All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A company is redesigning its database tier to optimize costs. The application uses two main tables: a user session table that experiences highly unpredictable, spiky write traffic when new media is released but remains idle for long periods, and a product catalog table that experiences a highly predictable, constant baseline read and write traffic. Currently, both tables are hosted on a single Amazon RDS for PostgreSQL DB instance, which must be constantly scaled for peak load, resulting in high idle costs. Which TWO actions should a solutions architect take to meet these requirements in the most cost-effective manner while maintaining high availability? (Select TWO.)

Select all that apply

Migrate the user session table to an Amazon DynamoDB table configured with On-Demand capacity mode.

Migrate the product catalog table to an Amazon DynamoDB table configured with Provisioned capacity mode and auto scaling enabled.

Migrate the user session table to an Amazon DynamoDB table configured with Provisioned capacity mode set to the maximum expected peak traffic.

Migrate both tables to Amazon DynamoDB tables configured with On-Demand capacity mode.

Keep both tables on the Amazon RDS DB instance, and configure an Amazon RDS Read Replica in a different Availability Zone to act as the primary automatic failover target.

Show answer & explanation

Answer: Migrate the user session table to an Amazon DynamoDB table configured with On-Demand capacity mode.; Migrate the product catalog table to an Amazon DynamoDB table configured with Provisioned capacity mode and auto scaling enabled.

Answer

Migrate the user session table to an Amazon DynamoDB table configured with On-Demand capacity mode, and migrate the product catalog table to an Amazon DynamoDB table configured with Provisioned capacity mode and auto scaling enabled.

Migrating the user session table to DynamoDB configured with On-Demand capacity mode ensures that the company only pays for the actual database requests during spiky periods and pays nothing when the table is idle. Migrating the product catalog table to DynamoDB configured with Provisioned capacity mode with auto scaling optimizes costs for the stable, predictable baseline by leveraging lower per-request rates while scaling dynamically to handle gradual load changes.

Step-by-Step Solution

Analyze the workload characteristics of each database table to identify patterns.

The user session table has highly unpredictable, spiky write traffic with long idle periods, while the product catalog table has a highly predictable, constant baseline read and write traffic.

Choosing the cost-optimal capacity model requires matching the database scaling configuration to the workload's specific traffic profile.

Evaluate the capacity options for the user session table.

Amazon DynamoDB with On-Demand capacity mode is chosen.

For highly spiky and unpredictable workloads that are frequently idle, On-Demand capacity is the most cost-effective since it bills purely on request volume without incurring costs for idle provisioned capacity.

Evaluate the capacity options for the product catalog table.

Amazon DynamoDB with Provisioned capacity mode and auto scaling is chosen.

For predictable baseline workloads, Provisioned capacity mode offers a much lower cost per request than On-Demand mode, and auto scaling accommodates any gradual variations safely.

Examine options involving Amazon RDS Read Replicas for high availability.

Reject using RDS Read Replicas as automatic failover targets.

Standard RDS Read Replicas are designed for scaling read traffic, not as primary high-availability failover destinations, which requires Multi-AZ deployments.

Key Concept

Selecting and configuring database capacity models (On-Demand versus Provisioned with auto scaling) to align with workload traffic patterns (predictable baseline versus unpredictable spiky) for cost optimization.

Estimated Time:2m 30s

Question 1102Question →

A company is hosting a simple web application on Amazon EC2 instances. The instances are managed by an Auto Scaling group (ASG) and receive traffic through an Application Load Balancer (ALB). The web application is configured to run on custom port $8080$ . The solutions architect needs to configure the load balancer and security groups to ensure traffic is correctly routed and instances are properly monitored.

Which of the following actions should the solutions architect perform to meet these requirements? (Select two.)

Select all that apply

Configure the target group of the Application Load Balancer to perform health checks on the custom port

8080

Configure the security group of the EC2 instances to allow inbound traffic from the security group of the Application Load Balancer on port

8080

Configure the target group to perform health checks on default port

80

, while keeping the application listener on port

8080

Configure a stateless Network ACL on the subnet to allow inbound traffic on port

8080

, relying on the stateful security group to automatically permit return traffic without additional outbound rules.

Configure an Amazon Route 53 Latency routing policy pointing to individual EC2 instances to dynamically handle load balancing and instance failover.

Show answer & explanation

Answer: Configure the target group of the Application Load Balancer to perform health checks on the custom port $8080$ .; Configure the security group of the EC2 instances to allow inbound traffic from the security group of the Application Load Balancer on port $8080$ .

Answer

Configure the target group of the Application Load Balancer to perform health checks on the custom port

8080

, and configure the security group of the EC2 instances to allow inbound traffic from the security group of the Application Load Balancer on port

8080

To ensure that the Application Load Balancer (ALB) can successfully route traffic and monitor the health of the EC2 instances, the target group health checks must query the port where the application is listening (port

8080

). Additionally, the security group attached to the EC2 instances must allow inbound traffic on port

8080

from the security group of the ALB.

Step-by-Step Solution

Identify the application port configuration.

The application listens on custom port

8080

All traffic from the load balancer and health checks must be routed to this specific port.

Set the health check port for the ELB Target Group.

The Target Group is configured to run active health checks on port

8080

If default port

80

is used, health check probes will fail because no service is listening on port

80

, causing the ALB to flag all instances as unhealthy.

Configure instance-level security groups to accept traffic.

The EC2 instances' security group is updated to allow inbound TCP traffic on port

8080

from the ALB's security group source.

This allows the ALB to forward client requests and perform health check probes successfully.

Key Concept

ELB Target Group health check configurations and security group port alignment for custom application ports.

Estimated Time:1m 0s

Question 1103Question →

A seismic monitoring station network uploads raw telemetry data logs to an Amazon S3 Standard bucket. Each log file is approximately $15\text{ MB}$ in size. The logs are accessed frequently by analytical tools for the first $10$ days. After $10$ days, the logs are rarely accessed, but must remain immediately available for audit queries. All logs are deleted permanently after $25$ days. Which S3 lifecycle policy configuration will minimize storage costs for this workload?

Retain the log files in S3 Standard for the entire

25

days, then configure a lifecycle rule to expire the objects.

Configure a lifecycle rule to transition the log files to S3 Standard-Infrequent Access (S3 Standard-IA) after

10

days, then expire the objects after

25

days.

Configure a lifecycle rule to transition the log files to S3 Glacier Flexible Retrieval after

10

days, then expire the objects after

25

days.

Configure a lifecycle rule to transition the log files to S3 Glacier Deep Archive after

10

days, then expire the objects after

25

days.

Show answer & explanation

Answer: Retain the log files in S3 Standard for the entire $25$ days, then configure a lifecycle rule to expire the objects.

Answer

Retain the log files in S3 Standard for the entire

25

days, then configure a lifecycle rule to expire the objects.

Retaining the objects in S3 Standard for the entire

25

days is the most cost-effective strategy. This is because transitioning them to S3 Standard-IA on day

10

means they will only spend

15

days in S3 Standard-IA. Since S3 Standard-IA enforces a minimum storage charge of

30

days, the organization would be billed for an extra

15

days of unused storage, making the transition more expensive than keeping the files in S3 Standard.

Step-by-Step Solution

Analyze the lifecycle requirements of the data.

The files are stored in Amazon S3 for a total of

25

days before deletion. They require frequent access for the first

10

days and immediate access for the remaining

15

days.

Understanding the timeline and access patterns is necessary to determine which S3 storage classes are viable and most cost-effective.

Evaluate S3 Standard-IA suitability.

S3 Standard-IA has a minimum storage duration of

30

days. Transitioning the files on day

10

and deleting them on day

25

means they reside in S3 Standard-IA for only

15

days, incurring a

15

-day penalty charge.

Evaluating S3 Standard-IA helps determine whether transitioning saves money or incurs a minimum storage duration penalty.

Compare storage costs between keeping files in S3 Standard vs. transitioning to S3 Standard-IA.

The cost of S3 Standard for

25

days is cheaper than paying for

10

days of S3 Standard plus a minimum

30

-day charge in S3 Standard-IA.

A quantitative cost comparison determines the most financially optimal lifecycle policy.

Key Concept

S3 lifecycle policies and the minimum storage duration rules for infrequent access and archive tiers.

Question 1104Question →

A genomics research laboratory generates two types of data: raw genomic sequence files with an average size of $150\text{ MB}$ and summary analysis reports with an average size of $10\text{ KB}$ .

- The raw sequence files are accessed frequently during the first $20\text{ days}$ for data pipelines. After this initial period, they are rarely accessed but must be retained for $5\text{ years}$ for audit purposes, with a retrieval time of up to $12\text{ hours}$ being acceptable.
- The summary analysis reports are accessed frequently for the first $10\text{ days}$ , but are only needed for a total of $25\text{ days}$ , after which they can be permanently deleted.

Which two lifecycle actions should a solutions architect configure to meet these requirements in the most cost-effective manner? (Select TWO.)

Select all that apply

Configure a lifecycle policy to transition the raw genomic sequence files from S3 Standard to Amazon S3 Glacier Flexible Retrieval after

20\text{ days}

Configure a lifecycle policy to delete the summary analysis reports directly from S3 Standard after

25\text{ days}

Configure a lifecycle policy to transition the raw genomic sequence files from S3 Standard to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after

10\text{ days}

, and then to Amazon S3 Glacier Flexible Retrieval after

20\text{ days}

Configure a lifecycle policy to transition the summary analysis reports from S3 Standard to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after

10\text{ days}

, and delete them after

25\text{ days}

Configure a lifecycle policy to transition the summary analysis reports from S3 Standard to Amazon S3 Glacier Flexible Retrieval after

10\text{ days}

Show answer & explanation

Answer: Configure a lifecycle policy to transition the raw genomic sequence files from S3 Standard to Amazon S3 Glacier Flexible Retrieval after $20\text{ days}$ .; Configure a lifecycle policy to delete the summary analysis reports directly from S3 Standard after $25\text{ days}$ .

Answer

The correct lifecycle actions are to transition the raw genomic sequence files to S3 Glacier Flexible Retrieval after

20\text{ days}

and to delete the summary reports directly from S3 Standard after

25\text{ days}

Transitioning the large raw genomic files (

150\text{ MB}

) directly to Amazon S3 Glacier Flexible Retrieval after

20\text{ days}

is highly cost-effective because the files are large enough to avoid size penalties, they are rarely accessed after

20\text{ days}

, and the required recovery time window (

12\text{ hours}

) is compatible with Glacier's standard retrieval performance (

3\text{ to }5\text{ hours}

). Deleting the summary reports directly from S3 Standard after

25\text{ days}

is correct because their size (

10\text{ KB}

) falls well below the

128\text{ KB}

minimum storage size for S3 Standard-IA, and their residency in the IA tier would be only

15\text{ days}

, which violates the

30\text{-day}

minimum storage duration. Thus, keeping them in S3 Standard avoids both the minimum capacity charge and early deletion fees.

Step-by-Step Solution

Evaluate the storage needs for raw genomic sequence files.

The files are

150\text{ MB}

(above the

128\text{ KB}

threshold), require active access for

20\text{ days}

, and can tolerate retrieval times of up to

12\text{ hours}

for the remaining

5\text{ years}

. Amazon S3 Glacier Flexible Retrieval meets this retrieval profile with standard retrievals (

3\text{ to }5\text{ hours}

) at a lower cost than S3 Standard.

To select the most cost-effective storage tier that matches access frequency and retrieval time limits.

Evaluate the storage needs for summary analysis reports.

The reports are small (

10\text{ KB}

) and are only needed for a total of

25\text{ days}

. Transitioning them to S3 Standard-IA or One Zone-IA after

10\text{ days}

would leave them in the IA tier for only

15\text{ days}

before deletion, violating the

30\text{-day}

minimum storage duration. Also, their

10\text{ KB}

size is billed at a

128\text{ KB}

minimum, creating a

12.8\text{x}

cost overhead.

To determine whether transitioning short-lived, small objects to infrequent access tiers is cost-effective.

Synthesize the lifecycle rules.

Transition the large files directly to S3 Glacier Flexible Retrieval after

20\text{ days}

. Leave the small reports in S3 Standard and delete them after

25\text{ days}

to avoid all minimum storage size and duration penalties.

To formulate the final most cost-optimized storage design.

Key Concept

Understanding S3 lifecycle transitions, object size constraints, and minimum storage durations to optimize costs.

Estimated Time:2m 0s

Question 1105Question →

A logistics company operates a fleet of IoT tracking devices that transmit real-time location telemetry using a custom UDP-based protocol to Amazon EC2 instances behind a Network Load Balancer (NLB) in a single AWS Region. The company also hosts a web portal where global clients download large, historical tracking reports in PDF format stored in an Amazon S3 bucket. Clients are experiencing high latency when downloading reports, and the IoT devices suffer from packet loss over the public internet during peak hours. A solutions architect must design a highly resilient architecture to reduce latency and packet loss. Which solution should the solutions architect recommend?

Configure an Amazon CloudFront distribution to serve both the PDF reports and the UDP telemetry traffic, and enable AWS Shield Advanced on CloudFront to protect the UDP stream from application-layer exploits.

Create an Amazon CloudFront distribution to cache and serve the PDF reports, and configure Amazon Route 53 with latency-based routing to route the UDP telemetry traffic directly to the EC2 instances.

Deploy AWS Global Accelerator to route the UDP telemetry traffic to the Network Load Balancer, and create an Amazon CloudFront distribution to cache and serve the PDF reports from the Amazon S3 bucket.

Deploy AWS Global Accelerator to route both the UDP telemetry traffic and the HTTPS traffic for the S3 bucket, using a single accelerator endpoint to optimize routing without caching.

Show answer & explanation

Answer: Deploy AWS Global Accelerator to route the UDP telemetry traffic to the Network Load Balancer, and create an Amazon CloudFront distribution to cache and serve the PDF reports from the Amazon S3 bucket.

Answer

The correct solution uses AWS Global Accelerator to route the UDP telemetry traffic over the AWS global network to the Network Load Balancer, minimizing latency and packet loss. Concurrently, it uses Amazon CloudFront to cache and serve the static PDF reports from the S3 bucket close to the users, offloading the S3 origin and optimizing performance.

Step-by-Step Solution

Analyze the protocols and traffic types: the telemetry stream uses a custom UDP protocol, and the historical reports are static PDF files delivered over HTTPS.

Identify that CloudFront cannot be used for the UDP stream as it only supports HTTP/HTTPS, and that S3 downloads are static and would benefit from edge caching.

Choosing the correct acceleration and delivery mechanism depends on protocol support and content type (cachable vs non-cachable).

Select the appropriate network acceleration tool for the UDP traffic to solve packet loss and latency over the public internet.

Select AWS Global Accelerator, which provides static IP addresses and Anycast routing to direct UDP traffic over the AWS global network to the NLB, bypassing public internet congestion.

Route 53 latency routing only resolves DNS and does not optimize path transit or prevent packet loss over the public internet.

Select the caching solution for the static PDF files stored in S3.

Select Amazon CloudFront to cache the PDF files at Edge Locations globally.

Caching static files close to users reduces latency and offloads read operations from the origin S3 bucket, maintaining high availability.

Key Concept

Selecting and combining Amazon CloudFront and AWS Global Accelerator based on protocol support and caching requirements.

Question 1106Question →

A media company hosts a video rendering application on Amazon EC2 instances inside a private subnet of a VPC. Every month, the application transfers $30\text{ TB}$ of rendered video files from the VPC to an on-premises storage repository. Currently, this transfer occurs over a $1\text{ Gbps}$ AWS Site-to-Site VPN connection. The company wants to reduce the high data transfer out (DTO) charges associated with this replication. Which solution will minimize the monthly data transfer costs most effectively?

Deploy an AWS NAT Gateway in a public subnet of the VPC and route all replication traffic through it to the existing Site-to-Site VPN.

Configure an AWS Transit Gateway and establish multiple Site-to-Site VPN connections using Equal-Cost Multi-Path (ECMP) routing to load balance the replication traffic.

Establish an AWS Direct Connect connection and configure a Private Virtual Interface (VIF) to route the replication traffic directly to the on-premises network.

Set up a public virtual interface (VIF) on an AWS Direct Connect connection and route the replication traffic through a NAT Gateway deployed in the VPC.

Show answer & explanation

Answer: Establish an AWS Direct Connect connection and configure a Private Virtual Interface (VIF) to route the replication traffic directly to the on-premises network.

Answer

Establish an AWS Direct Connect connection and configure a Private Virtual Interface (VIF) to route the replication traffic directly to the on-premises network.

Establishing an AWS Direct Connect connection with a Private VIF is the most cost-effective solution. AWS Direct Connect significantly reduces the per-GB data transfer out (DTO) fee compared to standard internet-based egress (which VPN uses). A Private VIF allows private and direct connectivity from the VPC to the on-premises network without traversing the public internet or incurring additional intermediary data processing fees.

Step-by-Step Solution

Analyze the current network data transfer path and associated cost structure.

The current configuration uses a Site-to-Site VPN over the public internet, which incurs standard AWS data transfer out (DTO) rates (typically

0.09 per GB) for the

30\text{ TB}$ of egress data.

Understanding the cost driver helps identify where savings can be achieved.

Evaluate AWS network services that offer reduced data transfer out rates.

AWS Direct Connect provides dedicated network connections to AWS with significantly lower per-GB DTO pricing (e.g., $0.02 per GB) compared to internet egress.

Replacing VPN/internet routing with Direct Connect directly reduces the per-GB DTO charge.

Determine the correct virtual interface (VIF) type and routing design.

A Private VIF is required to connect to private resources within a VPC. Routing the traffic directly over the Private VIF avoids intermediate processing costs like NAT Gateway fees.

Selecting a Private VIF aligns with accessing the VPC resources, and avoiding NAT Gateway prevents an additional $0.045 per GB processing fee.

Key Concept

AWS Direct Connect Private VIF provides the most cost-effective data transfer out (DTO) rates for replicating data from a VPC to on-premises environments, avoiding both high internet egress fees and additional NAT processing charges.

Estimated Time:2m 0s

Question 1107Question →

A solutions architect is designing a high-performance database tier for a multiplayer mobile game. The database must support up to $80,000$ write operations per second with single-digit millisecond latency and up to $200,000$ read operations per second with sub-millisecond latency. The gaming traffic is highly unpredictable and can spike rapidly within minutes. Which configurations should the solutions architect choose to meet these performance and latency requirements? (Select TWO.)

Select all that apply

Deploy an Amazon DynamoDB table and configure Amazon DynamoDB Accelerator (DAX) to serve read requests.

Design the DynamoDB table partition key using a combination of the game session ID and a unique user UUID.

Design the DynamoDB table partition key using a monotonically increasing timestamp to order player scores sequentially.

Deploy an Amazon RDS Multi-AZ DB cluster and configure the application to use the Read Replicas as the primary write failover target to maintain write availability.

Show answer & explanation

Answer: Deploy an Amazon DynamoDB table and configure Amazon DynamoDB Accelerator (DAX) to serve read requests.; Design the DynamoDB table partition key using a combination of the game session ID and a unique user UUID.

Answer

Deploying an Amazon DynamoDB table with Amazon DynamoDB Accelerator (DAX) to serve reads, and designing the partition key with a combination of the game session ID and a unique user UUID.

The correct configurations are to deploy Amazon DynamoDB with DynamoDB Accelerator (DAX) and to design a high-cardinality partition key using the game session ID and user UUID. DynamoDB is designed to handle high-throughput workloads, and DAX provides the required sub-millisecond (microsecond) read latencies. A composite partition key ensures that writes are distributed evenly across the database partitions, preventing write bottlenecks.

Step-by-Step Solution

Analyze latency and throughput requirements.

Write traffic requires single-digit millisecond latency at

80,000

writes/sec, and read traffic requires sub-millisecond latency at

200,000

reads/sec.

This determines the suitable database type and caching layer.

Select the database and caching technologies.

Choose Amazon DynamoDB to scale writes and Amazon DynamoDB Accelerator (DAX) to achieve sub-millisecond read latency.

DynamoDB scales horizontally for high write throughput, and DAX provides microsecond latency for cached reads.

Design a high-performing partitioning strategy.

Use a partition key combining game session ID and user UUID to distribute the workload.

A high-cardinality partition key avoids hot partitions and prevents write bottlenecks.

Key Concept

Designing high-performing, scalable database solutions using DynamoDB partitioning strategies and DAX caching to achieve sub-millisecond latencies.

Question 1108Question →

A digital health platform hosts its microservices on Amazon ECS with AWS Fargate. The platform must comply with healthcare regulations that require continuous security auditing, real-time threat detection for container environments, and centralized tracking of security posture across multiple AWS accounts. The security team needs a solution that monitors API calls, detects runtime container anomalies, and compiles all findings into a unified security dashboard. Which combination of actions should a solutions architect recommend to satisfy these monitoring and detection requirements? (Select TWO.)

Select all that apply

Enable Amazon GuardDuty with ECS Runtime Monitoring to analyze VPC Flow Logs, DNS logs, CloudTrail events, and container runtime activity for threats.

Configure AWS Security Hub to centrally aggregate and prioritize compliance findings and security alerts from GuardDuty and other integrated AWS services.

Configure AWS Shield Standard to monitor ECS container traffic for Layer 7 application exploits and automatically block common SQL injection vectors.

Configure stateless security groups at the Fargate task subnet level to inspect ingress payload data and automatically generate alerts for suspicious network activity.

Deploy AWS Shield Advanced at the VPC level to perform deep packet inspection of HTTP requests and block runtime anomalies inside the Fargate containers.

Show answer & explanation

Answer: Enable Amazon GuardDuty with ECS Runtime Monitoring to analyze VPC Flow Logs, DNS logs, CloudTrail events, and container runtime activity for threats.; Configure AWS Security Hub to centrally aggregate and prioritize compliance findings and security alerts from GuardDuty and other integrated AWS services.

Answer

The platform should enable Amazon GuardDuty with ECS Runtime Monitoring to analyze log sources and container runtime activities, and configure AWS Security Hub to centrally aggregate compliance findings and security alerts.

The solution requires a service that detects threats within the container environment and a centralized security dashboard. Enabling Amazon GuardDuty with ECS Runtime Monitoring meets the threat detection requirement by analyzing VPC flow logs, DNS logs, CloudTrail, and Fargate runtime activities. Enabling AWS Security Hub meets the aggregation requirement by consolidating findings from GuardDuty and compliance standards into a single pane of glass.

Step-by-Step Solution

Select the correct threat detection service for the container environment.

Identify Amazon GuardDuty with ECS Runtime Monitoring.

GuardDuty monitors logs and Fargate runtime activity to detect container threat patterns.

Select the correct service to consolidate security findings and track compliance posture.

Identify AWS Security Hub.

AWS Security Hub consolidates security alerts and compliance statuses from multiple AWS services and accounts into a centralized dashboard.

Evaluate and eliminate incorrect options.

Eliminate options involving AWS Shield and stateless security groups at the subnet level.

AWS Shield is for DDoS protection (not Layer 7 exploits or container runtime anomalies), and Security Groups are stateful firewall rules applied to ENIs rather than subnets.

Key Concept

AWS Security Monitoring and Threat Detection architectures rely on GuardDuty for intelligent threat detection (including runtime container monitoring) and AWS Security Hub for centralized findings aggregation and compliance standards monitoring.

Question 1109Question →

An enterprise application hosted on Amazon EC2 instances inside an Auto Scaling group (ASG) is positioned behind an Application Load Balancer (ALB). The ALB target group has stickiness enabled using ALB-generated duration-based cookies. The ASG is configured with a target tracking scaling policy based on the average CPU utilization metric. During a promotional event, a small number of heavy API clients initiate a massive volume of concurrent requests. System administrators observe that a few EC2 instances become severely overloaded and fail health checks, while the remaining instances in the ASG remain underutilized. The ASG does not scale out to add more capacity. Which action should the solutions architect take to resolve the performance imbalance and ensure the application scales effectively?

Configure the Application Load Balancer target group to perform health checks on a custom port instead of the traffic port, allowing the load balancer to bypass sticky routing for health monitoring.

Modify the subnet Network ACLs to statefully restrict inbound traffic from the heavy API consumers, redirecting their requests to newly spawned instances in a different Availability Zone.

Disable target group stickiness on the Application Load Balancer and modify the application to store session state externally in an Amazon ElastiCache cluster.

Configure an Amazon Route 53 latency-based routing policy to directly resolve the application's domain name to the public IP addresses of the individual EC2 instances, bypassing the Application Load Balancer to distribute client requests.

Show answer & explanation

Answer: Disable target group stickiness on the Application Load Balancer and modify the application to store session state externally in an Amazon ElastiCache cluster.

Answer

Disable target group stickiness on the Application Load Balancer and modify the application to store session state externally in an Amazon ElastiCache cluster.

Disabling target group stickiness on the Application Load Balancer allows traffic to be distributed evenly across all healthy EC2 instances in the Auto Scaling group using the configured load balancing algorithm (such as round-robin or least outstanding requests). Storing session state externally in Amazon ElastiCache ensures the application remains stateless, preventing localized overloads from heavy API consumers and enabling the target tracking policy based on average CPU utilization to scale the Auto Scaling group out or in accurately.

Step-by-Step Solution

Analyze the current architecture's bottleneck caused by stickiness and target tracking.

Identify that ALB-generated cookie stickiness binds specific heavy clients to specific EC2 instances, causing localized CPU spikes on those instances.

Average CPU utilization of the ASG remains below the scaling threshold because underutilized instances balance out the average, preventing scale-out.

Evaluate the options for scaling stateless versus stateful application components.

Determine that making the application tier stateless by offloading session storage to a caching tier is necessary to distribute traffic evenly.

Decoupling session state allows any instance to handle any request, enabling effective load balancing.

Configure the Application Load Balancer and session storage backend.

Disable target group stickiness on the ALB and provision an Amazon ElastiCache cluster for external session storage.

This permits the ALB to distribute requests evenly via round-robin or least outstanding requests, ensuring that CPU utilization rises uniformly across the ASG and triggers auto-scaling correctly under heavy load.

Key Concept

Decoupling session state from compute instances to enable effective load balancing and auto-scaling.

Estimated Time:3m 0s

Question 1110Question →

A financial technology firm hosts a payment processing application on Amazon ECS inside a private VPC subnet. Public traffic is received via an Application Load Balancer (ALB). The compliance team dictates that the architecture must satisfy three main security requirements: continuously monitor all network interfaces and DNS queries for potential data exfiltration or threat patterns; audit any configurations to security groups and automatically revert unauthorized changes within minutes; and aggregate security status globally across multiple AWS accounts. Which two actions should the solutions architect take to meet these security monitoring and compliance requirements?

Select all that apply

Enable Amazon GuardDuty to analyze VPC Flow Logs and Route 53 resolver query logs across all accounts to detect network-level anomalies and threat patterns.

Create an AWS Config rule to evaluate security group rule compliance and associate it with an AWS Systems Manager Automation runbook to automatically remediate unauthorized rules.

Deploy AWS Shield Advanced on the Application Load Balancer to inspect HTTP payloads for SQL injection and cross-site scripting attacks, and automatically update the security groups.

Configure stateless Network Access Control Lists (NACLs) to dynamically monitor security group states and drop all return packets from unauthorized external IPs.

Configure AWS WAF to monitor VPC Flow Logs in real time and automatically add deny rules to the public subnet Network ACLs when traffic anomalies are detected.

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs and Route 53 resolver query logs across all accounts to detect network-level anomalies and threat patterns.; Create an AWS Config rule to evaluate security group rule compliance and associate it with an AWS Systems Manager Automation runbook to automatically remediate unauthorized rules.

Answer

Enable Amazon GuardDuty to analyze VPC Flow Logs and Route 53 query logs, and create an AWS Config rule to evaluate security groups with an AWS Systems Manager Automation runbook for remediation.

The correct architecture uses Amazon GuardDuty to process VPC Flow Logs and Route 53 query logs across all accounts to detect anomalies, and AWS Config rules to monitor security group modifications with Systems Manager Automation runbooks to immediately revert non-compliant configurations.

Step-by-Step Solution

Select the threat detection service that natively ingests VPC Flow Logs and Route 53 query logs.

Amazon GuardDuty is selected to meet the requirement for network anomaly and threat detection.

GuardDuty uses machine learning and threat intelligence to analyze flow logs and DNS query logs without introducing performance overhead.

Identify the auditing and automated remediation tool for security groups.

AWS Config is chosen to monitor security group rules, paired with AWS Systems Manager Automation for automated remediation.

This combination audits resource configurations and triggers runbooks to revoke unauthorized ingress rules automatically.

Evaluate and rule out AWS Shield Advanced for application payload filtering.

AWS Shield Advanced is disqualified because payload filtering for SQL injection requires AWS WAF.

Shield is a DDoS mitigation service, not an application payload inspection firewall.

Evaluate and rule out stateless Network ACL configurations and WAF log analysis.

Stateless Network ACLs and WAF monitoring of VPC Flow Logs are disqualified due to stateless/stateful limitations and service scope mismatches.

Network ACLs cannot dynamically track connection state, and WAF cannot analyze flow logs.

Key Concept

Continuous security monitoring, threat detection, and automated compliance auditing using Amazon GuardDuty, AWS Config, and Systems Manager.

Question 1111Question →

An enterprise is migrating a stateful legacy web application to AWS. The application runs on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application listens on custom port 8080. During testing under load, users experience session loss and are forced to log in repeatedly when the application scales. Additionally, during scale-in events, users whose requests are currently being processed experience immediate connection drops and HTTP 502/504 errors. The network and security teams require strict control over VPC boundaries using both security groups and Network ACLs (NACLs).

Which two actions should a solutions architect take to resolve the session issues and prevent request failures during scale-in? (Select two.)

Select all that apply

Enable sticky sessions (session affinity) on the Application Load Balancer target group using duration-based cookies.

Configure a deregistration delay (connection draining) on the Application Load Balancer target group.

Change the target group's health check port to the default HTTP port 80 to prevent health check traffic from saturating the application on port 8080.

Configure stateless Network ACLs on the instance subnets to allow inbound traffic on port 8080, relying on the stateful nature of security groups to permit outbound ephemeral port responses automatically.

Implement an Amazon Route 53 latency routing policy pointing directly to the EC2 instances' public IP addresses to bypass the ALB and enforce session persistence.

Show answer & explanation

Answer: Enable sticky sessions (session affinity) on the Application Load Balancer target group using duration-based cookies.; Configure a deregistration delay (connection draining) on the Application Load Balancer target group.

Answer

Enable sticky sessions (session affinity) on the target group, and configure a deregistration delay (connection draining) on the target group.

To resolve the session loss issues in a stateful application, sticky sessions (session affinity) must be enabled on the Application Load Balancer target group so that a client is repeatedly routed to the same backend instance. To prevent active connections and requests from being cut off during scale-in operations, a deregistration delay (connection draining) must be configured on the target group to keep the connections alive until the in-flight requests complete.

Step-by-Step Solution

Address session loss by binding users to their session-holding instances.

Enabling sticky sessions (session affinity) on the target group ensures that subsequent requests from the same user are sent to the same EC2 instance, avoiding session loss.

Because the application is stateful and stores session data locally, routing requests to different instances causes session drops.

Address connection drops during scaling down events by delaying instance termination.

Configuring a deregistration delay (connection draining) ensures that the load balancer keeps active connections open until in-flight requests finish, up to the configured limit, before the ASG terminates the instance.

This prevents HTTP 502/504 errors and immediate session termination when the ASG attempts to scale in.

Key Concept

ELB Sticky Sessions and Deregistration Delay

Question 1112Question →

A company is designing the database tier for a new web application. The application stores user session states and profiles. The workload is highly variable and unpredictable, experiencing sudden, irregular traffic spikes of up to $8,000$ read operations per second and $4,000$ write operations per second, followed by several hours of complete inactivity. The company has a strict budget and wants to minimize operational costs while preventing database throttling during traffic spikes. Which database configuration is the most cost-effective for this workload?

Amazon DynamoDB configured in On-Demand capacity mode

Amazon DynamoDB configured in Provisioned capacity mode with DynamoDB Auto Scaling enabled, setting the minimum capacity to

100

Read Capacity Units (RCUs) and

50

Write Capacity Units (WCUs)

Amazon DynamoDB configured in Provisioned capacity mode with a constant provisioned capacity of

8,000

RCUs and

4,000

WCUs

An Amazon RDS for MySQL DB instance configured in a Multi-AZ deployment, using Read Replicas in separate Availability Zones as the primary disaster recovery failover targets

Show answer & explanation

Answer: Amazon DynamoDB configured in On-Demand capacity mode

Answer

Amazon DynamoDB configured in On-Demand capacity mode

The correct answer is configuring Amazon DynamoDB in On-Demand capacity mode. Because the workload is highly variable and unpredictable with long periods of complete inactivity, paying only for the actual read and write requests aligns perfectly with cost optimization. DynamoDB On-Demand scales instantly to accommodate spikes up to the table's previous peak traffic, ensuring zero throttling without paying for idle capacity.

Step-by-Step Solution

Analyze workload characteristics

The workload is highly variable, unpredictable, has sudden peaks (

8,000

reads/sec,

4,000

writes/sec), and experiences long periods of complete inactivity.

Understanding the traffic patterns is key to choosing between provisioned and serverless/on-demand capacity models.

Evaluate DynamoDB capacity options

On-demand capacity mode charges only for requests made and scales instantly. Provisioned capacity mode with auto-scaling is too slow to react to sudden spikes and incurs costs during idle times. Constant provisioned capacity is prohibitively expensive due to over-provisioning.

This determines the most cost-effective DynamoDB scaling option that also prevents throttling.

Evaluate Amazon RDS option

RDS instances run continuously and incur static hourly costs even during idle periods. Read Replicas do not solve the write scaling problem and cannot act as synchronous failover targets.

This rules out relational database alternatives that fail either cost-efficiency or failover requirements.

Select the optimal database design

Amazon DynamoDB configured in On-Demand capacity mode is the correct choice.

It offers instant scaling for sudden spikes and zero cost when idle.

Key Concept

Selecting the cost-optimal database capacity mode for highly unpredictable workloads with idle periods.

Estimated Time:2m 0s

Question 1113Question →

A logistics company is designing an automated package tracking update ingestion system. Package scanning devices at various transit hubs upload status updates. These updates for each package must be processed sequentially to prevent out-of-order state updates. The volume of updates varies significantly, with massive surges during holiday shopping seasons and near-zero activity during early morning hours.

The company wants to design a serverless architecture that minimizes costs during idle periods and scales automatically to handle peak surges without administrative overhead.

Which TWO configurations should a solutions architect select to meet these requirements cost-effectively? (Select two.)

Select all that apply

Configure an Amazon DynamoDB table using on-demand capacity mode to store the package tracking states.

Route incoming tracking updates to an Amazon Simple Queue Service (Amazon SQS) FIFO queue, and configure an AWS Lambda function to process messages from the queue.

Route incoming tracking updates to an Amazon Simple Queue Service (Amazon SQS) standard queue, and configure an AWS Lambda function to process messages from the queue.

Configure an Amazon DynamoDB table using provisioned capacity mode with Auto Scaling enabled to store the package tracking states.

Deploy a continuously running AWS Lambda function that loops indefinitely to poll the queue for tracking updates.

Show answer & explanation

Answer: Configure an Amazon DynamoDB table using on-demand capacity mode to store the package tracking states.; Route incoming tracking updates to an Amazon Simple Queue Service (Amazon SQS) FIFO queue, and configure an AWS Lambda function to process messages from the queue.

Answer

The correct choices are using Amazon DynamoDB in on-demand capacity mode and routing updates through an Amazon SQS FIFO queue processed by AWS Lambda.

The correct solution combined the use of Amazon SQS FIFO queues to guarantee package update order and AWS Lambda to process updates dynamically, alongside Amazon DynamoDB in on-demand capacity mode. This setup ensures that compute and database resources scale down to zero cost during idle periods, while auto-scaling to handle peak workloads with no administrative overhead.

Step-by-Step Solution

Analyze the database requirements for unpredictable spikes and idle periods.

Identify that DynamoDB on-demand capacity mode is the most cost-effective since it scales to zero during inactivity and handles immediate spikes.

To minimize idle database costs while ensuring scaling capability.

Analyze the processing queue requirements for strict sequential ordering.

Determine that an Amazon SQS FIFO queue is required to guarantee message ordering.

Standard queues do not guarantee first-in, first-out delivery, which is required to prevent out-of-order tracking history.

Select the compute model for processing queue messages.

Pair the SQS queue with an AWS Lambda function using event source mapping.

Event-driven Lambda executions scale automatically and cost nothing when the queue is empty, whereas continuous polling would lead to excessive compute costs.

Key Concept

Leveraging serverless architectures with SQS FIFO queues and DynamoDB on-demand capacity mode to achieve automatic scaling and cost optimization for spiky, order-sensitive workloads.

Estimated Time:1m 30s

Question 1114Question →

A startup is deploying a new API service on Amazon EC2 instances managed by an Auto Scaling group (ASG). The API service is configured to run on port 5000. An Application Load Balancer (ALB) is configured to route traffic to these instances. However, the ALB shows all targets in the target group as unhealthy. A solutions architect verifies that the API service is running on the instances. Which two configurations are required to resolve this issue and allow the ALB to perform successful health checks? (Select two.)

Select all that apply

Configure the target group health check settings to use port 5000 or the traffic port.

Update the security group associated with the EC2 instances to allow inbound traffic on port 5000 from the security group of the Application Load Balancer.

Configure a stateless Network ACL rule to allow inbound traffic on port 5000, assuming it will automatically allow the return traffic.

Set the target group health check port to default port 80 to ensure the Application Load Balancer can ping the web server.

Configure an Amazon Route 53 latency routing policy to route the load balancer's health checks to the nearest EC2 instance.

Show answer & explanation

Answer: Configure the target group health check settings to use port 5000 or the traffic port.; Update the security group associated with the EC2 instances to allow inbound traffic on port 5000 from the security group of the Application Load Balancer.

Answer

Configure the target group health check settings to use port 5000 or the traffic port, and update the security group associated with the EC2 instances to allow inbound traffic on port 5000 from the security group of the Application Load Balancer.

The Application Load Balancer must be configured to send health check requests to the port where the API service is listening, which is port 5000. Additionally, the security group for the EC2 instances must allow inbound traffic on port 5000 from the ALB's security group so the health check probes can successfully reach the instances.

Step-by-Step Solution

Identify the application port and verify health check settings.

The application runs on port 5000, but standard health checks default to port 80 or traffic port if not customized.

To verify health, the load balancer must query the specific port where the application is listening.

Ensure network path and security group permissions are open.

The target EC2 instances must allow inbound traffic from the ALB on port 5000.

Security groups are stateful; allowing inbound traffic on port 5000 from the ALB security group allows both health check probes and client request traffic.

Key Concept

Application Load Balancer health checks require alignment between the target group health check port configuration, the application listening port, and security groups that permit traffic from the load balancer.

Question 1115Question →

A software-as-a-service (SaaS) company hosts a multi-tier web application on AWS using an Application Load Balancer (ALB) and Amazon EC2 instances. The security team needs to monitor the environment for Layer 7 web exploits, detect anomalous network activity or potential credential compromise at the host level, and continuously audit changes to network access controls. Which combination of AWS services should a solutions architect recommend to meet these monitoring and threat detection requirements? (Select TWO.)

Select all that apply

Deploy AWS WAF on the ALB to protect against Layer 7 web exploits, and enable AWS Config to track and audit configuration history for security groups.

Enable Amazon GuardDuty to monitor VPC Flow Logs and CloudTrail events to identify anomalous network activity and unauthorized API actions.

Deploy AWS Shield Advanced on the ALB to analyze and block Layer 7 web application exploits, and configure AWS Config to audit subnet-level stateful traffic patterns.

Configure stateless Security Groups at the subnet level to log traffic, and store threat detection alert credentials in Systems Manager Parameter Store as plain String parameters.

Deploy AWS Shield Standard on the ALB to monitor and log SQL database queries, and store monitoring API tokens in Systems Manager Parameter Store as plain String parameters.

Show answer & explanation

Answer: Deploy AWS WAF on the ALB to protect against Layer 7 web exploits, and enable AWS Config to track and audit configuration history for security groups.; Enable Amazon GuardDuty to monitor VPC Flow Logs and CloudTrail events to identify anomalous network activity and unauthorized API actions.

Answer

Deploy AWS WAF on the ALB to protect against Layer 7 web exploits, enable AWS Config to track and audit configuration history for security groups, and enable Amazon GuardDuty to monitor VPC Flow Logs and CloudTrail events to identify anomalous network activity and unauthorized API actions.

The correct combination uses AWS WAF for inspecting and blocking Layer 7 web exploits, AWS Config to record configuration changes for security groups to audit network access controls, and Amazon GuardDuty to analyze VPC Flow Logs and CloudTrail events to identify network anomalies and potential compromises.

Step-by-Step Solution

Address the requirement for Layer 7 web exploit mitigation.

Identify AWS WAF as the correct service to deploy on the ALB, as it filters and blocks Layer 7 application-specific attacks.

AWS WAF provides deep inspection of HTTP/HTTPS requests, which is required to prevent common web exploits.

Address the requirement for host-level anomalous network activity and threat detection.

Identify Amazon GuardDuty as the appropriate service, which uses intelligent threat detection to analyze VPC Flow Logs and CloudTrail events.

GuardDuty monitors logs in the background without affecting performance to detect anomalies, brute-force attempts, and credential misuse.

Address the requirement for auditing network access configuration modifications.

Identify AWS Config to continuously track, record, and evaluate configuration changes to security groups.

AWS Config is the primary service for resource configuration history and compliance auditing.

Key Concept

Selecting the appropriate AWS services for Layer 7 security (WAF), threat detection (GuardDuty), and compliance tracking (AWS Config) according to the AWS Well-Architected Framework.

Question 1116Question →

A healthcare provider runs a patient analytics application on AWS. The application consists of three main components:

* An Amazon ECS cluster running API services on a baseline fleet of Amazon EC2 instances that operate continuously.
* A batch processing workload running on Amazon EC2 instances that executes for 2 hours each night. This workload is stateless, fault-tolerant, and designed to resume from checkpoints if interrupted.
* An Amazon Aurora PostgreSQL database cluster that stores patient records.

Which combination of purchasing strategies will minimize compute costs while meeting the application requirements? (Select TWO.)

Select all that apply

Purchase EC2 Instance Savings Plans to cover the baseline EC2 instances running the API services.

Use Spot Instances to run the daily batch processing workload.

Purchase Compute Savings Plans to cover both the baseline EC2 instances and the Amazon Aurora PostgreSQL database cluster.

Configure the daily batch processing workload to run on AWS Lambda functions.

Purchase an Amazon EC2 Instance Savings Plan to cover both the baseline EC2 instances and the Amazon Aurora PostgreSQL database cluster.

Show answer & explanation

Answer: Purchase EC2 Instance Savings Plans to cover the baseline EC2 instances running the API services.; Use Spot Instances to run the daily batch processing workload.

Answer

Purchase EC2 Instance Savings Plans to cover the baseline EC2 instances running the API services, and use Spot Instances to run the daily batch processing workload.

Purchasing an EC2 Instance Savings Plan is correct because the baseline ECS API services run continuously, making them steady-state workloads that benefit from the high discount of a committed savings plan. Using Spot Instances is correct because the daily batch processing workload is stateless, runs for a limited time (2 hours), and can resume from checkpoints, making it ideal for the high discounts of Spot instances without being impacted by potential interruptions.

Step-by-Step Solution

Analyze the baseline API service requirements.

The API services run continuously on EC2, representing a predictable, steady-state workload.

Steady-state EC2 workloads are best optimized using Savings Plans or Reserved Instances. An EC2 Instance Savings Plan offers significant discounts for a commitment to a specific instance family in a region.

Analyze the batch processing workload requirements.

The batch job runs for 2 hours daily, is stateless, and is designed to handle interruptions.

Since the batch workload is fault-tolerant and short-lived, Spot Instances provide the most cost-optimized compute option, offering significant discounts without long-term commitment.

Evaluate database cost optimization options and rule out ineligible plans.

The Amazon Aurora database is not eligible for EC2 Instance Savings Plans or Compute Savings Plans.

Compute Savings Plans and EC2 Instance Savings Plans do not cover RDS or Aurora databases. Using database-specific Reserved Instances is the correct way to discount database workloads.

Key Concept

Selecting the most cost-effective EC2 purchasing option (Savings Plans vs. Spot Instances) based on workload predictability, duration, and fault tolerance.

Estimated Time:2m 0s

Question 1117Question →

A company wants to continuously monitor its AWS environment for unauthorized activity and threat behavior, such as EC2 instances communicating with known malicious IP addresses or performing cryptocurrency mining. Which strategy should a solutions architect recommend to detect these security threats?

Deploy AWS Shield Advanced to analyze and block application-layer exploits and automated web scraping attacks.

Configure stateless Network ACL rules at the subnet level to dynamically detect and inspect packet payloads for malicious command-and-control communications.

Enable Amazon GuardDuty to analyze metadata from sources such as AWS CloudTrail logs, VPC Flow Logs, and DNS query logs.

Enable VPC Flow Logs and configure Security Groups at the subnet level to dynamically block unauthorized outgoing traffic.

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze metadata from sources such as AWS CloudTrail logs, VPC Flow Logs, and DNS query logs.

Answer

Enable Amazon GuardDuty to analyze metadata from sources such as AWS CloudTrail logs, VPC Flow Logs, and DNS query logs.

Amazon GuardDuty is a continuous threat detection service that monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, Kubernetes clusters, and data stored in Amazon S3. It analyzes metadata from sources such as AWS CloudTrail events, Amazon VPC Flow Logs, and DNS query logs to identify threats like communication with command-and-control servers or cryptocurrency mining.

Step-by-Step Solution

Identify the core security requirement, which is to detect unauthorized behavior and malicious activities like cryptocurrency mining and command-and-control communication across the AWS environment.

The requirement is dynamic threat detection and behavior monitoring rather than static packet filtering or DDoS prevention.

This establishes that a continuous threat monitoring service is needed.

Evaluate the AWS services capable of analyzing logs and metadata to detect security anomalies.

Amazon GuardDuty is built specifically for this purpose and integrates out-of-the-box with CloudTrail, VPC Flow Logs, and DNS logs.

This identifies the correct service aligned with AWS best practices.

Key Concept

Continuous Threat Detection and Security Monitoring using Amazon GuardDuty

Question 1118Question →

A company hosts a critical customer registration service at the apex domain example.com. The backend API is deployed using Regional Amazon API Gateway endpoints in us-east-1 (primary) and us-west-2 (secondary standby). The company needs to design an active-passive disaster recovery strategy that automatically routes all API traffic to us-west-2 if the us-east-1 regional endpoint becomes unavailable. The DNS records are managed in Amazon Route 53.

Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Create an HTTPS-based Route 53 health check that monitors the health of the primary regional API Gateway endpoint, and associate this health check with the primary DNS record.

Configure a primary Failover Alias record for the apex domain pointing to the primary regional API Gateway custom domain name, and configure a secondary Failover Alias record pointing to the secondary regional API Gateway custom domain name, setting 'Evaluate Target Health' to 'No' on both.

Configure primary and secondary Latency-based Alias records for the apex domain, enabling 'Evaluate Target Health' to allow Route 53 to automatically redirect traffic to the standby region during an outage.

Create a CNAME record at the apex domain pointing to the primary regional API Gateway, and configure Route 53 to automatically promote the standby database replica to primary during a failover event.

Configure a Route 53 health check to monitor a scaled-down Pilot Light environment in the standby region, enabling Route 53 to automatically start the standby Amazon EC2 instances and database engine when the primary region fails.

Show answer & explanation

Answer: Create an HTTPS-based Route 53 health check that monitors the health of the primary regional API Gateway endpoint, and associate this health check with the primary DNS record.; Configure a primary Failover Alias record for the apex domain pointing to the primary regional API Gateway custom domain name, and configure a secondary Failover Alias record pointing to the secondary regional API Gateway custom domain name, setting 'Evaluate Target Health' to 'No' on both.

Answer

Configure an HTTPS-based Route 53 health check for the primary regional API Gateway endpoint and associate it with the primary DNS record, and create primary and secondary Failover Alias records pointing to the regional custom domain names with 'Evaluate Target Health' set to 'No'.

To configure active-passive failover for regional API Gateway endpoints at the apex domain, you must use Route 53 Failover Alias records. Because API Gateway regional custom domains do not support Route 53's automatic 'Evaluate Target Health' functionality, you must set 'Evaluate Target Health' to 'No' on both alias records. Additionally, you must create a custom HTTPS Route 53 health check that probes the primary regional API Gateway endpoint and associate this health check with the primary Failover Alias record.

Step-by-Step Solution

Create an HTTPS-based Route 53 health check to monitor the health of the primary API Gateway regional endpoint.

A DNS health check is created that regularly probes the status of the primary API Gateway endpoint.

API Gateway regional custom domain names do not support the automated 'Evaluate Target Health' feature, so an external health check is required to detect endpoint failure.

Configure primary and secondary Failover Alias records for the apex domain pointing to the regional API Gateway custom domains.

DNS queries to the apex domain will resolve to the primary endpoint under normal operation and fail over to the secondary standby endpoint if the health check fails.

Failover routing policies are required for active-passive DNS configurations, and setting 'Evaluate Target Health' to 'No' allows the custom health check to govern the failover state.

Key Concept

Configuring active-passive Route 53 DNS failover for regional API Gateway endpoints using custom health checks and Failover Alias records.

Question 1119Question →

An enterprise IoT platform receives telemetry data from $50,000$ connected sensors. The platform experiences highly unpredictable and spiky write traffic that peaks at $8,500$ writes per second, and requires microsecond read response times for active sensor queries. The payload of each sensor includes a sequential timestamp and a device ID. A team wants to implement a database architecture that maximizes throughput and minimizes read latency without introducing hot partitions.

Which database configuration should be implemented to meet these requirements?

Store the sensor data in Amazon DynamoDB configured with on-demand capacity mode. Design the partition key as a composite value of the device ID and timestamp to distribute the write load, and enable Amazon DynamoDB Accelerator (DAX) to cache read operations.

Store the sensor data in Amazon DynamoDB configured with on-demand capacity mode. Design the partition key using the monotonically increasing timestamp to keep data chronologically sorted, and configure Amazon DynamoDB Accelerator (DAX) to cache read operations.

Store the sensor data in Amazon RDS for MySQL. Configure Multi-AZ for high availability, and deploy a Read Replica that serves as the primary automated disaster recovery failover target while handling the read traffic.

Store the sensor data in Amazon DynamoDB configured with provisioned capacity mode. Design the partition key as a composite value of the device ID and timestamp, and set a static provisioning value of

8,500

write capacity units to optimize cost.

Show answer & explanation

Answer: Store the sensor data in Amazon DynamoDB configured with on-demand capacity mode. Design the partition key as a composite value of the device ID and timestamp to distribute the write load, and enable Amazon DynamoDB Accelerator (DAX) to cache read operations.

Answer

Storing the sensor data in Amazon DynamoDB configured with on-demand capacity mode, using a composite partition key of device ID and timestamp, and enabling DynamoDB Accelerator (DAX) to cache reads.

The correct design uses Amazon DynamoDB with a composite partition key (device ID and timestamp) to distribute write workloads across partitions, preventing partition hot spots. It leverages on-demand capacity mode to scale dynamically with unpredictable traffic spikes, and integrates Amazon DynamoDB Accelerator (DAX) to achieve microsecond read latency.

Step-by-Step Solution

Analyze the access pattern and latency requirements.

Identify that the system needs to support high-velocity writes up to

8,500

writes/sec with microsecond-level read latency.

Microsecond read latency requires a caching tier such as DynamoDB Accelerator (DAX), and high-velocity writes are best handled by DynamoDB's distributed architecture.

Select the partition key strategy to avoid write bottlenecks.

Choose a composite key using both device ID and timestamp instead of just a sequential timestamp.

Using only sequential timestamps results in a monotonically increasing key sequence, which directs all concurrent writes to a single partition, creating a hot key bottleneck.

Determine the capacity management mode for DynamoDB.

Configure the DynamoDB table with on-demand capacity mode.

On-demand capacity mode is ideal for unpredictable, spiky workloads as it dynamically scales to accommodate surges without requiring manual provisioning or risking throttling.

Key Concept

High-performing NoSQL database design with partition key optimization and caching for low-latency operations.

Question 1120Question →

A company hosts a recipe sharing portal on Amazon EC2 instances behind an Application Load Balancer (ALB). The portal serves static image files of recipes, which are currently stored on the EC2 instances' attached Amazon EBS volumes. The recipe images are updated daily by users. During peak traffic hours, the EC2 instances experience extreme CPU utilization and high network bandwidth consumption from serving these static images. A solutions architect needs to design a high-performing and cost-effective solution to offload the static image serving and improve response times.

Which solution should the solutions architect recommend?

Create an Amazon CloudFront distribution with the Application Load Balancer as the origin, and configure the cache behavior for the images with the default, minimum, and maximum Time to Live (TTL) set to 0.

Migrate the static images to an Amazon S3 Glacier Flexible Retrieval bucket, and configure the application to serve the images directly from S3 Glacier to minimize storage costs.

Migrate the static images to an Amazon S3 Standard bucket, and create an Amazon CloudFront distribution with the S3 bucket as the origin to serve the images.

Migrate the static images to an Amazon S3 Standard-Infrequent Access (S3 Standard-IA) bucket to reduce storage costs, and configure the application to serve the images directly from the S3 bucket.

Show answer & explanation

Answer: Migrate the static images to an Amazon S3 Standard bucket, and create an Amazon CloudFront distribution with the S3 bucket as the origin to serve the images.

Answer

Migrate the static images to an Amazon S3 Standard bucket, and create an Amazon CloudFront distribution with the S3 bucket as the origin to serve the images.

Migrating the static images to an Amazon S3 Standard bucket and serving them through Amazon CloudFront offloads all static asset requests from the Application Load Balancer and EC2 instances. CloudFront caches the images at edge locations close to users, reducing latency and lowering the compute and bandwidth load on the origin servers.

Step-by-Step Solution

Migrate the static images from the EC2 instances' EBS volumes to an Amazon S3 Standard bucket.

The static images are stored in a scalable, highly available object storage service, eliminating EBS storage bottlenecks.

Amazon S3 is optimized for web-scale storage and serves as a highly scalable and cost-effective origin for content delivery networks.

Create an Amazon CloudFront distribution and set the Amazon S3 bucket as the origin.

Recipe images are cached at edge locations globally, closer to the users.

CloudFront reduces latency for end-users and offloads the read request traffic from the S3 origin.

Update the application configuration to reference the CloudFront distribution URLs instead of the EC2 local storage.

User requests for recipe images go directly to CloudFront, completely bypassing the ALB and EC2 instances.

This offloads the CPU and network bandwidth load from the compute tier, resolving the performance degradation.

Key Concept

Static content offloading and edge caching using Amazon S3 and Amazon CloudFront

PreviousPage 56 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept