Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 501Question →

A logistics company is designing the database tier for a new tracking application. The workload consists of two distinct tables:

1. A metadata store that receives a predictable, steady volume of updates throughout the day, averaging 500500 writes per second and rarely exceeding 600600 writes per second.
2. A tracking portal that experiences sudden, highly unpredictable spikes in read traffic during promotional events, scaling rapidly from 1010 reads per second to over 15,00015,000 reads per second.

To design a cost-optimized solution that guarantees performance, which two capacity planning configurations should a solutions architect recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the metadata store table to use provisioned capacity mode with Auto Scaling enabled.; Configure the tracking portal table to use on-demand capacity mode.

Answer

Configure the metadata store table to use provisioned capacity mode with Auto Scaling enabled, and configure the tracking portal table to use on-demand capacity mode.
For the metadata store, the steady and predictable write rate of 500500 to 600600 writes per second is most cost-effectively handled using provisioned capacity with Auto Scaling, which charges a lower rate per unit of capacity. For the tracking portal, the sudden and unpredictable spikes up to 15,00015,000 reads per second are best handled by on-demand capacity mode. This prevents throttling during bursts and avoids paying for idle capacity during normal hours, resulting in a lower total cost.

Step-by-Step Solution

1
Analyze the workload characteristics of the metadata store.
The metadata store has a predictable, steady baseline of 500500 to 600600 writes per second.
Identifying the traffic patterns helps choose between provisioned and on-demand capacity modes.
2
Determine the cost-optimal capacity mode for the metadata store.
Provisioned capacity mode with Auto Scaling is chosen.
For a steady-state workload, provisioned capacity is significantly cheaper per request than on-demand capacity.
3
Analyze the workload characteristics of the tracking portal.
The tracking portal has extremely spiky and unpredictable read traffic, surging from 1010 to 15,00015,000 reads per second.
Sudden surges can cause throttling if scaling is not fast enough, or high costs if capacity is over-provisioned.
4
Determine the cost-optimal capacity mode for the tracking portal.
On-demand capacity mode is chosen.
On-demand capacity handles sudden, rapid spikes instantly without throttling and scales down to zero cost when idle.
5
Evaluate purchasing options and discounts.
Compute Savings Plans are ruled out for DynamoDB.
Compute Savings Plans do not apply to DynamoDB capacity costs, so other discount mechanisms (like DynamoDB Reserved Capacity) must be considered for the provisioned table if applicable.

Key Concept

Selecting between DynamoDB Provisioned Capacity (with Auto Scaling) and On-Demand Capacity based on workload predictability and spikiness to optimize costs.
Estimated Time:1m 30s
Question 502Question →

A retail company is launching a high-traffic flash sale website. The application requirements specify:
- Highly unpredictable read traffic spikes for the product catalog requiring sub-millisecond latency.
- High-volume write traffic for customer order processing that exhibits sudden, massive spikes, where write throttling must be avoided.
- A requirement to maintain high availability and performance during database failover events.

Which two strategies should the solutions architect implement to achieve a high-performing and resilient database architecture? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy Amazon DynamoDB Accelerator (DAX) to cache read queries for the product catalog table, reducing read latency to microseconds.; Configure the customer order processing table in Amazon DynamoDB with On-Demand capacity mode to automatically handle sudden write spikes without manual provisioning.

Answer

Deploy Amazon DynamoDB Accelerator (DAX) to cache read queries for the product catalog table, and configure the customer order processing table with On-Demand capacity mode to scale writes automatically.
To meet the performance goals, the solutions architect should implement Amazon DynamoDB Accelerator (DAX) and DynamoDB On-Demand capacity mode. DAX serves read requests from cache with microsecond latency, satisfying the sub-millisecond catalog query requirement. On-Demand capacity mode handles unpredictable write traffic spikes instantly without manual intervention or throttling, ensuring orders are processed successfully during peak flash sale moments.

Step-by-Step Solution

1
Analyze read latency and traffic patterns for the product catalog.
Identify that the catalog has highly unpredictable read spikes requiring sub-millisecond response times, indicating a need for an in-memory cache like DAX.
DAX provides microsecond latency and offloads read pressure from the database table.
2
Evaluate write scaling requirements for order processing.
Identify that the order table requires rapid scaling to handle sudden, massive spikes without throttling, which indicates On-Demand capacity mode.
On-Demand capacity scales instantly to accommodate sudden peaks, whereas Provisioned Auto Scaling requires time to adjust throughput.
3
Eliminate database configurations that introduce bottlenecks or failover misconceptions.
Discard strategies involving monotonically increasing partition keys (which cause hot partitions) and RDS MySQL replicas for write failover (replicas scale reads, not writes, and do not automate failover in this manner).
Ensures the selected architecture is optimal for both high performance and resiliency.

Key Concept

High-performing database architectures on AWS leverage in-memory caching (DAX) for low-latency read performance and flexible scaling modes (On-Demand capacity) to handle highly unpredictable write traffic spikes.
Estimated Time:2m 0s
Question 503Question →

A solutions architect is designing the database layer for a global IoT tracking system. The system must ingest 60,000 write operations per second with sub-millisecond database response times, and handle 150,000 read operations per second for active trackers. The read traffic is highly repetitive as users frequently check the status of the same package. The write traffic consists of location updates associated with a monotonically increasing batch sequence number. Which database architecture should the solutions architect choose to meet these performance requirements while preventing write throttling and minimizing read latency?

Show answer & explanation

Answer: Use Amazon DynamoDB with a partition key based on a unique tracker ID (UUID) and a sort key of the timestamp, and deploy an Amazon ElastiCache for Redis cluster to offload repetitive read traffic.

Answer

Use Amazon DynamoDB with a partition key based on a unique tracker ID (UUID) and a sort key of the timestamp, and deploy an Amazon ElastiCache for Redis cluster to offload repetitive read traffic.
The correct architecture uses Amazon DynamoDB with a high-cardinality partition key (tracker ID UUID) to distribute writes evenly across partitions and prevent throttling. It also uses an Amazon ElastiCache for Redis cluster to cache highly repetitive read requests, delivering microsecond response times and lowering overall database resource consumption.

Step-by-Step Solution

1
Analyze the access pattern and write volume requirements.
The application requires ingesting 60,000 writes per second, which requires distributing the load across multiple partitions to avoid throttling.
DynamoDB partitions data based on the partition key. A uniform distribution prevents hot partitions.
2
Select the correct partition key strategy for DynamoDB.
Using a unique tracker ID (UUID) ensures high cardinality, while a sequential batch number would concentrate all writes on a single partition key.
Monotonically increasing keys are a well-known anti-pattern that limits throughput to a single partition's maximum capacity.
3
Evaluate read optimization for repetitive queries.
Caching repetitive reads using ElastiCache for Redis offloads the traffic from the database layer, offering microsecond response times.
Caching repetitive reads protects the primary database from read scaling bottlenecks and reduces operational costs.

Key Concept

Partition key cardinality and caching strategies for high-throughput database workloads.
Question 504Question →

A startup is developing a mobile application to track real-time delivery status updates. The application experiences highly unpredictable spikes in usage, reaching up to 5,000 writes per second5,000\text{ writes per second} during lunch and dinner hours, and dropping to near zero overnight. The data structure is simple key-value pairs representing the delivery ID and its status. The startup has a strict budget and wants to minimize operational and storage costs while preventing database throttling. Which database configuration meets these requirements most cost-effectively?

Show answer & explanation

Answer: Amazon DynamoDB configured in On-Demand capacity mode.

Answer

Amazon DynamoDB configured in On-Demand capacity mode.
The correct option is the choice stating that DynamoDB should be configured in On-Demand capacity mode. This mode is the most cost-effective solution for workloads that are highly unpredictable, experience sudden spikes, and have long idle periods. With on-demand capacity, the startup pays only for the read and write requests actually executed. It scales up or down instantly to handle spikes up to the table's previous peak traffic, completely avoiding throttling without the need to overprovision capacity.

Step-by-Step Solution

1
Analyze the application workload characteristics and data structure.
The workload is highly unpredictable with sudden spikes (up to 5,000 writes per second5,000\text{ writes per second}) and long idle periods (near zero writes). The data structure is simple key-value pairs (delivery ID and status).
Identifying the access pattern and load profiles helps narrow down the suitable database engine and capacity planning strategies.
2
Select the database engine.
Amazon DynamoDB is chosen because it is a managed NoSQL database designed for key-value storage with low latency and high scalability.
Using a relational database like RDS for a simple key-value workload is operationally complex and less cost-effective.
3
Determine the cost-optimal capacity mode.
On-Demand capacity mode is selected.
On-demand capacity mode handles sudden, unpredictable spikes instantly without throttling and charges only for actual usage, making it much more cost-effective than provisioning for the peak or waiting for auto-scaling to react.

Key Concept

Matching database capacity scaling modes to unpredictable, spiky workloads to optimize costs.
Question 505Question →

A company hosts a high-traffic web application on Amazon EC2 instances inside a private subnet. The instances are managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). After the security team updated the network access control list (Network ACL) of the private subnet to restrict inbound traffic to only port 80, the ALB target group health checks began failing, marking all EC2 instances as unhealthy and resulting in HTTP 502 Bad Gateway errors. The security groups associated with the EC2 instances allow all inbound traffic from the ALB. Which configuration change will resolve this issue and restore application availability?

Show answer & explanation

Answer: Add an outbound rule to the private subnet Network ACL allowing TCP traffic to the ALB subnet on ephemeral ports 1024−655351024 - 65535.

Answer

Add an outbound rule to the private subnet Network ACL allowing TCP traffic to the ALB subnet on ephemeral ports 1024−655351024 - 65535.
The correct option is correct because Network ACLs are stateless, meaning that outbound return traffic must be explicitly allowed. When the ALB sends a health check request to the EC2 instances on port 80, the return traffic from the instances back to the ALB is sent on an ephemeral port (1024−655351024 - 65535). Because the Network ACL only has an inbound rule for port 80 and no outbound rule for ephemeral ports, the return traffic is blocked, causing the health checks to fail. Adding an outbound rule for the ephemeral ports resolves the issue.

Step-by-Step Solution

1
Identify the impact of the Network ACL change on the network path between the Application Load Balancer (ALB) and the Amazon EC2 instances.
The Network ACL blocks all outbound return traffic from the EC2 instances to the ALB because Network ACLs are stateless, and only inbound traffic on port 80 was allowed.
Understanding the stateless nature of Network ACLs helps diagnose why healthy instances are marked unhealthy when inbound rules are tightened without considering outbound return paths.
2
Analyze the port requirements for the return traffic from the EC2 instances to the ALB.
Return traffic initiated by an inbound request on port 80 is sent back to the client (ALB) on ephemeral ports, which typically range from 10241024 to 6553565535.
The stateless Network ACL must explicitly permit outbound traffic on the ephemeral port range to allow the HTTP response to reach the ALB.
3
Formulate the correction to the Network ACL configuration.
Add an outbound rule to the private subnet's Network ACL allowing TCP traffic to the ALB's subnet on ports 1024−655351024 - 65535.
This allows the response of the health checks to successfully return to the ALB, allowing the targets to be marked as healthy and restoring service.

Key Concept

Stateless Network ACLs require explicit configuration of outbound return traffic paths, which utilize ephemeral ports.
Estimated Time:2m 0s
Question 506Question →

A digital ticketing platform handles concert ticket purchases and cancellations. The transaction details must be processed in the exact sequence they are generated to ensure seat availability is calculated accurately. During ticket sales for major events, the portal experiences massive surges in traffic that overwhelm the backend database. A solutions architect needs to decouple the portal from the transaction processing backend to buffer traffic spikes while maintaining strict transaction order. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Send the transaction updates to an Amazon SQS FIFO queue. Configure an AWS Lambda function to process the messages, using the concert ID as the Message Group ID to ensure sequential processing of transactions for each concert.

Answer

Send the transaction updates to an Amazon SQS FIFO queue, and configure an AWS Lambda function to process the messages, using the concert ID as the Message Group ID to ensure sequential processing of transactions for each concert.
The correct solution uses an Amazon SQS FIFO queue to decouple the ticketing portal from the database. SQS FIFO queues ensure first-in, first-out delivery. By setting the concert ID as the Message Group ID, all transactions relating to the same concert are processed in the order they occurred. Using an AWS Lambda function integrated as the event source represents the lowest operational overhead option, as AWS manages the polling infrastructure.

Step-by-Step Solution

1
Analyze the requirement for message ordering and traffic buffering.
The platform needs a buffer to absorb spikes in transactional traffic and must process updates chronologically per concert.
This indicates that a FIFO queueing mechanism is required to decouple the application layers.
2
Select the appropriate queuing service and configuration.
Amazon SQS FIFO is selected because it guarantees strict ordering and deduplication.
SQS standard queues cannot be used because they do not guarantee message order.
3
Determine the message grouping strategy.
Use the concert ID as the Message Group ID.
This guarantees that transactions for the same concert are processed sequentially, while transactions for different concerts can be scaled and processed in parallel.
4
Identify the low-overhead consumer mechanism.
Configure AWS Lambda to poll the queue natively as an event source.
Lambda automatically handles integration, polling, and scaling with minimal operational management.

Key Concept

Decoupling message flows with order preservation using Amazon SQS FIFO queues and AWS Lambda.
Question 507Question →

A smart home security company is designing an event-driven system to process status logs from connected smart hubs (e.g., alarm armed, sensor triggered, door unlocked). To ensure the correct application logic, the status logs for each individual home must be processed in the precise order they are generated. The logs must be fanned out to both a real-time alerting service and a secondary database ingestion worker. The architecture must be decoupled, scalable, and minimize operational overhead.

Which combination of services and configurations should a solutions architect use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic to ingest the smart hub status logs and publish them to downstream subscribers.; Create Amazon SQS FIFO queues for the alerting service and the database ingestion worker, subscribing both queues to the SNS topic.

Answer

Create an Amazon SNS FIFO topic to ingest the smart hub status logs, and create Amazon SQS FIFO queues for the alerting service and database worker subscribed to the SNS FIFO topic.
To preserve ordering during event ingestion and distribution, Amazon SNS FIFO must be paired with Amazon SQS FIFO queues. An SNS FIFO topic ensures that message ordering is maintained when fanning out. SQS FIFO queues then receive these ordered messages and guarantee first-in, first-out processing for each downstream consumer independently.

Step-by-Step Solution

1
Select a message ordering mechanism that supports publishing and pub/sub routing.
Amazon SNS FIFO is chosen to ingest logs while preserving message sequencing.
We must fan out status updates to multiple downstream destinations while preserving the exact order per smart home.
2
Select a message buffering mechanism for the downstream processing services that maintains order.
Amazon SQS FIFO queues are selected for each downstream consumer.
Downstream workers require buffer queues to prevent data loss, and FIFO queues ensure that the message sequence is preserved through processing.
3
Subscribe the SQS FIFO queues to the SNS FIFO topic.
A fully decoupled pub/sub message delivery system that guarantees strict ordering and message deduplication.
By connecting SQS FIFO queues to the SNS FIFO topic, both consumers get a complete, ordered copy of each status log message independently.

Key Concept

Using Amazon SNS FIFO and Amazon SQS FIFO queues together enables decoupled, fan-out messaging architectures that guarantee strict first-in, first-out (FIFO) ordering and deduplication.
Question 508Question →

A global media streaming platform uses Amazon Route 53 for DNS, Amazon CloudFront for content delivery, and an Application Load Balancer (ALB) backing an Auto Scaling group of Amazon EC2 instances. During peak events, the platform is frequently targeted by HTTP flood attacks (Layer 7) that cause the EC2 Auto Scaling group to scale out unnecessarily, resulting in high costs. Additionally, DNS query floods have recently threatened the availability of their DNS services. The platform requires a solution that automatically mitigates both Layer 7 and DNS-level DDoS attacks, provides real-time visibility into attacks, and offers financial protection against scaling costs incurred due to DDoS-related traffic spikes. Which solution will meet these requirements with the least administrative effort?

Show answer & explanation

Answer: Subscribe to AWS Shield Advanced. Associate Shield Advanced with the Route 53 hosted zones, CloudFront distributions, and the ALB. Enable AWS WAF on the CloudFront distributions, configure rate-based rules, and enable Shield Advanced automatic application-layer DDoS mitigation.

Answer

Subscribe to AWS Shield Advanced, associate it with the Route 53 hosted zones, CloudFront distributions, and the Application Load Balancer, enable AWS WAF on CloudFront with rate-based rules, and enable automatic application-layer DDoS mitigation.
The correct solution uses AWS Shield Advanced associated with Amazon Route 53, Amazon CloudFront, and the Application Load Balancer. Shield Advanced protects Route 53 against DNS query floods, and when coupled with AWS WAF, it automatically creates rules to mitigate Layer 7 HTTP flood attacks. Additionally, Shield Advanced includes DDoS cost protection, which provides service credits for scaling costs (such as ALB and EC2 Auto Scaling charges) caused by DDoS attacks, meeting all requirements with minimal administrative overhead.

Step-by-Step Solution

1
Identify the requirements for Layer 7 HTTP flood protection, DNS query flood protection, and cost protection.
Determine that AWS Shield Advanced is required because AWS Shield Standard does not provide cost protection or DNS/L7 automatic mitigation.
AWS Shield Advanced offers financial protection for scaling costs and native integration with Route 53 and CloudFront/ALB.
2
Select the resources to protect with AWS Shield Advanced.
Associate Shield Advanced with Route 53 hosted zones (for DNS query floods), CloudFront distributions, and the ALB.
This establishes DDoS protection at both the DNS routing layer and the content delivery/load balancing layers.
3
Configure application-layer (Layer 7) defenses using AWS WAF and Shield Advanced features.
Enable AWS WAF on CloudFront and configure rate-based rules, and turn on the automatic application-layer DDoS mitigation feature of Shield Advanced.
This automatically creates and deploys AWS WAF rules when a Layer 7 DDoS attack is detected, preventing origin overload and unnecessary scaling.

Key Concept

AWS Shield Advanced protects Route 53, CloudFront, and ALB against sophisticated Layer 3/4 and Layer 7 DDoS attacks, provides automatic L7 mitigation via AWS WAF, and offers cost protection for scaling resources during an attack.
Estimated Time:3m 0s
Question 509Question →

A global e-commerce company hosts its web application on Amazon EC2 instances behind an Application Load Balancer (ALB), utilizing Amazon CloudFront for content delivery. During a promotional event, the security team identifies a massive spike in HTTP POST requests targeting the `/login` endpoint from a distributed botnet. This Layer 7 traffic is bypassing cache and exhausting the compute capacity of the origin EC2 instances. The company needs to detect and block this application-layer attack at the edge before it reaches the backend infrastructure. Which solution should a solutions architect recommend?

Show answer & explanation

Answer: Deploy AWS WAF on the Amazon CloudFront distribution and configure a rate-based rule targeting the `/login` path

Answer

Deploy AWS WAF on the Amazon CloudFront distribution and configure a rate-based rule targeting the `/login` path
The correct solution is to deploy AWS WAF on the Amazon CloudFront distribution and create a rate-based rule for the `/login` path. AWS WAF operates at Layer 7 and is integrated with CloudFront at the AWS edge, allowing it to inspect HTTP/HTTPS request details like the request method (POST) and URI path. A rate-based rule tracks the number of requests originating from each IP address and blocks them once they exceed a defined threshold, effectively neutralizing the distributed botnet flood before the traffic reaches the backend ALB or EC2 origin.

Step-by-Step Solution

1
Analyze the attack vector and identify the target layer.
The attack consists of HTTP POST requests targeting a specific path (`/login`), which is a Layer 7 (application-layer) exploit bypassing cache.
This determines that network-level controls (Layer 3/4) alone will not suffice, and an application-aware firewall is required.
2
Select the appropriate AWS security service for edge protection.
Amazon CloudFront integrated with AWS WAF is chosen because AWS WAF inspects Layer 7 traffic and is deployed at the Edge locations.
Deploying the security control at the edge prevents malicious traffic from consuming bandwidth or compute resources at the origin ALB and EC2 layers.
3
Configure the detection and mitigation rule.
Create an AWS WAF rate-based rule that monitors requests to the `/login` URI path, blocking clients that exceed the specified request limit.
Rate-based rules automatically mitigate HTTP floods from distributed sources targeting specific high-load application endpoints.

Key Concept

Edge protection against Layer 7 application DDoS attacks using AWS WAF and Amazon CloudFront
Estimated Time:1m 30s
Question 510Question →

A solutions architect is designing a secure architecture for a web application. The application tier runs on Amazon EC2 instances and must access a database hosted on Amazon RDS. The database credentials must be encrypted at rest, and the security team requires that these credentials be rotated automatically every 30 days. In addition, the company's internal developers, who are authenticated via corporate Active Directory, need temporary administrative access to the AWS Management Console to manage the RDS instances. Which combination of actions will meet these requirements in the most secure manner?

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Configure AWS IAM Identity Center to federate corporate Active Directory users, allowing them to assume an administrative IAM role.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation. Attach an IAM role to the EC2 instances with permission to retrieve the credentials. Configure AWS IAM Identity Center to federate corporate Active Directory users, allowing them to assume an administrative IAM role.
Storing database credentials in AWS Secrets Manager with automatic rotation ensures that credentials are encrypted at rest and rotated programmatically without application downtime. Attaching an IAM role to the EC2 instances allows them to securely access Secrets Manager using temporary security credentials rather than long-term credentials. Configuring AWS IAM Identity Center to federate corporate Active Directory users allows developers to sign in using their existing corporate credentials and assume an administrative IAM role with temporary credentials, aligning with the principle of least privilege and eliminating the overhead of managing long-term IAM user credentials.

Step-by-Step Solution

1
Store database credentials securely.
Store database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.
This encrypts the credentials at rest using AWS KMS and programmatically rotates them without manual intervention, satisfying database credentials security requirements.
2
Grant application access using IAM roles.
Attach an IAM role to the Amazon EC2 instances with a policy allowing access to the specific secret in AWS Secrets Manager.
This allows the application to dynamically retrieve database credentials using temporary security credentials instead of hardcoding credentials in code or configuration files.
3
Implement identity federation for administrative access.
Configure AWS IAM Identity Center integrated with the corporate Active Directory to allow corporate developers to log in and assume an administrative IAM role.
This eliminates the need to manage individual IAM users for federated corporate employees, ensuring administrative access is controlled, audited, and utilizes short-lived security tokens.

Key Concept

Implementing secure credential management with AWS Secrets Manager and administrative access federation with AWS IAM Identity Center.
Estimated Time:2m 0s
Question 511Question →

A financial company is building a transaction ledger application where users deposit and withdraw funds. The application must process these transaction events in the exact order they occur to prevent incorrect balances. Additionally, a compliance service and an auditing service must both receive a copy of every transaction event in near-real-time. If a transaction fails to process after five attempts, it must be moved to a separate queue for analysis without blocking subsequent transactions.

Which combination of steps should a solutions architect take to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic to receive the transaction events, and subscribe two Amazon SQS FIFO queues to the topic to fan out the events to both the compliance and auditing services.; Configure a redrive policy on each Amazon SQS FIFO queue to send failed transaction events to an Amazon SQS FIFO dead-letter queue (DLQ).

Answer

Create an Amazon SNS FIFO topic to receive the transaction events, subscribe two Amazon SQS FIFO queues to the topic, and configure a redrive policy on each SQS FIFO queue to send failed events to an SQS FIFO dead-letter queue (DLQ).
To process transaction events in strict chronological order and distribute them to multiple independent services, you must use Amazon SNS FIFO combined with Amazon SQS FIFO. SNS FIFO distributes messages in a first-in, first-out order to multiple subscribed SQS FIFO queues. Additionally, to handle processing failures without stalling the entire queue (head-of-line blocking), a redrive policy must be configured on the SQS FIFO queues to send failed messages to an SQS FIFO dead-letter queue (DLQ). This combination ensures both strict ordering and resilient decoupling.

Step-by-Step Solution

1
Select the messaging components that support strict ordering and publish-subscribe fan-out.
Amazon SNS FIFO and Amazon SQS FIFO are selected.
Standard SQS and SNS do not guarantee first-in, first-out (FIFO) ordering. SNS FIFO allows publishing to a single topic and fanning out to multiple SQS FIFO queues while preserving message order.
2
Design the fan-out architecture by subscribing SQS FIFO queues to the SNS FIFO topic.
Two SQS FIFO queues (one for compliance and one for auditing) are subscribed to the SNS FIFO topic.
This decoupled setup ensures both downstream services receive their own copy of all events in the correct sequence without interfering with each other.
3
Implement error handling for failed messages that preserves ordering requirements.
A redrive policy pointing to an SQS FIFO Dead-Letter Queue (DLQ) is configured.
An SQS FIFO queue requires its DLQ to also be a FIFO queue. This allows failed events to be isolated after five attempts without blocking the remaining transaction events in the main queue.

Key Concept

Decoupling event-driven architectures with ordering guarantees using SNS FIFO, SQS FIFO, and FIFO Dead-Letter Queues.
Question 512Question →

A telehealth platform hosts its patient portal application in the us-east-1 Region using Amazon EC2 instances and an Amazon RDS for MySQL DB instance. The company needs to design a pilot light disaster recovery (DR) strategy in the us-west-2 Region. The DR solution must achieve a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours, while minimizing ongoing infrastructure costs. Which solution meets these requirements?

Show answer & explanation

Answer: Configure an Amazon RDS cross-region read replica in the us-west-2 Region. Store the application tier as Amazon Machine Images (AMIs) in us-west-2, and launch the EC2 instances from the AMIs only during a failover event.

Answer

Configure an Amazon RDS cross-region read replica in the us-west-2 Region. Store the application tier as Amazon Machine Images (AMIs) in us-west-2, and launch the EC2 instances from the AMIs only during a failover event.
The correct solution involves configuring an Amazon RDS cross-region read replica in us-west-2 to achieve low-latency asynchronous database replication. This satisfies the 15-minute RPO. By storing the application tier as AMIs in the secondary region and launching the EC2 instances only during a failover event, the solution minimizes ongoing compute costs while allowing the system to be fully provisioned well within the 4-hour RTO. This represents a classic pilot light disaster recovery strategy.

Step-by-Step Solution

1
Analyze RPO requirements.
To meet an RPO of 15 minutes, the database must replicate changes to the secondary region asynchronously with minimal lag. An RDS cross-region read replica provides this continuous, low-latency replication.
Traditional backup methods (like daily snapshots) would result in a recovery point of 12-24 hours, violating the 15-minute RPO constraint.
2
Analyze RTO and cost requirements.
To implement a cost-optimized 'pilot light' environment under a 4-hour RTO, application servers should not run continuously. Instead, keeping AMIs ready in the target region allows rapid deployment during a failover event.
Keeping EC2 instances powered down or unprovisioned minimizes compute costs, while launching them from AMIs takes under 30 minutes, easily fitting within the 4-hour RTO window.
3
Select the optimal disaster recovery configuration.
Combine the RDS cross-region read replica (for database RPO) with stored AMIs (for cost-efficient compute RTO).
This combination exactly satisfies the pilot light pattern: database replication is live (lighted), but compute resources are inactive until failover.

Key Concept

Disaster recovery (DR) strategies involve balancing RTO, RPO, and cost. A pilot light strategy maintains a running database replica to protect data (meeting strict RPOs) while keeping application compute resources idle or stored as AMIs to minimize costs.
Question 513Question →

An enterprise is designing a cross-account data ingestion pipeline. Applications running on Amazon EC2 instances in Account A (111111111111111111111111) must retrieve sensitive log files from an Amazon S3 bucket located in Account B (222222222222222222222222). The EC2 instances run inside an IAM instance profile associated with the IAM role `AppRole`. The S3 bucket in Account B is encrypted with a Customer Managed Key (CMK) in AWS KMS. The company's security policy requires that all cross-account access must utilize temporary credentials, enforce the principle of least privilege, and ensure all data remains encrypted.

Which configuration should the Solutions Architect implement to meet these requirements?

Show answer & explanation

Answer: Configure the S3 bucket policy in Account B to grant s3:GetObject permissions to the IAM role AppRole in Account A. Attach an IAM policy to AppRole in Account A that allows s3:GetObject on the Account B S3 bucket. Configure the KMS key policy in Account B to allow AppRole the kms:Decrypt action, and enable automatic annual key rotation on the KMS key.

Answer

Configure the S3 bucket policy in Account B to grant s3:GetObject permissions to the IAM role AppRole in Account A, attach an IAM policy to AppRole in Account A allowing s3:GetObject, configure the KMS key policy in Account B to allow AppRole the kms:Decrypt action, and enable automatic annual key rotation on the KMS key.
The correct configuration establishes cross-account access using resource-based policies (S3 bucket policy and KMS key policy) to trust the IAM role AppRole in Account A. This allows the application running on the EC2 instances to directly access the bucket using temporary security credentials managed by the EC2 instance profile, conforming to security best practices. Enabling automatic KMS key rotation satisfies the encryption requirement without disrupting access to older objects.

Step-by-Step Solution

1
Configure permissions for the S3 bucket in Account B.
The resource-based S3 bucket policy in Account B allows access to the IAM role in Account A.
For cross-account access, both the IAM policy in the trusting account (Account A) and the resource policy in the trusted account (Account B) must explicitly grant access.
2
Configure the IAM role permissions in Account A.
The identity-based policy attached to AppRole allows it to perform s3:GetObject on the bucket in Account B.
This completes the IAM delegation requirement from the client side.
3
Grant decryption permissions on the KMS key in Account B.
The KMS key policy is modified to allow AppRole in Account A to call kms:Decrypt.
Since the bucket is encrypted with a Customer Managed Key, the caller must have decrypt permissions on the key. KMS key policies must explicitly grant cross-account access, as identity-based policies alone cannot delegate cross-account access without key policy approval.
4
Enable automatic annual key rotation on the KMS key.
AWS KMS will automatically rotate the key annually without affecting current access.
KMS key rotation preserves older key versions so that existing data remains readable without manual re-encryption.

Key Concept

Cross-account resource access using resource-based policies (S3 and KMS) in combination with identity-based IAM policies, while adhering to temporary credential security policies and KMS rotation behaviors.
Estimated Time:2m 30s
Question 514Question →

A software-as-a-service (SaaS) provider hosts its API on Amazon EC2 instances behind an Application Load Balancer (ALB). The API has been experiencing recurring Layer 7 HTTP flood attacks, causing resource exhaustion on the EC2 instances. The provider wants to mitigate these attacks at the AWS network edge before they reach the ALB, without blocking legitimate client requests.

Which solution should a solutions architect recommend?

Show answer & explanation

Answer: Create an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.

Answer

Create an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.
Associating an AWS WAF web ACL with an Amazon CloudFront distribution allows the rate-limiting and filtering of Layer 7 HTTP flood attacks at AWS edge locations, preventing the traffic from reaching the Application Load Balancer and the backend EC2 instances.

Step-by-Step Solution

1
Identify the OSI layer of the attack.
The attacks are Layer 7 HTTP floods, which target the application layer.
Choosing the right defense requires understanding whether the attack is at the infrastructure layer (Layer 3/4) or the application layer (Layer 7).
2
Determine the appropriate AWS security services for Layer 7 mitigation.
AWS WAF is designed to inspect and filter Layer 7 traffic, while AWS Shield Standard only covers Layer 3/4.
AWS WAF rate-based rules are required to automatically identify and block clients exceeding a reasonable request threshold.
3
Deploy the protection at the network edge.
Position Amazon CloudFront in front of the Application Load Balancer, and associate the AWS WAF web ACL with the CloudFront distribution.
Placing CloudFront and AWS WAF at the edge ensures that malicious traffic is dropped before it consumes bandwidth or resources at the Application Load Balancer.

Key Concept

Mitigating Layer 7 DDoS attacks at the edge using Amazon CloudFront and AWS WAF rate-based rules.
Question 515Question →

A company runs a critical web application on AWS with a relational workload using an Amazon RDS for MySQL database. The database is currently deployed as a Multi-AZ DB instance to meet high availability requirements. During business hours, the database experiences predictable, high-volume read queries that cause CPU utilization on the primary instance to spike to 90%90\%. The database storage size is relatively small, but the workload requires high throughput and IOPS. The company wants to minimize overall operational costs while maintaining performance and high availability.

Which TWO configurations should the solutions architect implement to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Create Amazon RDS Read Replicas to offload read queries, allowing the primary database instance to be scaled down to a smaller size.; Configure the database storage using General Purpose SSD (gp3) volumes instead of Provisioned IOPS SSD (io1) volumes to provision the required IOPS and throughput independently of storage capacity.

Answer

Create Amazon RDS Read Replicas to offload read queries and configure the database storage using General Purpose SSD (gp3) volumes.
Creating Amazon RDS Read Replicas is the most cost-effective way to handle high volumes of read queries, as it allows the read traffic to be offloaded from the primary database instance. This enables the primary instance to be scaled down to a smaller, less expensive instance size. Configuring General Purpose SSD (gp3) volumes is cost-effective because gp3 allows provisioning IOPS and throughput independently of storage capacity. This prevents the need to overprovision storage capacity or use expensive Provisioned IOPS SSD (io1) volumes just to achieve high IOPS.

Step-by-Step Solution

1
Analyze the read query workload performance bottleneck.
The primary Multi-AZ database instance is experiencing CPU spikes to 90%90\% due to read traffic, which can be offloaded by deploying Read Replicas, allowing the primary instance to be downsized to save compute costs.
Offloading read traffic reduces compute requirements on the primary instance, optimizing the database capacity plan.
2
Evaluate the storage volume type for high IOPS and throughput requirements.
Using General Purpose SSD (gp3) volumes allows provisioning the required IOPS and throughput independently of storage size, avoiding the high cost of Provisioned IOPS SSD (io1) volumes or overprovisioning gp2 storage size.
This achieves cost-effective storage configuration without paying for unused storage space.
3
Assess high availability and automatic failover options.
Multi-AZ must be kept active for automatic failover. RDS Read Replicas cannot serve as automatic failover targets in place of Multi-AZ.
This ensures the SLA is met while avoiding configuration mistakes that compromise availability.

Key Concept

To cost-optimize relational database capacity on AWS, offload read-heavy traffic to Read Replicas to downscale the primary instance, and utilize gp3 storage to provision IOPS and throughput independently without overprovisioning storage space or using expensive Provisioned IOPS (io1) volumes.
Estimated Time:2m 0s
Question 516Question →

A medical device company is building an IoT platform that monitors patient health metrics. The platform receives events representing critical patient state changes (e.g., 'normal', 'warning', 'critical', 'resolved') sent from wearable sensors. For each patient, these state changes must be processed in the exact order they occurred to ensure the medical dashboard displays the current clinical state. Events from different patients must be processed concurrently to handle high throughput during peak hours. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Publish the health events to an Amazon SQS FIFO queue, using the patient ID as the Message Group ID. Configure an AWS Lambda function to consume and process the messages.

Answer

Publish the health events to an Amazon SQS FIFO queue, using the patient ID as the Message Group ID. Configure an AWS Lambda function to consume and process the messages.
The correct option correctly uses an Amazon SQS FIFO queue to guarantee ordered delivery. By setting the Message Group ID to the patient ID, messages associated with the same patient are always processed in the exact order they are received, while messages for different patients are processed in parallel by the AWS Lambda function. This approach has the lowest operational overhead as it relies entirely on serverless, managed integrations.

Step-by-Step Solution

1
Identify the ordering constraint
Events must be processed in the exact sequence they occur for each patient (per-patient ordering), but events across different patients can be processed concurrently.
This requirement determines that a message grouping mechanism is needed rather than global ordering.
2
Evaluate SQS FIFO queue capability
SQS FIFO queues guarantee order at the message group level. Using patient ID as the Message Group ID fulfills the ordering requirement for each patient while allowing parallel processing across different patients.
SQS FIFO automatically manages ordered delivery within a group and allows concurrent consumption across groups without manual partition management.
3
Compare operational overhead of alternatives
SQS Standard queues cannot guarantee ordering, necessitating complex consumer-side sorting. Kinesis Data Streams requires active shard provisioning and management. SQS FIFO with Lambda provides a fully managed serverless scaling model with the least operational overhead.
Minimizing operational overhead is a key requirement of the solution.

Key Concept

Using Amazon SQS FIFO queues with Message Group IDs allows per-identifier ordered processing while scaling consumer processing in parallel.
Question 517Question →

An engineering company runs a distributed computational fluid dynamics (CFD) simulation suite on a group of Amazon EC2 instances. The simulation nodes must exchange data with the lowest possible latency and maximum throughput. The administration team wants to monitor these nodes using a web dashboard that listens on TCP port 3000 of each instance, routed through an Application Load Balancer (ALB) that accepts traffic on port 443. The ALB target group is currently failing health checks.

Which actions should the solutions architect take to satisfy the latency requirements and resolve the health check issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Place the EC2 instances within a cluster placement group; Configure the target group health check port to explicitly query port 3000

Answer

Place the EC2 instances within a cluster placement group to meet the low latency requirement, and configure the target group health check port to explicitly query port 3000 to resolve the failing health checks.
To achieve the lowest possible network latency and highest throughput for inter-node communication, instances must be launched in a cluster placement group. Additionally, because the backend monitoring dashboard listens on port 3000 while the Application Load Balancer routes user traffic on port 443, the target group's health check port must be explicitly configured to port 3000 so the health check requests reach the active service.

Step-by-Step Solution

1
Analyze the network latency requirements for the distributed fluid dynamics simulation.
Determine that a cluster placement group is required to achieve the lowest possible network latency and high throughput.
Cluster placement groups place instances close together within a single Availability Zone, optimizing node-to-node performance.
2
Identify the cause of the load balancer target group health check failures.
Note the port mismatch: the web dashboard service on the instances listens on port 3000, while the ALB target group receives traffic on port 443.
By default, target group health checks query the traffic port (port 443). Since no service is listening on port 443 on the EC2 instances, the health checks fail.
3
Correct the target group configuration to resolve the health check failure.
Override the default health check port by setting it explicitly to port 3000.
This configuration routes health checks directly to the active web dashboard service port.

Key Concept

Tightly coupled compute workloads require cluster placement groups for low-latency node-to-node communication, and Elastic Load Balancing target groups must align health check ports with the backend application port.
Question 518Question →

A company hosts a web application on Amazon EC2 instances within an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG is configured with default settings. During a minor software failure, the web server process on one of the EC2 instances crashes. The ALB target group health checks correctly identify the instance as unhealthy and stop routing user traffic to it. However, the ASG does not terminate or replace the unhealthy instance, leading to reduced capacity. Which action should a solutions architect take to ensure the unhealthy instance is automatically replaced?

Show answer & explanation

Answer: Configure the Auto Scaling group to use Elastic Load Balancing (ELB) health checks instead of the default EC2 health checks.

Answer

Configure the Auto Scaling group to use Elastic Load Balancing (ELB) health checks instead of the default EC2 health checks.
By default, an Amazon EC2 Auto Scaling group only monitors EC2 status checks (which evaluate hypervisor and hardware health). If a web server process crashes but the OS is still running, the EC2 status checks will succeed. Configuring the Auto Scaling group to use Elastic Load Balancing (ELB) health checks forces the ASG to terminate and replace instances that fail the Application Load Balancer's target group health checks, maintaining application availability.

Step-by-Step Solution

1
Analyze the default behavior of the Auto Scaling group (ASG) health check mechanism.
By default, the ASG only uses EC2 status checks. Since the instance OS remains active and running during a web server application crash, the EC2 status check passes, and the ASG considers the instance healthy.
Understanding why the ASG does not automatically replace the instance is key to identifying the correct corrective configuration.
2
Determine how the Application Load Balancer (ALB) health checks behave.
The ALB performs application-level health checks (e.g., HTTP/HTTPS requests to a health path). It correctly identifies the instance as unhealthy and stops routing user traffic to it.
Since the load balancer already has the correct application health state, this state must be communicated to the ASG.
3
Modify the ASG health check type to integrate with the ALB.
Changing the ASG health check configuration from 'EC2' to 'ELB' allows the ASG to receive health status updates from the load balancer's target groups, terminating and replacing any instances marked unhealthy by the load balancer.
This configuration bridges the gap between application-level health status and instance lifecycle management.

Key Concept

Auto Scaling Group Health Check Integration with Elastic Load Balancing
Estimated Time:1m 30s
Question 519Question →

A gaming company is developing a multiplayer online game and needs to design the database layer for its player profile and game state service. The service must handle a peak workload of 45,00045,000 write operations per second for state updates and 90,00090,000 read operations per second for profile queries. Read requests for the most active players must have a sub-millisecond (microsecond) latency, while write operations must complete in less than 1010 milliseconds. The traffic is highly dynamic and spikes during game events. Which database configuration should a solutions architect recommend to achieve the required performance?

Show answer & explanation

Answer: Configure Amazon DynamoDB with Amazon DynamoDB Accelerator (DAX) to cache read requests, and use a unique UUIDv4 PlayerID as the partition key to distribute write operations evenly across partitions.

Answer

Configure Amazon DynamoDB with Amazon DynamoDB Accelerator (DAX) to cache read requests, and use a unique UUIDv4 PlayerID as the partition key to distribute write operations evenly across partitions.
The configuration using Amazon DynamoDB with DynamoDB Accelerator (DAX) and a unique UUIDv4 PlayerID partition key is correct because DynamoDB naturally scales to meet high-throughput workloads, and DAX provides microsecond latency for hot read keys. A high-cardinality partition key like PlayerID (UUIDv4) distributes write traffic evenly across DynamoDB partitions, preventing performance bottlenecks and write throttling.

Step-by-Step Solution

1
Analyze the database requirements for read/write volume, latency, and access patterns.
The database must support 45,00045,000 writes/sec (millisecond latency) and 90,00090,000 reads/sec (microsecond latency). Traffic is highly dynamic and spiky.
This identifies the scale and performance targets to narrow down candidate database services.
2
Evaluate database services and cache mechanisms suitable for microsecond read latency.
Amazon DynamoDB with DynamoDB Accelerator (DAX) satisfies both the high write throughput and the microsecond read latency requirement for cached player profiles.
Relational options like Amazon RDS or Aurora do not natively support microsecond latencies without external caching, and DynamoDB is highly optimized for scale.
3
Design the partition key structure to handle 45,00045,000 writes/sec without throttling.
A high-cardinality partition key like a UUIDv4 PlayerID distributes writes uniformly across partitions, preventing partition hot-spotting.
DynamoDB partitions have a physical limit of 1,0001,000 write capacity units (WCU) per partition, so keys must be distributed evenly to avoid hot partitions.

Key Concept

To design high-performing database solutions, select partition keys with high cardinality (such as unique UUIDs) to distribute read and write traffic evenly across DynamoDB partitions, preventing hot spots. Use DynamoDB Accelerator (DAX) to provide microsecond read latency for frequently accessed items.
Estimated Time:2m 0s
Question 520Question →

A company needs to design a cost-effective, serverless architecture for a daily data import pipeline. Once a night, a partner system uploads a batch of files containing transactional logs to an Amazon S3 bucket. A processing job must fetch these files, sort and process the records in strict chronological order, and write the output files to a temporary S3 folder. Another internal analytics system reads and permanently deletes these output files within 48 hours. The daily sorting and processing job is CPU-heavy and typically runs continuously for 3 hours. Which architecture is the most cost-effective and appropriate for this workload?

Show answer & explanation

Answer: Run the processing job inside an Amazon ECS task using the AWS Fargate launch type, scheduled daily via Amazon EventBridge, and store the output files in an Amazon S3 Standard bucket.

Answer

Running the processing job inside an Amazon ECS task on AWS Fargate scheduled via Amazon EventBridge, and storing the output files in an Amazon S3 Standard bucket.
The correct option is to run the processing job inside an Amazon ECS task on AWS Fargate, scheduled daily via Amazon EventBridge, and store the output files in an Amazon S3 Standard bucket. Amazon ECS on AWS Fargate provides a serverless compute option that can run containerized tasks for several hours without execution timeouts, charging only for the resources consumed while running. Amazon S3 Standard is the most cost-effective storage class for temporary files deleted within 48 hours because it does not enforce a minimum storage duration charge.

Step-by-Step Solution

1
Analyze compute runtime requirements.
The process runs for 3 hours, which exceeds AWS Lambda's 15-minute execution limit. Amazon ECS on AWS Fargate is a serverless option that supports long-running tasks.
To select a compatible compute service without managing virtual servers.
2
Evaluate data storage lifecycle and billing rules.
The output files are deleted within 48 hours. S3 Standard has no minimum storage duration, whereas S3 Standard-IA has a 30-day minimum billing period.
To avoid storage duration charge penalties.
3
Assess queue ordering behavior.
SQS Standard queues do not guarantee order, which violates the requirement for strict chronological processing.
To ensure architectural alignment with business requirements.

Key Concept

Matching serverless compute limits and S3 storage lifecycle characteristics to optimize workload costs.
Estimated Time:1m 30s
PreviousPage 26 / 74Next