All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A financial services company is setting up a development AWS account. The company wants to allow the development team leads to create and manage IAM roles for their applications' Amazon EC2 instances. However, the security team must ensure that the team leads cannot create roles that grant access to sensitive S3 buckets, even though the team leads themselves have administrative permissions in the account. Which solution meets these security requirements with the least administrative overhead?

Create individual IAM users with long-term security credentials for the applications, and manually attach the required permissions to each user while explicitly denying access to the sensitive S3 buckets.

Store a list of approved S3 buckets in Systems Manager Parameter Store as a plaintext parameter, and configure an AWS Lambda function triggered by AWS CloudTrail to delete newly created roles that violate these rules.

Configure an IAM permissions boundary that defines the maximum allowed permissions, excluding access to the sensitive S3 buckets. Attach an IAM policy to the team leads that allows role creation only if this permissions boundary is applied to the new role.

Enable KMS customer managed key automatic annual rotation, and configure the team leads to encrypt all new IAM roles with the rotated KMS key to automatically revoke S3 permissions for historical data.

Show answer & explanation

Answer: Configure an IAM permissions boundary that defines the maximum allowed permissions, excluding access to the sensitive S3 buckets. Attach an IAM policy to the team leads that allows role creation only if this permissions boundary is applied to the new role.

Answer

The correct solution is to use an IAM permissions boundary. A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity (user or role). When a permissions boundary is set on a role, the role can only perform actions that are allowed by both its identity-based policy and its permissions boundary. By requiring the team leads to specify this boundary when creating new roles (using the 'iam:PermissionsBoundary' condition key in their own IAM policy), the security team can safely delegate role creation without risking privilege escalation.

Step-by-Step Solution

Define the maximum allowable permissions for any application role by creating an IAM permissions boundary policy that denies access to the sensitive S3 buckets.

An IAM policy is created representing the boundary, which sets the maximum ceiling of permissions for roles created under it.

This establishes the hard security limit that delegated administrators cannot exceed.

Create an IAM policy for the team leads that allows the 'iam:CreateRole' and 'iam:PutRolePolicy' actions.

The team leads gain the permissions to create roles and attach policies locally within the development account.

This enables delegation of administrative tasks to the team leads.

Add a condition to the team leads' IAM policy that requires the 'iam:PermissionsBoundary' key to match the ARN of the permissions boundary policy created in step 1.

The team leads can only create roles if they specify the approved permissions boundary during creation.

This prevents privilege escalation by ensuring that any role they create is constrained by the security baseline.

Key Concept

IAM Permissions Boundary

Question 62Question →

An enterprise has a legacy payroll application running on physical servers in an on-premises data center. The application must securely upload daily transaction logs to an Amazon S3 bucket. The company's security policy strictly prohibits the storage of long-term AWS credentials on physical on-premises servers. The company already maintains an internal Public Key Infrastructure (PKI) and a private Certificate Authority (CA). Which solution meets these security requirements with the least administrative overhead?

Create a dedicated IAM user with programmatic access, attach an IAM policy with S3 write permissions, and store the access keys on the on-premises server. Rotate the access keys manually every

90

days.

Create an IAM user with programmatic access and store the access keys as plaintext String parameters in AWS Systems Manager Parameter Store. Configure the application to retrieve these keys at startup.

Configure AWS IAM Roles Anywhere by defining a trust anchor linked to the internal Certificate Authority. Configure the application to exchange its X.509 digital certificate for temporary AWS credentials using an IAM role.

Create access keys for the AWS account root user and configure the application to use these credentials. Implement an IAM policy to limit the root user's access to only the target Amazon S3 bucket.

Show answer & explanation

Answer: Configure AWS IAM Roles Anywhere by defining a trust anchor linked to the internal Certificate Authority. Configure the application to exchange its X.509 digital certificate for temporary AWS credentials using an IAM role.

Answer

Configure AWS IAM Roles Anywhere by defining a trust anchor linked to the internal Certificate Authority, and configure the application to exchange its X.509 digital certificate for temporary AWS credentials.

The correct solution involves configuring AWS IAM Roles Anywhere. Since the company already maintains a private Certificate Authority (CA), they can establish a trust anchor in IAM Roles Anywhere. The on-premises application can then use its X.509 digital certificate to authenticate and request short-lived, temporary AWS credentials from the AWS Security Token Service (STS) using an IAM role. This eliminates the need to store long-term AWS credentials on-premises, satisfying the security policy.

Step-by-Step Solution

Analyze the requirements for accessing the Amazon S3 bucket from an on-premises environment.

Identify that the application needs to upload logs to Amazon S3, but storing long-term credentials (like IAM access keys) on-premises is strictly prohibited.

This rules out solutions that rely on creating static IAM users and distributing access keys to physical servers.

Evaluate the available identity federation and credential management options.

Since the company has an established PKI with an internal Certificate Authority (CA), they can leverage AWS IAM Roles Anywhere.

AWS IAM Roles Anywhere uses X.509 digital certificates to establish trust between the on-premises environment and AWS, enabling workloads to obtain temporary credentials.

Select the option that conforms to security best practices and has the least administrative overhead.

Establishing a trust anchor with the CA and mapping certificates to an IAM role is the standard, secure pattern that avoids long-term credentials.

This satisfies the security policy without requiring complex custom identity brokering or storing keys in plain text.

Key Concept

AWS IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers, to use digital certificates to exchange for temporary AWS credentials, avoiding the risk of long-term credentials.

Estimated Time:1m 30s

Question 63Question →

An airline is designing an application to process loyalty rewards points accrual events. For each passenger, events must be processed in the exact chronological sequence they are generated to ensure loyalty tiers are calculated accurately. If an event fails to process after five attempts, it must be isolated for investigation without blocking the processing of events for other passengers.

Which solution meets these requirements with the least operational overhead?

Configure a standard Amazon SQS queue with an attached dead-letter queue. Set the passenger ID as a message attribute to guarantee that events for each passenger are processed in order.

Configure an Amazon SNS standard topic to receive the events, and subscribe multiple Amazon SQS FIFO queues to the topic to process messages for each passenger in order.

Configure an Amazon SQS FIFO queue with a dead-letter queue. Set the passenger ID as the message group ID to ensure in-order processing per passenger.

Configure an Amazon Kinesis Data Stream with a single shard to ingest all events, using the passenger ID as the partition key, and process events using an AWS Lambda consumer.

Show answer & explanation

Answer: Configure an Amazon SQS FIFO queue with a dead-letter queue. Set the passenger ID as the message group ID to ensure in-order processing per passenger.

Answer

Configure an Amazon SQS FIFO queue with a dead-letter queue. Set the passenger ID as the message group ID to ensure in-order processing per passenger.

The correct solution uses an Amazon SQS FIFO queue. SQS FIFO queues guarantee that messages within the same message group (using the passenger ID as the MessageGroupId) are processed in the exact order they are received. An associated dead-letter queue (DLQ) isolates messages that fail to process after five attempts, allowing other message groups (other passengers) to continue processing without interruption.

Step-by-Step Solution

Evaluate the ordering requirement.

Identified that events must be processed in the exact sequence they are generated on a per-passenger basis.

This requires a messaging mechanism that guarantees ordering based on a unique identifier (passenger ID) rather than requiring global ordering across all passengers.

Evaluate the failure isolation requirement.

Identified that failed events must be isolated after 5 retries without blocking other messages.

This indicates the need for a dead-letter queue (DLQ) with a maxReceiveCount of 5 configured on the source queue.

Compare SQS FIFO, SQS Standard, SNS standard, and Kinesis Data Streams capabilities.

SQS FIFO with a DLQ and a MessageGroupId of passenger ID satisfies all constraints with minimal configuration.

SQS Standard does not guarantee order, SNS Standard loses ordering before reaching the queues, and Kinesis with a single shard introduces scale limits and higher operational overhead.

Key Concept

Decoupling message processing using Amazon SQS FIFO queues to guarantee ordered processing within groups (using MessageGroupId) and utilizing dead-letter queues to handle processing failures without blocking other groups.

Question 64Question →

A financial services firm is deploying a containerized risk analysis platform on Amazon Elastic Kubernetes Service (Amazon EKS) across two Availability Zones. The platform's pods require concurrent, shared read and write access to a persistent storage volume that supports standard POSIX file systems, permissions, and locking. The storage must handle up to $15,000\text{ IOPS}$ during peak processing times, and must scale throughput and capacity automatically without manual provisioning or downtime.

Which of the following configurations should a solutions architect recommend? (Select TWO.)

Select all that apply

Create an Amazon EFS file system configured with Elastic throughput mode and mount it using the Amazon EFS CSI driver.

Deploy an Amazon FSx for NetApp ONTAP Multi-AZ file system and mount the volumes using the NFS protocol.

Provision an Amazon EBS gp3 volume, enable Multi-Attach, and mount it to the worker nodes using the Amazon EBS CSI driver.

Provision an Amazon EBS io2 volume, enable Multi-Attach, and mount it to the worker nodes across both Availability Zones.

Create an Amazon S3 bucket and mount it as a local file system using the Amazon S3 CSI driver.

Show answer & explanation

Answer: Create an Amazon EFS file system configured with Elastic throughput mode and mount it using the Amazon EFS CSI driver.; Deploy an Amazon FSx for NetApp ONTAP Multi-AZ file system and mount the volumes using the NFS protocol.

Answer

The correct configurations are to use an Amazon EFS file system configured with Elastic throughput mode mounted via the Amazon EFS CSI driver, and to deploy an Amazon FSx for NetApp ONTAP Multi-AZ file system mounted via NFS.

The correct configurations are the option to use Amazon EFS with Elastic throughput mode and the option to use Amazon FSx for NetApp ONTAP Multi-AZ file system. Amazon EFS is built to scale automatically and supports concurrent access from multiple pods across different Availability Zones with full POSIX compatibility. Amazon FSx for NetApp ONTAP Multi-AZ provides a fully managed shared file system that supports POSIX compliance, NFS access, and scales performance and capacity seamlessly to meet the

15,000\text{ IOPS}

demand.

Step-by-Step Solution

Analyze the workload requirements: multi-AZ containerized platform (EKS), concurrent read/write access (shared storage), POSIX compliance (file system, permissions, locking), high IOPS, and automated scaling.

Identified that standard single-instance block storage (EBS gp3/io2 without multi-AZ support) and object storage (S3) are unsuitable.

This narrows down the selection to shared file storage solutions that natively support POSIX and multi-AZ deployments.

Evaluate Amazon EFS with Elastic throughput mode.

Amazon EFS satisfies the POSIX file system and concurrent access requirements across multiple Availability Zones, and Elastic throughput mode ensures automatic performance scaling.

Elastic throughput mode matches the requirement of scaling throughput automatically without manual provisioning.

Evaluate Amazon FSx for NetApp ONTAP Multi-AZ deployment.

FSx for NetApp ONTAP is fully POSIX-compliant, supports NFS, can be deployed across multiple Availability Zones, and offers high-performance throughput scaling.

It matches the high performance, multi-AZ access, and POSIX compliance requirements.

Key Concept

Selecting and configuring shared, POSIX-compliant, high-performing storage solutions (such as Amazon EFS and Amazon FSx) that support concurrent access across multiple Availability Zones and scale automatically.

Question 65Question →

A solutions architect is designing the network security for a two-tier application in a VPC. The database tier runs on Amazon EC2 instances in a private subnet, and the web tier runs in a public subnet. The database instances must accept incoming database connections on TCP port 3306 from the web tier. Additionally, the database instances must be able to download software updates from the internet over HTTPS (TCP port 443) via a NAT Gateway. No other outbound connections from the database instances should be allowed. The architect wants to implement these controls using both Security Groups and Network Access Control Lists (Network ACLs) under the principle of least privilege. Which combination of configurations will satisfy these requirements? (Select TWO.)

Select all that apply

Configure the database security group with an inbound rule that allows TCP port 3306 from the web security group, and an outbound rule that allows TCP port 443 to 0.0.0.0/0.

Configure the database subnet Network ACL with inbound rules allowing TCP port 3306 from the web subnet CIDR and TCP ports 1024-65535 from 0.0.0.0/0, and outbound rules allowing TCP ports 1024-65535 to the web subnet CIDR and TCP port 443 to 0.0.0.0/0.

Configure the database security group with inbound rules allowing TCP port 3306 from the web security group and TCP ports 1024-65535 from 0.0.0.0/0, and outbound rules allowing TCP ports 1024-65535 to the web security group and TCP port 443 to 0.0.0.0/0.

Configure the database subnet Network ACL with an inbound rule allowing TCP port 3306 from the web subnet CIDR, and an outbound rule allowing TCP port 443 to 0.0.0.0/0, with no rules for ephemeral ports.

Associate an AWS WAF web ACL directly with the database subnet to inspect incoming traffic on port 3306 and block unauthorized requests.

Show answer & explanation

Answer: Configure the database security group with an inbound rule that allows TCP port 3306 from the web security group, and an outbound rule that allows TCP port 443 to 0.0.0.0/0.; Configure the database subnet Network ACL with inbound rules allowing TCP port 3306 from the web subnet CIDR and TCP ports 1024-65535 from 0.0.0.0/0, and outbound rules allowing TCP ports 1024-65535 to the web subnet CIDR and TCP port 443 to 0.0.0.0/0.

Answer

To secure the database tier, configure the database security group to statefully allow inbound TCP port 3306 from the web security group and outbound TCP port 443 to the internet. Additionally, configure the stateless Network ACL on the database subnet to allow inbound TCP port 3306 and ephemeral ports (1024-65535) for return traffic, and outbound TCP port 443 and ephemeral ports for return traffic.

The correct configurations properly apply stateful rules to the security group and stateless rules (including ephemeral ports) to the subnet Network ACL. The security group needs inbound port 3306 and outbound port 443, as it automatically tracks connections. The Network ACL requires inbound port 3306 and outbound port 443, along with outbound ephemeral ports (for database query responses) and inbound ephemeral ports (for software patch download responses).

Step-by-Step Solution

Determine the stateful security requirements at the instance level.

The database instances require a security group that allows inbound traffic on port 3306 from the web tier security group and outbound traffic on port 443 to the internet. Because security groups are stateful, return traffic is tracked and allowed automatically without requiring ephemeral port rules.

This satisfies the requirement to filter traffic at the instance level statefully.

Determine the stateless security requirements at the subnet level.

The database subnet Network ACL (NACL) must be configured to allow inbound queries (port 3306) and outbound patches (port 443). Because NACLs are stateless, we must also add rules to allow return traffic on ephemeral ports (1024-65535) for both directions.

This satisfies the requirement to filter traffic at the subnet level statelessly.

Key Concept

Stateful Security Groups vs Stateless Network ACLs

Question 66Question →

An enterprise architecture team is reviewing the security posture of an analytics application that processes sensitive financial data. The application requires access to a database password, and all associated Amazon EBS volumes must be encrypted. To comply with internal security policies, the database password must be rotated every 30 days without manual intervention, and the KMS keys used for EBS volume encryption must be automatically rotated annually. Which strategy should a solutions architect implement to meet these requirements with the least operational effort?

Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.

Store the database password in AWS Systems Manager Parameter Store as a standard String parameter. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.

Store the database password in AWS Secrets Manager with automatic rotation enabled. Encrypt the EBS volumes using a Customer Managed Key (CMK), enable automatic key rotation, and configure an automated script to immediately re-encrypt all existing historical EBS volume data block-by-block under the new key version.

Store the database password in AWS Secrets Manager. Log in as the AWS account root user to configure the Secrets Manager rotation policy and to create the Customer Managed Key (CMK) for EBS encryption to bypass KMS key policy permissions.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.

Answer

The correct solution stores database passwords securely in AWS Secrets Manager, which natively orchestrates rotation using AWS Lambda. It also encrypts EBS volumes using a Customer Managed Key (CMK) and leverages AWS KMS's native automatic rotation feature. This ensures that new data is encrypted with the new key version, while the previous key versions are retained to decrypt existing data without manual re-encryption overhead.

Step-by-Step Solution

Identify the secure storage and rotation mechanism for database credentials.

AWS Secrets Manager is selected because it natively supports automated rotation of database credentials using AWS Lambda, unlike Systems Manager Parameter Store standard String parameters.

Securing database credentials requires encryption at rest and automated lifecycle management.

Identify the encryption and rotation mechanism for EBS volumes.

Use a Customer Managed Key (CMK) with automatic annual key rotation enabled.

AWS KMS supports automatic annual rotation for CMKs without requiring existing data to be re-encrypted.

Combine the components into a single architecture that minimizes operational overhead and adheres to best practices.

The database credentials are managed by Secrets Manager and the EBS volumes are encrypted using KMS CMKs with rotation enabled, without root account usage or manual re-encryption scripts.

This combination meets all compliance requirements with native AWS capabilities.

Key Concept

Database credential rotation using Secrets Manager and KMS Customer Managed Key automatic rotation mechanics.

Estimated Time:1m 30s

Question 67Question →

A company hosts its static website assets in an Amazon S3 bucket located in the us-east-1 Region. To ensure high availability and resiliency, the company replicates these assets to a secondary S3 bucket in the us-west-2 Region. A solutions architect needs to configure Amazon CloudFront to deliver these assets with low latency and automatically serve files from the backup S3 bucket if the primary S3 bucket returns an HTTP 503 Service Unavailable error. Which configuration should the solutions architect use to meet these requirements?

Configure a CloudFront origin group with the primary S3 bucket as the primary origin and the secondary S3 bucket as the failover origin, selecting the 503 status code in the failover criteria.

Create an Amazon Route 53 latency-based routing policy to automatically route user requests to either the primary or secondary S3 bucket based on the health check status of the buckets.

Deploy AWS WAF with a custom web ACL rule on the CloudFront distribution to inspect traffic and redirect client requests to the secondary S3 bucket when the primary S3 bucket returns a 503 error.

Configure the CloudFront cache behavior for static assets to have a Time to Live (TTL) of zero, forcing CloudFront to query both S3 buckets in parallel for every user request.

Show answer & explanation

Answer: Configure a CloudFront origin group with the primary S3 bucket as the primary origin and the secondary S3 bucket as the failover origin, selecting the 503 status code in the failover criteria.

Answer

Configure a CloudFront origin group with the primary S3 bucket as the primary origin and the secondary S3 bucket as the failover origin, selecting the 503 status code in the failover criteria.

Configuring a CloudFront origin group provides a native, seamless way to implement high availability for static content. By setting up an origin group with a primary S3 bucket and a failover S3 bucket, CloudFront automatically retries the request against the secondary origin when the primary origin returns specific HTTP status codes such as 503.

Step-by-Step Solution

Identify the primary requirement for origin failover and low-latency content delivery.

Amazon CloudFront is selected as the content delivery network (CDN) to cache content at edge locations.

CloudFront caches content globally to reduce latency for end users.

Configure high availability for the S3 origin within CloudFront.

Create a CloudFront origin group containing both S3 buckets as origins.

An origin group is the native CloudFront feature designed to handle failover between two origins.

Define failover conditions for the origin group.

Specify the 503 HTTP status code as a trigger to failover from the primary bucket to the secondary bucket.

This ensures that if the primary S3 bucket experiences issues and returns a 503 error, CloudFront automatically retrieves the requested asset from the backup bucket without impacting the client.

Key Concept

CloudFront Origin Groups and Origin Failover

Estimated Time:50s

Question 68Question →

An international logistics provider runs a critical tracking application using Amazon RDS for PostgreSQL in the us-east-1 Region. The company requires a disaster recovery (DR) solution in the us-west-2 Region with a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 15 minutes. Additionally, the secondary region must serve read-only reporting workloads during normal operations to offload the primary database. Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Create a cross-region read replica of the primary database in the us-west-2 Region.

Promote the cross-region read replica to a standalone DB instance in the us-west-2 Region during a disaster recovery event, and update the application connection settings.

Configure an RDS Multi-AZ DB cluster configuration that spans across both the us-east-1 and us-west-2 Regions to enable synchronous replication and automatic failover.

Set up an Amazon Route 53 latency routing policy to automatically promote the secondary database instance and route application write traffic when the primary database is unhealthy.

Configure AWS Backup to take database snapshots every 4 hours, copy them to the us-west-2 Region, and restore the database from the copied snapshots during a failover event.

Show answer & explanation

Answer: Create a cross-region read replica of the primary database in the us-west-2 Region.; Promote the cross-region read replica to a standalone DB instance in the us-west-2 Region during a disaster recovery event, and update the application connection settings.

Answer

To meet the requirements, the company should create a cross-region read replica in the secondary region to handle reporting workloads and maintain low replication lag, and then promote that replica to a standalone DB instance during a DR event.

The correct actions are to create a cross-region read replica in the secondary region and to promote this replica to a standalone instance during a failover. The cross-region read replica satisfies the RPO of less than 5 minutes due to continuous asynchronous replication and allows read-only reporting queries to run in the secondary region. Promoting the read replica takes only a few minutes, which satisfies the 15-minute RTO.

Step-by-Step Solution

Select a replication method that meets the RPO and read workload requirements.

Creating an Amazon RDS cross-region read replica provides near-continuous asynchronous replication (meeting the 5-minute RPO) and can serve read-only reporting traffic during normal operations.

Asynchronous replication to a read replica offloads reads and replicates changes without synchronous write latency across regions.

Select a failover method that meets the 15-minute RTO requirement.

Promoting the read replica to a standalone instance takes only a few minutes.

Promoting an existing read replica is significantly faster than restoring from backups or setting up new instances, keeping RTO well under the 15-minute threshold.

Identify and eliminate options that are technically impossible or violate constraints.

Eliminated Multi-AZ spanning regions (not supported), Route 53 database promotion (DNS only), and 4-hour backup restore (violates RPO).

Multi-AZ is single-region, Route 53 cannot perform database operations, and snapshot restores from 4-hour intervals violate the RPO constraint.

Key Concept

Cross-Region Disaster Recovery using RDS Read Replicas

Question 69Question →

A global agricultural logistics company is migrating its telemetry archiving system to AWS. The system must store critical supply chain data with an RPO of $15$ minutes and an RTO of $30$ minutes. The architecture must ensure the data is resilient to regional disasters and remains immediately readable from a secondary destination region for localized reporting. Which two configurations should the solutions architect combine to meet these resilience and recovery requirements?

Select all that apply

Configure Amazon S3 Cross-Region Replication (CRR) to automatically copy telemetry data to a destination bucket in the secondary region.

Enable S3 Replication Time Control (RTC) on the replication rule configured for the telemetry data bucket.

Replicate telemetry objects to Amazon S3 Glacier Flexible Retrieval in the secondary region using standard retrievals during regional failover.

Set up AWS Volume Gateway in Cached mode to back up the data locally, configuring snapshots scheduled twice daily to the secondary region.

Deploy Amazon RDS Multi-AZ instances with read replicas in the secondary region to store the raw telemetry objects.

Show answer & explanation

Answer: Configure Amazon S3 Cross-Region Replication (CRR) to automatically copy telemetry data to a destination bucket in the secondary region.; Enable S3 Replication Time Control (RTC) on the replication rule configured for the telemetry data bucket.

Answer

To meet the requirements, the solutions architect should configure Amazon S3 Cross-Region Replication (CRR) to copy telemetry data to the destination bucket and enable S3 Replication Time Control (RTC) to ensure replication is completed within the

15

-minute RPO.

Configuring Amazon S3 Cross-Region Replication (CRR) copies objects to a secondary region automatically, keeping the data immediately readable. Enabling S3 Replication Time Control (RTC) enforces replication within

15

minutes, satisfying the

15

-minute RPO requirement.

Step-by-Step Solution

Select the appropriate storage service for storing raw telemetry objects across regions.

Amazon S3 with Cross-Region Replication (CRR) is selected, ensuring durability and cross-region disaster recovery.

This establishes a replicated object repository that supports immediate, active read access in the destination region.

Configure Replication Time Control (RTC) on the S3 replication rule.

RTC guarantees that

99.99\%

of objects replicate within

15

minutes.

This configuration directly aligns with the strict RPO constraint of

15

minutes.

Key Concept

Amazon S3 Cross-Region Replication with Replication Time Control (RTC) to guarantee strict RPO/RTO constraints.

Question 70Question →

An insurance company manages a multi-account environment on AWS using AWS Organizations. The company wants to allow its on-premises Active Directory users to access resources across these accounts using their existing corporate credentials. The solution must minimize operational overhead, avoid user data replication, and allow central management of permissions. Which of the following actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.

Create permission sets within AWS IAM Identity Center and associate them with the Active Directory groups mapping to the target AWS accounts.

Create individual IAM users in each target AWS account for every Active Directory user and implement a script to synchronize passwords periodically.

Generate access keys for the AWS account root user of the Organizations management account and share them with the Active Directory administrators for cross-account management.

Store the Active Directory administrator credentials as plaintext String parameters in AWS Systems Manager Parameter Store to automate cross-account role assumption.

Show answer & explanation

Answer: Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.; Create permission sets within AWS IAM Identity Center and associate them with the Active Directory groups mapping to the target AWS accounts.

Answer

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector, then create permission sets within AWS IAM Identity Center and associate them with the Active Directory groups mapping to the target AWS accounts.

The correct solution involves configuring AWS IAM Identity Center with AWS Directory Service AD Connector to link the on-premises Active Directory to AWS without replicating credentials. Additionally, permission sets must be created in AWS IAM Identity Center and assigned to the AD groups to grant access to the member accounts in the organization. This fulfills all requirements of centralized management, zero data replication, and low operational overhead.

Step-by-Step Solution

Establish connectivity between AWS and the on-premises directory.

AWS Directory Service AD Connector is deployed, redirecting directory authentication requests to the on-premises Active Directory without copying credentials.

This establishes directory integration without user database replication and minimizes operational overhead.

Configure AWS IAM Identity Center to use the AD Connector as its identity source.

AWS IAM Identity Center points to the Active Directory, allowing it to read groups and users directly.

This enables centralized login portal access for Active Directory users.

Create permission sets and assign them to the mapped groups.

Permissions are centrally defined as permission sets and linked to the corresponding AD groups inside the target AWS accounts.

This satisfies the requirement for central management of permissions.

Key Concept

AWS IAM Identity Center federation with on-premises Active Directory via AD Connector enables seamless single sign-on while keeping user credentials within the local directory and allowing centralized permission control via permission sets.

Estimated Time:2m 0s

Question 71Question →

A software development company runs nightly build integration tests. The build artifacts, which average $4\text{ MB}$ each, are uploaded to an Amazon S3 Standard bucket. The developers access these build artifacts frequently for the first $12$ days to debug any integration issues. After $12$ days, the artifacts are rarely accessed, but the company's compliance policy requires that they be retained for a total of $27$ days before being permanently deleted. Millisecond retrieval times are required if an older artifact needs to be inspected. Which of the following lifecycle configurations is the most cost-effective?

Store the artifacts in Amazon S3 Standard for the entire

27

days, and then use an S3 Lifecycle rule to delete them.

Transition the artifacts to Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

12

days after upload, and delete them after

27

days.

Transition the artifacts to Amazon S3 Glacier Flexible Retrieval

12

days after upload, and delete them after

27

days.

Transition the artifacts to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) immediately upon upload, and delete them after

27

days.

Show answer & explanation

Answer: Store the artifacts in Amazon S3 Standard for the entire $27$ days, and then use an S3 Lifecycle rule to delete them.

Answer

Store the artifacts in Amazon S3 Standard for the entire 27 days, and then use an S3 Lifecycle rule to delete them.

Keeping the artifacts in S3 Standard for the entire 27 days is the most cost-effective approach. Transitioning the objects to S3 Standard-IA after 12 days would keep them in that tier for only 15 days before deletion. Since S3 Standard-IA has a minimum storage duration of 30 days, the company would be billed for 30 days of storage, incurring an early deletion charge that negates the lower storage rate.

Step-by-Step Solution

Analyze the retrieval performance requirements.

The requirements demand millisecond retrieval times, which means cold storage classes like Amazon S3 Glacier Flexible Retrieval cannot be used.

S3 Glacier Flexible Retrieval requires minutes to hours for data retrieval, violating the retrieval time constraint.

Determine the storage duration in the transitioned tier.

The files are transitioned after

12

days and deleted at

27

days, meaning they would spend

15

days in the secondary tier.

Evaluating the exact duration the files spend in the secondary tier is necessary to check for minimum storage duration penalties.

Evaluate S3 Standard-IA billing rules.

S3 Standard-IA has a

30

-day minimum storage duration. A

15

-day residency incurs a

15

-day billing penalty.

Understanding the minimum storage duration rule allows us to calculate that transitioning to S3 Standard-IA is not cost-effective due to the early deletion charge.

Key Concept

S3 Standard-IA storage class has a minimum storage duration of 30 days, which makes transitioning short-lived data to this tier financially suboptimal due to early deletion charges.

Question 72Question →

A smart grid utility company collects electricity consumption readings from $1\text{ million}$ smart meters every $15\text{ minutes}$ . The total data volume during peak hours reaches $15\text{ MB/s}$ of XML data. The company needs to ingest this data, convert the format from XML to JSON in near-real-time, and store the output in Amazon S3 for downstream analytics. The ingestion pipeline must scale automatically to handle load fluctuations and require minimal operational overhead. Which combination of actions should the solutions architect recommend to meet these requirements? (Select two.)

Select all that apply

Use Amazon Kinesis Data Firehose to ingest the data and invoke an AWS Lambda function to transform the format from XML to JSON.

Ingest the data into an Amazon Kinesis Data Streams stream configured with provisioned mode and a fixed number of shards to handle peak traffic.

Deliver the transformed JSON records from Amazon Kinesis Data Firehose directly to the target Amazon S3 bucket.

Send the readings to an Amazon SQS standard queue to buffer the data and guarantee that messages are processed in strict first-in, first-out (FIFO) order.

Ingest the readings using an Amazon SQS standard queue and trigger an AWS Lambda function to transform the messages while relying on SQS to preserve the exact order of the data.

Show answer & explanation

Answer: Use Amazon Kinesis Data Firehose to ingest the data and invoke an AWS Lambda function to transform the format from XML to JSON.; Deliver the transformed JSON records from Amazon Kinesis Data Firehose directly to the target Amazon S3 bucket.

Answer

The correct combination of actions is to use Amazon Kinesis Data Firehose to ingest the data and invoke an AWS Lambda function to transform the format from XML to JSON, and to deliver the transformed JSON records from Amazon Kinesis Data Firehose directly to the target Amazon S3 bucket.

Amazon Kinesis Data Firehose is a fully managed service that scales automatically to match stream throughput, satisfying the high performance and low operational overhead criteria. It features built-in integration with AWS Lambda to execute data transformation synchronously as data passes through the delivery stream. Delivering the results directly to Amazon S3 completes a robust, scalable, and serverless ingestion pipeline.

Step-by-Step Solution

Identify the scaling and operational requirements.

The pipeline must handle up to

15\text{ MB/s}

peak traffic, scale automatically, and require minimal operational overhead.

This points toward a serverless managed ingestion service rather than provisioned streams or custom self-managed consumers.

Evaluate the ingestion and transformation mechanism.

Amazon Kinesis Data Firehose can ingest the data stream and trigger an inline AWS Lambda function to handle format transformation (XML to JSON) before delivery.

Firehose handles buffering, scaling, and transformation invocation serverlessly, eliminating the need to write custom scaling logic.

Select the destination delivery target.

Configure Amazon S3 as the target delivery destination within the Kinesis Data Firehose stream.

Firehose directly writes the output JSON files to S3, completing the end-to-end data flow with zero additional components.

Key Concept

Serverless streaming ingestion and transformation using Amazon Kinesis Data Firehose and AWS Lambda.

Question 73Question →

A company is deploying a high-performance clustered database application on $5$ Amazon EC2 instances located in a single Availability Zone. The application requires shared block-level access to a single storage volume that will be formatted with a cluster-aware file system. The storage volume must deliver a consistent performance of $15,000\text{ IOPS}$ with sub-millisecond latencies.

Which storage configuration will meet these requirements?

Provision an Amazon EBS io2 volume, enable EBS Multi-Attach, and attach the volume to all

5

EC2 instances.

Provision an Amazon EBS gp3 volume, enable EBS Multi-Attach, and attach the volume to all

5

EC2 instances.

Create an Amazon EFS file system configured with Provisioned Throughput, and mount the file system on all

5

EC2 instances.

Create an Amazon S3 bucket, configure Amazon S3 Transfer Acceleration, and mount the bucket as a local drive on all

5

EC2 instances.

Show answer & explanation

Answer: Provision an Amazon EBS io2 volume, enable EBS Multi-Attach, and attach the volume to all $5$ EC2 instances.

Answer

Provision an Amazon EBS io2 volume, enable EBS Multi-Attach, and attach the volume to all

5

EC2 instances.

The correct configuration is to provision an Amazon EBS io2 volume and enable EBS Multi-Attach. Multi-Attach allows attaching a single Provisioned IOPS volume to multiple Nitro-based EC2 instances within the same Availability Zone. This meets the requirement for shared block-level access with consistent performance and sub-millisecond latency. Since the database application is deployed in a single Availability Zone, this solution is fully compatible.

Step-by-Step Solution

Identify the architectural requirements: shared block-level storage, a single Availability Zone,

15,000\text{ IOPS}

, and sub-millisecond latency.

The solution must support attaching a single block volume to multiple EC2 instances concurrently.

Standard block storage (EBS) only allows a one-to-one attachment unless Multi-Attach is enabled.

Evaluate the block storage options that support Multi-Attach.

Only Provisioned IOPS SSD volumes (io1 and io2) support EBS Multi-Attach; General Purpose SSD (gp3) volumes do not support this feature.

AWS restricts Multi-Attach to high-performance provisioned IOPS workloads.

Determine if file or object storage options are suitable.

Amazon EFS and Amazon S3 are file-level and object-level storage systems, respectively, and cannot be formatted with a block-level cluster-aware file system.

The requirement explicitly calls for block-level access for a cluster file system.

Key Concept

EBS Multi-Attach allows mounting a single Provisioned IOPS volume to multiple EC2 instances in the same Availability Zone for shared block storage.

Question 74Question →

A digital ticketing platform plans to migrate its database to Amazon Aurora MySQL. The database must sustain high availability during an Availability Zone outage with a recovery time objective (RTO) of less than 60 seconds and zero data loss (recovery point objective or RPO of 0). In addition, the database must dynamically scale to support a large, unpredictable volume of read queries. Which two configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy the database as an Amazon Aurora cluster with a primary instance and one or more Aurora Replicas in different Availability Zones.

Configure the application to use the Aurora reader endpoint and enable Aurora Auto Scaling for the reader instances.

Deploy the database as a single-AZ Amazon Aurora instance and create an Aurora Read Replica in a second Availability Zone to perform manual failover.

Deploy a pilot light backup database in a secondary Region and configure Route 53 failover to achieve sub-minute automatic failover.

Use Amazon Route 53 latency routing policies to distribute database write operations across all active replica instances.

Show answer & explanation

Answer: Deploy the database as an Amazon Aurora cluster with a primary instance and one or more Aurora Replicas in different Availability Zones.; Configure the application to use the Aurora reader endpoint and enable Aurora Auto Scaling for the reader instances.

Answer

Deploy the database as an Amazon Aurora cluster with a primary instance and Aurora Replicas in different Availability Zones, and configure the application to use the Aurora reader endpoint while enabling Aurora Auto Scaling.

Deploying the database as a Multi-AZ Amazon Aurora cluster with replicas in multiple Availability Zones ensures that if the primary instance fails, Aurora automatically promotes a replica within 30 seconds with no data loss because all replicas share the cluster's distributed storage volume. Routing read traffic to the reader endpoint and enabling Aurora Auto Scaling ensures the database dynamically handles spikes in read queries by automatically scaling the number of read replicas.

Step-by-Step Solution

Analyze high availability (RTO/RPO) requirements.

Identified that RTO must be under 60 seconds and RPO must be 0 (no data loss) in case of an Availability Zone outage.

This necessitates automatic failover and synchronous-like storage replication within the region.

Evaluate the database deployment model.

Selecting a Multi-AZ cluster deployment with Aurora Replicas across different Availability Zones guarantees automatic failover and shared storage replication.

Aurora storage is automatically replicated across three Availability Zones. Failover to an Aurora Replica in another AZ takes less than 30 seconds.

Analyze the read scaling requirements.

Determined that read scaling must be dynamic and handled automatically.

By connecting the application to the reader endpoint and configuring Aurora Auto Scaling, instances are provisioned or terminated dynamically to handle load changes.

Key Concept

High Availability and Read Scaling in Amazon Aurora

Question 75Question →

A startup runs a public web application on Amazon EC2 instances that requires a baseline capacity of four instances running 24/7 to handle steady-state traffic. The application writes to an Amazon DynamoDB table that experiences sudden, highly unpredictable spikes in database traffic. In addition, the startup runs daily batch processing jobs on AWS Fargate that are fault-tolerant and can be interrupted at any time.

Which combination of purchasing strategies should a solutions architect recommend to minimize compute costs for these workloads? (Select TWO.)

Select all that apply

Purchase a Compute Savings Plan to cover the steady-state EC2 instances.

Use AWS Fargate Spot for the batch processing workloads.

Purchase a Compute Savings Plan to reduce the cost of the Amazon RDS database instances.

Migrate the 24/7 steady-state EC2 instances to AWS Lambda functions to eliminate idle compute costs.

Configure the Amazon DynamoDB table to use Provisioned Capacity mode to handle the unpredictable spiky traffic.

Show answer & explanation

Answer: Purchase a Compute Savings Plan to cover the steady-state EC2 instances.; Use AWS Fargate Spot for the batch processing workloads.

Answer

The solutions architect should purchase a Compute Savings Plan to cover the steady-state EC2 instances and use AWS Fargate Spot for the batch processing workloads.

Purchasing a Compute Savings Plan provides significant savings for the steady-state Amazon EC2 instances since they run continuously 24/7. Using AWS Fargate Spot is the most cost-effective choice for the batch processing workloads because they are fault-tolerant and can tolerate interruptions.

Step-by-Step Solution

Analyze the steady-state EC2 workload running 24/7.

Identify that a Compute Savings Plan offers the best discount for continuous, predictable EC2 compute usage over a 1-year or 3-year term.

Compute Savings Plans provide significant savings for steady-state workloads compared to On-Demand rates.

Analyze the batch processing Fargate workload.

Identify that AWS Fargate Spot is the most cost-effective option since the jobs are fault-tolerant and can tolerate interruptions.

Spot pricing provides the deepest discounts for interruptible workloads.

Evaluate the database and capacity configurations for other components.

Exclude Compute Savings Plans for RDS database instances and eliminate Lambda for continuous 24/7 workloads to prevent high costs.

Compute Savings Plans do not cover RDS, and Lambda is not cost-effective for continuous 24/7 processing.

Key Concept

Selecting the most cost-effective compute purchasing model based on workload characteristics (steady-state vs. interruptible) and service boundaries.

Question 76Question →

A manufacturing company is migrating its workloads to a multi-account environment on AWS managed by AWS Organizations. The company maintains an on-premises Microsoft Active Directory containing all employee accounts. The company wants to allow its security administrators to log in to the AWS Management Console and access the AWS CLI using their existing corporate credentials. The solution must minimize operational overhead, avoid replicating Active Directory passwords to the cloud, and support centralized permission management. Which combination of actions should the solutions architect recommend to meet these requirements? (Select two.)

Select all that apply

Enable AWS IAM Identity Center in the Organizations management account and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.

Create permission sets in AWS IAM Identity Center and assign them to the mapped Active Directory groups to control access to AWS resources.

Create individual IAM users in each target AWS account, configure long-term credentials for each user, and assign them to IAM groups that mimic the on-premises directory structure.

Log in to the AWS account root user of each member account to configure a custom SAML 2.0 identity provider pointing to the on-premises directory.

Show answer & explanation

Answer: Enable AWS IAM Identity Center in the Organizations management account and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.; Create permission sets in AWS IAM Identity Center and assign them to the mapped Active Directory groups to control access to AWS resources.

Answer

The correct configuration involves enabling AWS IAM Identity Center in the Organizations management account, connecting it to the on-premises directory via an AD Connector, and creating permission sets mapped to Active Directory groups.

Enabling AWS IAM Identity Center and using an AD Connector provides a secure, low-overhead gateway to redirect authentication requests to the on-premises directory without replicating passwords or credentials to AWS. Mapping permission sets centrally to Active Directory groups allows administrators to govern access across all member accounts from a single location.

Step-by-Step Solution

Identify the correct federation service for multi-account management.

AWS IAM Identity Center is selected over individual IAM configurations to provide single sign-on capabilities across the AWS Organization.

IAM Identity Center is the modern AWS recommendation for centralizing multi-account access.

Establish connectivity to the on-premises Active Directory without password replication.

Deploy an AWS Directory Service AD Connector to act as a directory gateway.

AD Connector redirects authentication requests directly to the on-premises Active Directory, ensuring no passwords or hashes are replicated to the cloud.

Map Active Directory groups to AWS permissions.

Create permission sets in AWS IAM Identity Center and associate them with mapped AD groups.

This allows group-based authorization, matching existing corporate governance structures.

Key Concept

Centralized multi-account access management using AWS IAM Identity Center integrated with an on-premises Active Directory via AD Connector.

Question 77Question →

A healthcare software provider is deploying a critical patient portal application on AWS. The application database tier requires high availability within the primary Region (us-east-1) to survive the loss of an Availability Zone with a Recovery Time Objective (RTO) of under 60 seconds. Additionally, the provider requires a cross-region disaster recovery (DR) solution in the us-west-2 Region with a Recovery Point Objective (RPO) of under 1 minute and a Recovery Time Objective (RTO) of under 15 minutes. Which combination of database configurations will meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon Aurora PostgreSQL DB cluster in us-east-1 with at least one Aurora Replica in a different Availability Zone.

Use Amazon Aurora Global Databases to replicate data from us-east-1 to a secondary Aurora DB cluster in us-west-2.

Configure a single-AZ Amazon RDS for PostgreSQL DB instance in us-east-1 and set up an active-passive cross-Region Read Replica in us-west-2 for primary database failover.

Configure a Multi-AZ Amazon RDS for PostgreSQL DB instance in us-east-1, and use Amazon Route 53 latency routing to dynamically route database write requests between us-east-1 and us-west-2.

Deploy an Amazon RDS for PostgreSQL DB instance in us-east-1, and configure a Pilot Light recovery structure in us-west-2 by keeping a scaled-down RDS instance running and synchronizing it via daily snapshot copying.

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL DB cluster in us-east-1 with at least one Aurora Replica in a different Availability Zone.; Use Amazon Aurora Global Databases to replicate data from us-east-1 to a secondary Aurora DB cluster in us-west-2.

Answer

Deploy an Amazon Aurora PostgreSQL DB cluster in us-east-1 with at least one Aurora Replica in a different Availability Zone, and use Amazon Aurora Global Databases to replicate data from us-east-1 to a secondary Aurora DB cluster in us-west-2.

Deploying an Amazon Aurora DB cluster with an Aurora Replica in a different Availability Zone provides automatic failover in under 30 seconds, satisfying the regional high availability RTO requirement of under 60 seconds. Combining this with Amazon Aurora Global Databases allows storage-level, low-latency replication to a secondary Region with a lag of less than 1 second (satisfying the 1-minute RPO) and enabling promotion of the secondary cluster in less than 1 minute (satisfying the 15-minute RTO).

Step-by-Step Solution

Analyze the regional high availability constraint (RTO < 60 seconds in us-east-1).

Identify that a Multi-AZ deployment is required. An Amazon Aurora PostgreSQL DB cluster with at least one replica in a separate Availability Zone provides automatic failover in under 30 seconds, meeting the target.

Single-AZ deployments or manual replica promotions do not meet the low RTO requirement for regional Availability Zone failures.

Analyze the cross-region disaster recovery constraints (RPO < 1 minute, RTO < 15 minutes in us-west-2).

Select Amazon Aurora Global Databases, which use fast storage-level replication with lag under 1 second (meeting the RPO of under 1 minute) and support failover/promotion in minutes (meeting the RTO of under 15 minutes).

Daily snapshot replication (Pilot Light) results in an RPO of 24 hours, which violates the 1-minute RPO limit.

Key Concept

High availability and disaster recovery design using Amazon Aurora Multi-AZ and Aurora Global Databases

Estimated Time:2m 0s

Question 78Question →

A company runs a high-performance web application on a fleet of Amazon EC2 instances distributed across two Availability Zones. The instances require concurrent read/write access to a shared, POSIX-compliant file system to store and retrieve media assets. The storage must scale throughput automatically to handle unpredictable traffic spikes while maintaining low latency.

Which storage solution should a solutions architect recommend to meet these requirements with the least operational overhead?

Amazon EFS configured with Elastic throughput

A single Amazon EBS gp3 volume with Multi-Attach enabled, formatted with an ext4 file system and mounted to all EC2 instances

A single Amazon EBS io2 volume with Multi-Attach enabled, mounted to all EC2 instances across both Availability Zones

An Amazon S3 bucket mounted to the EC2 instances using the AWS Storage Gateway Volume Gateway

Show answer & explanation

Answer: Amazon EFS configured with Elastic throughput

Answer

Amazon EFS configured with Elastic throughput

The correct answer is the option proposing Amazon EFS with Elastic throughput. Amazon EFS is designed as a serverless, shared, POSIX-compliant file system that can be accessed concurrently by EC2 instances in multiple Availability Zones. Elastic throughput ensures that the storage scales dynamically to handle unpredictable spikes in traffic without operational management.

Step-by-Step Solution

Identify the storage requirements of the application: concurrent access, multi-AZ deployment, POSIX compliance, automatic scaling of throughput, and low operational overhead.

Amazon EFS is selected as the primary candidate because it natively provides a shared POSIX-compliant file system that spans multiple Availability Zones and supports concurrent access.

Eliminating block-based storage options (EBS) which are locked to a single Availability Zone and do not natively support standard concurrent file sharing across multiple instances.

Evaluate EFS throughput modes to address unpredictable spikes in traffic.

Elastic throughput mode is selected because it dynamically scales throughput based on workload demands, eliminating the need to provision or manage throughput limits manually.

Ensuring the system handles performance spikes cost-effectively and with minimal operational effort.

Key Concept

Shared file storage using Amazon EFS with Elastic throughput mode across multiple Availability Zones.

Question 79Question →

A maritime fleet management company is designing a high-availability telemetry processing system on AWS. The application runs on Amazon ECS containers across multiple Availability Zones in the primary region (`eu-west-1`). The containers require concurrent read/write access to a shared POSIX-compliant file system. The architecture must support a multi-region disaster recovery (DR) plan in `eu-central-1` with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 10 minutes. During failover, the file system in the recovery region must be immediately writable without latency or performance degradation. Which combination of configurations will meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon Elastic File System (Amazon EFS) file system in `eu-west-1` using the Regional storage class, and configure Amazon EFS Replication to a destination file system in `eu-central-1`.

In the disaster recovery region (`eu-central-1`), configure the ECS task definitions to mount the replica EFS file system using its native mount target when initiating failover.

Store the telemetry files in Amazon S3 in `eu-west-1`, configure S3 Cross-Region Replication (CRR) to an S3 Glacier Flexible Retrieval bucket in `eu-central-1`, and use Standard retrievals during failover.

Implement a Pilot Light disaster recovery strategy by deploying active, fully running ECS tasks in `eu-central-1` that continuously mount the `eu-west-1` EFS file system via an inter-region VPC peering connection.

Configure an Amazon Aurora PostgreSQL Global Database with write forwarding enabled in the primary database cluster in `eu-west-1` to act as the shared POSIX-compliant mount target for the ECS containers.

Show answer & explanation

Answer: Create an Amazon Elastic File System (Amazon EFS) file system in `eu-west-1` using the Regional storage class, and configure Amazon EFS Replication to a destination file system in `eu-central-1`.; In the disaster recovery region (`eu-central-1`), configure the ECS task definitions to mount the replica EFS file system using its native mount target when initiating failover.

Answer

Deploying an Amazon EFS file system in the primary region with replication configured to the secondary region, and configuring the secondary region's ECS tasks to mount the replicated EFS file system.

Deploying Amazon EFS with native replication guarantees that files are automatically copied across regions with low latency, satisfying the 15-minute RPO. In the event of a failover, mounting the local replicated file system in the secondary region allows ECS containers to start up and begin executing operations instantly, comfortably staying within the 10-minute RTO.

Step-by-Step Solution

Determine the storage access requirement.

The application requires concurrent read/write POSIX-compliant access, which makes Amazon Elastic File System (EFS) the ideal choice over object storage or block storage.

Amazon EFS supports concurrent access from multiple container instances and complies with standard POSIX directory structures and permissions.

Assess replication and RPO compliance.

Enable Amazon EFS Replication from the primary region to the disaster recovery region.

EFS Replication transfers data asynchronously across regions and typically updates the replica within minutes, satisfying the 15-minute RPO.

Determine recovery procedures to meet the RTO.

Configure ECS container tasks in the secondary region to mount the replicated EFS file system.

When a failover occurs, the secondary EFS is immediately available for read and write operations. The ECS tasks can mount the local replica with minimal latency, ensuring the 10-minute RTO is met.

Key Concept

Multi-Region shared storage resilience utilizing Amazon EFS Replication to achieve low recovery metrics.

Question 80Question →

A company hosts a latency-sensitive application across two AWS Regions: us-east-1 and us-west-2. The company needs to route global user traffic to the Region that offers the lowest latency, with automatic failover if a Region becomes unhealthy. Additionally, the company must establish a secure hybrid network connection to replicate database backups from their on-premises data center to both AWS Regions. The replication traffic requires a consistent bandwidth of $2.5$ Gbps. Which architecture should a solutions architect recommend to meet these requirements?

Deploy AWS Global Accelerator to route user traffic to the application endpoints in both Regions. Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing across multiple VPN tunnels to handle the database replication traffic.

Deploy AWS Global Accelerator to route user traffic to the application endpoints in both Regions. Establish a single AWS Site-to-Site VPN connection directly to a Virtual Private Gateway in each Region to handle the database replication traffic, relying on the VPN tunnel to dynamically scale up to the required throughput.

Configure Amazon Route 53 with a latency routing policy to direct user traffic to the Application Load Balancers (ALBs) in both Regions without active health checks. Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing across multiple VPN tunnels to handle the database replication traffic.

Deploy AWS Global Accelerator to route user traffic to the application endpoints in both Regions. Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway with ECMP enabled. To secure the database replication, configure stateless Network ACLs on the database subnets to allow inbound traffic on the replication port, without adding corresponding outbound rules.

Show answer & explanation

Answer: Deploy AWS Global Accelerator to route user traffic to the application endpoints in both Regions. Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing across multiple VPN tunnels to handle the database replication traffic.

Answer

The correct architecture uses AWS Global Accelerator to route user traffic using the low-latency AWS global network and automatically redirects traffic around unhealthy endpoints. For the hybrid database replication, because a single AWS Site-to-Site VPN tunnel is limited to

1.25

Gbps, configuring multiple VPN tunnels with ECMP enabled on an AWS Transit Gateway allows the connection to scale to

2.5

Gbps.

Step-by-Step Solution

Address the user latency and failover requirements.

Using AWS Global Accelerator directs users to the nearest application endpoint using the AWS edge network and provides automatic health-check-based failover.

Global Accelerator uses Anycast IP addresses and the AWS global backbone network to minimize latency and automatically route around unhealthy endpoints.

Address the hybrid database replication throughput requirement.

Establish a Site-to-Site VPN with multiple tunnels attached to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing.

Since a single AWS VPN tunnel has a hard limit of

1.25

Gbps, ECMP routing across multiple active tunnels is required to aggregate bandwidth and support the

2.5

Gbps throughput requirement.

Key Concept

AWS Transit Gateway ECMP routing scales VPN bandwidth beyond the

1.25

Gbps tunnel limit, and AWS Global Accelerator optimizes user latency with automatic failover.

Estimated Time:1m 30s

PreviousPage 4 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept