Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 41Question →

A security architect is designing an access and credentials management solution for a multi-account AWS environment. An application running on Amazon EC2 instances in Account A (111122223333111122223333) must securely retrieve database credentials to connect to a PostgreSQL database in Account B (444455556666444455556666). The database credentials must be rotated every 3030 days without causing application downtime. The solution must adhere to the principle of least privilege, avoid long-term credentials, and ensure all data in transit and at rest is secured using customer-managed keys (CMKs). Which architecture represents the most secure and compliant design that meets these requirements?

Show answer & explanation

Answer: Store the credentials in AWS Secrets Manager in Account B, encrypted with a customer-managed KMS key. Attach an IAM role to the EC2 instances in Account A, and configure the Secrets Manager resource policy and the KMS key policy in Account B to permit the Account A role to retrieve the secret and decrypt using the KMS key. Configure automatic rotation in Secrets Manager using a Lambda function in Account B.

Answer

Store the credentials in AWS Secrets Manager in Account B, encrypted with a customer-managed KMS key. Attach an IAM role to the EC2 instances in Account A, and configure the Secrets Manager resource policy and the KMS key policy in Account B to permit the Account A role to retrieve the secret and decrypt using the KMS key. Configure automatic rotation in Secrets Manager using a Lambda function in Account B.
The correct architecture stores credentials securely in AWS Secrets Manager, which supports automated rotation using a Lambda function. Using resource-based policies on the secret and the KMS key in the database account (Account B) allows the IAM role attached to the EC2 instances in Account A to retrieve and decrypt the secret without needing long-term credentials. This adheres to the principles of least privilege and secure cross-account access.

Step-by-Step Solution

1
Evaluate credential storage and transmission requirements.
Determine that credentials must be stored securely using AWS Secrets Manager in the database account (Account B) rather than Systems Manager Parameter Store in plaintext, and access must be granted using IAM roles rather than long-term IAM user access keys.
This satisfies the requirements for encryption at rest/in transit, avoiding long-term credentials, and practicing least privilege.
2
Configure cross-account access policies for the EC2 instances.
Grant the EC2 instance role in Account A access to Secrets Manager and KMS in Account B. Ensure the Secrets Manager resource policy and the KMS key policy in Account B explicitly permit the role in Account A.
For cross-account access, resource-based policies (and KMS key policies) must trust the external account or role directly since identity-based policies in Account A alone are insufficient.
3
Configure the automated credential rotation mechanism.
Enable Secrets Manager automatic rotation, which uses a Lambda function to update the database password and the secret value.
AWS KMS key rotation only rotates KMS key material, not the actual secret value. Secrets Manager rotation is required to securely update database credentials.

Key Concept

Cross-account access and credentials rotation utilizing AWS Secrets Manager and AWS KMS with resource-based policies.
Estimated Time:3m 0s
Question 42Question →

An insurance firm runs a distributed risk-modeling application on Amazon EC2 instances. The application consists of compute nodes that frequently communicate with each other, requiring low-latency and high-throughput node-to-node network communication. A Network Load Balancer (NLB) distributes incoming simulation jobs to these EC2 instances on custom port 8090. The target group is configured to perform health checks on port 80, which causes the NLB to mark all instances as unhealthy. Which two configuration changes should a solutions architect make to resolve these issues and optimize the compute architecture?

Select all that apply

Show answer & explanation

Answer: Launch the EC2 instances in a cluster placement group.; Modify the target group health check configuration to query port 8090.

Answer

Deploy the EC2 instances in a cluster placement group, and modify the target group health check configuration to query port 8090.
To achieve low-latency and high-throughput communication between nodes, instances must be launched in a cluster placement group. Additionally, since the application listens on port 8090 and the target group is querying port 80, the health check port configuration must be changed to port 8090 so that the Network Load Balancer can successfully verify instance health.

Step-by-Step Solution

1
Analyze the network latency and throughput requirements of the risk-modeling application.
The application requires high-throughput, low-latency node-to-node communication.
This requirement determines the correct placement group strategy.
2
Select the appropriate EC2 placement group.
A cluster placement group is selected.
Cluster placement groups place instances close together within a single Availability Zone, enabling low-latency and high-throughput TCP/IP communication.
3
Investigate the health check failure for the target group.
The target group is configured to health check on port 80, but the application runs on port 8090.
The mismatch causes the NLB health checks to fail, marking the instances as unhealthy.
4
Reconfigure the target group health check port.
The health check port is updated to 8090.
This aligns the health check with the actual port the application is listening on, allowing the NLB to detect the instances as healthy.

Key Concept

Selecting cluster placement groups for low-latency node-to-node communication and aligning target group health check ports with the application port.
Question 43Question →

A media company is building a serverless video processing pipeline. Users upload raw video files to an Amazon S3 bucket. The transcoding process is CPU-intensive, takes between 20 to 45 minutes per video, and occurs at unpredictable intervals. The company wants to minimize compute costs, ensure the architecture scales automatically to zero when there are no uploads, and process the files in the exact order they are uploaded to maintain a chronological publishing timeline. Which architectural solution is the most cost-effective and meets these requirements?

Show answer & explanation

Answer: Configure Amazon S3 event notifications to publish upload events to an Amazon SQS FIFO queue. Use an AWS Step Functions state machine to run an Amazon ECS task on AWS Fargate using the Fargate Spot capacity provider to process the videos from the queue.

Answer

Configure Amazon S3 event notifications to publish upload events to an Amazon SQS FIFO queue, and use an AWS Step Functions state machine to run an Amazon ECS task on AWS Fargate using the Fargate Spot capacity provider.
The correct solution combines Amazon SQS FIFO queues to enforce first-in, first-out ordering, with Amazon ECS on AWS Fargate using Fargate Spot capacity providers. Fargate Spot offers up to a 70% cost discount for containers and scales to zero when there are no jobs, matching the cost-efficiency goals, while bypassing AWS Lambda's 15-minute execution limit.

Step-by-Step Solution

1
Analyze the execution duration and compute requirements of the transcoding process.
The process takes 20 to 45 minutes, which exceeds the 15-minute maximum limit of AWS Lambda. Therefore, Amazon ECS on AWS Fargate is selected as the serverless compute platform.
To prevent runtime timeouts while maintaining a serverless scaling model.
2
Select the most cost-effective capacity provider for the containers.
AWS Fargate Spot is selected because it offers spare capacity at up to a 70% discount compared to standard Fargate, which fits the stateless, interruptible nature of batch video transcoding.
To minimize compute costs for unpredictable workloads.
3
Determine the message queue type to satisfy the strict chronological processing requirement.
Amazon SQS FIFO is selected instead of SQS standard.
Only SQS FIFO queues guarantee first-in, first-out ordering, preventing out-of-order execution.

Key Concept

Serverless container orchestration with Fargate Spot and order preservation with SQS FIFO.
Question 44Question →

A solutions architect is designing a high-throughput telemetry application on AWS. Thousands of IoT devices will send real-time environmental data every second. The architect decides to store the data in an Amazon DynamoDB table. The database schema is currently designed with `SensorType` (which has 4 unique values: 'Temperature', 'Humidity', 'Pressure', and 'AirQuality') as the partition key, and a timestamp as the sort key. During load testing, the application encounters write throttling errors even though the table has sufficient write capacity. Which modification to the database design should the solutions architect recommend to resolve the performance bottleneck?

Show answer & explanation

Answer: Redesign the table schema to use a high-cardinality attribute, such as a combination of `SensorID` and a daily date string, as the partition key to distribute write operations evenly across multiple partitions.

Answer

Redesign the table schema to use a high-cardinality attribute, such as a combination of `SensorID` and a daily date string, as the partition key to distribute write operations evenly across multiple partitions.
The correct option is to redesign the table schema using a high-cardinality attribute. By using a partition key with high cardinality (such as `SensorID` or a combination of `SensorID` and a date), DynamoDB can distribute the write workload evenly across many physical partitions. This avoids hitting the partition-level limit of 1,000 Write Capacity Units (WCUs).

Step-by-Step Solution

1
Analyze the write workload and partition structure.
Identify that the current partition key `SensorType` has only 4 unique values, causing all writes to be concentrated on at most 4 partitions.
DynamoDB determines physical partition allocation by hashing the partition key.
2
Evaluate the partition limits.
Recognize that each physical partition has a maximum limit of 1,000 Write Capacity Units (WCUs). Due to the low cardinality of `SensorType`, the partition capacity is exceeded, causing throttling.
Understanding physical DynamoDB limits is necessary to identify bottlenecks.
3
Redesign the primary key for optimal distribution.
Recommend using a high-cardinality partition key like `SensorID` (optionally with a date suffix) to spread the writes across many partitions.
Distributing writes evenly prevents any single partition from exceeding the 1,000 WCU limit.

Key Concept

DynamoDB partition key cardinality and partition-level throughput limits
Estimated Time:1m 30s
Question 45Question →

A financial subscription billing application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer in the us-east-1 Region. The application database is hosted on an Amazon RDS for PostgreSQL DB instance. The company wants to implement a disaster recovery (DR) strategy in the us-west-2 Region with a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 5 minutes. The solution must minimize running costs under normal conditions. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon RDS for PostgreSQL cross-region read replica in the secondary region, and promote it to a standalone DB instance during a failover event.; Deploy an Application Load Balancer and a scaled-down Auto Scaling group of EC2 instances in the secondary region, and configure the group to scale up when a failover is initiated.

Answer

To achieve the required RTO of under 15 minutes and RPO of under 5 minutes cost-effectively, configure an Amazon RDS cross-region read replica for database replication and deploy a scaled-down Auto Scaling group behind an Application Load Balancer in the secondary region to scale up during failover.
The correct strategy combines database replication and scaled-down compute resources. An RDS cross-region read replica maintains a replica of the database with sub-minute lag (RPO) and can be promoted to primary in minutes (RTO). A scaled-down Auto Scaling group in the secondary region acts as a Warm Standby, minimizing costs during normal operations while guaranteeing that application instances can scale up quickly during a disaster to meet the RTO.

Step-by-Step Solution

1
Address the database RPO and RTO constraints.
Deploy an Amazon RDS cross-region read replica.
Asynchronous cross-region replication keeps replication lag (RPO) within seconds. Promoting the read replica to a standalone primary database can be completed in a few minutes, meeting the 15-minute RTO.
2
Address the compute RTO and cost constraints.
Implement a Warm Standby pattern with a scaled-down Auto Scaling group and an Application Load Balancer in the disaster recovery region.
Maintaining a minimal number of running EC2 instances keeps idle costs low while ensuring the system can quickly scale up to production capacity, meeting the 15-minute RTO.

Key Concept

Cross-region disaster recovery strategies involving database replication and pre-provisioned scaled-down application infrastructure to meet specific RTO/RPO limits.
Estimated Time:2m 0s
Question 46Question →

A software company is building a collaborative online drafting application with users distributed across North America and Europe. The architecture requires a relational database to store document metadata and version history, supporting complex queries and auto-scaling read performance in both regions. Additionally, the application requires a data store to manage real-time collaborator session state and presence details with sub-millisecond response times. Which combination of database configurations should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Aurora Global Database to store relational document metadata, using read replicas in the secondary region to scale read performance.; Amazon ElastiCache for Redis to manage real-time collaborator session state and presence details with sub-millisecond latencies.

Answer

The solutions architect should choose Amazon Aurora Global Database to store relational document metadata with read replicas in the secondary region, and Amazon ElastiCache for Redis to manage real-time collaborator session state with sub-millisecond latencies.
To support a relational, globally distributed database with complex query capabilities and read scaling, Amazon Aurora Global Database is the ideal choice as it provides low-latency local reads in secondary regions. For real-time user session state requiring sub-millisecond latencies, an in-memory solution like Amazon ElastiCache for Redis is optimized for this performance envelope.

Step-by-Step Solution

1
Analyze the requirement for document metadata and version history.
The database must be relational, support complex queries, and scale reads globally (North America and Europe) with low latency.
This points to Amazon Aurora Global Database, which supports cross-region read replicas and automated scaling.
2
Analyze the requirement for real-time collaborator session state.
This requires a sub-millisecond latency data store to track active users and their presence.
Amazon ElastiCache for Redis is an in-memory key-value store that provides sub-millisecond latencies suitable for real-time state tracking.
3
Evaluate and eliminate incorrect database configurations.
Eliminated options using RDS replicas for automatic failover, DynamoDB with monotonic partition keys, and DynamoDB with provisioned capacity for spiky workloads.
These options violate design practices, leading to failover misconceptions, partition key bottlenecks, or performance throttling under spiky loads.

Key Concept

Selecting and configuring high-performing databases based on latency, query patterns, and global read scalability requirements.
Estimated Time:2m 0s
Question 47Question →

An e-learning platform operates a multi-account AWS environment managed under AWS Organizations. The security team needs a solution to centralize the monitoring of security alerts and threat detections from Amazon GuardDuty, Amazon Macie, and AWS IAM Access Analyzer across all accounts. Additionally, they must continuously assess their resource configurations against the AWS Foundational Security Best Practices standard. Which solution will meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Enable AWS Security Hub in a designated security administrator account, integrate it with AWS Organizations to aggregate findings across all member accounts, and enable the AWS Foundational Security Best Practices standard.

Answer

Enable AWS Security Hub in a designated security administrator account, integrate it with AWS Organizations to aggregate findings across all member accounts, and enable the AWS Foundational Security Best Practices standard.
The correct solution uses AWS Security Hub, which is designed to centralize and prioritize security findings from multiple AWS services (such as GuardDuty, Macie, and IAM Access Analyzer) across all accounts in an organization. It also runs automated compliance checks against standards like AWS Foundational Security Best Practices, minimizing operational overhead.

Step-by-Step Solution

1
Identify the primary requirement of centralizing threat detection and compliance checks across multiple AWS accounts.
AWS Security Hub is identified as the native service designed for centralizing findings and conducting automated compliance checks.
It natively integrates with AWS Organizations, GuardDuty, Macie, and IAM Access Analyzer to aggregate findings into a single pane of glass.
2
Address the requirement to run security posture assessments against the AWS Foundational Security Best Practices standard.
AWS Security Hub's compliance standards feature is selected.
Security Hub continuously runs automated checks against security standards to identify configuration drifts and compliance status.
3
Determine the configuration that minimizes operational overhead across the organization.
AWS Organizations integration is configured.
Setting up a designated security administrator account allows automatic enablement of Security Hub across all existing and future member accounts.

Key Concept

Centralized security monitoring and compliance tracking using AWS Security Hub and AWS Organizations.
Question 48Question →

A gaming company is launching a global multiplayer game and needs to design a database architecture for player profiles and leaderboards. The database must support high-throughput writes with single-digit millisecond latency for players distributed across North America, Europe, and Asia. Additionally, player profile page lookups must achieve microsecond read latency to prevent page load delays. Which combination of database configurations will meet these performance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Amazon DynamoDB global tables to replicate data with single-digit millisecond latency across multiple AWS Regions.; Enable Amazon DynamoDB Accelerator (DAX) to provide microsecond read latency for player profile lookups.

Answer

Deploying Amazon DynamoDB global tables and enabling Amazon DynamoDB Accelerator (DAX).
DynamoDB global tables provide a fully managed multi-region database solution that replicates data across AWS Regions, allowing local write and read access with single-digit millisecond latency. DynamoDB Accelerator (DAX) adds a caching layer in front of the tables, reducing the latency of read lookups from milliseconds to microseconds for read-intensive workloads such as player profiles.

Step-by-Step Solution

1
Analyze the workload requirements: global replication with low-latency (single-digit millisecond) writes and read-heavy profile lookups requiring microsecond latency.
Identified that DynamoDB global tables fit the multi-region write requirement, and an in-memory cache is needed for microsecond reads.
DynamoDB global tables support multi-region write replication, and DAX delivers the required microsecond read performance for DynamoDB tables.
2
Evaluate the caching options and reject configurations that process writes to read-only endpoints or cache instances as primary databases.
Eliminated Aurora read replicas for direct writes and Memcached as a primary database write target.
Read replicas cannot handle write transactions, and caching solutions do not provide persistent primary database capabilities.
3
Assess the partition key design to prevent partition bottlenecks during high-throughput writes.
Avoided partition key patterns using sequential or monotonically increasing values.
Using sequential keys distributes traffic unevenly, resulting in hot partitions that throttle overall throughput.

Key Concept

Combining multi-region active-active databases with in-memory caching to achieve high write throughput and microsecond read latencies.
Estimated Time:2m 0s
Question 49Question →

A company is deploying a global application across two AWS Regions: us-east-1 and eu-central-1. The application consists of web servers behind an Application Load Balancer (ALB) in each region, and a multi-region database. The solutions architect needs to design an Amazon Route 53 DNS routing strategy that directs users to the closest region with the lowest network latency, but automatically redirects traffic to the other region if the ALB or the backend database in one region becomes unhealthy. Which combination of configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create Route 53 Alias records with a Latency routing policy pointing to the ALB in each region, and configure Evaluate Target Health to Yes.; Configure the ALB target group health checks in each region to monitor an application health endpoint that verifies both the web server status and database connectivity.

Answer

Create Route 53 Alias records with a Latency routing policy pointing to the ALB in each region with Evaluate Target Health set to Yes, and configure the ALB target group health checks to monitor a path that validates both the web server and database connectivity.
The correct architecture uses Route 53 Alias records with a Latency routing policy and 'Evaluate Target Health' enabled to route users based on lowest latency and monitor ALB health. To propagate database failures to Route 53, the ALB target group health check must monitor an endpoint that validates the backend database. When the database fails, the ALB targets fail health checks, causing the ALB to report as unhealthy, which prompts Route 53 to stop routing traffic to that region.

Step-by-Step Solution

1
Determine the appropriate Route 53 routing policy for lowest latency.
Latency routing policy must be used to direct users to the region that offers the lowest network latency.
Failover or other policies do not dynamically route based on latency performance.
2
Select the correct record type that supports health evaluation for the load balancer.
Use Alias records (pointing to the ALBs) instead of CNAME records, and enable 'Evaluate Target Health'.
'Evaluate Target Health' is only supported on Alias records and allows Route 53 to automatically monitor target group health.
3
Integrate the database status into the health check path.
Configure the ALB target group health check to query a deep health path (like `/health`) that verifies the backend database connection.
If the database goes down, target instances will fail their health checks, the ALB will report as unhealthy, and Route 53 will failover traffic.

Key Concept

Route 53 DNS failover using Latency routing policies combined with ALB Evaluate Target Health.
Estimated Time:2m 0s
Question 50Question →

A logistics company runs a tracking and analysis platform on AWS. The platform consists of a backend application on Amazon EC2 instances that runs continuously 24/7 with a predictable, steady-state load. The platform also runs a daily data validation batch job on EC2 instances that is stateless, can be interrupted at any time, and writes results to Amazon S3. The company also uses an Amazon RDS database for data storage. Which combination of strategies should a solutions architect recommend to meet these requirements most cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Purchase a Compute Savings Plan to cover the predictable, steady-state Amazon EC2 instances.; Use Amazon EC2 Spot Instances to run the stateless, interruptible batch validation jobs.

Answer

The correct options are purchasing a Compute Savings Plan to cover the predictable, steady-state Amazon EC2 instances, and using Amazon EC2 Spot Instances to run the stateless, interruptible batch validation jobs.
Purchasing a Compute Savings Plan is the most cost-effective way to cover the predictable, steady-state Amazon EC2 backend application load, offering significant discounts compared to On-Demand rates. Using Amazon EC2 Spot Instances is the optimal choice for the batch validation jobs since they are stateless, run once a day, and can tolerate interruptions, providing the maximum possible cost savings of up to 90% off On-Demand rates.

Step-by-Step Solution

1
Analyze the backend application workload characteristics.
The backend application runs continuously 24/7 with a predictable, steady-state load.
Determining if the workload is steady-state helps select the appropriate purchasing option (Savings Plan or Reserved Instances) rather than On-Demand.
2
Analyze the daily batch validation job characteristics.
The batch validation job is stateless, can be interrupted at any time, and runs daily.
Identifying that a workload is fault-tolerant and interruptible makes it an ideal candidate for Spot Instances to maximize cost savings.
3
Evaluate the options for compute cost optimization.
Compute Savings Plans cover EC2 steady-state compute. Spot Instances cover the batch validation compute. NAT Gateways and Lambda are not appropriate or cost-effective for these specific configurations.
Combining Compute Savings Plans for steady-state workloads and Spot Instances for interruptible batch workloads delivers the most cost-effective architecture.

Key Concept

Selecting the most cost-effective AWS compute purchasing model (Savings Plans for steady-state, Spot Instances for interruptible workloads) based on workload characteristics.
Estimated Time:1m 30s
Question 51Question →

A global media broadcasting corporation is designing a disaster recovery (DR) solution for its historical video archive system. The archive contains over 10 PB10\text{ PB} of footage that must be stored with maximum durability (99.999999999%99.999999999\%) across multiple geographic locations to protect against regional disasters. In the event of a primary site failure, the company's business continuity plan dictates a Recovery Time Objective (RTO) of under 15 minutes15\text{ minutes} to resume search and retrieval operations for the video files. Which storage and disaster recovery configuration meets these requirements?

Show answer & explanation

Answer: Store the video archive in Amazon S3 Standard with Cross-Region Replication (CRR) enabled to a destination bucket in a secondary Region. Deploy a Warm Standby disaster recovery environment in the secondary Region with pre-provisioned, scaled-down catalog search services to meet the 15-minute15\text{-minute} retrieval timeline.

Answer

Store the video archive in Amazon S3 Standard with Cross-Region Replication (CRR) and use a Warm Standby disaster recovery strategy in the secondary Region.
Storing the video archive in Amazon S3 Standard ensures that files are immediately accessible with sub-second retrieval latency, meeting the need for rapid search and recovery. Enabling Cross-Region Replication (CRR) asynchronously copies the data to a destination bucket in a secondary Region, achieving the required cross-region high availability and 99.999999999%99.999999999\% durability. Implementing a Warm Standby disaster recovery strategy ensures that critical services (such as catalog search) are already running in a scaled-down capacity in the secondary Region, permitting failover to complete well within the 15-minute15\text{-minute} RTO.

Step-by-Step Solution

1
Analyze storage durability and recovery time requirements.
Durability must be 99.999999999%99.999999999\% across multiple Regions, and retrieval/recovery must happen within 15 minutes15\text{ minutes} (RTO).
This establishes S3 Standard as the appropriate storage tier since Glacier Standard retrieval times (3 to 5 hours3\text{ to }5\text{ hours}) exceed the RTO, and S3 Standard provides sub-second latency.
2
Evaluate replication options to satisfy the regional disaster recovery constraint.
Amazon S3 Cross-Region Replication (CRR) should be configured to replicate archive data asynchronously to a secondary AWS Region.
CRR protects the data against a regional outage while maintaining the required 99.999999999%99.999999999\% durability of the S3 storage class.
3
Select the correct disaster recovery (DR) pattern for the catalog application and database.
A Warm Standby DR pattern is chosen, keeping a minimal, active catalog search application running in the recovery Region.
A Pilot Light pattern keeps resources stopped, which introduces startup latency that cannot reliably guarantee a failover in under 15 minutes15\text{ minutes}.

Key Concept

Disaster recovery planning requires balancing the storage tier's data retrieval speed against the application's Recovery Time Objective (RTO). High durability demands cross-Region replication, while low RTO demands warm, active standby infrastructure.
Estimated Time:2m 0s
Question 52Question →

A financial services company generates daily transaction audit logs averaging 10 MB10\text{ MB} in size. These files are stored in an Amazon S3 Standard bucket. The logs are accessed frequently during the first 12 days12\text{ days} following their creation. After 12 days12\text{ days}, access to these files drops to zero. According to the company's compliance policy, the logs must be retained for a total of 28 days28\text{ days} from their creation date, after which they must be permanently deleted. Which lifecycle policy configuration is the MOST cost-effective for managing these files?

Show answer & explanation

Answer: Retain the files in Amazon S3 Standard for the entire 28 days28\text{ days} and configure a lifecycle rule to permanently delete them after 28 days28\text{ days}.

Answer

Retain the files in Amazon S3 Standard for the entire 28 days28\text{ days} and configure a lifecycle rule to permanently delete them after 28 days28\text{ days}.
Keeping the files in S3 Standard for the entire 28 days28\text{ days} is the most cost-effective option because any transition to S3 Standard-IA or S3 Glacier Flexible Retrieval after 12 days12\text{ days} would leave the files in those tiers for only 16 days16\text{ days}. This is less than the minimum storage duration requirements of 30 days30\text{ days} for S3 Standard-IA and 90 days90\text{ days} for S3 Glacier Flexible Retrieval, leading to prorated minimum duration charges that exceed the cost of S3 Standard. Transitioning to S3 Intelligent-Tiering also incurs monitoring fees without any cost benefit, as files are deleted before they can transition to lower-cost tiers.

Step-by-Step Solution

1
Analyze the lifecycle of the files, noting that they are created, accessed for 12 days12\text{ days}, and deleted after 28 days28\text{ days} (total lifetime is 28 days28\text{ days}).
2
Calculate the duration of time the files would spend in a secondary storage class if transitioned after 12 days12\text{ days}, which is 28−12=16 days28 - 12 = 16\text{ days}.
3
Evaluate the minimum storage duration requirements for S3 Standard-IA (30 days30\text{ days}) and S3 Glacier Flexible Retrieval (90 days90\text{ days}).
4
Determine that transitioning the files to these tiers would trigger early deletion/minimum storage duration penalties, offsetting any potential storage tier savings, and that S3 Intelligent-Tiering would add monitoring fees without tiering benefits because the files are deleted before the 30-day30\text{-day} inactivity threshold.

Key Concept

Understanding S3 storage class minimum storage duration charges and lifecycle transition rules.
Estimated Time:1m 30s
Question 53Question →

A company is designing a security architecture to grant administrative access to its internal cloud operations team, whose identities are managed in an external corporate directory, and a group of external consultants. The administrators need to configure automatic KMS key rotation for sensitive logs, manage database credentials securely, and perform daily maintenance tasks. Which solution meets these requirements securely and with the least administrative overhead?

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the internal cloud operations team, create a cross-account IAM role with an External ID for the external consultants, store the database credentials in Systems Manager Parameter Store as SecureString parameters, and enable automatic key rotation on the Customer Managed Key.

Answer

Configure AWS IAM Identity Center to federate the internal cloud operations team, create a cross-account IAM role with an External ID for the external consultants, store the database credentials in Systems Manager Parameter Store as SecureString parameters, and enable automatic key rotation on the Customer Managed Key.
The correct solution implements federation using AWS IAM Identity Center for internal users, which uses temporary credentials and reduces credential management overhead. It uses a cross-account IAM role with an External ID for third-party access, which aligns with security best practices. It securely stores database credentials in Parameter Store as SecureString parameters (which are encrypted using KMS), and enables automatic key rotation on the Customer Managed Key, preserving the old key material so that existing data remains readable.

Step-by-Step Solution

1
Evaluate the identity federation requirements for the internal cloud operations team.
AWS IAM Identity Center provides federated access using existing corporate directory credentials, eliminating the need to manage individual IAM users with long-term access keys.
Reduces operational overhead and improves security posture.
2
Determine the access model for the external consultants.
A cross-account IAM role with an External ID is created to grant the external consultants least-privilege, temporary access without creating IAM users in the primary account.
Prevents the 'confused deputy' problem and avoids managing long-term credentials for external entities.
3
Determine the secure storage mechanism for the database credentials.
Systems Manager Parameter Store with SecureString parameters is chosen to encrypt the credentials at rest using KMS.
Ensures sensitive configuration parameters are not stored in plaintext.
4
Determine the key rotation strategy for the Customer Managed Key (CMK).
Enable automatic key rotation on the Customer Managed Key.
AWS KMS automatically rotates the backing key material annually while retaining the old key material to decrypt historical data without manual intervention or key deletion.

Key Concept

AWS Identity and Access Management (IAM) best practices demand the use of temporary credentials via federation and cross-account roles, secure parameter storage, and proper KMS key rotation mechanics.
Question 54Question →

A financial analytics platform generates daily transaction ledger snapshots for audit validation. The platform produces approximately 50 million files monthly, with an average file size of 90 KB90\text{ KB}. These files are stored in an Amazon S3 bucket. They are frequently accessed during the first 10 days after creation. From day 11 to day 25, they are accessed occasionally (less than once per week) but must remain available for immediate retrieval. After exactly 25 days, the files are no longer needed and can be safely deleted. Which storage strategy is the most cost-effective for these files?

Show answer & explanation

Answer: Store the files in Amazon S3 Standard for the entire 25-day lifecycle, and configure an S3 Lifecycle policy to expire the files 25 days after creation.

Answer

Store the files in Amazon S3 Standard for the entire 25-day lifecycle, and configure an S3 Lifecycle policy to expire the files 25 days after creation.
Storing the files in Amazon S3 Standard for the entire 25 days is the most cost-effective option. The average file size (90 KB90\text{ KB}) is less than the S3 Standard-IA minimum billing size of 128 KB128\text{ KB}. Additionally, because the files are deleted after 25 days, transitioning them to S3 Standard-IA after 10 days would mean they spend only 15 days in that tier, which falls short of the 30-day minimum storage duration for S3 Standard-IA, triggering a penalty charge for the remaining 15 days. Finally, transitioning 50 million objects incurs transition request fees (0.01per1,000requests,or0.01 per 1,000 requests, or 500 total) which vastly exceed the storage costs ($82.25) of the raw data.

Step-by-Step Solution

1
Calculate the total storage volume and cost of keeping data in S3 Standard.
Total data volume per month is 50 million files of 90 KB90\text{ KB} average size, which equals approximately 4,291.5 GB4,291.5\text{ GB} (4.3 TB4.3\text{ TB}). In S3 Standard, storage cost is calculated based on the actual size (90 KB90\text{ KB}) and actual duration (25 days). The storage charge at 0.023perGB−monthisroughly0.023 per GB-month is roughly 4,291.5\text{ GB} \times (25/30) \times 0.023 = 82.25$. S3 Standard does not charge transition request fees upon creation.
Establishing a cost baseline for S3 Standard is necessary to evaluate the cost-effectiveness of transition alternatives.
2
Analyze the impact of transitioning to S3 Standard-IA.
Transitioning 50 million files to S3 Standard-IA costs 50,000,000×(0.01/1,000)=50050,000,000 \times (0.01 / 1,000) = 500 in transition request fees. Storing them in S3 Standard-IA at day 10 increases the billable size of each file from 90 KB90\text{ KB} to 128 KB128\text{ KB} (due to the minimum capacity charge). Because they are deleted at day 25, they spend 15 days in S3 Standard-IA but are billed for 30 days (due to the 30-day minimum storage duration). Total cost exceeds S3 Standard baseline by over 600%.
To determine if transitioning to Standard-IA is cost-effective, we must factor in S3 Standard-IA minimum size limits, minimum storage duration, and transition fees.
3
Evaluate the retrieval and duration requirements against S3 Glacier Flexible Retrieval.
Transitioning to S3 Glacier Flexible Retrieval violates the requirement for immediate retrieval, as standard retrieval takes 3 to 5 hours. Furthermore, Glacier Flexible Retrieval has a 90-day minimum storage duration, meaning the system would pay for an extra 75 days of storage per file as an early deletion penalty.
Checking service-level retrieval capability and early deletion penalties prevents selecting invalid or high-cost storage classes.
4
Evaluate S3 Intelligent-Tiering for small files.
S3 Intelligent-Tiering does not perform auto-tiering for files smaller than 128 KB128\text{ KB}. Storing these 90 KB90\text{ KB} files in S3 Intelligent-Tiering keeps them in the Frequent Access tier permanently (incurring standard rates), while still incurring transition request fees to move them into the class.
Understanding S3 Intelligent-Tiering's minimum size rule for monitoring prevents incurring unnecessary transition charges without benefit.

Key Concept

S3 Standard-IA and S3 Glacier storage tiering optimization constraints including minimum object sizes, minimum storage durations, and transition request costs.
Question 55Question →

A financial services organization is establishing a secure hybrid network connection between its on-premises trading platform and a VPC in the AWS Cloud. The application requires a minimum encrypted throughput of 2.0 Gbps2.0 \text{ Gbps} to replicate time-sensitive market feeds. Additionally, the network engineering team must implement stateless traffic filtering at the subnet level to restrict inbound access. Which design will meet these requirements with the lowest administrative complexity?

Show answer & explanation

Answer: Establish multiple AWS Site-to-Site VPN connections to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing to aggregate the tunnel throughput. Set up Network Access Control Lists (NACLs) on the subnets to enforce stateless traffic filtering.

Answer

Establish multiple AWS Site-to-Site VPN connections to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing to aggregate the tunnel throughput, and set up Network Access Control Lists (NACLs) on the subnets to enforce stateless traffic filtering.
The correct answer combines AWS Transit Gateway and Equal-Cost Multi-Path (ECMP) routing, which allows the dynamic distribution of traffic across multiple active Site-to-Site VPN connections. This bypasses the 1.25 Gbps1.25 \text{ Gbps} limit of a single VPN tunnel to meet the 2.0 Gbps2.0 \text{ Gbps} requirement. Using Network Access Control Lists (NACLs) correctly provides the required stateless filtering at the subnet boundaries.

Step-by-Step Solution

1
Analyze the throughput requirement of 2.0 Gbps2.0 \text{ Gbps} and the encryption requirement.
A single AWS Site-to-Site VPN tunnel has a maximum throughput of 1.25 Gbps1.25 \text{ Gbps}. To meet the 2.0 Gbps2.0 \text{ Gbps} requirement, multiple VPN tunnels must be aggregated.
Identifying the hardware and service constraints of AWS VPN connections.
2
Determine the routing mechanism to aggregate multiple VPN tunnels.
AWS Transit Gateway supports Equal-Cost Multi-Path (ECMP) routing, allowing traffic to be balanced across multiple VPN tunnels to achieve aggregate throughput exceeding 1.25 Gbps1.25 \text{ Gbps}.
Enabling high performance and scalability for hybrid network architectures.
3
Identify the requirement for stateless traffic filtering at the subnet level.
Network Access Control Lists (NACLs) operate at the subnet level and are stateless, whereas security groups are stateful and operate at the instance level.
Selecting the correct security control that meets the stateless and subnet-level requirements.

Key Concept

To scale VPN throughput beyond 1.25 Gbps1.25 \text{ Gbps}, you must use AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing to distribute traffic across multiple Site-to-Site VPN tunnels. Stateless network filtering at the subnet level is achieved using Network Access Control Lists (NACLs).
Question 56Question →

A gaming company is launching a real-time multiplayer game. Players in North America and Europe must read and write their profiles and game state data with sub-second latency. The system must remain highly available even if an entire AWS Region suffers an outage, with a Recovery Time Objective (RTO) of less than 1 minute and a Recovery Point Objective (RPO) of near 0. Which database configuration should a solutions architect recommend to satisfy these requirements?

Show answer & explanation

Answer: Deploy an Amazon DynamoDB global table replicated between the North America and Europe regions. Use Amazon Route 53 latency-based routing combined with active health checks to direct user traffic to the closest healthy region.

Answer

The correct answer is the option that proposes deploying an Amazon DynamoDB global table replicated between the North America and Europe regions, along with Route 53 latency-based routing and health checks.
The correct answer is the option suggesting the deployment of an Amazon DynamoDB global table replicated between both regions using Route 53 latency-based routing and health checks. DynamoDB global tables support multi-region, active-active read and write operations. The data is replicated asynchronously with sub-second latency, providing near-zero RPO. Combined with Route 53 latency-based routing and health checks, client traffic is automatically routed to the closest healthy regional endpoint, allowing failover to complete in under a minute to satisfy the RTO constraint.

Step-by-Step Solution

1
Identify the latency and replication requirements.
The game requires active read and write operations with sub-second latency in both North America and Europe.
This indicates a need for a multi-region active-active database configuration, as single-region databases would introduce significant network latency for cross-region writes.
2
Evaluate the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) constraints.
RTO must be less than 1 minute, and RPO must be near 0.
This requires automated failover capabilities and continuous, sub-second data replication across regions.
3
Match the requirements against AWS database services.
Amazon DynamoDB global tables provide fully managed, active-active multi-region replication with sub-second replication latency, meeting all performance, HA, and RTO/RPO requirements.
Relational databases like RDS and Aurora do not natively support active-active writes in multiple regions without write-forwarding latency or manual failover overhead.

Key Concept

Amazon DynamoDB Global Tables provide fully managed, active-active multi-region replication for high availability and low-latency local reads and writes.
Estimated Time:1m 30s
Question 57Question →

An insurance company runs its claims processing application in the us-east-1 Region. The application uses Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, and an Amazon RDS for PostgreSQL DB instance. The company wants to design a disaster recovery (DR) plan in the us-west-2 Region. The DR strategy must achieve a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes, while minimizing ongoing costs. Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a cross-region read replica of the RDS for PostgreSQL DB instance in the us-west-2 Region, and promote it to a standalone DB instance during failover.; Pre-stage an Application Load Balancer and an Auto Scaling group in the us-west-2 Region with the minimum capacity set to 0, and configure the Auto Scaling group to launch instances using replicated Amazon Machine Images (AMIs) during a failover.

Answer

To meet the requirements, the company should configure a cross-region read replica of the RDS for PostgreSQL DB instance in the secondary region and promote it to a standalone DB instance during failover, and pre-stage an Application Load Balancer and Auto Scaling group with a minimum capacity of 0 in the secondary region to launch instances using replicated AMIs when needed.
The correct combination of actions implements a cost-effective Pilot Light disaster recovery strategy. Creating an Amazon RDS cross-region read replica in the recovery region ensures that data is continuously and asynchronously replicated, maintaining a recovery point within minutes, which satisfies the 15-minute RPO. Pre-staging the Application Load Balancer and the Auto Scaling group with a minimum capacity of 0 ensures that no compute costs are incurred in the secondary region during normal operations. During a failover event, promoting the RDS read replica and scaling the compute instances up to the required capacity from replicated AMIs can be completed in under an hour, meeting the 1-hour RTO.

Step-by-Step Solution

1
Evaluate the database replication strategy to satisfy the Recovery Point Objective (RPO) of 15 minutes.
Using an Amazon RDS cross-region read replica provides asynchronous replication with lag times typically under a few minutes, meeting the 15-minute RPO.
Traditional backup and restore methods from daily snapshots cannot guarantee an RPO of less than 15 minutes, and RDS Multi-AZ cannot span multiple regions.
2
Evaluate the compute tier configuration in the secondary region to satisfy the Recovery Time Objective (RTO) of 1 hour while minimizing costs.
Pre-staging an Application Load Balancer and an Auto Scaling group with a minimum capacity of 0 ensures zero compute costs during normal operations (Pilot Light strategy). During failover, scaling the Auto Scaling group and launching instances from replicated AMIs takes only a few minutes, well within the 1-hour RTO.
Running a full-scale warm standby or active-active compute tier would incur substantial ongoing costs, which violates the constraint to minimize costs.

Key Concept

Disaster Recovery (DR) strategies involve finding the optimal balance between Recovery Time Objective (RTO), Recovery Point Objective (RPO), and cost. A Pilot Light strategy provides a cost-effective mechanism by keeping databases updated via asynchronous replication (RDS read replica) and keeping compute resources scaled down or pre-configured but not running (Auto Scaling group capacity 0).
Question 58Question →

A travel booking system generates daily XML reconciliation reports. The files average 15 MB15\text{ MB} in size and are stored in an Amazon S3 bucket. These reports are accessed frequently during the first 1414 days for booking validation. After 1414 days, they are rarely accessed, but must be retained for auditing purposes for a total of 2525 days from creation. After 2525 days, the files are no longer needed and can be permanently deleted. Which of the following Amazon S3 lifecycle configurations provides the most cost-effective storage solution?

Show answer & explanation

Answer: Keep the reports in the Amazon S3 Standard tier, and configure a lifecycle rule to permanently delete the files after 2525 days.

Answer

Keep the reports in the Amazon S3 Standard tier, and configure a lifecycle rule to permanently delete the files after 2525 days.
Keeping the reports in Amazon S3 Standard and deleting them after 2525 days is the most cost-effective option. Because the total lifecycle of the files is only 2525 days, transitioning them to S3 Standard-IA or S3 Glacier Flexible Retrieval after 1414 days would result in early deletion charges (due to their 3030-day and 9090-day minimum storage duration requirements, respectively). Thus, the cost of keeping them in S3 Standard for 2525 days is lower than transitioning them to a tier with minimum storage duration penalties.

Step-by-Step Solution

1
Analyze the file lifecycle duration and access patterns.
The files have a total lifespan of 2525 days, with frequent access for the first 1414 days and rare access for the remaining 1111 days.
Understanding the timeline is necessary to evaluate minimum storage duration constraints for different S3 storage classes.
2
Evaluate S3 Standard-IA storage constraints.
S3 Standard-IA requires a minimum storage duration of 3030 days. Transitioning at day 1414 and deleting at day 2525 keeps files in S3 Standard-IA for only 1111 days, triggering a 1919-day early deletion charge.
Calculating early deletion charges helps determine if transitioning to a lower-cost tier is actually cheaper than keeping the files in S3 Standard.
3
Compare costs between S3 Standard and S3 Standard-IA with early deletion penalty.
Keeping the files in S3 Standard for 2525 days is more cost-effective than paying for 1414 days of S3 Standard plus 3030 days of S3 Standard-IA (along with transition request fees).
Selecting the option with the lowest total cost satisfies the requirement for a cost-optimized storage architecture.

Key Concept

Amazon S3 Standard-IA has a 3030-day minimum storage duration charge. If objects are deleted or transitioned before 3030 days have elapsed in this tier, an early deletion charge is applied.
Estimated Time:1m 15s
Question 59Question →

A company has deployed a high-performance catalog search API on Amazon EC2 instances. The API application runs on the instances and is configured to listen for requests on port 8088. The instances are registered as targets in an Application Load Balancer (ALB) target group. The ALB health check status for all EC2 instances is reported as unhealthy, resulting in HTTP 502 (Bad Gateway) errors for clients. A configuration audit reveals that the target group's health check is configured to query port 80. Which action will resolve this issue and restore service availability?

Show answer & explanation

Answer: Modify the target group configuration to use port 8088 or 'traffic-port' for the health check.

Answer

Modify the target group configuration to use port 8088 or 'traffic-port' for the health check.
The correct action is to modify the target group configuration to use port 8088 or 'traffic-port' for the health check. Since the API is configured to listen on port 8088, target group health checks sent to port 80 will fail because nothing is listening on that port on the EC2 instances. Aligning the health check port to port 8088 allows the load balancer to receive successful responses and mark the instances as healthy.

Step-by-Step Solution

1
Identify the ports involved in the architecture.
The application listens on port 8088, but the ALB target group health checks are targeting port 80.
Understanding where the traffic is sent versus where the health checks are pointing helps locate the source of the HTTP 502 errors.
2
Determine the configuration setting causing the mismatch.
The health check port in the target group is set to a static value of 80, which does not match the application port.
By default, target group health checks target the registered traffic port, but an explicit override to port 80 will fail if the application is not listening on that port.
3
Align the health check port with the active application port.
Update the health check settings in the target group to use port 8088 or select the 'traffic-port' option.
This configuration allows the ALB to successfully probe the catalog search API, marking the targets as healthy and routing client traffic correctly.

Key Concept

ELB Target Group Health Check Configuration
Question 60Question →

An enterprise hosts a high-frequency market data API on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. Financial clients located globally in Europe and Asia require the lowest possible latency and must avoid routing traffic over the public internet. Additionally, the security team requires that a dynamic blacklist of malicious IP addresses be blocked at the subnet boundary before reaching the ALB.

Which network architecture will meet these requirements?

Show answer & explanation

Answer: Configure AWS Global Accelerator in front of the ALB to onboard client traffic onto the AWS global network at the nearest edge location. Apply stateless Network Access Control Lists (NACLs) to the ALB subnets to block the blacklisted IP addresses.

Answer

Configure AWS Global Accelerator in front of the ALB to onboard client traffic onto the AWS global network at the nearest edge location. Apply stateless Network Access Control Lists (NACLs) to the ALB subnets to block the blacklisted IP addresses.
AWS Global Accelerator uses Anycast IP addresses to route traffic over the high-speed AWS global network from the nearest edge location to the destination ALB, bypassing the public internet and reducing TCP connection establishment time. Using stateless Network Access Control Lists (NACLs) at the subnet level is the correct way to enforce explicit deny rules at the subnet boundary.

Step-by-Step Solution

1
Identify the primary network optimization requirement.
Since global clients require the lowest possible latency and must avoid routing traffic over the public internet, the solution must route traffic over the private AWS backbone.
AWS Global Accelerator routes TCP/UDP traffic over the AWS global network from the nearest edge location, whereas standard DNS routing (Route 53) still directs traffic over the public internet.
2
Evaluate the security and traffic-filtering requirement.
A blacklist of malicious IP addresses must be blocked at the subnet boundary.
Network Access Control Lists (NACLs) are stateless, operate at the subnet boundary, and support explicit deny rules, making them the correct tool for blocking specific IP addresses before they reach the ALB. Security Groups do not operate at the subnet boundary and do not support deny rules.

Key Concept

Optimizing global application latency using AWS Global Accelerator and enforcing subnet-level traffic filtering using Network ACLs.
Estimated Time:2m 0s
PreviousPage 3 / 74Next