All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A company is designing an IoT telemetry ingestion pipeline. During peak hours, thousands of devices send JSON payload messages to AWS, resulting in a data ingestion rate of $15\text{ MB/s}$ and $15,000\text{ records/s}$ (averaging $1\text{ KB}$ per record). The data must be partitioned by region and timestamp, converted into Apache Parquet format, and stored in Amazon S3. The total latency from data generation to S3 delivery must not exceed $2\text{ minutes}$ . The pipeline must scale dynamically to handle traffic spikes without manual administration. Which architecture meets these requirements with the highest performance and least operational overhead?

Configure Amazon Kinesis Data Firehose with Amazon Kinesis Data Streams in on-demand mode as the source. Enable dynamic partitioning in Kinesis Data Firehose using jq expressions to partition by region and timestamp, and enable format conversion to Parquet using the AWS Glue Schema Registry before delivering the data to Amazon S3.

Configure a standard Amazon SQS queue to ingest the payloads. Set up an AWS Lambda function triggered by the queue to partition the data, convert it to Parquet, and write it to Amazon S3. Choose this configuration to guarantee strict first-in, first-out ordering of the incoming telemetry events.

Configure Amazon Kinesis Data Streams in provisioned mode with

5

shards to ingest the data. Attach an Amazon Kinesis Data Firehose delivery stream to the data stream to handle format conversion to Parquet and S3 partitioning. The stream will automatically scale its capacity dynamically to absorb the peak throughput.

Configure Amazon Kinesis Data Streams in provisioned mode with a single shard. Use an AWS Lambda function triggered by the stream to convert the records to Parquet and save them to Amazon S3. The Lambda function will partition the records dynamically based on the payload attributes.

Show answer & explanation

Answer: Configure Amazon Kinesis Data Firehose with Amazon Kinesis Data Streams in on-demand mode as the source. Enable dynamic partitioning in Kinesis Data Firehose using jq expressions to partition by region and timestamp, and enable format conversion to Parquet using the AWS Glue Schema Registry before delivering the data to Amazon S3.

Answer

The architecture using Kinesis Data Streams in on-demand mode combined with Kinesis Data Firehose's dynamic partitioning and format conversion provides the highest performance and lowest operational overhead.

The correct solution utilizes Amazon Kinesis Data Streams in on-demand mode, which instantly scales to accommodate ingestion rates up to

200\text{ MB/s}

200,000\text{ records/s}

. Coupling this stream with Amazon Kinesis Data Firehose allows the pipeline to ingest, dynamically partition (using jq expressions on payload attributes), and convert JSON to Parquet format (using AWS Glue Schema Registry) before storing in S3. This managed solution meets the sub-2-minute latency requirement with zero administrative overhead.

Step-by-Step Solution

Calculate the ingestion throughput requirements.

The peak throughput is

15\text{ MB/s}

and

15,000\text{ records/s}

. This exceeds the limits of standard low-capacity configurations (such as a single shard or small shard pools).

To ensure no data loss or throttling, the ingestion layer must support at least

15\text{ MB/s}

and

15,000\text{ records/s}

Determine the scaling mechanism for the ingestion tier.

Using Kinesis Data Streams with on-demand capacity mode allows the stream to automatically scale up to

200\text{ MB/s}

and

200,000\text{ records/s}

write throughput without manual shard management.

On-demand capacity mode eliminates the need to manage shard scaling manually or build complex autoscaling scripts, satisfying the requirement to scale dynamically without manual administration.

Select the transformation and partitioning mechanism.

Amazon Kinesis Data Firehose with Glue Schema Registry can automatically convert JSON payloads to Parquet format and write them to S3 using dynamic partitioning based on jq expressions.

Performing format conversion and partitioning natively within Kinesis Data Firehose removes the operational overhead of running custom Lambda functions or Glue ETL jobs, while meeting the 2-minute latency delivery window.

Key Concept

High-throughput real-time ingestion requires automated scaling (Kinesis Data Streams on-demand mode) paired with managed, serverless delivery and transformation tools (Kinesis Data Firehose dynamic partitioning and Parquet conversion) to minimize operational overhead and latency.

Estimated Time:2m 0s

Question 402Question →

A company hosts a latency-sensitive web application on Amazon EC2 instances behind Application Load Balancers (ALBs) in both the us-east-1 and eu-west-1 Regions. The company wants to optimize the network performance for its global user base, reduce latency, and ensure automated failover to the healthy Region if an ALB fails. Which TWO options should a solutions architect recommend to achieve this high-performing and resilient network architecture?

Select all that apply

Provision an AWS Global Accelerator accelerator and configure the ALBs in both Regions as endpoints under the accelerator.

Configure Amazon Route 53 using a latency-routing policy to direct users to the closest Region, and configure Route 53 health checks on the ALBs to ensure failover.

Deploy a AWS Site-to-Site VPN connection from the users' client devices to each Region to tunnel traffic securely with up to

1.25\text{ Gbps}

throughput.

Configure Amazon Route 53 with latency-based routing without active health checks, relying on client-side browser caching to detect load balancer failures.

Configure stateful Network ACLs at the subnet level in both Regions to dynamically reroute inbound HTTP/HTTPS traffic to the alternate Region's ALB if local instances become unresponsive.

Show answer & explanation

Answer: Provision an AWS Global Accelerator accelerator and configure the ALBs in both Regions as endpoints under the accelerator.; Configure Amazon Route 53 using a latency-routing policy to direct users to the closest Region, and configure Route 53 health checks on the ALBs to ensure failover.

Answer

The solutions architect should provision an AWS Global Accelerator accelerator to route traffic over the AWS global network to the ALBs, and configure Amazon Route 53 with a latency-routing policy combined with active health checks to ensure traffic is directed to the lowest-latency healthy endpoint.

Provisioning an AWS Global Accelerator accelerator is correct because it uses anycast IP addresses and the AWS global network to route traffic to the nearest healthy ALB endpoint, reducing latency and jitter. Configuring Route 53 with latency-based routing and health checks is correct because it resolves DNS queries to the lower-latency Region while automatically omitting unhealthy endpoints if an ALB fails.

Step-by-Step Solution

Evaluate the need for global traffic routing and latency reduction.

Identify that AWS Global Accelerator uses the AWS private global fiber network to route user requests, providing low-latency, anycast IP-based ingress and rapid regional failover.

Global Accelerator optimizes the network path from the user's nearest edge location to the ALB, bypassing the public internet where possible.

Analyze DNS-based routing options for multi-Region high availability.

Select Amazon Route 53 with latency-based routing and health checks enabled.

Adding health checks ensures that Route 53 stops returning the IP address of an ALB that fails, preventing blackholing of user traffic.

Identify and eliminate options that violate physical or service constraints.

Exclude VPN-based routing due to the

1.25\text{ Gbps}

tunnel limit and client scaling issues, exclude health-check-free DNS configuration because it fails to provide automated failover, and discard Network ACLs because they are stateless and incapable of routing traffic between Regions.

Understanding limits like VPN bandwidth and the operational characteristics of Route 53 and Network ACLs helps eliminate suboptimal or incorrect designs.

Key Concept

High-performing global routing and multi-Region resilience require combining latency-optimized path selection (AWS Global Accelerator or Route 53 latency routing) with active health monitoring to automate failover.

Question 403Question →

A company is deploying a global gaming application that requires a multi-region, active-active database configuration. The database must allow users in both North America and Europe to perform local read and write operations with sub-millisecond latency. The data must be replicated bi-directionally across regions with a Recovery Point Objective (RPO) of less than 1 second. Which two database configuration steps should the solutions architect perform to meet these requirements?

Select all that apply

Create an Amazon DynamoDB table and enable DynamoDB Streams with the "New and old images" view type.

Add the replica region to the DynamoDB table to automatically establish a DynamoDB global table.

Deploy an Amazon RDS PostgreSQL DB instance in Multi-AZ mode and configure cross-region read replicas to accept local write operations in both regions.

Configure Route 53 latency-based routing to direct write requests to the nearest database endpoint and automatically synchronize writes across regions.

Deploy a warm standby database replica in the secondary region and set up a pilot light replication model to handle active-active traffic.

Show answer & explanation

Answer: Create an Amazon DynamoDB table and enable DynamoDB Streams with the "New and old images" view type.; Add the replica region to the DynamoDB table to automatically establish a DynamoDB global table.

Answer

To meet the requirements of active-active writes, low latency, and sub-second replication across multiple regions, you must configure Amazon DynamoDB global tables. This is achieved by creating a DynamoDB table, enabling DynamoDB Streams with the new and old images view type, and then adding the target replica region to the table configuration.

Establishing a global, active-active database configuration with sub-millisecond latency requires Amazon DynamoDB global tables. To configure global tables, a solutions architect must enable DynamoDB Streams with the new and old images view type on the source table and then add the replica regions. This configures managed bi-directional replication, allowing local reads and writes in all replica regions.

Step-by-Step Solution

Identify the active-active multi-region database requirement.

Amazon DynamoDB global tables is identified as the appropriate service to support active-active writes and reads in multiple regions with sub-millisecond latencies.

Relational databases like RDS do not support multi-region active-active write configurations natively, whereas DynamoDB global tables provide fully managed, multi-region replication with local read/write performance.

Configure the prerequisites for DynamoDB global tables.

Enable DynamoDB Streams on the primary table with the view type set to new and old images.

DynamoDB global tables rely on DynamoDB Streams to track and propagate changes across region replicas.

Add replica regions to the table configuration.

Add the desired AWS region as a replica in the table's global tables settings.

This establishes the bi-directional replication between the selected regions to complete the global tables setup.

Key Concept

Amazon DynamoDB Global Tables

Question 404Question →

A media company is migrating a high-throughput, low-latency live video streaming platform to AWS. The platform requires high-speed connection between their on-premises broadcasting studio and their AWS VPC. The peak data transfer rate is expected to reach $8\text{ Gbps}$ during live events. The architecture must support maximum throughput, dynamic routing with automated failover, and high security. The solutions architect is designing the hybrid network connectivity using AWS Transit Gateway and AWS Direct Connect. The network security team requires strict traffic control at both the subnet boundary and the instance level. Which TWO configurations should the solutions architect implement to meet these requirements with optimal performance and resiliency?

Select all that apply

Deploy an AWS Direct Connect connection with a Transit Virtual Interface (VIF) attached to an AWS Transit Gateway to enable high-speed routing to multiple VPCs.

Configure stateful security groups at the instance level to allow streaming traffic, and implement stateless Network Access Control Lists (NACLs) at the subnet boundary to permit both inbound streaming traffic and outbound return traffic on ephemeral ports.

Deploy an AWS Site-to-Site VPN connection and attach it to the AWS Transit Gateway as the primary path, relying on the VPN tunnel to dynamically scale its throughput to handle the

8\text{ Gbps}

peak bandwidth.

Implement Route 53 latency routing policies to route the ingress video upload traffic to the closest AWS Region, relying on Route 53's default routing metrics to automatically fail over and bypass unhealthy regions during an outage.

Configure stateless security groups at the instance level to block unauthorized traffic, while relying on stateful Network Access Control Lists (NACLs) at the subnet level to track connections and automatically allow return traffic.

Show answer & explanation

Answer: Deploy an AWS Direct Connect connection with a Transit Virtual Interface (VIF) attached to an AWS Transit Gateway to enable high-speed routing to multiple VPCs.; Configure stateful security groups at the instance level to allow streaming traffic, and implement stateless Network Access Control Lists (NACLs) at the subnet boundary to permit both inbound streaming traffic and outbound return traffic on ephemeral ports.

Answer

The correct configurations are to deploy an AWS Direct Connect connection with a Transit Virtual Interface (VIF) attached to an AWS Transit Gateway, and configure stateful security groups at the instance level combined with stateless Network Access Control Lists (NACLs) at the subnet boundary to permit both inbound streaming traffic and outbound return traffic on ephemeral ports.

The configuration using AWS Direct Connect with a Transit VIF attached to an AWS Transit Gateway is correct because it supports the high throughput requirements of

8\text{ Gbps}

by connecting to multiple VPCs over dedicated high-bandwidth lines. The configuration using stateful security groups and stateless Network Access Control Lists (NACLs) is correct because it aligns with AWS security best practices: security groups automatically allow return traffic statefully at the instance level, while NACLs at the subnet boundary are stateless and require explicit rules in both directions (including ephemeral port ranges) to permit return traffic.

Step-by-Step Solution

Evaluate the bandwidth and connectivity requirements for the on-premises migration.

Determined that the platform requires at least

8\text{ Gbps}

of throughput with low latency and dynamic routing.

Identifying throughput constraints helps rule out solutions with hard limits below

8\text{ Gbps}

, such as a single Site-to-Site VPN.

Select the appropriate hybrid connectivity model.

Selected AWS Direct Connect with a Transit Virtual Interface (VIF) attached to an AWS Transit Gateway.

AWS Direct Connect provides dedicated network connections up to

10\text{ Gbps}

100\text{ Gbps}

which can support the

8\text{ Gbps}

peak demand, and Transit Gateway simplifies routing management across multiple VPCs.

Configure network security controls at both the subnet and instance levels.

Implemented stateful security groups at the instance level and stateless Network ACLs (NACLs) at the subnet level.

This satisfies the requirement for strict traffic control. Security groups track connection states (stateful), while NACLs require explicit rules in both inbound and outbound directions to allow traffic and return paths (stateless).

Key Concept

Designing high-performing, scalable, and secure hybrid network architectures using AWS Direct Connect, Transit Gateway, stateful Security Groups, and stateless NACLs.

Question 405Question →

An enterprise is migrating a critical SQL-based inventory application to AWS. The database must be highly available within a single AWS Region. The architecture must achieve a Recovery Time Objective (RTO) of less than 30 seconds and a Recovery Point Objective (RPO) of zero (no data loss) during an Availability Zone outage. Additionally, the application experiences sudden spikes in read traffic that must be scaled independently without affecting the primary write database. Which two database configurations or actions should a solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon Aurora PostgreSQL DB cluster with a primary DB instance and at least one Aurora Replica in a different Availability Zone.

Configure the application's read operations to use the DB cluster reader endpoint.

Create a single-instance Amazon RDS PostgreSQL DB instance and set up an RDS Read Replica in a different Availability Zone to serve as the automatic failover target.

Configure an Amazon RDS PostgreSQL Multi-AZ DB instance and use Amazon Route 53 latency-based routing to distribute read queries to the standby database instance.

Set up an Amazon RDS PostgreSQL DB instance in one Availability Zone and configure AWS Database Migration Service (AWS DMS) to sync data to a scaled-down warm standby instance in another Availability Zone.

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL DB cluster with a primary DB instance and at least one Aurora Replica in a different Availability Zone.; Configure the application's read operations to use the DB cluster reader endpoint.

Answer

Deploying an Amazon Aurora PostgreSQL DB cluster with a primary DB instance and at least one Aurora Replica in a different Availability Zone, and configuring the application's read operations to use the DB cluster reader endpoint.

Deploying an Amazon Aurora PostgreSQL DB cluster with a replica in another Availability Zone ensures automatic failover in less than 30 seconds with zero data loss, satisfying both the RTO and RPO requirements. Directing read traffic to the Aurora reader endpoint allows read queries to be load-balanced across replicas, scaling the read workload independently of the primary write instance.

Step-by-Step Solution

Evaluate the HA failover time (RTO) and data loss (RPO) requirements.

Identify that a database configuration with automatic failover under 30 seconds and synchronous replication (RPO of 0) is necessary. Amazon Aurora PostgreSQL with an Aurora Replica fits this requirement.

Amazon Aurora automates failover to a replica within 30 seconds, and its shared storage architecture replicates writes synchronously across three Availability Zones to prevent data loss.

Address the requirement to scale read traffic independently without impacting write operations.

Determine that read operations should be routed away from the primary writer instance using a read-scaling mechanism. In Aurora, this is handled by connecting to the reader endpoint.

The Aurora reader endpoint automatically load balances read-only connections among available Aurora Replicas, isolating read-heavy spikes from the primary writer instance.

Eliminate options that fail to meet high availability, replication, or read-scaling constraints.

Exclude configurations using RDS Read Replicas for primary failover (requires manual intervention), RDS standby instances for read traffic (standbys are passive), or AWS DMS to a warm standby (asynchronous replication with higher RTO).

These configurations violate basic AWS RDS/Aurora architectural constraints regarding read routing, synchronous replication, and automated failover capabilities.

Key Concept

Amazon Aurora high availability architecture relies on synchronous storage replication across multiple Availability Zones, automated failover to Aurora Replicas within 30 seconds, and endpoint management (writer and reader endpoints) to decouple read and write traffic.

Question 406Question →

An enterprise is migrating a clustered database workload to Amazon EC2. The cluster consists of three nodes that require concurrent, shared read/write access to a single block storage volume. The database engine requires support for SCSI-3 Persistent Reservations to coordinate write operations, and must achieve a minimum performance of $80,000 \text{ IOPS}$ and $2,000 \text{ MB/s}$ throughput with sub-millisecond latency.

Which two configurations must the solutions architect implement to meet these storage requirements? (Select TWO.)

Select all that apply

Provision an Amazon EBS `io2` volume with the required capacity, IOPS, and throughput, and enable the Multi-Attach feature.

Launch the EC2 instances in the same Availability Zone, and attach the `io2` volume to all three instances.

Launch the EC2 instances across multiple Availability Zones in the same AWS Region, and attach the `io2` volume to all three instances.

Provision an Amazon EBS `gp3` volume with custom provisioned performance, and enable the Multi-Attach feature.

Create an Amazon EFS file system with Provisioned Throughput set to

2,000 \text{ MB/s}

, and mount the volume to all three instances.

Show answer & explanation

Answer: Provision an Amazon EBS `io2` volume with the required capacity, IOPS, and throughput, and enable the Multi-Attach feature.; Launch the EC2 instances in the same Availability Zone, and attach the `io2` volume to all three instances.

Answer

Provision an Amazon EBS io2 volume with the required performance and enable Multi-Attach, then launch the EC2 instances in the same Availability Zone and attach the volume to all instances.

The database workload requires shared block storage with SCSI-3 Persistent Reservations. Amazon EBS io2 volumes configured with Multi-Attach support this capability and provide the required performance (

80,000 \text{ IOPS}

and

2,000 \text{ MB/s}

throughput). Since EBS Multi-Attach is restricted to a single Availability Zone, the EC2 instances must be launched in the same Availability Zone.

Step-by-Step Solution

Analyze the technical requirements of the database cluster.

Identified requirements: block storage, SCSI-3 Persistent Reservations, concurrent write access from 3 nodes, at least

80,000 \text{ IOPS}

, and

2,000 \text{ MB/s}

throughput.

Understanding key constraints helps eliminate incompatible storage types like file systems (Amazon EFS).

Evaluate EBS volume types for Multi-Attach and performance capabilities.

Only EBS io2 (and io2 Block Express) volumes support Multi-Attach and can reach the performance targets of

80,000 \text{ IOPS}

and

2,000 \text{ MB/s}

. General Purpose SSD (gp3) volumes do not support Multi-Attach and are capped at lower performance limits.

Selecting the correct volume type ensures that both the multi-writer feature and performance SLAs are satisfied.

Determine the network topology constraint for Multi-Attach.

EBS Multi-Attach volumes can only be attached to instances within the same Availability Zone.

Ensures that the cluster instances are deployed in the same Availability Zone to allow successful volume attachment.

Key Concept

Amazon EBS Multi-Attach with io2 volumes supports cluster-aware applications requiring shared block storage with SCSI-3 Persistent Reservations, limited to a single Availability Zone.

Alternative Method

If cross-AZ resiliency is required for the database layer, instead of using EBS Multi-Attach at the storage level, you could implement application-level replication (e.g., PostgreSQL streaming replication or SQL Server Availability Groups) where each database node uses its own dedicated EBS io2 volume in a different Availability Zone.

Estimated Time:3m 0s

Question 407Question →

A financial technology startup is using AWS Organizations to manage multiple AWS accounts. The security team wants to enforce compliance across all member accounts by ensuring that AWS CloudTrail remains enabled and Amazon GuardDuty cannot be disabled or modified by member account administrators. Additionally, the startup wants to federate user access using their external Identity Provider (IdP) so that employees can access member accounts with their existing credentials without introducing long-term IAM credentials. Which strategy should the solutions architect recommend to meet these security and compliance requirements with the least operational effort?

Enable AWS IAM Identity Center, configure federation with the external IdP, and assign permissions. Place the member accounts into Organizational Units (OUs) within AWS Organizations, and attach a Service Control Policy (SCP) to the OUs that denies API actions for disabling CloudTrail and GuardDuty.

Create individual IAM users in each member account for every employee in the external IdP directory, configure IAM roles for cross-account access, and use AWS Organizations Service Control Policies (SCPs) to prevent member accounts from altering CloudTrail and GuardDuty.

Enable AWS IAM Identity Center and configure federation with the external IdP. Attach a Service Control Policy (SCP) to the AWS Organizations management account root user to prevent it from disabling CloudTrail and GuardDuty across all member accounts.

Deploy an AWS Directory Service AD Connector in each member account, generate individual IAM users with programmatic keys for each directory user, and use AWS Systems Manager to audit and automatically re-enable CloudTrail and GuardDuty if disabled.

Show answer & explanation

Answer: Enable AWS IAM Identity Center, configure federation with the external IdP, and assign permissions. Place the member accounts into Organizational Units (OUs) within AWS Organizations, and attach a Service Control Policy (SCP) to the OUs that denies API actions for disabling CloudTrail and GuardDuty.

Answer

The correct strategy uses AWS IAM Identity Center to federate with the external IdP, which centralizes user management and avoids creating individual IAM users with long-term credentials in each member account. It also groups member accounts into Organizational Units (OUs) and applies Service Control Policies (SCPs) to deny disabling CloudTrail and GuardDuty. This enforces security guardrails across all member accounts with minimal operational effort.

Step-by-Step Solution

Centralize identity federation.

AWS IAM Identity Center is enabled and integrated with the external Identity Provider (IdP) to allow single sign-on access without creating individual IAM users or long-term credentials.

This meets the requirement of federating user access using existing credentials without introducing local IAM users.

Establish account structure in AWS Organizations.

Member accounts are grouped into Organizational Units (OUs) based on environment or governance needs.

This allows policies to be applied hierarchically and consistently across multiple accounts.

Enforce compliance using Service Control Policies (SCPs).

An SCP is attached to the OUs to explicitly deny administrative actions that would disable AWS CloudTrail or Amazon GuardDuty.

SCPs act as guardrails that apply to all users and roles within the member accounts, including the root user of those member accounts, ensuring compliance cannot be bypassed.

Key Concept

Centralized multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center for external IdP federation.

Question 408Question →

A financial trading firm is designing an ingestion and transformation pipeline to process high-frequency market data feeds from multiple external stock exchanges. The system must ingest up to $120\text{ MB/s}$ of streaming data during peak trading hours, preserving strict ordering per stock ticker symbol. Real-time analytics dashboards require sub-second processing latency. Additionally, a backup of all raw feeds must be stored in Apache Parquet format in Amazon S3, partitioned by date, with a maximum ingestion-to-storage latency of $5$ minutes. The archived data must also be available for query within minutes if an ad-hoc audit is requested. Which combination of actions should the solutions architect take to meet these performance and storage requirements? (Select TWO.)

Select all that apply

Provision an Amazon Kinesis Data Stream to ingest the market data, using the stock ticker symbol as the partition key.

Create an Amazon Kinesis Data Firehose delivery stream with the Kinesis Data Stream as the source, enabling data format conversion to Apache Parquet before writing to Amazon S3 Standard.

Ingest the data feeds directly into Amazon SQS Standard queues, utilizing message group IDs to guarantee order processing.

Configure Amazon Kinesis Data Firehose to write the transformed data directly to Amazon S3 Glacier Flexible Retrieval, using standard retrieval to access the files for ad-hoc audits.

Deploy an Amazon Kinesis Data Stream with a single shard and configure the Kinesis Producer Library (KPL) to scale the throughput automatically during peak hours.

Show answer & explanation

Answer: Provision an Amazon Kinesis Data Stream to ingest the market data, using the stock ticker symbol as the partition key.; Create an Amazon Kinesis Data Firehose delivery stream with the Kinesis Data Stream as the source, enabling data format conversion to Apache Parquet before writing to Amazon S3 Standard.

Answer

The correct configuration is to provision an Amazon Kinesis Data Stream to ingest the market data using the stock ticker symbol as the partition key, and create an Amazon Kinesis Data Firehose delivery stream with the Kinesis Data Stream as the source, enabling data format conversion to Apache Parquet before writing to Amazon S3 Standard.

Provisioning an Amazon Kinesis Data Stream using the stock ticker symbol as the partition key ensures that all transactions for a specific stock are routed to the same shard, which guarantees chronological order preservation and sub-second ingestion latency. Using Amazon Kinesis Data Firehose with the stream as its source allows the streaming data to be asynchronously buffered, converted into Apache Parquet format, and delivered to Amazon S3 Standard within the

5

-minute limit, without impacting the latency of the real-time processing path.

Step-by-Step Solution

Analyze the real-time ingestion and ordering requirements.

Real-time processing requires sub-second latency and strict ordering per stock symbol. Kinesis Data Streams supports sub-second latency and partition-key-based ordering.

Using the stock symbol as the partition key ensures all updates for a specific stock are routed to the same shard and processed in order.

Analyze the transformation and backup requirements.

Data must be converted to Apache Parquet and stored in S3 within

5

minutes. Amazon Kinesis Data Firehose natively supports format conversion to Parquet and delivery to S3.

By sourcing from the Kinesis Data Stream, Firehose can batch and transform the stream asynchronously without adding latency to the real-time path.

Evaluate the storage tier requirement for audit access speed.

The audited data must be accessible within minutes. S3 Standard allows immediate access, whereas S3 Glacier Flexible Retrieval with standard retrieval takes

3

5

hours.

S3 Standard meets both the immediate query requirement and the

5

-minute ingestion latency target.

Key Concept

Architecting high-throughput, low-latency streaming ingestion using Kinesis Data Streams for sub-second ordering, paired with Kinesis Data Firehose for near-real-time data transformation and delivery to S3 Standard.

Estimated Time:2m 0s

Question 409Question →

A company is deploying a database instance in a private subnet. The database needs to receive traffic only from a web server running in a public subnet of the same VPC. Which of the following configurations are required to establish this network security boundary? (Select TWO.)

Select all that apply

Create a security group for the database instance with an inbound rule that allows the database port traffic from the security group of the web server.

Configure the private subnet's Network ACL with an inbound rule allowing database port traffic from the public subnet CIDR, and an outbound rule allowing ephemeral port traffic back to the public subnet CIDR.

Attach an AWS WAF web ACL directly to the database instance to inspect and filter SQL queries at the network layer.

Configure the database security group with an outbound rule allowing return traffic to the web server, because security groups are stateless.

Configure a Network ACL at the database instance level to restrict inbound access to the database port.

Show answer & explanation

Answer: Create a security group for the database instance with an inbound rule that allows the database port traffic from the security group of the web server.; Configure the private subnet's Network ACL with an inbound rule allowing database port traffic from the public subnet CIDR, and an outbound rule allowing ephemeral port traffic back to the public subnet CIDR.

Answer

The correct configurations are to create a security group for the database instance that allows inbound traffic from the web server's security group, and to configure the private subnet's Network ACL with both inbound traffic rules and outbound ephemeral port return rules.

The correct choices are the security group inbound rule configuration and the Network ACL rules configuration. Security groups operate at the instance level and are stateful, so configuring an inbound rule referencing the web server's security group allows the traffic and its return flow. Network ACLs operate at the subnet level and are stateless, requiring explicit rules for both inbound database traffic and outbound ephemeral port return traffic.

Step-by-Step Solution

Analyze instance-level network security controls.

Identify that security groups operate at the instance level and are stateful, meaning they only require inbound configuration to allow bidirectional communication.

This confirms that an inbound rule on the database security group referencing the web server's security group is correct and sufficient at the instance level.

Analyze subnet-level network security controls.

Identify that Network ACLs operate at the subnet level and are stateless, meaning they require explicit rules for both inbound traffic and outbound return traffic.

This confirms that the Network ACL must allow inbound database port traffic and outbound ephemeral port traffic to enable successful bidirectional communication.

Key Concept

VPC Network Security controls comparison (Security Groups vs. Network ACLs)

Question 410Question →

A logistics company is setting up a multi-account structure on AWS using AWS Organizations. The company wants to implement a centralized identity management solution to allow employees to access multiple AWS accounts using their existing corporate Active Directory credentials. Additionally, the security team needs to ensure that no member accounts can disable AWS CloudTrail.

Which two actions should a solutions architect take to meet these requirements? (Select two.)

Select all that apply

Configure AWS IAM Identity Center to federate with the corporate Active Directory to manage user access across all AWS accounts.

Create a Service Control Policy (SCP) that denies permissions to disable or delete CloudTrail, and attach it to the organizational units containing the member accounts.

Create individual IAM users with long-term credentials in each member account mapping to each corporate Active Directory user.

Write a restrictive IAM policy that denies the disabling of CloudTrail and attach it directly to the root user of each member account.

Create IAM roles with administrative privileges in the management account and share the root credentials of the management account with Active Directory administrators.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the corporate Active Directory to manage user access across all AWS accounts.; Create a Service Control Policy (SCP) that denies permissions to disable or delete CloudTrail, and attach it to the organizational units containing the member accounts.

Answer

Configure AWS IAM Identity Center to federate with the corporate Active Directory, and create a Service Control Policy (SCP) that denies permissions to disable or delete CloudTrail attached to the organizational units containing the member accounts.

Centralizing identity federation using AWS IAM Identity Center allows users to authenticate once using their Active Directory credentials and access their assigned roles across AWS accounts securely. Utilizing Service Control Policies (SCPs) at the Organizational Unit (OU) level provides a governance guardrail that prevents any entity, including administrators and the root user in member accounts, from stopping or deleting CloudTrail logging.

Step-by-Step Solution

Address the centralized identity requirement by integrating the identity provider.

AWS IAM Identity Center is configured to federate with the corporate Active Directory, allowing centralized SSO across accounts.

This eliminates the need to create local IAM users in individual accounts.

Address the governance requirement to prevent member accounts from disabling CloudTrail.

A Service Control Policy is created with a Deny effect on CloudTrail modification APIs and attached to the Organizational Units (OUs).

SCPs apply to all users and roles within member accounts (including root users), enforcing the restriction centrally.

Key Concept

AWS multi-account governance using AWS Organizations, Service Control Policies, and centralized federation with AWS IAM Identity Center.

Question 411Question →

A company is deploying a secure containerized application on Amazon EC2 instances within a private subnet (Subnet A: $10.10.1.0/24$ ). The application must consume a third-party messaging service hosted in an on-premises data center via an established AWS Direct Connect connection. The on-premises messaging service endpoint is at $192.168.10.50$ and listens on TCP port $5672$ . The security team has implemented a custom Network Access Control List (NACL) for Subnet A. The Security Group (SG) associated with the EC2 instances allows outbound TCP traffic on port $5672$ to $192.168.10.50/32$ and has no inbound rules. Which configuration of NACL rules for Subnet A is required to establish successful outbound communication to the on-premises service while maintaining the principle of least privilege?

Inbound: No inbound rules are required because the Security Group is stateful. Outbound: Allow TCP traffic on port

5672

to destination

192.168.10.50/32

Inbound: Allow TCP traffic on ports

1024

65535

from source

192.168.10.50/32

. Outbound: Allow TCP traffic on port

5672

to destination

192.168.10.50/32

Inbound: Allow TCP traffic on port

5672

from source

192.168.10.50/32

. Outbound: Allow TCP traffic on port

5672

to destination

192.168.10.50/32

Inbound: Allow all traffic from source

0.0.0.0/0

. Outbound: Allow all traffic to destination

0.0.0.0/0

Show answer & explanation

Answer: Inbound: Allow TCP traffic on ports $1024$ - $65535$ from source $192.168.10.50/32$ . Outbound: Allow TCP traffic on port $5672$ to destination $192.168.10.50/32$ .

Answer

Inbound: Allow TCP traffic on ports

1024

65535

from source

192.168.10.50/32

. Outbound: Allow TCP traffic on port

5672

to destination

192.168.10.50/32

The correct option is the one that configures the outbound NACL rule to allow TCP port

5672

to the on-premises IP address, and configures the inbound NACL rule to allow the return traffic on the ephemeral port range (

1024

65535

) from the same IP address. Because Network ACLs are stateless, return traffic is not automatically permitted and must be explicitly allowed by matching the client's dynamic source ports.

Step-by-Step Solution

Analyze the connection flow direction.

The EC2 instances in Subnet A initiate outbound TCP connections to the on-premises endpoint (

192.168.10.50

) on service port

5672

This establishes that the outbound destination port is

5672

and the destination IP is

192.168.10.50/32

Determine the statefulness of the VPC security layers.

Security Groups are stateful (allowing return traffic automatically), but Network ACLs are stateless (requiring explicit rules for both request and response traffic).

Both inbound and outbound rules must be explicitly configured in the NACL for Subnet A to allow the traffic flow.

Identify the ports used for request and return traffic.

Outbound requests target destination port

5672

from client ephemeral ports (

1024

65535

). Returning traffic targets client ephemeral ports (

1024

65535

) from source port

5672

Knowing the correct ports ensures least privilege configuration without blocking the network response.

Formulate the minimal NACL rules.

Allow outbound TCP on port

5672

192.168.10.50/32

, and allow inbound TCP on ports

1024

65535

from

192.168.10.50/32

This configuration permits the initiating request and the corresponding stateless response under the principle of least privilege.

Key Concept

VPC Network ACLs are stateless and require explicit rules for both outbound request traffic and inbound ephemeral return traffic.

Estimated Time:2m 0s

Question 412Question →

An enterprise runs a mission-critical workload on Amazon EC2 instances with encrypted Amazon EBS volumes. The volumes are encrypted using an AWS KMS customer managed key. Corporate security policy dictates that the encryption keys must be rotated every year. A solutions architect needs to configure this rotation in the most operationally efficient way, while ensuring that all existing EBS snapshots can still be successfully restored at any time.

Which configuration strategy will meet these requirements?

Enable automatic key rotation for the customer managed key in AWS KMS, which rotates the backing key material annually while keeping the key ID and ARN unchanged.

Enable automatic key rotation for the customer managed key, which automatically schedules a background process in AWS KMS to decrypt and re-encrypt all existing EBS volumes and snapshots using the new key version.

Create a new customer managed key manually each year, update the Amazon EC2 launch templates to use the new key, and delete the previous key to avoid extra key storage charges.

Store the KMS key's administrative passwords and configuration metadata as a plain String parameter in AWS Systems Manager Parameter Store, and set up a custom AWS Lambda function to rotate them annually.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key in AWS KMS, which rotates the backing key material annually while keeping the key ID and ARN unchanged.

Answer

Enable automatic key rotation for the customer managed key in AWS KMS, which rotates the backing key material annually while keeping the key ID and ARN unchanged.

Enabling automatic key rotation for the customer managed key in AWS KMS automatically generates new backing key material every year. Because the key ID, ARN, and key policies remain unchanged, applications can continue to use the key without modifications. Historical backing key material is retained by AWS KMS, meaning existing snapshots encrypted with the old backing key material can still be decrypted and restored automatically without needing manual re-encryption.

Step-by-Step Solution

Analyze the encryption requirements.

The requirement states that the customer managed key must be rotated annually with minimal operational overhead, while maintaining the ability to decrypt historical snapshots.

Understanding the core constraints helps filter out solutions that introduce manual overhead or risk data loss.

Evaluate the behavior of AWS KMS automatic key rotation.

Automatic key rotation manages the backing cryptographic material without changing the key ID, ARN, or metadata. Old backing keys remain available for decryption.

This confirms that existing snapshots remain decryptable without any configuration changes or manual key management.

Identify why other configurations fail.

Re-encrypting all snapshots is unnecessary and resource-intensive, deleting old keys makes historical backups unrestorable, and plain Systems Manager parameters expose credentials.

Ensures the selected option adheres to the principles of least privilege, operational efficiency, and data integrity.

Key Concept

AWS KMS Customer Managed Key Automatic Rotation Mechanics

Question 413Question →

A company stores compliance logs in an Amazon S3 bucket. The logs are encrypted at rest using an AWS KMS Customer Managed Key. The company's security policy dictates that when the KMS key is rotated, all existing historical logs must be immediately re-encrypted under the new key version. Additionally, the log ingestion application requires database credentials that must be rotated every $30$ days. Which combination of steps will meet these security requirements in the most secure manner?

Perform manual key rotation by creating a new customer managed key and updating the S3 bucket configuration. Delete the old customer managed key to ensure no historical logs can be read using the old key material. Store the database credentials in Systems Manager Parameter Store as a SecureString parameter and configure it to rotate every

30

days using an AWS Lambda function.

Enable automatic key rotation for the customer managed key, which automatically schedules a background job to re-encrypt all historical S3 objects with the new key version. Store the database credentials in Systems Manager Parameter Store as a String parameter and write a custom script to rotate the parameter value every

30

days.

Enable automatic key rotation for the customer managed key. Run an Amazon S3 Batch Operations copy job to copy the S3 objects to themselves using the same key to re-encrypt historical data. Store the database credentials in AWS Secrets Manager and configure automatic rotation every

30

days.

Log in as the AWS account root user to manually force rotation of the AWS managed key (aws/s3). Use the AWS CLI to run a script that downloads, decrypts, and re-uploads all historical objects. Store the database credentials as a plaintext parameter in Systems Manager Parameter Store with a lifecycle policy.

Show answer & explanation

Answer: Enable automatic key rotation for the customer managed key. Run an Amazon S3 Batch Operations copy job to copy the S3 objects to themselves using the same key to re-encrypt historical data. Store the database credentials in AWS Secrets Manager and configure automatic rotation every $30$ days.

Answer

30

days.

The correct option correctly configures automatic rotation for the customer managed key, which creates a new key version annually while maintaining historical versions for decryption. To immediately re-encrypt existing objects under the new key version, an S3 Batch Operations copy job copies objects to themselves, applying the active new key material. Finally, it uses AWS Secrets Manager, which natively and securely manages database credential storage and automatic rotation.

Step-by-Step Solution

Enable KMS Key Rotation

Automatic rotation is enabled, meaning AWS KMS will generate a new key version annually for new encryption operations while keeping the old key version active for decrypting existing data.

This complies with security policies requiring rotated keys for new data without manually updating application settings or key ARNs.

Re-encrypt Historical Data

Run an Amazon S3 Batch Operations copy job that copies S3 objects to themselves using the existing KMS key alias.

Because AWS S3 copy operations write objects as new writes, they are encrypted using the currently active version of the KMS key, satisfying the requirement to immediately re-encrypt historical data under the new key version.

Configure Secure Credentials Storage and Rotation

Deploy AWS Secrets Manager to hold the database credentials and configure a rotation schedule of

30

days.

AWS Secrets Manager natively integrates with database credentials to orchestrate rotation via Lambda and secures secrets at rest, unlike plaintext parameter configurations.

Key Concept

AWS KMS key rotation behavior combined with S3 Batch Operations copy actions for historical data re-encryption, and native secret management via AWS Secrets Manager.

Estimated Time:2m 30s

Question 414Question →

A municipal utility enterprise is deploying a new smart-metering application on AWS that must integrate with their existing on-premises Microsoft Active Directory. The enterprise plans to run Active Directory-aware application servers on Amazon EC2 instances in a VPC. The application must authenticate corporate users and domain-join the EC2 instances. The enterprise wants to minimize operational overhead, prevent any replication of Active Directory data to the cloud, and avoid setting up a trust relationship. Which solution meets these requirements with the least operational complexity?

Deploy AWS Managed Microsoft AD in the VPC, and establish a two-way forest trust relationship with the on-premises Microsoft Active Directory.

Use AWS Directory Service AD Connector to connect to the on-premises Active Directory, and use it to domain-join the EC2 instances and authenticate users.

Create individual IAM users in the AWS account for all corporate users, and configure a custom synchronization server on EC2 to replicate user credentials from the on-premises Active Directory.

Use the AWS account root user to generate a single set of long-term access keys, and hardcode these credentials in the application configuration to authenticate all incoming user requests.

Show answer & explanation

Answer: Use AWS Directory Service AD Connector to connect to the on-premises Active Directory, and use it to domain-join the EC2 instances and authenticate users.

Answer

Use AWS Directory Service AD Connector to connect to the on-premises Active Directory, and use it to domain-join the EC2 instances and authenticate users.

Using AWS Directory Service AD Connector meets all the requirements. AD Connector is a directory gateway that redirects directory requests to the on-premises Active Directory without caching or replicating any data in the cloud, and it does not require establishing a trust relationship. This minimizes operational complexity while satisfying the domain-join and user authentication needs.

Step-by-Step Solution

Analyze the requirements for Active Directory integration on AWS EC2 instances.

The requirements demand domain-joining EC2 instances and authenticating users using on-premises Microsoft Active Directory credentials without establishing trust relationships or replicating directory data.

This narrows down the Directory Service options to those that function as a proxy or directory gateway.

Evaluate the capabilities of AD Connector versus AWS Managed Microsoft AD.

AWS Managed Microsoft AD requires establishing a trust relationship and replicates directory records, whereas AD Connector acts as a pure directory gateway (proxy) redirecting requests to the on-premises Active Directory without caching or trust requirements.

This aligns with the enterprise's goal of avoiding data replication and trust relationships while minimizing operational overhead.

Select the option that configures AD Connector to domain-join instances and authenticate users.

The correct option is identified as using AWS Directory Service AD Connector.

It fulfills all technical and business constraints with the lowest operational complexity.

Key Concept

AWS Directory Service AD Connector serves as a directory gateway to redirect requests to an on-premises Active Directory without caching data or requiring trust relationships.

Estimated Time:2m 0s

Question 415Question →

A company is designing a secure multi-account architecture on AWS. Applications running on Amazon EC2 instances in Account A must write encrypted logs to an Amazon S3 bucket located in Account B. The logs must be encrypted at rest using an AWS KMS customer managed key owned by Account B. The security team needs to configure the required permissions to allow the applications to perform cryptographic operations and upload the logs securely. Which combination of configuration steps will meet these requirements? (Select TWO.)

Select all that apply

In the destination account (Account B), configure the KMS key policy to grant the source account (Account A) permission to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions.

In the source account (Account A), attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions on the KMS key ARN in Account B.

In the destination account (Account B), grant administrative control of the KMS key directly to the AWS account root user of the source account (Account A) to manage cryptographic permissions, violating least privilege.

In the destination account (Account B), enable automatic key rotation for the KMS customer managed key, expecting AWS to immediately decrypt and re-encrypt all existing historical S3 objects using the new key version.

In the source account (Account A), configure the application to store the database credentials and KMS keys as plaintext String parameters in Systems Manager Parameter Store for direct retrieval by the application instances.

Show answer & explanation

Answer: In the destination account (Account B), configure the KMS key policy to grant the source account (Account A) permission to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions.; In the source account (Account A), attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions on the KMS key ARN in Account B.

Answer

In Account B, configure the KMS key policy to grant the source account permissions for the cryptographic actions, and in Account A, attach an IAM policy to the application role granting permissions on the target KMS key ARN.

For cross-account access to AWS KMS customer managed keys, permissions must be explicitly declared on both sides. First, the key policy in the destination account must permit the source account's root user or the specific IAM principal to access the key. Second, the source account's IAM role must have an identity-based policy that explicitly grants permission to use the external key ARN for the necessary operations.

Step-by-Step Solution

Analyze cross-account KMS authorization flow.

Identify that cross-account access to a customer managed key requires permissions to be granted in both the resource-based policy (KMS key policy) and the identity-based policy (IAM policy).

AWS evaluates both policies for cross-account KMS requests, and both must explicitly allow the action.

Configure destination account resources.

Modify the KMS key policy in Account B to include Account A in the Principal block and allow the necessary cryptographic operations.

This establishes trust and delegates authorization decisions to Account A.

Configure source account identities.

Attach an IAM policy to the EC2 instance role in Account A specifying the target KMS key ARN and the cryptographic actions.

This authorizes the EC2 instances to request data keys from the external KMS key.

Key Concept

Cross-account AWS KMS authorization requires matching policies in both the resource owner account and the caller identity account.

Question 416Question →

A media streaming company is migrating its operations to AWS and setting up a multi-account environment managed by AWS Organizations. The company's developers need single sign-on (SSO) access to the AWS Management Console. The company maintains an on-premises Microsoft Active Directory to manage developer identities. The solution must minimize operational overhead, avoid the replication of Active Directory passwords to the AWS Cloud, and leverage existing Active Directory group memberships to control access permissions.

Which solution should a solutions architect recommend to meet these requirements?

Manually create individual IAM users with long-term credentials in each AWS account for all developers, and run a daily cron job to sync credentials from the on-premises Active Directory.

Configure AWS IAM Identity Center, connect it to the on-premises Active Directory using AWS Directory Service AD Connector, and map the Active Directory groups to permission sets in IAM Identity Center.

Enable SAML 2.0 federation directly on the AWS account root user of the management account, and share the root credentials with developers to manage resources across all member accounts.

Deploy a custom synchronization application on Amazon EC2 that queries the on-premises Active Directory to create matching IAM users, and store the Active Directory service account password as a plaintext parameter in AWS Systems Manager Parameter Store.

Show answer & explanation

Answer: Configure AWS IAM Identity Center, connect it to the on-premises Active Directory using AWS Directory Service AD Connector, and map the Active Directory groups to permission sets in IAM Identity Center.

Answer

Configuring AWS IAM Identity Center with AWS Directory Service AD Connector is the most efficient design to achieve single sign-on for on-premises Active Directory users in a multi-account environment. AD Connector acts as a directory gateway to forward authentication requests to the on-premises AD without replicating passwords to the AWS Cloud. Mapping AD groups to permission sets in IAM Identity Center ensures access control is centrally managed and leverages existing directory structures, minimizing operational overhead.

Step-by-Step Solution

Assess the need for centralized single sign-on (SSO) and minimal overhead in a multi-account setup.

Identify AWS IAM Identity Center as the recommended AWS service for centralized multi-account access.

AWS IAM Identity Center simplifies SSO access across AWS accounts and integrates with external identity providers.

Determine the directory integration method that avoids password replication and minimizes infrastructure management.

Choose AWS Directory Service AD Connector to redirect authentication requests to the on-premises Active Directory.

AD Connector acts as a directory gateway, proxying authentication requests without caching or replicating AD passwords in AWS.

Assign permissions based on existing on-premises groups.

Map Active Directory groups to permission sets in IAM Identity Center.

This leverages existing group structures to assign permissions to users dynamically as they authenticate, avoiding manual credential management.

Key Concept

Centralized multi-account access using AWS IAM Identity Center and AD Connector to federate with on-premises Active Directory without password replication.

Question 417Question →

A logistics company is deploying a fleet of Amazon EC2 instances in private subnets within a VPC. These instances must upload high volumes of archived tracking logs directly to Amazon S3, and communicate with an external shipping carrier's API over HTTPS to update package statuses. The solution must ensure secure connectivity, prevent direct inbound connections from the internet to the EC2 instances, and minimize data transfer costs. Which combination of configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets.

Deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for the internet to the NAT gateway.

Configure a network ACL on the private subnets with a stateful rule that permits inbound traffic on ephemeral ports and outbound HTTPS traffic to the carrier's API.

Route all S3-bound traffic from the private subnets through a NAT gateway deployed in a public subnet to avoid establishing VPC endpoints.

Modify the security group of the EC2 instances in the private subnets to allow inbound traffic on HTTPS port 443 from the external shipping carrier's API endpoints.

Show answer & explanation

Answer: Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets.; Deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for the internet to the NAT gateway.

Answer

Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets, and deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for the internet to the NAT gateway.

The solution requires secure, cost-effective egress. Deploying a Gateway VPC endpoint for Amazon S3 establishes a secure, private connection to S3 that avoids the internet and NAT Gateway charges. A NAT gateway in a public subnet enables private EC2 instances to securely establish outbound-only communication with the external shipping carrier's API over the internet.

Step-by-Step Solution

Analyze the requirements for accessing Amazon S3 and the external shipping API from the private EC2 instances.

The S3 connection involves high-volume archived tracking logs. The external carrier API connection involves outbound-initiated HTTPS requests to the internet.

This helps identify the most cost-effective and secure routing mechanism for each target.

Select the optimal connectivity method for S3 to avoid high data transfer charges.

A Gateway VPC endpoint is chosen because it routes S3 traffic privately within AWS and is free of charge.

Routing S3 traffic through a NAT gateway incurs per-GB data processing charges, which is not cost-effective.

Select the optimal connectivity method for the external carrier's API on the internet.

A NAT gateway deployed in a public subnet is chosen, with private route tables updated to route 0.0.0.0/0 traffic to the NAT gateway.

NAT gateways allow instances in private subnets to initiate outbound-only communication to the internet while keeping them protected from inbound internet traffic.

Key Concept

VPC Network Security and Cost Optimization

Question 418Question →

A real estate property management firm is migrating its internal operations to a multi-account AWS environment. The firm currently manages its 300 agents and administrative staff using an on-premises Microsoft Active Directory. A solutions architect must design a security architecture that allows these employees to log in to the AWS Management Console to manage resources across multiple AWS accounts. The solution must allow the employees to use their existing Active Directory credentials, enforce the organization's existing multi-factor authentication (MFA) policies, and minimize the administrative overhead of managing identities. Which solution should the solutions architect recommend to meet these requirements?

Create individual IAM users in each AWS account for the 300 employees, and write a script to continuously synchronize password hashes from the on-premises Active Directory.

Enable AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Grant access to the AWS accounts using IAM Identity Center permission sets.

Use the AWS account root user to create a centralized IAM group in the management account, assign the required permissions to the group, and distribute the root credentials to the directory administrators to manage user access.

Deploy AWS Directory Service for Microsoft Active Directory in the cloud, establish a two-way forest trust, and configure the on-premises user directories to generate long-term AWS access keys for each employee.

Show answer & explanation

Answer: Enable AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Grant access to the AWS accounts using IAM Identity Center permission sets.

Answer

Enable AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Grant access to the AWS accounts using IAM Identity Center permission sets.

The correct answer is the option to enable AWS IAM Identity Center and connect it to the on-premises Active Directory using an AD Connector. This approach allows users to authenticate to the AWS Management Console using their existing corporate credentials without duplicating directory identities in AWS. AWS IAM Identity Center supports centralized management of permission sets and assigns AWS IAM roles to users when they log in, fulfilling all business and security requirements with the lowest operational overhead.

Step-by-Step Solution

Deploy AWS Directory Service AD Connector to establish a directory gateway with the on-premises Active Directory.

Authentication requests can be forwarded securely from AWS to the on-premises Active Directory without replicating directory data.

This bridges the on-premises directory and AWS services without local database synchronization overhead.

Enable AWS IAM Identity Center in the Organization's management account and configure the identity source to use the Active Directory via the AD Connector.

Users in the on-premises Active Directory can now be mapped directly to AWS IAM Identity Center and authenticate using their existing credentials and MFA.

This integrates the enterprise identity provider into AWS for single sign-on capabilities.

Create permission sets in AWS IAM Identity Center and associate them with Active Directory groups and AWS accounts.

Agents and administrative staff gain federated access to their respective AWS accounts with the correct permissions when logging in through the AWS access portal.

This implements role-based access control and minimizes administrative management overhead across a multi-account structure.

Key Concept

Centralized identity federation using AWS IAM Identity Center and AD Connector to integrate on-premises Active Directory without credential duplication.

Estimated Time:2m 0s

Question 419Question →

An application running on Amazon EC2 instances in AWS Account A needs to read encrypted payload logs from an Amazon S3 bucket located in AWS Account B. The security team requires that the S3 bucket use Server-Side Encryption with AWS KMS customer managed keys (SSE-KMS) and that the key undergoes annual rotation. Additionally, the configuration must allow the EC2 application role in Account A to decrypt the files while preventing the historical log files from needing manual re-encryption. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure the KMS key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform the kms:Decrypt action, and grant kms:Decrypt permissions to the IAM role in Account A.

Enable automatic key rotation for the customer managed key in Account B, which automatically rotates the backing key material annually while retaining previous versions to decrypt existing logs.

Manually rotate the KMS key in Account B annually by creating a new key, and execute an S3 Batch Operations job to re-encrypt all historical logs with the new key version.

Configure the EC2 application in Account A to authenticate using IAM user access keys that are stored as a plaintext String parameter in AWS Systems Manager Parameter Store.

Use Account B's root user credentials on the EC2 instances in Account A to perform all log decryption tasks, bypassing cross-account KMS key policy configurations.

Show answer & explanation

Answer: Configure the KMS key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform the kms:Decrypt action, and grant kms:Decrypt permissions to the IAM role in Account A.; Enable automatic key rotation for the customer managed key in Account B, which automatically rotates the backing key material annually while retaining previous versions to decrypt existing logs.

Answer

Configure the KMS key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform the kms:Decrypt action, grant kms:Decrypt permissions to the IAM role in Account A, and enable automatic key rotation for the customer managed key in Account B.

To grant an EC2 instance in Account A access to a KMS key in Account B, both the key policy in Account B must permit the IAM role in Account A, and the IAM role in Account A must have permissions to decrypt. In addition, enabling automatic key rotation handles key rotation seamlessly because AWS KMS keeps older versions of backing keys available for decrypting historical data, preventing the need for manual re-encryption.

Step-by-Step Solution

Configure cross-account KMS permissions.

The key policy in Account B is updated to delegate permission to the IAM role in Account A, and the IAM role in Account A is granted permission to use the key.

For cross-account access, permissions must be granted in both the resource's key policy and the consumer's IAM policy.

Enable automatic key rotation on the customer managed key in Account B.

The key automatically rotates its backing material annually without affecting historical data.

AWS KMS automatic key rotation keeps previous versions of the backing key active for decryption, meaning existing logs do not need to be manually re-encrypted.

Key Concept

Cross-account KMS key policies and automatic key rotation mechanics

Estimated Time:2m 0s

Question 420Question →

An energy utility provider runs a smart grid monitoring application on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones in the us-east-1 Region. The application requires a shared, POSIX-compliant file system to store active telemetry logs. Additionally, raw historical log files must be archived to a highly durable object store.

The provider wants to establish a disaster recovery (DR) architecture in the us-west-2 Region with a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 15 minutes for both active logs and historical archives. Historical archives must be accessible within minutes during a DR event.

Which two configurations should the solutions architect implement to meet these requirements?

Select all that apply

Configure Amazon EFS replication to automatically replicate the shared file system from us-east-1 to us-west-2.

Store raw historical logs in an Amazon S3 bucket in us-east-1, and configure Cross-Region Replication (CRR) with S3 Replication Time Control (S3 RTC) enabled to a destination bucket in us-west-2.

Store raw historical logs in Amazon S3, and configure a replication rule to copy the objects to a destination bucket in us-west-2 with the S3 Glacier Flexible Retrieval storage class.

Migrate the shared telemetry logs to an Amazon RDS Multi-AZ DB instance in us-east-1, and configure a cross-region Read Replica in us-west-2 to act as the automated, zero-administrative failover endpoint.

Implement a Pilot Light disaster recovery strategy by creating daily Amazon Machine Images (AMIs) of the EC2 instances and daily backups of the shared storage, copying them to us-west-2, and restoring them during a failover event.

Show answer & explanation

Answer: Configure Amazon EFS replication to automatically replicate the shared file system from us-east-1 to us-west-2.; Store raw historical logs in an Amazon S3 bucket in us-east-1, and configure Cross-Region Replication (CRR) with S3 Replication Time Control (S3 RTC) enabled to a destination bucket in us-west-2.

Answer

Configure Amazon EFS replication to automatically replicate the shared file system from us-east-1 to us-west-2, and store raw historical logs in an Amazon S3 bucket in us-east-1, configuring Cross-Region Replication (CRR) with S3 Replication Time Control (S3 RTC) enabled to a destination bucket in us-west-2.

To satisfy a POSIX-compliant shared file system requirement with a 15-minute RTO and RPO in a secondary region, Amazon EFS replication is the correct choice because it automatically and continuously replicates changes to the destination region within minutes. To satisfy the raw historical logs archiving requirement with a 15-minute RPO, Amazon S3 Cross-Region Replication with S3 Replication Time Control (S3 RTC) is the correct choice because it provides a service level agreement (SLA) to replicate 99.9% of objects within 15 minutes, and storing them in standard S3 buckets ensures they are immediately accessible during a failover event.

Step-by-Step Solution

Analyze the file system requirement and RTO/RPO limits.

The application requires a POSIX-compliant shared file system. Amazon EFS provides this capability for EC2 instances. To meet the 15-minute RTO and RPO in the us-west-2 DR region, Amazon EFS replication is required as it replicates data within minutes.

Identify the primary storage service that supports shared POSIX access and cross-region replication within minutes.

Analyze the historical log archiving requirement and RTO/RPO limits.

Historical logs must be stored in a highly durable object store (Amazon S3). To meet the 15-minute RPO, S3 Cross-Region Replication (CRR) with Replication Time Control (S3 RTC) must be configured, which guarantees replication of 99.9% of objects within 15 minutes. To meet the 15-minute RTO, the target storage class must allow rapid access (milliseconds/minutes).

Identify the object storage replication and retrieval configuration that satisfies the RTO and RPO criteria.

Evaluate and eliminate incorrect architectures.

Using S3 Glacier Flexible Retrieval for replicated archives introduces retrieval delays of 3-5 hours, violating the RTO. Daily backups (Pilot Light) violate the 15-minute RPO. Relying on RDS Read Replicas does not solve the shared file system requirement and lacks automated cross-region failover.

Ensure all other options are eliminated based on AWS service limitations and scenario constraints.

Key Concept

Designing highly available, multi-region storage systems using EFS Replication and S3 Replication Time Control (RTC) to meet strict RTO and RPO requirements.

PreviousPage 21 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution