Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 1121Question →

A logistics company's security operations team suspects that an Amazon EC2 instance in a private subnet is compromised and communicating with a malicious command-and-control server. The team must capture network flow details, including source and destination IP addresses, ports, and protocols, to confirm this activity and analyze the connection patterns. The logging solution must capture all traffic without altering the existing network architecture or impacting network performance. Which strategy should the solutions architect recommend to monitor this network traffic?

Show answer & explanation

Answer: Enable VPC Flow Logs on the subnet, publishing the logs to an Amazon S3 bucket, and use Amazon Athena to query and analyze the traffic details.

Answer

Enable VPC Flow Logs on the subnet, publishing the logs to an Amazon S3 bucket, and use Amazon Athena to query and analyze the traffic details.
Enabling VPC Flow Logs at the subnet level allows the security team to capture metadata about the IP traffic going to and from network interfaces in the subnet. Since VPC Flow Logs is an out-of-band feature, it has no impact on network latency or throughput. Storing these logs in Amazon S3 and querying them using Amazon Athena provides a highly scalable and cost-effective method to analyze the network flow data, locate the destination IP addresses, and verify whether the connections were accepted or rejected.

Step-by-Step Solution

1
Identify the requirement to monitor and analyze all traffic going to and from network interfaces in a VPC subnet without affecting latency or performance.
Determine that VPC Flow Logs is the native AWS feature designed to capture IP traffic metadata without impacting performance, as it operates out-of-band.
Allows the security team to collect metadata about network connections (source, destination, protocol, ports) without deploying agents or inline appliances.
2
Determine the appropriate log destination and analysis tool for querying the captured flow metadata.
Select Amazon S3 as the cost-effective storage target, and Amazon Athena to query the log files directly using standard SQL.
Aligns with AWS security and storage best practices, enabling ad-hoc forensic queries without the overhead of indexing or running a continuous search cluster.

Key Concept

VPC Flow Logs for network threat detection and monitoring
Estimated Time:2m 0s
Question 1122Question →

A company is designing a database architecture for a multi-tenant web application. The database tier has two distinct workloads:

First, a tenant metadata and configuration store which experiences predictable, steady read/write volume throughout the day, requiring high availability with a recovery point objective (RPO) of 00.

Second, an analytics database that ingests large batches of telemetry data from tenants during random, unpredictable 1515-minute windows, remaining completely idle for the rest of the day.

Which combination of database configurations will meet these requirements in the most cost-effective manner? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon RDS for PostgreSQL Multi-AZ DB instance deployment using gp3 storage volumes for the tenant metadata.; Configure an Amazon DynamoDB table in On-Demand capacity mode for the analytics telemetry store.

Answer

Configure an Amazon RDS for PostgreSQL Multi-AZ DB instance deployment using gp3 storage volumes for the tenant metadata, and configure an Amazon DynamoDB table in On-Demand capacity mode for the analytics telemetry store.
The correct architecture combines an Amazon RDS Multi-AZ DB instance deployment with gp3 storage for the tenant metadata, and an Amazon DynamoDB table in On-Demand capacity mode for the telemetry store. The RDS Multi-AZ deployment ensures high availability and zero recovery point objective (RPO) through synchronous replication. Utilizing gp3 volumes allows the company to optimize storage costs by configuring performance independent of storage size. DynamoDB On-Demand capacity mode is ideal for the telemetry store because it instantly handles unpredictable, short-duration spikes without throttling and incurs no charges when the database is idle.

Step-by-Step Solution

1
Analyze the tenant metadata store requirements.
The metadata store requires high availability, RPO of 00, and handles predictable, steady volume.
RDS Multi-AZ DB instance deployments utilize synchronous replication to a standby instance in another Availability Zone, ensuring an RPO of 00 and automatic failover. General Purpose gp3 storage is the most cost-effective storage option for predictable database workloads because it decoupling performance (IOPS and throughput) from capacity.
2
Analyze the analytics telemetry store requirements.
The analytics store requires handling sudden, unpredictable spikes during 1515-minute windows, remaining idle for most of the day.
Amazon DynamoDB in On-Demand capacity mode scales dynamically to meet write spikes instantly without throttling. Since charges are based strictly on actual read/write requests consumed, no costs are incurred during the long idle periods, making it highly cost-effective.
3
Evaluate the database replication and capacity planning distractors.
Identify incorrect configurations based on replication mechanics, capacity scaling speed, and savings plan applicability.
RDS Read Replicas are asynchronously replicated and cannot guarantee RPO of 00. DynamoDB Provisioned capacity mode cannot scale to 00 and Auto Scaling cannot scale up fast enough for a 1515-minute spike from a low baseline. Compute Savings Plans do not cover Amazon RDS instances.

Key Concept

Cost-Optimized Database Capacity Planning and Storage Selection
Question 1123Question →

A company hosts a latency-sensitive API on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The API processes user transactions on TCP port 8443. A separate monitoring agent on each instance listens on TCP port 9999 to report service health metrics. The ALB's target group is configured to perform health checks on port 9999. The subnet's stateless Network Access Control List (NACL) allows inbound TCP traffic on port 8443 from all sources and allows all outbound traffic.

To meet security compliance, a security engineer modifies the subnet NACL's outbound rule to only allow outbound TCP traffic to port 8443. Immediately after this change, the ALB marks all instances in the target group as unhealthy. Furthermore, Route 53, which is configured with latency-based routing policies to distribute traffic between this Region and another active Region, continues to send client requests to the unhealthy ALB.

Which combination of actions will restore the target health status and ensure Route 53 diverts traffic away from this Region during a failure? (Select two.)

Select all that apply

Show answer & explanation

Answer: Modify the subnet Network ACLs to allow inbound TCP traffic on port 9999 and outbound TCP traffic to ephemeral ports (1024-65535).; Configure 'Evaluate Target Health' to Yes on the Route 53 alias records that point to the Application Load Balancer.

Answer

Modify the subnet Network ACLs to allow inbound TCP traffic on port 9999 and outbound TCP traffic to ephemeral ports (1024-65535), and configure 'Evaluate Target Health' to Yes on the Route 53 alias records that point to the Application Load Balancer.
The correct solution requires configuring the stateless subnet Network ACLs to allow the inbound health check traffic on port 9999 and the outbound return traffic to the load balancer's ephemeral ports (1024-65535). Additionally, enabling 'Evaluate Target Health' on the Route 53 alias records ensures that Route 53 monitors the health of the targets behind the Application Load Balancer and diverts traffic to the healthy Region if all targets are unhealthy.

Step-by-Step Solution

1
Analyze the health check failure caused by the outbound Network ACL rule modification.
The ALB health check queries port 9999. Since the subnet Network ACL is stateless, restricting outbound traffic to port 8443 prevents the EC2 instances from sending TCP responses back to the ALB's health check requests.
Stateless Network ACLs require explicit rules for both inbound request traffic and outbound return traffic.
2
Determine the necessary Network ACL rules to allow the health check traffic.
An inbound rule must allow TCP port 9999 traffic from the ALB, and an outbound rule must allow TCP traffic to ephemeral ports (1024-65535) back to the ALB.
The ALB initiates connections to port 9999 from its ephemeral ports, which requires the return traffic to be allowed outbound.
3
Determine why Route 53 continues routing traffic to the unhealthy Region.
Route 53 latency-based routing distributes traffic based on latency but does not automatically monitor endpoint health unless explicitly configured.
Route 53 alias records pointing to Application Load Balancers must have 'Evaluate Target Health' set to Yes to dynamically fail over when the backend targets are unhealthy.

Key Concept

Configuring health checks and routing for resilience with stateless Network ACLs and Route 53 latency-based routing.
Question 1124Question →

A company runs a high-availability customer portal on Amazon EC2 instances managed by an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The ALB target group is configured with ELB health checks targeting a deep health check endpoint (`/healthcheck`) that queries the backend Amazon RDS database. During a scheduled database maintenance window, the database becomes temporarily unresponsive. Consequently, all EC2 instances fail the target group health check. Since the ASG health check type is set to ELB, it begins terminating and recreating all instances in a continuous loop, causing prolonged downtime and high operational costs. Which architectural modification should a Solutions Architect implement to prevent this loop of instance terminations during database outages?

Show answer & explanation

Answer: Configure the ALB health check to query a shallow endpoint that only verifies the web server status, and handle database connectivity issues gracefully within the application code.

Answer

Configure the ALB health check to query a shallow endpoint that only verifies the web server status, and handle database connectivity issues gracefully within the application code.
The correct answer is to configure a shallow health check. A shallow health check only verifies that the web server or application process is running (e.g., via a simple static file or status page), rather than verifying deep dependencies like database connectivity. When the database becomes unavailable, the web server instances will still pass the shallow health check, preventing the Auto Scaling Group from terminating them. The application can then handle the database outage gracefully by displaying a maintenance page or returning a structured error code, while keeping the infrastructure stable.

Step-by-Step Solution

1
Identify the root cause of the instance termination loop.
The deep health check queries the database, causing the ALB to mark instances as unhealthy when the database is down, which prompts the ASG to terminate healthy web server instances.
Understanding the dependency between target group health checks and ASG instance lifecycle is critical to troubleshooting termination loops.
2
Modify the target group health check configuration to use a shallow endpoint.
The health check path is changed to target a static page or a lightweight endpoint (e.g., `/ping` or `/index.html`) that only verifies the web server process itself is running.
A shallow health check ensures the load balancer only monitors the health of the EC2 instance and the web server process, preventing database outages from triggering instance termination.
3
Implement application-level error handling for database connection failures.
The application handles database connection errors gracefully (e.g., by displaying a friendly error message or a read-only view) without failing the ALB health check.
Graceful degradation ensures the application remains online to serve static content or error messages rather than experiencing a complete infrastructure tear-down.

Key Concept

Shallow vs. Deep Health Checks in Elastic Load Balancing and Auto Scaling Groups
Question 1125Question →

A global e-commerce company is migrating its legacy database architecture to AWS. The company requires a database solution that can handle a product catalog database with read queries that must return in less than a millisecond. Additionally, transactional order records must be written with high throughput, and reporting queries must be offloaded to prevent performance degradation on the primary writer node.

Which combination of database configurations will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Amazon Aurora with Auto Scaling Read Replicas to handle transactional writes on the primary instance and route reporting queries to the reader endpoint.; Deploy Amazon ElastiCache for Redis to store and serve cached product catalog data with sub-millisecond latency.

Answer

The correct configurations are to deploy Amazon ElastiCache for Redis to cache catalog reads and configure Amazon Aurora with Auto Scaling Read Replicas to offload reporting queries.
Configuring Amazon Aurora with Auto Scaling Read Replicas allows the application to scale read capacity dynamically and direct reporting queries to the reader endpoint, preventing performance impact on the primary writer. Deploying Amazon ElastiCache for Redis in front of the database provides sub-millisecond response times for cached product catalog queries, meeting the extreme low-latency read requirements.

Step-by-Step Solution

1
Identify the latency requirement for product catalog reads.
The reads require sub-millisecond response times, which indicates an in-memory caching layer is needed.
Relational databases typically operate in the millisecond range; caching with in-memory stores like ElastiCache achieves microsecond/sub-millisecond latency.
2
Identify the transactional write and reporting query requirements.
High-throughput write performance is required, and reporting queries must not impact the primary database instance.
Amazon Aurora supports high-throughput writes and offers a reader endpoint to easily distribute reporting queries across auto-scaled read replicas.
3
Evaluate the architectural viability and performance limits of the options.
Standard RDS Multi-AZ standby instances cannot be read from, and monotonically increasing DynamoDB partition keys create write performance bottlenecks.
Understanding replica limitations and key design prevents architectural bottlenecks in high-performing systems.

Key Concept

Designing high-performing database architectures on AWS using caching, replication, and appropriate partition key design.
Question 1126Question →

A financial company hosts a reporting application on a fleet of Amazon EC2 instances managed by an Auto Scaling group (ASG). The instances run in private subnets and are registered with an Application Load Balancer (ALB). The application receives traffic on port 8000, but its health check endpoint is exposed on administrative port 8081. Currently, the ALB is marking all instances as unhealthy, and the ASG is continuously terminating and replacing them. Which two configurations are required to resolve this issue and allow the ALB to perform health checks successfully? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the health check port in the ALB target group settings to port 8081.; Add a rule to the EC2 instances' security group allowing inbound TCP traffic on port 8081 from the ALB's security group.

Answer

The target group health check settings must be updated to use port 8081, and the security group of the EC2 instances must be modified to allow inbound TCP traffic on port 8081 from the security group of the Application Load Balancer.
To resolve the issue, the solutions architect must configure the ALB target group's health check port to match the administrative port (8081) where the application is listening for health status checks. Additionally, the security group for the EC2 instances must allow inbound TCP traffic on port 8081 from the security group of the Application Load Balancer, ensuring the health check requests are permitted through the instance's firewall.

Step-by-Step Solution

1
Identify the ports involved in the scenario.
The application receives client traffic on port 8000, while the health check endpoint is on port 8081.
Since these are different, the default behavior of targeting the traffic port (8000) for health checks will fail.
2
Configure the target group to query the custom health check port.
Override the target group health check port setting by specifying port 8081.
This ensures the ALB sends health check requests to the administration port where the health endpoint is running.
3
Configure the host security controls to allow health check traffic.
Allow inbound traffic on port 8081 from the ALB security group in the EC2 instance security group.
Security groups act as a stateful firewall at the instance level and must explicitly permit the health check queries from the load balancer.

Key Concept

Configuring Application Load Balancer health checks on custom ports requires overriding the health check port in the target group and allowing the traffic through instance-level security groups.
Question 1127Question →

A smart home company is launching a system to process telemetry updates from connected thermostats. The updates include sequential temperature adjustments that must be processed in the exact order they are generated by each thermostat to ensure accurate reporting. The telemetry traffic is highly unpredictable, spiking during extreme weather events but remaining virtually idle during mild seasons. The company wants to minimize compute and database costs during idle periods. Which architecture is the most cost-effective and meets the requirements?

Show answer & explanation

Answer: Route the updates to an Amazon SQS FIFO queue, configure an AWS Lambda function using native event source mapping to process the updates from the queue, and write the data to an Amazon DynamoDB table in On-Demand capacity mode.

Answer

Route the updates to an Amazon SQS FIFO queue, configure an AWS Lambda function using native event source mapping to process the updates from the queue, and write the data to an Amazon DynamoDB table in On-Demand capacity mode.
The correct architecture uses Amazon SQS FIFO to guarantee that updates from each thermostat are processed in the exact sequence they are generated. AWS Lambda with native event source mapping ensures that compute resources are only consumed and billed when messages are in the queue, scaling to zero during idle periods. Amazon DynamoDB in On-Demand capacity mode handles unpredictable traffic spikes seamlessly and eliminates base capacity charges during inactive seasons, achieving optimal cost efficiency.

Step-by-Step Solution

1
Select the correct queue type to preserve telemetry sequence.
Amazon SQS FIFO queue is selected over standard SQS to ensure messages within the same thermostat message group are processed in first-in, first-out order.
Standard SQS does not guarantee ordering, which would violate the requirement to process sequential temperature adjustments in the order they are generated.
2
Select the appropriate compute scaling model to eliminate idle costs.
AWS Lambda triggered by native event source mapping is chosen.
Native event source mapping ensures Lambda is only invoked when messages arrive, scaling to zero during idle seasons and avoiding the costs of continuous polling or running idle instances.
3
Select the most cost-effective database capacity mode for spiky, idle workloads.
Amazon DynamoDB in On-Demand capacity mode is chosen.
On-Demand capacity mode accommodates sudden, unpredictable spikes instantly and charges nothing for storage read/write requests during periods of complete inactivity, unlike Provisioned capacity mode.

Key Concept

Serverless architectures optimize costs for unpredictable workloads by scaling compute (AWS Lambda) and database (Amazon DynamoDB On-Demand) to zero during idle periods, while Amazon SQS FIFO preserves ordering.
Question 1128Question →

A retail company wants to implement automated security monitoring and compliance tracking for its AWS infrastructure. The security team requires that all Amazon S3 buckets must have server-side encryption enabled, and Amazon EC2 security groups must not allow inbound SSH traffic from the public internet (0.0.0.0/0). Any non-compliant resources must be detected automatically, and the team must receive real-time alerts.

Which TWO solutions should a solutions architect implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Enable AWS Config and deploy the managed rules for S3 bucket encryption and restricted SSH ports.; Configure an Amazon EventBridge rule triggered by AWS Config compliance state changes to send alerts via Amazon Simple Notification Service (Amazon SNS).

Answer

Enable AWS Config with managed rules for S3 encryption and restricted SSH ports, and configure an Amazon EventBridge rule to route compliance change events to Amazon SNS.
The correct options involve enabling AWS Config to deploy managed rules for evaluating S3 encryption and restricted security group ports, alongside configuring Amazon EventBridge to route compliance change alerts via Amazon SNS. This aligns with AWS security monitoring best practices for automated compliance auditing and near real-time notification.

Step-by-Step Solution

1
Enable configuration recording in AWS Config for the required resources.
AWS Config begins tracking configuration history and changes for Amazon S3 and EC2 security groups.
This establishes the data source for compliance monitoring.
2
Deploy AWS Config managed rules for S3 bucket encryption verification and restricted SSH port checks.
AWS Config automatically evaluates resources against these rules and marks non-compliant resources.
Managed rules automate compliance auditing without writing custom logic.
3
Create an Amazon EventBridge rule that filters for AWS Config compliance change events.
Events are captured whenever a resource transitions from compliant to non-compliant status.
This triggers the notification workflow when compliance status changes.
4
Configure the EventBridge rule target to publish messages to an Amazon SNS topic.
Alerts are sent to subscribers of the SNS topic immediately upon compliance status changes.
This meets the real-time alerting requirement.

Key Concept

Continuous compliance monitoring and automated alerting using AWS Config, Amazon EventBridge, and Amazon SNS.
Question 1129Question →

An online banking platform uses an Application Load Balancer (ALB) in the eu-west-1 Region to route portal traffic to backend EC2 instances. To meet disaster recovery compliance, the organization has deployed a warm standby replica of their application stack in the ap-southeast-2 Region, which includes a standby ALB and a cross-region Amazon RDS Read Replica. The organization wants to configure Amazon Route 53 to support automated active-passive routing for their zone apex domain (bank.com). If the primary region's ALB becomes unhealthy, traffic must fail over to the standby region, where the database replica will be promoted manually. Which Route 53 routing configuration should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Create a primary Failover Alias record for bank.com pointing to the eu-west-1 ALB, and a secondary Failover Alias record pointing to the ap-southeast-2 ALB. Set Evaluate Target Health to Yes on both records.

Answer

Create a primary Failover Alias record for bank.com pointing to the eu-west-1 ALB, and a secondary Failover Alias record pointing to the ap-southeast-2 ALB. Set Evaluate Target Health to Yes on both records.
The correct configuration uses Route 53 Failover routing with Alias records pointing to the Application Load Balancers. Alias records are required because the destination is the zone apex domain (bank.com), which cannot have CNAME records. Setting 'Evaluate Target Health' to Yes allows Route 53 to inherit the health status of the ALB targets directly, enabling automated DNS failover without requiring separate custom health checks.

Step-by-Step Solution

1
Select the correct record type and routing policy for active-passive failover at the zone apex.
Identify that a Failover routing policy is required for active-passive routing, and Alias records must be used instead of CNAME records because the target is the zone apex (bank.com).
DNS RFCs do not allow CNAME records at the zone apex, but Route 53 Alias records can map the zone apex directly to AWS resources like ALBs.
2
Configure health checking to monitor the primary and secondary endpoints.
Set Evaluate Target Health to Yes on both the primary and secondary Alias records.
Setting Evaluate Target Health to Yes tells Route 53 to evaluate the health of the ALB using its target group health checks, eliminating the need to configure custom Route 53 health checks.
3
Verify database promotion requirements.
Ensure that the RDS Read Replica promotion remains a separate operational step, as Route 53 is a DNS service and cannot promote databases.
Route 53 only handles DNS routing; database failover/promotion must be handled at the database or application layer.

Key Concept

Route 53 Failover Routing with Alias Records
Question 1130Question →

A healthcare clinic hosts a patient scheduling application on a fleet of Amazon EC2 instances. The instances are registered with a target group for an Application Load Balancer (ALB) and managed by an Auto Scaling group. The clinic's IT team reports that the ALB target group shows all EC2 instances as unhealthy, preventing patients from accessing the portal. However, verification confirms that the web service is running normally on the instances themselves. What is the most likely cause of this behavior?

Show answer & explanation

Answer: The security group for the EC2 instances does not allow inbound traffic from the security group of the Application Load Balancer.

Answer

The security group for the EC2 instances does not allow inbound traffic from the security group of the Application Load Balancer.
For an Application Load Balancer to successfully perform health checks, the security group assigned to the registered EC2 instances must explicitly permit inbound traffic from the Application Load Balancer's security group on the application's port. Since security groups are stateful, return traffic is automatically allowed.

Step-by-Step Solution

1
Identify where the failure is occurring.
The target group health checks are failing, meaning the Application Load Balancer cannot reach the instances on the health check port.
Since the application runs fine locally, the problem lies in network connectivity or permissions between the ALB and the EC2 instances.
2
Evaluate security configurations governing internal traffic between the ALB and EC2 instances.
Confirm that the security group of the EC2 instances must allow inbound traffic from the ALB's security group on the application port.
By default, security groups block all inbound traffic unless explicitly permitted. If the EC2 instances do not allow inbound traffic from the ALB, health checks will fail.

Key Concept

Elastic Load Balancing health checks and Security Group rules
Estimated Time:1m 0s
Question 1131Question →

A collaborative document editing platform hosts its application on AWS. Users access static UI assets (such as CSS, JavaScript, and images) and retrieve real-time document metadata stored in an Amazon DynamoDB table. Users in distant geographic regions report high latency when loading the application and retrieving metadata. The DynamoDB database is also experiencing read performance bottlenecks due to repetitive queries for the same metadata. Which combination of configurations should the solutions architect implement to reduce latency for both static assets and database queries? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Amazon CloudFront with an Amazon S3 origin to cache and deliver the static UI assets closer to the users.; Deploy Amazon DynamoDB Accelerator (DAX) to cache database read operations for the document metadata.

Answer

Configure Amazon CloudFront with an Amazon S3 origin to cache and deliver the static UI assets closer to the users, and deploy Amazon DynamoDB Accelerator (DAX) to cache database read operations for the document metadata.
The correct combination uses Amazon CloudFront to cache static UI assets (such as CSS, JavaScript, and images) at Edge Locations closer to the users, and uses Amazon DynamoDB Accelerator (DAX) to provide an in-memory cache directly in front of the DynamoDB table, reducing read latency for repetitive document metadata queries to microseconds.

Step-by-Step Solution

1
Analyze the workload requirements for static assets and database queries.
Identified that static UI assets require edge caching to reduce geographic latency, and DynamoDB reads require inline query caching to prevent database bottlenecks.
Dividing the problem into content delivery (static) and database acceleration (dynamic) ensures both layers are optimized.
2
Select the appropriate caching solution for static assets.
Chose Amazon CloudFront paired with Amazon S3 as the origin to cache CSS, JavaScript, and images at edge locations.
CloudFront reduces latency by caching static assets close to users, offloading traffic from origin servers.
3
Select the appropriate caching solution for DynamoDB.
Chose Amazon DynamoDB Accelerator (DAX) to cache document metadata reads.
DAX is API-compatible and provides microsecond read latency directly in front of DynamoDB tables, reducing database CPU load and query response times.

Key Concept

Multi-tier caching using Amazon CloudFront for edge content delivery and Amazon DynamoDB Accelerator (DAX) for in-memory database query acceleration.
Estimated Time:2m 0s
Question 1132Question →

A smart home security provider uploads motion sensor activity logs to an Amazon S3 Standard bucket. The logs have an average file size of 320 KB320\text{ KB}. These logs are accessed frequently during the first 12 days12\text{ days} after upload. From day 1212 through day 4242, they are accessed occasionally but must remain available for immediate retrieval in the event of a security alert. After 42 days42\text{ days}, the logs are rarely accessed, but they must be retained for 5 years5\text{ years} for compliance and can tolerate a retrieval time of up to 12 hours12\text{ hours}. Which lifecycle configuration is the most cost-effective while meeting all access and retention requirements?

Show answer & explanation

Answer: Transition the objects to S3 Standard-IA after 12 days12\text{ days}, and then transition them to Amazon S3 Glacier Deep Archive after 42 days42\text{ days}.

Answer

Transitioning the objects to S3 Standard-IA after 12 days12\text{ days}, and then transitioning them to Amazon S3 Glacier Deep Archive after 42 days42\text{ days} is the most cost-effective solution.
Transitioning the objects to S3 Standard-IA after 12 days12\text{ days} and then to Amazon S3 Glacier Deep Archive after 42 days42\text{ days} is the most cost-effective path. This ensures that the objects spend exactly 30 days30\text{ days} in S3 Standard-IA, which matches the minimum storage duration requirement and avoids early transition penalties. Once in Glacier Deep Archive, they are stored at the lowest possible cost while conforming to the 12-hour12\text{-hour} retrieval SLA.

Step-by-Step Solution

1
Analyze the active and intermediate access windows.
Objects need S3 Standard for the first 12 days12\text{ days}. From day 1212 to 4242 (30 days30\text{ days}), they require occasionally accessed but immediate storage.
This determines when the transition to S3 Standard-IA should occur and how long they must remain there to satisfy retrieval requirements.
2
Check the S3 Standard-IA minimum storage duration constraint.
S3 Standard-IA has a minimum storage duration of 30 days30\text{ days}. Keeping objects in S3 Standard-IA from day 1212 to day 4242 (42−12=30 days42 - 12 = 30\text{ days}) meets this requirement exactly.
Transitioning objects out of S3 Standard-IA before 30 days30\text{ days} incurs an early transition charge, making the configuration less cost-effective.
3
Verify compliance and archival requirements for the final phase.
Transition to Amazon S3 Glacier Deep Archive after 42 days42\text{ days} is cost-optimized and supports the 12-hour12\text{-hour} retrieval SLA.
Amazon S3 Glacier Deep Archive is the lowest-cost storage class, and its 12-hour12\text{-hour} standard retrieval matches the compliance constraint.

Key Concept

Amazon S3 Lifecycle Policy Optimization
Estimated Time:1m 30s
Question 1133Question →

A logistics company provides a web-based dashboard where customers query real-time package statuses and download static PDF delivery receipts. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB), with package data stored in Amazon DynamoDB. During peak shopping events, the system experiences performance degradation. Which strategy should a Solutions Architect implement to achieve the lowest latency for both types of requests while optimizing backend resource utilization?

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache the static PDF receipts, and configure an Amazon DynamoDB Accelerator (DAX) cluster to cache package status queries.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache the static PDF receipts, and configure an Amazon DynamoDB Accelerator (DAX) cluster to cache package status queries.
Deploying Amazon CloudFront in front of the Application Load Balancer ensures that static PDF receipts are cached at edge locations, preventing these requests from reaching the EC2 instances. Using Amazon DynamoDB Accelerator (DAX) provides an in-memory cache for the database, reducing read response times to microseconds and preventing read operations from consuming DynamoDB read capacity units.

Step-by-Step Solution

1
Analyze the request types and identify caching opportunities.
Identified static PDF receipts as candidates for edge caching, and dynamic package status queries as candidates for database caching.
Static assets do not change frequently and are best cached at the edge, while database read queries can be cached in-memory to reduce latency and origin load.
2
Select the appropriate caching service for static content.
Configure Amazon CloudFront with the Application Load Balancer as the origin.
CloudFront delivers static files with low latency from edge locations, offloading the EC2 web servers.
3
Select the appropriate caching service for DynamoDB reads.
Enable Amazon DynamoDB Accelerator (DAX) in front of the DynamoDB table.
DAX is a fully managed, highly available, in-memory cache for DynamoDB that delivers microsecond response times for read-heavy workloads.

Key Concept

Multi-tier caching using Amazon CloudFront for static assets and Amazon DynamoDB Accelerator (DAX) for database query acceleration.
Question 1134Question →

A company stores compliance reports in an Amazon S3 bucket. The reports must be encrypted at rest using an AWS KMS Customer Managed Key (CMK). The company's security policy requires that the encryption key be rotated every year. In addition, historical reports encrypted with older versions of the key must remain readable without requiring manual re-encryption of the S3 objects, and the key management actions must be restricted to a specific security team. Which combination of actions will meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable automatic key rotation for the Customer Managed Key (CMK) in AWS KMS.; Configure the key policy of the Customer Managed Key (CMK) to grant administrative permissions to the security team's IAM role and cryptographic permissions to the application's IAM role.

Answer

Enabling automatic key rotation for the Customer Managed Key (CMK) and configuring the key policy to grant administrative permissions to the security team while restricting cryptographic permissions to the application role.
Enabling automatic key rotation handles annual key rotation seamlessly because AWS KMS keeps previous backing key materials active to decrypt historical objects. Additionally, separating key administrative actions and cryptographic actions via key policies enforces separation of duties and least privilege.

Step-by-Step Solution

1
Evaluate key rotation mechanics.
Determine that automatic key rotation in AWS KMS generates new backing key material annually while retaining previous versions. This enables transparent decryption of historical S3 objects without manual re-encryption.
Meets the business requirement for annual key rotation while ensuring older data remains readable without manual intervention.
2
Enforce least privilege access control on the Customer Managed Key.
Configure a KMS key policy separating administrative privileges (given to the security team's role) from cryptographic privileges (given to the application's role).
Fulfills the security restriction that key management actions must be restricted to a specific security team.

Key Concept

AWS KMS key rotation behaviors and key policy design rules.
Question 1135Question →

A global financial firm is designing a security monitoring architecture for its multi-account AWS environment managed via AWS Organizations. The firm needs to detect network anomalies, malicious activity, and unauthorized API calls across all accounts, and aggregate these findings into a single dashboard in a dedicated security account. Additionally, they must ensure that any unauthorized modifications of network security configurations, such as security groups and network ACLs, are automatically detected and flagged for compliance auditing. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty across all accounts, designate the dedicated security account as the GuardDuty delegated administrator, and integrate GuardDuty findings with AWS Security Hub in the security account.; Create AWS Config organizational rules to continuously monitor configuration changes of security groups and network ACLs, and aggregate compliance results in the dedicated security account.

Answer

Enable Amazon GuardDuty across all accounts, designating the security account as the delegated administrator and integrating with AWS Security Hub, while using AWS Config organizational rules to monitor security group and network ACL configurations.
Centralizing threat detection and compliance tracking in a multi-account organization involves using Amazon GuardDuty integrated with AWS Security Hub to monitor activities and logs, combined with AWS Config organizational rules to track changes to resources like security groups and network ACLs.

Step-by-Step Solution

1
Set up centralized threat monitoring using Amazon GuardDuty.
GuardDuty is enabled on all accounts, and the dedicated security account is designated as the delegated administrator, consolidating all security findings in Security Hub.
This establishes real-time network anomaly and malicious API activity detection using VPC Flow Logs, DNS logs, and CloudTrail events without agent deployment.
2
Deploy configuration compliance monitoring using AWS Config.
AWS Config organizational rules are deployed across the organization to monitor resources like Security Groups and Network ACLs.
This automatically tracks any configuration changes to network security resources and flags non-compliance, notifying the security account.

Key Concept

Centralized threat detection and resource configuration compliance auditing in multi-account environments.
Estimated Time:2m 0s
Question 1136Question →

A company is migrating a legacy HR application to Amazon EC2 instances. The application requires access to a database password that must be rotated every 60 days to comply with internal security policies. The database is hosted on Amazon RDS. The security team mandates that the password must be encrypted at rest using a customer managed key, and that the rotation process must be automated with minimal operational effort.

Which solution should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and encrypt it using an AWS Key Management Service (AWS KMS) customer managed key. Configure Secrets Manager to automatically rotate the password every 60 days using a configured AWS Lambda function.

Answer

Store the database password in AWS Secrets Manager, encrypt it using an AWS KMS customer managed key, and configure automatic rotation every 60 days using an AWS Lambda function.
AWS Secrets Manager is designed for storing secrets such as database credentials and supports automated rotation through AWS Lambda. It allows encryption using customer managed AWS KMS keys, which satisfies all the compliance and operational requirements with minimal overhead.

Step-by-Step Solution

1
Select AWS Secrets Manager as the credential storage solution.
AWS Secrets Manager supports native integration with AWS Lambda to automatically rotate database credentials without requiring application downtime.
Systems Manager Parameter Store does not support out-of-the-box automated rotation of parameter values.
2
Configure AWS KMS customer managed key encryption.
Secrets Manager encrypts the secret value at rest using the specified customer managed key, satisfying the security team's encryption mandate.
This provides control over key policies and rotation of the key material independent of the secret itself.
3
Associate an AWS Lambda function for rotation and set the rotation schedule to 60 days.
The Lambda function updates the database credentials in RDS and the secret value in Secrets Manager automatically.
This removes the need to write and manage custom rotation cron scripts on the EC2 instances, achieving the least operational overhead.

Key Concept

AWS Secrets Manager supports automatic secrets rotation using AWS Lambda, whereas KMS key rotation only rotates encryption key material and not the stored secret values.
Estimated Time:1m 30s
Question 1137Question →

A company is designing a cost-optimization strategy for its inventory management system on AWS. The workload consists of a containerized application layer running on Amazon ECS with AWS Fargate that requires a continuous, steady-state baseline of compute capacity, and a database tier running on Amazon RDS for PostgreSQL that also requires steady-state baseline compute and storage capacity. The company wants to maximize cost discounts for both tiers while maintaining the existing architecture and minimizing operational overhead. Which combination of purchasing strategies should a solutions architect recommend to meet these requirements most cost-effectively?

Show answer & explanation

Answer: Purchase a Compute Savings Plan to cover the AWS Fargate baseline compute capacity, and purchase Amazon RDS Reserved Instances for the database tier.

Answer

Purchase a Compute Savings Plan to cover the AWS Fargate baseline compute capacity, and purchase Amazon RDS Reserved Instances for the database tier.
The correct option is to purchase a Compute Savings Plan to cover the AWS Fargate baseline compute capacity and purchase Amazon RDS Reserved Instances for the database tier. Compute Savings Plans automatically apply to Fargate compute usage, offering significant savings for steady-state workloads. Since Compute Savings Plans do not extend to database services like Amazon RDS, purchasing RDS Reserved Instances is the correct and most cost-effective method to cover the steady-state database tier.

Step-by-Step Solution

1
Analyze the containerized application tier requirements.
The application tier runs on Amazon ECS with AWS Fargate and requires continuous, steady-state baseline compute capacity.
Identifying the compute service and workload pattern helps determine the best purchasing model.
2
Determine the optimal purchasing strategy for the Fargate tier.
A Compute Savings Plan is selected.
Compute Savings Plans apply discounts to Amazon EC2, AWS Fargate, and AWS Lambda usage, making it ideal for the steady-state Fargate baseline.
3
Analyze the database tier requirements.
The database tier runs on Amazon RDS for PostgreSQL and also requires steady-state baseline capacity.
Understanding the database hosting model and usage pattern helps select the correct discount mechanism.
4
Determine the optimal purchasing strategy for the database tier.
Amazon RDS Reserved Instances are selected.
Compute Savings Plans do not cover Amazon RDS. Amazon RDS Reserved Instances must be purchased separately to obtain discounts on the steady-state database instances.

Key Concept

Selecting and combining AWS compute purchasing models (Compute Savings Plans and RDS Reserved Instances) based on service scope and workload steadiness.
Question 1138Question →

A retail company operates a multi-tier web application on AWS. The application tier runs on Amazon EC2 instances in a private VPC subnet. A security audit requires the company to monitor network traffic for suspicious activities, such as communication with known malicious command-and-control (C2) servers. If a threat is detected, the company must automatically block all traffic to and from the malicious IP address at the subnet level in near real-time. Which TWO options should a solutions architect combine to meet these requirements with the least operational overhead?

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs and generate findings for malicious network activity.; Configure an Amazon EventBridge rule to match GuardDuty findings, triggering an AWS Lambda function that dynamically adds a stateless deny rule to the Network ACL associated with the subnet.

Answer

The solutions architect should enable Amazon GuardDuty to analyze VPC Flow Logs and generate findings, and configure an Amazon EventBridge rule to match those findings to trigger an AWS Lambda function that dynamically adds a stateless deny rule to the Network ACL associated with the subnet.
To monitor network traffic for threats such as communication with known malicious command-and-control (C2) servers, Amazon GuardDuty is the ideal service. GuardDuty continuously analyzes VPC Flow Logs, DNS logs, and CloudTrail events without impacting network performance or requiring manual logging infrastructure. To automatically block the malicious IP at the subnet level in near real-time, GuardDuty findings can be sent to Amazon EventBridge. An EventBridge rule detects the threat event and triggers an AWS Lambda function. This Lambda function can programmatically add a stateless deny rule to the Network ACL associated with the subnet, which successfully blocks traffic at the subnet boundary as required.

Step-by-Step Solution

1
Identify the monitoring service that can detect command-and-control (C2) network communications with the least operational overhead.
Amazon GuardDuty is selected because it continuously and automatically analyzes VPC Flow Logs, DNS logs, and CloudTrail events without requiring log storage configuration or performance impact.
Using native threat intelligence is highly efficient and aligns with the requirement for minimal operational overhead.
2
Choose the network security control to block traffic at the subnet level.
Network Access Control Lists (Network ACLs) are identified as the appropriate control.
Security Groups are applied at the instance level (network interface level) and are stateful, whereas Network ACLs operate at the subnet boundary and support both allow and deny rules.
3
Establish the near real-time automated remediation pipeline.
An Amazon EventBridge rule is configured to detect GuardDuty findings and trigger an AWS Lambda function.
EventBridge provides an event-driven mechanism to respond to GuardDuty findings in near real-time.
4
Implement the programmatic update to the network boundaries.
The AWS Lambda function invokes the Amazon EC2 API to insert a stateless deny rule into the subnet's Network ACL.
This dynamically blocks all traffic to and from the malicious IP address at the subnet level as soon as the threat is identified.

Key Concept

Automated threat detection and network boundary remediation using Amazon GuardDuty, Amazon EventBridge, AWS Lambda, and Network ACLs.
Question 1139Question →

A gaming company needs to audit and record all API activity across its AWS account to determine who made specific configuration changes, such as modifying IAM policies or deleting resources. Which AWS service should the solutions architect recommend to continuously monitor and record these API actions?

Show answer & explanation

Answer: AWS CloudTrail

Answer

AWS CloudTrail
AWS CloudTrail records AWS API calls and management events for your AWS account. It logs details about the caller identity, the time of the action, the specific API requested, and the response. This directly enables tracking of actions like resource deletion and IAM policy changes.

Step-by-Step Solution

1
Identify the primary requirement from the scenario, which is to audit and record administrative API actions and resource changes in an AWS account.
The requirement is for API-level auditing and tracking of identity and actions.
This helps narrow down the services that record management events.
2
Evaluate AWS CloudTrail against this requirement.
AWS CloudTrail log files contain metadata about the API call, including the identity of the API caller, the time, the source IP address, and the request parameters.
CloudTrail is the native AWS service built specifically for auditing account activity.
3
Verify that alternative services like Amazon VPC Flow Logs, AWS Shield, and AWS Budgets do not meet this administrative API tracking requirement.
These alternative services serve different network, security, and cost management functions.
Eliminating distractors ensures the chosen solution is correct and aligned with best practices.

Key Concept

AWS CloudTrail is the primary service for monitoring, auditing, and recording API activity and actions taken across AWS infrastructure.

Alternative Method

Instead of checking CloudTrail logs manually in S3, you can query CloudTrail Event History directly in the console for the last 90 days of management events.
Estimated Time:45s
Question 1140Question →

A company runs a web application on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer (ALB). The application listens on TCP port 8080. After a new deployment, the ALB marks all instances as unhealthy, causing the Auto Scaling group to repeatedly terminate and launch new instances. Which two actions should a solutions architect take to resolve this issue? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the health check port in the Application Load Balancer (ALB) target group to use port 8080 or the traffic port.; Update the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB.

Answer

Configure the health check port in the Application Load Balancer target group to use port 8080 or the traffic port, and update the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB.
The correct options are configuring the ALB target group health check port to 8080 and updating the EC2 security group to allow inbound traffic on port 8080 from the ALB. This aligns the load balancer's health check queries with the actual port the application listens on and allows the security group to permit that traffic.

Step-by-Step Solution

1
Identify the application port configuration.
The web application is configured to run on TCP port 8080.
Health checks must target the port where the application is listening.
2
Align target group health check settings.
Configure the ALB target group health check to query port 8080.
Using the default port 80 results in health check failures because nothing is listening on port 80.
3
Configure Security Groups for health check and user traffic.
Allow inbound TCP traffic on port 8080 in the EC2 instance security group, sourcing from the ALB security group.
The ALB must have network access to query the application port (8080) on the target instances.

Key Concept

Auto Scaling and Application Load Balancer Target Group health checks require aligning the target group health check port and security group permissions with the application port.
PreviousPage 57 / 74Next
All practice questions — AWS Certified Solutions Architect - Associate | Examkin