Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 381Question →

An enterprise is deploying an active-passive disaster recovery (DR) architecture for a stateful web application. The primary environment is in us-west-2 with an Application Load Balancer (ALB) and an Amazon Aurora PostgreSQL database. The secondary environment in us-east-1 is a warm standby with a scaled-down Amazon EC2 fleet behind another ALB, and an Aurora read replica. The DR plan requires Route 53 to automatically shift DNS traffic to us-east-1 only if the primary ALB has no healthy EC2 targets, or if the primary application cannot connect to its database (determined by the absence of the string 'DB_OK' on the '/healthz' status page). The database promotion to primary will be handled by a separate automated script. Which Route 53 DNS failover configuration meets these requirements with the shortest recovery time?

Show answer & explanation

Answer: Configure a Route 53 HTTP health check that queries the us-west-2 ALB DNS name at /healthz and checks for the string DB_OK. Create a primary Failover Alias record pointing to the us-west-2 ALB, set Evaluate Target Health to Yes, and associate it with the Route 53 health check. Create a secondary Failover Alias record pointing to the us-east-1 ALB with Evaluate Target Health set to Yes.

Answer

Configure a Route 53 HTTP health check that queries the us-west-2 ALB DNS name at /healthz and checks for the string DB_OK. Create a primary Failover Alias record pointing to the us-west-2 ALB, set Evaluate Target Health to Yes, and associate it with the Route 53 health check. Create a secondary Failover Alias record pointing to the us-east-1 ALB with Evaluate Target Health set to Yes.
The correct configuration uses Route 53 Failover Alias records combined with both Route 53 health checks and the Evaluate Target Health feature. Evaluate Target Health allows Route 53 to monitor the backend EC2 targets of the Application Load Balancer (ALB). Associating the Route 53 health check that performs response body string matching for 'DB_OK' ensures that deep application failures (such as database connectivity issues) are also detected. If either the ALB targets fail or the health check fails to find the string, Route 53 automatically fails over to the standby region.

Step-by-Step Solution

1
Configure the application-level health check
A Route 53 HTTP health check is created to target the primary ALB DNS endpoint at /healthz, configured to fail if the response body does not contain the string DB_OK.
The Application Load Balancer cannot inspect the response body for specific strings on its own; hence, a Route 53 external health check is required to verify deep database connectivity.
2
Configure the Route 53 primary Failover Alias record
A primary Failover Alias record is created pointing to the us-west-2 ALB, with Evaluate Target Health set to Yes and associated with the health check created in Step 1.
Enabling Evaluate Target Health ensures Route 53 monitors target group health (infrastructure level), while associating the Route 53 health check ensures application-level status is evaluated. If either fails, the record is marked unhealthy.
3
Configure the Route 53 secondary Failover Alias record
A secondary Failover Alias record is created pointing to the us-east-1 ALB, with Evaluate Target Health set to Yes.
This guarantees that if the primary region is unhealthy, Route 53 redirects DNS queries to the standby region's ALB, while keeping the standby inactive during normal operations.

Key Concept

Route 53 Active-Passive Failover with Alias Records and Target Health Evaluation
Question 382Question →

A company's enterprise application runs on AWS and uses an Amazon RDS for SQL Server database to store transactional data. The database must be designed to withstand an Availability Zone outage in the primary AWS Region with automatic failover to minimize downtime. Furthermore, the company requires a disaster recovery strategy to support recovery in a secondary AWS Region with a Recovery Point Objective (RPO) of less than 30 minutes.

Which two database configurations should the solutions architect select to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the RDS for SQL Server database with a Multi-AZ deployment.; Create a cross-region read replica of the RDS for SQL Server database in the secondary AWS Region.

Answer

The correct configurations are configuring the database with a Multi-AZ deployment and creating a cross-region read replica in the secondary region.
The correct options are configuring the RDS database as a Multi-AZ deployment and creating a cross-region read replica. Multi-AZ replication is synchronous and provides automatic failover within the primary region, securing high availability. A cross-region read replica replicates data asynchronously to the secondary region, keeping the recovery point well within the 30-minute requirement and offering a promotable primary target for disaster recovery.

Step-by-Step Solution

1
Analyze high availability requirements in the primary region
Determine that a Multi-AZ deployment is required for synchronous replication and automatic failover.
Multi-AZ provides automated failover to minimize downtime during Availability Zone outages without manual intervention.
2
Analyze disaster recovery requirements in the secondary region
Determine that a cross-region read replica is required to meet the 30-minute RPO.
Cross-region read replicas use continuous asynchronous replication to keep data updated in near-real-time in the secondary region.

Key Concept

Multi-AZ and Cross-Region replication configurations for relational database resilience.
Question 383Question →

A gaming company hosts a global multiplayer game. The backend architecture consists of an Application Load Balancer (ALB) routing player requests to Amazon EC2 instances in an Auto Scaling group, with Amazon DynamoDB storing player profiles and leaderboards. Static game assets are stored in Amazon S3. During peak gaming events, the EC2 instances experience high CPU utilization due to the overhead of retrieving static assets and querying player profiles. The DynamoDB table also experiences throttling. A solutions architect must design a high-performing architecture that minimizes latency for players globally and reduces load on both the EC2 instances and the database. Which architecture should the solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution with Amazon S3 as the origin for static game assets. Provision an Amazon DynamoDB Accelerator (DAX) cluster to cache read queries, and configure the application to direct database requests to the DAX endpoint.

Answer

Deploy an Amazon CloudFront distribution with Amazon S3 as the origin for static game assets, and provision an Amazon DynamoDB Accelerator (DAX) cluster to cache database read queries.
The correct architecture leverages Amazon CloudFront to deliver static assets directly from Amazon S3 to the edge locations nearest to players. This drastically reduces the load on EC2 instances. Furthermore, implementing Amazon DynamoDB Accelerator (DAX) adds a high-performance, in-memory cache for player profiles and leaderboards, delivering microsecond response times and shielding the DynamoDB table from read spikes and throttling.

Step-by-Step Solution

1
Analyze the architecture requirements for static game assets.
Determine that static assets should be served via a Content Delivery Network (CDN) directly to clients, bypassing EC2 and reducing origin load.
Amazon S3 combined with Amazon CloudFront provides low-latency edge caching for static assets.
2
Analyze the database access patterns and latency requirements.
Identify that DynamoDB is experiencing read throttling and needs microsecond-level response times for repetitive read queries.
Amazon DynamoDB Accelerator (DAX) is a fully managed in-memory cache for DynamoDB that delivers up to a 10x10\text{x} performance improvement.
3
Evaluate the integration of the caching layers.
Select the architecture that combines CloudFront for edge asset caching and DAX for database query caching.
This design resolves both EC2 CPU exhaustion and database read bottlenecks while minimizing overall latency.

Key Concept

Multi-tier caching using Amazon CloudFront for static edge delivery and Amazon DynamoDB Accelerator (DAX) for in-memory database query caching.
Estimated Time:3m 0s
Question 384Question →

A media streaming company hosts its user profile database in the us-east-1 Region. The application requires local, sub-second read performance for users in the eu-west-1 Region. Additionally, the architecture must support a cross-region disaster recovery strategy with a Recovery Point Objective (RPO) of less than 55 seconds and a Recovery Time Objective (RTO) of less than 55 minutes. Which database configuration meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1.

Answer

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1.
The correct database configuration is an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1. Aurora Global Database uses dedicated storage-based replication that delivers sub-second replication latency (typically under 11 second), meeting the 55-second RPO. In the event of a regional outage, the secondary cluster can be promoted to primary in less than 11 minute, satisfying the 55-minute RTO. This provides local reads in the secondary region with the lowest operational overhead.

Step-by-Step Solution

1
Analyze the read latency and location constraints.
The solution requires low-latency read replication from us-east-1 to eu-west-1.
This narrows the choice to configurations supporting cross-region replication.
2
Evaluate the RPO and RTO disaster recovery requirements against replication options.
Amazon Aurora Global Database supports storage-level, dedicated replication with typical lag of less than 11 second (meeting the 55-second RPO limit) and secondary cluster promotion in less than 11 minute (meeting the 55-minute RTO limit).
Standard RDS replicas and backup-based approaches cannot meet these tight recovery metrics with low operational overhead.

Key Concept

High availability and disaster recovery configurations in Amazon Aurora
Estimated Time:1m 30s
Question 385Question →

A company is designing a high-availability, active-active web application deployed across two AWS Regions: us-east-1 and eu-west-1. The application is accessed via the domain apex (example.com). The architecture requires low-latency access for global users by directing them to the nearest healthy region. Additionally, the system must support automatic failover to the secondary region if either the load balancer target servers become unhealthy or the local application instance loses connectivity to its database. Which two configurations should the solutions architect implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create Route 53 Latency Alias records for example.com pointing to the Application Load Balancer (ALB) in each region, and enable the Evaluate Target Health option.; Create Route 53 HTTPS health checks to monitor the application's database connectivity endpoint in each region, and associate these health checks with their corresponding Latency Alias records.

Answer

Creating Route 53 Latency Alias records pointing to the Application Load Balancers with target health evaluation enabled, and configuring custom Route 53 HTTPS health checks to monitor the database connectivity endpoint.
The correct solution requires configuring Route 53 Latency Alias records pointing to the Application Load Balancer in each region and setting 'Evaluate Target Health' to Yes. This allows traffic to be routed to the closest healthy region at the zone apex. Additionally, to detect database connectivity failures, custom Route 53 HTTPS health checks must be created to query the database connectivity endpoint and associated with the Latency Alias records.

Step-by-Step Solution

1
Address the requirement for zone apex routing and active-active low-latency routing.
Determine that Route 53 Latency Alias records pointing to the ALBs in each region must be used, as CNAME records cannot reside at the zone apex.
Alias records map the zone apex directly to AWS resources like ALBs and support Route 53's active health monitoring.
2
Configure automatic load balancer health evaluation.
Enable the 'Evaluate Target Health' option on the Latency Alias records.
This permits Route 53 to check the health of the ALB targets and stop routing traffic to a region if its web servers fail.
3
Address the requirement to monitor backend database connectivity and handle regional degradation.
Create custom HTTP/HTTPS Route 53 health checks probing a health endpoint that verifies database connectivity, and associate these health checks with the Latency Alias records.
ALB Target Group checks might not capture deep backend dependency failures, so custom health checks are required for end-to-end failover.

Key Concept

Combining Route 53 Latency Routing, Alias Records, and Multi-layered Health Checks for Active-Active Failover at the Zone Apex
Question 386Question →

A software-as-a-service (SaaS) company hosts a global collaborative mapping platform. The application requires low-latency access to base map tiles (static assets) stored in an Amazon S3 bucket, as well as real-time custom map annotations and metadata (dynamic, read-heavy queries) stored in an Amazon DynamoDB table. During peak geographic events, the application experiences massive, unpredictable spikes in read traffic for both data types. The company wants to optimize the architecture to achieve the lowest possible read latency globally, prevent database throttling, and maintain cost-efficiency. Which two solutions should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution with the Amazon S3 bucket configured as the origin, and configure a cache policy with a default TTL of 86400 seconds for static map assets. Use CloudFront invalidations to update assets when styling changes occur.; Enable Amazon DynamoDB Accelerator (DAX) to cache the read queries for custom map annotations, providing microsecond response times and shielding the database table from read spikes.

Answer

Deploying an Amazon CloudFront distribution with the Amazon S3 bucket configured as the origin, along with enabling Amazon DynamoDB Accelerator (DAX) for dynamic database queries.
To optimize global performance and cost, the architecture must cache assets at appropriate layers. Caching static S3 assets at the edge using Amazon CloudFront with an appropriate TTL reduces origin load and latency. For dynamic reads on DynamoDB, Amazon DynamoDB Accelerator (DAX) provides microsecond read performance and prevents throttling from spiky workloads.

Step-by-Step Solution

1
Analyze the static content delivery requirements.
Identified that static base map tiles are stored in Amazon S3 and require global low-latency access and cost efficiency.
Amazon CloudFront acts as a content delivery network (CDN) to cache static S3 assets closer to users at edge locations, reducing origin load and latency.
2
Evaluate caching policies for static content.
A high Default TTL (e.g., 86400 seconds) should be configured, using manual cache invalidations for occasional styling updates.
Setting the TTL to 0 seconds would defeat the purpose of caching, causing CloudFront to forward all requests back to the S3 origin.
3
Analyze the dynamic content access requirements.
Identified that custom map annotations and metadata are read-heavy, spiky, and stored in Amazon DynamoDB.
Dynamic reads require microsecond-level latency and protection against hot partitions and throttle events during usage spikes.
4
Select the optimal database caching technology.
Amazon DynamoDB Accelerator (DAX) is chosen to cache DynamoDB queries directly.
DAX provides API-compatible, in-memory caching that scales to handle extreme read volumes without modification to query logic or relying on expensive provisioned capacity units.

Key Concept

Multi-tier caching using Amazon CloudFront for static objects and Amazon DynamoDB Accelerator (DAX) for dynamic, low-latency database queries.
Estimated Time:3m 0s
Question 387Question →

A global SaaS provider hosts a multi-tenant application on AWS. The entry point is an Amazon CloudFront distribution that forwards requests to an Application Load Balancer (ALB) backed by Amazon EC2 instances in private subnets. During a promotional event, the application experiences a massive distributed denial of service (DDoS) attack consisting of a Layer 3/4 SYN flood and a Layer 7 HTTP flood. This causes resource exhaustion at the ALB level. A solutions architect needs to design a mitigation strategy to protect the application from future attacks of both types at the edge, while minimizing administrative overhead.

Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate an AWS WAF web ACL with the CloudFront distribution and create a rate-based rule to block clients that exceed a threshold of requests.; Subscribe to AWS Shield Advanced and enable protection for the CloudFront distribution to leverage automatic Layer 3 and Layer 4 mitigation.

Answer

Associate an AWS WAF web ACL with the CloudFront distribution with a rate-based rule to block high-volume clients, and subscribe to AWS Shield Advanced to enable protection for the CloudFront distribution to leverage automated Layer 3 and Layer 4 mitigation.
The correct architecture uses a combination of AWS WAF and AWS Shield Advanced associated with Amazon CloudFront. The rate-based rule in AWS WAF inspects HTTP requests at the edge and automatically blocks clients that exceed rate thresholds, mitigating the Layer 7 HTTP flood. Subscribing to AWS Shield Advanced and protecting the CloudFront distribution mitigates Layer 3 and Layer 4 infrastructure attacks, such as SYN floods, at the edge before they can consume resources on the Application Load Balancer.

Step-by-Step Solution

1
Analyze the attack vectors to determine the target layers of the traffic floods.
Identify that the SYN flood is a Layer 3/4 infrastructure attack, whereas the HTTP flood is a Layer 7 application-layer attack.
Correct service selection requires distinguishing between network/transport layer attacks and application-layer exploits.
2
Mitigate the Layer 7 HTTP flood at the edge before it reaches the Application Load Balancer.
Configure AWS WAF with a rate-based rule and associate it with the CloudFront distribution.
AWS WAF inspects HTTP traffic at edge locations and can drop requests from offending IP addresses when rate thresholds are crossed.
3
Mitigate the Layer 3/4 infrastructure SYN flood at the edge before it exhausts ALB capacity.
Protect the CloudFront distribution with AWS Shield Advanced.
AWS Shield Advanced offers advanced monitoring, automated mitigation of infrastructure attacks at the CloudFront edge, and support from the Shield Response Team.

Key Concept

Edge and DDoS Protection
Question 388Question →

A B2B software-as-a-service (SaaS) provider hosts a multi-tenant enterprise application on AWS. The application architecture has two primary entry points exposed via an Application Load Balancer (ALB): a custom TCP-based protocol endpoint for real-time telemetry ingestion, and an HTTPS REST API for analytical reporting. During a recent audit, the security team identified a vulnerability to Layer 3/4 DDoS attacks targeting the TCP endpoint and Layer 7 HTTP flood attacks targeting the REST API. The provider has subscribed to AWS Shield Advanced and wants to implement a solution that mitigates these threats while minimizing latency for global tenants. Which TWO solutions should a solutions architect implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create an AWS Global Accelerator accelerator for the custom TCP telemetry endpoint, route traffic to the Application Load Balancer, and enable AWS Shield Advanced on the accelerator.; Deploy an Amazon CloudFront distribution in front of the HTTPS REST API, associate an AWS WAF web ACL with the distribution, and configure a rate-limiting rule.

Answer

The correct solutions are to create an AWS Global Accelerator accelerator for the custom TCP telemetry endpoint, route traffic to the Application Load Balancer, and enable AWS Shield Advanced on the accelerator; and to deploy an Amazon CloudFront distribution in front of the HTTPS REST API, associate an AWS WAF web ACL with the distribution, and configure a rate-limiting rule.
The solution requires separate strategies for the custom TCP protocol and the HTTP/HTTPS protocol. For the custom TCP protocol, AWS Global Accelerator is used because CloudFront does not support custom TCP traffic. Enabling AWS Shield Advanced on the accelerator protects the TCP endpoint from Layer 3/4 DDoS attacks. For the HTTPS REST API, Amazon CloudFront is deployed, and an AWS WAF web ACL with a rate-limiting rule is associated with the distribution to protect against Layer 7 HTTP flood attacks at the edge before they hit the origin Application Load Balancer.

Step-by-Step Solution

1
Analyze the protocols used by the application endpoints.
The telemetry endpoint uses a custom TCP-based protocol, while the analytical reporting endpoint uses HTTP/HTTPS.
This determines which edge services are compatible. CloudFront only supports HTTP, HTTPS, and RTMP, whereas AWS Global Accelerator supports both TCP and UDP protocols.
2
Select the appropriate edge service for the custom TCP endpoint.
AWS Global Accelerator is selected because it routes TCP traffic over the AWS global network, reducing latency and providing static IP addresses that act as a front end.
This satisfies the low-latency requirement for the custom TCP endpoint while keeping the origin infrastructure shielded.
3
Select the appropriate edge service for the HTTPS REST API endpoint.
Amazon CloudFront is selected as the content delivery network (CDN) to serve the HTTPS REST API.
CloudFront caches responses at edge locations, integrates with AWS WAF, and provides built-in Layer 3/4 DDoS protection.
4
Determine the mitigation strategy for Layer 3/4 attacks on the TCP endpoint.
Enable AWS Shield Advanced on the AWS Global Accelerator resource.
AWS Shield Advanced integrates with Global Accelerator to provide resource-specific monitoring and mitigation of sophisticated Layer 3/4 DDoS attacks.
5
Determine the mitigation strategy for Layer 7 HTTP flood attacks on the HTTPS REST API.
Associate an AWS WAF web ACL with the CloudFront distribution and add a rate-limiting rule.
AWS WAF inspects HTTP/HTTPS requests at the edge. A rate-limiting rule temporarily blocks client IP addresses that exceed a configured request threshold, mitigating Layer 7 floods before they reach the ALB.

Key Concept

AWS Edge Security Architecture using CloudFront, Global Accelerator, AWS WAF, and AWS Shield Advanced
Estimated Time:3m 0s
Question 389Question →

A real estate platform runs its production workload in the eu-west-1 Region. The architecture consists of Amazon EC2 instances in an Auto Scaling Group behind an Application Load Balancer, and an Amazon RDS for MySQL database. The company needs to design a disaster recovery (DR) strategy in the eu-central-1 Region with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which strategy should a Solutions Architect recommend to meet these requirements with the lowest operational cost?

Show answer & explanation

Answer: Create an RDS Cross-Region Read Replica in the secondary region. Copy EC2 AMIs and launch templates to the secondary region, and configure an Auto Scaling Group with a desired capacity of 0. During a disaster, promote the replica to a standalone database, scale up the Auto Scaling Group, and update Route 53 DNS records.

Answer

Create an RDS Cross-Region Read Replica in the secondary region, copy EC2 AMIs and launch templates, configure an Auto Scaling Group with a desired capacity of 0, and promote the database replica and scale up the Auto Scaling Group during failover.
The correct strategy uses an RDS Cross-Region Read Replica to continuously copy database changes, which meets the 15-minute RPO requirement. By maintaining the EC2 Auto Scaling Group at a capacity of 0 in the secondary region, the company avoids running compute instances during normal operations, minimizing costs. The replication promotion and Auto Scaling Group scaling processes can be completed well within the 4-hour RTO.

Step-by-Step Solution

1
Evaluate the recovery time objective (RTO) and recovery point objective (RPO) requirements.
RPO is 15 minutes, which requires active replication of data to the secondary region. RTO is 4 hours, which allows for some manual or scripted steps to provision resources during failover.
Determining the bounds of RPO and RTO guides the selection of the DR strategy (e.g., Pilot Light vs. Warm Standby vs. Backup and Restore).
2
Select the database replication method.
An RDS Cross-Region Read Replica provides asynchronous replication, ensuring replica lag is minimal (usually seconds or minutes) and meets the 15-minute RPO.
Standard backups copied to the secondary region or S3 Glacier cannot reliably guarantee a 15-minute RPO and would violate the RTO due to retrieval delays.
3
Design the compute replication strategy to minimize costs.
Store EC2 AMIs and launch templates in the secondary region, and configure an Auto Scaling Group with a desired capacity of 0. Scale it up only during failover.
Keeping EC2 instances at 0 capacity avoids ongoing compute charges, aligning with the constraint to minimize costs while easily launching instances within the 4-hour RTO window.

Key Concept

Selecting the most cost-effective disaster recovery strategy (such as Pilot Light) that satisfies recovery time (RTO) and recovery point (RPO) constraints using cross-region database replication and on-demand compute scaling.
Question 390Question →

A medical laboratory runs an automated pipeline to analyze clinical trial results. When a new trial dataset is uploaded to an Amazon S3 bucket, it must trigger two separate processes: a statistical analysis engine and a regulatory compliance auditing service. The systems must process these datasets asynchronously. If either downstream service encounters an error or fails to process a dataset, the dataset event must be isolated for analysis without disrupting the rest of the queue. The order in which datasets are processed is not critical, but each service must process a copy of every dataset event.

Which combination of steps should a solutions architect recommend to design a decoupled and resilient architecture for this application? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the Amazon S3 bucket to send event notifications to an Amazon SNS topic, and subscribe two Amazon SQS standard queues to the topic, with each queue dedicated to one of the processing services.; Configure an Amazon SQS dead-letter queue (DLQ) for each of the processing queues to capture and isolate messages that cannot be processed successfully.

Answer

To build a decoupled and resilient architecture, configure Amazon S3 to publish event notifications to an Amazon SNS topic. Subscribe two separate Amazon SQS standard queues to the SNS topic, allowing each downstream service to consume a dedicated copy of the events. To handle failures gracefully, configure a dead-letter queue (DLQ) for each SQS queue to capture and isolate messages that fail to process.
To decouple the services while ensuring both the statistical analysis engine and the regulatory compliance auditing service receive a copy of every event, a fan-out pattern is required. Configuring the Amazon S3 bucket to publish to an Amazon SNS topic, and then subscribing a dedicated SQS queue for each service, satisfies this requirement. Since ordering is not critical, standard SQS queues are appropriate. To ensure resilience, attaching a Dead-Letter Queue (DLQ) to each processing SQS queue isolates messages that fail to process, preventing blocking errors in the main pipeline.

Step-by-Step Solution

1
Select a message distribution pattern that allows a single S3 event to be copied and delivered to multiple independent processing systems (fan-out pattern).
Amazon SNS is identified as the publisher, and Amazon SQS queues are identified as subscribers.
Amazon SNS supports fan-out messaging to multiple SQS queues, preventing competing consumers issues.
2
Ensure that processing failures do not block the entire message processing pipeline.
Each SQS queue is configured with a dead-letter queue (DLQ).
Failed events are diverted to the DLQ after a specific number of retries, leaving the main queue clear for subsequent datasets.

Key Concept

Decoupling multi-consumer systems using Amazon SNS and SQS fan-out with Dead-Letter Queues (DLQs) for resilient asynchronous processing.
Question 391Question →

A financial services company hosts an invoice processing platform in the us-west-2 Region. The application architecture consists of Amazon EC2 instances behind an Application Load Balancer (ALB), an Amazon RDS for PostgreSQL database for invoice metadata, and an Amazon S3 bucket for storing scanned invoice documents. The company needs to design a disaster recovery (DR) solution in the us-east-1 Region. The solution must support a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours while keeping ongoing standby costs as low as possible. Which combination of database and storage configurations will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Amazon S3 Cross-Region Replication (CRR) to asynchronously copy invoice documents from the us-west-2 bucket to a destination bucket in us-east-1.; Create an Amazon RDS for PostgreSQL cross-region read replica in us-east-1 to serve as the standby database.

Answer

Configure Amazon S3 Cross-Region Replication (CRR) to asynchronously copy invoice documents from the us-west-2 bucket to a destination bucket in us-east-1, and create an Amazon RDS for PostgreSQL cross-region read replica in us-east-1 to serve as the standby database.
To meet a 15-minute RPO and a 2-hour RTO cost-effectively, a Pilot Light DR pattern is appropriate. The correct configurations include using Amazon S3 Cross-Region Replication (CRR) to copy scanned invoices from us-west-2 to us-east-1, ensuring that newly uploaded documents are replicated asynchronously within minutes. For the database tier, creating an Amazon RDS for PostgreSQL cross-region read replica ensures the metadata is continuously replicated asynchronously with low lag (satisfying the 15-minute RPO) and can be promoted to primary status within minutes during a failover event (satisfying the 2-hour RTO).

Step-by-Step Solution

1
Analyze the storage replication requirements for the RPO of 15 minutes.
Identify that Amazon S3 Cross-Region Replication (CRR) provides automated, asynchronous replication of new objects to another region, satisfying the RPO for the document storage.
S3 Lifecycle rules alone cannot copy data across regions directly into S3 Glacier without replication, and Glacier retrieval times would violate the RTO.
2
Analyze the database replication requirements for the RPO of 15 minutes and RTO of 2 hours.
Determine that an Amazon RDS for PostgreSQL cross-region read replica keeps the standby database updated asynchronously with minimal lag, satisfying the 15-minute RPO, and can be promoted to a standalone primary database quickly, satisfying the 2-hour RTO.
Daily database snapshots via AWS Backup only guarantee a 24-hour RPO and require a lengthy restore process, which violates the 15-minute RPO and 2-hour RTO requirements.
3
Evaluate the routing and failover automation options.
Discard options attempting to use Route 53 latency routing to automate RDS promotion, as Route 53 is a DNS service and cannot perform database-level operations or promote read replicas.
RDS read replicas require explicit promotion to become writeable, and Route 53 does not manage database failover.

Key Concept

Designing a pilot light multi-region disaster recovery architecture utilizing Amazon S3 Cross-Region Replication and Amazon RDS cross-region read replicas to meet stringent RTO and RPO constraints cost-effectively.
Estimated Time:2m 0s
Question 392Question →

A financial technology company hosts a payment gateway API on Amazon ECS container instances behind an Application Load Balancer (ALB). The API has recently been targeted by distributed denial of service (DDoS) attacks, including Layer 7 HTTP floods that consume ECS container resources and volumetric Layer 3/4 attacks that saturate network bandwidth. The company needs to implement a highly resilient edge security solution to mitigate these attacks before they reach the origin.

Which combination of actions should the company take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer (ALB) and associate an AWS WAF web ACL containing a rate-based rule.; Enable AWS Shield Advanced on the Amazon CloudFront distribution to protect the entry point against volumetric Layer 3 and Layer 4 attacks.

Answer

Deploying an Amazon CloudFront distribution with an associated AWS WAF web ACL containing a rate-based rule, and enabling AWS Shield Advanced on the CloudFront distribution.
To mitigate both Layer 7 HTTP floods and Layer 3/4 volumetric DDoS attacks, the architecture should leverage Amazon CloudFront as the entry point. Associating AWS WAF with CloudFront allows the use of rate-based rules to detect and block clients sending unusually high volumes of HTTP requests at the edge, protecting ECS container resources from exhaustion. Enabling AWS Shield Advanced on the CloudFront distribution provides advanced DDoS protection against volumetric attacks targeting the infrastructure layers, along with access to the AWS Shield Response Team (SRT).

Step-by-Step Solution

1
Analyze the attack vectors affecting the payment gateway API.
Identified Layer 7 HTTP floods (requiring application-layer filtering) and volumetric Layer 3/4 attacks (requiring infrastructure-layer mitigation).
Edge protection must address different layers of the OSI model using appropriate security services.
2
Design Layer 7 mitigation at the network edge.
Place Amazon CloudFront in front of the Application Load Balancer and attach AWS WAF with rate-based rules.
CloudFront acts as the entry point at edge locations, and AWS WAF evaluates and blocks HTTP floods before they reach the ALB and ECS container instances.
3
Design Layer 3/4 volumetric protection.
Enable AWS Shield Advanced on the Amazon CloudFront distribution.
AWS Shield Advanced offers tailored mitigation and protection against volumetric DDoS attacks at the AWS edge network.

Key Concept

AWS Edge Security and DDoS Mitigation using CloudFront, WAF, and Shield
Question 393Question →

A collaborative online whiteboard platform runs its production environment in the us-east-1 Region. The architecture includes an Application Load Balancer, an Auto Scaling group of Amazon EC2 instances, and an Amazon RDS for PostgreSQL database. The company needs to design a disaster recovery (DR) plan in the us-west-2 Region. The design must meet a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 15 minutes while minimizing ongoing infrastructure costs.

Which strategy should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Establish a pilot light recovery strategy by creating an Amazon RDS cross-region read replica in the secondary Region, and using AWS CloudFormation templates to deploy the Application Load Balancer and Auto Scaling group only when a failover is initiated.

Answer

Establish a pilot light recovery strategy by creating an Amazon RDS cross-region read replica in the secondary Region, and using AWS CloudFormation templates to deploy the Application Load Balancer and Auto Scaling group only when a failover is initiated.
The pilot light strategy is the most cost-effective option that meets the RTO of 4 hours and RPO of 15 minutes. An Amazon RDS cross-region read replica provides asynchronous replication with lag typically measured in seconds, satisfying the 15-minute RPO. Since the RTO is 4 hours, there is sufficient time to use AWS CloudFormation to provision the Application Load Balancer and the Auto Scaling group of EC2 instances when a disaster is declared, avoiding the ongoing compute costs of a warm standby.

Step-by-Step Solution

1
Analyze the RTO and RPO requirements.
The RTO is 4 hours, which allows sufficient time to deploy compute resources on demand. The RPO is 15 minutes, which requires continuous database replication rather than daily backup copies.
This establishes the technical constraints for computing (dynamic deployment is allowed) and data (replication must be near real-time).
2
Evaluate the cost constraint.
To minimize ongoing infrastructure costs, the standby region should run as few active compute resources as possible during normal operations.
Running compute instances (like in a warm standby or active-active setup) increases ongoing costs, which must be avoided.
3
Select the optimal disaster recovery pattern.
A pilot light pattern keeps the database replicated live using a cross-region read replica, but leaves the application and load balancing tiers unprovisioned until failover, using CloudFormation to build them when needed.
This meets both the 15-minute RPO and 4-hour RTO while achieving the lowest possible idle infrastructure costs.

Key Concept

Disaster recovery strategies differ in RTO, RPO, and cost; pilot light minimizes costs by only keeping data replication active and provisioning compute resources on demand.
Question 394Question →

A company is designing the security architecture for a new application. The development team, consisting of 50 engineers who are managed in an on-premises Active Directory, needs administrator access to the AWS Management Console. Additionally, the application requires access to a database password that must be rotated every 30 days. The solution must follow AWS security best practices.

Which combination of actions should a solutions architect recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the on-premises Active Directory and grant console access to the engineers.; Store the database password in AWS Secrets Manager and enable automatic rotation every 30 days.

Answer

The correct actions are to configure AWS IAM Identity Center to federate the on-premises Active Directory for console access, and to store the database password in AWS Secrets Manager with automatic rotation enabled.
Configuring AWS IAM Identity Center with on-premises Active Directory enables centralized federation and single sign-on (SSO), avoiding the administrative overhead and security risks of managing long-term IAM user credentials. Storing the database password in AWS Secrets Manager allows for secure storage and built-in, automated credential rotation every 30 days, which meets the security compliance requirements.

Step-by-Step Solution

1
Evaluate the identity management requirement for console access.
AWS IAM Identity Center is selected to federate the on-premises Active Directory.
This allows the 50 engineers to authenticate using their existing corporate credentials without the administrative overhead of managing separate, long-term IAM users.
2
Evaluate the secret management and rotation requirement.
AWS Secrets Manager is selected to store the database password and configure a 30-day automatic rotation schedule.
Secrets Manager natively supports automatic rotation of database credentials, securing the password without requiring manual script maintenance.

Key Concept

Centralized identity federation and secure secrets management with automated rotation
Estimated Time:2m 0s
Question 395Question →

A software-as-a-service (SaaS) provider is structuring a new multi-account AWS environment using AWS Organizations. The security team wants to establish centralized governance and security controls. Specifically, they must integrate their external enterprise identity provider (IdP) for centralized single sign-on and administrative access across all accounts. They also need to enforce security policies that prevent member accounts from altering AWS CloudTrail configurations or deleting critical Amazon S3 audit log buckets. Which combination of actions should a solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable AWS IAM Identity Center and configure federation with the external identity provider to manage single sign-on user access across all accounts.; Create a Service Control Policy (SCP) in AWS Organizations that denies cloudtrail:StopLogging and s3:DeleteBucket actions, and apply it to the organizational units (OUs) containing member accounts.

Answer

The solutions architect should recommend enabling AWS IAM Identity Center and configuring federation with the external identity provider, while deploying a Service Control Policy (SCP) in AWS Organizations to deny cloudtrail:StopLogging and s3:DeleteBucket actions at the organizational unit (OU) level.
Centralizing governance requires combining identity management and preventative guardrails. The combination of AWS IAM Identity Center and Service Control Policies (SCPs) fulfills these goals. AWS IAM Identity Center integrates with external IdPs for single sign-on access without creating individual IAM users. SCPs in AWS Organizations restrict member accounts from modifying CloudTrail settings or deleting log buckets, enforcing strict compliance policies.

Step-by-Step Solution

1
Address the centralized identity and single sign-on requirement.
By enabling AWS IAM Identity Center and setting up federation with the external enterprise IdP, the organization can map enterprise directory groups to AWS permissions centrally, avoiding local IAM users.
This establishes a centralized, secure identity mechanism with temporary credentials across the entire Organization.
2
Implement policy guardrails to protect auditing and log storage in member accounts.
Create a Service Control Policy (SCP) that explicitly denies cloudtrail:StopLogging and s3:DeleteBucket and attach it to the member account OUs.
SCPs restrict the maximum permissions of all users in member accounts, including the root user, ensuring that localized administrative access cannot bypass centralized logging and auditing controls.

Key Concept

Centralized multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center federation.
Estimated Time:2m 0s
Question 396Question →

A financial services company needs to grant its application developers command-line access to manage resources in several AWS accounts. The developers work from local workstations. To comply with security policies, the company must prevent the storage of long-term access keys on local machines, require multi-factor authentication (MFA), and ensure that permissions are automatically revoked when a developer leaves the company. The company currently manages developer identities in an external identity provider (IdP). Which solution should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external identity provider, and instruct developers to configure the AWS CLI using the SSO command to obtain temporary credentials.

Answer

Configure AWS IAM Identity Center to federate with the external identity provider, and instruct developers to configure the AWS CLI using the SSO command to obtain temporary credentials.
Configuring AWS IAM Identity Center to federate with the external identity provider is the recommended best practice. It enables single sign-on (SSO) and ensures that developer access is automatically revoked when their account is deactivated in the external identity provider. Using the AWS CLI integration with IAM Identity Center allows developers to authenticate and receive short-term credentials, eliminating the need to store long-term access keys on their local workstations.

Step-by-Step Solution

1
Identify the security requirements: eliminate long-term access keys on local machines, integrate with an external identity provider, and enforce MFA.
Limits options to federation and temporary credential mechanisms.
Long-term credentials stored locally present a significant security risk if a workstation is compromised.
2
Evaluate AWS IAM Identity Center federation.
IAM Identity Center integrates with external IdPs using SAML 2.0 or OIDC, allowing centralized management and automatic deprovisioning.
When a developer leaves the company, revoking their identity in the external IdP automatically revokes their access to AWS.
3
Determine the CLI configuration for IAM Identity Center.
The AWS CLI integration with IAM Identity Center dynamically requests short-term, temporary credentials, satisfying the local storage restriction.
Temporary credentials automatically expire, mitigating the risk of credential leakage.

Key Concept

Federated access and temporary credentials using AWS IAM Identity Center
Question 397Question →

A logistics company is designing an automated warehouse inventory synchronization system. When items are scanned at receiving stations, inventory update events are generated. These events must be delivered to three separate systems: a centralized inventory database, a third-party vendor replenishment system, and a real-time shipping analytics dashboard. The centralized inventory database must process the events in the exact chronological order they were generated to avoid reconciliation errors, whereas the other systems can process events in any order. If any downstream system is unavailable, it must not impact the others, and the failed events must be retried automatically. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Publish the inventory update events to an Amazon SNS FIFO topic. Subscribe three Amazon SQS FIFO queues to the SNS FIFO topic, with each queue consuming messages for one of the downstream systems.

Answer

Publish the inventory update events to an Amazon SNS FIFO topic and subscribe three Amazon SQS FIFO queues to it, with each queue consuming messages for one of the downstream systems.
The correct solution leverages the fan-out pattern with ordering. By publishing events to an Amazon SNS FIFO topic, the message order is preserved. Subscribing three Amazon SQS FIFO queues (one for each downstream system) ensures that each system gets its own independent copy of every event, ensuring fault isolation and automatic retries. The SQS FIFO queue bound to the inventory database guarantees that the events are processed in the exact order they were scanned, preventing race conditions or incorrect state calculations.

Step-by-Step Solution

1
Select a message fan-out service to deliver events to multiple downstream systems.
Amazon SNS is chosen because it natively supports publishing messages to multiple subscribers (fan-out pattern).
The requirement states that events must be delivered to three separate systems independently.
2
Ensure strict ordering guarantees for the centralized inventory database.
Use Amazon SNS FIFO and Amazon SQS FIFO queues.
Standard SQS/SNS do not guarantee ordering. SQS FIFO queues guarantee chronological order processing, and they can only subscribe to SNS FIFO topics.
3
Decouple downstream processing to ensure isolation and retries.
Create a separate SQS FIFO queue for each of the three downstream systems.
If any downstream system fails, its dedicated SQS queue will hold the messages for retry without affecting the other systems' queues.

Key Concept

Decoupling message fan-out with strict ordering guarantees using Amazon SNS FIFO and Amazon SQS FIFO queues.
Question 398Question →

A global e-commerce company hosts its application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of Amazon EC2 instances. The company's security team detects two concurrent security events during a high-traffic sale: a volumetric UDP flood attack targeting the application's infrastructure, and a distributed HTTP GET flood targeting a database-intensive search endpoint (/api/v1/search) using randomized query parameters to bypass caching. The company requires a solution that automatically mitigates the volumetric traffic, provides application-layer protection for the search endpoint, secures cost protection against EC2 scaling charges incurred by the attack traffic, and grants 24/7 access to the AWS Shield Response Team (SRT). Which architecture meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Enable AWS Shield Advanced on the Application Load Balancer. Associate AWS WAF with the Application Load Balancer, and create a rate-based rule that inspects request parameters and matches the search endpoint path.

Answer

Enable AWS Shield Advanced on the Application Load Balancer, associate AWS WAF with the Application Load Balancer, and configure an AWS WAF rate-based rule targeting the search endpoint path.
The correct architecture leverages AWS Shield Advanced on the Application Load Balancer for automated mitigation of infrastructure-layer (Layer 3/4) attacks like UDP floods, cost protection to offset EC2 scaling charges incurred during a DDoS attack, and 24/7 access to the Shield Response Team. In addition, an AWS WAF rate-based rule is associated with the ALB to inspect HTTP requests and throttle clients that send high-volume HTTP GET requests to the resource-intensive search endpoint.

Step-by-Step Solution

1
Select AWS Shield Advanced for L3/L4 volumetric protection, cost protection, and SRT access.
Automatic mitigation of UDP floods at the AWS edge, reimbursement for scale-out costs, and 24/7 access to the Shield Response Team are enabled.
AWS Shield Standard does not cover scale-out costs or provide SRT support, which are critical requirements.
2
Deploy AWS WAF and associate it with the Application Load Balancer.
Layer 7 HTTP traffic can now be inspected at the load balancer layer.
Layer 7 mitigation requires AWS WAF since network firewalls and NACLs cannot inspect HTTP request payloads or paths.
3
Configure an AWS WAF rate-based rule matching the '/api/v1/search' URI path.
HTTP requests targeting the search endpoint are automatically throttled when they exceed the defined rate limit threshold.
A rate-based rule limits the rate of requests from any single IP address, mitigating HTTP GET flood attacks that attempt to bypass caching using randomized query parameters.

Key Concept

AWS Shield Advanced offers Layer 3 and Layer 4 DDoS protection, cost protection for scaled-out resources, and SRT engagement, while AWS WAF provides Layer 7 mitigation (such as rate-limiting) for specific application endpoints.
Estimated Time:2m 30s
Question 399Question →

A solutions architect is designing a secure architecture for a serverless web application. The application consists of AWS Lambda functions that need to query an Amazon RDS for PostgreSQL database. The database credentials must not be hardcoded in the application code, must be encrypted at rest, and must be rotated every 30 days without manual intervention or application downtime. Which combination of steps should the solutions architect perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS-managed rotation function for Amazon RDS.; Configure the AWS Lambda function to retrieve the credentials dynamically at runtime using the Secrets Manager API, and grant the Lambda execution role permissions to retrieve the secret value.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS-managed rotation function for Amazon RDS, and configure the AWS Lambda function to retrieve the credentials dynamically at runtime using the Secrets Manager API, granting the Lambda execution role permissions to retrieve the secret value.
Storing database credentials in AWS Secrets Manager allows for secure storage with encryption at rest using AWS KMS. Secrets Manager natively supports automatic rotation for Amazon RDS databases using a built-in AWS-managed Lambda function, which updates both the database password and the secret value without downtime. The Lambda function must dynamically retrieve these credentials at runtime via the Secrets Manager API, which requires that the Lambda function's IAM execution role has permissions to retrieve the secret value.

Step-by-Step Solution

1
Store the database credentials securely in AWS Secrets Manager.
The sensitive database credentials are encrypted at rest using AWS KMS.
Hardcoding secrets violates security standards; Secrets Manager provides central encrypted storage.
2
Configure AWS Secrets Manager to automatically rotate the secret every 30 days using the built-in Amazon RDS rotation template.
Secrets Manager automatically updates the password on the RDS PostgreSQL instance and updates the secret value concurrently.
This satisfies the requirement for automatic password rotation without application downtime or manual intervention.
3
Configure the AWS Lambda function to query the secret value dynamically at runtime using the AWS SDK.
The Lambda function retrieves the most current credentials directly from Secrets Manager.
Dynamically querying the credentials ensures the application always uses the rotated password without needing redeployment.
4
Grant the Lambda function's IAM execution role permission to retrieve the secret value.
The Lambda function is authorized to access the credentials at runtime.
Least privilege access must be enforced, allowing only authorized serverless components to decrypt the secret.

Key Concept

AWS Secrets Manager automatic RDS rotation and secure IAM access pattern for Lambda.
Question 400Question →

An engineering firm is deploying a seismic simulation workload on AWS. The workload consists of a cluster of 5050 Amazon EC2 Linux instances that require concurrent, parallel read and write access to a shared file system. The simulation demands sub-millisecond latencies, an aggregate throughput of at least 15 GiB/s15\text{ GiB/s}, and over 100000 IOPS100{}000\text{ IOPS}. The data is highly transient scratch data that can be easily regenerated if lost. Which storage configuration meets these requirements with the highest performance and the lowest operational complexity?

Show answer & explanation

Answer: An Amazon FSx for Lustre file system using SSD storage deployed in scratch mode.

Answer

An Amazon FSx for Lustre file system using SSD storage deployed in scratch mode
The correct option is the FSx for Lustre deployment because it is a native parallel file system designed specifically for high-performance computing (HPC) and scratch workloads. It supports parallel access from hundreds of EC2 instances and scales performance (both throughput and IOPS) with SSD storage while maintaining sub-millisecond latencies.

Step-by-Step Solution

1
Analyze the access requirement
The architecture requires parallel, concurrent read and write access from a cluster of 5050 Linux EC2 instances.
This rules out standard Amazon EBS volumes which cannot be attached to multiple instances concurrently, and EBS Multi-Attach which is limited to a maximum of 1616 instances.
2
Evaluate throughput and latency constraints
The file system must support sub-millisecond latencies, at least 15 GiB/s15\text{ GiB/s} throughput, and over 100000 IOPS100{}000\text{ IOPS} for transient scratch data.
Amazon EFS cannot scale to 15 GiB/s15\text{ GiB/s} write throughput, and its Max I/O mode increases latency for metadata operations, making it unsuitable.
3
Match workload characteristics to optimal service
Amazon FSx for Lustre is a high-performance parallel file system designed for HPC workloads, supporting parallel client access, sub-millisecond latency, and massive scaling.
Deploying it as SSD scratch storage matches the transient nature of the data and provides the maximum cost-effective performance.

Key Concept

High-Performance Parallel Storage for HPC Workloads
PreviousPage 20 / 74Next
All practice questions — AWS Certified Solutions Architect - Associate | Examkin