Examkin

All practice questions

1462 questions

All types1,462Multiple choice739Multiple select723
Question 1281Question →

A healthcare SaaS provider hosts a critical patient portal on AWS. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in the primary Region (us-east-1). The database tier runs on an Amazon Aurora PostgreSQL DB cluster. The provider wants to implement a cross-region disaster recovery (DR) strategy in a secondary Region (us-west-2). The business SLA mandates a Recovery Time Objective (RTO) of 15 minutes15\text{ minutes} and a Recovery Point Objective (RPO) of 1 minute1\text{ minute}. The solution must minimize infrastructure costs during normal operations in the primary Region.

Which combination of actions will meet these requirements at the lowest cost? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Amazon Aurora Global Database with a secondary DB cluster in the secondary Region, and configure the secondary DB cluster with zero DB instances under normal operating conditions.; Pre-deploy the Application Load Balancer and the Auto Scaling group in the secondary Region with both the desired and minimum capacity set to 00, and use a failover script to scale up the instances during a disaster recovery event.

Answer

Configure Amazon Aurora Global Database with a secondary DB cluster containing zero DB instances, and pre-deploy the Application Load Balancer and Auto Scaling group with the capacity set to zero, scaling up the instances and databases via automation during failover.
To satisfy a Recovery Point Objective (RPO) of 1 minute1\text{ minute} and a Recovery Time Objective (RTO) of 15 minutes15\text{ minutes} at the lowest cost, a Pilot Light DR pattern is ideal. By leveraging Amazon Aurora Global Database, storage replication is continuous and automatic with sub-second latency, satisfying the 1-minute1\text{-minute} RPO. Keeping the secondary database cluster headless (zero DB instances) under normal conditions ensures zero database compute costs. Pre-deploying the Application Load Balancer and configuring the Auto Scaling group with a desired capacity of 00 ensures zero compute costs for the application tier during normal operations. During a disaster, automated scripts can spin up DB instances in the secondary Region, promote the secondary Aurora cluster, and scale up the Auto Scaling group to launch EC2 instances, recovering the application well within the 15-minute15\text{-minute} RTO.

Step-by-Step Solution

1
Analyze the database replication and RPO requirement.
To meet the 1-minute1\text{-minute} RPO, continuous physical or logical replication is required. Amazon Aurora Global Database replicates storage updates across Regions with latency of less than 1 second1\text{ second}, meeting the RPO.
Traditional backup methods like hourly snapshots or S3 backups cannot guarantee a 1-minute1\text{-minute} RPO.
2
Analyze the database compute and cost requirement.
Configure a secondary DB cluster in the Global Database with zero running DB instances (headless cluster) to eliminate running compute costs during normal operations.
During failover, adding a new DB instance to the secondary cluster and promoting it takes only a few minutes, which is well within the 15-minute15\text{-minute} RTO.
3
Analyze the application tier compute and cost requirement.
Deploy the Application Load Balancer and Auto Scaling group in the secondary Region with desired capacity set to 00.
This Pilot Light strategy incurs zero EC2 running costs under normal conditions. During failover, the Auto Scaling group capacity can be scaled up to launch EC2 instances and receive traffic within the 15-minute15\text{-minute} window.

Key Concept

Disaster recovery (DR) architectures on AWS utilize different patterns (such as Pilot Light and Warm Standby) to balance cost, Recovery Time Objective (RTO), and Recovery Point Objective (RPO). A Pilot Light architecture keeps database replication active (often headless or minimal) and compute resources scaled down to zero, provisioning them dynamically via automated scripts during failover to meet RTOs in the range of tens of minutes while minimizing baseline run costs.
Estimated Time:2m 30s
Question 1282Question →

A telemetry processing company is deploying an application on Amazon EC2 instances to analyze high-frequency sensor streams. The application components are distributed across multiple instances and require the lowest possible node-to-node network latency for internal synchronization. The external ingestion traffic is received on a custom TCP port 5050 via a Network Load Balancer (NLB). The instances do not run any web server on port 80. During initial deployment, the NLB marks all instances as unhealthy because the target group health checks are querying the default port 80. Which combination of actions will achieve the required network performance and resolve the health check issues?

Show answer & explanation

Answer: Launch the instances within a cluster placement group, and modify the target group health check configuration to use port 5050.

Answer

Launch the instances within a cluster placement group, and modify the target group health check configuration to use port 5050.
Launching the EC2 instances in a cluster placement group ensures that the instances are placed physically close to each other in the same Availability Zone, which minimizes node-to-node latency and maximizes network throughput. Correcting the target group health check port to use the custom application port ensures that the load balancer correctly validates the service's availability, allowing the instances to pass the health checks.

Step-by-Step Solution

1
Determine the appropriate Amazon EC2 placement group strategy for low-latency node-to-node communication.
A cluster placement group is selected because it groups instances physically close together within a single Availability Zone, enabling low-latency, high-throughput network performance.
This satisfies the requirement for sub-millisecond node-to-node synchronization latency between telemetry processing nodes.
2
Identify the cause of the load balancer health check failure and configure the correct health check port.
The target group health check configuration is updated from the default port 80 to TCP port 5050.
Since the application runs on port 5050 and no service is listening on port 80, the default health check port must be changed to prevent the NLB from marking the targets as unhealthy.

Key Concept

Amazon EC2 Placement Groups and Elastic Load Balancing Health Checks
Estimated Time:1m 30s
Question 1283Question →

A retail corporation manages multiple AWS accounts using AWS Organizations. The security team wants to establish a centralized security monitoring solution to detect threats, such as anomalous behavior or unauthorized API calls, and aggregate security compliance findings across all member accounts. The solution must align with the AWS Well-Architected Framework.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty in all accounts, and designate a security account as the delegated administrator to centrally manage threat detection findings.; Enable AWS Security Hub in all accounts, and designate the security account as the delegated administrator to aggregate security and compliance alerts.

Answer

Enable Amazon GuardDuty in all accounts with a delegated administrator, and enable AWS Security Hub in all accounts with a delegated administrator.
The correct options are enabling Amazon GuardDuty and AWS Security Hub with delegated administrator accounts. GuardDuty leverages machine learning, anomaly detection, and threat intelligence to identify suspicious activities like unauthorized API calls. Security Hub acts as the single pane of glass to aggregate and prioritize compliance assessments and alerts across the AWS Organizations hierarchy.

Step-by-Step Solution

1
Analyze the requirement for centralized threat detection.
Amazon GuardDuty monitors threat patterns and anomalies across all accounts using a delegated administrator architecture.
This provides the required near-real-time threat detection for anomalous behavior and unauthorized API calls.
2
Analyze the requirement for aggregating compliance findings.
AWS Security Hub centrally aggregates compliance and security posture findings from GuardDuty, Config, and other security services.
This meets the requirement to centrally aggregate and prioritize security alerts and compliance checks.

Key Concept

Centralized threat detection and security aggregation in multi-account organizations.
Estimated Time:2m 0s
Question 1284Question →

A smart agriculture company collects telemetry data from thousands of soil sensors. The sensors upload data hourly, but during storm events, they transmit readings every minute, causing sudden traffic spikes. To prevent old sensor readings from overwriting newer updates, the telemetry data must be processed in the exact order it was captured. Additionally, a complex analytics job needs to process historical data once a day, taking approximately 30 minutes to complete. The company wants a serverless, cost-effective solution with no idle resource costs.

Which combination of services should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon SQS FIFO queue to buffer the telemetry data and trigger an AWS Lambda function for processing.; Use Amazon EventBridge to schedule an AWS Fargate task to run the daily analytics job.

Answer

The correct combination of services is configuring an Amazon SQS FIFO queue to buffer telemetry data and triggering an AWS Lambda function for processing, along with using Amazon EventBridge to schedule an AWS Fargate task to run the daily analytics job.
The correct solution uses an Amazon SQS FIFO queue to ensure telemetry data is processed in the exact chronological order it was received, coupled with AWS Lambda to handle unpredictable incoming spikes serverlessly. For the daily analytics job, AWS Fargate is scheduled using Amazon EventBridge. Because the job runs for 30 minutes, it exceeds AWS Lambda's 15-minute timeout constraint. AWS Fargate is serverless, charges only for the duration of the execution, and avoids any idle server costs.

Step-by-Step Solution

1
Evaluate the telemetry ingestion requirements.
Identify that the system needs to handle highly variable traffic spikes cost-effectively while preserving strict message ordering.
Amazon SQS FIFO queues guarantee first-in, first-out delivery, and AWS Lambda provides automatic scaling with a pay-per-use model that scales down to zero when idle.
2
Evaluate the daily analytics job requirements.
Identify that the analytics job takes 30 minutes, which exceeds AWS Lambda's 15-minute execution limit.
AWS Fargate runs containerized workloads serverlessly without execution timeout limits, billing only for the resources consumed during the 30-minute run.

Key Concept

Selecting serverless services based on execution limits (AWS Fargate for >15 minute jobs) and ordering requirements (Amazon SQS FIFO queues) to design cost-efficient architectures that scale to zero.
Question 1285Question →

An enterprise runs a critical payroll application on AWS in the `us-east-1` Region. The application uses Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB), with an Amazon RDS for PostgreSQL DB instance. The company must design a disaster recovery (DR) strategy in the `us-west-2` Region to protect against a regional outage. The solution must achieve a Recovery Point Objective (RPO) of 55 minutes and a Recovery Time Objective (RTO) of 1010 minutes while minimizing ongoing running costs. Which strategy should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Deploy a scaled-down Auto Scaling group of EC2 instances behind an ALB in the secondary Region, and create a cross-region read replica of the RDS DB instance. Configure Amazon Route 53 failover routing with health checks. In the event of a disaster, promote the replica to primary, scale out the EC2 instances, and allow Route 53 to redirect traffic.

Answer

Deploy a scaled-down Auto Scaling group of EC2 instances behind an ALB in the secondary Region, create a cross-region read replica of the RDS DB instance, configure Amazon Route 53 failover routing with health checks, and in a disaster, promote the replica and scale out the compute resources.
The correct strategy is a Warm Standby DR pattern. Deploying a scaled-down but active compute tier in the secondary region ensures that instances are already running and registered with the ALB. In a disaster, the solutions architect only needs to promote the RDS cross-region read replica (which handles the database replication with under 55 minutes of lag to satisfy the RPO) and scale out the EC2 Auto Scaling group. Route 53 failover routing with health checks automatically detects the primary region failure and reroutes traffic, completing the recovery well within the 1010-minute RTO.

Step-by-Step Solution

1
Evaluate the RPO requirement of 55 minutes.
Amazon RDS cross-region read replicas replicate asynchronously with very low latency (typically seconds or minutes), satisfying the 55-minute RPO constraint.
Standard backup restoration from snapshots copied across regions fails the RPO constraint as backups are usually taken daily.
2
Evaluate the RTO requirement of 1010 minutes.
A Warm Standby pattern is selected. Scaled-down but running EC2 instances are kept active in the secondary Region, ready to scale out immediately.
A Pilot Light strategy with stopped instances or deploying resources purely from CloudFormation templates during a disaster cannot guarantee recovery and initialization within 1010 minutes.
3
Design the failover routing mechanism using Route 53.
A failover routing policy combined with health checks is configured to dynamically redirect client traffic to the secondary ALB when the primary region becomes unhealthy.
Using latency routing without health checks will not redirect traffic away from the failed primary region.

Key Concept

Disaster Recovery strategies (Warm Standby vs. Pilot Light) and Cross-Region DB Replication
Question 1286Question →

A gaming studio is deploying a real-time multiplayer simulation application on Amazon EC2. The architecture has two primary requirements: the EC2 instances must communicate with each other with the lowest possible network latency to synchronize physics calculations, and player connections must be distributed across these instances using a custom game protocol listening on port 7200.

Which two actions should a solutions architect take to meet these performance and scaling requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Launch the EC2 instances in a cluster placement group within a single Availability Zone.; Configure a Network Load Balancer target group with the health check port set explicitly to 7200.

Answer

Launch the EC2 instances in a cluster placement group within a single Availability Zone, and configure a Network Load Balancer target group with the health check port set explicitly to 7200.
To achieve the lowest possible network latency for node-to-node communication, the EC2 instances must be launched in a cluster placement group. Since the game protocol is bound to port 7200, the Network Load Balancer target group health checks must be explicitly directed to port 7200 to prevent healthy instances from being falsely marked as unhealthy.

Step-by-Step Solution

1
Determine the network requirement for synchronization.
The simulation requires the lowest possible node-to-node network latency.
This determines that a cluster placement group is necessary, as it groups instances physically close together on the network.
2
Determine the application port configuration.
The game application listens on a custom port 7200.
This is required to bind incoming traffic and configure health check endpoints.
3
Align the load balancer health check settings with the application port.
Configure the target group to perform health checks specifically on port 7200.
Using the default port 80 will cause health checks to fail since the application does not listen on that port.

Key Concept

Low-latency compute node placement groups and correct load balancer health check configuration for custom application ports.
Estimated Time:1m 30s
Question 1287Question →

A logistics company is designing an IoT tracking system that receives real-time location telemetry from 50,00050,000 delivery trucks. During peak operations, the application receives a high volume of write requests containing a truck ID, a current timestamp, and coordinates. The primary query pattern is to retrieve the historical route of a specific truck for a given day. The transmission rate of the telemetry fluctuates significantly throughout the day. Which database architecture and configuration should the solutions architect choose to meet these requirements with optimal write performance and cost-efficiency?

Show answer & explanation

Answer: Deploy an Amazon DynamoDB table in on-demand capacity mode, setting the partition key as the unique truck ID and the sort key as the timestamp.

Answer

Deploy an Amazon DynamoDB table in on-demand capacity mode, setting the partition key as the unique truck ID and the sort key as the timestamp.
Deploying an Amazon DynamoDB table in on-demand capacity mode with the truck ID as the partition key is the optimal solution. The truck ID provides a high cardinality value, distributing the write load evenly across multiple partitions. The timestamp as the sort key allows historical querying of a specific truck's route. On-demand capacity mode automatically accommodates the fluctuating transmission rate without manual scaling or throttling.

Step-by-Step Solution

1
Analyze workload characteristics and database requirements.
The workload is write-heavy, fluctuates over time, requires high write throughput, and accesses data by truck ID (key-value lookup).
This helps determine if a relational database (RDS) or non-relational database (DynamoDB) is better suited for the scale and access patterns.
2
Select the partition key to distribute write traffic.
Using the unique truck ID as the partition key provides high cardinality, distributing writes evenly across multiple partitions and preventing a hot partition.
Choosing a monotonically increasing key like a timestamp would write-throttle the table by targeting a single partition at any given time.
3
Choose the database capacity mode.
Select on-demand capacity mode to handle fluctuating telemetry workloads automatically and cost-effectively.
Fixed provisioned capacity would result in throttling during spikes or high cost during idle times.

Key Concept

DynamoDB Partition Key Design and Capacity Modes
Estimated Time:1m 30s
Question 1288Question →

A retail company is launching a new flash-sale feature where customers submit coupon claims. The claims arrive in highly unpredictable spikes, ranging from zero to 50,000 requests per minute during the 1-hour sale event, and then drop back to zero. Each claim processing task takes 1 second. To ensure fair distribution, the claims must be processed in the exact order they are received. The company wants to minimize costs and avoid paying for idle resources. Which architecture is the most cost-effective and meets these requirements?

Show answer & explanation

Answer: Deploy an Amazon API Gateway HTTP API that writes claims to an Amazon SQS FIFO queue. Configure an AWS Lambda function to poll the queue and process the claims, writing the results to an Amazon DynamoDB table configured in on-demand capacity mode.

Answer

Deploy an Amazon API Gateway HTTP API that writes claims to an Amazon SQS FIFO queue. Configure an AWS Lambda function to poll the queue and process the claims, writing the results to an Amazon DynamoDB table configured in on-demand capacity mode.
The correct answer combines Amazon API Gateway HTTP API, Amazon SQS FIFO, AWS Lambda, and Amazon DynamoDB on-demand mode. This architecture guarantees strict first-in, first-out ordering of coupon claims, handles extreme spiky traffic automatically, and scales down to zero when the sale ends, ensuring no charges are incurred for idle resources.

Step-by-Step Solution

1
Analyze the scaling and cost requirements.
Identify that the system needs to scale to zero (no idle costs) and handle short, unpredictable bursts (from zero to 50,000 requests per minute). This points to serverless components.
Serverless architectures charge only for resource consumption, eliminating idle cost when traffic drops back to zero.
2
Evaluate the ordering requirement.
Determine that Amazon SQS FIFO (First-In-First-Out) is required to ensure claims are processed in the exact order they are received.
Standard SQS queues do not guarantee order, which violates the fair distribution requirement.
3
Select the optimal database capacity mode.
Choose Amazon DynamoDB in on-demand capacity mode.
On-demand mode scales instantly to handle peak spikes and scales down to zero when there is no traffic, preventing costs from over-provisioning.

Key Concept

Serverless architectures with SQS FIFO and DynamoDB On-Demand provide cost optimization by scaling to zero and billing only for resources consumed, while maintaining strict message ordering.
Question 1289Question →

A chemical manufacturing plant uses IoT sensors to monitor reactor temperatures and pressure levels. The telemetry updates from each reactor contain a `reactor_id` and a `timestamp` and must be processed in the exact sequence they are generated to prevent incorrect automated safety interventions. The plant needs to distribute these updates to two separate backend applications: a real-time monitoring dashboard and a long-term analytical warehouse. The system must handle message spikes, prevent data loss during backend downtime, and support up to 9,0009,000 messages per second.

Which combination of steps should a solutions architect take to design this architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic and subscribe two Amazon SQS FIFO queues to the topic, one for each backend application.; Enable high-throughput FIFO mode on the Amazon SQS FIFO queues and configure the telemetry messages to use the `reactor_id` as the message group ID.

Answer

To support fan-out with message ordering and high throughput, the solutions architect should create an Amazon SNS FIFO topic subscribing two Amazon SQS FIFO queues (one for each backend), enable high-throughput FIFO mode, and use the reactor ID as the message group ID.
To design a resilient, decoupled architecture that maintains message ordering during fan-out, a combination of Amazon SNS FIFO and Amazon SQS FIFO is required. The SNS FIFO topic allows a single publish action to fan out to multiple queues. Each downstream application gets its own SQS FIFO queue, ensuring independent processing, buffering, and resilience against downtime. To handle 9,0009,000 messages per second, high-throughput mode must be enabled on the SQS FIFO queues, and the `reactor_id` must be used as the message group ID to ensure messages from the same reactor are processed in sequence while allowing different reactors to be processed in parallel.

Step-by-Step Solution

1
Address the multi-application fan-out requirement with strict ordering.
Combine Amazon SNS FIFO and Amazon SQS FIFO queues. SNS FIFO allows fanning out the message stream to multiple downstream subscribers while maintaining the order.
Each backend application must receive all updates. Creating two separate SQS FIFO queues subscribed to a single SNS FIFO topic ensures both applications get a complete copy of the telemetry data independently.
2
Scale the message ingestion to support 9,0009,000 messages per second.
Enable high-throughput mode on the SQS FIFO queues.
Standard SQS FIFO queues are limited to 300300 transactions per second (or 3,0003,000 with batching). High-throughput mode allows scaling to the required 9,0009,000 messages per second.
3
Group and sequence messages correctly.
Use the `reactor_id` as the message group ID for FIFO processing.
The message group ID determines which messages must be processed sequentially. Using `reactor_id` guarantees ordered delivery within each individual reactor while enabling concurrent processing across different reactors.

Key Concept

Decoupling event-driven architectures with high-throughput ordered message delivery using SNS FIFO and SQS FIFO.
Question 1290Question →

A financial services company is deploying a high-frequency trading application on a fleet of Amazon EC2 instances. The application requires extremely low-latency, point-to-point network communication between the EC2 instances to coordinate order matching. The instances are managed by an Auto Scaling group and sit behind an Application Load Balancer. The application service is bound to port 84438443, but the target group health check is querying the default HTTP port 8080, marking the instances as unhealthy. Which combination of actions should a solutions architect take to resolve the health check issues and optimize the network performance of the instances?

Show answer & explanation

Answer: Modify the target group health check settings to query port 84438443, and launch the EC2 instances in a cluster placement group.

Answer

Modify the target group health check settings to query port 84438443, and launch the EC2 instances in a cluster placement group.
The correct solution is to modify the target group health check settings to query port 84438443 and launch the EC2 instances in a cluster placement group. A cluster placement group groups instances closely together within a single Availability Zone, enabling low-latency, high-throughput network communication. Changing the health check port to 84438443 ensures the load balancer queries the active port of the application, resolving the health check failures.

Step-by-Step Solution

1
Identify the cause of the target group health check failure.
The application listens on port 84438443, but the health check queries port 8080, causing all checks to fail.
Health checks must target the active port where the application is listening to report correct status.
2
Determine the optimal EC2 placement strategy for low-latency node-to-node communication.
Select a cluster placement group.
Cluster placement groups place instances physically close to each other within a single Availability Zone, enabling low-latency, high-throughput network performance.
3
Combine the health check correction and the placement group selection.
Update the load balancer target group health check port to 84438443 and launch the instances within a cluster placement group.
This dual configuration resolves the health check failures and satisfies the low-latency networking requirement.

Key Concept

Optimizing EC2 network latency using placement groups and aligning load balancer health check ports with active services.
Question 1291Question →

A logistics company hosts a web application on Amazon EC2 instances within a public subnet of a VPC. The security team needs a solution to detect potential SSH brute-force attempts and malicious port scans from the internet. Additionally, they want to ensure that any unauthorized modifications to the VPC subnets' Network Access Control Lists (NACLs) are automatically detected and flagged as non-compliant. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Amazon GuardDuty to monitor and analyze VPC Flow Logs for anomalous network behaviors, such as SSH brute-force attacks and port scanning.; Deploy an AWS Config rule to track configuration changes of Network ACLs and evaluate compliance against the company's security baseline.

Answer

Enable Amazon GuardDuty to monitor and analyze VPC Flow Logs, and deploy an AWS Config rule to track configuration changes of Network ACLs.
Enabling Amazon GuardDuty allows the logistics company to leverage intelligent threat detection that automatically monitors VPC Flow Logs to identify malicious activities like SSH brute-force attempts and port scans. Concurrently, deploying an AWS Config rule enables continuous compliance tracking by monitoring configuration changes to resource types like Network ACLs and flagging any unauthorized changes that deviate from the defined baseline, aligning with the AWS Well-Architected Framework's security pillar.

Step-by-Step Solution

1
Enable Amazon GuardDuty to detect threat patterns in network traffic.
GuardDuty will continuously ingest VPC Flow Logs and use threat intelligence to identify anomalies, such as brute-force attacks and port scans.
This provides real-time detection of network anomalies and threats without requiring manual log analysis.
2
Deploy AWS Config and set up a rule for Network ACLs.
AWS Config will record configuration changes to Network ACLs and automatically evaluate them against compliance baselines.
This implements automated compliance tracking and drift detection for critical network boundary configurations.

Key Concept

Continuous security monitoring using AWS GuardDuty for network threats and AWS Config for configuration compliance.
Estimated Time:1m 30s
Question 1292Question →

A company is deploying a media transcoding service on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The transcoding service listens on TCP port 8085, while the health status endpoint is exposed on TCP port 8086. The architecture must ensure that only healthy instances receive transcoding jobs, and inbound network access to the EC2 instances must be restricted to only the ALB. Which two configurations should the solutions architect implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure the target group to route traffic to port 8085, and explicitly set the health check port to 8086.; Update the security group for the EC2 instances to allow inbound traffic from the security group of the Application Load Balancer on ports 8085 and 8086.

Answer

Configure the target group to send traffic to port 8085 with the health check port explicitly set to 8086, and configure the EC2 instance security group to allow inbound traffic on both ports from the ALB's security group.
The system requires separate ports for health checks (8086) and transcoding traffic (8085). The target group must be configured with port 8085 for traffic and an explicit override of port 8086 for health checks. Additionally, security groups must allow the ALB to reach the EC2 instances on both ports to perform health checks and forward traffic.

Step-by-Step Solution

1
Determine the application port configuration.
The application listens on port 8085 and the health endpoint is on port 8086.
This establishes that the traffic and health check ports must be configured differently in the load balancer target group.
2
Configure target group routing and health checks.
Set the target group port to 8085 and configure the health check configuration to use custom port 8086.
This guarantees that health checks query the correct port and instances are only marked healthy if the health endpoint responds successfully.
3
Apply security group rules on the EC2 instances.
Allow inbound traffic on ports 8085 and 8086 specifically from the ALB's security group.
This implements the principle of least privilege, ensuring only the ALB can reach the backend instances on the necessary ports.

Key Concept

Decoupling target group health checks and application traffic ports in load balancer configurations combined with security group chaining.
Estimated Time:1m 30s
Question 1293Question →

A company is building a document processing platform. Users upload PDF files to an Amazon S3 bucket. A containerized application analyzes each document and extracts metadata. The upload volume is highly irregular and unpredictable, with spikes of thousands of uploads per hour followed by hours of inactivity. Each document analysis takes approximately 20 minutes to complete, and the order of processing does not matter. The extracted metadata must be stored in a database that scales automatically to handle sudden spikes. Which combination of services and capacity modes will provide the most cost-effective architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Run the containerized application on AWS Fargate using Spot Providers, triggered by messages in an Amazon SQS standard queue.; Store the metadata in an Amazon DynamoDB table configured with on-demand capacity mode.

Answer

Run the containerized application on AWS Fargate using Spot Providers with an Amazon SQS standard queue, and store the metadata in an Amazon DynamoDB table configured with on-demand capacity mode.
Running the containerized application on AWS Fargate using Spot Providers with a standard SQS queue is cost-effective because the 20-minute execution duration exceeds the 15-minute limit of AWS Lambda. Fargate Spot offers up to a 70% discount compared to On-Demand pricing. Additionally, configuring the DynamoDB table to use on-demand capacity mode is ideal for unpredictable and spiky workloads because it charges only for actual read and write requests and scales to zero when there is no traffic, avoiding provisioned capacity costs during idle periods.

Step-by-Step Solution

1
Analyze execution time constraints for serverless compute options.
Identify that the 20-minute execution time exceeds the 15-minute limit of AWS Lambda, requiring containerized compute on AWS Fargate.
AWS Lambda will timeout if a process takes longer than 15 minutes.
2
Compare Fargate purchasing options and queue choices for cost-effectiveness.
Choose Fargate Spot Providers to run the containerized jobs at a reduced price, and pair it with a standard Amazon SQS queue since ordering is not required.
Fargate Spot is significantly cheaper than On-Demand, and SQS standard queues have lower request costs and higher throughput than FIFO queues.
3
Select the optimal database capacity mode for spiky and irregular workloads.
Select Amazon DynamoDB on-demand capacity mode to handle unpredictable traffic spikes without manual scaling delays.
On-demand capacity mode scales instantly to handle spikes and charges only for active requests, scaling down to zero cost when idle.

Key Concept

Selecting the most cost-effective serverless compute and database configurations for unpredictable, long-running batch workloads.
Question 1294Question →

A marketing agency is deploying a real-time ad bidding analytics application on a fleet of Amazon EC2 instances. The application performs distributed, high-performance computing calculations that require sub-millisecond node-to-node latency. The instances are deployed in a private subnet and are registered with an Application Load Balancer (ALB) that routes incoming traffic. The application service on the EC2 instances is configured to listen on custom port 8080.

Which combination of actions should a solutions architect take to meet the performance requirements and ensure that the ALB successfully forwards traffic to the EC2 instances? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Launch the EC2 instances in a cluster placement group within a single Availability Zone.; Configure the Application Load Balancer target group health check to query the custom port 8080.

Answer

Launch the EC2 instances in a cluster placement group within a single Availability Zone and configure the Application Load Balancer target group health check to query the custom port 8080.
To achieve sub-millisecond node-to-node latency, instances must be launched in a cluster placement group within a single Availability Zone. Additionally, because the application is listening on a custom port 8080, the ALB's target group health check must be explicitly configured to monitor port 8080 to prevent healthy targets from being marked as unhealthy.

Step-by-Step Solution

1
Analyze placement group requirements for the workload.
Identify that the application requires low-latency, tightly coupled node-to-node communication.
This determines that a cluster placement group is necessary to achieve sub-millisecond latency.
2
Select the correct placement group configuration.
Deploy the EC2 instances inside a cluster placement group within a single Availability Zone.
Cluster placement groups place instances physically close together on the same underlying hardware networks.
3
Verify load balancer configuration for the custom application port.
Modify the target group health check settings to target port 8080 instead of the default port 80.
An incorrect health check port leads to healthy instances being marked unhealthy, which stops the ALB from routing traffic.

Key Concept

Low-latency compute clustering and application target group health check configuration
Question 1295Question →

A logistics company is designing a serverless and automated scaling architecture to process order fulfillment status updates. The updates must be processed in the exact sequence they are received to ensure data integrity in the inventory database. The application receives updates continuously 24/7 at a stable rate, with each message taking an average of 45 seconds to process. The processed updates must then be stored in a database that experiences highly unpredictable, brief spikes in write requests.

Which two solutions should a solutions architect recommend to meet these requirements most cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the destination Amazon DynamoDB table in On-Demand capacity mode.; Buffer the incoming messages using Amazon SQS FIFO queues.

Answer

To meet these requirements cost-effectively, buffer the incoming messages using Amazon SQS FIFO queues to preserve order, and configure the destination Amazon DynamoDB table in On-Demand capacity mode to dynamically handle the unpredictable database traffic spikes without paying for idle capacity.
The system requires strict order processing, which is satisfied by buffering messages with Amazon SQS FIFO queues. Additionally, the database must handle highly unpredictable, brief spikes in write requests; configuring Amazon DynamoDB in On-Demand capacity mode accommodates these spikes instantly and cost-effectively by charging only for actual reads and writes, avoiding the cost of idle provisioned capacity.

Step-by-Step Solution

1
Analyze the ordering requirements for the message queue.
Since messages must be processed in the exact sequence they are received to ensure inventory data integrity, Amazon SQS FIFO queues must be selected instead of standard queues, which only guarantee best-effort ordering.
Standard SQS queues can deliver messages out of order, violating the core requirement of sequential processing.
2
Evaluate the database access patterns and scaling requirements.
The destination database experiences highly unpredictable, brief traffic spikes. Amazon DynamoDB in On-Demand capacity mode scales automatically and charges only for read/write requests made, whereas Provisioned Capacity mode requires over-provisioning to handle peak traffic, leading to idle capacity costs.
On-Demand capacity mode is the most cost-effective option for unpredictable, spiky workloads.
3
Assess the compute layer requirements for continuous workload processing.
The processing workload runs continuously 24/7 with long-running tasks. AWS Lambda is cost-inefficient for constant, long-running processes due to its execution duration pricing. A container-based approach (e.g., Amazon ECS on AWS Fargate) is the correct cost-optimized choice, making the deployment of Lambda functions incorrect.
Continuous execution on Lambda leads to high duration-based costs, making it suboptimal for stable 24/7 baselines.

Key Concept

Selecting cost-effective serverless queue and database capacity modes based on workload characteristics and sequencing requirements.
Question 1296Question →

A company is designing a new two-tier web application on AWS that requires two database components:

1. A metadata store that records user profiles and session preferences. This store experiences sudden, highly irregular spikes in read and write traffic during flash sales, with long periods of near-zero activity.
2. A relational transaction database containing order history that requires high availability, where read queries are highly repetitive and dominate the workload.

The company wants to design a database architecture that is highly resilient, performant, and cost-optimized. Which two database configurations should the solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the metadata store using Amazon DynamoDB in On-Demand capacity mode.; Deploy the order history database as an Amazon RDS Multi-AZ DB instance and implement Amazon ElastiCache to cache the repetitive read queries.

Answer

Configure the metadata store using Amazon DynamoDB in On-Demand capacity mode, and deploy the order history database as an Amazon RDS Multi-AZ DB instance and implement Amazon ElastiCache to cache the repetitive read queries.
For the metadata store, configuring Amazon DynamoDB in On-Demand capacity mode is the most cost-effective choice because the workload is highly irregular and spiky. This avoids over-provisioning capacity during idle times while ensuring the database scales automatically during flash sales. For the order history database, deploying an Amazon RDS Multi-AZ DB instance ensures high availability, while adding Amazon ElastiCache to cache the highly repetitive read queries offloads database traffic, allowing the database to be scaled down to a smaller, less expensive instance class.

Step-by-Step Solution

1
Analyze the capacity requirement for the metadata store.
The metadata store experiences sudden, highly irregular traffic spikes during flash sales, followed by long periods of near-zero activity. On-demand capacity mode is selected because it scales instantly to handle sudden spikes without manual intervention and incurs zero costs when there is no traffic.
Choosing the correct DynamoDB capacity mode directly impacts both performance reliability (throttling avoidance) and cost optimization (avoiding paying for idle provisioned throughput).
2
Evaluate the database tier requirements for the order history database.
The order history database requires high availability (HA). A Multi-AZ deployment is selected because it provides synchronous replication and automated failover.
High availability is a non-negotiable requirement for the order history database, making a Multi-AZ deployment necessary.
3
Optimize the performance and cost of the read-heavy database workload.
Read queries are highly repetitive. Placing Amazon ElastiCache in front of the RDS Multi-AZ DB instance offloads the repetitive reads from the primary database instance.
By reducing the read load on the database instance, the company can provision a smaller and cheaper instance class, significantly reducing RDS database costs.

Key Concept

Selecting cost-effective database capacity modes and using caching layers to reduce database instance sizes while maintaining high availability.
Question 1297Question →

A financial services company needs to ensure that all Amazon EC2 security groups in its production environment are continuously audited for security compliance. Specifically, any rule that allows inbound traffic from the public internet (0.0.0.0/0) on port 22 must be flagged, and the security team must be notified immediately. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Enable AWS Config, configure the managed rule to check for restricted SSH access, and use Amazon EventBridge to route non-compliant compliance change events to an Amazon Simple Notification Service (Amazon SNS) topic.

Answer

The correct solution is to enable AWS Config, configure the managed rule to check for restricted SSH access, and use Amazon EventBridge to route non-compliant compliance change events to an Amazon SNS topic.
AWS Config is designed specifically for tracking resource configuration changes and auditing compliance against rules. The managed rule for restricted SSH access checks security group ingress rules, and EventBridge can publish non-compliant states directly to SNS. This native integration requires no code and minimizes operational overhead.

Step-by-Step Solution

1
Enable AWS Config to record resource configurations.
AWS Config starts tracking configuration changes for resources including EC2 security groups.
This establishes the foundation for monitoring configuration changes and evaluating compliance rules.
2
Deploy the managed rule for restricted SSH access.
AWS Config automatically evaluates security groups against the rule to identify unrestricted port 22 access.
Managed rules provide built-in, low-effort checks for common compliance requirements like securing administrative ports.
3
Configure an EventBridge rule with an SNS target.
Compliance status changes (from compliant to non-compliant) trigger real-time email or SMS alerts to the security team.
This automates notifications to the security operations center without the need to write custom monitoring scripts or Lambda functions.

Key Concept

AWS Config is the primary tool for resource configuration compliance auditing and drift detection, whereas GuardDuty is for active threat detection and Shield is for DDoS mitigation.
Estimated Time:1m 30s
Question 1298Question →

A media company is deploying a distributed video rendering application on a fleet of Amazon EC2 instances. The rendering nodes must exchange massive amounts of sync data with each other with the lowest possible network latency. The rendering application runs on TCP port 8082, while a secondary administrative agent runs on TCP port 80. A Network Load Balancer (NLB) distributes rendering jobs to the fleet. Which configuration should the company implement to achieve optimal network performance between nodes while ensuring the load balancer accurately identifies the status of the rendering application?

Show answer & explanation

Answer: Deploy the EC2 instances in a cluster placement group. Configure the NLB target group health checks to use port 8082.

Answer

Deploy the EC2 instances in a cluster placement group and configure the NLB target group health checks to use port 8082.
The correct configuration uses a cluster placement group to group the instances within a single Availability Zone, minimizing node-to-node latency. It also configures the load balancer health checks to query port 8082, ensuring that the rendering service itself is verified rather than the secondary administrative agent on port 80.

Step-by-Step Solution

1
Determine the placement group type that minimizes network latency between EC2 instances.
Select a cluster placement group.
Cluster placement groups pack instances close together inside a single Availability Zone, enabling high-performance, low-latency node-to-node communication.
2
Identify the application port that requires health monitoring by the Network Load Balancer.
Target port 8082 for health checks.
The core rendering application listens on port 8082. Monitoring this port ensures that the load balancer only routes traffic to instances where the rendering service is running, rather than checking the secondary administrative agent on port 80.
3
Combine the placement group and port configurations to form the complete solution.
Combine a cluster placement group with target group health checks configured to port 8082.
This combined configuration satisfies both the low-latency networking requirement and the accurate health status reporting requirement.

Key Concept

Selecting cluster placement groups for low-latency HPC workloads and configuring matching health check ports on target groups.
Question 1299Question →

A financial company stores sensitive customer data in Amazon S3 buckets. The company's security team needs to implement a solution to monitor the AWS environment. The solution must detect anomalous data access patterns and potential data exfiltration attempts on the S3 buckets in near-real-time. Additionally, the solution must continuously audit and record configuration changes to the S3 buckets to evaluate compliance against security baselines. Which combination of AWS services should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon GuardDuty with S3 Protection enabled to analyze S3 data events and identify anomalous access patterns.; AWS Config to track configuration history and continuously evaluate bucket settings against security rules.

Answer

The correct architecture uses Amazon GuardDuty with S3 Protection enabled to monitor data access patterns and detect potential exfiltration, along with AWS Config to record S3 configuration history and continuously audit compliance against baseline rules.
Amazon GuardDuty with S3 Protection is the native AWS threat detection service that monitors S3 data events (e.g. access patterns) using anomaly detection to identify data exfiltration. AWS Config tracks resource configuration changes (like S3 bucket policies) and automatically assesses them against rules for compliance auditing.

Step-by-Step Solution

1
Identify the service for threat detection on S3 data plane activity.
Amazon GuardDuty with S3 Protection is selected.
GuardDuty monitors S3 API data events using machine learning to detect anomalies and threat signatures, satisfying the exfiltration detection requirement.
2
Identify the service for configuration history and compliance evaluation.
AWS Config is selected.
AWS Config records resource configurations and assesses them against rules to ensure compliance, satisfying the auditing requirement.
3
Evaluate and eliminate incorrect distractors based on security architecture principles.
Discard options proposing AWS Shield Advanced, subnet-level security groups, and long-term IAM user credentials.
These services either address different problems (DDoS mitigation), do not apply to S3/subnets directly, or violate the principle of least privilege.

Key Concept

Continuous compliance auditing combined with near-real-time threat detection on object storage allows architects to satisfy both monitoring and threat detection goals for sensitive data stores.
Question 1300Question →

A technology company is deploying a distributed search index compilation engine on a fleet of Amazon EC2 instances. The compilation nodes must frequently synchronize index shards with each other, requiring the lowest possible latency for inter-node communication. A Network Load Balancer (NLB) is configured to route jobs from a coordinator service to the nodes on TCP port 8888. A custom health monitoring daemon runs on each instance on TCP port 8899. Currently, the NLB is marking all instances as unhealthy because the target group is using the default health check settings. Which combination of steps should the solutions architect take to resolve the health check issue and optimize inter-node network performance? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Launch the EC2 instances in a cluster placement group.; Configure the target group health check port to use port 8899.

Answer

Launch the EC2 instances in a cluster placement group and configure the target group health check port to use port 8899.
To achieve the lowest possible network latency and high-throughput inter-node communication, the instances must be launched in a cluster placement group. In addition, the health check port in the Network Load Balancer target group must be modified to use port 8899 so that health checks query the monitoring daemon instead of failing on the default traffic port.

Step-by-Step Solution

1
Analyze inter-node network requirements.
The compilation engine requires minimal latency and maximum throughput for index shard synchronization.
Choosing a cluster placement group colocates instances on the same underlying hardware backplane within a single Availability Zone, meeting the low-latency requirement.
2
Diagnose the load balancer health check failure.
The target group defaults to using the traffic port (8888) for health checks, where no health monitoring daemon is running.
Configuring the target group to explicitly probe port 8899 aligns the health check with the custom health monitoring daemon.

Key Concept

Selecting the correct EC2 placement group for low-latency networking and aligning target group health check ports with service daemons.
PreviousPage 65 / 74Next