Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 1141Question →

A company's security team needs to monitor network traffic entering and leaving their Amazon VPC. They want to identify potential security threats, detect anomalous traffic, and capture details about the IP traffic flowing through the network interfaces. Which two actions should the solutions architect recommend to implement this security monitoring? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable VPC Flow Logs on the target VPC to capture IP traffic details for network interfaces.; Publish the flow log data to an Amazon CloudWatch Logs log group to enable querying and analysis.

Answer

Enable VPC Flow Logs on the target VPC to capture IP traffic details for network interfaces, and publish the flow log data to an Amazon CloudWatch Logs log group to enable querying and analysis.
The correct combination of actions is to enable VPC Flow Logs on the target VPC to capture metadata about IP traffic, and to publish those logs to Amazon CloudWatch Logs (or Amazon S3) for querying and analysis. This aligned architectural approach captures network-level traffic data without agent overhead and allows direct querying to discover anomalous traffic.

Step-by-Step Solution

1
Identify the primary source of VPC network traffic metadata.
VPC Flow Logs captures packet metadata (source, destination, protocol, port, packets, bytes) at the network interface level.
This provides the underlying data needed to audit network flows and detect threats.
2
Determine where to store and analyze the captured network traffic flow data.
Publishing to Amazon CloudWatch Logs or Amazon S3 allows for query execution and integration with anomaly detection tools.
VPC Flow Logs must be exported to a destination like CloudWatch Logs or Amazon S3 to be queried and analyzed.

Key Concept

VPC Flow Logs capture network traffic metadata at the VPC, subnet, or elastic network interface level, and can be published to CloudWatch Logs or Amazon S3 for security monitoring.
Question 1142Question →

A company is designing a high-throughput financial transaction processing application on AWS. The application must process incoming transactions in the exact order they are received. Transactions are ingested via Amazon API Gateway and must be decoupled before being processed by a fleet of microservices running on Amazon Elastic Container Service (Amazon ECS). Additionally, an independent compliance microservice must receive a copy of every transaction for near real-time auditing and archiving, although the compliance service itself does not require strict ordering. Which combination of steps should a solutions architect take to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Publish incoming transactions from Amazon API Gateway to an Amazon SNS FIFO topic.; Create two Amazon SQS FIFO queues: one for the transaction processing backend and one for the compliance microservice. Subscribe both queues to the SNS FIFO topic.

Answer

Publish incoming transactions from Amazon API Gateway to an Amazon SNS FIFO topic, and create two Amazon SQS FIFO queues (one for the transaction processing backend and one for the compliance microservice) subscribed to the SNS FIFO topic.
To process transactions in strict order with a decoupled, fan-out architecture, the ingestion must use an Amazon SNS FIFO topic. Because Amazon SNS FIFO topics strictly limit subscriber endpoints to Amazon SQS FIFO queues, the compliance microservice must also use an SQS FIFO queue despite not requiring strict ordering itself. This design ensures end-to-end message ordering, deduplication, and successful fan-out delivery.

Step-by-Step Solution

1
Analyze the ordering requirements for the transaction processing backend.
Transactions must be processed in the exact order they are received, requiring end-to-end FIFO (First-In-First-Out) ordering.
This establishes that both the ingestion/fan-out layer (SNS) and the queueing layer (SQS) for the transaction backend must support FIFO semantics.
2
Determine the decoupling and fan-out mechanism.
An Amazon SNS FIFO topic is required to publish and fan out the messages while preserving strict ordering.
Standard SNS topics do not guarantee message ordering, which would break the transactional ordering requirement before messages reach the queues.
3
Evaluate the subscription constraints for Amazon SNS FIFO topics.
SNS FIFO topics only support Amazon SQS FIFO queues as subscriber endpoints.
Because of this native AWS restriction, any microservice subscribing to the SNS FIFO topic—including the compliance service—must use an SQS FIFO queue, regardless of whether that specific service needs ordering.

Key Concept

End-to-end FIFO ordering in event-driven systems using Amazon SNS FIFO and Amazon SQS FIFO integration rules.
Estimated Time:3m 0s
Question 1143Question →

A logistics company is deploying a tracking system on AWS that ingests status updates from packages. The ingestion rate is expected to reach 10,00010,000 write operations per second. The solutions architect designs an Amazon DynamoDB table with `status_date` (formatted as YYYY-MM-DD) as the partition key. During performance testing, the application experiences write throttling errors, even though the total allocated write throughput is far below the table's limit. Which modification should the solutions architect make to resolve this write bottleneck and optimize performance?

Show answer & explanation

Answer: Change the partition key of the table to a high-cardinality attribute, such as `package_id`, to distribute write requests evenly across partitions.

Answer

Change the partition key of the table to a high-cardinality attribute, such as `package_id`, to distribute write requests evenly across partitions.
The correct answer is to change the partition key to a high-cardinality attribute like `package_id`. Amazon DynamoDB distributes data and workload traffic across physical partitions based on the partition key value. A single partition has a hard limit of 1,0001,000 Write Capacity Units (WCUs) per second. Using `status_date` (which changes only once per day) results in all write requests targeting a single partition, creating a hot partition. Changing the partition key to `package_id` ensures that writes are evenly distributed across many partitions, allowing the table to support the full 10,00010,000 writes per second without partition-level throttling.

Step-by-Step Solution

1
Identify the cause of throttling in Amazon DynamoDB.
The current partition key `status_date` (YYYY-MM-DD) has very low cardinality, causing all 10,00010,000 write operations per second on a given day to target the same partition key value.
DynamoDB allocates capacity across partitions. A single partition can support a maximum of 1,0001,000 Write Capacity Units (WCUs).
2
Evaluate the proposed solutions against the partition limits.
Changing the partition key to `package_id` introduces high cardinality. Since each package has a unique ID, writes are spread across many partitions.
Distributing the writes across partitions prevents any single partition from exceeding the 1,0001,000 WCU limit.

Key Concept

DynamoDB partition key design and partition throughput limits
Estimated Time:1m 30s
Question 1144Question →

An insurance firm is designing a serverless system to process customer claims. The system receives claim applications that must be processed in the exact sequence they are submitted to prevent audit trail errors. The processing involves two steps: first, parsing and extracting metadata from the claim application (which takes less than 2 seconds); second, running a continuous claim verification model that analyzes historical database patterns over several hours. Which two AWS configurations will meet these requirements most cost-effectively? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Simple Queue Service (Amazon SQS) FIFO queue to receive the claim applications and preserve message ordering.; Use an Amazon Elastic Container Service (Amazon ECS) service on AWS Fargate to run the continuous claim verification model.

Answer

Configure an Amazon SQS FIFO queue to receive the claim applications and preserve message ordering, and use an Amazon ECS service on AWS Fargate to run the continuous claim verification model.
To process claim applications in the exact sequence they are submitted, the architecture must utilize an Amazon SQS FIFO queue, which guarantees first-in, first-out delivery. For the claim verification model, because the process runs continuously for several hours, deploying the application as a container task on Amazon ECS with AWS Fargate is the most cost-effective and viable choice. Fargate provides a serverless execution environment with no time limit, unlike AWS Lambda, which is restricted to 15 minutes.

Step-by-Step Solution

1
Analyze ordering requirements for message ingestion
The scenario requires claim applications to be processed in the exact sequence they are submitted. This dictates the use of a first-in, first-out (FIFO) queue.
Standard queues do not guarantee strict message ordering.
2
Select the appropriate queue type
Choose Amazon SQS FIFO queue over standard SQS or DynamoDB buffers.
An Amazon SQS FIFO queue natively supports messaging ordering, scales automatically, and incurs cost only when requests are made.
3
Analyze execution duration for the verification model
The claim verification model runs continuously for several hours.
AWS Lambda is limited to a 15-minute timeout and is cost-inefficient for continuous execution.
4
Select the compute platform for the long-running task
Choose Amazon ECS on AWS Fargate for containerized execution.
Fargate allows running containers for hours without managing underlying EC2 hosts, optimizing both operational overhead and cost for long-running processes.

Key Concept

Decoupling components using SQS FIFO queues for sequence preservation while pairing with containerized compute (Fargate) for long-running processes to optimize architectural cost and reliability.
Estimated Time:2m 0s
Question 1145Question →

A content management company is migrating its application to AWS. The application has two distinct workloads:

1. A transaction-heavy user management system that requires strict ACID compliance and relational integrity, with a read-to-write ratio of 10:110:1. The system must survive a database instance failure with minimal recovery time.
2. A high-volume event logging system that records user clicks. This log has highly unpredictable and spiky write patterns, but queries are simple key-value lookups.

Which configuration represents the most high-performing and scalable database solution?

Show answer & explanation

Answer: Deploy an Amazon Aurora Multi-AZ DB cluster for the user management system and use Aurora Read Replicas to offload read traffic. Store the event logging data in an Amazon DynamoDB table configured with On-Demand capacity mode and a partition key of event_uuid.

Answer

Deploy an Amazon Aurora Multi-AZ DB cluster for the user management system and use Aurora Read Replicas to offload read traffic. Store the event logging data in an Amazon DynamoDB table configured with On-Demand capacity mode and a partition key of event_uuid.
The correct configuration utilizes an Amazon Aurora Multi-AZ DB cluster to ensure high availability and relational performance, offloading read traffic to read replicas. For the event logging system, Amazon DynamoDB with a high-cardinality partition key (event_uuid) distributes write operations evenly across partitions. Configuring the table in On-Demand capacity mode accommodates highly unpredictable, spiky write workloads efficiently without throttling or unnecessary idle capacity costs.

Step-by-Step Solution

1
Analyze the requirements for the user management workload.
Identified the need for relational integrity, strict ACID compliance, a read-to-write ratio of 10:110:1, and rapid failover.
Determining the database engine and high-availability configuration.
2
Analyze the requirements for the event logging workload.
Identified the need for key-value lookups and high-volume, highly unpredictable, spiky write patterns.
Selecting the NoSQL database engine and scaling/partitioning strategy.
3
Compare database solutions and configurations for both workloads.
Amazon Aurora Multi-AZ with Read Replicas fits user management. Amazon DynamoDB with a high-cardinality partition key (event_uuid) and On-Demand capacity fits the logging workload.
Selecting the configuration that maximizes performance and availability while avoiding bottlenecks and over-provisioning.

Key Concept

High-performing database design involves selecting the correct database engine (relational vs. NoSQL) based on access patterns, configuring appropriate high availability (Multi-AZ vs. replicas), and designing proper partition keys and capacity modes in DynamoDB to handle write patterns.
Question 1146Question →

A solutions architect is troubleshooting a microservices application deployed on AWS. The application consists of a fleet of Amazon EC2 instances in an Auto Scaling group (ASG) residing in private subnets. The ASG is registered with a target group of an Application Load Balancer (ALB) located in public subnets. The application is configured to listen on TCP port 8443, and the target group is configured with a target port of 8443. The health check is set to use the `traffic-port` (TCP port 8443) with the path `/healthz`.

To secure the network traffic, the following configurations are applied:
1. The security group associated with the EC2 instances allows inbound TCP traffic on port 8443 from the security group of the ALB.
2. The custom Network ACL (NACL) for the private subnets allows inbound TCP traffic on port 8443 from the public subnet CIDR block.
3. The custom NACL for the private subnets allows outbound TCP traffic on port 8443 to the public subnet CIDR block.

The application is running correctly on the EC2 instances, and querying the `/healthz` endpoint locally on the instances returns a `200 OK` status. However, the ALB marks all instances in the target group as unhealthy, and the ASG is continuously terminating and replacing the instances.

Which of the following modifications is required to resolve this issue and allow the ALB to successfully perform health checks?

Show answer & explanation

Answer: Modify the private subnet outbound Network ACL (NACL) rule to allow outbound TCP traffic on ephemeral ports (1024-65535) to the public subnet CIDR block.

Answer

Modify the private subnet outbound Network ACL (NACL) rule to allow outbound TCP traffic on ephemeral ports (1024-65535) to the public subnet CIDR block.
The Application Load Balancer (ALB) initiates connection requests using ephemeral ports (1024-65535) to the target port (8443) on the EC2 instances. Because Network ACLs (NACLs) are stateless, return traffic must be explicitly allowed. Allowing outbound TCP traffic on ephemeral ports (1024-65535) to the public subnet CIDR block allows the EC2 instances to respond to the ALB's requests. Since the return traffic's destination port is the ALB's ephemeral port, this outbound rule enables the ALB to receive the health check response and mark the instances as healthy.

Step-by-Step Solution

1
Analyze the load balancing and routing path between the Application Load Balancer (ALB) in the public subnet and the EC2 instances in the private subnet.
The path involves stateless Network ACLs (NACLs) at the subnet boundaries and stateful Security Groups at the instance boundary.
Understanding the stateful versus stateless nature of these filters is key to identifying why traffic might be blocked in one direction.
2
Determine how connections are established by the ALB to the targets.
The ALB initiates a TCP connection from an ephemeral source port (1024-65535) to the destination target port (8443) on the EC2 instances.
This establishes the source and destination ports for both the request and the response packets.
3
Examine the stateless custom Network ACL (NACL) rules applied to the private subnets.
The inbound rule allows TCP traffic on destination port 8443, which lets the ALB's health check request reach the instances. However, the outbound rule only allows traffic with a destination port of 8443.
Because NACLs are stateless, return traffic is not tracked. The response packet from the EC2 instance is sent from source port 8443 back to the ALB's ephemeral destination port. Because the outbound NACL does not allow outbound traffic to ephemeral ports (1024-65535), the response is dropped.
4
Identify the required rule modification to permit the return traffic.
Add an outbound NACL rule for the private subnets allowing TCP traffic on destination ports 1024-65535 to the public subnet CIDR block.
This permits the return TCP packets to reach the ALB, completing the health check handshake.

Key Concept

Stateless Network ACLs require explicit outbound rules for return traffic using ephemeral client ports, unlike stateful security groups which track connection states automatically.
Estimated Time:3m 0s
Question 1147Question →

A company hosts a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The company wants to implement an active-passive disaster recovery (DR) strategy using a warm standby environment in the us-west-2 Region. The solution must automatically route user traffic to the secondary region with minimal downtime if the primary region's application becomes unavailable. Which two configuration steps must a solutions architect take to meet these requirements? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Configure a Route 53 failover alias record for the apex domain pointing to the primary Application Load Balancer, set the record type as Primary, and enable Evaluate Target Health.; Configure a Route 53 failover alias record for the apex domain pointing to the secondary Application Load Balancer, set the record type as Secondary, and enable Evaluate Target Health.

Answer

Configure primary and secondary Route 53 failover alias records pointing to the respective Application Load Balancers, ensuring Evaluate Target Health is enabled for both.
The correct options state that we must configure a Route 53 failover alias record pointing to the primary Application Load Balancer as 'Primary', and another failover alias record pointing to the secondary Application Load Balancer as 'Secondary', both with 'Evaluate Target Health' enabled. This setup creates a fully automated active-passive DNS failover configuration.

Step-by-Step Solution

1
Analyze the disaster recovery strategy requirements.
Identify that an active-passive failover configuration is needed for the apex domain pointing to Application Load Balancers in two different regions.
This determines that Route 53 failover routing policies are the correct mechanism to automatically redirect traffic.
2
Configure the primary Route 53 record.
Create a failover alias record pointing to the primary ALB in us-east-1, mark it as Primary, and enable Evaluate Target Health.
This allows Route 53 to monitor the health of the primary ALB using its target health metrics and determine when to fail over.
3
Configure the secondary Route 53 record.
Create a failover alias record pointing to the secondary ALB in us-west-2, mark it as Secondary, and enable Evaluate Target Health.
This provides a backup endpoint for Route 53 to route traffic to once the primary endpoint is determined to be unhealthy.

Key Concept

Route 53 Failover Routing Policy allows you to configure active-passive failover configurations. Using alias records with Evaluate Target Health enables automatic redirection without the need for manual DNS updates.
Question 1148Question →

A company hosts a containerized web application on Amazon EC2 instances within a private subnet. The instances are managed by an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The application listens on custom TCP port 80808080. The ALB's target group is configured to route traffic to port 80808080, but its health check is configured to use the default HTTP port 8080. As a result, all newly launched EC2 instances fail the ALB health check and are terminated by the ASG.

The security group assigned to the EC2 instances allows inbound TCP traffic on port 80808080 from the ALB security group, and allows all outbound traffic. The private subnet's Network ACL allows inbound traffic on port 80808080 and port 8080, but its outbound rule only allows traffic to destination ports 8080 and 443443 to allow for package updates.

Which two actions should a solutions architect take to resolve the health check failures and allow the instances to receive application traffic? (Select two.)

Select all that apply

Show answer & explanation

Answer: Modify the target group health check settings to perform health checks on port 80808080 instead of the default port.; Update the outbound Network ACL rules of the private subnet to allow traffic to ephemeral ports 1024−655351024-65535.

Answer

The correct actions are to modify the target group health check settings to perform health checks on port 80808080 instead of the default port, and to update the outbound Network ACL rules of the private subnet to allow traffic to ephemeral ports 1024−655351024-65535.
The correct actions resolve the two root issues preventing successful health checks. First, correcting the health check port ensures that the load balancer queries the active application service running on port 80808080 instead of the default port 8080. Second, opening the outbound Network ACL to ephemeral ports allows the stateless firewall to permit the return packets of the TCP connections initiated by the load balancer nodes.

Step-by-Step Solution

1
Analyze why the health check fails on port 8080.
The application only listens on port 80808080, so requests sent to port 8080 receive no response, marking the targets as unhealthy.
To identify the mismatch between where the application is listening and where the load balancer is sending health checks.
2
Analyze the stateless Network ACL behavior on return traffic.
Although inbound traffic on port 80808080 is allowed, return traffic from the EC2 instances back to the Application Load Balancer's ephemeral client ports is blocked by the restricted outbound Network ACL.
To understand why TCP handshakes fail even if the health check port is corrected.
3
Determine the necessary corrections to allow traffic flow.
Modify the health check settings to target port 80808080 and update the outbound Network ACL rules to allow TCP traffic to ephemeral ports 1024−655351024-65535.
To align the health check destination with the active application port and permit stateless return packets to reach the load balancer.

Key Concept

Ensuring health check port alignment and configuring stateless Network ACLs for ephemeral port return traffic in a load-balanced Auto Scaling architecture.
Question 1149Question →

A company is deploying a new web application using AWS App Runner. The application requires access to a database connection string containing sensitive credentials that must be automatically rotated every 30 days. The application also needs access to a database port configuration, which is non-sensitive and static. The company wants to implement a secure solution that minimizes cost and management overhead. Which configuration meets these requirements?

Show answer & explanation

Answer: Store the database connection string in AWS Secrets Manager and configure automatic rotation every 30 days using an AWS Lambda function. Store the database port as a String parameter in AWS Systems Manager Parameter Store.

Answer

Store the database connection string in AWS Secrets Manager with automatic rotation configured via an AWS Lambda function, and store the database port as a standard String parameter in AWS Systems Manager Parameter Store.
AWS Secrets Manager is designed for storing sensitive credentials and natively supports automatic rotation using AWS Lambda functions, which aligns with the security requirements. For non-sensitive configurations such as the database port, AWS Systems Manager Parameter Store standard String parameters are the most cost-effective choice since they are free of charge, thus minimizing overall cloud architecture costs.

Step-by-Step Solution

1
Identify the sensitivity and rotation requirements of the database connection string.
The connection string contains sensitive credentials and requires automatic rotation every 30 days.
This determines that AWS Secrets Manager is the appropriate service, as it natively supports scheduled credential rotation using AWS Lambda.
2
Identify the sensitivity and rotation requirements of the database port.
The port is static and non-sensitive.
This allows the port to be stored in AWS Systems Manager Parameter Store as a standard String parameter, which is free and avoids the cost of Secrets Manager.
3
Configure the web application on AWS App Runner to reference these configurations.
App Runner service is configured to retrieve the credentials from Secrets Manager and the port from Parameter Store.
This integration secures the secrets and configuration parameters during application startup without hardcoding values in the container.

Key Concept

Secrets and Parameter Management
Estimated Time:1m 30s
Question 1150Question →

A solutions architect is configuring an Application Load Balancer (ALB) and an Auto Scaling group to host a stateful web application. The application requires user session state to be maintained on the specific Amazon EC2 instance where the session was established. Which of the following configurations should the solutions architect implement to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Enable sticky sessions (session affinity) on the Application Load Balancer target group.; Configure the target group to use duration-based cookies or application-based cookies.

Answer

To maintain user session state on specific instances, enable sticky sessions (session affinity) on the Application Load Balancer target group and configure the target group to use duration-based or application-based cookies.
To maintain user session state on specific EC2 instances, the solutions architect must enable sticky sessions (session affinity) on the target group associated with the Application Load Balancer. Sticky sessions use cookies to bind a client session to a specific instance. Consequently, configuring the target group to use duration-based or application-based cookies is also required to manage the cookie lifecycle and affinity behavior.

Step-by-Step Solution

1
Analyze the application requirements.
The application is stateful and stores session data in instance memory, requiring client requests to be sent to the same EC2 instance.
Identify the need for session stickiness (affinity) at the load balancer level.
2
Select the appropriate load balancer configuration option.
Enabling sticky sessions on the target group forces the Application Load Balancer to route requests from the same user to the same target instance.
Provide the core routing capability to maintain session affinity.
3
Define the cookie mechanism for tracking session affinity.
Choose either duration-based cookies or application-based cookies under target group attributes.
Provide the client-side mechanism (cookies) that the load balancer uses to route the client back to the correct instance.

Key Concept

Session stickiness (session affinity) allows an Application Load Balancer to bind a user's session to a specific target instance by using cookies.
Estimated Time:1m 0s
Question 1151Question →

A financial brokerage platform processes a continuous, steady stream of stock market trade executions to update user portfolio balances. The system operates 24/7, handling a high and constant volume of transactions. The updates for each individual user portfolio must be processed in the exact sequence the trades occurred. The current architecture uses an AWS Lambda function triggered by an Amazon SQS standard queue to process the trade records. This configuration is experiencing high operational costs and occasional incorrect portfolio balances. Which solution will resolve these issues most cost-effectively?

Show answer & explanation

Answer: Deploy the processing application on an Amazon ECS service running on AWS Fargate, and replace the Amazon SQS standard queue with an Amazon SQS FIFO queue.

Answer

Deploy the processing application on an Amazon ECS service running on AWS Fargate, and replace the Amazon SQS standard queue with an Amazon SQS FIFO queue.
The correct solution optimizes both cost and correctness. Utilizing Amazon SQS FIFO queues guarantees that events for each unique portfolio are processed sequentially, resolving the incorrect balances. Since the ingestion pipeline runs continuously 24/7 at a high and constant volume, hosting the consumer code in a containerized environment using Amazon ECS on AWS Fargate is significantly more cost-efficient than AWS Lambda, which incurs high costs when running continuously.

Step-by-Step Solution

1
Analyze the workload characteristics and requirements.
Identify that the workload runs 24/7 continuously with a steady, high volume, and requires strict message ordering per user portfolio.
Understanding workload pattern (continuous vs. spiky) is key to selecting the most cost-efficient compute model, and ordering constraints dictate the messaging technology.
2
Evaluate the compute options for continuous 24/7 execution.
Determine that Amazon ECS on AWS Fargate is more cost-effective than AWS Lambda, which is optimized for short, intermittent, or event-driven tasks.
AWS Lambda charges per invocation and duration, which accumulates high costs under 100% utilization. A container running on ECS Fargate has a fixed baseline cost that is cheaper for continuous consumption.
3
Address the strict ordering requirement.
Select Amazon SQS FIFO queues instead of standard queues, using the portfolio ID as the MessageGroupId.
Standard SQS queues only provide best-effort ordering, whereas SQS FIFO guarantees first-in, first-out delivery and single-consumer processing per message group.

Key Concept

Selecting cost-effective compute (Lambda vs. ECS Fargate) based on workload execution continuity alongside queue ordering constraints.
Estimated Time:1m 30s
Question 1152Question →

A connected vehicle platform uses a fleet of Amazon EC2 instances to ingest real-time telemetry data. The ingestion application runs on a custom TCP port 9099 and requires sub-millisecond node-to-node latency for memory synchronization between instances. A Network Load Balancer (NLB) distributes the incoming TCP connections. Which combination of actions should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the EC2 instances in a cluster placement group.; Configure the Network Load Balancer target group health checks to use TCP port 9099.

Answer

Deploy the EC2 instances in a cluster placement group, and configure the Network Load Balancer target group health checks to use TCP port 9099.
Deploying instances in a cluster placement group meets the requirement for low-latency node-to-node communication by packing instances close together inside a single Availability Zone. Setting the load balancer health checks to TCP port 9099 ensures the health check queries the actual port where the ingestion agent is listening.

Step-by-Step Solution

1
Analyze placement group options for low-latency requirements.
Cluster placement groups provide sub-millisecond node-to-node latency, whereas spread and partition placement groups focus on high availability and fault isolation by spreading instances across hardware.
Tightly-coupled applications requiring high-performance MPI or memory synchronization need cluster placement groups.
2
Evaluate the target group health check configuration.
Identify that the telemetry ingestion application runs on port 9099, so health checks must target port 9099.
Using the default port 80 for health checks when the application listens on port 9099 will result in health check failures and service disruption.

Key Concept

Low-latency compute clustering and load balancer health check configuration.
Question 1153Question →

A company is hosting a specialized transaction processing application on a fleet of Amazon EC2 instances managed by an Auto Scaling group (ASG). The instances are registered with a target group for an Application Load Balancer (ALB). The application receives transaction requests on TCP port 9443, and the target group is configured to route traffic to port 9443 with the health check port set to 'traffic-port'. To verify application health, the load balancer needs to query an administrative status API endpoint that runs on port 8081 of the instances. Currently, the ALB is marking all instances as unhealthy, causing the ASG to continuously terminate and launch new instances. Which action should the solutions architect take to resolve this issue?

Show answer & explanation

Answer: Modify the target group configuration to explicitly set the health check port to 8081.

Answer

Modify the target group configuration to explicitly set the health check port to 8081.
The target group is configured to route user traffic to the application's transaction port (9443). However, because the application's health status API runs on a separate administration port (8081), the solutions architect must override the default health check port settings from 'traffic-port' to port 8081. This ensures that the Application Load Balancer (ALB) sends health probes to the correct port while maintaining transaction routing to port 9443.

Step-by-Step Solution

1
Analyze the ports used by the application and the health check configuration.
The application listens on port 9443 for transactions, while the health check status endpoint runs on port 8081.
Understanding the separation of transaction traffic and administrative health check endpoints is necessary to determine the correct port mapping.
2
Evaluate the behavior of the default 'traffic-port' setting in the ALB target group.
By default, 'traffic-port' tells the ALB to perform health checks on the same port it routes traffic to, which is port 9443. Since the status API is on port 8081, the health check fails.
This explains why the ALB is currently marking the instances as unhealthy.
3
Identify the correct configuration update required to separate routing port from health check port.
Specify port 8081 under the health check settings of the target group.
This allows the ALB to route production traffic to port 9443 while sending health checks to port 8081.

Key Concept

ELB target group health checks can be configured to use a custom port different from the traffic port.
Estimated Time:2m 0s
Question 1154Question →

A company hosts its containerized microservices application on Amazon ECS using the AWS Fargate launch type. The company's security team requires a solution to detect runtime threats, such as execution of unauthorized binaries, malware, and credential theft, at the container level. Additionally, they must continuously audit all AWS resources in the environment against CIS benchmarks to ensure compliance. Which combination of AWS services should a solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty and activate Amazon ECS Runtime Monitoring.; Enable AWS Security Hub and activate the CIS AWS Foundations Benchmark standard.

Answer

The correct architecture consists of enabling Amazon GuardDuty with ECS Runtime Monitoring to detect container-level threats, and enabling AWS Security Hub with the CIS AWS Foundations Benchmark standard to continuously audit configurations for compliance.
The correct solution uses GuardDuty ECS Runtime Monitoring, which analyzes system calls from the underlying host to identify indicators of compromise inside Fargate tasks. Combined with AWS Security Hub running CIS benchmark compliance checks, the organization meets both real-time threat detection and configuration governance requirements.

Step-by-Step Solution

1
Analyze the container runtime security requirement
Identify that Amazon GuardDuty ECS Runtime Monitoring is designed to monitor and detect threats inside ECS containers on AWS Fargate by monitoring system calls.
This directly satisfies the requirement to detect unauthorized binaries, malware, and credential theft at the container level.
2
Analyze the compliance auditing requirement
Identify that AWS Security Hub provides automated configuration checks against security standards and industry frameworks like the CIS AWS Foundations Benchmark.
This directly satisfies the requirement to continuously audit all resources against CIS benchmarks.
3
Evaluate the incorrect services and scopes
Determine that AWS WAF, AWS Shield Advanced, and Network ACLs are network-level or DDoS-focused solutions that do not have the visibility into container runtimes or resource configurations required to meet either objective.
Eliminating these options confirms that GuardDuty and Security Hub are the appropriate choices.

Key Concept

Centralized threat detection and automated configuration auditing are key components of a secure cloud architecture, achieved through GuardDuty Runtime Monitoring and Security Hub compliance checks.
Question 1155Question →

An online auction application hosts its platform on AWS. The application uses an Amazon S3 bucket to store high-resolution item images, which are active only during a 55-day auction window before they are archived or deleted. Bidders frequently query the auction catalog, resulting in high read latencies for both the item images and the bid history stored in an Amazon DynamoDB table. A solutions architect must design a caching and content delivery strategy to minimize read latency for both the static images and the database queries.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution with the Amazon S3 bucket configured as the origin to cache and serve the item images.; Deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache read queries for the bid history table.

Answer

Deploy an Amazon CloudFront distribution with the Amazon S3 bucket configured as the origin to cache and serve the item images, and deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache read queries for the bid history table.
Deploying Amazon CloudFront caching in front of S3 ensures static assets (images) are served from edge locations with low latency. Deploying DynamoDB Accelerator (DAX) provides microsecond-latency caching for DynamoDB queries without needing custom application cache code.

Step-by-Step Solution

1
Analyze the caching requirement for static content.
Identify that the item images stored in Amazon S3 are static assets that can be cached globally.
Deploying Amazon CloudFront reduces latency by caching static images at edge locations closer to bidders.
2
Analyze the caching requirement for database queries.
Identify that the bid history is stored in DynamoDB and undergoes frequent read queries.
Deploying Amazon DynamoDB Accelerator (DAX) provides an in-memory cache directly in front of DynamoDB, reducing read query latency to sub-milliseconds without application-side logic changes.
3
Evaluate and eliminate sub-optimal storage, partitioning, and caching configurations.
Discard options suggesting TTL values of 00, premature S3 Standard-IA tiering, and monotonic keys.
TTL of 00 bypasses CloudFront cache, S3 Standard-IA has a 3030-day minimum billing penalty, and monotonic keys cause DynamoDB hot partitions.

Key Concept

Multi-tier caching using Amazon CloudFront for static object storage and Amazon DynamoDB Accelerator (DAX) for database reads.
Estimated Time:2m 0s
Question 1156Question →

A retail company wants to implement a solution to continuously monitor its AWS accounts and workloads for threat patterns, such as Amazon EC2 instances communicating with known malicious IP addresses or unexpected IAM activity. Which AWS service should the company use to meet this requirement?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It uses threat intelligence feeds and machine learning to identify signatures such as cryptocurrency mining, communication with known command-and-control servers, and abnormal API patterns.

Step-by-Step Solution

1
Analyze the requirements for continuous threat detection across AWS accounts and workloads, specifically for malicious IP communication and unexpected account activity.
Identify that the solution requires a service capable of processing multiple log sources (VPC Flow Logs, DNS logs, and CloudTrail logs) and performing anomaly detection.
Understanding the security monitoring scope helps select the appropriate service.
2
Evaluate the capabilities of the available AWS security services against the requirements.
Determine that Amazon GuardDuty is designed for threat detection by analyzing these logs, while firewalls and DDoS protection services act as enforcement mechanisms rather than logging/detection engines.
This isolates the correct threat detection service from traffic filtering services.

Key Concept

Continuous threat detection and security monitoring across workloads and account activity using Amazon GuardDuty.
Estimated Time:45s
Question 1157Question →

A company wants to continuously monitor its AWS resource configurations to ensure they comply with security standards. The company also needs a centralized dashboard to aggregate security alerts and evaluate compliance against the CIS AWS Foundations Benchmark. Which TWO services should the solutions architect recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: AWS Config to track resource configuration changes and evaluate compliance against desired configurations; AWS Security Hub to aggregate security alerts from multiple AWS services and run automated compliance checks against industry standards

Answer

AWS Config and AWS Security Hub
AWS Config is the correct service for tracking, auditing, and evaluating configurations of AWS resources. AWS Security Hub is the correct service for aggregating security findings from multiple AWS services and evaluating compliance against security standards (such as the CIS AWS Foundations Benchmark). Together, they satisfy the requirement of continuous configuration compliance monitoring and centralized alert aggregation.

Step-by-Step Solution

1
Identify the requirement for tracking and auditing AWS resource configurations over time.
AWS Config is selected as the primary service for tracking configuration changes and evaluating compliance against rules.
AWS Config continuously monitors resource configurations and maintains a history of changes.
2
Identify the requirement for a centralized dashboard to aggregate security alerts and check compliance against security standards.
AWS Security Hub is selected to aggregate alerts and perform automated compliance checks.
AWS Security Hub consolidates security findings from various AWS services and conducts continuous compliance checks against standards like the CIS AWS Foundations Benchmark.

Key Concept

Continuous security monitoring, compliance checks, and centralized security posture management using AWS Config and AWS Security Hub.
Question 1158Question →

A company runs a high-traffic web application on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application handles long-lived WebSocket connections and standard HTTP requests. During scale-in events, users complain that their active WebSocket sessions are abruptly terminated. Additionally, during sudden traffic surges, the ASG fails to scale out quickly enough because the default scaling metric (average CPU utilization) does not immediately reflect the sudden increase in connection volume. Which two actions should the solutions architect take to resolve these issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Increase the deregistration delay (connection draining) timeout value for the Application Load Balancer target group to allow active connections to persist during scale-in.; Configure a target tracking scaling policy for the Auto Scaling group using the Application Load Balancer request count per target metric.

Answer

The correct actions are to increase the deregistration delay timeout for the target group and to configure a target tracking scaling policy for the Auto Scaling group using the Application Load Balancer request count per target metric.
To prevent active WebSocket connections from being terminated abruptly when an EC2 instance is being decommissioned during scale-in, the deregistration delay (connection draining) timeout on the target group should be increased. This allows the load balancer to keep existing connections open until they complete or the timeout expires. To address the slow scaling issue, using the Application Load Balancer request count per target metric in a target tracking policy provides a direct, immediate indicator of request volume changes, allowing the Auto Scaling group to scale out faster than it would when relying solely on CPU utilization metrics, which have a delayed response to sudden network spikes.

Step-by-Step Solution

1
Analyze the connection termination issue during scale-in events.
Identify that the default deregistration delay (connection draining) timeout is too short for long-lived WebSocket connections, causing them to be terminated when instances are decommissioned.
Increasing this timeout allows the load balancer to drain active connections gracefully.
2
Analyze the slow scale-out issue during sudden traffic spikes.
Determine that CPU utilization is a lagging indicator for connection-heavy or network-bound sudden spikes, whereas Application Load Balancer request count per target responds immediately to traffic increases.
Configuring a target tracking policy based on target request count allows the ASG to scale out rapidly as request volume spikes.

Key Concept

Graceful connection management via ELB connection draining and rapid scaling using load balancer metrics.
Question 1159Question →

A company is designing a batch processing solution on AWS that runs containerized simulation jobs on a daily schedule for 4 hours. The jobs are stateless, fault-tolerant, and designed to checkpoint their progress so they can resume if interrupted. The simulation results must be stored in an Amazon RDS database, while the raw input data is temporarily stored in Amazon S3 for 10 days before being deleted. Which strategy is the most cost-effective to meet these requirements?

Show answer & explanation

Answer: Deploy the simulation jobs on Amazon ECS using Amazon EC2 Spot Instances, and store the raw input data in Amazon S3 Standard.

Answer

Deploy the simulation jobs on Amazon ECS using Amazon EC2 Spot Instances, and store the raw input data in Amazon S3 Standard.
Deploying the simulation jobs on Amazon ECS using Amazon EC2 Spot Instances is the most cost-effective compute strategy because Spot Instances offer up to a 90% discount and are designed for stateless, checkpoint-enabled workloads. Additionally, storing raw data in Amazon S3 Standard is correct because it has no minimum storage duration charge, making it cheaper than S3 Standard-IA for data deleted after 10 days.

Step-by-Step Solution

1
Evaluate the compute requirements and purchasing strategies.
Identify that the containerized workload runs for a short duration (4 hours daily) and is stateless and fault-tolerant. This makes EC2 Spot Instances on Amazon ECS the most cost-effective compute choice compared to On-Demand, Fargate, or Lambda.
Spot Instances provide maximum savings for interruptible workloads, and the 4-hour daily duration does not justify long-term commitments like Savings Plans for compute.
2
Assess the storage tiering for the 10-day retention period.
Determine that S3 Standard must be used instead of S3 Standard-IA.
S3 Standard-IA charges a minimum of 30 days of storage. Deleting the raw data after 10 days incurs a cost penalty for the unused 20 days, making S3 Standard more cost-effective for short-lived datasets.
3
Validate the coverage of purchasing discounts and service limits.
Confirm that Compute Savings Plans do not extend to Amazon RDS, and AWS Lambda cannot support continuous 4-hour executions due to its 15-minute timeout.
Eliminating options that assume incorrect discount scopes or violate service limitations ensures a technically sound and cost-optimized architecture.

Key Concept

Selecting cost-optimized compute purchasing models and storage classes based on workload duration, fault tolerance, and data retention policies.
Question 1160Question →

A company is deploying a high-performance in-memory distributed database on a fleet of Amazon EC2 instances. The database nodes must synchronize data continuously with sub-millisecond network latency and maximum throughput. The database service listens on custom TCP port 7000. A Network Load Balancer (NLB) is configured to route client traffic to the database cluster on port 7000, but the NLB is currently marking all database instances as unhealthy because the target group uses the default HTTP health check configuration.

Which combination of actions will achieve the lowest node-to-node replication latency and resolve the health check issue?

Show answer & explanation

Answer: Deploy the EC2 instances in a cluster placement group within a single Availability Zone, and configure the target group health check port to 7000.

Answer

Deploying the EC2 instances in a cluster placement group within a single Availability Zone and configuring the target group health check port to 7000 is the correct solution.
Deploying the EC2 instances in a cluster placement group packs the instances close together inside a single Availability Zone, enabling low-latency, high-throughput TCP communication between nodes. Since the database application is listening on port 7000, the target group health check port must be updated to 7000 so the load balancer can verify the actual database service status, rather than checking the default port 80 where no service is listening.

Step-by-Step Solution

1
Identify the latency and throughput requirements of the distributed database node-to-node communications.
Determine that a cluster placement group is required to achieve the lowest possible network latency and high throughput.
Cluster placement groups pack instances close together within a single Availability Zone to minimize latency.
2
Analyze the health check failure reported by the Network Load Balancer.
Identify that the health check is querying the default port 80 while the database runs on port 7000.
A load balancer target group uses port 80 by default. If no service listens on port 80, the instances will be marked unhealthy.
3
Reconfigure the target group health check port to 7000.
The Network Load Balancer successfully reaches the database service on port 7000 and marks the instances as healthy.
Aligning the health check port with the active service port ensures correct health status reporting.

Key Concept

Tightly-coupled compute architectures require cluster placement groups for sub-millisecond node-to-node latency, and target group health check ports must align with application listening ports.
PreviousPage 58 / 74Next
All practice questions — AWS Certified Solutions Architect - Associate | Examkin