Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 521Question →

A startup is developing a restaurant table booking application. The application experiences highly irregular and unpredictable traffic spikes when popular restaurants open their reservation windows, followed by hours of low activity. The database must store the reservation records with single-digit millisecond latency. Which database configuration is the most cost-effective to meet these requirements?

Show answer & explanation

Answer: Configure an Amazon DynamoDB table using On-Demand capacity mode.

Answer

Configure an Amazon DynamoDB table using On-Demand capacity mode.
The correct option is to configure an Amazon DynamoDB table using On-Demand capacity mode. On-Demand mode is designed for workloads with unpredictable or spiky traffic patterns because it automatically accommodates bursts of traffic without the need to provision capacity in advance. Since charges are based only on the actual read and write requests processed, the startup avoids paying for idle resources during low-activity hours.

Step-by-Step Solution

1
Analyze the workload's performance and traffic pattern.
The application requires low latency (single-digit millisecond) and experiences highly irregular, unpredictable traffic spikes followed by long idle periods.
Understanding the latency requirement and traffic pattern is necessary to choose the appropriate database engine and capacity planning model.
2
Evaluate the target database engine alternatives.
Amazon DynamoDB is selected because it natively supports single-digit millisecond latency, whereas Amazon RDS PostgreSQL requires more management overhead and does not natively offer the same scaling speed.
Choosing the correct database service prevents over-provisioning and ensures latency requirements are met.
3
Select the optimal capacity mode for the chosen database engine.
On-Demand capacity mode for DynamoDB is selected because it automatically scales instantly to handle unpredictable spikes and charges only for active requests, resulting in zero idle capacity costs.
On-demand billing aligns database costs directly with actual application usage, optimizing costs for spiky workloads.

Key Concept

Matching database capacity models (On-Demand vs. Provisioned) and services to unpredictable, spiky workloads to achieve cost optimization.
Question 522Question →

A company hosts a microservice on Amazon EC2 instances inside private subnets. The instances are managed by an Auto Scaling group (ASG) behind a public Application Load Balancer (ALB). The microservice is configured to listen on TCP port 8080. The ALB target group is configured to send health check requests to the instances on port 8080. After a security audit, a network engineer modified the custom network access control list (network ACL) associated with the private subnets. Shortly after, the ALB target group health checks began failing, marking all EC2 instances as unhealthy. The security group associated with the EC2 instances correctly allows inbound traffic on port 8080 from the ALB's security group. Which action should the solutions architect take to resolve this issue and restore service availability?

Show answer & explanation

Answer: Update the subnet network ACL to allow outbound traffic on ephemeral ports (1024-65535) to the load balancer's subnets.

Answer

Update the subnet network ACL to allow outbound traffic on ephemeral ports (1024-65535) to the load balancer's subnets.
The correct solution is to allow outbound ephemeral port traffic in the private subnets' network ACL. Because network ACLs are stateless, allowing inbound traffic on port 8080 is not enough; the return traffic from the instances back to the load balancer (which uses ephemeral ports as source ports) must be explicitly permitted in the outbound rules.

Step-by-Step Solution

1
Analyze the health check failure context.
The application is running on port 8080, and the instance security groups correctly allow inbound traffic on port 8080 from the ALB. The health checks started failing immediately after network ACL modifications.
To narrow down the root cause to the stateless network ACL layer.
2
Evaluate how stateless network ACLs process health check traffic.
The ALB initiates TCP connections to the EC2 instances on port 8080 using ephemeral source ports (1024-65535). Because network ACLs are stateless, return traffic from the EC2 instances to the ALB must be explicitly allowed on these ephemeral ports.
To determine the required rule to allow the health check responses to return to the ALB.
3
Select the configuration change that addresses the stateless nature of network ACLs.
Adding an outbound rule to the private subnet network ACL allowing ephemeral port traffic to the ALB subnets restores health check traffic flow.
To establish successful health check validation and make the instances healthy in the target group.

Key Concept

ELB health checks require appropriate configuration of security groups and stateless Network ACLs (NACLs) to ensure bidirectional communication.
Question 523Question →

A digital payment processing company provides a merchant API endpoint using an Application Load Balancer (ALB) backed by Amazon EC2 instances in a private subnet. The company must implement a security solution to defend against distributed denial of service (DDoS) attacks. The solution must protect the API from HTTP GET floods (Layer 7) and automatically mitigate UDP floods (Layer 3/4) before they reach the ALB. Additionally, the company requires 24/7 access to the AWS Shield Response Team (SRT) to assist in custom mitigation during active security incidents.

Which combination of AWS services and configurations should a solutions architect recommend to meet these security requirements with the least operational complexity?

Show answer & explanation

Answer: Deploy Amazon CloudFront in front of the ALB. Associate an AWS WAF Web ACL with the CloudFront distribution and configure a rate-based rule. Subscribe to AWS Shield Advanced and enable it on the CloudFront distribution.

Answer

Deploy Amazon CloudFront in front of the ALB. Associate an AWS WAF Web ACL with the CloudFront distribution and configure a rate-based rule. Subscribe to AWS Shield Advanced and enable it on the CloudFront distribution.
The correct architecture uses Amazon CloudFront as the entry point to absorb Layer 3 and Layer 4 attacks at the AWS edge using AWS Shield Advanced. This configuration also grants 24/7 access to the AWS Shield Response Team (SRT) for active assistance. Meanwhile, AWS WAF is associated with CloudFront to inspect Layer 7 traffic and enforce rate limits on HTTP GET requests, mitigating HTTP flood attacks automatically before they reach the backend Application Load Balancer.

Step-by-Step Solution

1
Analyze the requirements for L3/4 and L7 protection along with SRT engagement.
Identified the need for Layer 3/4 protection (UDP floods), Layer 7 protection (HTTP GET floods), and AWS Shield Response Team (SRT) access.
This establishes the scope of the services needed: AWS Shield Advanced is required for SRT access, and AWS WAF is required for Layer 7 rate limiting.
2
Determine the optimal point of enforcement.
Amazon CloudFront should be deployed in front of the ALB to act as the entry point at the AWS edge.
Enforcing security at the edge (CloudFront) prevents DDoS traffic from reaching the regional resources (ALB and EC2), protecting network capacity and compute resources from exhaustion.
3
Configure Layer 3/4 and Layer 7 protection on the edge resource.
Enable AWS Shield Advanced on CloudFront to mitigate L3/4 UDP floods and gain SRT support. Associate AWS WAF with CloudFront and configure a rate-based rule to automatically block IPs exceeding HTTP GET thresholds.
This combined architecture ensures automated protection at the edge, satisfies the requirement for SRT access, and handles both application-layer and infrastructure-layer attacks with minimal operational overhead.

Key Concept

Best practices for AWS Edge Security involve combining Amazon CloudFront, AWS Shield Advanced, and AWS WAF to mitigate Layer 3, 4, and 7 DDoS attacks before traffic reaches regional infrastructure.
Question 524Question →

A municipal utility company hosts a public portal on AWS for customers to view real-time energy usage and pay bills. The application runs on EC2 instances behind an Application Load Balancer (ALB) in a single AWS Region. The portal has recently experienced service outages due to sudden HTTP flood attacks targeting the login endpoint. The company needs to implement a cost-effective, automated edge security solution that mitigates these Layer 7 attacks before they reach the ALB, while minimizing latency for legitimate local users.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer.; Associate an AWS WAF web ACL with the CloudFront distribution and configure a rate-based rule to limit requests to the login endpoint.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer and associate an AWS WAF web ACL with the distribution to configure a rate-based rule to limit requests to the login endpoint.
Deploying Amazon CloudFront moves the entry point of the application to the AWS global edge network, which naturally absorbs Layer 3 and Layer 4 DDoS attacks. Associating AWS WAF with CloudFront allows the solutions architect to inspect Layer 7 HTTP requests and apply a rate-based rule to automatically block IP addresses that exceed a specified threshold of requests to the login endpoint. This provides automated, cost-effective Layer 7 protection before the malicious traffic can reach the Application Load Balancer or the backend compute resources.

Step-by-Step Solution

1
Analyze the attack pattern and application entry point.
The attack is a Layer 7 HTTP flood targeting a specific endpoint (the login page) of an ALB-backed application.
Identifying the target and type of attack ensures the mitigation is applied at the correct layer of the OSI model.
2
Introduce an edge network layer using Amazon CloudFront.
CloudFront acts as the public entry point, caching static content and distributing the threat surface globally across AWS edge locations.
Moving the endpoint to the edge prevents direct HTTP attacks from reaching the ALB and backend EC2 instances.
3
Implement Layer 7 filtering using AWS WAF and configure rate-based rules.
An AWS WAF web ACL is associated with the CloudFront distribution, containing a rate-based rule that tracks requests from client IP addresses and blocks them if they exceed a configured threshold.
This automatically detects and mitigates HTTP flood attacks targeting the login endpoint in real time without administrative overhead.

Key Concept

Edge protection and Layer 7 DDoS mitigation using Amazon CloudFront and AWS WAF rate-based rules.
Question 525Question →

A company is deploying a secure microservices application on Amazon EC2 instances within a private subnet (10.0.2.0/2410.0.2.0/24) of an Amazon VPC. The application must receive HTTPS requests on TCP port 84438443 from an internal Application Load Balancer (ALB) located in a separate private subnet (10.0.1.0/2410.0.1.0/24). Additionally, the EC2 instances must download container assets from Amazon S3 and write application logs to an S3 bucket. A Gateway VPC Endpoint is configured for S3 (`vpce-s3`) in the VPC. The company's security policy requires the use of strict, custom Network ACLs (NACLs) on the application subnet that operate under a default-deny posture, allowing only the minimum required traffic. Security Groups are also configured at the instance level.

Which of the following configurations must a solutions architect implement to establish secure, functional network connectivity for the application? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An inbound rule in the application subnet NACL allowing TCP traffic from 10.0.1.0/2410.0.1.0/24 on port 84438443, and an outbound rule in the same NACL allowing TCP traffic to 10.0.1.0/2410.0.1.0/24 on ports 1024−655351024-65535.; An outbound rule in the application subnet NACL allowing TCP traffic to the Amazon S3 prefix list on port 443443, and an inbound rule in the same NACL allowing TCP traffic from the Amazon S3 prefix list on ports 1024−655351024-65535.

Answer

Implementing an inbound rule in the application subnet NACL for port 8443 along with an outbound rule for the ephemeral port range 1024-65535 to the ALB subnet, and implementing an outbound rule in the application subnet NACL to the S3 prefix list on port 443 along with an inbound rule for the ephemeral port range 1024-65535 from the S3 prefix list.
The correct configurations involve setting up both inbound and outbound rules for the stateless Network ACL (NACL) to permit connection initiation and return traffic. For traffic initiated by the ALB, the NACL requires an inbound rule for the HTTPS traffic on port 8443 and an outbound rule to allow the response to reach the ALB's ephemeral port range (1024-65535). For traffic initiated by the EC2 instances to Amazon S3, the NACL requires an outbound rule to the S3 prefix list on port 443 and an inbound rule to allow S3's response to reach the EC2 instances' ephemeral port range.

Step-by-Step Solution

1
Analyze the statefulness of the VPC security layers.
Identify that Security Groups are stateful (automatically permit return traffic) and Network ACLs (NACLs) are stateless (must explicitly define rules for both inbound and outbound traffic directions).
This establishes the fundamental behavior required to define correct NACL rules without making stateful assumptions.
2
Evaluate the traffic flow from the ALB to the EC2 instances.
The connection is initiated by the ALB from subnet 10.0.1.0/24 on port 8443 to the EC2 instances in subnet 10.0.2.0/24. The return traffic goes from the EC2 instances back to the ALB's ephemeral port range (1024-65535).
This details the exact inbound port and outbound ephemeral port range needed in the stateless NACL for the ALB-to-EC2 path.
3
Evaluate the traffic flow from the EC2 instances to Amazon S3.
The connection is initiated by the EC2 instances in subnet 10.0.2.0/24 to S3 via the Gateway VPC Endpoint on port 443 (HTTPS). The return traffic goes from S3 (public IP addresses matched by the S3 prefix list) back to the EC2 instances' ephemeral ports (1024-65535).
This details the outbound port and inbound ephemeral port range needed in the stateless NACL for the EC2-to-S3 path.
4
Synthesize the rules and rule out incorrect options.
Confirm that the NACL must have the ALB inbound/outbound rules and the S3 outbound/inbound rules. Rule out options that rely on NACL statefulness, misapply Security Group rule requirements, or suggest incorrect NAT Gateway configurations.
Ensures that all distractors are successfully eliminated based on cloud architecture rules.

Key Concept

VPC Network Security
Question 526Question →

An advertising agency has a hybrid cloud architecture spanning an on-premises data center and a multi-account AWS environment managed under AWS Organizations. The agency manages its employee identities in an on-premises Microsoft Active Directory (AD) environment. The security team requires that employees use their existing AD credentials to access the AWS Management Console and the AWS CLI across different accounts. The solution must ensure that credentials are not replicated to the cloud, must support authentication redirection to the on-premises directory, and must integrate with their existing on-premises RADIUS server for multi-factor authentication (MFA) with minimal administrative overhead. Which solution meets these requirements?

Show answer & explanation

Answer: Enable AWS IAM Identity Center in the Organization's management account, configure an Active Directory directory source, and deploy an AWS Directory Service AD Connector to connect to the on-premises AD. Enable multi-factor authentication (MFA) on the AD Connector pointing to the on-premises RADIUS server.

Answer

Enable AWS IAM Identity Center in the Organization's management account, configure an Active Directory directory source, and deploy an AWS Directory Service AD Connector to connect to the on-premises AD. Enable multi-factor authentication (MFA) on the AD Connector pointing to the on-premises RADIUS server.
The correct solution uses AWS IAM Identity Center combined with an AD Connector to federate identities from the on-premises Active Directory without replicating passwords or credentials. Since the AD Connector acts as a proxy, it redirects authentication requests back to the on-premises Active Directory and supports native integration with an on-premises RADIUS server for multi-factor authentication (MFA). This provides single sign-on access to both the console and CLI with minimal operational overhead.

Step-by-Step Solution

1
Enable AWS IAM Identity Center in the management account of AWS Organizations to centrally manage access to all AWS accounts.
Centralized access control capability is established across the organization.
Allows mapping AD groups to permission sets across multiple accounts without managing individual policies per account.
2
Deploy an AWS Directory Service AD Connector pointing to the on-premises Active Directory domain controllers.
A directory proxy is created that redirects authentication requests without replicating database records or credentials.
Meets the technical requirement of not replicating credentials to the cloud while utilizing the existing directory.
3
Configure the identity source in IAM Identity Center to use the deployed AD Connector.
IAM Identity Center is linked to the on-premises Active Directory.
Enables users to log in with their corporate credentials.
4
Configure Multi-Factor Authentication (MFA) on the AD Connector to redirect MFA validation requests to the on-premises RADIUS server.
MFA is enforced using the existing corporate RADIUS server.
Integrates with existing security mechanisms and satisfies the requirement to use the current RADIUS infrastructure.

Key Concept

AWS IAM Identity Center integration with on-premises Active Directory using AD Connector and RADIUS MFA
Estimated Time:2m 30s
Question 527Question →

A company is designing a hybrid network architecture to connect its on-premises corporate office to an AWS VPC. The connection must support a minimum throughput of 2 Gbps2\text{ Gbps} for secure, encrypted data transfers. Additionally, the network design must implement stateless traffic filtering at the subnet boundary to restrict specific external IP address ranges from accessing internal resources.

Which TWO actions should the Solutions Architect take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create an AWS Transit Gateway and set up a Site-to-Site VPN connection with multiple VPN tunnels, enabling Equal-Cost Multi-Path (ECMP) routing to distribute the traffic.; Configure stateless Network Access Control Lists (Network ACLs) associated with the subnets to deny traffic from the restricted external IP ranges.

Answer

Create an AWS Transit Gateway with a Site-to-Site VPN utilizing ECMP routing across multiple tunnels to exceed individual tunnel throughput limits, and configure stateless Network Access Control Lists (Network ACLs) at the subnet boundary.
To achieve a secure connection of 2 Gbps2\text{ Gbps}, the architect must use AWS Transit Gateway with multiple Site-to-Site VPN tunnels and ECMP routing enabled, which effectively pools the 1.25 Gbps1.25\text{ Gbps} bandwidth capacity of individual tunnels. Additionally, Network ACLs are the correct component to meet the requirement for stateless filtering at the subnet boundary.

Step-by-Step Solution

1
Evaluate the encryption and throughput requirements for the hybrid connection.
A throughput of 2 Gbps2\text{ Gbps} is required. A single AWS Site-to-Site VPN tunnel is limited to 1.25 Gbps1.25\text{ Gbps}. To scale capacity beyond this limit while maintaining encryption, multiple VPN tunnels must be aggregated using AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled.
This overcomes the standard bandwidth limits of a single VPN connection.
2
Determine the appropriate firewalling mechanism for stateless filtering at the subnet boundary.
Network Access Control Lists (Network ACLs) are stateless and operate at the subnet boundary.
This matches the requirement to perform stateless traffic filtering at the subnet boundary, whereas security groups are stateful and operate at the instance level.

Key Concept

Scaling VPN throughput using AWS Transit Gateway ECMP routing and implementing stateless subnet security boundaries with Network ACLs.
Question 528Question →

A solutions architect is configuring the network security for a two-tier application in a new Amazon VPC. The application consists of web servers deployed in a public subnet and a MySQL database cluster deployed in a private subnet. The web servers must be accessible from the internet, and the database cluster must only accept connections from the web servers. Which TWO configurations should the solutions architect implement to secure these tiers? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the database security group to allow inbound traffic on TCP port 3306 with the source set as the web server security group.; Configure the web server security group to allow inbound traffic on TCP port 443 from any source (0.0.0.0/0).

Answer

To secure the two-tier application, the database security group should allow inbound database traffic on TCP port 3306 from the web server security group, and the web server security group must allow inbound HTTPS traffic from any source.
Allowing database traffic from the web server security group ensures database access is limited to the web tier. Allowing HTTPS traffic from any source allows public clients to access the web tier. Both configurations use stateful security groups to properly manage access at the instance level.

Step-by-Step Solution

1
Configure database security group rules.
Create an inbound rule allowing TCP port 3306 traffic, setting the source as the web server security group ID.
This establishes a secure database tier by limiting traffic to only the web servers.
2
Configure web server security group rules.
Create an inbound rule allowing TCP port 443 traffic from any source (0.0.0.0/0).
This allows clients on the internet to establish secure HTTPS connections with the web servers.

Key Concept

Configuring stateful security groups using security group references as sources or destinations to implement a secure multi-tier architecture.
Question 529Question →

A multiplayer game studio is building a new development environment consisting of multiple AWS accounts managed under AWS Organizations. The studio's corporate identity provider (IdP) is PingFederate, which holds all employee credentials. The game developers need single sign-on (SSO) access to both the AWS Management Console and several external SaaS-based collaboration tools. The solution must support automatic user provisioning and ensure that access is dynamically updated when developers join or leave projects, without managing long-term credentials in individual AWS accounts. Which solution meets these requirements with the least operational complexity?

Show answer & explanation

Answer: Configure AWS IAM Identity Center, integrated with AWS Organizations, to use PingFederate as an external identity provider using SAML 2.0. Enable SCIM-based automatic provisioning from PingFederate to IAM Identity Center. Configure permission sets in IAM Identity Center for the AWS accounts and add custom SAML 2.0 applications for the SaaS collaboration tools.

Answer

Configure AWS IAM Identity Center, integrated with AWS Organizations, to use PingFederate as an external identity provider using SAML 2.0. Enable SCIM-based automatic provisioning from PingFederate to IAM Identity Center. Configure permission sets in IAM Identity Center for the AWS accounts and add custom SAML 2.0 applications for the SaaS collaboration tools.
The correct solution leverages AWS IAM Identity Center integrated with AWS Organizations to centralize access control. By configuring PingFederate as an external SAML 2.0 identity provider and enabling SCIM-based automatic provisioning, the studio automates user lifecycle management and access dynamically. Furthermore, AWS IAM Identity Center supports custom SAML applications, allowing developers to authenticate into both AWS environments and SaaS collaboration tools from a single user portal without managing long-term credentials.

Step-by-Step Solution

1
Establish federation between the external identity provider (PingFederate) and AWS IAM Identity Center.
Trust is configured centrally, allowing users to authenticate with their existing PingFederate credentials.
Centralizing federation avoids the operational overhead of setting up SAML configurations individually in each AWS account.
2
Enable SCIM-based automatic provisioning between PingFederate and AWS IAM Identity Center.
User accounts and group memberships are automatically synchronized and updated when developers join or leave the studio.
SCIM removes the need for custom scripts or manual synchronization, satisfying the requirement to keep access dynamically updated with minimal overhead.
3
Create permission sets and assign them to users or groups for member accounts, and configure custom SAML 2.0 applications in IAM Identity Center for external SaaS tools.
Developers get single sign-on access to all assigned AWS accounts and SaaS tools through a single portal.
IAM Identity Center natively supports both multi-account AWS access and external SAML applications, eliminating individual account credential management.

Key Concept

Centralized Identity Federation and Directory Services with AWS IAM Identity Center and SCIM
Question 530Question →

A company needs to grant 500 external contractors access to specific AWS resources in a single AWS account. The contractors already have identities managed in an external OpenID Connect (OIDC) compliant identity provider. The company's security policy states that no long-term AWS credentials should be created for these contractors, and they must authenticate using their existing corporate credentials. Which solution meets these security requirements with the least administrative overhead?

Show answer & explanation

Answer: Establish a trust relationship between AWS and the external OIDC identity provider by creating an OIDC identity provider in IAM, map the provider to IAM roles with the necessary permissions, and configure the contractors to assume these roles.

Answer

Establish a trust relationship between AWS and the external OIDC identity provider by creating an OIDC identity provider in IAM, map the provider to IAM roles with the necessary permissions, and configure the contractors to assume these roles.
Establishing a trust relationship with the external OIDC provider and mapping groups to IAM roles allows contractors to assume roles and receive temporary credentials. This satisfies the requirement of using existing corporate credentials, avoids creating long-term AWS credentials, and minimizes administrative overhead.

Step-by-Step Solution

1
Configure the identity provider (IdP) in AWS IAM.
AWS IAM establishes a trust relationship with the external OIDC-compliant identity provider.
This enables external users to authenticate using their existing corporate credentials without storing their passwords in AWS.
2
Create IAM roles with appropriate trust policies and permissions.
Roles are created that trust the OIDC identity provider and have permission policies attached.
This allows the external users to assume these roles and obtain short-term security credentials for access.
3
Configure the mapping between the IdP groups and AWS IAM roles.
Contractors are mapped to specific roles based on their group membership in the external IdP.
This ensures the principle of least privilege is enforced dynamically based on user identity, with zero long-term credentials created.

Key Concept

Federating identity providers with AWS IAM using OIDC allows external users to securely access AWS resources using temporary security credentials, avoiding the administrative overhead and security risks of managing individual IAM users.
Question 531Question →

A shipping company is designing a system to process telemetry reports from IoT sensors installed on cargo containers. The sensors publish reports containing temperature, humidity, and location data. The processing application must handle messages asynchronously. To prevent data corruption, reports for each individual cargo container must be processed in the exact order they are received. Reports that fail to process after 5 attempts must be quarantined for investigation. Which TWO options should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon SQS FIFO queue to buffer the reports, using the cargo container ID as the message group ID to preserve order.; Configure an Amazon SQS FIFO dead-letter queue (DLQ) to capture messages that fail to process after multiple retries.

Answer

The solutions architect should create an Amazon SQS FIFO queue, using the cargo container ID as the message group ID to preserve order, and configure an Amazon SQS FIFO dead-letter queue (DLQ) to capture failed messages.
To ensure reports for each cargo container are processed in the exact order they are received, an Amazon SQS FIFO queue is required. Using the container ID as the message group ID ensures that messages within the same container group are processed sequentially, while allowing parallel processing across different containers. Additionally, configure an Amazon SQS FIFO dead-letter queue (DLQ) to handle processing failures. A FIFO queue requires a FIFO DLQ to maintain order and receive quarantined messages after the specified retry limit is reached.

Step-by-Step Solution

1
Identify the ordering requirements of the system.
Since the reports must be processed in the exact order they were received per container, a First-In-First-Out (FIFO) messaging mechanism is required.
Standard message queues do not guarantee FIFO order, which could lead to processing telemetry data out of sequence.
2
Determine the message grouping strategy.
Use the container ID as the Message Group ID within the SQS FIFO queue.
This guarantees sequential processing for messages within the same container group while allowing concurrent processing across different container IDs.
3
Design the error handling and quarantine mechanism.
Configure an SQS FIFO dead-letter queue (DLQ) as the target for the redrive policy of the main queue.
Messages that fail to process after 5 attempts are automatically sent to the DLQ, satisfying the quarantine requirement without blocking the rest of the queue.

Key Concept

Decoupling message processing while maintaining message ordering using SQS FIFO queues and handling failures using Dead-Letter Queues (DLQs).
Question 532Question →

An online auction platform operates its primary application in the eu-west-1 Region. The architecture consists of an Application Load Balancer (ALB), an Auto Scaling group of Amazon EC2 instances, and an Amazon RDS for MySQL database. The company needs to design a disaster recovery (DR) strategy in the eu-central-1 Region. The DR plan must support a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours while minimizing ongoing running costs. Which strategy should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Configure a cross-region Amazon RDS Read Replica in the secondary region. Store the application tier infrastructure as AWS CloudFormation templates in the secondary region, maintaining the Auto Scaling group with a desired capacity of zero. In a disaster recovery event, promote the Read Replica to a standalone DB instance and deploy the CloudFormation templates to provision the compute resources.

Answer

Configure a cross-region Amazon RDS Read Replica in the secondary region. Store the application tier infrastructure as AWS CloudFormation templates in the secondary region, maintaining the Auto Scaling group with a desired capacity of zero. In a disaster recovery event, promote the Read Replica to a standalone DB instance and deploy the CloudFormation templates to provision the compute resources.
The correct strategy represents a Pilot Light architecture. By utilizing a cross-region Amazon RDS Read Replica, database updates are constantly replicated to the DR region, satisfying the 15-minute RPO. Maintaining the compute resources (ALB and EC2 Auto Scaling group) as CloudFormation templates and keeping the Auto Scaling group desired capacity at zero minimizes running costs since there are no active computing charges. In the event of a disaster, provisioning the compute stack and promoting the DB replica can easily be completed within the 2-hour RTO.

Step-by-Step Solution

1
Analyze RPO requirements.
The target RPO is 15 minutes. To prevent losing more than 15 minutes of transactional data, replication to the target region must be continuous. An RDS cross-region Read Replica uses asynchronous replication and satisfies this requirement.
Choosing a backup-and-restore option with manual snapshot copies is operationally heavy and risks violating RPO if replication/copies are delayed.
2
Analyze RTO and cost requirements.
The target RTO is 2 hours. Deploying compute resources using AWS CloudFormation templates and scaling up an Auto Scaling group takes minutes, easily fitting within the 2-hour window. This allows us to keep the Auto Scaling group capacity at zero in the DR region.
This is a Pilot Light strategy. Keeping the application load balancer and compute instances offline when not in use minimizes running costs.
3
Evaluate and eliminate sub-optimal strategies.
Warm Standby is rejected because keeping active compute resources running continuously in the secondary region is more expensive. S3 Glacier is rejected because retrieval delays violate the RTO. Multi-AZ database configurations are rejected because they do not span multiple AWS regions.
Ensuring the selected solution is both technically viable and the most cost-efficient choice among the options.

Key Concept

Disaster Recovery (DR) Strategies: Pilot Light vs. Warm Standby
Estimated Time:2m 0s
Question 533Question →

An application is deployed on Amazon EC2 instances inside a private subnet (CIDR 10.0.2.0/2410.0.2.0/24) of an Amazon VPC. The application must regularly download large datasets from Amazon S3 and invoke a public, third-party payment gateway API over the internet. A public subnet (CIDR 10.0.1.0/2410.0.1.0/24) in the VPC contains a NAT Gateway. A Gateway VPC Endpoint for Amazon S3 has already been created for the VPC. Security policies require strict control over outbound traffic, minimal data processing charges, and the enforcement of the principle of least privilege. Which TWO configurations are required to establish secure, cost-effective connectivity for the application?

Select all that apply

Show answer & explanation

Answer: Update the private subnet route table to direct traffic destined for the Amazon S3 prefix list to the S3 Gateway VPC Endpoint.; Configure the private subnet Network ACL to allow outbound traffic to the payment gateway IP range on port 443443 and allow inbound traffic from the payment gateway IP range on ephemeral ports 10241024-6553565535.

Answer

Update the private subnet route table to direct traffic destined for the Amazon S3 prefix list to the S3 Gateway VPC Endpoint, and configure the private subnet Network ACL to allow outbound traffic to the payment gateway IP range on port 443443 and allow inbound traffic from the payment gateway IP range on ephemeral ports 10241024-6553565535.
Updating the private subnet route table to target the S3 prefix list via the S3 Gateway VPC Endpoint ensures S3 traffic is routed privately and cost-effectively. Furthermore, configuring the stateless Network ACL with an outbound rule for port 443443 and an inbound rule for ephemeral ports (10241024-6553565535) ensures that outbound API calls can be completed and responses can return.

Step-by-Step Solution

1
Determine the most cost-effective and secure route for Amazon S3 traffic.
A Gateway VPC Endpoint for S3 should be used, requiring an update to the private subnet route table targeting the S3 prefix list.
This keeps traffic within the AWS internal network, reducing NAT Gateway processing costs.
2
Analyze security group requirements for returning HTTPS traffic.
No inbound security group rule is needed for return traffic because security groups are stateful.
Security groups automatically allow return traffic for established outbound sessions.
3
Configure Network ACL rules for the stateless subnet boundary.
Add an outbound rule for port 443443 and an inbound rule for ephemeral ports 10241024-6553565535 for the payment gateway IP range.
Network ACLs are stateless, meaning return traffic must be explicitly allowed by specifying inbound rules for ephemeral ports.

Key Concept

VPC Network Security design balancing stateful security groups, stateless Network ACLs, and Gateway VPC Endpoint routing.
Estimated Time:2m 0s
Question 534Question →

A renewable energy company operates a web-based grid monitoring dashboard hosted on Amazon EC2 instances. The security team needs to implement a solution to monitor the environment for security threats, specifically targeting potential SSH brute-force attempts on the instances, while maintaining a comprehensive history of all management console activity and API calls for compliance auditing. Which combination of AWS services should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty to monitor VPC Flow Logs and analyze DNS query logs for anomalous behavior.; Enable AWS CloudTrail to log and retain account activity related to actions taken across the AWS infrastructure.

Answer

The correct combination is to enable Amazon GuardDuty to monitor network and DNS activity for threats, and to enable AWS CloudTrail to capture and audit AWS API activities.
The correct approach is to combine threat detection and event auditing. The option to enable Amazon GuardDuty satisfies the requirement to identify brute-force attacks by analyzing network flows. The option to enable AWS CloudTrail fulfills the compliance requirement by logging all API operations and management activities.

Step-by-Step Solution

1
Analyze the threat detection requirement.
Identify that the system needs to detect active security threats like SSH brute-force attempts.
Amazon GuardDuty is designed for threat detection and can analyze network flow logs to find signature-based anomalies.
2
Analyze the auditing and compliance requirement.
Determine the need for a persistent audit trail of all API operations.
AWS CloudTrail captures all API events, console actions, and SDK requests, providing a historical record.

Key Concept

AWS security monitoring requires separating threat detection (using GuardDuty) from API and configuration audit logging (using CloudTrail).
Estimated Time:1m 30s
Question 535Question →

A real estate company is hosting its public property search portal on AWS. The company needs to protect the application from common web exploits and vulnerabilities, such as SQL injection and cross-site scripting (XSS), which are affecting database queries and user sessions. Which AWS service should a solutions architect recommend to meet this requirement?

Show answer & explanation

Answer: AWS WAF

Answer

AWS WAF is the correct service because it functions at the application layer (Layer 7) and can inspect HTTP/HTTPS request bodies, headers, and query strings to block malicious payloads such as SQL injection and cross-site scripting (XSS) attacks.
AWS WAF is the appropriate service because it inspects incoming HTTP/HTTPS requests at the application layer (Layer 7) and blocks threats like SQL injection and cross-site scripting based on customizable rules.

Step-by-Step Solution

1
Identify the target threat layer and exploit types described in the scenario.
The target threats are SQL injection and cross-site scripting (XSS), which are application-layer (Layer 7) exploits.
Understanding the OSI model layer of the threat helps eliminate services that only operate at lower layers.
2
Evaluate the capabilities of the available security services relative to Layer 7 inspection.
AWS WAF is the only service listed that operates at Layer 7 and is capable of inspecting HTTP/HTTPS request components like query parameters and request bodies.
Security Groups and Network ACLs filter traffic based on IP addresses and ports (Layer 3 and 4), while AWS Shield Standard mitigates infrastructure-layer DDoS attacks (Layer 3 and 4).
3
Select the service designed specifically for mitigating Layer 7 application exploits.
AWS WAF is recommended for web application-layer exploit protection.
Deploying AWS WAF allows the application of rules to inspect and block malicious web requests before they reach the backend application.

Key Concept

AWS WAF operates at Layer 7 to protect web applications against common web exploits, whereas AWS Shield, Security Groups, and NACLs operate at Layers 3 and 4.
Estimated Time:45s
Question 536Question →

An enterprise is building an internal human resources application on AWS. The application consists of a front-end server tier and a backend payroll database. The solutions architect needs to isolate the payroll database so that it has no direct route to or from the public internet, and it must only accept incoming traffic on port 54325432 from the front-end servers.

Which of the following configurations should the solutions architect implement to achieve this security posture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate the payroll database instances with private subnets that do not contain a route to an Internet Gateway in their route tables.; Add a rule to the payroll database security group that allows inbound traffic on port 54325432 from the security group of the front-end servers.

Answer

To secure the payroll database, place the database instances in private subnets that do not route to an Internet Gateway, and configure the database security group to allow inbound traffic on port 54325432 from the front-end server security group.
Placing the database in private subnets with no route to an Internet Gateway blocks all direct internet access. Configuring the database security group to reference the front-end server security group ensures that only the web tier can connect to the database on the database port, implementing secure least-privilege access.

Step-by-Step Solution

1
Isolate the network layer by deploying the database instances in private subnets.
Database instances have no direct route to the public internet.
This satisfies the requirement that the database must have no direct route to or from the public internet.
2
Configure the database security group with an inbound rule allowing port 54325432 traffic sourcing from the front-end security group.
Only front-end instances can establish connections to the database.
This restricts access to only the authorized application tier, adhering to security best practices.

Key Concept

VPC Network Security Isolation using Private Subnets and Stateful Security Group Rules
Question 537Question →

A financial services application runs on Amazon EC2 instances with attached Amazon EBS volumes that contain highly sensitive transaction records. The security officer requires that all EBS volumes are encrypted using AWS KMS customer managed keys, and that the encryption key material is automatically rotated every year. The application must not experience any downtime, and existing volumes must remain accessible and decrypted transparently.

Which actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Turn on automatic key rotation within the configuration of the customer managed key.; Allow AWS KMS to keep the legacy key material versions active to decrypt data that was encrypted before the rotation.

Answer

Turn on automatic key rotation within the customer managed key configuration, and allow AWS KMS to keep legacy key material versions active to decrypt older data.
To satisfy the rotation requirement without modification or downtime, automatic key rotation must be enabled. AWS KMS will automatically rotate the underlying cryptographic key material annually while retaining the original key ARN. This ensures that the EBS volume configuration remains unchanged. AWS KMS also automatically preserves older versions of the key material, allowing the system to decrypt existing volumes and snapshots transparently.

Step-by-Step Solution

1
Enable automatic key rotation for the customer managed key in AWS KMS.
The backing key material will be rotated automatically every year, while keeping the same key ARN.
This avoids having to modify any EC2 launch configurations or volume attachments since the key identifier remains unchanged.
2
Ensure backward compatibility for existing EBS volumes.
AWS KMS retains the older versions of the key material to decrypt data encrypted under those versions.
This allows older backups and active volumes to continue working seamlessly without requiring immediate re-encryption.

Key Concept

AWS KMS automatic key rotation retains older key material versions for decryption while preserving the same key ARN.
Question 538Question →

A global online gaming company hosts its multiplayer matchmaking API on Amazon ECS container instances behind an Application Load Balancer (ALB). The company recently suffered a major distributed denial of service (DDoS) attack in the form of an HTTP flood, which overwhelmed the ALB and caused matchmaking services to fail. Additionally, the security team has identified SQL injection attempts in the request payloads. The company wants to implement a solution to mitigate these Layer 7 attacks, minimize latency for global players, and restrict direct access to the ALB, allowing traffic only from the edge security layer. Which two actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL with the distribution that includes a rate-based rule and SQL injection protection rules.; Configure the security group of the Application Load Balancer to allow inbound HTTP/HTTPS traffic only from the Amazon CloudFront managed prefix list.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer with AWS WAF associated, and restrict the load balancer's security group to allow inbound traffic only from the CloudFront managed prefix list.
Deploying CloudFront in front of the ALB caches content globally to reduce latency. Associating AWS WAF with CloudFront allows filtering of Layer 7 exploits like SQL injection and mitigating HTTP flood attacks using rate-based rules at the edge. Restricting the ALB security group to the CloudFront managed prefix list ensures that all public traffic must pass through the CloudFront and WAF edge security layer before reaching the backend.

Step-by-Step Solution

1
Introduce Amazon CloudFront to cache content globally, reducing latency, and provide a point of integration for AWS WAF at the AWS edge network.
Latency is reduced for global users, and the attack surface is shifted to the AWS edge.
CloudFront routes traffic through the AWS global network and integrates directly with AWS WAF.
2
Configure an AWS WAF Web ACL containing rate-based rules to block HTTP flood attacks and custom/managed rules to inspect payloads and block SQL injection exploits.
Layer 7 attacks (HTTP floods and SQL injection) are blocked at the edge.
AWS WAF inspects HTTP/HTTPS traffic at Layer 7 and can enforce rate limits and payload inspections.
3
Modify the Application Load Balancer's security group to restrict inbound traffic to the Amazon CloudFront managed prefix list, ensuring direct access to the origin is blocked.
Direct public access to the load balancer is prevented, forcing all traffic through CloudFront.
Securing the origin ensures attackers cannot bypass AWS WAF by sending requests directly to the ALB's public IP address.

Key Concept

Implementing Layer 7 DDoS and exploit mitigation at the edge using Amazon CloudFront and AWS WAF while securing the origin ALB.
Question 539Question →

An online auction platform experiences intermittent performance degradation during high-traffic bidding events due to sophisticated Layer 7 HTTP flood attacks and cross-site scripting (XSS) attempts. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). Which solution should a solutions architect implement to mitigate these attacks at the AWS network edge before they reach the application?

Show answer & explanation

Answer: Deploy Amazon CloudFront in front of the Application Load Balancer. Associate an AWS WAF web ACL with the CloudFront distribution, and configure a rate-based rule and a cross-site scripting (XSS) match rule.

Answer

Deploy Amazon CloudFront in front of the Application Load Balancer, associate an AWS WAF web ACL with the CloudFront distribution, and configure a rate-based rule and a cross-site scripting (XSS) match rule.
Deploying Amazon CloudFront in front of the Application Load Balancer puts the entry point at the AWS network edge. Associating AWS WAF with the CloudFront distribution allows traffic to be inspected and filtered at edge locations. Rate-based rules in AWS WAF mitigate Layer 7 HTTP floods, and XSS match conditions block exploit attempts before they reach the Application Load Balancer and the backend instances.

Step-by-Step Solution

1
Identify where edge mitigation must occur.
Determine that Amazon CloudFront is the content delivery network that operates at global AWS edge locations, providing an entry point outside the primary AWS region.
Deploying CloudFront ensures that incoming traffic is intercepted and inspected at the network edge before reaching regional infrastructure.
2
Select the appropriate tool for Layer 7 inspection and rate limiting.
Choose AWS WAF to create Web ACLs with rate-limiting rules (for HTTP floods) and custom inspection rules (for XSS).
Layer 4 components like Security Groups and Network ACLs cannot inspect HTTP request payloads or selectively block based on application signatures.
3
Integrate AWS WAF at the edge layer.
Associate the AWS WAF Web ACL with the Amazon CloudFront distribution.
This configuration filters malicious traffic at the CloudFront edge locations, blocking attacks before they travel to the Application Load Balancer and the backend EC2 instances.

Key Concept

Using Amazon CloudFront in combination with AWS WAF protects web applications against Layer 7 DDoS (HTTP floods) and application exploits at the AWS network edge, preventing malicious traffic from reaching regional load balancers.
Estimated Time:1m 30s
Question 540Question →

A company is setting up a secure multi-tier application in a VPC. The database tier runs on Amazon EC2 instances located in a private subnet (10.0.2.0/2410.0.2.0/24). The database instances need to periodically initiate outbound connections to download software patches from an external repository on the public internet over HTTPS (TCP port 443443). A NAT Gateway is deployed in the public subnet (10.0.1.0/2410.0.1.0/24) to facilitate egress, and the private subnet's route table contains a default route (0.0.0.0/00.0.0.0/0) pointing to the NAT Gateway. The database subnet uses a custom Network Access Control List (NACL) that currently denies all traffic. The database instances are associated with a custom security group. Which configuration of security group and NACL rules must the solutions architect implement to allow the database instances to download patches while maintaining the principle of least privilege?

Show answer & explanation

Answer: Security Group: Outbound rule allowing TCP port 443443 to 0.0.0.0/00.0.0.0/0. No inbound rules. Subnet NACL: Outbound rule allowing TCP port 443443 to 0.0.0.0/00.0.0.0/0; Inbound rule allowing TCP ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.

Answer

Security Group: Outbound rule allowing TCP port 443443 to 0.0.0.0/00.0.0.0/0. No inbound rules. Subnet NACL: Outbound rule allowing TCP port 443443 to 0.0.0.0/00.0.0.0/0; Inbound rule allowing TCP ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.
The correct configuration uses the stateful nature of Security Groups and the stateless nature of NACLs. For the Security Group, an outbound rule for TCP port 443443 allows the connection to be established, and the stateful tracking automatically allows the return traffic back in. For the NACL, an outbound rule allows the outbound request on TCP port 443443, and an inbound rule allows return traffic to enter the subnet on the ephemeral ports (1024−655351024-65535) used by the initiating client instances.

Step-by-Step Solution

1
Analyze the statefulness of the Security Group.
Since Security Groups are stateful, any outbound request allowed on TCP port 443443 automatically permits the return response to enter. No inbound rules are required.
To maintain the principle of least privilege, we should only define the outbound rule.
2
Analyze the statelessness of the Network ACL (NACL) outbound flow.
NACLs are stateless, meaning return traffic is not tracked. An outbound rule allowing TCP port 443443 to 0.0.0.0/00.0.0.0/0 is required for the outbound patch request to leave the subnet.
The packet destination IP is the external repository, so the rule must target 0.0.0.0/00.0.0.0/0 rather than the NAT Gateway's IP.
3
Analyze the statelessness of the NACL inbound flow.
Because the client establishes a connection using an ephemeral source port, the return traffic from the repository will target that ephemeral port range (1024−655351024-65535). An inbound rule allowing TCP ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0 is required.
Without this inbound rule, the stateless NACL will drop the returning packets from the repository.

Key Concept

Understanding the functional differences between stateful Security Groups (operating at the instance level) and stateless Network ACLs (operating at the subnet level), including ephemeral port requirements and destination IP evaluation.
Estimated Time:2m 0s
PreviousPage 27 / 74Next
All practice questions — AWS Certified Solutions Architect - Associate | Examkin