All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A company has Amazon EC2 instances in a private subnet that frequently transfer hundreds of gigabytes of data to and from an Amazon S3 bucket. The private subnet currently routes all traffic to the internet through a NAT Gateway. The company wants to reduce the high data transfer costs associated with S3 access. Which action is the most cost-effective solution to meet these requirements?

Create a Gateway VPC Endpoint for Amazon S3 and update the route table of the private subnet to direct S3 traffic to the endpoint.

Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon S3 and route all S3 traffic through it.

Provision an additional NAT Gateway in a different Availability Zone to distribute the S3 data transfer load.

Replace the NAT Gateway with a NAT Instance to handle the traffic at a lower per-gigabyte data transfer rate.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon S3 and update the route table of the private subnet to direct S3 traffic to the endpoint.

Answer

Create a Gateway VPC Endpoint for Amazon S3 and update the route table of the private subnet to direct S3 traffic to the endpoint.

Creating a Gateway VPC Endpoint for Amazon S3 and updating the route table is the most cost-effective option because Gateway VPC Endpoints are free to deploy and do not incur data processing or transfer charges. This completely removes the S3 traffic from the NAT Gateway, eliminating the associated NAT Gateway processing fees.

Step-by-Step Solution

Identify the source of the high data transfer charges.

The traffic to Amazon S3 from private EC2 instances is routing through a NAT Gateway, which incurs per-gigabyte data processing fees.

Traffic destined for public AWS service endpoints like S3 is treated as internet traffic by default and must go through a NAT gateway from a private subnet.

Select a routing alternative that bypasses the NAT Gateway.

Gateway VPC Endpoints for Amazon S3 allow traffic to be routed directly to S3 within the AWS internal network without leaving the VPC.

Gateway VPC Endpoints are free to create and use, and do not charge for data processing.

Configure the route tables to apply the changes.

Updating the private subnet's route table to point S3-destined traffic to the Gateway VPC Endpoint prefix list ensures all S3 traffic bypasses the NAT Gateway.

Route tables must be explicitly updated so that traffic to S3 is redirected away from the default route pointing to the NAT Gateway.

Key Concept

Gateway VPC Endpoints provide a secure and completely free mechanism to route traffic from a VPC to Amazon S3 and Amazon DynamoDB, bypassing expensive NAT Gateways.

Estimated Time:1m 0s

Question 822Question →

An enterprise runs a data processing application on Amazon EC2 instances located in private subnets. The application downloads and processes $10\text{ TB}$ of raw files daily from an Amazon S3 bucket located in the same AWS Region. Currently, all traffic to Amazon S3 is routed through a NAT Gateway, which has led to high monthly NAT Gateway data processing charges. A solutions architect must optimize the network architecture to minimize data transfer costs without compromising security. Which modification will achieve the highest cost savings?

Deploy an Interface VPC Endpoint (AWS PrivateLink) for Amazon S3 in each private subnet and update the application endpoint configuration.

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.

Set up an AWS Transit Gateway to route the S3 traffic to a centralized VPC containing a shared NAT Gateway.

Configure the EC2 instances with public IP addresses and route S3 traffic directly through an Internet Gateway.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.

Answer

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.

Creating a Gateway VPC Endpoint for Amazon S3 is the most cost-effective and secure solution. Gateway VPC Endpoints are offered at no cost, with no hourly charges or data processing fees. By associating the endpoint with the private subnet route tables, S3 traffic bypasses the NAT Gateway entirely, eliminating the high data processing fees while keeping the EC2 instances secure in their private subnets.

Step-by-Step Solution

Analyze the current data transfer route and costs.

The application transfers

10\text{ TB}

of data daily from EC2 instances in private subnets to Amazon S3 via a NAT Gateway. NAT Gateways charge a data processing fee (approximately

\$0.045\text{ per GB}

) in addition to hourly charges, leading to high daily costs.

Understanding the source of the cost is necessary to evaluate alternative routing paths.

Evaluate private routing alternatives for Amazon S3.

Gateway VPC Endpoints for Amazon S3 are available at no additional cost (no hourly charges, no data processing fees). Interface VPC Endpoints (AWS PrivateLink) support Amazon S3 but incur an hourly charge and data processing fees (approximately

\$0.01\text{ per GB}

Identifying the pricing models of alternative VPC endpoints helps select the most cost-effective solution.

Select and configure the most cost-effective and secure solution.

Create a Gateway VPC Endpoint for S3 and associate it with the route tables of the private subnets. This routes the traffic to S3 directly through the AWS network backbone, bypassing the NAT Gateway entirely and securing the connection without exposing instances to the public internet.

This configuration provides the highest cost savings while maintaining the security posture of the private subnets.

Key Concept

Gateway VPC Endpoints provide a free, secure pathway for VPC resources to access Amazon S3 and DynamoDB without traversing a NAT Gateway or utilizing public IP addresses.

Estimated Time:1m 30s

Question 823Question →

A retail company hosts its primary database in a VPC within the $us-east-1$ Region. The company needs to replicate database logs continuously to a disaster recovery VPC in the $us-west-2$ Region. The replication traffic is highly variable, regularly peaking at $2.5\text{ Gbps}$ . To comply with corporate policies, all data must be encrypted in transit, must not traverse the public internet, and must travel over a private network connection that can scale dynamically to support peak traffic. Which network configuration meets these requirements with the lowest operational complexity?

Establish an Inter-Region VPC Peering connection between the two VPCs and route the replication traffic directly over the peering connection.

Deploy a Site-to-Site VPN connection between the VPCs using AWS Transit Gateway in both regions to encrypt the replication traffic.

Configure software-based VPN appliances on Amazon EC2 instances in each VPC, and route traffic using public IP addresses with Network ACLs to restrict access.

Establish an AWS Direct Connect connection with an IPsec VPN between the two VPCs, and configure Amazon Route 53 latency-based routing to resolve the replica endpoints.

Show answer & explanation

Answer: Establish an Inter-Region VPC Peering connection between the two VPCs and route the replication traffic directly over the peering connection.

Answer

Establish an Inter-Region VPC Peering connection between the two VPCs and route the replication traffic directly over the peering connection.

Establishing an Inter-Region VPC Peering connection is the most efficient solution because it routes traffic over the private AWS global network backbone, avoiding the public internet. Inter-Region VPC Peering traffic is automatically encrypted at the physical layer. It does not have any bandwidth throughput bottlenecks, meaning it easily handles the

2.5\text{ Gbps}

peak traffic without requiring additional infrastructure configuration.

Step-by-Step Solution

Analyze the bandwidth requirement.

The replication traffic peaks at

2.5\text{ Gbps}

, which exceeds the

1.25\text{ Gbps}

limit of a single AWS Site-to-Site VPN tunnel.

This rules out solutions relying on a standard single VPN tunnel configuration without complex multipath routing.

Evaluate the path and encryption requirements.

The network path must be private (not over the public internet) and encrypted in transit.

Inter-Region VPC Peering traverses the private AWS global network backbone and is encrypted at the physical layer by default, meeting both criteria.

Compare scaling and operational complexity.

Inter-Region VPC Peering requires no additional network appliances or gateways to scale, representing the lowest operational complexity.

Unlike VPNs or custom EC2-based solutions, VPC Peering handles bandwidth scaling transparently.

Key Concept

AWS Inter-Region VPC Peering features built-in physical layer encryption and scales without throughput limits across the AWS global network backbone.

Question 824Question →

A genomics research company stores two types of data in an Amazon S3 bucket:

- Raw DNA sequence data: The files average $350\text{ MB}$ in size. They are accessed frequently during the first $10\text{ days}$ after upload. Afterward, they are rarely accessed, but must be retained for a total of $25\text{ days}$ from the upload date before they can be safely deleted.
- Variant call metadata: The files average $30\text{ KB}$ in size. They are accessed frequently for the first $15\text{ days}$ after upload. Afterward, they are rarely accessed, but must be retained for a total of $90\text{ days}$ from the upload date before they can be safely deleted.

Which Amazon S3 lifecycle configuration is the most cost-effective for managing these datasets?

Transition the raw DNA sequence data to S3 Standard-IA after

10\text{ days}

and delete them after

25\text{ days}

; transition the variant call metadata to S3 Standard-IA after

15\text{ days}

and delete them after

90\text{ days}

Transition the raw DNA sequence data to S3 Standard-IA after

10\text{ days}

and delete them after

25\text{ days}

; keep the variant call metadata in S3 Standard and delete them after

90\text{ days}

Keep both the raw DNA sequence data and the variant call metadata in S3 Standard for their entire lifetimes, and delete the raw data after

25\text{ days}

and the metadata after

90\text{ days}

Keep the raw DNA sequence data in S3 Standard and delete them after

25\text{ days}

; transition the variant call metadata to S3 Standard-IA after

15\text{ days}

and delete them after

90\text{ days}

Show answer & explanation

Answer: Keep both the raw DNA sequence data and the variant call metadata in S3 Standard for their entire lifetimes, and delete the raw data after $25\text{ days}$ and the metadata after $90\text{ days}$ .

Answer

Keep both the raw DNA sequence data and the variant call metadata in S3 Standard for their entire lifetimes, and delete the raw data after

25\text{ days}

and the metadata after

90\text{ days}

The correct answer is to keep both the raw DNA sequence data and the variant call metadata in S3 Standard for their entire lifetimes. The raw DNA sequence data has a total lifecycle of 25 days. Transitioning it to S3 Standard-IA after 10 days would mean storing it in the IA tier for only 15 days, which violates the 30-day minimum storage duration of S3 Standard-IA and triggers a billing penalty. The variant call metadata files average 30 KB, which is well below the 128 KB minimum object capacity charge for S3 Standard-IA. Storing them in S3 Standard-IA would result in a significant capacity billing penalty.

Step-by-Step Solution

Analyze the lifecycle constraints for the raw DNA sequence data.

The files are

350\text{ MB}

(above the

128\text{ KB}

S3 Standard-IA minimum object size limit) and have a total lifetime of

25\text{ days}

Determining file size and duration is necessary to identify potential S3 Standard-IA storage tiering options.

Evaluate S3 Standard-IA transition feasibility for the raw DNA sequence data.

If transitioned to S3 Standard-IA at Day 10, the files remain in S3 Standard-IA for only

15\text{ days}

(

25 - 10

) before deletion. Because S3 Standard-IA has a minimum storage duration of

30\text{ days}

, the company will be billed for a full

30\text{ days}

of Standard-IA storage, making this transition financially suboptimal compared to remaining in S3 Standard.

Applying the S3 Standard-IA minimum storage duration rules reveals the storage cost penalty.

Analyze the lifecycle constraints for the variant call metadata files.

The metadata files average

30\text{ KB}

in size and have a total lifetime of

90\text{ days}

Understanding the characteristics of the second dataset is necessary to determine the optimal lifecycle configuration.

Evaluate S3 Standard-IA transition feasibility for the variant call metadata.

S3 Standard-IA has a minimum capacity charge of

128\text{ KB}

per object. Storing

30\text{ KB}

files in S3 Standard-IA forces billing at

128\text{ KB}

per file (a

326\%

increase in billed capacity), which negates standard storage tier savings.

Applying S3 Standard-IA minimum object size rules demonstrates that transitioning these small objects is more expensive than leaving them in S3 Standard.

Key Concept

S3 Lifecycle Management Cost Constraints

Question 825Question →

A financial services company is migrating its transactional application to AWS. The database tier will run on Amazon RDS for PostgreSQL. The company requires a database design that guarantees high availability within a single AWS Region. The design must provide an automatic failover time of less than 60 seconds (Recovery Time Objective) and zero data loss (Recovery Point Objective) during an Availability Zone outage. In addition, the database must support horizontal read scaling during peak hours. Which of the following database configurations meets these requirements?

Deploy a Single-AZ RDS PostgreSQL DB instance and create two Read Replicas in different Availability Zones, configuring the application to promote a Read Replica if the primary fails.

Deploy a Single-AZ RDS PostgreSQL DB instance and use AWS Backup to restore hourly snapshots to a new DB instance in a different Availability Zone during a failure.

Deploy an Amazon RDS Multi-AZ DB cluster with one writer DB instance and two readable standby DB instances across three Availability Zones.

Deploy two Single-AZ RDS PostgreSQL DB instances in different Availability Zones and configure Amazon Route 53 latency-based routing to distribute database write and read traffic.

Show answer & explanation

Answer: Deploy an Amazon RDS Multi-AZ DB cluster with one writer DB instance and two readable standby DB instances across three Availability Zones.

Answer

Deploy an Amazon RDS Multi-AZ DB cluster with one writer DB instance and two readable standby DB instances across three Availability Zones.

Deploying an Amazon RDS Multi-AZ DB cluster provides a high availability configuration with one primary (writer) DB instance and two readable standby DB instances across three Availability Zones. This deployment uses semi-synchronous replication to ensure zero data loss (RPO of 0) and supports automatic failover in under 35 seconds (meeting the RTO requirement). Furthermore, the readable standby instances allow horizontal scaling of read traffic through the reader endpoint.

Step-by-Step Solution

Analyze the requirements for high availability, failover time (RTO < 60s), data loss (RPO = 0), and read scaling.

The solution must support automatic failover in less than 60 seconds, semi-synchronous replication to guarantee zero data loss during an AZ outage, and have readable standby or secondary instances.

This establishes the baseline criteria for filtering out non-compliant architectures.

Evaluate Amazon RDS Multi-AZ DB clusters against these criteria.

An RDS Multi-AZ DB cluster consists of one primary (writer) instance and two reader instances across three AZs. It uses semi-synchronous replication to achieve zero data loss (RPO = 0) and offers automatic failover in under 35 seconds, which meets the RTO < 60s constraint.

This confirms that the cluster deployment satisfies all high availability and replication requirements.

Evaluate read scaling capabilities of the selected architecture.

Because the standby instances in a Multi-AZ DB cluster are readable, they can actively serve read queries via the reader endpoint, addressing the read scaling constraint without requiring separate asynchronous replicas.

This guarantees that the design scales horizontally under peak workloads.

Key Concept

High Availability and Read Scaling in Amazon RDS Multi-AZ DB Clusters

Question 826Question →

An e-learning platform generates temporary video transcoding chunks during user uploads. These chunks average $120\text{ MB}$ in size, are stored in Amazon S3 Standard, and must be available for immediate processing for 7 days. After 7 days, the chunks are no longer needed and can be safely deleted. Which lifecycle configuration is the most cost-effective for managing these files?

Keep the files in Amazon S3 Standard, and configure a lifecycle policy to delete the files after 7 days.

Configure a lifecycle policy to transition the files to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 3 days, and delete them after 7 days.

Configure a lifecycle policy to transition the files to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) immediately, and delete them after 7 days.

Configure a lifecycle policy to transition the files to Amazon S3 Glacier Flexible Retrieval after 3 days, and retrieve them using Standard retrieval on day 7 before deletion.

Show answer & explanation

Answer: Keep the files in Amazon S3 Standard, and configure a lifecycle policy to delete the files after 7 days.

Answer

Keep the files in Amazon S3 Standard, and configure a lifecycle policy to delete the files after 7 days.

The correct option is to keep the files in S3 Standard and delete them after 7 days. Because the files are deleted after 7 days, transitioning them to S3 Standard-IA (which has a 30-day minimum storage charge) or S3 Glacier Flexible Retrieval (which has a 90-day minimum storage charge) would result in early deletion charges. Thus, keeping them in S3 Standard is the most cost-effective choice.

Step-by-Step Solution

Analyze the access pattern and lifetime of the files.

The files are accessed for 7 days and then deleted.

Understanding the storage duration is critical to evaluating minimum storage duration constraints for cost-optimized tiering.

Evaluate the minimum storage duration rules for the target tiers.

S3 Standard-IA has a 30-day minimum storage duration, and S3 Glacier Flexible Retrieval has a 90-day minimum storage duration.

Any transition of objects deleted before these thresholds will incur charges for the remaining days.

Compare the cost of keeping files in S3 Standard versus transitioning them early.

Since the lifetime is only 7 days, keeping the files in S3 Standard for the entire 7 days and deleting them is cheaper than transitioning them and paying the minimum duration penalties.

Avoiding transition penalties is a core requirement for optimizing short-term storage costs.

Key Concept

S3 Lifecycle Minimum Storage Durations

Question 827Question →

A media company is deploying a real-time video transcoding application on a group of Amazon EC2 instances. The transcoding nodes must exchange data with minimal network latency to process video segments in parallel. The application listens on port 5000, and transcoded outputs are monitored by an internal dashboard via an Application Load Balancer (ALB). Which combination of steps should the solutions architect take to configure this environment? (Select TWO.)

Select all that apply

Deploy the EC2 instances within a cluster placement group.

Configure the target group health check port to use port 5000.

Place the EC2 instances in a spread placement group to achieve maximum network throughput.

Configure the target group health check port to use the default HTTP port 80.

Mount a single Amazon EBS gp3 volume with Multi-Attach enabled across all EC2 instances to share video files.

Show answer & explanation

Answer: Deploy the EC2 instances within a cluster placement group.; Configure the target group health check port to use port 5000.

Answer

Deploy the EC2 instances within a cluster placement group and configure the target group health check port to use port 5000.

To satisfy the low-latency network performance requirement for parallel data exchange, the solutions architect must place the EC2 instances in a cluster placement group. In addition, since the transcoding application listens on custom port 5000, the target group health check port must be updated to port 5000 so the load balancer can correctly determine instance health.

Step-by-Step Solution

Analyze the network latency requirement between the application nodes.

Identify that the parallel video transcoding workload requires minimal node-to-node network latency.

Determining the network latency requirements guides the selection of the correct EC2 placement group.

Select the appropriate EC2 placement group type.

Choose a cluster placement group to group instances close together within a single Availability Zone.

Cluster placement groups enable low-latency, high-throughput network performance between instances.

Analyze the load balancer health check configuration for custom ports.

Identify that the transcoding service listens on port 5000, so the target group health checks must query port 5000.

Aligning the health check port with the application port prevents the load balancer from marking healthy nodes as unhealthy.

Key Concept

Selecting the correct placement group for low latency and aligning load balancer health check ports for custom services.

Estimated Time:1m 30s

Question 828Question →

A solutions architect is designing a high-performing database layer for a retail application. The application requires microsecond-level read latency for a highly dynamic catalog page and needs to offload heavy read traffic from the primary relational database. Which of the following architectural strategies will meet these requirements? (Select TWO.)

Select all that apply

Configure Amazon DynamoDB Accelerator (DAX) in front of the DynamoDB catalog table to reduce read latency to microseconds.

Deploy Amazon ElastiCache in front of the relational database to store frequently accessed query results and offload reads.

Design the DynamoDB catalog table with partition keys containing sequential, monotonically increasing timestamp values to optimize write throughput.

Configure Amazon RDS Read Replicas as the primary target for automatic failover and write operations during database outages.

Show answer & explanation

Answer: Configure Amazon DynamoDB Accelerator (DAX) in front of the DynamoDB catalog table to reduce read latency to microseconds.; Deploy Amazon ElastiCache in front of the relational database to store frequently accessed query results and offload reads.

Answer

Configure Amazon DynamoDB Accelerator (DAX) in front of the DynamoDB table, and deploy Amazon ElastiCache in front of the relational database.

Deploying Amazon DynamoDB Accelerator (DAX) directly addresses microsecond-level latency requirements for DynamoDB, while Amazon ElastiCache provides sub-millisecond response times to offload queries from a relational database.

Step-by-Step Solution

Analyze read latency requirements.

The DynamoDB catalog table needs microsecond-level read latency.

Identifying the caching layer for DynamoDB.

Select database acceleration mechanism for DynamoDB.

Amazon DynamoDB Accelerator (DAX) provides microsecond-level response times.

DAX is specifically designed to provide in-memory acceleration for DynamoDB.

Determine offloading strategy for the relational database.

Deploying Amazon ElastiCache caches frequent read query results.

ElastiCache provides low-latency query results and reduces CPU load on the relational database.

Key Concept

Database performance optimization using caching technologies (DAX and ElastiCache) for low-latency retrieval.

Question 829Question →

A financial services enterprise runs a real-time transaction reconciliation application on Amazon EC2 instances distributed across three Availability Zones. The application requires concurrent read/write access to a shared storage repository with high durability ( $99.999999999\%$ ) and high availability ( $99.99\%$ ). The storage architecture must support a Recovery Point Objective (RPO) of zero and a Recovery Time Objective (RTO) of near-zero in the event of an Availability Zone outage, without requiring manual intervention. Which storage configuration best meets these requirements?

Amazon Elastic File System (Amazon EFS) using the Standard (Regional) storage class.

Amazon S3 Glacier Flexible Retrieval using Standard retrieval options for failover storage.

A Pilot Light disaster recovery configuration in a secondary Region with pre-warmed, scaled-down EC2 instances and EBS volumes.

Amazon Elastic Block Store (Amazon EBS) volumes attached to Amazon RDS DB instances, leveraging RDS Read Replicas for automatic write failover.

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS) using the Standard (Regional) storage class.

Answer

Amazon Elastic File System (Amazon EFS) using the Standard (Regional) storage class.

The correct answer is Amazon Elastic File System (Amazon EFS) using the Standard (Regional) storage class. EFS natively replicates data across multiple Availability Zones in an AWS Region, provides concurrent shared access to EC2 instances, and automatically handles AZ failures to meet near-zero RTO and zero RPO requirements.

Step-by-Step Solution

Analyze the access pattern and durability requirements.

The application requires concurrent read/write access from EC2 instances in multiple Availability Zones, zero data loss (

RPO = 0

), and durability of

99.999999999\%

This filters out block storage (EBS) which cannot natively attach to multiple instances across AZs simultaneously.

Evaluate the recovery time requirements (RTO).

An AZ outage must be handled automatically without manual intervention, achieving a near-zero RTO.

This rules out S3 Glacier due to standard retrieval delays (3 to 5 hours) and Pilot Light disaster recovery configurations which require manual activation steps.

Assess the remaining storage configurations for multi-AZ failover capability.

Amazon EFS Regional storage class provides Multi-AZ durability, concurrent shared access, and native failover without manual intervention.

It meets both the high-availability metric (

99.99\%

) and the zero RPO/near-zero RTO targets.

Key Concept

Resilient and Highly Available Storage Infrastructure

Estimated Time:1m 30s

Question 830Question →

A global e-learning company hosts its interactive quiz application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. To ensure disaster recovery and high availability, the company has deployed a duplicate environment with an ALB in the eu-west-1 Region. The application requires low-latency delivery of dynamic content to global users and must automatically fail over to the secondary Region with minimal downtime if the primary Region experiences an outage. The solution must minimize operational complexity and avoid modifications to client-side DNS configurations. Which solution should the solutions architect implement to meet these requirements?

Configure an Amazon CloudFront distribution and define an origin group containing the us-east-1 ALB as the primary origin and the eu-west-1 ALB as the failover origin. Set failover criteria to include HTTP status codes 500, 502, 503, and 504.

Configure Amazon Route 53 with a latency routing policy pointing to both the us-east-1 ALB and the eu-west-1 ALB. Enable Route 53 health checks on both endpoints to automatically route traffic to the healthy Region during an outage.

Deploy AWS Global Accelerator to route traffic to both ALBs. Configure AWS WAF on the ALBs with a custom rule that blocks incoming traffic to the us-east-1 ALB when it becomes unhealthy, forcing the accelerator to route all requests to the eu-west-1 ALB.

Configure an Amazon CloudFront distribution with the us-east-1 ALB as the primary origin. Configure the cache behavior's default, minimum, and maximum TTL values to 0 seconds. Use Route 53 failover routing policy to update the origin DNS record to point to the eu-west-1 ALB during an outage.

Show answer & explanation

Answer: Configure an Amazon CloudFront distribution and define an origin group containing the us-east-1 ALB as the primary origin and the eu-west-1 ALB as the failover origin. Set failover criteria to include HTTP status codes 500, 502, 503, and 504.

Answer

Configure an Amazon CloudFront distribution with an origin group containing the primary ALB and the backup ALB, configuring failover for HTTP status codes 500, 502, 503, and 504.

The correct solution uses an Amazon CloudFront distribution configured with an Origin Group. This feature allows a primary origin (the Application Load Balancer in us-east-1) and a secondary origin (the Application Load Balancer in eu-west-1) to act in an active-passive setup. When the primary origin returns specific HTTP status codes (such as 500, 502, 503, or 504), CloudFront automatically retries the request against the secondary origin. This failover happens at the edge layer within seconds, preventing user downtime and bypassing client-side DNS caching limitations.

Step-by-Step Solution

Identify the primary performance and resilience constraints.

The solution requires low-latency content delivery, automated active-passive regional failover, and minimal operational complexity without modifying client-side DNS settings.

This rules out basic Route 53 failover because client DNS caching (TTL) delays propagation, violating the minimal downtime constraint.

Evaluate Amazon CloudFront's native failover capabilities.

CloudFront supports Origin Groups, which allow designating a primary origin and a failover origin.

Edge-level failover avoids DNS propagation delays, routing requests directly to the backup region if the primary region's ALB fails.

Define the failover criteria.

Specify HTTP status codes (500, 502, 503, 504) that represent origin unavailability or server-side failure.

This guarantees that if the primary ALB or its backend EC2 instances fail, CloudFront immediately redirects the user request to the secondary ALB in eu-west-1.

Key Concept

CloudFront Origin Groups and Failover Configuration

Estimated Time:2m 30s

Question 831Question →

A financial analytics platform is designing an ingestion pipeline to capture real-time stock ticker updates from external market feeds. During periods of high volatility, the stream is expected to peak at $12,000$ updates per second, with an average update payload size of $1.5\text{ KB}$ . The solutions architect must design a solution that ingests this data with sub-second latency, preserves the strict chronological order of updates for each individual stock ticker symbol, and writes the processed updates to an Amazon DynamoDB table. Which ingestion architecture should the solutions architect choose to support the peak load?

Configure an Amazon Kinesis data stream with

18

shards in Provisioned mode, using the stock ticker symbol as the partition key. Use an AWS Lambda function to consume records from the stream and write them to the DynamoDB table.

Configure an Amazon Kinesis data stream with

12

shards in Provisioned mode, using the stock ticker symbol as the partition key. Use an AWS Lambda function to consume records from the stream and write them to the DynamoDB table.

Configure a standard Amazon SQS queue to capture the incoming updates. Use an AWS Lambda function to poll the queue, sort the updates by stock ticker symbol, and write them to the DynamoDB table.

Configure the market feeds to write updates directly to the Amazon DynamoDB table using the AWS SDK, utilizing the update timestamp as the partition key.

Show answer & explanation

Answer: Configure an Amazon Kinesis data stream with $18$ shards in Provisioned mode, using the stock ticker symbol as the partition key. Use an AWS Lambda function to consume records from the stream and write them to the DynamoDB table.

Answer

The architecture using an Amazon Kinesis data stream with

18

shards in Provisioned mode, with the stock ticker symbol as the partition key, and consumed by an AWS Lambda function to write to DynamoDB.

The correct solution calculates the shard count by evaluating both the record write limit (

1,000

records/sec per shard) and the throughput write limit (

1\text{ MB/sec}

per shard). To support

12,000

records/sec at

1.5\text{ KB}

each (

18\text{ MB/sec}

total), a minimum of

18

shards is required. Furthermore, using the stock ticker symbol as the partition key ensures that all updates for a given ticker are routed to the same shard and processed sequentially, maintaining order.

Step-by-Step Solution

Calculate the total ingestion write throughput.

12,000\text{ updates/sec} \times 1.5\text{ KB/update} = 18,000\text{ KB/sec} = 18\text{ MB/sec}

Understanding total payload volume is necessary to determine the bandwidth requirements of the ingestion layer.

Determine the Kinesis Data Streams shard count required based on both throughput and record limits.

Based on the

1,000

records/sec limit:

12,000 / 1,000 = 12

shards. Based on the

1\text{ MB/sec}

write throughput limit:

18\text{ MB/sec} / 1\text{ MB/sec} = 18

shards. The minimum required is the maximum of the two calculations, which is

18

shards.

Kinesis shards have independent limits for write throughput (

1\text{ MB/sec}

) and write record count (

1,000

records/sec). Failing to scale for both limits causes ingestion throttling.

Select a partition key that ensures correct message ordering.

Using the stock ticker symbol as the partition key ensures all updates for a single ticker are mapped to the same shard and processed sequentially.

Kinesis preserves order within a single shard. Routing all records with the same partition key to the same shard guarantees their chronological order is maintained.

Key Concept

Kinesis Data Streams shard capacity calculations and partition key design for message ordering.

Estimated Time:1m 30s

Question 832Question →

An analytics company runs a real-time data processing application on AWS. The application consists of three main components:

* A front-end ingestion API hosted on Amazon ECS with AWS Fargate that experiences stable, continuous traffic 24/7.
* A legacy stateful data validation service that runs on Amazon EC2 instances and requires constant, continuous compute capacity.
* A business intelligence database running on Amazon RDS for MySQL that is operational 24/7.

The company wants to make a 3-year commitment to minimize their overall costs with minimal administrative overhead. Which purchasing strategy provides the lowest overall cost while meeting all architectural requirements?

Purchase a 3-year Compute Savings Plan to cover the Amazon ECS Fargate tasks and the Amazon EC2 instances, and purchase 3-year Amazon RDS DB Instance Reserved Instances for the database.

Purchase a 3-year Compute Savings Plan to cover the Amazon ECS Fargate tasks, the Amazon EC2 instances, and the Amazon RDS database.

Purchase a 3-year EC2 Instance Savings Plan to cover the Amazon EC2 instances, use Amazon ECS Fargate Spot for the front-end ingestion API, and purchase a Compute Savings Plan to cover the Amazon RDS database.

Migrate the legacy stateful data validation service to run continuously on AWS Lambda to utilize Compute Savings Plans, and purchase Amazon RDS DB Instance Reserved Instances for the database.

Show answer & explanation

Answer: Purchase a 3-year Compute Savings Plan to cover the Amazon ECS Fargate tasks and the Amazon EC2 instances, and purchase 3-year Amazon RDS DB Instance Reserved Instances for the database.

Answer

Purchase a 3-year Compute Savings Plan to cover the Amazon ECS Fargate tasks and the Amazon EC2 instances, and purchase 3-year Amazon RDS DB Instance Reserved Instances for the database.

The correct strategy combines a 3-year Compute Savings Plan for the ECS Fargate and EC2 validation service workloads with 3-year RDS DB Instance Reserved Instances for the database. Compute Savings Plans automatically apply discounts to compute usage across EC2 and Fargate, regardless of region or family. Because Amazon RDS is excluded from Compute Savings Plans, it must be covered by its own Reserved Instances to achieve maximum cost savings for the 24/7 database workload.

Step-by-Step Solution

Analyze the compute requirements for the ingestion API and validation service.

The ingestion API (ECS Fargate) and legacy validation service (EC2) are both steady-state compute workloads running 24/7.

Identifying the patterns of the compute workloads allows for selecting the most appropriate purchasing model.

Select the optimal purchasing strategy for the Fargate and EC2 workloads.

A 3-year Compute Savings Plan is selected to cover both Fargate and EC2 instances.

Compute Savings Plans provide the highest flexibility (covering EC2, Fargate, and Lambda across any instance family and region) with up to 66% savings over a 3-year term.

Evaluate the database workload and determine its purchasing option.

Amazon RDS for MySQL is running 24/7 and is not covered by Compute Savings Plans. Select Amazon RDS DB Instance Reserved Instances.

Since Compute Savings Plans do not apply to Amazon RDS, RDS DB Instance Reserved Instances must be purchased separately to cover the database.

Key Concept

Compute purchasing strategies on AWS require matching specific services with their corresponding savings models, such as using Compute Savings Plans for EC2 and ECS Fargate while utilizing Reserved Instances for Amazon RDS databases.

Question 833Question →

A company wants to reduce its compute costs for a workload running on Amazon EC2, AWS Fargate, and AWS Lambda. Additionally, the workload uses Amazon RDS for its database layer. The company decides to purchase a Compute Savings Plan. To which of the following resources will the Compute Savings Plan discounts apply?

Amazon EC2 instances, AWS Fargate tasks, and AWS Lambda functions

Amazon EC2 instances, AWS Fargate tasks, and Amazon RDS DB instances

Amazon RDS DB instances, Amazon DynamoDB tables, and Amazon Redshift clusters

Amazon EC2 instances, Amazon EBS volumes, and Amazon RDS DB instances

Show answer & explanation

Answer: Amazon EC2 instances, AWS Fargate tasks, and AWS Lambda functions

Answer

Amazon EC2 instances, AWS Fargate tasks, and AWS Lambda functions

The correct option is the one specifying Amazon EC2, AWS Fargate, and AWS Lambda. Compute Savings Plans provide the most flexibility and automatically apply to usage across these three compute services regardless of instance family, size, OS, or region.

Step-by-Step Solution

Identify the services included in the company's workload.

The workload consists of Amazon EC2, AWS Fargate, AWS Lambda, and Amazon RDS.

To determine which of these services are eligible for Compute Savings Plans discounts.

Analyze the coverage scope of a Compute Savings Plan.

Compute Savings Plans apply to Amazon EC2, AWS Fargate, and AWS Lambda.

To match the workload services against the actual scope of Compute Savings Plans.

Exclude services that are not covered under Compute Savings Plans.

Amazon RDS is a database service and is excluded from Compute Savings Plans.

RDS requires RDS Reserved Instances, not Compute Savings Plans, to achieve discounts.

Key Concept

Compute Savings Plans apply automatically to EC2, Fargate, and Lambda usage, but do not apply to non-compute services such as RDS, DynamoDB, or EBS.

Estimated Time:45s

Question 834Question →

A telemetry processing system runs on Amazon EC2 instances deployed inside a private subnet. The application continuously ingests sensor data, writes the processed results to an Amazon DynamoDB table, and archives raw payloads in an Amazon S3 bucket. Currently, all traffic to these services passes through a NAT Gateway, leading to high data processing costs.

Which TWO configurations should a solutions architect implement to minimize these network costs? (Select TWO.)

Select all that apply

Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.

Create a gateway VPC endpoint for Amazon DynamoDB and associate it with the route table of the private subnet.

Create an interface VPC endpoint for Amazon S3 to bypass the NAT Gateway.

Create an interface VPC endpoint for Amazon DynamoDB to bypass the NAT Gateway.

Set up an AWS Transit Gateway to route the S3 and DynamoDB traffic directly.

Show answer & explanation

Answer: Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.; Create a gateway VPC endpoint for Amazon DynamoDB and associate it with the route table of the private subnet.

Answer

Create a gateway VPC endpoint for Amazon S3 and a gateway VPC endpoint for Amazon DynamoDB, then associate both with the route table of the private subnet.

The correct choices are the configurations that establish gateway VPC endpoints for Amazon S3 and Amazon DynamoDB and associate them with the private subnet's route table. Gateway VPC endpoints are provided by AWS at no additional cost and do not charge for data transfer or data processing. By routing traffic directly through these endpoints, the EC2 instances bypass the NAT Gateway, eliminating the NAT Gateway data processing fees.

Step-by-Step Solution

Identify that the current traffic path to Amazon S3 and Amazon DynamoDB goes through a NAT Gateway, which incurs data processing fees.

Confirming NAT Gateway data processing fees are the source of high costs.

Analyzing the architecture to find the bottleneck.

Determine if Amazon S3 and Amazon DynamoDB support Gateway VPC Endpoints.

S3 and DynamoDB are the only two services that support free Gateway VPC Endpoints.

Choosing the most cost-effective VPC endpoint type.

Recognize that Gateway VPC Endpoints are free to use (no hourly or data processing charges).

Traffic routed via Gateway Endpoints bypasses the NAT Gateway at zero cost.

Confirming the cost savings compared to Interface Endpoints.

Implement Gateway VPC Endpoints for both S3 and DynamoDB and update the private subnet's route table to route traffic directly.

The route table directs S3 and DynamoDB traffic through the VPC endpoint directly instead of the default route to the NAT Gateway.

Finalizing the cost-effective architecture configuration.

Key Concept

Gateway VPC Endpoints for S3 and DynamoDB provide a zero-cost routing mechanism to access these services privately from a VPC, bypassing NAT Gateways.

Estimated Time:1m 30s

Question 835Question →

A retail firm operates an analytics workload in a private subnet within VPC A. Every day, the workload retrieves $20\text{ TB}$ of sales reports from an Amazon S3 bucket. Additionally, the workload sends $5\text{ TB}$ of data to a shared PostgreSQL database hosted in VPC B within the same AWS Region. Currently, VPC A routes all traffic destined for the internet, S3, and VPC B through a NAT Gateway.

Which two adjustments to the network architecture will minimize data transfer charges? (Select TWO.)

Select all that apply

Configure a gateway endpoint for Amazon S3 in VPC A and associate it with the route table of the analytics subnet.

Establish a VPC peering connection between VPC A and VPC B, and configure the route tables to direct database-destined traffic through the peering connection.

Configure an interface endpoint for Amazon S3 in VPC A and update the route tables to prioritize it over the S3 route.

Implement an AWS Transit Gateway to route all database and S3 traffic between the VPCs.

Route the database traffic through a Site-to-Site VPN connection established between VPC A and VPC B.

Show answer & explanation

Answer: Configure a gateway endpoint for Amazon S3 in VPC A and associate it with the route table of the analytics subnet.; Establish a VPC peering connection between VPC A and VPC B, and configure the route tables to direct database-destined traffic through the peering connection.

Answer

Configure a gateway VPC endpoint for Amazon S3 in VPC A, and establish a VPC peering connection between VPC A and VPC B to route database traffic directly.

Configuring a gateway VPC endpoint for Amazon S3 eliminates NAT Gateway processing charges for S3 data access at no additional cost. Establishing a VPC peering connection between VPC A and VPC B allows the workload to communicate directly using private IP addresses, bypassing the NAT Gateway and its associated charges.

Step-by-Step Solution

Analyze S3 traffic cost optimization.

Identify that routing S3 traffic through a NAT Gateway incurs a data processing fee of $0.045 per GB. Implementing a Gateway VPC Endpoint for S3 is free and avoids NAT Gateway data processing fees.

To eliminate charges for retrieving

20\text{ TB}

of data daily from S3.

Analyze cross-VPC database traffic cost optimization.

Identify that routing traffic to another VPC in the same Region through a NAT Gateway incurs NAT Gateway data processing charges. Using a VPC peering connection routes traffic directly over the AWS network using private IP addresses.

To eliminate NAT Gateway processing fees for the

5\text{ TB}

database traffic.

Select the two most cost-effective options.

Combining a gateway VPC endpoint for S3 and a VPC peering connection for inter-VPC database traffic provides the lowest network cost.

Both selected solutions bypass NAT Gateway fees without introducing other costly services like interface endpoints, Transit Gateway, or Site-to-Site VPN.

Key Concept

Cost-Effective Network Routing and Data Transfer Optimization

Question 836Question →

A gaming company has a mobile game played by users worldwide. The application retrieves game configuration metadata from an API hosted on Amazon API Gateway and backed by AWS Lambda. The metadata is updated once daily. During peak tournament hours, the Lambda functions experience a high volume of requests, causing concurrency throttling and increased latency for global players. A solutions architect needs to design a caching solution to reduce the load on the Lambda functions and minimize response latency for players globally. Which solution will meet these requirements with the lowest latency for global players?

Create a custom Amazon CloudFront distribution with a regional API Gateway stage as the origin. Enable caching on CloudFront using a cache policy with a 24-hour TTL, and update the DNS record for the custom domain to point to the CloudFront distribution.

Create a custom Amazon CloudFront distribution with a regional API Gateway stage as the origin. Configure the cache behavior's Minimum TTL, Default TTL, and Maximum TTL to 0 to ensure players always receive the most up-to-date configuration metadata directly from the origin.

Migrate the metadata storage to an Amazon DynamoDB table using a sequential timestamp as the partition key to optimize query performance, and enable DynamoDB Accelerator (DAX) to cache the queries.

Write an AWS Lambda function that runs continuously in a loop to handle the high volume of incoming player requests, caching the configuration in the Lambda function's memory, and route traffic using a NAT Gateway.

Show answer & explanation

Answer: Create a custom Amazon CloudFront distribution with a regional API Gateway stage as the origin. Enable caching on CloudFront using a cache policy with a 24-hour TTL, and update the DNS record for the custom domain to point to the CloudFront distribution.

Answer

The correct solution uses an Amazon CloudFront distribution to cache game configuration metadata at edge locations globally. Because the metadata is updated only once per day, caching the response for 24 hours at the edge ensures that almost all requests are served from the cache, reducing backend Lambda invocations to a minimum and lowering player response times to sub-milliseconds. Directing custom domain traffic to CloudFront preserves the client endpoint configuration.

Step-by-Step Solution

Deploy a custom Amazon CloudFront distribution and set the origin to point to a Regional API Gateway stage.

A global content delivery network is placed in front of the API Gateway endpoints.

CloudFront routes traffic through edge locations close to users worldwide, minimizing network latency.

Create and associate a Cache Policy with a Minimum, Default, and Maximum TTL of 24 hours (86,400 seconds) on the CloudFront distribution behavior.

Requests for configuration metadata are cached at the edge locations.

This prevents redundant player requests from propagating to the origin API Gateway and Lambda functions, resolving the concurrency throttling issues.

Update the Route 53 DNS record for the custom API domain to point to the CloudFront distribution URL.

Traffic from mobile clients is seamlessly routed through CloudFront with no changes required in the mobile application code.

This ensures a transparent deployment with zero downtime.

Key Concept

Edge caching using Amazon CloudFront in front of regional API endpoints protects compute resources and minimizes latency for global clients.

Estimated Time:2m 0s

Question 837Question →

A software development company is setting up a high-performance distributed cache layer using self-managed Redis on Amazon EC2 instances. The cache nodes require the lowest possible latency and highest throughput for node-to-node replication. Which configuration will satisfy these requirements?

Launch the EC2 instances in a cluster placement group within a single Availability Zone.

Launch the EC2 instances in a spread placement group to distribute the nodes across distinct physical racks.

Launch the EC2 instances in a partition placement group to logically isolate the replication traffic.

Deploy the instances behind an Application Load Balancer and configure target group health checks on the default HTTP port 80 while the application runs on port 6379.

Show answer & explanation

Answer: Launch the EC2 instances in a cluster placement group within a single Availability Zone.

Answer

Launch the EC2 instances in a cluster placement group within a single Availability Zone.

The correct configuration is to launch the EC2 instances in a cluster placement group within a single Availability Zone. This placement strategy physically groups instances close together on the underlying hardware, allowing them to achieve the lowest possible network latency and highest packet-per-second performance for node-to-node replication.

Step-by-Step Solution

Analyze the performance requirements of the workload.

The workload requires a high-performance distributed cache layer with the lowest possible latency and highest throughput for node-to-node replication.

Identifying the primary optimization criteria helps select the correct EC2 placement strategy.

Evaluate EC2 placement group types for low-latency node-to-node communication.

A cluster placement group groups instances closely together within a single Availability Zone to enable low-latency, high-throughput network performance.

Spread and partition placement groups are designed for fault tolerance and isolation rather than maximum network performance.

Key Concept

EC2 Cluster Placement Groups for Low-Latency Workloads

Question 838Question →

An e-commerce company runs its operations on AWS. The order-processing microservices run continuously on containerized infrastructure using AWS Fargate, requiring a predictable baseline capacity of $16\text{ vCPU}$ and $64\text{ GB}$ of memory, and scaling up during peak hours. In addition, an Amazon RDS for PostgreSQL database instance runs continuously to support the orders. Lastly, a memory-intensive inventory reconciliation batch processing script runs on EC2 instances once daily at midnight. The script takes approximately $3\text{ hours}$ to complete, is state-saved, can survive interruptions, and uploads several terabytes of output data directly to Amazon S3. Which combination of strategies should the Solutions Architect recommend to achieve the most cost-effective architecture? (Select TWO.)

Select all that apply

Purchase a Compute Savings Plan to cover the continuous baseline capacity of the AWS Fargate order-processing microservices.

Launch EC2 Spot Instances to run the daily inventory reconciliation batch processing workload.

Purchase a Compute Savings Plan to cover the continuous baseline capacity of both the AWS Fargate microservices and the Amazon RDS for PostgreSQL database instance.

Migrate the 3-hour inventory reconciliation script to run as a single AWS Lambda function to eliminate compute costs when not running.

Route the output data uploads from the inventory reconciliation EC2 instances to Amazon S3 through a NAT Gateway to reduce data transfer charges.

Show answer & explanation

Answer: Purchase a Compute Savings Plan to cover the continuous baseline capacity of the AWS Fargate order-processing microservices.; Launch EC2 Spot Instances to run the daily inventory reconciliation batch processing workload.

Answer

Commit to a Compute Savings Plan to cover the continuous baseline capacity of the Fargate order-processing microservices, and run the fault-tolerant, daily 3-hour inventory reconciliation script on EC2 Spot Instances.

Purchasing a Compute Savings Plan provides discount coverage for Fargate container tasks that run continuously, while using EC2 Spot Instances for the daily inventory reconciliation batch script yields maximum cost savings for an interruption-tolerant, short-running workload.

Step-by-Step Solution

Analyze the workload characteristics of the order-processing microservices.

The order-processing microservices run continuously on AWS Fargate with a predictable baseline capacity.

Since the workload is continuous and running on Fargate, Compute Savings Plans are the most appropriate purchasing model to reduce baseline costs.

Analyze the workload characteristics of the inventory reconciliation batch script.

The reconciliation script runs for 3 hours daily, can survive interruptions, is state-saved, and is fault-tolerant.

Because the batch workload is interruption-tolerant and runs for a short duration, EC2 Spot Instances provide the highest cost savings (up to 90% discount) without risking service availability.

Evaluate the database and data transfer components for optimization.

The RDS instance is continuous, and large data transfers to S3 occur daily.

Identify that Compute Savings Plans do not apply to RDS (which requires RDS Reserved Instances), and data transfers to S3 should use a free S3 Gateway VPC Endpoint instead of a NAT Gateway.

Key Concept

Selecting the most cost-effective compute hosting models and purchasing strategies based on workload resilience, predictability, and duration.

Question 839Question →

A marketing agency generates weekly campaign performance reports averaging $2\text{ MB}$ in size. These reports are stored in an Amazon S3 Standard bucket. The agency's analytics team accesses the reports frequently for the first $10\text{ days}$ of creation. After $10\text{ days}$ , the reports are rarely accessed, but must be retained for a total of $25\text{ days}$ for compliance, after which they can be permanently deleted. Which S3 lifecycle configuration is the most cost-effective to meet these requirements?

Retain the reports in S3 Standard, and configure an S3 Lifecycle policy to permanently delete the objects after

25\text{ days}

Configure an S3 Lifecycle policy to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) after

10\text{ days}

, and permanently delete the objects after

25\text{ days}

Configure an S3 Lifecycle policy to transition the reports to S3 Glacier Instant Retrieval after

10\text{ days}

, and permanently delete the objects after

25\text{ days}

Configure an S3 Lifecycle policy to transition the reports to S3 Intelligent-Tiering after

10\text{ days}

, and permanently delete the objects after

25\text{ days}

Show answer & explanation

Answer: Retain the reports in S3 Standard, and configure an S3 Lifecycle policy to permanently delete the objects after $25\text{ days}$ .

Answer

Retain the reports in S3 Standard, and configure an S3 Lifecycle policy to permanently delete the objects after

25\text{ days}

Retaining the reports in S3 Standard for the entire 25 days and then deleting them is the most cost-effective option. Transitioning objects to S3 Standard-IA or S3 Glacier classes introduces minimum storage duration requirements (30 days and 90 days, respectively). Because the files are deleted on day 25, any transition on day 10 would result in paying early deletion penalties for the remaining days of the minimum duration, making the transition more expensive than keeping them in S3 Standard.

Step-by-Step Solution

Calculate the active storage duration for the objects in each tier.

The objects are stored in the bucket for a total of

25\text{ days}

. They are accessed frequently for the first

10\text{ days}

and are inactive for the remaining

15\text{ days}

This establishes the timeline to evaluate minimum storage duration constraints for different S3 storage tiers.

Evaluate S3 Standard-IA and S3 Glacier billing constraints.

S3 Standard-IA has a minimum storage charge of

30\text{ days}

, and S3 Glacier Instant Retrieval has a minimum charge of

90\text{ days}

. Since the objects are deleted after

25\text{ days}

total (

15\text{ days}

after transition), both options incur early deletion penalties.

Understanding S3 minimum storage duration policies is critical to determining the true cost of lifecycle transitions.

Compare the cost of keeping the objects in S3 Standard versus transitioning them.

Keeping the objects in S3 Standard for

25\text{ days}

costs less than transitioning them to S3 Standard-IA, which incurs

10\text{ days}

of S3 Standard storage,

30\text{ days}

of S3 Standard-IA storage (due to the minimum duration penalty), and transition request fees.

Comparing total costs reveals that avoiding the transition is more cost-effective when the retention period is shorter than the tier's minimum storage duration.

Key Concept

S3 Lifecycle Minimum Storage Durations and Early Deletion Fees

Estimated Time:1m 30s

Question 840Question →

A retail company runs a containerized microservices application on Amazon ECS (Fargate) across three Availability Zones in a VPC. The Fargate tasks are located in private subnets and need to perform the following operations:

- Retrieve $120\text{ TB}$ of product catalog assets per month from an Amazon S3 bucket in the same AWS Region.
- Synchronize transaction logs (totaling $60\text{ TB}$ per month) with a database cluster hosted in another VPC belonging to a subsidiary in the same Region.

Currently, a NAT Gateway in a public subnet handles all outbound traffic for the private subnets. A solutions architect needs to redesign the network routing to reduce the monthly data transfer charges.

Which combination of actions should the solutions architect implement to achieve the most cost-effective solution? (Select TWO.)

Select all that apply

Configure an Amazon S3 gateway VPC endpoint and reference it in the private subnet route tables.

Set up a VPC peering connection between the two VPCs and direct the log synchronization traffic through it using private route table entries.

Provision an interface VPC endpoint (AWS PrivateLink) for Amazon S3 and update the Fargate task configuration.

Implement an AWS Transit Gateway to bridge the two VPCs and route the transaction traffic through the transit hub.

Maintain the existing route tables and request Elastic IPs for the Fargate tasks to route traffic using public IP addressing.

Show answer & explanation

Answer: Configure an Amazon S3 gateway VPC endpoint and reference it in the private subnet route tables.; Set up a VPC peering connection between the two VPCs and direct the log synchronization traffic through it using private route table entries.

Answer

The correct options are to configure an Amazon S3 gateway VPC endpoint and set up a VPC peering connection between the two VPCs.

The correct solution involves deploying a gateway VPC endpoint for S3 and establishing a VPC peering connection. The gateway endpoint for S3 is free and routes S3 traffic directly over the internal AWS backbone, completely bypassing the NAT Gateway and saving

120\text{ TB}

of NAT Gateway data processing fees. The VPC peering connection is also free to set up and does not incur data processing fees for traffic within the same AWS Region, routing the database synchronization logs directly via private IPs and bypassing the NAT Gateway.

Step-by-Step Solution

Analyze the data transfer volumes and current routing architecture.

Identified two high-volume traffic patterns traversing the NAT Gateway:

120\text{ TB}

S3 download traffic and

60\text{ TB}

inter-VPC database replication traffic.

Understanding the cost breakdown of the current setup ($0.045 per GB for NAT Gateway processing) highlights the areas where optimization yields the highest savings.

Select the most cost-effective option for Amazon S3 access.

An S3 gateway VPC endpoint is selected because it is free of charge, unlike the current NAT Gateway path or an S3 interface VPC endpoint (which costs $0.01 per GB).

Using the free gateway endpoint completely eliminates the NAT Gateway data processing charges for the

120\text{ TB}

S3 traffic.

Select the most cost-effective option for inter-VPC database replication traffic.

A VPC peering connection is selected because it has no hourly attachment fees and no data processing charges within the same AWS Region.

VPC peering routes traffic directly between the VPCs using private IPs, avoiding the

0.045 per GB NAT Gateway fee and the

0.02 per GB Transit Gateway fee.

Key Concept

Minimizing AWS data transfer costs by bypassing NAT Gateways and Transit Gateways using free Gateway VPC Endpoints for Amazon S3 and direct VPC Peering for inter-VPC traffic.

PreviousPage 42 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept