servers.

Key Concept

Mitigating Layer 7 DDoS attacks at the edge using Amazon CloudFront and AWS WAF rate-based rules.
Question 35Question →

A retail technology startup has a multi-account AWS environment managed under AWS Organizations. The startup uses Okta as its central Identity Provider (IdP) for employee authentication. The security team wants to grant developers single sign-on (SSO) access to their respective AWS accounts. The solution must ensure that user access is automatically provisioned and deprovisioned when users are added or removed in Okta, while minimizing operational complexity and eliminating the use of long-term credentials. Which solution meets these requirements?

Show answer & explanation

Answer: Enable AWS IAM Identity Center, configure Okta as an external identity provider (IdP) using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol.

Answer

Enable AWS IAM Identity Center, configure Okta as an external identity provider (IdP) using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol.
The correct solution uses AWS IAM Identity Center to federate Okta as an external Identity Provider (IdP) via SAML 2.0. This allows users to authenticate using their corporate credentials. Enabling System for Cross-domain Identity Management (SCIM) v2.0 ensures that user provisioning and deprovisioning are handled automatically when accounts are modified in Okta, meeting the requirement to minimize operational complexity without using long-term credentials.

Step-by-Step Solution

1
Select AWS IAM Identity Center as the central service for managing SSO access across multiple accounts in AWS Organizations.
Establishes a centralized identity hub that eliminates the need to configure IAM resources individually in every account.
Reduces operational complexity and simplifies management.
2
Configure SAML 2.0 federation between AWS IAM Identity Center and Okta.
Enables single sign-on using Okta as the authoritative identity provider.
Allows developers to authenticate with their existing corporate credentials without using long-term AWS IAM credentials.
3
Enable and configure automatic provisioning using the SCIM v2.0 protocol in AWS IAM Identity Center and Okta.
Automatically synchronizes user accounts, group memberships, and status updates.
Ensures that when a user is added to or removed from Okta, their access in AWS is immediately granted or revoked, maintaining security and compliance.

Key Concept

Centralized Identity Federation with Automatic SCIM Provisioning
Estimated Time:1m 30s
Question 36Question →

A game development studio is migrating its build pipelines and testing environments to AWS. The studio manages all employees using an on-premises Microsoft Active Directory domain. The solutions architect must implement a single sign-on (SSO) solution that allows developers to access their respective AWS accounts within AWS Organizations using their existing on-premises credentials. The solution must minimize operational overhead, require no password replication to the cloud, and avoid manually managing long-term AWS credentials. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy an AWS Directory Service AD Connector to establish a gateway that redirects directory requests to the on-premises Active Directory.; Enable AWS IAM Identity Center and configure the identity source to use the Active Directory directory connected via AD Connector.

Answer

Deploy an AWS Directory Service AD Connector to redirect directory requests to the on-premises Active Directory, and configure AWS IAM Identity Center to use that directory as the identity source.
To integrate an on-premises Microsoft Active Directory with AWS for user access without replicating password hashes, the best approach is to deploy an AD Connector. The AD Connector acts as a proxy, directing authentication requests back to the on-premises directory. By enabling AWS IAM Identity Center and configuring it to point to the AD Connector directory, users can sign in using their corporate credentials and gain access to their assigned AWS accounts seamlessly.

Step-by-Step Solution

1
Deploy an AWS Directory Service AD Connector.
This establishes a directory gateway that connects AWS services to the on-premises Active Directory without duplicating credentials or password hashes.
This meets the requirement of not replicating passwords to the cloud while keeping operational overhead low.
2
Enable AWS IAM Identity Center and select the Active Directory directory as the identity source.
Developers can now sign in using their existing on-premises credentials via the AWS access portal.
This enables centralized SSO access to multiple AWS accounts within the organization without managing individual IAM users.

Key Concept

AWS Directory Service AD Connector and AWS IAM Identity Center integration for hybrid directory federation
Question 37Question →

A clinical diagnostic laboratory is building an event-driven system to process patient test results generated by multiple automated analyzers. The results for each patient must be processed in the exact sequence they are completed to prevent older results from overwriting newer ones due to network latency. Results for different patients can be processed concurrently. The system must scale automatically to handle sudden increases in test volumes during peak hours.

Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Create an Amazon SQS FIFO queue and configure an AWS Lambda function as the consumer. Send the events to the queue using the patient ID as the message group ID.

Answer

Create an Amazon SQS FIFO queue and configure an AWS Lambda function as the consumer. Send the events to the queue using the patient ID as the message group ID.
The correct solution uses an Amazon SQS FIFO queue with the patient ID as the message group ID. This setup guarantees that all messages belonging to the same patient (the same message group) are processed sequentially, while allowing different patient groups to be processed in parallel. Using AWS Lambda as a consumer provides automatic scaling and minimal operational overhead.

Step-by-Step Solution

1
Identify the primary requirement for message ordering and concurrency.
Events for the same patient must be processed in order, while events for different patients can be processed concurrently.
This dictates that we need a messaging system that supports message ordering groups.
2
Evaluate Amazon SQS FIFO queues for this scenario.
SQS FIFO queues preserve message order within a specific MessageGroupId.
Using patient ID as the MessageGroupId ensures that all events for a single patient are processed in the order they are received, while allowing concurrent processing of different patient IDs.
3
Compare SQS FIFO with SQS Standard and Amazon Kinesis.
Standard SQS does not guarantee ordering. Kinesis requires partition key design and manual shard scaling.
SQS FIFO provides a serverless, zero-overhead solution for message grouping and ordering, minimizing operational overhead.

Key Concept

Amazon SQS FIFO queues use the MessageGroupId parameter to group messages that must be processed in a strict sequence, allowing multiple consumers to process different message groups concurrently.
Question 38Question →

A company runs a high-traffic web application on a fleet of Amazon EC2 instances managed by an Auto Scaling group (ASG). The application is configured to listen on custom port 8080. The instances are registered with a target group behind an Application Load Balancer (ALB) that routes external traffic from port 443 to the target group. A solutions architect must configure health checks to ensure that the ASG accurately detects and replaces instances that fail at the application layer, while maintaining a secure and highly available setup.

Which configuration should the solutions architect implement?

Show answer & explanation

Answer: Configure the target group health check to query the application's status path on port 8080, and update the Auto Scaling group to use Elastic Load Balancing (ELB) health checks. Ensure the security groups allow traffic from the ALB to the instances on port 8080.

Answer

Configure the target group health check to query the application's status path on port 8080, and update the Auto Scaling group to use Elastic Load Balancing (ELB) health checks. Ensure the security groups allow traffic from the ALB to the instances on port 8080.
Configuring the target group health check to query the status path on port 8080 ensures that the ALB tests the actual application port. Setting the Auto Scaling group to use ELB health checks allows the ASG to terminate and replace instances that fail the ALB health checks, maintaining resilience at the application layer. Standard security group rules must also allow port 8080 traffic between the ALB and the instances.

Step-by-Step Solution

1
Configure the target group health check to match the application's listening port.
The target group is configured to query the custom application port (8080) instead of the default HTTP port (80).
The Application Load Balancer needs to verify the health of the application on the specific port where the application service runs, preventing false-negative health statuses.
2
Integrate the Auto Scaling Group health checks with the Elastic Load Balancer.
The Auto Scaling Group is updated to use ELB health checks in addition to standard EC2 instance status checks.
By default, the ASG only monitors EC2 status (e.g., hardware/hypervisor failures). Adding ELB health checks ensures the ASG replaces instances that fail at the application layer.
3
Establish secure network routing rules for health checks and traffic.
Security groups are configured to allow inbound traffic from the ALB on port 8080, and Network ACLs are configured to permit stateless ephemeral return traffic.
Security groups must allow communication between the load balancer and the targets, and stateless Network ACLs must explicitly allow return traffic to avoid blocking connections.

Key Concept

Aligning target group health checks with custom application ports, enabling ELB health checks in the Auto Scaling group, and satisfying stateful security group and stateless Network ACL rules.
Estimated Time:2m 0s
Question 39Question →

An IoT asset tracking platform for a cold chain logistics company runs its application tier on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer in the us-east-1 Region. The database tier uses a Single-AZ Amazon RDS for PostgreSQL DB instance. The company needs to design a disaster recovery (DR) strategy in the us-west-2 Region that achieves a Recovery Point Objective (RPO) of 55 minutes and a Recovery Time Objective (RTO) of 1515 minutes, while minimizing ongoing run costs. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a cross-region read replica for the Amazon RDS for PostgreSQL DB instance in us-west-2 to replicate data asynchronously.; Pre-deploy the Application Load Balancer in us-west-2, configure an Auto Scaling group with a minimum capacity of 11 instance, and use Amazon Route 53 failover routing with active health checks.

Answer

The correct strategy combines configuring an Amazon RDS for PostgreSQL cross-region read replica in the standby region with pre-deploying the Application Load Balancer and a scaled-down Auto Scaling group (minimum capacity of 11 instance) in that region, combined with Route 53 failover routing and health checks.
To meet both the 55-minute RPO and 1515-minute RTO cost-effectively, a Warm Standby disaster recovery pattern is required. The database tier uses asynchronous cross-region read replication to keep replica lag under a few minutes, meeting the RPO. Promoting the replica to primary takes under 1010 minutes. The compute tier pre-deploys the Application Load Balancer and keeps a minimum of 11 EC2 instance active in the Auto Scaling group, enabling immediate request handling upon failover and rapid scale-out, satisfying the RTO. Route 53 failover routing automatically detects primary region failure and routes traffic to the standby load balancer.

Step-by-Step Solution

1
Evaluate database disaster recovery options that satisfy the recovery objectives.
Confirm that an Amazon RDS cross-region read replica meets the 55-minute RPO through asynchronous replication, and its promotion time meets the 1515-minute RTO.
Asynchronous replication across regions minimizes performance overhead on the primary database while keeping the standby database updated within seconds or minutes.
2
Determine the minimum compute deployment required in the secondary region to guarantee a failover time of less than 1515 minutes.
Choose a Warm Standby pattern by pre-deploying the Application Load Balancer and running a minimum of 11 EC2 instance in the Auto Scaling group in the recovery region.
Deploying resources from scratch on failover (Pilot Light) takes too long to meet the 1515-minute RTO, whereas keeping a scaled-down compute tier active allows rapid scale-out and immediate request routing.
3
Configure DNS routing to handle failover automated detection.
Implement an Amazon Route 53 failover routing policy using health checks pointed at the primary region's resources.
Active health checks allow Route 53 to automatically detect a regional outage and redirect users to the pre-deployed standby load balancer in the secondary region.

Key Concept

Warm Standby Disaster Recovery Pattern
Question 40Question →

A solutions architect is designing a database architecture for a high-frequency financial trading application. The application requires a relational database to store transactional trade execution history, demanding high availability and the ability to scale read operations dynamically from 5,0005,000 to 50,00050,000 queries per second during market opening spikes. In addition, the application must display a real-time leaderboard showing top trading accounts with microsecond read latency. Which combination of database services and configurations should the solutions architect choose to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Amazon Aurora PostgreSQL with Aurora Replicas and Auto Scaling to scale read operations dynamically during market spikes.; Amazon ElastiCache for Redis to store and serve the real-time leaderboard data with microsecond read latency.

Answer

The correct architecture combines Amazon Aurora PostgreSQL utilizing Aurora Replicas with Auto Scaling for relational, read-scalable transaction logging, along with Amazon ElastiCache for Redis to provide microsecond read latency for the real-time leaderboard.
The correct options are the choices recommending Amazon Aurora PostgreSQL with Aurora Replicas and Auto Scaling, and Amazon ElastiCache for Redis. Amazon Aurora PostgreSQL natively supports high availability and handles read surges by dynamically adding Aurora Replicas via Auto Scaling. Amazon ElastiCache for Redis is an in-memory caching database optimized for microsecond-latency operations, which directly satisfies the leaderboard requirement.

Step-by-Step Solution

1
Evaluate the relational database requirement for trade execution history.
Amazon Aurora PostgreSQL provides MySQL and PostgreSQL compatibility with auto-scaling Aurora Replicas, allowing read capacity to scale dynamically to meet spikes from 5,0005,000 to 50,00050,000 queries per second.
Relational constraints require a SQL-compatible engine, while high availability and spiky traffic require dynamic read replicas and automatic failover.
2
Evaluate the caching layer requirement for the real-time leaderboard.
Amazon ElastiCache for Redis supports in-memory data structures, enabling microsecond latency retrievals.
Microsecond read latency cannot be consistently achieved by standard relational databases under heavy load and requires an in-memory caching mechanism.
3
Filter out configurations that violate best practices, failover mechanics, or partitioning rules.
Eliminated options using RDS replicas for failover, monotonically increasing partition keys in DynamoDB, and provisioned capacity without auto scaling.
These options introduce performance bottlenecks, lack automatic failover mechanisms, or result in scaling failures under spiky workloads.

Key Concept

Combining Amazon Aurora Auto Scaling Replicas for scalable relational reads and Amazon ElastiCache for microsecond caching performance.
Estimated Time:2m 0s
PreviousPage 2 / 74Next
All practice questions — AWS Certified Solutions Architect - Associate | Examkin