Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 1161Question →

A logistics company is designing an event-driven telemetry ingestion system to track delivery vehicles globally. The system must process location updates in the exact chronological order they are generated for each individual vehicle to ensure accurate routing history. Three downstream consumer applications—a live customer map, a fleet analytics engine, and an archival database—must independently process the same location stream in real time. The ingestion layer must scale automatically to handle sudden spikes in traffic during peak delivery hours. Which architecture meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Deploy an Amazon Kinesis Data Stream in On-Demand capacity mode, using the vehicle identifier as the partition key. Configure each downstream application as a Kinesis consumer utilizing enhanced fan-out.

Answer

The architecture that uses Amazon Kinesis Data Streams in On-Demand capacity mode with vehicle identifier partition keys and enhanced fan-out consumers.
The correct solution uses an Amazon Kinesis Data Stream in On-Demand capacity mode with the vehicle identifier as the partition key. This partition key routing ensures all coordinates for a specific vehicle are sent to the same shard, preserving chronological ordering. Configuring each downstream application as an independent Kinesis consumer with enhanced fan-out allows parallel, non-blocking real-time processing of the same stream. On-Demand mode eliminates the operational overhead of manually monitoring and scaling shards during traffic spikes.

Step-by-Step Solution

1
Analyze the ordering requirement.
Identify that location updates must be ordered chronologically per vehicle.
To ensure that routing history remains accurate, sequential consistency must be preserved using partition keys in Kinesis or message groups in FIFO systems.
2
Analyze the multi-consumer and real-time fan-out requirements.
Identify that multiple downstream consumers need to read the same event stream independently in real time.
Kinesis streams support multiple independent consumers natively, and enhanced fan-out provides dedicated read throughput to prevent lag. In contrast, standard queue systems are designed for competing consumers where each message is processed once.
3
Evaluate the scaling and operational overhead requirements.
Select On-Demand capacity mode for Kinesis Data Streams.
On-Demand mode automatically scales throughput up and down to handle unpredictable spikes in traffic without manual intervention or custom monitoring logic.

Key Concept

Real-time event streaming with ordered delivery and independent fan-out consumer scaling using Amazon Kinesis Data Streams.
Question 1162Question →

A retail company is designing a serverless order processing system for its online storefront. The system must ingest customer order placement and cancellation events, processing them in the exact chronological sequence they are received to prevent processing a cancellation before an order is created. The traffic pattern is highly unpredictable, with massive traffic surges during flash sales and periods of complete idle time overnight. The company wants a highly scalable, serverless solution that minimizes baseline costs during periods of inactivity.

Which TWO configurations should a solutions architect select to meet these requirements cost-effectively?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon SQS FIFO queue to buffer incoming events and set it as an event source for an AWS Lambda function that processes the events.; Store the order state in an Amazon DynamoDB table configured with on-demand capacity mode.

Answer

The correct configurations are using an Amazon SQS FIFO queue with an AWS Lambda event source, and storing the order state in an Amazon DynamoDB table configured with on-demand capacity mode.
To process order events in the exact sequence they occur while minimizing costs during idle times, a combination of Amazon SQS FIFO queues and Amazon DynamoDB on-demand capacity mode is the most cost-effective solution. SQS FIFO ensures strict chronological order processing, and when combined with AWS Lambda, it triggers compute execution only when messages are present, scaling down to zero cost when idle. Storing the order state in DynamoDB using on-demand capacity mode ensures that the database scales instantly to handle flash sale traffic peaks and costs nothing when there are no read or write requests.

Step-by-Step Solution

1
Analyze the sequence requirements for event processing.
Determine that strict order preservation is mandatory to prevent processing cancellations before orders.
Amazon SQS FIFO queues are required because Amazon SQS Standard queues do not guarantee message ordering.
2
Analyze the compute cost model for unpredictable and idle traffic.
Select an event-driven AWS Lambda compute option integrated with the queue rather than a continuous polling worker.
Event-driven Lambda functions scale to zero when there are no messages, whereas a continuous polling Lambda execution would incur excessive runtime costs.
3
Analyze the database capacity strategy for highly variable workloads.
Select Amazon DynamoDB on-demand capacity mode instead of provisioned capacity mode.
On-demand capacity mode scales dynamically with traffic and avoids the baseline costs of over-provisioned throughput during idle periods.

Key Concept

Designing event-driven serverless architectures using Amazon SQS FIFO queues, AWS Lambda, and Amazon DynamoDB on-demand capacity mode to optimize cost and performance for spiky workloads.
Question 1163Question →

An e-commerce company hosts its critical shopping cart and order processing application on AWS. The application runs on Amazon ECS tasks using the AWS Fargate launch type in the us-east-1 Region, backed by an Amazon Aurora PostgreSQL Multi-AZ DB cluster. The company needs to design a disaster recovery (DR) solution in the us-west-2 Region. The DR solution must support a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes. The company wants to minimize costs during normal operations while ensuring the compute capacity can scale up rapidly during a failover. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set up an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2.; Deploy a Warm Standby compute environment by maintaining a scaled-down ECS service in us-west-2. Configure an Application Load Balancer in us-west-2, and set up Amazon Route 53 failover routing with health checks pointing to both regions.

Answer

To meet the RPO of 5 minutes and RTO of 15 minutes while minimizing cost, the Solutions Architect should set up an Amazon Aurora Global Database with a secondary cluster in us-west-2, and deploy a Warm Standby compute environment by maintaining a scaled-down ECS service with Route 53 failover routing and health checks in us-west-2.
The correct architecture combines Amazon Aurora Global Database for the data layer and a Warm Standby compute environment for the application layer. Aurora Global Database provides sub-second replication to the secondary region, satisfying the 5-minute RPO, and supports promotion of the secondary cluster to primary in less than a minute, supporting the 15-minute RTO. For the compute layer, keeping a scaled-down ECS service running in the secondary region ensures that network paths, load balancers, and tasks are warm and ready to scale up rapidly using ECS Auto Scaling. Configuring Route 53 failover routing with health checks ensures that user traffic is automatically and dynamically redirected to the secondary region if the primary region's Application Load Balancer becomes unhealthy.

Step-by-Step Solution

1
Evaluate the database replication strategy to satisfy the 5-minute Recovery Point Objective (RPO).
Identify that Amazon Aurora Global Database uses storage-level, physical replication to copy data asynchronously to a secondary region with latency of less than one second, far exceeding the RPO requirement.
Choosing the correct database replication method ensures minimal data loss and compliant RPO.
2
Evaluate the database failover strategy to satisfy the 15-minute Recovery Time Objective (RTO).
Confirm that an Aurora Global Database secondary cluster can be promoted to a standalone read-write cluster in under a minute, meeting the RTO requirement.
Rapid database promotion is critical for minimizing overall application downtime during a regional outage.
3
Determine the optimal compute deployment model to balance the 15-minute RTO and cost-minimization goals.
Select a Warm Standby compute model where a scaled-down ECS service is continuously running in the secondary region. This avoids the long startup latencies of a Pilot Light setup (which starts with 0 tasks) while costing less than an Active-Active deployment.
Maintaining active but scaled-down compute capacity allows tasks to scale up rapidly using ECS Auto Scaling and accept traffic quickly.
4
Establish the DNS routing and health check policy to automate regional failover.
Configure Amazon Route 53 failover routing with health checks targeting both Application Load Balancers. If the us-east-1 load balancer fails, Route 53 automatically redirects client traffic to the us-west-2 load balancer.
Automating traffic redirection based on endpoint health ensures seamless switchover and minimal manual intervention.

Key Concept

Disaster recovery planning using a combination of Aurora Global Database and Warm Standby compute strategies to achieve low RTO and RPO targets cost-effectively.
Question 1164Question →

An analytics company hosts a distributed data ingestion service on Amazon EC2 instances inside an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ingestion service processes incoming data on port 5001, while a separate health status daemon runs on port 9001. The ASG is currently configured with the default EC2 health check type. During a recent event, the ingestion service crashed on several instances, but the ASG did not terminate them, resulting in lost data. To resolve this, a solutions architect updated the configuration, but the ASG began aggressively terminating newly launched instances before they could complete their 10-minute cache warming process.

Which two actions should the solutions architect take to resolve these issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Change the Auto Scaling group health check type from EC2 to ELB.; Increase the Auto Scaling group health check grace period to at least 600 seconds.

Answer

Change the Auto Scaling group health check type from EC2 to ELB, and increase the Auto Scaling group health check grace period to at least 600 seconds.
Changing the Auto Scaling group health check type from EC2 to ELB ensures that the ASG monitors application-level availability via the Application Load Balancer target group. In addition, increasing the health check grace period to at least 600 seconds prevents the ASG from prematurely terminating new instances while they are performing their 10-minute cache warming process.

Step-by-Step Solution

1
Analyze why crashed instances are not being replaced.
The Auto Scaling group is configured with the EC2 health check type, which only monitors hypervisor-level instance status. If the application service crashes but the OS remains healthy, the instance is marked healthy.
To ensure instances with crashed application services are replaced, we must link the ASG to the Application Load Balancer's target group health checks by changing the health check type to ELB.
2
Analyze why new instances are being terminated immediately after launching.
When the health check type is changed to ELB, the ASG begins monitoring the ALB's health checks immediately or after the grace period. Because the cache warming process takes 10 minutes (600 seconds) to complete, the instance fails health checks initially and is terminated prematurely by the ASG.
Increasing the health check grace period to at least 600 seconds prevents the ASG from evaluating the health status of new instances until they have completed initialization.
3
Ensure the target group health check port is correctly configured.
The target group health checks must query the health status daemon on port 9001 rather than the traffic port (5001) to accurately assess the node status.
Using the traffic port would result in health check failures, causing all instances to be marked unhealthy.

Key Concept

Auto Scaling Group integration with Elastic Load Balancing health checks and health check grace periods
Question 1165Question →

A solutions architect is designing a configuration management strategy for a containerized application. The application requires access to two types of data: database credentials for an Amazon Aurora MySQL database, which must be rotated automatically every 30 days, and external API endpoints that must be encrypted at rest but do not change. To minimize monthly costs and administrative effort, which combination of actions should the solutions architect take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda function template.; Store the external API endpoints as SecureString parameters in AWS Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation using the built-in Lambda template, and store the external API endpoints as SecureString parameters in AWS Systems Manager Parameter Store.
The correct solution involves storing the database credentials in AWS Secrets Manager with automatic rotation enabled using the built-in Lambda function template, and storing the static API endpoints as SecureString parameters in AWS Systems Manager Parameter Store. Secrets Manager provides native, out-of-the-box automatic rotation for RDS and Aurora databases, which eliminates the need to build and maintain custom rotation code. For the static API endpoints, Parameter Store SecureString parameters provide encryption at rest via AWS KMS at no additional cost for standard parameters, representing the most cost-efficient option since Secrets Manager incurs a monthly cost per secret.

Step-by-Step Solution

1
Evaluate the database credential requirements.
The credentials require automatic rotation every 30 days. AWS Secrets Manager is the optimal service here because it offers native integration with RDS and Aurora to handle rotation automatically using built-in Lambda templates.
This minimizes administrative effort compared to writing custom rotation logic in Systems Manager Parameter Store.
2
Evaluate the static API endpoint configuration requirements.
The endpoints must be encrypted at rest but do not change frequently or require rotation. AWS Systems Manager Parameter Store using the SecureString parameter type is the most cost-effective choice.
Parameter Store standard parameters are free, whereas AWS Secrets Manager charges a monthly flat rate per secret.
3
Combine the evaluations to select the correct options.
Using AWS Secrets Manager for the rotating database credentials and Parameter Store SecureString parameters for the static API endpoints satisfies all security, rotation, cost, and administrative constraints.
This hybrid approach leverages the strengths of both services to optimize costs and minimize overhead.

Key Concept

Secrets and Parameter Management
Question 1166Question →

A healthcare company uploads patient intake documents averaging 250 KB250\text{ KB} in size to an Amazon S3 Standard bucket. The files are accessed frequently during the first 2020 days after upload. After 2020 days, the files are rarely accessed, but they must be retained for a total of 3535 days from the upload date for compliance, after which they can be deleted. Which storage strategy is the most cost-effective for this workload?

Show answer & explanation

Answer: Keep the records in Amazon S3 Standard, and configure an Amazon S3 Lifecycle policy to expire the objects after 35 days.

Answer

Keep the records in Amazon S3 Standard, and configure an Amazon S3 Lifecycle policy to expire the objects after 35 days.
Keeping the files in S3 Standard for the full 35 days and using an S3 Lifecycle policy to delete them is the most cost-effective strategy. Transitioning the files to S3 Standard-IA at day 20 means they would only be stored in S3 Standard-IA for 15 days before deletion. Since S3 Standard-IA has a minimum storage duration charge of 30 days, the company would be billed for 30 days of storage, negating any cost savings from the lower tier. Therefore, avoiding the transition and keeping the files in S3 Standard is cheaper.

Step-by-Step Solution

1
Determine the active retention period in the target storage tier after the initial frequent access window.
The files require storage in the secondary tier from day 20 to day 35, which is a duration of 1515 days (35−20=1535 - 20 = 15 days).
This helps evaluate if transitioning to an infrequent access storage tier meets the minimum storage duration requirements.
2
Evaluate S3 Standard-Infrequent Access (S3 Standard-IA) storage duration constraints.
S3 Standard-IA enforces a minimum storage charge of 30 days. Storing files in this tier for only 15 days before deletion results in paying for 15 days of unused storage.
This determines if the transition to S3 Standard-IA incurs an early deletion penalty.
3
Compare the total cost of keeping the files in S3 Standard versus transitioning them.
Keeping the 250 KB250\text{ KB} files in S3 Standard for 35 days is more cost-effective because it avoids both the 30-day minimum storage charge penalty and the S3 transition request charges.
This identifies the most cost-optimal storage tiering strategy.

Key Concept

Amazon S3 Standard-IA has a minimum storage duration charge of 30 days. Transitioning objects to S3 Standard-IA that are deleted before 30 days are up results in a cost penalty.
Question 1167Question →

A startup wants to implement a security solution that continuously monitors its AWS accounts for malicious activities, unauthorized access, and anomalous behavior. The solution must analyze AWS CloudTrail management logs, VPC Flow Logs, and DNS query logs with zero impact on resource performance. Which AWS service should a solutions architect recommend to satisfy these requirements?

Show answer & explanation

Answer: Amazon GuardDuty

Answer

Amazon GuardDuty
The correct answer is Amazon GuardDuty because it is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior. It does so by analyzing metadata from foundational sources such as AWS CloudTrail event logs, Amazon VPC Flow Logs, and DNS logs without affecting the performance of active EC2 instances.

Step-by-Step Solution

1
Identify the data sources to be analyzed
The requirement specifies AWS CloudTrail management logs, VPC Flow Logs, and DNS query logs.
Selecting a service that natively integrates with and ingests these specific log sources is necessary.
2
Evaluate the detection capability needed
The target service must detect malicious activity and unauthorized behavior.
This matches a threat detection service rather than a simple firewall or access control mechanism.
3
Select the service with minimal operational overhead
Amazon GuardDuty matches all requirements and runs completely independently of workloads.
GuardDuty uses machine learning and threat intelligence to process these data sources without requiring agent deployment.

Key Concept

Continuous security monitoring and threat detection using Amazon GuardDuty
Estimated Time:50s
Question 1168Question →

A financial technology company is designing a cost-effective compute environment for a risk-modeling suite. The workload has the following components:
1. A core trading microservice running on Amazon ECS with AWS Fargate that requires a constant baseline of 1010 tasks running 24/724/7 to handle routine API requests.
2. A continuous, long-running telemetry processing agent that must run 24/724/7 to collect system metrics and process them in real time.
3. A large-scale simulation engine running on Amazon EC2 instances. The simulation runs batch jobs that are fault-tolerant, can be interrupted, and can resume from checkpoints.
4. A critical nightly database reconciliation job running on Amazon EC2 that runs for exactly 22 hours starting at midnight and must complete without interruption.

Which combination of compute hosting configurations and purchasing strategies will meet these requirements most cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Purchase a Compute Savings Plan to cover the baseline capacity of the ECS Fargate microservice tasks.; Run the EC2 simulation engine on Spot Instances, and run the nightly reconciliation job on On-Demand Instances.

Answer

The most cost-effective compute strategy is to purchase a Compute Savings Plan for the ECS Fargate microservice baseline and to run the EC2 simulation engine on Spot Instances while running the nightly reconciliation job on On-Demand Instances.
Purchasing a Compute Savings Plan to cover the baseline capacity of the ECS Fargate tasks is correct because Compute Savings Plans apply directly to Fargate and offer deep discounts for predictable, continuous compute usage. Running the EC2 simulation engine on Spot Instances is correct because the simulation is fault-tolerant and can resume from checkpoints, allowing it to leverage Spot pricing (up to 90%90\% savings). Running the nightly reconciliation job on On-Demand Instances is correct because it is a critical, non-interruptible process that runs for only 22 hours daily, meaning it does not justify a 11-year or 33-year savings commitment and cannot safely run on Spot.

Step-by-Step Solution

1
Analyze the pricing model and suitability of Compute Savings Plans for Fargate tasks.
Compute Savings Plans apply automatically to ECS Fargate usage, offering significant discounts for predictable, continuous 24/724/7 workloads.
Determining the most cost-effective way to run the core microservice baseline.
2
Evaluate compute purchasing options for the simulation engine and the reconciliation job.
The simulation engine is fault-tolerant and can resume from checkpoints, making it ideal for Spot Instances. The critical reconciliation job is short-running (22 hours daily) and cannot be interrupted, making On-Demand Instances the best choice.
Matching workload fault tolerance and duration to the appropriate EC2 pricing model.
3
Identify scope limitations of savings plans and compute hosting models for database and telemetry components.
Compute Savings Plans do not apply to Amazon Aurora, and running a continuous 24/724/7 agent on AWS Lambda is financially inefficient due to invocation limits.
Eliminating incorrect distractor strategies that violate AWS service limits and savings plan scopes.

Key Concept

Matching AWS compute workloads to optimal purchasing models (Savings Plans, Spot, and On-Demand) based on availability, continuity, and service coverage rules.
Question 1169Question →

A solutions architect has configured an Application Load Balancer (ALB) to distribute traffic to a fleet of Amazon EC2 instances. The web application runs on port 80 on the EC2 instances. The security group associated with the EC2 instances is configured to allow inbound traffic on port 80 from the ALB security group. However, the ALB is marking all EC2 instances as unhealthy. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The Network ACL associated with the EC2 instance subnets is blocking the traffic.

Answer

The Network ACL associated with the EC2 instance subnets is blocking the traffic.
The Network ACL associated with the EC2 instance subnets is blocking the traffic. Because Network ACLs are stateless, they evaluate inbound and outbound traffic independently. Even if a stateful security group allows the inbound health check, a stateless Network ACL that does not allow inbound traffic on port 80 or outbound return traffic on ephemeral ports (typically 1024-65535) will block the health check requests, causing the Application Load Balancer to mark the instances as unhealthy.

Step-by-Step Solution

1
Analyze the stateful vs. stateless nature of the network components.
Security groups are stateful, meaning return traffic is allowed automatically. Network ACLs are stateless, meaning return traffic must be explicitly allowed.
This helps identify why traffic might be blocked outbound even if inbound security groups are correctly configured.
2
Evaluate the health check port configuration.
The application listens on port 80, and the health check queries port 80. This is a correct match, ruling out port mismatch issues.
Verifying that the target group configuration aligns with the application port rules out target group health check port mismatches.
3
Determine if DNS routing affects internal load balancer health checks.
Route 53 latency routing controls client-to-ALB routing, not ALB-to-EC2 target communication.
This rules out DNS routing policies as a cause of internal target health check failures.

Key Concept

Stateless Network ACLs vs. Stateful Security Groups in ELB Health Checks
Estimated Time:50s
Question 1170Question →

A logistics company is designing an architecture to process batch data files containing shipment logs uploaded to Amazon S3. The processing of each batch file is a compute-intensive operation that takes approximately 20 minutes to complete. The files are uploaded sporadically throughout the day with highly unpredictable traffic spikes, including long periods of no activity. The company wants a serverless, cost-optimized solution that automatically scales based on demand and minimizes costs during idle periods. Which architecture meets these requirements most cost-effectively?

Show answer & explanation

Answer: Configure Amazon S3 to send event notifications to an Amazon Simple Queue Service (Amazon SQS) queue. Run the processing application as containerized tasks in Amazon Elastic Container Service (Amazon ECS) on AWS Fargate Spot, scaling the number of tasks dynamically based on the queue depth, and use a Gateway VPC Endpoint for Amazon S3 traffic.

Answer

Configure Amazon S3 to send event notifications to an Amazon Simple Queue Service (Amazon SQS) queue. Run the processing application as containerized tasks in Amazon Elastic Container Service (Amazon ECS) on AWS Fargate Spot, scaling the number of tasks dynamically based on the queue depth, and use a Gateway VPC Endpoint for Amazon S3 traffic.
The correct answer combines AWS Fargate Spot (which provides serverless container execution at a steep discount) with an SQS-based scaling policy that allows the environment to scale down to zero tasks when no logs are waiting to be processed. Additionally, using a Gateway VPC Endpoint for Amazon S3 ensures that the high-volume data transfer between the Fargate tasks and S3 does not incur NAT Gateway data processing charges.

Step-by-Step Solution

1
Evaluate the execution duration against AWS serverless compute limitations.
The processing job takes 20 minutes, which exceeds the 15-minute execution limit of AWS Lambda, necessitating a containerized approach like AWS Fargate.
AWS Lambda is disqualified due to the hard timeout constraint, requiring Amazon ECS or EKS on Fargate for serverless execution.
2
Select the most cost-effective compute capacity and scaling strategy.
AWS Fargate Spot capacity provider combined with SQS queue-depth auto-scaling is selected.
Fargate Spot offers up to a 70% discount compared to regular Fargate pricing. Auto-scaling based on queue depth allows the task count to scale to zero when there are no files to process, avoiding idle capacity costs.
3
Optimize data transfer costs between the private compute tasks and Amazon S3.
A Gateway VPC Endpoint for Amazon S3 is chosen to handle the file transfers.
Routing S3 traffic through a NAT Gateway incurs expensive hourly and per-GB data processing charges. A Gateway VPC Endpoint is free and keeps traffic within the AWS network.

Key Concept

Serverless and Automated Scaling Architectures for Cost Efficiency
Estimated Time:1m 30s
Question 1171Question →

An aerospace engineering company runs a tightly coupled computational fluid dynamics (CFD) simulation suite. The workload runs on several Amazon EC2 instances that must exchange simulation state data with sub-millisecond network latency. Additionally, external administrators submit simulation configuration files via a Network Load Balancer (NLB) targeting these instances on TCP port 8080. The instances only run the configuration service on this port.

Which actions should a solutions architect take to ensure the highest network performance for the simulation communication while maintaining successful health checks on the load balancer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Group the EC2 instances within a cluster placement group inside a single Availability Zone.; Specify TCP port 8080 as the health check port for the Network Load Balancer's target group.

Answer

Grouping the EC2 instances in a cluster placement group and specifying TCP port 8080 for target group health checks.
Grouping the instances in a cluster placement group ensures they are physically located close to each other on the same network hardware, enabling low-latency, high-throughput node-to-node communication. Specifying port 8080 for the target group health checks ensures that the load balancer correctly monitors the custom configuration service running on that port instead of failing on the default port 80, where no service is listening.

Step-by-Step Solution

1
Analyze the network latency requirement for tightly coupled node-to-node communications.
Identify that a cluster placement group is required to place instances close together on the underlying hardware to achieve low latency and high network throughput.
Tightly coupled applications, such as computational fluid dynamics simulations, require sub-millisecond node-to-node communication that spread or partition placement groups cannot provide.
2
Analyze the load balancer health check configuration relative to the application port.
Determine that the target group health checks must query port 8080 where the active service is running.
Using the default port 80 will cause health check failures because the application is only listening on port 8080, leading the load balancer to route no traffic to the instances.

Key Concept

Selecting appropriate EC2 placement groups and configuring correct port settings for load balancer target group health checks.
Estimated Time:2m 0s
Question 1172Question →

A solutions architect is designing a high-performance database solution for a social media application. The application must support a high volume of writes for user activities and requires sub-millisecond latency for reading popular user profiles. The workload experiences highly unpredictable, spiky traffic. Which combination of database configurations should the solutions architect select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon DynamoDB table using a high-cardinality attribute such as a unique user ID for the partition key.; Deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache read requests for the session and profile data.

Answer

Create an Amazon DynamoDB table using a high-cardinality attribute such as a unique user ID for the partition key, and deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache read requests for the session and profile data.
Implementing Amazon DynamoDB with a high-cardinality partition key (such as a unique user ID) prevents write bottlenecks by distributing traffic evenly across physical partitions. Coupling this with Amazon DynamoDB Accelerator (DAX) provides the required sub-millisecond latency for hot read requests by serving them from an in-memory cache.

Step-by-Step Solution

1
Analyze workload requirements.
Identified highly unpredictable, spiky read and write traffic, with sub-millisecond read latency requirements.
The database solution must handle high-throughput, variable access patterns without bottlenecking, while providing extremely fast read times.
2
Design the partition key strategy for scaling.
Selected a high-cardinality key (unique user ID) rather than a sequential or timestamp-based key.
High-cardinality keys distribute write and read requests evenly across DynamoDB physical partitions, preventing write bottlenecks on a single partition.
3
Address sub-millisecond lookup latency.
Added a DynamoDB Accelerator (DAX) caching tier.
DAX delivers microsecond response times for read-heavy data by keeping cached data in-memory, relieving read load from the DynamoDB table.

Key Concept

High-performing database designs using DynamoDB partition scaling and caching strategies.
Question 1173Question →

A retail company hosts its core ordering application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application runs on a custom port 8085. The ALB listener is configured to accept HTTPS traffic on port 443 and forward it to a target group containing the EC2 instances on port 8085. To meet strict security requirements, the EC2 security group is restricted to allow inbound TCP traffic on port 8085 only from the ALB security group. However, after a new deployment, the target group health checks fail, and the ASG repeatedly terminates and replaces the instances.

Which action should the Solutions Architect take to resolve the issue and ensure the instances pass health checks while maintaining the current security posture?

Show answer & explanation

Answer: Update the target group health check configuration to use the traffic-port (port 8085) for health checks.

Answer

Update the target group health check configuration to use the traffic-port (port 8085) for health checks.
The application runs on port 8085, and the EC2 instances' security group only allows inbound traffic on port 8085 from the Application Load Balancer (ALB). By default, target group health checks are sent to the default port (typically port 80) unless customized. Updating the target group health check configuration to use the traffic-port (port 8085) ensures that health check requests are sent to the port where the application is listening and where traffic is permitted by the security group.

Step-by-Step Solution

1
Analyze the port mappings and security group rules.
The application listens on port 8085. The security group on the EC2 instances restricts inbound traffic to port 8085 from the Application Load Balancer (ALB) security group.
This establishes that port 8085 is the only valid port for application traffic and health checks under the current security posture.
2
Identify why the target group health checks are failing.
By default, target groups perform health checks on the default port (typically port 80) unless overridden. Since port 80 is blocked by the security group and has no service listening, health checks fail.
Pinpointing the port mismatch clarifies why the load balancer marks healthy instances as unhealthy.
3
Select the resolution that resolves the port mismatch without introducing security vulnerabilities.
Configure the target group to perform health checks on the traffic-port (port 8085).
This ensures the load balancer queries the correct active application port, aligned with existing security group rules.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) Target Group Health Check Port configuration
Question 1174Question →

A Software-as-a-Service (SaaS) company builds software applications and stores build artifacts in an Amazon S3 Standard bucket. The average size of each artifact is 120 MB120\text{ MB}. The artifacts are accessed frequently during the first 15 days15\text{ days} after creation for verification and deployments. After 15 days15\text{ days}, the artifacts are rarely accessed but must be retained for compliance audits for a total of 120 days120\text{ days} from creation, after which they can be safely deleted. In the event of an audit, the company must be able to retrieve the artifacts within 5 hours5\text{ hours}. Which combination of actions should a solutions architect configure in the Amazon S3 Lifecycle policy to meet these requirements in the most cost-effective manner? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Transition the artifacts to Amazon S3 Glacier Flexible Retrieval 15 days15\text{ days} after creation.; Permanently delete the artifacts 120 days120\text{ days} after creation.

Answer

Transitioning the artifacts to Amazon S3 Glacier Flexible Retrieval 15 days15\text{ days} after creation and permanently deleting the artifacts 120 days120\text{ days} after creation.
Transitioning the artifacts to Amazon S3 Glacier Flexible Retrieval after 15 days15\text{ days} is the most cost-effective option because the artifacts are rarely accessed after that time and can be retrieved within 3 to 5 hours3\text{ to }5\text{ hours} using standard retrieval, which complies with the 5 hour5\text{ hour} retrieval SLA. Deleting the artifacts after 120 days120\text{ days} complies with the compliance retention requirement while avoiding unnecessary ongoing storage costs. Since the artifacts are stored in Glacier Flexible Retrieval for 105 days105\text{ days} (from day 1515 to day 120120), this exceeds the 90 day90\text{ day} minimum storage duration, avoiding early deletion fees.

Step-by-Step Solution

1
Analyze the access patterns, file sizes, and retrieval SLA of the build artifacts.
Artifacts are 120 MB120\text{ MB} (no minimum size constraints), frequently accessed for 15 days15\text{ days}, and rarely accessed for the next 105 days105\text{ days} (total retention of 120 days120\text{ days}). Retrieval SLA is within 5 hours5\text{ hours}.
To determine the most cost-effective storage classes that satisfy the operational and retrieval speed requirements.
2
Select the most cost-effective storage class for the retention phase (Day 1515 to Day 120120).
Amazon S3 Glacier Flexible Retrieval is selected. Its standard retrieval option delivers data in 3 to 5 hours3\text{ to }5\text{ hours}, meeting the 5 hour5\text{ hour} SLA. S3 Glacier Deep Archive is ruled out because its standard retrieval takes 12 hours12\text{ hours}.
S3 Glacier Flexible Retrieval has significantly lower storage costs than S3 Standard-IA while still meeting the retrieval SLA.
3
Calculate the duration the objects will reside in the Glacier tier to check for minimum storage duration penalties.
Objects will reside in Glacier Flexible Retrieval from Day 1515 to Day 120120, which is 105 days105\text{ days}. Since 105≥90 days105 \geq 90\text{ days} (the minimum storage duration for Glacier Flexible Retrieval), no early deletion fees are incurred.
S3 storage classes like Glacier and Standard-IA have minimum storage durations; violating them results in early deletion/transition charges.
4
Define the lifecycle rules to execute the storage transitions and deletion.
Rule 1: Transition to S3 Glacier Flexible Retrieval after 15 days15\text{ days}. Rule 2: Expire (permanently delete) the objects after 120 days120\text{ days}.
To automate the cost-optimization lifecycle without administrative overhead.

Key Concept

Cost-Optimized Storage Tiering and Lifecycle Management
Question 1175Question →

A research institution is deploying a seismic data processing cluster on Amazon EC2 instances to analyze real-time earthquake signals. The cluster requires sub-millisecond node-to-node communication latency to perform fast Fourier transform calculations. To receive incoming seismic data feeds from remote stations, the instances are registered with an Application Load Balancer (ALB) target group configured for HTTP traffic on port 8088. The application's health status endpoint is also served on port 8088, but the instances are currently marked unhealthy by the ALB, and node-to-node latency is too high. Which configuration will resolve the health check issues and achieve the required network performance?

Show answer & explanation

Answer: Launch the instances in a cluster placement group. Set the target group health check port to 8088.

Answer

Launch the instances in a cluster placement group. Set the target group health check port to 8088.
Deploying the EC2 instances in a cluster placement group ensures that the nodes are physically located close to each other within a single Availability Zone, enabling low-latency, high-throughput node-to-node communication. Configuring the load balancer's target group health check port to 8088 ensures the load balancer queries the port where the application actually listens and reports health, resolving the health check failures.

Step-by-Step Solution

1
Analyze the node-to-node communication latency requirement.
Identify that a cluster placement group is required to group instances physically close together on the same underlying hardware to minimize network latency.
Other placement groups like spread or partition are designed to maximize physical isolation, which increases network latency.
2
Analyze the load balancer health check failure.
Identify that the application serves health check endpoints on port 8088, but the ALB defaults to port 80 (or the default listener configuration) which has no service running.
A target group health check port mismatch causes the load balancer to mark healthy targets as unhealthy.
3
Select the correct combination of configurations.
Combine the cluster placement group configuration with setting the health check port specifically to port 8088.
This dual configuration addresses both the network latency performance requirements and the health check failures.

Key Concept

High-performing and elastic compute configurations, specifically EC2 placement groups and ELB health check port alignment.
Question 1176Question →

A media company is migrating a web application to AWS. The architecture requires a fleet of Amazon ECS tasks running on AWS Fargate to handle constant, baseline user traffic. The application also uses Amazon DynamoDB to store user session data with highly unpredictable, spiky access patterns. The company wants to minimize the long-term, predictable costs of Fargate, while ensuring DynamoDB is optimized for cost. Which strategy should the company implement?

Show answer & explanation

Answer: Purchase a Compute Savings Plan for the ECS Fargate tasks, and configure Amazon DynamoDB in On-Demand capacity mode.

Answer

Purchase a Compute Savings Plan for the ECS Fargate tasks, and configure Amazon DynamoDB in On-Demand capacity mode.
The correct strategy is to use a Compute Savings Plan to cover the constant, 24/7 baseline compute usage of the Amazon ECS Fargate tasks, and configure Amazon DynamoDB in On-Demand capacity mode. Compute Savings Plans provide discounts on ECS Fargate. Since DynamoDB access patterns are spiky and unpredictable, On-Demand capacity mode ensures that the company only pays for the database requests actually consumed, avoiding the high cost of over-provisioning capacity.

Step-by-Step Solution

1
Analyze the compute requirements for the baseline web application traffic.
The baseline web application traffic is constant and runs 24/7 on Amazon ECS Fargate. Compute Savings Plans are ideal for this workload, offering discounts of up to 66% in exchange for a commitment to a consistent amount of compute usage.
To choose the correct compute purchasing model for predictable, continuous ECS Fargate tasks.
2
Evaluate the database storage and throughput needs for DynamoDB.
The DynamoDB workload has highly unpredictable, spiky access patterns. On-Demand capacity mode charges per request and accommodates sudden traffic changes instantly, preventing over-provisioning costs.
To select the most cost-effective capacity mode for spiky database traffic.
3
Combine the compute and database strategies and eliminate invalid options.
We pair the Compute Savings Plan for Fargate with DynamoDB On-Demand capacity. We eliminate options that misapply Compute Savings Plans to DynamoDB, over-provision DynamoDB capacity, or use Lambda for continuous baseline load.
To synthesize the optimal hybrid architecture that minimizes total cost of ownership.

Key Concept

Selecting cost-optimized compute purchasing strategies (Compute Savings Plans for Fargate) and matching appropriate database capacity modes (On-Demand for spiky DynamoDB workloads) to minimize AWS costs.
Question 1177Question →

A gaming company hosts a mobile leaderboard application on Amazon EC2 instances in an Auto Scaling group (ASG). The instances are registered with a target group for an Application Load Balancer (ALB). The leaderboard application listens on custom TCP port 80808080, but the ALB shows all EC2 instances as unhealthy. A solutions architect verifies that the application is running correctly on the instances. Which two actions should the solutions architect take to resolve the health check issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Update the ALB target group health check configuration to use port 80808080 or select the traffic port option.; Configure the security group of the EC2 instances to allow inbound TCP traffic on port 80808080 from the security group of the ALB.

Answer

To resolve the health check issues, the target group health check port must match the application port (port 80808080), and the EC2 instances' security group must permit inbound traffic on port 80808080 from the load balancer.
The correct actions are to update the target group health check to query the custom port 80808080 (or select the traffic port option) and configure the EC2 instances' security group to allow inbound traffic on port 80808080 from the ALB's security group. This ensures the load balancer can reach the application to evaluate its health and forward client traffic.

Step-by-Step Solution

1
Verify and align the health check port configuration.
Changing the target group health check port to port 80808080 or traffic-port ensures the ALB targets the active application port.
By default, if the target group is configured on a custom port but the health check is set to a default port (like port 8080), the instances will be marked unhealthy.
2
Ensure network connectivity between the ALB and the EC2 instances.
Updating the EC2 instance security group to allow port 80808080 inbound from the ALB's security group allows the health check requests and application traffic to flow.
Security groups require an explicit inbound rule for traffic to enter the instances.

Key Concept

Auto Scaling and Elastic Load Balancing health check configuration and security group alignment
Question 1178Question →

A media company is developing a web platform where users upload high-resolution video files. The uploads occur unpredictably throughout the day. The company requires a cost-effective, scalable architecture to perform two tasks for each upload:

1. Write metadata to a database in the exact sequence in which the uploads occurred to maintain a chronological audit log.
2. Run a CPU-intensive transcoding pipeline that takes between 30 and 45 minutes to process each video.

Which combination of actions should a solutions architect recommend to meet these requirements cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Amazon EventBridge to route S3 upload events to an Amazon SQS FIFO queue, which triggers an AWS Lambda function to write metadata to the database.; Run the transcoding pipeline using AWS Batch with an AWS Fargate Spot compute environment.

Answer

Configure Amazon EventBridge to route S3 upload events to an Amazon SQS FIFO queue triggering an AWS Lambda function, and run the transcoding pipeline using AWS Batch with an AWS Fargate Spot compute environment.
The correct combination uses Amazon EventBridge to send S3 events to an Amazon SQS FIFO queue, which triggers AWS Lambda to sequentially write metadata to the database, ensuring strict ordering. It also uses AWS Batch with AWS Fargate Spot to process long-running transcoding tasks, bypassing the 15-minute Lambda limit in a serverless, highly cost-optimized manner.

Step-by-Step Solution

1
Analyze the ordering requirement for metadata tracking.
The requirement demands processing uploads in the exact sequence they occurred. Standard Amazon SQS queues do not guarantee ordering, so an SQS FIFO queue is required. S3 event notifications cannot target SQS FIFO queues directly, so routing S3 upload events through Amazon EventBridge to the SQS FIFO queue is the correct pattern.
Ensures that the chronological audit log maintains strict event sequence.
2
Analyze the transcoding duration and compute requirements.
The transcoding process takes 30 to 45 minutes. Since AWS Lambda has a maximum execution limit of 15 minutes, it is physically impossible to run the entire transcoding pipeline on Lambda. Instead, running containerized transcoding tasks using AWS Batch with AWS Fargate Spot instances provides a fully serverless, auto-scaling, and highly cost-efficient solution.
Bypasses the Lambda execution limit while optimizing compute costs for variable batch workloads.
3
Evaluate the database scaling and cost requirements.
Using Provisioned Capacity Mode for an unpredictable database workload requires over-provisioning to handle spikes, leading to high idle costs. Using Amazon DynamoDB on-demand capacity mode would scale automatically and only charge per request, but the options only suggest either the SQS FIFO/EventBridge integration or provisioned capacity. Rejecting provisioned capacity is necessary for cost optimization.
Aligns the architecture with the AWS Well-Architected Framework's cost optimization pillar.

Key Concept

Selecting the appropriate compute, queueing, and scaling options to support long-running processes and strict sequencing while minimizing idle capacity costs.
Estimated Time:2m 0s
Question 1179Question →

A real estate platform hosts a global portal on AWS. The portal allows users to search for property listings and view high-resolution property images. The search queries are processed by an Amazon RDS for PostgreSQL database, while the images are stored in an Amazon S3 bucket. The company wants to optimize performance for global users, minimize load on both the database and the S3 bucket, and keep costs optimized. Which combination of services should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Configure an Amazon CloudFront distribution with Amazon S3 as the origin for the images, utilizing a default cache TTL of 86400 seconds. Deploy an Amazon ElastiCache cluster to cache frequent query results from the Amazon RDS database.

Answer

Configure an Amazon CloudFront distribution with Amazon S3 as the origin for the images, utilizing a default cache TTL of 86400 seconds. Deploy an Amazon ElastiCache cluster to cache frequent query results from the Amazon RDS database.
Implementing Amazon CloudFront with a non-zero cache TTL caches static images at edge locations, reducing S3 request costs and user latency. Amazon ElastiCache stores the results of common read-heavy queries in memory, offloading the RDS database and accelerating responses.

Step-by-Step Solution

1
Analyze the traffic and data types in the application.
Identify static assets (property images in S3) and dynamic query results (property searches in RDS).
Determining data volatility allows for the selection of appropriate caching layers.
2
Design the caching strategy for the static images.
Place Amazon CloudFront in front of the S3 bucket with a non-zero cache TTL.
This offloads read requests from the origin S3 bucket and reduces global latency.
3
Design the caching strategy for the database search queries.
Implement Amazon ElastiCache to cache frequently requested property listings.
This prevents redundant read-heavy queries from hitting the Amazon RDS database, improving response times.

Key Concept

Multi-tier caching using Amazon CloudFront and Amazon ElastiCache
Question 1180Question →

A medical device manufacturer is building an IoT monitoring system on AWS to process state-change logs from thousands of diagnostic devices. The system must process status updates for each device chronologically to maintain an accurate device history. During peak usage, the system experiences brief, massive spikes in telemetry messages. The architecture must fan out these state-change events to two distinct backend systems: a real-time status-tracking service and a historical compliance auditing database. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Publish the state-change events to an Amazon SNS FIFO topic. Subscribe two Amazon SQS FIFO queues to the topic, with one queue dedicated to the status-tracking service and the other to the compliance auditing database.

Answer

Publish the state-change events to an Amazon SNS FIFO topic. Subscribe two Amazon SQS FIFO queues to the topic, with one queue dedicated to the status-tracking service and the other to the compliance auditing database.
Publishing events to an Amazon SNS FIFO topic and subscribing two Amazon SQS FIFO queues is the optimal decoupling pattern. SNS FIFO topics preserve message ordering and deliver messages to subscribed SQS FIFO queues in a first-in, first-out manner. The device ID is mapped to the message group ID, ensuring messages for the same device are processed in order by the downstream consumers. This fully managed approach requires no custom polling logic, keeps operational overhead to a minimum, and handles traffic spikes seamlessly.

Step-by-Step Solution

1
Identify the core requirements: message ordering preservation per device, fan-out to two distinct services, spike resilience, and minimal operational overhead.
Limits the valid design choices to event-driven services that support FIFO delivery and fan-out natively.
We must filter out solutions that use standard queues (which do not guarantee ordering) or those requiring heavy custom container/compute management.
2
Evaluate the subscription constraints of Amazon SNS FIFO.
Rule out direct subscription of AWS Lambda functions or standard SQS queues to the SNS FIFO topic.
Amazon SNS FIFO topics only support SQS FIFO queues as subscribers to guarantee ordering preservation.
3
Analyze the operational overhead of the Kinesis and Lambda custom polling option.
Rule out the Kinesis solution due to the inefficient and expensive continuous polling loop implementation in AWS Lambda.
Continuous execution loops in serverless functions are a major cost and operational anti-pattern.
4
Confirm the capability of SNS FIFO to SQS FIFO integration.
Each SQS FIFO queue will receive identical ordered copies of the messages, preserving the FIFO ordering per Message Group ID (device ID) for each downstream application independently.
This satisfies all business and technical constraints with a fully managed serverless architecture.

Key Concept

Decoupling with FIFO ordering and fan-out.
Estimated Time:3m 0s
PreviousPage 59 / 74Next