All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A logistics company hosts a fleet tracking application on AWS. The application runs on Amazon ECS Fargate tasks behind an Application Load Balancer (ALB) in the primary Region (us-east-1). The database is an Amazon RDS for PostgreSQL Multi-AZ DB instance. The company requires a disaster recovery (DR) strategy in a secondary Region (us-west-2) with a Recovery Time Objective (RTO) of less than $15$ minutes and a Recovery Point Objective (RPO) of less than $5$ minutes. The solution must minimize ongoing operational costs. Which two actions should a solutions architect take to meet these requirements?

Select all that apply

Create an Amazon RDS cross-region read replica in the secondary Region. During a failover, promote the read replica to a standalone DB instance.

Deploy the ECS service in the secondary Region with a minimum desired task count of

1

. Configure an Application Load Balancer in the secondary Region, and set up Amazon Route 53 active-passive failover routing with health checks.

Configure the RDS DB instance to replicate synchronously to the secondary Region using Multi-AZ deployment.

Configure automated DB snapshots and copy them to the secondary Region every

12

hours. In a disaster, restore the database from the copied snapshot.

Use Route 53 Latency routing policy to route user traffic to both regions simultaneously, allowing clients to automatically direct requests to the secondary Region if the primary Region becomes unresponsive.

Show answer & explanation

Answer: Create an Amazon RDS cross-region read replica in the secondary Region. During a failover, promote the read replica to a standalone DB instance.; Deploy the ECS service in the secondary Region with a minimum desired task count of $1$ . Configure an Application Load Balancer in the secondary Region, and set up Amazon Route 53 active-passive failover routing with health checks.

Answer

The correct options are creating an Amazon RDS cross-region read replica in the secondary Region (promoting it during failover), and deploying the ECS service in the secondary Region with a minimum task count of one along with an Application Load Balancer and Route 53 active-passive failover routing with health checks.

The correct actions combine an Amazon RDS cross-region read replica in the secondary Region with a Warm Standby ECS deployment and Route 53 active-passive failover. Creating a cross-region read replica satisfies the RPO of less than

5

minutes since replication is continuous and asynchronous, and promoting the replica to a standalone database takes only a few minutes. Running a single Fargate task in the secondary Region keeps compute costs minimal while ensuring that the infrastructure is ready to receive traffic immediately upon a DNS failover, satisfying the RTO of less than

15

minutes.

Step-by-Step Solution

Analyze the RPO requirement of less than

5

minutes.

Identify that data replication to the secondary Region must be near real-time. Since the primary database is Amazon RDS for PostgreSQL, an asynchronous cross-region read replica is the most appropriate option to keep replication lag within seconds/minutes while keeping costs low compared to active-active architectures.

Ensures that data loss is minimized to meet the RPO threshold.

Analyze the RTO requirement of less than

15

minutes.

Determine that compute capacity must be pre-provisioned or quickly deployable, and failover routing must be automated. Running a scaled-down ECS Fargate task (desired count of

1

) represents a Warm Standby strategy that allows traffic to be served immediately upon DNS failover, avoiding the startup delays of deploying infrastructure from scratch.

Allows the application to recover and start serving traffic within the RTO budget.

Evaluate the database replication options.

Rule out RDS Multi-AZ for cross-region replication since Multi-AZ is strictly single-region. Rule out periodic snapshots since

12

-hour snapshot copying does not meet the

5

-minute RPO and restoration takes too long for the

15

-minute RTO.

Eliminates database options that violate either the synchronous cross-region technical limitation or RPO/RTO constraints.

Evaluate routing and failover options.

Rule out latency-based routing without active health checks, as it does not perform automated failover during a regional outage.

Eliminates incorrect DNS configurations that fail to provide high availability.

Key Concept

Disaster recovery (DR) strategies (specifically Warm Standby vs. Pilot Light) require aligning AWS database replication (like RDS cross-region replicas) and routing mechanisms (like Route 53 failover routing) to meet specific RTO and RPO objectives at the lowest cost.

Estimated Time:3m 0s

Question 1182Question →

An enterprise logistics company runs a fleet of Amazon EC2 instances in a private subnet to process shipping telemetry. The security team must design a threat detection and mitigation system to identify any EC2 instances that attempt to communicate with known malicious command-and-control (C&C) servers. When a threat is detected, the system must immediately block both inbound and outbound communication with the malicious IP address for the affected subnet. Which architectural design meets these requirements while adhering to the AWS Well-Architected Framework?

Enable Amazon GuardDuty to analyze VPC Flow Logs. Configure an Amazon EventBridge rule that triggers on GuardDuty findings to invoke an AWS Lambda function that adds stateless inbound and outbound DENY rules for the remote IP address to the Network Access Control List (NACL) associated with the private subnet.

Enable Amazon GuardDuty to analyze VPC Flow Logs. Configure an Amazon EventBridge rule that triggers on GuardDuty findings to invoke an AWS Lambda function that adds an outbound DENY rule for the remote IP address to the Security Group associated with the EC2 instances in the private subnet.

Enable AWS Shield Advanced on the resources in the private subnet. Configure AWS Shield Advanced to automatically detect the malicious outbound traffic and update the subnet's route table to redirect traffic destined for the remote IP address to a blackhole route.

Enable AWS WAF on the elastic network interfaces (ENIs) of the EC2 instances in the private subnet. Configure AWS WAF to inspect the outbound traffic payloads and block all packets destined for the malicious IP address.

Show answer & explanation

Answer: Enable Amazon GuardDuty to analyze VPC Flow Logs. Configure an Amazon EventBridge rule that triggers on GuardDuty findings to invoke an AWS Lambda function that adds stateless inbound and outbound DENY rules for the remote IP address to the Network Access Control List (NACL) associated with the private subnet.

Answer

The correct architecture uses Amazon GuardDuty to detect the malicious outbound C&C traffic by analyzing VPC Flow Logs. The event triggers an EventBridge rule that invokes an AWS Lambda function. The Lambda function adds inbound and outbound DENY rules to the stateless Network Access Control List (NACL) associated with the private subnet, which effectively blocks the communication at the subnet boundary as required.

Step-by-Step Solution

Select the appropriate security monitoring and threat detection service.

Amazon GuardDuty is enabled. It continuously monitors VPC Flow Logs, DNS logs, and CloudTrail management events to identify anomalous and malicious behaviors such as C&C communications.

Threat detection at the network layer for C&C server communication requires machine learning-based intelligence and signature matching, which GuardDuty provides out-of-the-box using VPC Flow Logs.

Configure real-time event routing for automated response.

An Amazon EventBridge rule is created to match GuardDuty findings (specifically those indicating outbound C&C communication) and target an AWS Lambda function.

EventBridge enables event-driven automation in response to security findings within seconds of detection.

Implement the blocking mechanism at the subnet level.

The AWS Lambda function modifies the Network Access Control List (NACL) of the target private subnet to add inbound and outbound DENY rules targeting the malicious IP address.

To block traffic at the subnet boundary, stateless NACLs must be used because Security Groups do not support DENY rules. Since NACLs are stateless, separate rules for both inbound and outbound traffic are required to fully isolate the subnet from the malicious destination.

Key Concept

Security Monitoring, Automated Threat Detection, and Subnet-Level Network Security Controls

Question 1183Question →

A solutions architect is designing a high-performance web application. The application tier runs on Amazon EC2 instances inside an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The application listens on a custom port $8443$ . The ALB is configured with a target group targeting the EC2 instances. The solutions architect configures the security group of the EC2 instances to accept incoming TCP traffic on port $8443$ from the ALB's security group. However, the instances are showing as unhealthy in the target group, and users receive a HTTP $502$ Bad Gateway error. The subnets containing the EC2 instances are associated with a custom Network Access Control List (Network ACL). Which TWO configurations must the solutions architect verify or modify to resolve the health check issues and restore service? (Select two.)

Select all that apply

Configure the health check port in the ALB target group settings to use port

8443

instead of the default port.

Verify that the custom Network ACL has an inbound rule allowing traffic on port

8443

and an outbound rule allowing traffic on ephemeral ports

1024-65535

for the EC2 subnet.

Modify the EC2 instances' security group to allow inbound traffic on port

80

, as target group health checks are always forwarded to port

80

by default regardless of target group configurations.

Change the subnet Network ACL to be stateful so that return traffic from the EC2 instances to the ALB is automatically allowed without requiring an explicit outbound rule.

Configure Amazon Route 53 with a latency routing policy pointing to the ALB to bypass the unhealthy targets when health checks fail.

Show answer & explanation

Answer: Configure the health check port in the ALB target group settings to use port $8443$ instead of the default port.; Verify that the custom Network ACL has an inbound rule allowing traffic on port $8443$ and an outbound rule allowing traffic on ephemeral ports $1024-65535$ for the EC2 subnet.

Answer

The solutions architect must configure the health check port in the target group settings to use port

8443

, and verify that the custom Network ACL allows inbound traffic on port

8443

and outbound traffic on ephemeral ports

1024-65535

for the EC2 subnet.

The correct options involve configuring the target group health check to point to the actual application port (port

8443

) and ensuring that the stateless Network ACL has rules allowing inbound traffic on port

8443

and outbound traffic on the ephemeral port range (

1024-65535

) to allow health check probes and responses to pass successfully.

Step-by-Step Solution

Analyze target group health check configuration.

Identify that because the application is listening on custom port

8443

, health checks targeting the default port (like port

80

) will fail if the instances do not listen on port

80

Health checks must target the correct port on which the web application is running to verify its status.

Review Network ACL behavior and rules.

Determine that Network ACLs are stateless, which requires outbound traffic rules for response traffic on ephemeral ports (

1024-65535

) in addition to inbound traffic rules.

Since the ALB communicates with the target group, the subnet containing the EC2 instances must allow return traffic to the ALB's ephemeral ports.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) Target Health Checks and Stateless Network Security with Network ACLs

Question 1184Question →

A company is building a serverless ETL pipeline using AWS Glue. The pipeline runs multiple jobs that need to connect to an on-premises database. To establish this connection, the Glue jobs require a database password that is subject to a strict regulatory policy requiring rotation every 60 days. The jobs also require the database port number, which is static and does not contain sensitive information. The solutions architect must design a secure, cost-effective solution with minimal operational overhead.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.

Store the database port number in AWS Systems Manager Parameter Store as a String parameter.

Store the database password in AWS Systems Manager Parameter Store as a String parameter to avoid the monthly cost of AWS Secrets Manager.

Enable automatic rotation on the AWS KMS customer managed key (CMK) used for encryption to automatically rotate the database password every 60 days.

Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter and enable the native Parameter Store automatic 60-day rotation feature.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.; Store the database port number in AWS Systems Manager Parameter Store as a String parameter.

Answer

Store the database password in AWS Secrets Manager with AWS Lambda-based automatic rotation, and store the database port number in AWS Systems Manager Parameter Store as a String parameter.

To securely manage the database password with automatic 60-day rotation, AWS Secrets Manager is the optimal choice because it integrates with AWS Lambda to orchestrate credential rotation on databases. For the non-sensitive and static database port number, AWS Systems Manager Parameter Store as a standard String parameter is the most cost-effective solution because Parameter Store does not charge for standard parameters.

Step-by-Step Solution

Analyze configuration requirements and separate sensitive data from non-sensitive data.

The database password is identified as sensitive and requires rotation; the database port is identified as static and non-sensitive.

This separation allows for a cost-effective design where expensive secrets management is only used for data that strictly requires it.

Select the appropriate storage service for the database password.

Choose AWS Secrets Manager, encrypt it with KMS, and configure an AWS Lambda function to rotate the password every 60 days.

Secrets Manager natively supports automatic rotation of credentials, which meets the 60-day rotation requirement with minimal operational overhead.

Select the appropriate storage service for the database port.

Choose AWS Systems Manager Parameter Store and store it as a standard String parameter.

Parameter Store standard parameters are free and ideal for non-sensitive, static parameters, avoiding unnecessary Secrets Manager costs.

Key Concept

Selecting the appropriate AWS service for secrets versus parameters based on security, rotation requirements, and cost-effectiveness.

Question 1185Question →

A media streaming company hosts its transcoding fleet on Amazon EC2 instances inside a private subnet. The security team needs to ensure that all network interfaces adhere strictly to corporate security standards. Specifically, they must detect any modifications that open restricted ports to unauthorized CIDR blocks, automatically flag these instances as non-compliant, and immediately notify the security operations center. Which combination of AWS services should the solutions architect recommend to implement this security monitoring system? (Select TWO.)

Select all that apply

Enable AWS Config and configure the restricted-common-ports managed rule to evaluate whether security groups are blocking restricted port traffic.

Create an Amazon EventBridge rule that detects AWS Config compliance status changes and triggers an Amazon Simple Notification Service (Amazon SNS) topic to alert the security operations center.

Deploy AWS Shield Advanced to inspect incoming packets at the subnet level and automatically revert modifications made to the security groups.

Configure stateless Network ACLs on the private subnet to track change actions and automatically block administrative traffic at the instance level.

Use AWS account root user credentials to schedule a daily script that queries security group settings and sends emails directly via SMTP.

Show answer & explanation

Answer: Enable AWS Config and configure the restricted-common-ports managed rule to evaluate whether security groups are blocking restricted port traffic.; Create an Amazon EventBridge rule that detects AWS Config compliance status changes and triggers an Amazon Simple Notification Service (Amazon SNS) topic to alert the security operations center.

Answer

Enable AWS Config with the restricted-common-ports rule to monitor compliance, and create an Amazon EventBridge rule targeting an Amazon SNS topic to notify the security team when compliance status changes.

The correct solution uses AWS Config to monitor and record changes to security groups and evaluate them against compliance rules (such as restricted-common-ports). Amazon EventBridge receives state change events from AWS Config and triggers Amazon SNS to send immediate alerts to the security team.

Step-by-Step Solution

Select a tool to audit configurations.

Identify AWS Config as the appropriate service for auditing, recording, and evaluating AWS resource configurations.

AWS Config maintains a configuration history and evaluates compliance against managed or custom rules.

Determine the alerting mechanism.

Combine Amazon EventBridge and Amazon SNS.

AWS Config publishes compliance change events to Amazon EventBridge, which can target Amazon SNS to deliver real-time notifications.

Eliminate inappropriate services for configuration auditing.

Discard options suggesting AWS Shield, Network ACLs, or root user scripts.

Shield is for DDoS protection, Network ACLs are stateless subnet traffic filters, and using the root user violates the principle of least privilege.

Key Concept

Continuous security compliance monitoring and automated alerting using AWS Config, Amazon EventBridge, and Amazon SNS.

Question 1186Question →

A company is designing a disaster recovery (DR) strategy for a database on AWS. The company requires a Recovery Point Objective (RPO) of $1$ hour and a Recovery Time Objective (RTO) of $15$ minutes. The solutions architect wants to minimize ongoing running costs. Which of the following strategies meets these requirements at the lowest cost?

A Pilot Light strategy that replicates the database data to the secondary AWS Region, runs a minimal database instance, and provisions the application servers from Amazon Machine Images (AMIs) during a failover.

A Pilot Light strategy that keeps all application servers stopped in the secondary region, expecting them to process live traffic immediately with zero startup time upon DNS failover.

A database replication strategy that copies data to an Amazon RDS Read Replica in the secondary region, and configures the application to write directly to the Read Replica during a failover without promoting it.

A Backup and Restore strategy that stores database backups in Amazon S3 Glacier Flexible Retrieval, and uses standard retrieval to restore the database to a new instance within the

15

-minute failover window.

Show answer & explanation

Answer: A Pilot Light strategy that replicates the database data to the secondary AWS Region, runs a minimal database instance, and provisions the application servers from Amazon Machine Images (AMIs) during a failover.

Answer

The correct strategy is a Pilot Light architecture. In this setup, critical data such as the database is replicated to the disaster recovery region and kept active, while application servers remain unprovisioned (or exist only as AMIs) to minimize ongoing costs. The application servers can be quickly provisioned from AMIs during failover, which satisfies the

15

-minute RTO.

Step-by-Step Solution

Analyze the RTO and RPO requirements.

The RPO is

1

hour (permits minimal data loss) and the RTO is

15

minutes (demands fast recovery).

This determines which DR strategies are capable of meeting the recovery window.

Evaluate the cost constraint.

Backup and Restore is too slow for a

15

-minute RTO. Warm Standby and Multi-site are too expensive. Pilot Light is the most cost-effective strategy that can meet the RTO.

We must find the strategy that satisfies the recovery objectives at the lowest ongoing running cost.

Identify the correct implementation of the Pilot Light strategy.

Replicating data to an active database and keeping application servers unprovisioned until failover meets both the cost and RTO requirements.

This matches the definition of a Pilot Light strategy.

Key Concept

Disaster recovery strategies differ in cost and recovery times. Pilot Light maintains database replication with minimal resources and provisions the rest of the application stack only during failover, offering a balance of low cost and quick recovery.

Estimated Time:1m 0s

Question 1187Question →

A solutions architect is configuring an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances running a web service on custom port $8080$ . The instances are managed by an Auto Scaling group. The solutions architect notices that the load balancer is marking all instances as unhealthy. The service is running on the instances, and security groups allow traffic on port $8080$ . What is the most likely cause of this issue?

The security group on the EC2 instances does not allow outbound return traffic on port

8080

because security groups are stateless.

Amazon Route 53 is using latency routing to direct health check traffic to the closest instance rather than using the load balancer.

The target group health check is configured to query the default port

80

instead of port

8080

The Application Load Balancer is unable to perform health checks because target groups only support health checks on port

80

or port

443

Show answer & explanation

Answer: The target group health check is configured to query the default port $80$ instead of port $8080$ .

Answer

The target group health check is configured to query the default port

80

instead of port

8080

The correct answer is correct because the web application listens on port

8080

, but the health check port is misconfigured to query the default port

80

. Since no service is listening on port

80

, the health checks fail and the instances are marked as unhealthy. Setting the health check port to

8080

or utilizing the traffic port resolves the mismatch.

Step-by-Step Solution

Analyze the web service port configuration and health check behavior.

The web service runs on port

8080

, but if the health check is misconfigured to target port

80

, requests will fail since no service listens on port

80

Health checks must target a port where the application is listening to return a successful response.

Evaluate the statefulness of security groups.

Security groups are stateful, so outbound return traffic is automatically allowed.

Understanding security group statefulness helps rule out return-traffic blockages as a cause.

Identify Route 53 routing policy limitations.

Route 53 resolves client queries to the load balancer but does not perform target-level health check routing.

This rules out DNS routing policy misconfigurations.

Key Concept

ELB Target Group Health Check Port Configuration

Question 1188Question →

A software-as-a-service (SaaS) provider hosts a financial analytics dashboard on AWS. The static assets of the dashboard are stored in an Amazon S3 bucket. The backend application runs on Amazon EC2 instances in private subnets behind an Application Load Balancer (ALB) and retrieves market analytics data from an Amazon Aurora PostgreSQL database. During periods of high market volatility, users experience slow dashboard loading times, and the database CPU utilization spikes due to a high volume of read queries for identical market data. Which two actions should a solutions architect recommend to optimize response times and reduce the load on the database? (Select TWO.)

Select all that apply

Configure an Amazon CloudFront distribution with the Amazon S3 bucket as the origin to cache and serve the static assets.

Implement Amazon ElastiCache for Redis in front of the Aurora PostgreSQL database to cache query results.

Create an Amazon CloudFront distribution for the static assets, and configure a cache behavior with the Minimum TTL, Maximum TTL, and Default TTL set to 0.

Export frequently queried market analytics reports to an Amazon S3 Standard-Infrequent Access (S3 Standard-IA) bucket and update them every 15 minutes for users to download directly.

Configure the EC2 instances to retrieve static assets from the S3 bucket through a NAT Gateway to ensure low-latency internal data path delivery.

Show answer & explanation

Answer: Configure an Amazon CloudFront distribution with the Amazon S3 bucket as the origin to cache and serve the static assets.; Implement Amazon ElastiCache for Redis in front of the Aurora PostgreSQL database to cache query results.

Answer

The solutions architect should configure an Amazon CloudFront distribution with the Amazon S3 bucket as the origin to serve static assets, and implement Amazon ElastiCache for Redis in front of the Aurora PostgreSQL database to cache query results.

Caching static content at edge locations using CloudFront minimizes user retrieval latency and reduces overall origin load. Caching database queries using ElastiCache for Redis offloads repetitive read requests from Aurora, dramatically reducing database CPU usage during peak traffic.

Step-by-Step Solution

Analyze the bottlenecks in the current architecture.

Slow loading times are caused by serving static assets directly or querying the database repeatedly for identical data.

Identifying the root causes helps in choosing the correct caching layers.

Address static asset delivery latency.

Amazon CloudFront is configured to edge cache static content from the S3 bucket.

CloudFront speeds up static content delivery and offloads origin requests.

Address relational database query load.

Amazon ElastiCache for Redis is deployed to store and retrieve frequent, repetitive database queries.

ElastiCache provides sub-millisecond response times for cached queries and reduces database CPU utilization.

Key Concept

Multi-tier caching using CloudFront for edge content delivery and ElastiCache for database query caching.

Question 1189Question →

A company is designing a cost-effective infrastructure for two new workloads and an existing database on AWS:

1. A backend application running on Amazon EC2 instances that runs continuously 24/7 with a baseline of 10 instances. Every Friday, a batch reporting job runs for 8 hours, requiring an additional 20 instances. These batch jobs are stateless, fault-tolerant, and can be resumed if interrupted.
2. A containerized microservices application running on Amazon ECS. The workload has highly unpredictable, dynamic traffic, and the company wants to minimize server provisioning and operational overhead.
3. An Amazon RDS for PostgreSQL database instance that runs continuously 24/7.

Which of the following strategies should a solutions architect select to meet these requirements at the lowest cost? (Select TWO.)

Select all that apply

Purchase a Compute Savings Plan to cover the baseline 10 EC2 instances and the ECS Fargate tasks.

Launch the weekly Friday batch reporting jobs on Amazon EC2 Spot Instances.

Purchase a Compute Savings Plan to cover the baseline 10 EC2 instances, the ECS Fargate tasks, and the Amazon RDS for PostgreSQL database.

Host the continuous 24/7 backend application on AWS Lambda to eliminate server provisioning and minimize operational overhead.

Use AWS Cost Explorer to automatically scale down the EC2 instance fleet once the Friday batch reporting jobs complete.

Show answer & explanation

Answer: Purchase a Compute Savings Plan to cover the baseline 10 EC2 instances and the ECS Fargate tasks.; Launch the weekly Friday batch reporting jobs on Amazon EC2 Spot Instances.

Answer

Purchase a Compute Savings Plan to cover the baseline 10 EC2 instances and the ECS Fargate tasks, and launch the weekly Friday batch reporting jobs on Amazon EC2 Spot Instances.

The correct strategy combines a Compute Savings Plan to cover both the baseline 24/7 EC2 instances and the serverless ECS Fargate tasks (since Compute Savings Plans flexibly apply to both compute types), along with using Spot Instances for the short-lived, stateless, and interruptible Friday reporting jobs to maximize cost savings without commitment waste.

Step-by-Step Solution

Analyze the baseline workload and container hosting requirements to minimize management overhead.

The baseline of 10 EC2 instances runs 24/7, and the ECS microservices need serverless scaling (AWS Fargate) to minimize operational overhead.

AWS Fargate is the ideal launch type for Amazon ECS to eliminate server management. A Compute Savings Plan covers both EC2 and Fargate usage, offering significant discounts with high flexibility.

Analyze the periodic weekly Friday batch reporting job requirements.

The job runs for only 8 hours a week, and is stateless, fault-tolerant, and interruptible.

Since the workload is short-lived, stateless, and tolerant to interruptions, EC2 Spot Instances are the most cost-effective selection, avoiding commitment costs of Savings Plans or the higher rates of On-Demand.

Evaluate the database optimization and discount coverage scope.

The Amazon RDS instance runs 24/7, but cannot be covered by Compute Savings Plans.

Compute Savings Plans only cover EC2, Fargate, and Lambda. To optimize RDS costs, RDS Reserved Instances must be purchased separately.

Key Concept

Selecting appropriate compute hosting models and matching them with optimized purchasing options (Compute Savings Plans for baseline EC2/Fargate, Spot Instances for interruptible batch workloads) while understanding coverage scopes.

Question 1190Question →

A company is designing an automated serverless workflow to coordinate its customer onboarding process. The workflow must execute several steps, including identity verification, account creation, and waiting for the customer to upload a signed agreement, which can take up to 5 days. The processing logic for each step is short-lived, completing in under 2 seconds. The initial onboarding requests must be processed in the exact order they are received to prevent race conditions. The company wants to minimize compute and database costs, ensuring that they do not pay for idle resources while waiting for the customer's document. Which architecture should a solutions architect recommend to meet these requirements?

Configure an Amazon SQS FIFO queue to ingest the requests. Use an AWS Step Functions Standard Workflow to coordinate the onboarding process, invoking AWS Lambda functions for individual tasks, and pause the workflow using a task token callback until the signed document is uploaded.

Configure an Amazon SQS standard queue to ingest the requests. Use an AWS Step Functions Standard Workflow to coordinate the onboarding process, invoking AWS Lambda functions for individual tasks, and pause the workflow using a task token callback until the signed document is uploaded.

Configure an Amazon SQS FIFO queue to ingest the requests. Develop a single AWS Lambda function that executes the onboarding steps and uses an internal polling loop to check daily for the uploaded document until the onboarding process is complete.

Configure an Amazon SQS FIFO queue to ingest the requests. Use an AWS Step Functions Standard Workflow to coordinate the onboarding process, storing step metadata in an Amazon DynamoDB table configured with provisioned capacity.

Show answer & explanation

Answer: Configure an Amazon SQS FIFO queue to ingest the requests. Use an AWS Step Functions Standard Workflow to coordinate the onboarding process, invoking AWS Lambda functions for individual tasks, and pause the workflow using a task token callback until the signed document is uploaded.

Answer

Configure an Amazon SQS FIFO queue to ingest the requests, use an AWS Step Functions Standard Workflow to coordinate the onboarding process with task token callbacks to pause execution, and use AWS Lambda for short-lived tasks.

The correct architecture uses an Amazon SQS FIFO queue to guarantee the ordering of incoming requests, and orchestrates the multi-day onboarding process using an AWS Step Functions Standard Workflow. Standard Workflows are billed per state transition and can run for up to a year, making them highly cost-effective because the system does not pay for compute resources while waiting for the customer's signed document. Individual short-lived tasks are executed by AWS Lambda, which scales to zero and only bills for active execution time.

Step-by-Step Solution

Identify the messaging service that guarantees sequential processing.

An Amazon SQS FIFO queue is selected to process onboarding requests in the exact order they are received.

Standard SQS queues only provide best-effort ordering, which does not prevent race conditions.

Select the orchestration mechanism for a long-running, multi-day workflow.

An AWS Step Functions Standard Workflow is selected with a task token callback.

Standard Workflows can run for up to a year and are billed per state transition, ensuring the workflow can pause for up to 5 days at no cost.

Select the compute service for individual short-lived execution steps.

AWS Lambda is selected to run the 2-second processing steps.

Lambda is fully serverless, scales automatically, and only charges for the milliseconds of active compute time, scaling to zero when idle.

Key Concept

Integrating Amazon SQS FIFO queues with AWS Step Functions Standard Workflows allows orchestrating order-sensitive, long-running processes serverlessly without paying for idle compute time.

Estimated Time:2m 0s

Question 1191Question →

An enterprise retail organization is migrating its inventory management pipeline to AWS. The pipeline must process inventory state-change events generated by retail stores. The requirements are:

1. Event processing must be strictly ordered on a per-store basis to prevent race conditions in warehouse stock levels.
2. The events must be fanned out to two separate downstream microservices: a real-time inventory reconciliation service and a near-real-time business intelligence dashboard.
3. The total ingestion throughput across all stores is expected to exceed 15,000 messages per second, while individual store volume varies dynamically.

Which TWO configurations should a solutions architect combine to meet these requirements with the lowest operational overhead? (Select TWO.)

Select all that apply

Create an Amazon SNS FIFO topic and subscribe two Amazon SQS FIFO queues to the topic, setting the retail store ID as the Message Group ID for all published events.

Enable high-throughput FIFO for both the Amazon SNS FIFO topic and the subscribed Amazon SQS FIFO queues to support the required message throughput.

Configure an Amazon Kinesis Data Stream with the retail store ID as the partition key, and configure two independent consumers to process the stream.

Create an Amazon SNS Standard topic with two Amazon SQS Standard queues as subscribers, and rely on downstream services to re-sequence events using a custom timestamp header.

Ingest all events into a single Amazon SQS Standard queue first to handle high volume, and use an AWS Lambda function to route messages to separate SQS FIFO queues based on the store ID.

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic and subscribe two Amazon SQS FIFO queues to the topic, setting the retail store ID as the Message Group ID for all published events.; Enable high-throughput FIFO for both the Amazon SNS FIFO topic and the subscribed Amazon SQS FIFO queues to support the required message throughput.

Answer

The correct solution involves creating an Amazon SNS FIFO topic that fans out to two Amazon SQS FIFO queues, using the store ID as the Message Group ID, and enabling high-throughput FIFO mode on both the SNS topic and the SQS queues.

The correct solution uses an Amazon SNS FIFO topic to fan out inventory events to two Amazon SQS FIFO queues (one for each downstream service). By setting the store ID as the Message Group ID, messages are processed in order for each individual store while allowing parallel processing across different stores. To handle the 15,000 messages per second throughput, high-throughput FIFO mode must be enabled on both the SNS FIFO topic and the SQS FIFO queues, which scales the throughput limits.

Step-by-Step Solution

Analyze the ordering and fan-out requirements.

Identify that the system requires message ordering grouped by store ID and delivery to two independent downstream services.

Ordering requires FIFO capability (using a Message Group ID or partition key), and delivery to two independent services requires a pub/sub fan-out pattern.

Evaluate the throughput requirements against standard AWS service limits.

Identify that the total throughput of 15,000 messages/sec exceeds the default limit of SQS/SNS FIFO queues (which is 300 messages/sec without high-throughput mode).

High-throughput FIFO mode must be enabled to scale SQS and SNS FIFO to support 15,000 messages/sec.

Determine the configuration with the lowest operational overhead.

Select SNS FIFO subscribed to SQS FIFO with high-throughput mode enabled, rather than provisioning and managing Kinesis shards.

SNS/SQS is fully serverless and handles scaling automatically without manual shard management, minimizing operational overhead.

Key Concept

Decoupling event-driven architectures with high-throughput SNS FIFO and SQS FIFO to maintain ordering within specific message groups.

Question 1192Question →

A financial clearinghouse processes sensitive transactional data in its primary AWS Region (us-east-1). The current architecture consists of an Amazon Aurora PostgreSQL-Compatible Edition database cluster and an application tier running on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The clearinghouse must implement a disaster recovery (DR) strategy in a secondary Region (us-west-2) to ensure business continuity. The DR solution must achieve a Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 10 minutes, while minimizing ongoing compute costs. Which database and application deployment strategy should a solutions architect recommend to meet these requirements?

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In us-west-2, pre-deploy the ALB and an Auto Scaling group with the minimum capacity set to 1 instance. Configure Amazon Route 53 failover routing with health checks to direct traffic to the secondary Region, and automate the promotion of the secondary database cluster in the event of a primary Region failure.

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Create a launch template for the EC2 instances in us-west-2. Write an AWS Lambda function triggered by Amazon CloudWatch alarms to create the ALB, provision the Auto Scaling group from scratch, and promote the secondary database cluster only when a regional failover is initiated.

Configure cross-region database replication using an Amazon RDS PostgreSQL Read Replica in us-west-2. Deploy a fully provisioned Auto Scaling group behind an ALB in us-west-2. Use Route 53 latency-based routing to distribute traffic. In the event of a disaster, manually promote the read replica to a primary database instance and update the application configuration files with the new endpoint.

Configure daily backups of the Aurora cluster in us-east-1 and copy the snapshots to us-west-2, storing them in Amazon S3 Glacier Flexible Retrieval to minimize storage costs. Maintain a warm standby EC2 fleet behind an ALB in us-west-2. In the event of a disaster, initiate an expedited retrieval of the latest snapshot, restore the database cluster, and update Route 53 routing records.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In us-west-2, pre-deploy the ALB and an Auto Scaling group with the minimum capacity set to 1 instance. Configure Amazon Route 53 failover routing with health checks to direct traffic to the secondary Region, and automate the promotion of the secondary database cluster in the event of a primary Region failure.

Answer

The correct strategy uses Amazon Aurora Global Database to achieve an RPO of less than 1 second through storage-level replication. For the application tier, a Warm Standby approach (pre-deploying the Application Load Balancer and running a minimal Auto Scaling group capacity of 1 instance) ensures that the infrastructure is ready to accept traffic immediately and scale out, satisfying the 10-minute RTO. Route 53 failover routing with health checks automates the DNS switchover, and promoting the secondary Aurora cluster takes less than a minute.

Step-by-Step Solution

Analyze the RPO requirement of less than 1 minute.

Identify that daily snapshots (which have a 24-hour RPO) and standard RDS read replicas (which can experience high replication lag under write-heavy loads) are unsuitable. Amazon Aurora Global Database uses storage-level, dedicated physical replication with typical lag of less than 1 second, meeting the RPO.

Choosing the replication technology that guarantees minimal data loss is the first step in disaster recovery planning.

Analyze the RTO requirement of less than 10 minutes.

Determine that a Pilot Light strategy (where compute resources like ALBs and Auto Scaling groups are created from scratch) is too slow to guarantee recovery within 10 minutes due to resource provisioning and instance bootstrapping times. A Warm Standby strategy (where the ALB is pre-deployed and a minimum compute capacity is already running) is required to ensure immediate availability and fast scaling.

Computing provisioning times directly impact the recovery time (RTO), requiring pre-warmed compute components.

Evaluate routing and failover automation.

Confirm that Amazon Route 53 failover routing with health checks provides automated DNS redirection to the secondary Region. The promotion of the Aurora Global Database secondary cluster to primary can be automated via AWS Systems Manager or Lambda to execute within minutes.

Automated failover reduces manual operational steps, ensuring the RTO threshold is not breached during stress events.

Key Concept

Disaster Recovery (DR) Strategies (Warm Standby vs. Pilot Light) and Cross-Region Replication with Aurora Global Database

Question 1193Question →

A real estate listing platform hosts its application on AWS using Amazon EC2 instances and an Amazon RDS for PostgreSQL DB instance. The platform needs to establish a cost-effective disaster recovery (DR) plan in a secondary Region. The company specifies a Recovery Point Objective (RPO) of $24$ hours and a Recovery Time Objective (RTO) of $4$ hours. The DR plan must minimize ongoing running costs. Which TWO configurations should a solutions architect recommend to meet these requirements at the lowest cost?

Select all that apply

Configure daily automated snapshots of the RDS DB instance and copy them to the destination Region.

Store an AWS CloudFormation template of the application tier in an Amazon S3 bucket in the destination Region to deploy resources on demand.

Export the database backups directly to Amazon S3 Glacier Deep Archive daily to minimize storage costs.

Create a cross-region RDS Read Replica and use Amazon Route 53 latency routing to automatically redirect write traffic during a failover.

Deploy a Warm Standby environment in the destination Region with all EC2 instances running at full capacity to ensure zero startup time.

Show answer & explanation

Answer: Configure daily automated snapshots of the RDS DB instance and copy them to the destination Region.; Store an AWS CloudFormation template of the application tier in an Amazon S3 bucket in the destination Region to deploy resources on demand.

Answer

Configure daily automated snapshots of the RDS DB instance and copy them to the destination Region, and store an AWS CloudFormation template of the application tier in an Amazon S3 bucket in the destination Region to deploy resources on demand.

To meet an RPO of

24

hours and an RTO of

4

hours at the lowest cost, a Backup and Restore strategy is the ideal solution. Configuring daily automated snapshots of the database and copying them to the destination Region meets the

24

-hour RPO. Storing an AWS CloudFormation template in Amazon S3 in the secondary Region allows you to deploy the application's compute resources on demand within the

4

-hour window during a disaster, incurring no compute costs during normal operations.

Step-by-Step Solution

Analyze the RTO, RPO, and budget requirements.

The target requirements are RPO =

24

hours, RTO =

4

hours, and the strategy must minimize ongoing costs.

An RPO of

24

hours and an RTO of

4

hours allow for a Backup and Restore strategy, which is the most cost-effective disaster recovery strategy since no compute resources run actively in the backup Region.

Select the database replication strategy that meets the RPO at the lowest cost.

Choose daily database snapshots copied cross-region.

Creating daily snapshots fits the

24

-hour RPO, and copying them to the secondary Region incurs only standard storage costs, which is far cheaper than running a replica database.

Select the compute provisioning method that meets the RTO at the lowest cost.

Choose on-demand provisioning using AWS CloudFormation templates stored in S3.

AWS CloudFormation can provision the application tier in minutes, easily meeting the

4

-hour RTO while incurring zero ongoing compute costs prior to a failover event.

Key Concept

Disaster Recovery strategies on AWS range from Backup & Restore (lowest cost, highest RTO/RPO) to Active-Active (highest cost, lowest RTO/RPO). A Backup & Restore approach utilizes offline resources like snapshots and infrastructure-as-code templates to minimize running costs.

Question 1194Question →

An organization has migrated a legacy internal API to run on Amazon EC2 instances in an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The API service is bound to TCP port 5050 on the instances. After launching the new instances, the ALB reports all targets as unhealthy with a status of 502 Bad Gateway for client requests. The security group associated with the ALB allows traffic on port 443 from client networks. The instances are deployed in private subnets. Which configuration adjustments are required to restore service health and enable successful load balancing? (Select two.)

Select all that apply

Configure the security group of the EC2 instances to permit inbound TCP port 5050 traffic from the security group of the Application Load Balancer.

Update the ALB's target group settings to register targets on port 5050 and configure health checks to query the traffic port or port 5050.

Adjust the health check path in the target group to point to the default port 80 so that health monitoring is isolated from custom application ports.

Add a stateless rule to the Network Access Control List (Network ACL) of the instance subnets that redirects inbound TCP port 80 traffic to TCP port 5050.

Implement an Amazon Route 53 latency routing policy that redirects traffic directly to the individual EC2 instance IP addresses when the ALB health checks fail.

Show answer & explanation

Answer: Configure the security group of the EC2 instances to permit inbound TCP port 5050 traffic from the security group of the Application Load Balancer.; Update the ALB's target group settings to register targets on port 5050 and configure health checks to query the traffic port or port 5050.

Answer

Configure the security group of the EC2 instances to allow inbound traffic on TCP port 5050 from the ALB's security group, and update the ALB's target group settings to register targets on port 5050 and configure health checks to query port 5050.

To resolve the 502 Bad Gateway errors, the Application Load Balancer must be able to successfully connect to the EC2 instances on their active service port. This requires two configurations: first, updating the target group to send both application traffic and health checks to port 5050; second, modifying the security group of the EC2 instances to allow inbound TCP traffic on port 5050 from the ALB's security group.

Step-by-Step Solution

Ensure target group routing matches the application port

The target group is updated to register EC2 instances on port 5050, and the health check configuration is set to use the traffic port (5050) so that the ALB checks the actual service.

Since the API runs on port 5050, checking default port 80 will fail as no listener exists there.

Configure instance-level security groups to allow traffic from the load balancer

Inbound TCP port 5050 is allowed on the instances' security group, with the source set to the security group of the ALB.

The load balancer needs network-level access to forward client requests and health check probes to the instances on the application port.

Key Concept

Configuring target group port registration, health checks, and security group rules for custom ports behind an Application Load Balancer.

Question 1195Question →

A company hosts a stateful web application at the apex domain example.com. The primary environment is deployed in the us-east-1 Region behind an Application Load Balancer (ALB) and uses an Amazon RDS Multi-AZ DB instance. The disaster recovery (DR) environment is in the us-west-2 Region behind another ALB and uses a cross-Region RDS read replica. The company requires a warm standby DR strategy where the DR environment is scaled down but running. The failover to us-west-2 must happen automatically if the primary ALB or the database becomes unavailable. The company wants to use Route 53 DNS failover and needs to minimize the Recovery Time Objective (RTO) while avoiding split-brain data writes. How should the solutions architect configure this architecture?

Configure Route 53 Failover alias records at the apex domain pointing to the ALBs in both Regions, enabling Evaluate Target Health on both records. Ensure the primary ALB's health check endpoint queries the primary database's health, and establish a process to promote the us-west-2 RDS read replica if a failover occurs.

Configure Route 53 Latency alias records at the apex domain pointing to both ALBs, enabling Evaluate Target Health on both records. Rely on Route 53 to automatically shift user traffic to the us-west-2 Region if the database latency increases in us-east-1.

Configure Route 53 Failover alias records pointing to both ALBs. To minimize cost, keep the EC2 instances in the us-west-2 DR environment stopped, and configure an Amazon CloudWatch alarm on Route 53 health check failures to start the instances.

Configure Route 53 Failover alias records pointing to both ALBs. Rely on RDS Multi-AZ replication to automatically fail over the database to the us-west-2 Region, which will automatically update the DNS records.

Show answer & explanation

Answer: Configure Route 53 Failover alias records at the apex domain pointing to the ALBs in both Regions, enabling Evaluate Target Health on both records. Ensure the primary ALB's health check endpoint queries the primary database's health, and establish a process to promote the us-west-2 RDS read replica if a failover occurs.

Answer

The correct answer uses Route 53 Failover routing with Alias records pointing to the ALBs at the apex domain. Evaluating target health allows Route 53 to dynamically switch regions based on ALB health status. The primary ALB's health check is configured to query the database, ensuring that database failure also triggers the DNS failover. Because cross-Region database replication is asynchronous and does not automatically fail over, the secondary read replica must be promoted to primary during the failover process.

Step-by-Step Solution

Select the correct Route 53 routing policy for active-passive disaster recovery.

Determine that Route 53 Failover routing policy is required to direct all traffic to us-east-1 normally and fail over to us-west-2.

Failover routing is designed for active-passive setups, whereas policies like Latency routing act as active-active and would route normal write traffic to the read-only replica.

Identify how Route 53 can route the apex domain to ALBs with health check support.

Create Alias records pointing to the ALBs and set Evaluate Target Health to Yes.

CNAME records cannot be used at the zone apex. Route 53 Alias records resolve this restriction and allow Route 53 to inherit the health status of the ALB's target group without extra health check costs.

Configure the dependency between application health and database availability.

Ensure the ALB health check path queries database connectivity, and create a replica promotion plan.

If the database in us-east-1 fails, the ALB health check will fail, triggering Route 53 to redirect DNS queries to us-west-2. The read replica must then be promoted to allow writes.

Key Concept

Using Route 53 Failover Alias records with Evaluate Target Health for active-passive multi-region DR while managing database replica promotion.

Question 1196Question →

An application deployed on AWS needs to query a third-party weather forecasting service. The application requires access to two configuration settings: a sensitive API access token that must be rotated automatically every 30 days, and a non-sensitive API endpoint URL that does not change. To minimize costs while maintaining a secure architecture, which of the following configurations should a solutions architect recommend?

Store the API access token in AWS Secrets Manager and configure a custom AWS Lambda function to rotate the token every 30 days. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter.

Store both the API access token and the API endpoint URL as String parameters in AWS Systems Manager Parameter Store, and configure Parameter Store to rotate the token parameter automatically every 30 days.

Store the API access token as a SecureString parameter in AWS Systems Manager Parameter Store, and enable automatic rotation of the associated KMS Customer Managed Key (CMK) every 30 days to rotate the token value.

Store the API access token in AWS Systems Manager Parameter Store as a String parameter, and use a custom AWS Lambda function to encrypt the parameter and rotate the backing KMS key every 30 days.

Show answer & explanation

Answer: Store the API access token in AWS Secrets Manager and configure a custom AWS Lambda function to rotate the token every 30 days. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter.

Answer

The correct configuration uses AWS Secrets Manager for the sensitive API access token because it provides secure encryption and supports automated rotation through custom AWS Lambda functions. To minimize costs, the non-sensitive, static API endpoint URL is stored in AWS Systems Manager Parameter Store as a standard String parameter, which is free of charge.

Step-by-Step Solution

Evaluate the sensitivity and rotation requirements for each parameter.

The API access token is sensitive and requires automatic rotation every 30 days. The API endpoint URL is non-sensitive and static.

This determines which AWS service is best suited for each configuration setting based on security, features, and cost.

Select the appropriate storage service for the sensitive API token.

AWS Secrets Manager is selected because it encrypts secrets at rest and natively integrates with AWS Lambda to orchestrate custom rotation schedules (e.g., every 30 days) for third-party APIs.

Systems Manager Parameter Store does not natively support automatic rotation of parameters, and storing secrets in plaintext is insecure.

Select the appropriate storage service for the non-sensitive endpoint URL.

AWS Systems Manager Parameter Store (using a standard String parameter) is selected.

Standard parameters in Parameter Store are free of charge, making this the most cost-effective choice for non-sensitive, static configuration settings, whereas storing it in Secrets Manager would incur unnecessary costs.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on security, rotation requirements, and cost.

Question 1197Question →

A genomic research company runs a continuous, 24/7 data-ingestion pipeline on Amazon EC2 instances with a highly predictable baseline load. The company also runs containerized data analysis workloads on Amazon ECS using AWS Fargate that can tolerate interruptions and can be restarted from checkpoints. Finally, they maintain a persistent Multi-AZ Amazon RDS for PostgreSQL database instance. The company wants to implement a purchasing strategy to maximize cost savings across these workloads. Which combination of purchasing options meets these requirements most cost-effectively?

Purchase a Compute Savings Plan to cover the EC2 instances, the Fargate tasks, and the RDS database.

Purchase a Compute Savings Plan to cover the EC2 instances and the RDS database, and run the Fargate tasks on Fargate Spot.

Purchase a Compute Savings Plan for the EC2 instances, run the ECS tasks on Fargate Spot, and purchase an Amazon RDS Reserved DB Instance.

Use EC2 Spot Instances for the data-ingestion pipeline, run the ECS tasks on Fargate Spot, and purchase a Compute Savings Plan for the RDS database.

Show answer & explanation

Answer: Purchase a Compute Savings Plan for the EC2 instances, run the ECS tasks on Fargate Spot, and purchase an Amazon RDS Reserved DB Instance.

Answer

Purchase a Compute Savings Plan for the EC2 instances, run the ECS tasks on Fargate Spot, and purchase an Amazon RDS Reserved DB Instance.

The correct option properly matches the workloads to their respective optimized purchasing models: the continuous EC2 instances are covered by a Compute Savings Plan, the interruptible ECS Fargate tasks run on Fargate Spot, and the persistent Amazon RDS database is covered by an RDS Reserved DB Instance.

Step-by-Step Solution

Analyze the EC2 data-ingestion workload.

The pipeline runs 24/7 and has a highly predictable baseline load. Applying a Compute Savings Plan yields significant savings over On-Demand rates with a 1-year or 3-year commitment.

Baseline, continuous EC2 workloads are best optimized using Savings Plans or Reserved Instances.

Analyze the ECS Fargate workload.

The containerized tasks are stateless, run irregularly, and can tolerate interruptions. Fargate Spot is the most cost-effective option, offering up to a 70% discount compared to standard Fargate pricing.

Workloads that are interruptible and can resume from checkpoints are ideal candidates for Spot capacity.

Analyze the RDS PostgreSQL workload and identify the correct purchasing model scope.

The database is persistent and runs continuously. Compute Savings Plans do not apply to Amazon RDS. Therefore, an Amazon RDS Reserved DB Instance must be purchased to reduce database costs.

Compute Savings Plans only cover EC2, Fargate, and Lambda. Non-compute services like RDS require specific Reserved DB Instance commitments.

Key Concept

Selecting cost-optimized compute purchasing strategies based on workload predictability and service-specific savings plan boundaries.

Estimated Time:2m 0s

Question 1198Question →

An e-commerce application uses an Amazon RDS for MySQL Multi-AZ DB instance. During flash sales, CPU utilization on the database spikes to $100\%$ due to a massive influx of read queries for product catalog details, causing application timeouts. The catalog data is updated only once per day. Which architecture should a solutions architect recommend to resolve this performance bottleneck with the lowest latency?

Migrate the product catalog to an Amazon DynamoDB table using a partition key based on a monotonically increasing timestamp of the product upload to ensure sequential read performance.

Configure RDS Read Replicas in the primary Availability Zone and configure the application to use the replica endpoints as the primary target for write traffic and disaster recovery failover during peak periods.

Deploy an Amazon ElastiCache for Redis cluster in front of the RDS DB instance to cache product catalog queries, and configure the application to check the cache before querying the database.

Migrate the product catalog to an Amazon DynamoDB table configured with provisioned capacity mode to automatically scale and absorb the highly unpredictable and sudden spikes in read traffic.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster in front of the RDS DB instance to cache product catalog queries, and configure the application to check the cache before querying the database.

Answer

Deploying an Amazon ElastiCache for Redis cluster in front of the RDS DB instance to cache product catalog queries.

Caching the static product catalog in Amazon ElastiCache for Redis offloads the read traffic from the database, delivering microsecond response times and lowering CPU utilization to resolve the bottleneck.

Step-by-Step Solution

Analyze the workload characteristics and database bottleneck.

The workload is read-heavy on static catalog data that changes infrequently, causing high CPU usage (

100\%

) on the RDS database.

Understanding the query pattern helps identify whether caching or database scaling is the most appropriate remedy.

Select a caching strategy to offload read queries.

Amazon ElastiCache for Redis is chosen to store database query results for the product catalog.

Caching static, read-intensive data in memory provides sub-millisecond response times and prevents the queries from reaching the database.

Configure the application to utilize the cache.

The application code is modified to check the ElastiCache cluster first. If the data is present (cache hit), it is returned. If not (cache miss), the RDS database is queried and the cache is updated.

This implementation successfully bypasses the database for subsequent read requests, resolving the CPU bottleneck.

Key Concept

Database Caching with Amazon ElastiCache

Estimated Time:1m 30s

Question 1199Question →

A smart utility provider receives water consumption telemetry reports from $500,000$ smart meters. These meters upload data in unpredictable bursts three times a day. The processing pipeline requires strict message ordering for each smart meter to compute usage trends accurately. Each batch processing job performs complex analytics that runs continuously for $20$ to $25$ minutes per batch. The final results are stored in an Amazon DynamoDB table. The provider wants to design a highly cost-effective, serverless backend architecture that minimizes operational overhead.

Which combination of actions will meet these requirements most cost-effectively? (Select TWO.)

Select all that apply

Use Amazon SQS standard queues to ingest the telemetry data.

Use Amazon SQS FIFO queues to ingest the telemetry data.

Deploy the analytics application on AWS Lambda functions.

Deploy the analytics application as containerized tasks using Amazon ECS on AWS Fargate.

Configure the target Amazon DynamoDB table with provisioned capacity mode.

Show answer & explanation

Answer: Use Amazon SQS FIFO queues to ingest the telemetry data.; Deploy the analytics application as containerized tasks using Amazon ECS on AWS Fargate.

Answer

The correct architecture uses Amazon SQS FIFO queues to ingest the telemetry data and deploys the analytics application as containerized tasks using Amazon ECS on AWS Fargate.

To satisfy the requirements cost-effectively, the solution must handle spiky workloads, preserve message ordering, and support execution runtimes longer than

15

minutes without manual server management. Amazon SQS FIFO queues ensure strict ordering per smart meter. Amazon ECS on AWS Fargate is serverless, scales to zero when no messages are in the queue, and supports long-running tasks without the execution timeout limit of AWS Lambda.

Step-by-Step Solution

Analyze the ingestion and message ordering requirements.

Determine that Amazon SQS FIFO queues are necessary to ensure strict ordering of messages per smart meter, preventing standard SQS queue out-of-order delivery.

Correct trend calculations require telemetry data to be processed in the exact order it was generated.

Evaluate the compute execution duration limits.

Select Amazon ECS on AWS Fargate for the batch processing jobs, rejecting AWS Lambda.

AWS Lambda functions will time out due to the

15

-minute limit, whereas AWS Fargate tasks can run for the required

20

25

minutes and scale dynamically to zero when idle.

Assess the database access pattern and capacity needs.

Identify that the DynamoDB table should use on-demand capacity mode rather than provisioned mode.

On-demand capacity mode eliminates the cost of provisioning for peak spiky bursts and charges only for the actual read/write requests made.

Key Concept

Serverless and Automated Scaling Architectures for Cost Efficiency

Estimated Time:2m 0s

Question 1200Question →

A company is designing the database architecture for a web application that manages ticket sales. The database requirements are split into two categories:

* Ticket transaction records: The write workload is highly unpredictable, experiencing extreme surges up to $15,000$ writes per second during flash sales, but dropping to near zero for most of the week.
* User profile sessions: The read workload is highly predictable with a stable baseline of $2,000$ reads per second throughout the day. Low latency under $10\text{ ms}$ is required.

Which TWO strategies should a solutions architect recommend to design a highly cost-optimized database tier that meets these requirements? (Select TWO.)

Select all that apply

Store ticket transaction records in an Amazon DynamoDB table configured in On-Demand capacity mode.

Store user profile sessions in an Amazon DynamoDB table configured in Provisioned capacity mode with Auto Scaling enabled.

Store ticket transaction records in an Amazon DynamoDB table configured in Provisioned capacity mode with a static capacity of

15,000

write capacity units.

Store ticket transaction records in an Amazon RDS for PostgreSQL Multi-AZ DB cluster, using read replicas as the primary automated disaster recovery failover mechanism.

Store user profile sessions in an Amazon DynamoDB table configured in On-Demand capacity mode to handle the reads.

Show answer & explanation

Answer: Store ticket transaction records in an Amazon DynamoDB table configured in On-Demand capacity mode.; Store user profile sessions in an Amazon DynamoDB table configured in Provisioned capacity mode with Auto Scaling enabled.

Answer

Store ticket transaction records in an Amazon DynamoDB table configured in On-Demand capacity mode, and store user profile sessions in an Amazon DynamoDB table configured in Provisioned capacity mode with Auto Scaling enabled.

The correct strategy involves combining DynamoDB On-Demand capacity mode for the highly unpredictable ticket transaction workloads and Provisioned capacity mode with Auto Scaling for the stable, predictable user profile session workloads. On-Demand mode instantly handles surges up to

15,000

writes without throttling or paying for idle time, which is highly cost-effective for spiky traffic. Provisioned capacity mode with Auto Scaling is more cost-effective for predictable workloads because it provides a lower unit cost for a guaranteed baseline of traffic.

Step-by-Step Solution

Analyze the ticket transaction workload characteristics.

The ticket transaction workload is highly spiky and unpredictable, ranging from zero to

15,000

writes per second.

Understanding the traffic pattern helps determine whether On-Demand or Provisioned capacity mode in DynamoDB is more cost-effective.

Select the optimal DynamoDB capacity mode for ticket transaction records.

Amazon DynamoDB On-Demand capacity mode is chosen.

Since the traffic has extreme surges and drops to zero, provisioned capacity would either lead to throttling (if scaled too slowly) or extreme waste (if over-provisioned). On-Demand mode accommodates instant spikes without manual planning and charges only for what is used.

Analyze the user profile sessions workload characteristics.

The session workload is highly predictable with a stable baseline of

2,000

reads per second.

Predictable baselines allow for provisioning capacity units to lower costs.

Select the optimal DynamoDB capacity mode for user profile sessions.

Amazon DynamoDB Provisioned capacity mode with Auto Scaling is chosen.

For a stable and predictable read volume, provisioned capacity is significantly cheaper per request than On-Demand mode. Auto Scaling can handle any minor deviations cost-effectively.

Key Concept

Cost-optimized database capacity planning requires matching database capacity modes to workload predictability. Use On-Demand capacity for spiky, unpredictable workloads, and Provisioned capacity with Auto Scaling for predictable baselines.

PreviousPage 60 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept