All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A media streaming provider needs to implement a security monitoring strategy across its AWS environment. The provider wants to detect compromised IAM credentials and anomalous API requests made from unauthorized IP addresses. Additionally, they must track configurations and record resource changes over time for compliance auditing. Which combination of AWS services should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Enable Amazon GuardDuty to continuously analyze AWS CloudTrail management events and detect credential misuse or unauthorized API patterns.

Implement AWS Config to record configurations of AWS resources and evaluate them against compliance rules.

Configure stateless Network ACLs at the subnet level to automatically track and inspect returning IAM API traffic.

Deploy AWS Shield Standard on the front-end load balancers to block Layer 7 application exploits and malicious access key patterns.

Enable AWS Shield Advanced to analyze and filter out SQL injection attacks on the EC2 backend instances.

Show answer & explanation

Answer: Enable Amazon GuardDuty to continuously analyze AWS CloudTrail management events and detect credential misuse or unauthorized API patterns.; Implement AWS Config to record configurations of AWS resources and evaluate them against compliance rules.

Answer

The correct options are enabling Amazon GuardDuty to analyze AWS CloudTrail management events and implementing AWS Config to record and track configurations of resources.

The correct architecture uses Amazon GuardDuty to monitor IAM credential security and API anomalies by digesting AWS CloudTrail logs, and AWS Config to track configuration history and ensure compliance baseline rules are met.

Step-by-Step Solution

Address credential compromise and anomalous API monitoring requirements.

Identify that Amazon GuardDuty analyses AWS CloudTrail management events to identify anomalous patterns of activity indicative of credential misuse or compromise.

GuardDuty has built-in threat intelligence and machine learning to identify credential abuse.

Address compliance and auditing requirements for configuration history.

Identify that AWS Config records the history of configurations and automatically evaluates changes against desired security baselines.

AWS Config is designed for auditing and compliance tracking of configuration history.

Key Concept

AWS Security Monitoring and Threat Detection using GuardDuty and AWS Config

Question 562Question →

A company hosts a high-traffic e-commerce platform on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). During flash sales, the ASG scales out rapidly. However, newly launched EC2 instances are immediately bombarded with a large volume of requests before they can complete their initialization tasks, such as pre-populating local caches. This causes the instances to become overloaded, fail health checks, and be prematurely terminated by the ASG. Additionally, when the flash sale ends and the ASG scales in, clients with active checkout connections receive HTTP 504 Gateway Timeout errors because their sessions are abruptly severed.

Which combination of actions should a Solutions Architect take to resolve these issues? (Select two.)

Select all that apply

Configure a slow start duration in the Application Load Balancer target group settings.

Increase the deregistration delay timeout in the Application Load Balancer target group settings.

Configure an Amazon Route 53 latency routing policy with health checks to route client traffic directly to individual EC2 instance IP addresses.

Configure stateful Network ACL rules on the application subnets to temporarily block incoming connections to new instances until their cache is populated.

Modify the target group's health check configuration to query a default port such as port 80 instead of the custom application port to prevent early health check failures.

Show answer & explanation

Answer: Configure a slow start duration in the Application Load Balancer target group settings.; Increase the deregistration delay timeout in the Application Load Balancer target group settings.

Answer

Configure a slow start duration in the Application Load Balancer target group settings, and increase the deregistration delay timeout in the Application Load Balancer target group settings.

Configuring a slow start duration in the Application Load Balancer target group settings allows newly launched EC2 instances to receive a linearly increasing share of requests, preventing them from being overwhelmed before completing cache pre-population. Increasing the deregistration delay timeout ensures that during Auto Scaling group scale-in, active checkout connections have sufficient time to complete their transactions before the target is fully deregistered and terminated, avoiding HTTP 504 Gateway Timeout errors.

Step-by-Step Solution

Address the initialization overload issue by enabling slow start.

The Application Load Balancer will linearly ramp up the volume of requests sent to newly registered EC2 instances, giving them time to populate their local database cache before handling full production load.

Newly launched instances require a warm-up period to initialize caches without being overwhelmed by immediate full request volumes.

Address the connection termination issue during scale-in by adjusting the deregistration delay.

The Application Load Balancer will keep existing connections open for the specified duration, allowing active checkout requests to complete before the instances are terminated.

Without a sufficient deregistration delay, active client requests are terminated abruptly when the Auto Scaling group terminates instances during scale-in, causing client-side HTTP 504 errors.

Key Concept

Application Load Balancer Target Group configuration (Slow Start and Deregistration Delay) to manage EC2 instance lifecycle under Auto Scaling events.

Estimated Time:2m 0s

Question 563Question →

A financial analytics firm is designing a high-performance computing (HPC) pipeline on AWS to process market datasets. The pipeline runs on a cluster of 50 Linux-based Amazon EC2 instances that require concurrent, shared access to a file system. The storage solution must deliver sub-millisecond latencies, support throughput up to $12\text{ GB/s}$ , and integrate directly with an Amazon S3 data lake to load and write back data. Which two AWS storage configurations will satisfy these requirements? (Select two.)

Select all that apply

Create an Amazon FSx for Lustre file system using SSD storage and configure a data repository association linked to the Amazon S3 bucket.

Select the Persistent SSD deployment type for the FSx for Lustre file system to achieve the required throughput and latency.

Provision an Amazon EBS gp3 volume and enable Multi-Attach to share the volume across the EC2 instances.

Create an Amazon EFS file system configured with Elastic throughput and mount it on all 50 EC2 instances.

Deploy an Amazon FSx for Windows File Server file system with HDD storage linked to the S3 bucket.

Show answer & explanation

Answer: Create an Amazon FSx for Lustre file system using SSD storage and configure a data repository association linked to the Amazon S3 bucket.; Select the Persistent SSD deployment type for the FSx for Lustre file system to achieve the required throughput and latency.

Answer

Create an Amazon FSx for Lustre file system using SSD storage with a data repository association linked to the Amazon S3 bucket, and select the Persistent SSD deployment type for the file system.

The correct options are to create an Amazon FSx for Lustre file system using SSD storage with a data repository association linked to the Amazon S3 bucket, and select the Persistent SSD deployment type. FSx for Lustre is designed for high-performance computing (HPC) workloads, offering sub-millisecond latencies and massive throughput. The Persistent SSD deployment type provides high-throughput durable storage, while the data repository association enables seamless integration with the Amazon S3 data lake.

Step-by-Step Solution

Evaluate the workload requirements.

Identify that the system requires shared concurrent access for 50 instances, sub-millisecond latencies,

12\text{ GB/s}

throughput, and native integration with Amazon S3.

This establishes the constraints needed to choose between EBS, EFS, and FSx solutions.

Eliminate incompatible storage systems.

EBS gp3 is ruled out because it lacks Multi-Attach support and is limited to 16 instances. EFS is ruled out due to higher typical latencies (low millisecond) and lack of native data repository integration with S3. FSx for Windows File Server is ruled out due to OS incompatibility and insufficient performance of HDD storage.

Eliminating unsuitable technologies narrows the choices to FSx for Lustre.

Select the correct FSx for Lustre configurations.

Choose Amazon FSx for Lustre with SSD storage and a data repository association to link to S3. Select the Persistent SSD deployment type to provide durable, low-latency, and high-throughput storage.

This configuration meets all latency, throughput, scale, and integration requirements.

Key Concept

High-Performance Storage with FSx for Lustre and S3 Integration

Question 564Question →

A solutions architect is designing a secure architecture for a microservice-based payment application. The application must securely store API keys for a third-party payment gateway. Additionally, the application requires encrypting customer profiles stored in an Amazon DynamoDB table using a customer managed key (CMK) that is automatically rotated. The company requires that historical data encrypted under the CMK remains readable after rotation without manual intervention or data re-encryption. Which TWO actions should the solutions architect take to meet these security requirements? (Select TWO.)

Select all that apply

Store the payment gateway API keys in AWS Secrets Manager and configure automatic rotation for the secrets.

Create a symmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this key.

Store the payment gateway API keys in AWS Systems Manager Parameter Store as a parameter of type String.

Create an asymmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this key.

Create a symmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and execute a custom script to decrypt and re-encrypt all historical DynamoDB items under the new key version.

Show answer & explanation

Answer: Store the payment gateway API keys in AWS Secrets Manager and configure automatic rotation for the secrets.; Create a symmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this key.

Answer

Store the API keys in AWS Secrets Manager with automatic rotation, and use a symmetric customer managed key in AWS KMS with automatic key rotation enabled for the DynamoDB table.

The correct options are to store the API keys in AWS Secrets Manager and to use a symmetric customer managed KMS key with automatic key rotation enabled for DynamoDB. Secrets Manager securely stores and automatically rotates API keys. A symmetric customer managed KMS key is the correct key type for DynamoDB encryption and supports automatic key rotation. Since KMS transparently keeps the older key versions to decrypt historical data, no manual re-encryption is required.

Step-by-Step Solution

Select a secure storage solution for third-party API keys.

AWS Secrets Manager is chosen because it securely encrypts secrets at rest and supports built-in automatic rotation.

Storing credentials in plaintext (like SSM Parameter Store String type) is insecure, while Secrets Manager provides secure lifecycle management for API keys.

Select the correct KMS key type and rotation policy for DynamoDB.

A symmetric customer managed KMS key with automatic rotation enabled is configured.

DynamoDB supports encryption at rest with KMS keys. Symmetrical KMS keys support automatic annual rotation, whereas asymmetric keys do not support automatic rotation.

Evaluate decryption requirements for historical data.

Verify that no manual re-encryption is needed.

AWS KMS automatically retains the older backing key material to decrypt historical data encrypted under previous versions of the key.

Key Concept

AWS KMS automatic rotation for symmetric keys automatically retains older key versions to decrypt historical data, and AWS Secrets Manager provides secure storage and rotation for API credentials.

Question 565Question →

A company stores large volumes of sensitive transactional data in an Amazon S3 bucket. The data is encrypted at rest using Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS). Due to high read and write request volumes, the company is experiencing high AWS KMS costs and is occasionally throttled by AWS KMS API limits. Which action should the solutions architect take to resolve this issue with minimal changes to the application?

Enable automatic key rotation on the KMS Customer Managed Key to distribute the cryptographic workload.

Configure SSE-S3 encryption for the S3 bucket, and store the plaintext encryption keys as String parameters in Systems Manager Parameter Store to perform client-side encryption.

Configure the Amazon S3 bucket to use an S3 Bucket Key for server-side encryption.

Deploy an S3 Gateway Endpoint in the VPC and route all AWS KMS API traffic through it to eliminate KMS request charges.

Show answer & explanation

Answer: Configure the Amazon S3 bucket to use an S3 Bucket Key for server-side encryption.

Answer

Configure the Amazon S3 bucket to use an S3 Bucket Key for server-side encryption.

Configuring an Amazon S3 Bucket Key for server-side encryption allows S3 to use a bucket-level key derived from AWS KMS. This key is used to encrypt new objects in the bucket, significantly reducing the volume of calls S3 makes to AWS KMS (by up to 99%). This reduces costs and mitigates API throttling without any modifications to the application.

Step-by-Step Solution

Analyze the cause of high AWS KMS costs and throttling.

The issue is caused by the high volume of direct API requests from Amazon S3 to AWS KMS for encrypting and decrypting individual objects.

Each S3 read/write operation under standard SSE-KMS generates a call to AWS KMS to decrypt or generate a data key.

Evaluate solutions that reduce the frequency of direct KMS API calls.

Amazon S3 Bucket Keys reduce KMS request traffic by deriving key material at the bucket level instead of making a KMS call per object.

An S3 Bucket Key serves as a temporary, bucket-level key cached by S3, minimizing KMS API interactions.

Implement the S3 Bucket Key configuration.

AWS KMS request traffic is reduced by up to 99%, resolving both the high costs and throttling limits.

This is a configuration change on the S3 bucket level and requires zero changes to application code.

Key Concept

Amazon S3 Bucket Keys for SSE-KMS

Question 566Question →

A company runs a data processing application on Amazon EC2 instances located in the private subnets of a VPC. The application must regularly download software updates from an external repository on the public internet and upload large processed datasets to an Amazon S3 bucket. The company wants to minimize data transfer costs and ensure that the network configuration follows security best practices. Which TWO configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.

Deploy a NAT Gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for

0.0.0.0/0

to the NAT Gateway.

Route all Amazon S3 traffic through the NAT Gateway to the public S3 endpoints to simplify routing and avoid creating additional VPC endpoints.

Add an inbound rule to the security group of the Amazon EC2 instances to allow return traffic on ephemeral ports (

1024 - 65535

) from the NAT Gateway.

Configure the private subnet Network ACL with an outbound rule allowing traffic to the external repository, and rely on the Network ACL's stateful packet inspection to automatically permit response traffic.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.; Deploy a NAT Gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for $0.0.0.0/0$ to the NAT Gateway.

Answer

The correct configurations are to create a Gateway VPC Endpoint for Amazon S3 associated with the private subnet route tables, and to deploy a NAT Gateway in a public subnet with a route for outbound internet traffic in the private subnet route tables.

Creating a Gateway VPC Endpoint for Amazon S3 allows instances in the private subnets to securely transfer data to S3 without using a NAT Gateway, avoiding data processing charges. Deploying a NAT Gateway in a public subnet and routing

0.0.0.0/0

traffic from the private subnets through it allows the private instances to download updates from the public internet safely.

Step-by-Step Solution

Analyze the requirements for internet egress and AWS service access.

The application needs access to the public internet for software updates and access to Amazon S3 for data uploads.

This establishes the routing paths needed: one for public internet traffic and one for Amazon S3 traffic.

Identify the most secure and cost-effective method to access Amazon S3 from private subnets.

A Gateway VPC Endpoint for Amazon S3 is selected.

Gateway VPC Endpoints are free and allow private subnets to communicate with Amazon S3 without traversing the internet or incurring NAT Gateway data transfer charges.

Identify the mechanism for private instances to safely download updates from the internet.

A NAT Gateway is deployed in a public subnet, and the private subnet route table is updated to route outbound internet traffic (

0.0.0.0/0

) through it.

This allows instances in the private subnets to initiate outbound connections to the internet for updates while blocking unsolicited inbound connections from the internet.

Key Concept

VPC Network Security and VPC Endpoint Routing

Estimated Time:2m 0s

Question 567Question →

A media company hosts a microservices application across two different virtual private clouds (VPCs) in the same AWS Region: VPC A ( $10.10.0.0/16$ ) and VPC B ( $10.20.0.0/16$ ). The VPCs are connected using a VPC peering connection. The web microservice in VPC A needs to query a PostgreSQL database cluster running on Amazon EC2 instances in VPC B.

Which configuration should a solutions architect implement to secure network access to the database using the principle of least privilege?

Configure the database security group in VPC B to allow inbound TCP port

5432

traffic from the security group of the web microservice in VPC A.

Configure the database security group in VPC B to allow inbound TCP port

5432

traffic from the CIDR block of VPC A (

10.10.0.0/16

Configure the Network ACL of the database subnet in VPC B to allow inbound TCP port

5432

traffic from the security group of the web microservice in VPC A.

Configure the database security group in VPC B to allow inbound TCP port

5432

traffic from the public IP addresses of the web microservice instances in VPC A.

Show answer & explanation

Answer: Configure the database security group in VPC B to allow inbound TCP port $5432$ traffic from the security group of the web microservice in VPC A.

Answer

Configure the database security group in VPC B to allow inbound TCP port

5432

traffic from the security group of the web microservice in VPC A.

Referencing the security group ID of the web microservice in the database's security group rule is the recommended AWS best practice for peered VPCs. This ensures that only the instances explicitly associated with the web microservice security group can access the PostgreSQL database on port

5432

, maintaining strict isolation.

Step-by-Step Solution

Identify the network connection type.

The VPCs are peered via a VPC peering connection, meaning traffic routes privately using private IP addresses.

This rules out solutions using public IP addresses or public network gateways.

Determine the capabilities of security groups across peered VPCs.

AWS security groups can reference other security groups in peered VPCs as traffic sources or destinations.

This allows for fine-grained access control based on resource membership rather than broad CIDR blocks.

Evaluate the stateful vs. stateless resource control mechanisms.

Security groups are stateful and can filter traffic based on security group IDs, while Network ACLs are stateless and can only filter by CIDR blocks.

This confirms that referencing the web microservice security group within the database's security group is the only way to achieve least-privilege security.

Key Concept

Security Group Referencing across VPC Peering

Estimated Time:1m 30s

Question 568Question →

A global financial analytics firm hosts a critical risk modeling application on-premises that generates massive datasets. The firm needs to migrate its storage backend to AWS. The architecture must store the generated datasets in a highly durable storage tier that is replicated to a secondary AWS region for disaster recovery (DR). The system must meet a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 10 minutes for accessing the DR datasets. The datasets must be immediately retrievable in the secondary region in the event of a primary region outage. Additionally, the on-premises application servers require low-latency, local cached access to the active datasets. Which storage architecture meets these requirements with the lowest recovery time and operational complexity?

Deploy an Amazon S3 File Gateway on-premises to cache active datasets locally and store the primary data in an Amazon S3 bucket. Enable S3 Versioning and configure S3 Cross-Region Replication (CRR) with S3 Replication Time Control (S3 RTC) to a secondary region. In the destination bucket, use a lifecycle policy to transition objects immediately to the S3 Glacier Instant Retrieval storage class.

Deploy an AWS Storage Gateway Volume Gateway in cached volume mode on-premises. Configure volume snapshots to back up data to Amazon S3 in the primary region, and use S3 Cross-Region Replication to copy snapshots to the secondary region. Use an S3 Lifecycle policy to transition the replicated snapshots to the S3 Glacier Flexible Retrieval storage class, using Standard retrieval during a disaster.

Deploy an Amazon EFS File Gateway on-premises. Configure Amazon EFS Replication to copy data to a secondary region. Set up an Amazon RDS Multi-AZ DB instance in the primary region and create an RDS Read Replica in the secondary region, configuring the replica as the primary automatic failover target for database transaction records.

Deploy an Amazon S3 File Gateway on-premises. Configure S3 Same-Region Replication (SRR) in the primary region, and write a custom AWS Lambda function to copy objects to the secondary region's bucket. Set up the secondary region as a Pilot Light environment, relying on manual service activation to access the data during a failover event.

Show answer & explanation

Answer: Deploy an Amazon S3 File Gateway on-premises to cache active datasets locally and store the primary data in an Amazon S3 bucket. Enable S3 Versioning and configure S3 Cross-Region Replication (CRR) with S3 Replication Time Control (S3 RTC) to a secondary region. In the destination bucket, use a lifecycle policy to transition objects immediately to the S3 Glacier Instant Retrieval storage class.

Answer

The correct architecture uses Amazon S3 File Gateway to maintain an on-premises local cache for low-latency active file access while storing the primary copy in Amazon S3. To meet the 15-minute RPO, S3 Replication Time Control (S3 RTC) is enabled for Cross-Region Replication, which guarantees that 99.9% of objects are copied to the secondary region within 15 minutes. To meet the 10-minute RTO for the DR datasets, the destination bucket uses the S3 Glacier Instant Retrieval storage class, which provides millisecond retrieval speeds at lower storage costs.

Step-by-Step Solution

Address the local low-latency requirement.

Amazon S3 File Gateway provides a local cache for frequently accessed files using standard file protocols (NFS/SMB) while using Amazon S3 as the backend.

This satisfies the requirement for on-premises servers to have low-latency cached access.

Select a replication mechanism that guarantees the 15-minute RPO.

S3 Cross-Region Replication (CRR) with S3 Replication Time Control (S3 RTC) is configured.

S3 RTC guarantees replication of 99.9% of objects within 15 minutes, meeting the 15-minute RPO with a backed SLA.

Ensure the disaster recovery storage class meets the 10-minute RTO cost-effectively.

Objects are transitioned to the S3 Glacier Instant Retrieval storage class in the secondary region.

S3 Glacier Instant Retrieval provides millisecond retrieval times (meeting the 10-minute RTO) for archived data, offering lower storage costs compared to S3 Standard.

Key Concept

Disaster recovery architectures using AWS Storage Gateway, S3 Replication Time Control (RTC), and high-availability storage classes.

Estimated Time:3m 0s

Question 569Question →

An enterprise is deploying a microservice application on Amazon ECS. The application requires access to a Microsoft SQL Server database running on Amazon RDS. The security team mandates that the database credentials must be encrypted at rest and rotated every 30 days without downtime or manual intervention. Which strategy should a solutions architect recommend to meet these requirements with the least operational overhead?

Store the database credentials in AWS Secrets Manager. Configure automatic rotation using the built-in Secrets Manager rotation template integrated with a helper AWS Lambda function.

Store the credentials as a plaintext String parameter in AWS Systems Manager Parameter Store. Write a scheduled Amazon EventBridge rule that triggers an AWS Lambda function to update the database password.

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Enable AWS KMS automatic key rotation on the customer managed key used for encryption to automatically rotate the underlying credentials.

Store the credentials as a plaintext String parameter in AWS Systems Manager Parameter Store, and configure an IAM policy that allows only the application's ECS task execution role to decrypt the parameter.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager. Configure automatic rotation using the built-in Secrets Manager rotation template integrated with a helper AWS Lambda function.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in Secrets Manager rotation template integrated with a helper AWS Lambda function.

AWS Secrets Manager is specifically designed for database credential management. It encrypts secrets at rest using AWS Key Management Service (KMS) and provides built-in integration with AWS Lambda to rotate credentials automatically. By using the provided rotation templates for Amazon RDS databases, a solutions architect can achieve automatic rotation with minimal operational effort.

Step-by-Step Solution

Select a secure, encrypted storage service that supports automatic credential rotation.

AWS Secrets Manager is selected because it integrates directly with AWS KMS for encryption at rest and natively supports secret rotation.

Systems Manager Parameter Store SecureString parameters support encryption but do not have built-in, out-of-the-box automatic rotation for database credentials.

Configure the rotation mechanism for the database credentials.

Use the native integration in AWS Secrets Manager to configure a Lambda function based on the standard rotation template for RDS.

This configuration automatically updates the database password on both the database instance and the stored secret, avoiding manual intervention and minimizing operational overhead.

Key Concept

AWS Secrets Manager provides native support for the lifecycle management, encryption, and automatic rotation of sensitive credentials like database passwords.

Estimated Time:1m 30s

Question 570Question →

A company needs to grant an external compliance audit firm temporary access to audit logs stored in a private Amazon S3 bucket. The audit firm has its own AWS account. The company wants to ensure that the audit firm can access the logs securely without sharing long-term AWS credentials, adhering to the principle of least privilege. Which solution should a solutions architect recommend to meet these requirements?

Create a dedicated IAM user in the company's account for the audit firm. Attach a policy allowing read-only access to the S3 bucket, generate long-term access keys, and share these credentials with the audit firm.

Generate a pre-signed S3 URL using the company's AWS account root user credentials, and provide the URL to the audit firm to download the logs directly.

Create an IAM role in the company's account with a trust policy that allows the audit firm's AWS account to assume the role. Attach an IAM policy to the role that allows read-only access to the specific S3 bucket. Provide the IAM role ARN to the audit firm.

Store the S3 access credentials as a plaintext parameter in AWS Systems Manager Parameter Store, and configure the S3 bucket policy to allow public access filtered by the audit firm's IP address range.

Show answer & explanation

Answer: Create an IAM role in the company's account with a trust policy that allows the audit firm's AWS account to assume the role. Attach an IAM policy to the role that allows read-only access to the specific S3 bucket. Provide the IAM role ARN to the audit firm.

Answer

Create an IAM role in the company's account with a trust policy that allows the audit firm's AWS account to assume the role, attach a read-only policy to the S3 bucket, and provide the role ARN.

The correct solution uses an IAM role with a trust policy allowing cross-account access. By using IAM roles, the audit firm can assume the role to obtain temporary security credentials, avoiding the need to share long-term credentials. Applying a read-only policy to the specific S3 bucket ensures the principle of least privilege is maintained.

Step-by-Step Solution

Determine the credential requirement for third-party cross-account access.

Identify that temporary credentials via IAM roles are preferred over long-term IAM user credentials to meet security best practices.

IAM roles allow users or services from another AWS account to obtain temporary security credentials via the AWS Security Token Service (STS).

Configure the IAM role trust policy and permission policy.

Define a trust policy pointing to the third party's AWS account and a permission policy granting read-only access to the target S3 bucket.

This establishes trust between accounts while enforcing the principle of least privilege on the destination resource.

Provide the role ARN to the third party.

The third-party audit firm can now configure their applications or CLI to assume the role.

This allows the external entity to retrieve temporary credentials and perform the audit tasks without storing long-term credentials.

Key Concept

Cross-Account IAM Roles and Temporary Credentials

Question 571Question →

A company is migrating a multi-tier application to AWS. The application consists of microservices running on AWS Fargate that require access to two different credentials: a database password for an Amazon RDS for PostgreSQL database that must be automatically rotated every 14 days, and a third-party API key that rarely changes but must be encrypted at rest using a customer managed key (CMK) with minimum retrieval cost. Which combination of actions should a solutions architect take to meet these requirements securely and cost-effectively? (Select TWO.)

Select all that apply

Store the PostgreSQL database credentials in AWS Secrets Manager, and configure the secret to rotate automatically using the database's built-in RDS rotation function.

Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter, specifying the customer managed KMS key for encryption.

Store the database credentials in Systems Manager Parameter Store as a String parameter, and create a custom AWS Lambda function to update the database password every 14 days.

Store the database credentials in Systems Manager Parameter Store as a SecureString parameter, and configure AWS KMS customer managed key automatic rotation to rotate the database password every 14 days.

Store the API key in Systems Manager Parameter Store as a String parameter, and enable the default KMS automatic annual rotation for the parameter storage.

Show answer & explanation

Answer: Store the PostgreSQL database credentials in AWS Secrets Manager, and configure the secret to rotate automatically using the database's built-in RDS rotation function.; Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter, specifying the customer managed KMS key for encryption.

Answer

Store the database credentials in AWS Secrets Manager with built-in RDS PostgreSQL automatic rotation, and store the API key in Systems Manager Parameter Store as a SecureString parameter encrypted with the customer managed KMS key.

For the database credentials, AWS Secrets Manager is the correct choice because it natively manages database secrets and supports automatic rotation for RDS databases out-of-the-box. For the static API key, storing it as a SecureString in Systems Manager Parameter Store is the most secure and cost-effective approach since it supports encryption with customer managed KMS keys and has no storage costs for standard parameters.

Step-by-Step Solution

Analyze rotation requirements for database credentials.

The database credentials require automatic rotation every 14 days. Secrets Manager supports native, automatic rotation templates for Amazon RDS databases.

Using AWS Secrets Manager satisfies the automatic rotation requirement without building custom logic.

Analyze encryption and cost requirements for static secrets.

The third-party API key is static but must be encrypted at rest using a customer managed KMS key. Parameter Store with SecureString parameters supports customer managed KMS keys and provides standard parameter storage at no cost.

Using Systems Manager Parameter Store SecureString parameters for static secrets is more cost-effective than using Secrets Manager, which incurs a monthly cost per secret and additional retrieval fees.

Key Concept

Selecting the appropriate secrets management service based on rotation needs, encryption requirements, and cost-efficiency.

Estimated Time:2m 0s

Question 572Question →

A company is deploying a fleet of web servers on Amazon EC2 instances that must concurrently access a single shared file system. The storage solution must support standard file system protocols and scale automatically to handle throughput spikes. Which AWS storage service should a solutions architect select?

Amazon Elastic File System (Amazon EFS)

Amazon Elastic Block Store (Amazon EBS) gp3 volume

Amazon EBS io2 volume with Multi-Attach enabled

Amazon S3 Glacier Flexible Retrieval

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS)

Answer

Amazon Elastic File System (Amazon EFS)

Amazon Elastic File System (Amazon EFS) is correct because it is a managed file storage service that allows multiple EC2 instances to connect concurrently using standard NFSv4, scaling capacity and throughput automatically as files are added.

Step-by-Step Solution

Analyze the business scenario and identify the access requirements.

Multiple Amazon EC2 instances require concurrent read/write access to a single file system.

This rules out standard Amazon EBS gp3 block storage volumes which can only be attached to a single instance at a time.

Determine the required protocol and storage characteristics.

The solution must support standard file system protocols (NFSv4) and scale throughput automatically.

Amazon EFS supports standard file-level protocols, scales automatically, and supports concurrent access, making it the appropriate choice.

Key Concept

Differentiating between block storage (EBS) and fully managed shared file storage (EFS) for concurrent instance access.

Question 573Question →

A company is migrating a web application to Amazon EC2 instances. The application requires access to an Amazon RDS for PostgreSQL database. To comply with security policies, the database credentials must be encrypted at rest and automatically rotated every 30 days without causing application downtime. Which combination of actions should a solutions architect perform to meet these requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager.

Configure AWS Secrets Manager to rotate the database credentials automatically using an AWS Lambda function.

Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store.

Store the database credentials as a SecureString parameter in AWS Systems Manager Parameter Store and enable automatic annual rotation of the customer managed AWS KMS key.

Store the database credentials in a plaintext environment variable within the EC2 instance launch template.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager.; Configure AWS Secrets Manager to rotate the database credentials automatically using an AWS Lambda function.

Answer

Store the database credentials in AWS Secrets Manager, and configure AWS Secrets Manager to rotate the database credentials automatically using an AWS Lambda function.

AWS Secrets Manager is designed specifically to secure database credentials. Storing credentials in Secrets Manager ensures encryption at rest, and configuring Secrets Manager automatic rotation via an AWS Lambda function updates both the secret and the Amazon RDS database, fulfilling all requirements securely without downtime.

Step-by-Step Solution

Identify the service that supports secure secret storage and native automatic rotation.

AWS Secrets Manager is chosen over Systems Manager Parameter Store because Secrets Manager natively supports automatic rotation of database credentials.

Parameter Store does not have built-in support for rotating credentials on a schedule.

Enable automatic rotation for the secret.

Configure AWS Secrets Manager with a rotation schedule and an AWS Lambda function to update the database credentials.

Secrets Manager uses a Lambda function to update the credentials in both Secrets Manager and the target Amazon RDS database concurrently without downtime.

Key Concept

AWS Secrets Manager is the standard service for storing, encrypting, and automatically rotating database credentials.

Question 574Question →

An enterprise is designing a secure multi-account environment to support multiple business units. The architecture must enforce centralized administrative control, federated access, and strict data protection policies. Specifically, the Solutions Architect must ensure that member accounts cannot delete Amazon S3 buckets containing centralized audit logs, and that employees authenticate using their corporate credentials to access designated AWS accounts.

Which combination of actions should the Solutions Architect recommend to achieve these goals? (Select TWO.)

Select all that apply

Configure AWS IAM Identity Center and integrate it with the enterprise identity provider to federate user access.

Attach a service control policy (SCP) to the member account organizational units (OUs) that denies the s3:DeleteBucket and s3:DeleteObject actions on the centralized audit log buckets.

Create individual IAM users in each member account and configure cross-account roles with trust policies linked directly to the enterprise identity provider.

Apply a service control policy (SCP) at the Organization root level that restricts the management account root user from performing deletion actions on the log buckets.

Configure each member account's root user credentials to run a scheduled AWS Lambda function that periodically audits and restores deleted S3 log buckets.

Show answer & explanation

Answer: Configure AWS IAM Identity Center and integrate it with the enterprise identity provider to federate user access.; Attach a service control policy (SCP) to the member account organizational units (OUs) that denies the s3:DeleteBucket and s3:DeleteObject actions on the centralized audit log buckets.

Answer

To establish secure multi-account governance, configure AWS IAM Identity Center integrated with the enterprise identity provider to federate user access, and apply a service control policy (SCP) to the member account organizational units (OUs) to deny bucket and object deletion actions on the centralized audit log buckets.

Centralizing access control through AWS IAM Identity Center integrated with the corporate identity provider ensures safe, federated access without the need for manual credential management. Applying a service control policy (SCP) to the member account OUs establishes a strong security guardrail, preventing anyone—including local administrators—from deleting critical audit log resources.

Step-by-Step Solution

Set up centralized federation.

Connect AWS IAM Identity Center to the corporate identity provider (IdP).

Allows employees to authenticate using existing corporate credentials and access their assigned AWS accounts dynamically via role assumption, avoiding the creation of static, local IAM users.

Enforce data protection via Organizations.

Create a service control policy (SCP) with a Deny effect for s3:DeleteBucket and s3:DeleteObject actions targeting the audit log buckets, and attach it to the OUs containing the member accounts.

SCPs act as permission guardrails that override local administrator permissions in member accounts, ensuring that log deletion is blocked across all target accounts.

Key Concept

Multi-account governance through AWS Organizations service control policies (SCPs) and centralized identity federation using AWS IAM Identity Center.

Estimated Time:2m 30s

Question 575Question →

An enterprise wants to allow a third-party SaaS monitoring application to collect performance metrics from Amazon CloudWatch in their AWS account. The SaaS provider's application runs in its own AWS account. The solutions architect must configure this access securely following the principle of least privilege, preventing unauthorized access by other customers of the SaaS provider.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create an IAM role in the enterprise account with a trust policy that trusts the SaaS provider's AWS account and requires a unique External ID

Attach a permissions policy to the IAM role that grants read-only access to Amazon CloudWatch metrics

Create an IAM user in the enterprise account, assign CloudWatch read-only permissions, and share the user's access keys with the SaaS provider

Share the enterprise account's root user access keys with the SaaS provider to ensure unrestricted access to all metrics

Store the API tokens and credentials used by the SaaS agent as a plaintext parameter in AWS Systems Manager Parameter Store

Show answer & explanation

Answer: Create an IAM role in the enterprise account with a trust policy that trusts the SaaS provider's AWS account and requires a unique External ID; Attach a permissions policy to the IAM role that grants read-only access to Amazon CloudWatch metrics

Answer

To securely grant access to the third-party SaaS monitoring application, the solutions architect should create an IAM role in the enterprise account with a trust policy that requires a unique External ID and trusts the SaaS provider's AWS account. Additionally, a permissions policy granting read-only access to Amazon CloudWatch metrics must be attached to this role.

The correct combination of steps involves creating an IAM role in the enterprise account that trusts the third-party's AWS account and enforces an External ID, and then attaching a CloudWatch read-only permissions policy to that role. This enables secure cross-account delegation of access without using long-term credentials and prevents the confused deputy security vulnerability.

Step-by-Step Solution

Identify the correct cross-account access mechanism.

Determine that an IAM role with cross-account access is preferred over long-term credentials.

Using roles eliminates the need to manage and share long-term credentials like access keys.

Secure the trust relationship for the role.

Specify the third party's AWS account ID in the trust policy and require a unique External ID.

The External ID mitigates the confused deputy problem when a third party accesses multiple customer accounts.

Apply the principle of least privilege.

Attach a permissions policy to the IAM role that only allows read-only access to CloudWatch metrics.

This ensures that the monitoring application can only access the metrics it needs and cannot perform administrative changes.

Key Concept

Cross-account access using IAM roles and External IDs to secure third-party integration.

Question 576Question →

A financial services company has deployed a secure three-tier web application. The application tier runs on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application listens on custom TCP port $8443$ . The security team has configured Network ACLs (NACLs) to allow only HTTPS traffic on TCP port $443$ between the ALB subnets and the application subnets. The ALB target group has health checks configured to query TCP port $8443$ . After deployment, the operations team notices that all EC2 instances are repeatedly marked as unhealthy by the target group and subsequently terminated and replaced by the ASG, even though local tests confirm the application process is running and responding on port $8443$ . Which of the following configuration modifications will resolve the health check failures and stabilize the Auto Scaling group?

Update the Network ACLs to allow outbound traffic on TCP port

8443

from the ALB subnets and inbound traffic on TCP port

8443

to the application subnets, while also allowing traffic on ephemeral TCP ports

1024

65535

in both directions to accommodate stateless return communication.

Change the target group health check port configuration to standard TCP port

80

443

, allowing the ALB to perform health checks on standard web ports while client traffic continues to flow to the application on port

8443

Configure the application instances' security groups to be stateless to allow inbound traffic on port

8443

, and modify the Network ACLs to be stateful so they automatically permit the returning ephemeral port traffic from the instances to the ALB.

Configure Amazon Route 53 Latency routing with active-passive failover to redirect client requests directly to a secondary static page, bypass the ALB's health check threshold settings, and configure the ASG to use EC2 health checks instead of ELB health checks.

Show answer & explanation

Answer: Update the Network ACLs to allow outbound traffic on TCP port $8443$ from the ALB subnets and inbound traffic on TCP port $8443$ to the application subnets, while also allowing traffic on ephemeral TCP ports $1024$ - $65535$ in both directions to accommodate stateless return communication.

Answer

Update the Network ACLs to allow outbound traffic on TCP port

8443

from the ALB subnets and inbound traffic on TCP port

8443

to the application subnets, while also allowing traffic on ephemeral TCP ports

1024

65535

in both directions to accommodate stateless return communication.

The correct solution involves modifying the stateless Network ACLs to allow the traffic on port

8443

between the ALB subnets and the application subnets, along with allowing return traffic on the ephemeral port range (

1024

65535

). Because NACLs are stateless, they evaluate traffic in each direction independently, meaning rules must cover both the outbound/inbound request path and the inbound/outbound response path.

Step-by-Step Solution

Analyze the application port and protocol configuration.

The application listens on custom TCP port

8443

, and the ALB target group is configured to run health checks on this same port (

8443

This establishes that traffic from the ALB to the instances for both health checks and standard routing must use port

8443

Examine the Network ACL (NACL) rules currently in place.

The NACLs are currently configured to only allow HTTPS traffic on port

443

between the subnets.

Because NACLs are stateless, they must explicitly allow both the request and response paths for any network connection. Since the traffic between the ALB and the targets is on port

8443

, the current rules block this traffic.

Formulate the required NACL updates.

Inbound rules for application subnets must allow port

8443

from the ALB subnet. Outbound rules for ALB subnets must allow port

8443

to the application subnets. Return traffic must be allowed on ephemeral ports (

1024

65535

) in both directions.

This ensures the ALB can successfully send health check requests and application traffic to the targets on port

8443

and receive the responses back, resolving the health check failure.

Key Concept

Understanding Elastic Load Balancing target group health checks on custom ports and the stateless nature of Network ACLs in an AWS VPC.

Question 577Question →

A multinational corporation is implementing a centralized deployment pipeline. A containerized microservice hosted on Amazon ECS in a Shared Services account (Account ID: $888888888888$ ) must dynamically retrieve runtime secrets and database credentials from AWS Secrets Manager located in a Production database account (Account ID: $999999999999$ ). The Secrets Manager secret is encrypted using a Customer Managed Key (CMK) in the Production database account. The container in Account $888888888888$ runs under an IAM task role named `EcsSharedTaskRole`. The architecture must enforce the principle of least privilege and prevent the storage of long-term credentials.

Which combination of configuration steps is required to securely enable this cross-account retrieval? (Select TWO.)

Select all that apply

Attach an identity-based policy to `EcsSharedTaskRole` in Account

888888888888

that allows `secretsmanager:GetSecretValue` on the Production secret ARN and `kms:Decrypt` on the Customer Managed Key ARN. Update the secret's resource-based policy in Account

999999999999

to grant `secretsmanager:GetSecretValue` to the `EcsSharedTaskRole` ARN.

Configure the key policy of the Customer Managed Key in Account

999999999999

to grant `kms:Decrypt` permissions to `arn:aws:iam::888888888888:role/EcsSharedTaskRole`.

Create a dedicated IAM user in Account

999999999999

with a permission policy allowing secrets retrieval, generate long-term access keys, and configure the ECS task definition to pass these keys as environment variables to the container.

Replicate the secret values into the Systems Manager Parameter Store in Account

888888888888

as standard, unencrypted parameters to eliminate the need for cross-account KMS decryption and IAM task role configuration.

Configure the ECS task to run using the AWS account root user credentials of Account

888888888888

, and update the KMS key policy in Account

999999999999

to trust the root user of Account

888888888888

for all actions.

Show answer & explanation

Answer: Attach an identity-based policy to `EcsSharedTaskRole` in Account $888888888888$ that allows `secretsmanager:GetSecretValue` on the Production secret ARN and `kms:Decrypt` on the Customer Managed Key ARN. Update the secret's resource-based policy in Account $999999999999$ to grant `secretsmanager:GetSecretValue` to the `EcsSharedTaskRole` ARN.; Configure the key policy of the Customer Managed Key in Account $999999999999$ to grant `kms:Decrypt` permissions to `arn:aws:iam::888888888888:role/EcsSharedTaskRole`.

Answer

The correct configuration requires attaching an identity-based policy to the task role that allows secrets retrieval and decryption, granting the task role access in the secret's resource policy, and updating the KMS key policy to permit decryption by the task role.

To establish secure cross-account access to an encrypted secret in Secrets Manager, you must grant permissions on both sides of the account boundary. First, the IAM identity (the task role) in the consuming account must have an identity-based policy that allows accessing the secret and using the KMS key. Second, the secret's resource-based policy must explicitly permit the consuming role. Third, the KMS key policy in the producing account must trust the consuming role to perform decrypt operations. This direct delegation configuration satisfies the principle of least privilege.

Step-by-Step Solution

Configure identity-based permissions in the source account

The ECS task role has the necessary permissions to call cross-account APIs.

Before an IAM identity can access a resource in another account, it must be explicitly permitted by its own identity-based policy.

Configure the resource-based policy on the target secret

Secrets Manager permits the cross-account role to retrieve the secret value.

Cross-account access requires permission from the resource owner; the resource-based policy must explicitly list the external IAM role as an allowed principal.

Configure the KMS key policy on the Customer Managed Key

The external IAM role is allowed to decrypt the data key used to encrypt the secret payload.

Since the secret is encrypted with a Customer Managed Key, the key policy must trust the cross-account role principal. Identity-based policies alone cannot grant access to cross-account KMS keys without key policy cooperation.

Key Concept

Cross-account access delegation using IAM roles, resource-based policies, and KMS key policies under the principle of least privilege.

Question 578Question →

A company is designing a hybrid network architecture to replicate a database from an on-premises data center to AWS. The database replication traffic requires a continuous, stable throughput of $8\text{ Gbps}$ , minimum latency, and encryption in transit. The architecture must connect to five VPCs in a single AWS Region. Which network architecture will meet these requirements with the highest performance and least administrative complexity?

Establish a

10\text{ Gbps}

AWS Direct Connect connection with MACsec encryption enabled, configure a Transit Virtual Interface to an AWS Transit Gateway, and attach the five VPCs to the Transit Gateway.

Create a single AWS Site-to-Site VPN connection over the internet to a Transit Gateway, relying on default routing to automatically aggregate tunnel bandwidth to handle the database replication stream.

Establish a

10\text{ Gbps}

AWS Direct Connect connection with a Private Virtual Interface, configure a full mesh of VPC Peering connections to connect all five VPCs, and configure stateless Network ACLs to enforce encryption at the subnet boundary.

Set up multiple AWS Site-to-Site VPN connections to Virtual Private Gateways in each VPC, and use Amazon Route 53 latency-based routing policies to scale the replication bandwidth dynamically across all VPN connections.

Show answer & explanation

Answer: Establish a $10\text{ Gbps}$ AWS Direct Connect connection with MACsec encryption enabled, configure a Transit Virtual Interface to an AWS Transit Gateway, and attach the five VPCs to the Transit Gateway.

Answer

Establish a

10\text{ Gbps}

AWS Direct Connect connection with MACsec encryption enabled, configure a Transit Virtual Interface to an AWS Transit Gateway, and attach the five VPCs to the Transit Gateway.

The correct answer provides a high-performance network design. A dedicated

10\text{ Gbps}

AWS Direct Connect connection natively supports the

8\text{ Gbps}

throughput requirement. By enabling MACsec, the traffic is encrypted at the physical link layer (Layer 2) without the encapsulation overhead and

1.25\text{ Gbps}

throughput bottleneck of IPsec VPN tunnels. Using a Transit VIF and AWS Transit Gateway allows the hybrid connection to scale efficiently to multiple VPCs through a centralized hub, minimizing routing complexity.

Step-by-Step Solution

Analyze the bandwidth requirement.

The application requires

8\text{ Gbps}

of continuous throughput, which rules out single standard IPsec VPN connections limited to

1.25\text{ Gbps}

per tunnel.

We must select a network option capable of native multi-gigabit speeds, pointing to AWS Direct Connect.

Evaluate the encryption-in-transit requirement.

Standard Direct Connect does not encrypt traffic in transit. To achieve encryption at line-rate (

10\text{ Gbps}

), MACsec (IEEE 802.1AE) must be enabled on the dedicated Direct Connect connection.

IPsec VPNs over Direct Connect would restrict the throughput per tunnel to

1.25\text{ Gbps}

, whereas MACsec provides Layer 2 encryption without sacrificing speed.

Determine the routing architecture for multiple VPCs.

A Transit Virtual Interface (Transit VIF) connected to an AWS Transit Gateway is the most scalable way to attach five VPCs in a single Region.

Using Transit Gateway simplifies routing management and scales easily compared to managing a complex mesh of VPC peering connections combined with private virtual interfaces.

Key Concept

High-throughput hybrid connectivity utilizing AWS Direct Connect with MACsec encryption and AWS Transit Gateway for scalable routing.

Estimated Time:3m 0s

Question 579Question →

A financial services company is establishing a hybrid network connection between its on-premises data center and a VPC in the AWS Cloud. The company needs to replicate a high-volume transactional database to AWS, requiring a continuous, secure, and encrypted bandwidth of at least $3\text{ Gbps}$ with minimal latency. The solutions architect decides to implement an AWS Site-to-Site VPN over an existing AWS Direct Connect connection.

Which configuration should the solutions architect implement to meet these performance and security requirements?

Configure an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, associate it with a Direct Connect gateway using a transit virtual interface (VIF), and establish multiple Site-to-Site VPN connections terminating on the Transit Gateway.

Attach a virtual private gateway (VGW) to the VPC, associate it with a Direct Connect gateway using a private virtual interface (VIF), and establish a single AWS Site-to-Site VPN connection to encrypt all replication traffic.

Deploy an AWS Site-to-Site VPN connection terminating on a virtual private gateway (VGW) and configure stateless Network Access Control Lists (NACLs) to automatically distribute and parallelize the database replication traffic across multiple private subnets.

Set up multiple active-active AWS Site-to-Site VPN connections and configure Amazon Route 53 with a latency-based routing policy to automatically route database replication traffic across the connections to optimize throughput.

Show answer & explanation

Answer: Configure an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled, associate it with a Direct Connect gateway using a transit virtual interface (VIF), and establish multiple Site-to-Site VPN connections terminating on the Transit Gateway.

Answer

The correct answer utilizes AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled. An AWS Site-to-Site VPN tunnel is restricted to a maximum throughput of

1.25\text{ Gbps}

. To scale beyond this limit and achieve the required

3\text{ Gbps}

bandwidth, multiple VPN tunnels must be established and aggregated. By terminating these VPN connections on an AWS Transit Gateway that has ECMP routing active and is connected via a transit virtual interface (VIF) to a Direct Connect gateway, the network can balance traffic across multiple tunnels, satisfying both the high-throughput performance requirement and the data encryption requirement over Direct Connect.

Step-by-Step Solution

Analyze the bandwidth constraint of the hybrid connection.

The replication workload requires at least

3\text{ Gbps}

of encrypted bandwidth. A single AWS Site-to-Site VPN tunnel has a hard limit of

1.25\text{ Gbps}

of throughput.

Identifying the

1.25\text{ Gbps}

limit per IPsec tunnel ensures that a single VPN connection will not satisfy the

3\text{ Gbps}

requirement.

Determine the scaling mechanism for VPN throughput.

AWS Transit Gateway supports Equal-Cost Multi-Path (ECMP) routing, which enables traffic to be dynamically balanced across multiple VPN tunnels.

By using ECMP on Transit Gateway, multiple VPN tunnels can be aggregated to achieve a cumulative throughput higher than

1.25\text{ Gbps}

Integrate Transit Gateway with the AWS Direct Connect infrastructure.

Associate the Transit Gateway with a Direct Connect gateway utilizing a transit virtual interface (VIF).

A transit VIF is required to connect AWS Direct Connect to an AWS Transit Gateway, allowing the encrypted VPN tunnels to run over the private, low-latency Direct Connect circuit.

Key Concept

Scaling VPN throughput over AWS Direct Connect requires AWS Transit Gateway with ECMP enabled, routing over a transit virtual interface (VIF).

Estimated Time:2m 30s

Question 580Question →

A financial auditing firm is migrating its document management system to AWS. The application runs on Amazon EC2 instances deployed across multiple Availability Zones in the us-west-2 Region and requires concurrent read and write access to a shared file system. The storage solution must sustain the loss of an Availability Zone without data loss or downtime. Additionally, compliance regulations mandate a cross-region disaster recovery strategy with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 30 minutes.

Which storage architecture meets these requirements with the least operational overhead?

Create an Amazon Elastic File System (EFS) file system using the One Zone storage class to reduce cost, and configure an AWS Backup plan to perform cross-region copies to an S3 Glacier Flexible Retrieval vault in the secondary region.

Configure an Amazon Elastic Block Store (EBS) gp3 volume with Multi-Attach enabled, mount it to all EC2 instances across the Availability Zones, and configure AWS Backup to copy snapshots to the secondary region every 15 minutes.

Create an Amazon Elastic File System (EFS) using the Standard storage class in the primary region, and configure Amazon EFS Replication to copy data to a destination EFS file system in the secondary region.

Provision an Amazon RDS PostgreSQL database in a Multi-AZ deployment to store the files, set up a cross-region Read Replica in the secondary region, and configure the application to write directly to the replica during a disaster recovery event.

Show answer & explanation

Answer: Create an Amazon Elastic File System (EFS) using the Standard storage class in the primary region, and configure Amazon EFS Replication to copy data to a destination EFS file system in the secondary region.

Answer

The correct solution uses the Amazon EFS Standard storage class, which natively replicates data across multiple Availability Zones to ensure high availability and prevent downtime during an AZ failure. It pairs this with Amazon EFS Replication to automate cross-region synchronization. EFS Replication operates continuously and asynchronously, aligning with the 15-minute RPO compliance requirement, while keeping the destination file system mounted and ready in the secondary region to satisfy the 30-minute RTO.

Step-by-Step Solution

Evaluate the requirement for concurrent access and high availability.

Amazon EFS Standard provides simultaneous read/write access for multiple EC2 instances across different Availability Zones and replicates data across those AZs to survive failures.

Amazon EBS is restricted to a single Availability Zone (even with Multi-Attach), and EFS One Zone does not span multiple AZs.

Address the disaster recovery metrics (RPO and RTO).

Amazon EFS Replication copies data asynchronously to another AWS Region, meeting an RPO of minutes (well under the 15-minute limit) and a low RTO as the secondary file system is already warm.

Using Glacier vaults for backup recovery introduces significant retrieval delays that would violate the 30-minute RTO.

Select the solution that minimizes operational overhead.

EFS Replication is a native, fully-managed feature that automatically replicates data without custom backup scripting or database configurations.

Relational databases like Amazon RDS are structurally inappropriate for direct shared file storage.

Key Concept

Amazon EFS Replication and Multi-AZ Resiliency

Estimated Time:1m 30s

PreviousPage 29 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept