All practice questions

1462 questions

All types1,462 Multiple choice739 Multiple select723

A financial services firm is deploying a distributed, real-time risk modeling engine on a fleet of Amazon EC2 instances. The modeling nodes require the lowest possible latency and maximum network throughput for node-to-node communication to synchronize state. The application runs on a custom port of $9090$ on each instance. An Application Load Balancer (ALB) is configured to route traffic to the instances on port $9090$ . The Solutions Architect needs to ensure the instances can communicate efficiently and are not mistakenly marked as unhealthy by the ALB. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Launch the EC2 instances within a cluster placement group in a single Availability Zone

Set the target group health check port configuration to 'traffic-port' or explicitly to port

9090

Launch the EC2 instances within a spread placement group across multiple Availability Zones

Leave the target group health check port configuration at its default value of port

80

Launch the EC2 instances within a partition placement group with a partition count of

7

Show answer & explanation

Answer: Launch the EC2 instances within a cluster placement group in a single Availability Zone; Set the target group health check port configuration to 'traffic-port' or explicitly to port $9090$

Answer

To meet the requirements, the Solutions Architect should launch the EC2 instances in a cluster placement group and configure the ALB target group health check port to 'traffic-port' or explicitly to port

9090

Launching instances within a cluster placement group provides low-latency, high-throughput network performance by placing them close together within a single Availability Zone. Setting the health check port to the traffic port or explicitly to port

9090

ensures the load balancer verifies the actual port where the application is listening, preventing healthy instances from being falsely marked as unhealthy.

Step-by-Step Solution

Analyze the network latency and throughput requirements of the risk modeling engine.

Identify that the workload is tightly-coupled and requires the lowest possible network latency and high throughput for node-to-node communication.

This determines the choice of EC2 placement group.

Select the appropriate EC2 placement group type.

A cluster placement group is selected because it packs instances close together inside a single Availability Zone to enable low-latency, high-throughput networking.

Spread and partition placement groups separate instances to increase resilience, which increases latency.

Analyze the Application Load Balancer port routing and health check parameters.

Identify that the application is listening on custom port

9090

, but default ALB target group health checks target port

80

This mismatch will cause the health checks to fail.

Configure the target group health check port to match the application port.

Configure the health check port to 'traffic-port' or explicitly to

9090

so that the ALB queries the correct daemon.

This prevents healthy instances from being flagged as unhealthy.

Key Concept

Optimizing compute networks using placement groups and aligning load balancer health check ports with custom application ports.

Question 1322Question →

An enterprise application runs on Amazon EC2 instances inside a private subnet. These instances are managed by an Auto Scaling group (ASG) and receive traffic from an Application Load Balancer (ALB). The primary application is configured to listen on port 5000, while a dedicated monitoring daemon on each instance handles status reporting on port 5001. Currently, the target group health checks are targeted at port 5001. The ALB marks all new instances as unhealthy, yet the ASG fails to terminate or replace them. The security group on the EC2 instances is configured to accept inbound TCP connections on port 5000 from the ALB's security group. Which two modifications will resolve these issues and ensure unhealthy instances are automatically replaced? (Select two.)

Select all that apply

Allow inbound TCP traffic on port 5001 from the Application Load Balancer's security group in the EC2 instances' security group

Modify the Auto Scaling group's health check configuration to use Elastic Load Balancing (ELB) health checks instead of EC2 health checks

Add an inbound rule to the subnet's Network Access Control List (NACL) to allow traffic on port 5001, and remove the port 5001 allowance from the security group

Change the target group health check port configuration to port 80 to align with standard HTTP health check protocols

Configure an Amazon Route 53 latency routing policy to route user requests directly to individual EC2 instance IP addresses when they fail load balancer health checks

Show answer & explanation

Answer: Allow inbound TCP traffic on port 5001 from the Application Load Balancer's security group in the EC2 instances' security group; Modify the Auto Scaling group's health check configuration to use Elastic Load Balancing (ELB) health checks instead of EC2 health checks

Answer

Allow inbound TCP traffic on port 5001 from the Application Load Balancer's security group in the EC2 instances' security group, and modify the Auto Scaling group's health check configuration to use Elastic Load Balancing (ELB) health checks instead of EC2 health checks.

The correct options resolve both issues. First, allowing inbound TCP traffic on port 5001 from the Application Load Balancer's security group within the EC2 instances' security group opens the necessary communication path for the load balancer to query the monitoring daemon. Second, configuring the Auto Scaling group to use ELB health checks ensures the Auto Scaling group is aware of health status changes from the load balancer, enabling it to automatically terminate and replace instances that fail the target group health checks.

Step-by-Step Solution

Analyze why the Application Load Balancer is marking instances as unhealthy.

The target group is querying port 5001 for health checks, but the EC2 instances' security group only allows inbound traffic on port 5000. Traffic to port 5001 is being blocked.

Security groups are stateful firewalls at the instance level. An inbound rule must explicitly allow the load balancer to reach the health check port.

Analyze why the Auto Scaling group is not replacing the unhealthy instances.

By default, Auto Scaling groups use EC2 status checks (hardware and system status) to determine instance health. They do not automatically recognize Application Load Balancer target group health check failures.

Changing the health check type to ELB tells the Auto Scaling group to monitor target group health status and replace instances when they are marked unhealthy by the load balancer.

Key Concept

Auto Scaling Group health check types and Elastic Load Balancing target group security group rules.

Question 1323Question →

A global e-learning provider hosts its platform on AWS. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The database tier uses an Amazon RDS for MySQL Multi-AZ DB instance. The provider needs to implement a disaster recovery (DR) strategy in a secondary AWS Region. The strategy must support a Recovery Time Objective (RTO) of 3 hours and a Recovery Point Objective (RPO) of 10 minutes, while keeping ongoing replication and infrastructure costs to a minimum.

Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Configure an Amazon RDS for MySQL cross-region read replica in the secondary Region, and promote it to a standalone DB instance during a failover event.

Create and copy an Amazon Machine Image (AMI) of the application servers to the secondary Region, and prepare an AWS CloudFormation template to deploy the Application Load Balancer and Auto Scaling group during a failover.

Deploy a scaled-down Auto Scaling group and an Application Load Balancer in the secondary Region that continuously run at minimum capacity.

Configure Amazon Route 53 latency routing to automatically distribute incoming traffic between the application tiers in both Regions.

Take daily Amazon RDS snapshots, copy them to the secondary Region, and store them in Amazon S3 Glacier Flexible Retrieval to restore the database during a failover.

Show answer & explanation

Answer: Configure an Amazon RDS for MySQL cross-region read replica in the secondary Region, and promote it to a standalone DB instance during a failover event.; Create and copy an Amazon Machine Image (AMI) of the application servers to the secondary Region, and prepare an AWS CloudFormation template to deploy the Application Load Balancer and Auto Scaling group during a failover.

Answer

Configure an Amazon RDS for MySQL cross-region read replica in the secondary Region, and promote it during failover. Additionally, create and copy an AMI of the application servers, and use an AWS CloudFormation template to deploy the application tier resources during failover.

To satisfy the 10-minute RPO, continuous or near-continuous replication is required. Amazon RDS cross-region read replicas automatically replicate changes asynchronously with very low latency, typically in seconds, meeting the RPO. To meet the 3-hour RTO while minimizing ongoing costs, a Pilot Light strategy is ideal. Keeping pre-built AMIs and deploying the infrastructure via AWS CloudFormation templates on-demand avoids paying for running compute instances and load balancers during normal operations, yet allows full recovery within the 3-hour timeline.

Step-by-Step Solution

Select a data replication strategy that meets the 10-minute RPO.

Amazon RDS cross-region read replicas use asynchronous replication with very low replication lag (seconds to minutes), satisfying the 10-minute RPO.

Direct backup methods like daily snapshots would violate the 10-minute RPO.

Select a compute strategy that meets the 3-hour RTO while minimizing cost.

Store pre-built AMIs and write AWS CloudFormation templates to provision the load balancer and Auto Scaling group when a disaster is declared.

This Pilot Light strategy avoids any ongoing compute costs for idle servers while allowing full provisioning within the 3-hour window.

Avoid warm standby or active-active configurations to respect the cost constraint.

Do not provision running EC2 instances or load balancers in the secondary region prior to failover.

Running inactive or scaled-down infrastructure incurs unnecessary ongoing costs.

Key Concept

Designing a cost-effective Pilot Light disaster recovery strategy using cross-region database replication and on-demand infrastructure provisioning.

Question 1324Question →

A mobile gaming studio is deploying a real-time multiplayer backend on Amazon EC2 instances. The game servers require the lowest possible node-to-node network latency to synchronize player state across the fleet. The game traffic runs on port 7777, but the server's health monitoring endpoint is exposed on a management port at 8080. After launching the instances and registering them with an Application Load Balancer (ALB) target group, the solutions architect notices that the instances are failing health checks and experiencing high inter-node network latency. Which configuration will resolve these issues?

Deploy the EC2 instances in a partition placement group, and configure the target group health check to query port 8080.

Deploy the EC2 instances in a cluster placement group, and configure the target group health check to query the default traffic port.

Deploy the EC2 instances in a cluster placement group, and configure the target group health check to query port 8080.

Deploy the EC2 instances in a spread placement group, and configure the target group health check to query the default traffic port.

Show answer & explanation

Answer: Deploy the EC2 instances in a cluster placement group, and configure the target group health check to query port 8080.

Answer

Deploying the EC2 instances in a cluster placement group ensures the lowest inter-node network latency, while configuring the target group health check to query port 8080 ensures the load balancer accurately monitors the health of the servers on the correct management port.

To achieve the lowest possible node-to-node network latency, EC2 instances should be deployed in a cluster placement group, which packs instances close together within a single Availability Zone. Additionally, because the health endpoint is on a custom management port (8080) rather than the game traffic port (7777), the ALB target group's health check must be explicitly configured to query port 8080. This resolves the health check failures while maintaining high-performance networking.

Step-by-Step Solution

Identify latency optimization mechanism

Cluster placement groups must be used to pack EC2 instances close together within a single Availability Zone for low-latency node-to-node communication.

Other placement groups like partition or spread are designed for high availability and fault isolation, which can increase network latency.

Locate health check port mismatch

The target group's health check must be explicitly pointed to port 8080.

By default, target groups run health checks on the traffic port (7777 in this case). Since the health endpoint is only available on port 8080, health checks will fail unless custom port configuration is applied.

Key Concept

Optimizing EC2 network performance with placement groups and configuring target group health checks for custom ports.

Question 1325Question →

A global supply chain logistics platform hosts its fleet scheduling system in the us-east-1 Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, and a primary Amazon Aurora PostgreSQL database cluster. The company needs to design a disaster recovery (DR) solution in the us-west-2 Region. The DR solution must achieve a Recovery Time Objective (RTO) of 20 minutes and a Recovery Point Objective (RPO) of 5 minutes while minimizing ongoing running costs. Which two steps should the solutions architect take to meet these requirements?

Select all that apply

Set up an Amazon Aurora Global Database with the primary cluster in the primary Region and a secondary cluster in the disaster recovery Region.

Deploy an Auto Scaling group in the disaster recovery Region with the minimum and desired capacity set to 0, and use a script or AWS CloudFormation to scale out the instances during a failover.

Deploy an Amazon RDS PostgreSQL Read Replica in the disaster recovery Region, and configure the primary Application Load Balancer to automatically route write transactions to the read replica if the primary database becomes unavailable.

Establish a Warm Standby DR solution by running a fully duplicated, active Auto Scaling group with the same instance counts in both Regions and utilizing Route 53 Latency routing.

Perform daily database backups to Amazon S3, transition the backups to S3 Glacier Flexible Retrieval, and restore the database to a new instance in the disaster recovery Region during a failover event.

Show answer & explanation

Answer: Set up an Amazon Aurora Global Database with the primary cluster in the primary Region and a secondary cluster in the disaster recovery Region.; Deploy an Auto Scaling group in the disaster recovery Region with the minimum and desired capacity set to 0, and use a script or AWS CloudFormation to scale out the instances during a failover.

Answer

Configure an Amazon Aurora Global Database with a secondary cluster in the recovery Region, and deploy an Auto Scaling group in the recovery Region with its capacity initialized to 0, scaling it out on-demand during failover.

The correct solution uses a Pilot Light disaster recovery strategy. Setting up an Aurora Global Database ensures asynchronous, sub-second replication to the secondary Region, keeping the database in sync and satisfying the 5-minute RPO. Deploying an Auto Scaling group with minimum and desired capacity set to 0 avoids active compute charges during normal operations, which satisfies the cost minimization constraint. In the event of a disaster, the database can be promoted quickly, and the Auto Scaling group can be scaled out via automation within the 20-minute RTO.

Step-by-Step Solution

Analyze the RTO and RPO requirements alongside the cost minimization constraint.

The RPO of 5 minutes requires active database replication to the secondary Region. The RTO of 20 minutes allows the application tier to be scaled down to zero and started on demand (Pilot Light).

The architecture needs to support fast recovery but avoid the cost of active compute in the recovery Region.

Address the database layer requirements.

Set up an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2.

Aurora Global Database provides sub-second latency replication, meeting the RPO of 5 minutes, and supports sub-minute failovers to meet the RTO.

Address the compute layer requirements.

Deploy an Auto Scaling group in us-west-2 with minimum and desired capacity set to 0. Use a template or script to scale out compute during failover.

This Pilot Light strategy avoids compute charges in the DR Region during normal operations, satisfying the cost-minimization constraint while allowing instance provisioning within the 20-minute RTO.

Key Concept

Disaster Recovery strategies (specifically Pilot Light) and cross-region replication technologies.

Question 1326Question →

A financial firm is deploying a web application on Amazon EC2 instances in private subnets. The instances are managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application is configured to listen on port 8080. After deployment, the ALB is marking all registered EC2 instances as unhealthy. The solutions architect must resolve the health check failures and ensure the architecture is secure and resilient. Which combination of actions should the solutions architect take to resolve this issue? (Select two.)

Select all that apply

Update the ALB target group health check settings to explicitly use port 8080.

Configure the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB.

Modify the target group to perform health checks on port 80, expecting the operating system to automatically forward the probes to port 8080.

Change the Network ACL of the private subnet to stateful mode to automatically permit ephemeral port return traffic for the health checks.

Set up an Amazon Route 53 Latency routing policy targeting the individual private IP addresses of the EC2 instances to bypass the ALB's health checks.

Show answer & explanation

Answer: Update the ALB target group health check settings to explicitly use port 8080.; Configure the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB.

Answer

Update the ALB target group health check settings to explicitly use port 8080, and configure the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the ALB.

To resolve the health check issues, the target group's health check configuration must be modified to query port 8080 where the application is listening, and the EC2 security group must allow inbound traffic on port 8080 from the ALB security group to allow the probes to succeed.

Step-by-Step Solution

Analyze the service configuration and identify the application port.

The application listens on port 8080, which is different from the default port 80.

By default, an Elastic Load Balancing target group performs health checks on the default port of the target group. If the target group defaults to port 80 but the application listens on port 8080, health checks will fail.

Ensure network connectivity between the Application Load Balancer and the EC2 instances.

The EC2 instances' security group must permit inbound TCP traffic on port 8080 from the ALB's security group.

Security groups are stateful firewalls. Allowing inbound traffic on the custom port from the load balancer security group allows the health check requests (and client traffic) to reach the instances.

Key Concept

ELB health check configuration and target group security integration

Question 1327Question →

A Software-as-a-Service (SaaS) company hosts a document collaboration application in the us-east-1 Region. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. User documents are stored in an Amazon S3 bucket, and metadata is stored in an Amazon Aurora MySQL-Compatible DB cluster. The company needs to implement a disaster recovery (DR) plan in the us-west-2 Region. The solution must achieve a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 15 minutes while minimizing ongoing infrastructure costs. Which solution meets these requirements most cost-effectively?

Enable Amazon S3 Cross-Region Replication (CRR) to replicate document files to us-west-2. Create an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 with zero DB instances. Pre-configure the Application Load Balancer and the Auto Scaling group in us-west-2 with a desired capacity of zero. Configure Amazon Route 53 failover routing with health checks.

Establish a warm standby environment in us-west-2 by maintaining a scaled-down Auto Scaling group with a minimum capacity of one EC2 instance and a running secondary Aurora DB instance. Use Amazon Route 53 latency routing to automatically redirect user sessions to the secondary region during a failover event.

Create hourly snapshots of the Aurora DB cluster and copy them to us-west-2. Store the application deployment templates in an S3 bucket configured to transition objects immediately to S3 Glacier Flexible Retrieval. Upon disaster declaration, retrieve the templates to deploy the infrastructure and restore the database from the copied snapshot.

Configure a cross-region Aurora Read Replica in us-west-2 to serve as the immediate database failover target. Deploy the EC2 application tier at full capacity in us-west-2 to ensure immediate availability. Use Amazon Route 53 simple routing to direct a portion of the write traffic to the read replica to keep it synchronized.

Show answer & explanation

Answer: Enable Amazon S3 Cross-Region Replication (CRR) to replicate document files to us-west-2. Create an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 with zero DB instances. Pre-configure the Application Load Balancer and the Auto Scaling group in us-west-2 with a desired capacity of zero. Configure Amazon Route 53 failover routing with health checks.

Answer

The correct solution represents a Pilot Light DR strategy, which is the most cost-effective way to meet a 4-hour RTO and 15-minute RPO. Amazon S3 Cross-Region Replication (CRR) and Amazon Aurora Global Database provide continuous, low-latency replication that satisfies the 15-minute RPO. Aurora Global Database supports having zero running DB instances in the secondary region cluster, and the EC2 Auto Scaling group can be configured with a capacity of zero. During a failover event, the DB instances are created, the Auto Scaling group is scaled up, and Route 53 failover routing directs traffic to the secondary region. This process completes well within the 4-hour RTO and incurs zero compute cost during normal operation.

Step-by-Step Solution

Determine the optimal disaster recovery pattern based on the RTO and RPO constraints.

An RTO of 4 hours suggests that a Pilot Light strategy is appropriate because compute resources (EC2 and Aurora DB instances) do not need to run continuously and can be provisioned or scaled up during failover.

This minimizes ongoing costs while easily meeting the generous 4-hour recovery window.

Choose replication mechanisms that satisfy the 15-minute RPO.

S3 Cross-Region Replication (CRR) and Aurora Global Database both replicate data continuously and asynchronously with sub-minute latency.

This ensures that data loss in the event of a disaster remains well under the 15-minute RPO limit.

Select the correct database and application configuration for Pilot Light.

Aurora Global Database allows the secondary DB cluster to have zero DB instances, eliminating compute costs. Similarly, pre-configured Auto Scaling groups can have their desired capacity set to zero.

This ensures zero compute expenses in the recovery region during normal operations, achieving the most cost-effective architecture.

Key Concept

Designing a Pilot Light disaster recovery strategy using S3 Cross-Region Replication and Aurora Global Database with zero-instance secondary clusters to meet recovery objectives cost-effectively.

Question 1328Question →

A public transit ticketing platform hosts its core application in the us-west-2 Region. The database tier runs on an Amazon RDS for MySQL Multi-AZ DB instance. The company needs to design a disaster recovery (DR) plan in the us-east-1 Region. The DR strategy must achieve a Recovery Point Objective (RPO) of less than 15 minutes and a Recovery Time Objective (RTO) of less than 30 minutes, while keeping costs as low as possible.

Which TWO configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Create a cross-region read replica of the RDS DB instance in the us-east-1 Region.

Deploy a scaled-down application tier in the us-east-1 Region, and configure Amazon Route 53 failover routing with health checks.

Configure an Amazon Route 53 latency-based routing policy to automatically redirect database and application traffic to the us-east-1 Region during an outage.

Enable Amazon RDS Multi-AZ replication across both the us-west-2 and us-east-1 Regions to automate database failover.

Export daily database snapshots to Amazon S3 Glacier Flexible Retrieval in the us-east-1 Region, and restore the database during a failover event.

Show answer & explanation

Answer: Create a cross-region read replica of the RDS DB instance in the us-east-1 Region.; Deploy a scaled-down application tier in the us-east-1 Region, and configure Amazon Route 53 failover routing with health checks.

Answer

Create a cross-region read replica of the RDS DB instance in the us-east-1 Region, and deploy a scaled-down application tier in the us-east-1 Region with Amazon Route 53 failover routing and health checks.

To meet the 15-minute RPO, the database must replicate continuously to the secondary region. An RDS cross-region read replica meets this requirement by replicating data asynchronously with very low latency. To meet the 30-minute RTO, the database replica can be promoted to a standalone primary instance in minutes. To minimize costs, the application tier should be kept scaled down (Pilot Light pattern) and only scaled up when a failover is initiated. Amazon Route 53 failover routing with health checks handles the redirection of user traffic to the secondary region during a disaster.

Step-by-Step Solution

Select a database replication method that meets the RPO of less than 15 minutes.

Using an Amazon RDS cross-region read replica provides asynchronous data replication across regions, which typically keeps replication lag under a few minutes, meeting the 15-minute RPO.

Asynchronous replication to a cross-region read replica provides a cost-effective, low-lag copy of the database in the recovery region.

Choose a compute deployment model that minimizes costs and supports the 30-minute RTO.

Pre-deploying a scaled-down (Pilot Light) application tier in us-east-1 ensures that the core resources exist and can be scaled up rapidly via Auto Scaling groups or instance resizing during a disaster.

A Pilot Light pattern avoids the cost of running a full-capacity environment continuously while still meeting the RTO.

Configure DNS routing to handle traffic redirection during failover.

Setting up Amazon Route 53 failover routing policies associated with health checks allows the architect to redirect client traffic to the secondary region once the database is promoted and the application tier is scaled up.

Failover routing provides the mechanism to switch active user traffic to the backup site when the primary region is unavailable.

Key Concept

Disaster recovery planning using a cross-region Pilot Light strategy with Amazon RDS cross-region read replicas and Amazon Route 53 failover routing to meet strict RTO/RPO objectives while minimizing idle resource costs.

Question 1329Question →

A financial technology company is designing a ledger application that processes account transaction logs. When an account transaction occurs, the details must be sent to two separate downstream systems: a ledger auditing service and an account balance update service. Both downstream systems must process the transaction events in the exact chronological order in which they were generated for each account to ensure ledger accuracy. The architecture must be decoupled and resilient to temporary downstream service outages. Which combination of steps should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon SNS FIFO topic to receive and distribute the transaction events.

Create two Amazon SQS FIFO queues and subscribe them to the SNS FIFO topic, with one queue dedicated to each downstream service.

Create a standard Amazon SNS topic and subscribe two standard Amazon SQS queues to it to distribute the transaction events.

Create two standard Amazon SQS queues and configure the transaction generator to write to both queues simultaneously using parallel client-side threads.

Configure both downstream services to pull events from a single shared Amazon SQS FIFO queue.

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic to receive and distribute the transaction events.; Create two Amazon SQS FIFO queues and subscribe them to the SNS FIFO topic, with one queue dedicated to each downstream service.

Answer

Creating an Amazon SNS FIFO topic to receive the events and subscribing two Amazon SQS FIFO queues to the topic (one for each downstream service) provides a decoupled, resilient, and ordered event distribution system.

To achieve both event fan-out (sending the same transaction to multiple services) and chronological ordering, the architecture must use Amazon SNS FIFO paired with Amazon SQS FIFO. An SNS FIFO topic preserves the ordering of messages and can fan them out to multiple SQS FIFO queues. Each downstream service must have its own dedicated SQS FIFO queue to ensure both services receive every transaction message independently without competing. The SQS queues also buffer messages, decoupling the producer from the consumers and ensuring resilience during downstream service outages.

Step-by-Step Solution

Select a message distribution service that supports ordering and fan-out.

Amazon SNS FIFO is chosen because standard SNS does not guarantee ordering, which is a key requirement for ledger transactions.

An SNS FIFO topic ensures that message ordering is maintained and allows fanning out the same message to multiple subscriber queues.

Select consumer queues that support ordering and resilience.

Two Amazon SQS FIFO queues are chosen, with one dedicated to each downstream service.

SQS FIFO queues preserve the strict order of messages published by the SNS FIFO topic and buffer messages to protect downstream services during high traffic or downtime.

Verify fan-out topology versus shared queue topology.

Each service must have its own queue subscribed to the SNS FIFO topic rather than sharing a single queue.

A single shared queue would result in competing consumers where each transaction is processed by only one of the services instead of both.

Key Concept

Fanning out ordered messages to multiple downstream systems using Amazon SNS FIFO and Amazon SQS FIFO queues.

Question 1330Question →

A ride-hailing platform is designing an event-driven system to process trip status updates (such as requested, accepted, in-progress, and completed). These updates must be processed in the exact chronological sequence they are generated for each individual trip to ensure accurate customer billing and driver payouts. The status updates must be delivered to two separate backend services: a billing service and a real-time analytics service. The architecture must be decoupled, highly available, and handle traffic spikes dynamically.

Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon SNS FIFO topic, and subscribe two Amazon SQS FIFO queues to the topic.

Publish the trip status updates to the SNS FIFO topic using the unique trip ID as the message group ID.

Create a standard Amazon SNS topic, and subscribe two standard Amazon SQS queues to the topic.

Configure an AWS Lambda function to run continuously in a loop to poll the status updates and process them sequentially for both services.

Write the trip status updates to an Amazon DynamoDB table using a sequential, monotonically increasing timestamp as the partition key.

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic, and subscribe two Amazon SQS FIFO queues to the topic.; Publish the trip status updates to the SNS FIFO topic using the unique trip ID as the message group ID.

Answer

Create an Amazon SNS FIFO topic and subscribe two Amazon SQS FIFO queues to it, then publish the status updates to the SNS FIFO topic using the trip ID as the message group ID.

To achieve both decoupling (fan-out) and strict chronological ordering per trip, the architect must use Amazon SNS FIFO and Amazon SQS FIFO. By subscribing two separate SQS FIFO queues (one for billing, one for analytics) to the SNS FIFO topic, the system fans out the updates to both services independently. Using the unique trip ID as the message group ID ensures that events for any single trip are processed in order, while allowing updates across different trips to run in parallel, maximizing throughput during spikes.

Step-by-Step Solution

Determine how to broadcast trip status updates to both backend services without coupling.

Amazon SNS is chosen to fan out incoming trip status updates to multiple downstream destinations.

Publishing events to an SNS topic allows multiple independent subscriber queues to receive copies of the same event.

Select the appropriate queue and topic types to guarantee chronological ordering.

Configure an SNS FIFO topic and SQS FIFO queues, and publish messages using the trip ID as the message group ID.

FIFO configurations guarantee that messages within the same group are processed in the exact order they are received, while the trip ID ensures serialization is restricted per trip rather than across the entire platform.

Exclude alternatives that introduce bottlenecks or cost inefficiencies.

Avoid standard queues (which do not guarantee ordering), continuous Lambda loops (which inflate run-time costs), and monotonic keys in DynamoDB (which create hot partitions).

This guarantees a decoupled, resilient, cost-effective, and highly performant architecture that scales with traffic spikes.

Key Concept

Decoupled fan-out with ordering preservation using SNS FIFO and SQS FIFO queues.

Question 1331Question →

A real estate platform allows agents to update property listing details. When a listing is updated, the platform must concurrently update the search index, regenerate watermarked images of the property, and send email alerts to prospective buyers. To prevent older data from overwriting newer updates, changes to each property listing must be processed in the exact chronological order they were submitted. The image watermarking and email alert processes do not require strict ordering but must be decoupled to handle traffic spikes.

Which solution meets these requirements with the least operational overhead?

Publish listing update events to a standard Amazon SNS topic. Subscribe three standard Amazon SQS queues to the SNS topic to decouple the search indexing, image watermarking, and email alert services.

Publish listing update events to a standard Amazon SNS topic. Subscribe one Amazon SQS FIFO queue for search indexing and two standard Amazon SQS queues for image watermarking and email alerts to the SNS topic.

Publish listing update events to an Amazon SNS FIFO topic. Subscribe three Amazon SQS FIFO queues to the SNS FIFO topic, with each queue feeding one of the downstream services: search indexing, image watermarking, and email alerts.

Publish listing update events to an Amazon SNS FIFO topic. Subscribe a single Amazon SQS FIFO queue to the topic, and configure the search indexing, image watermarking, and email alert services to consume from this single queue using different message group IDs.

Show answer & explanation

Answer: Publish listing update events to an Amazon SNS FIFO topic. Subscribe three Amazon SQS FIFO queues to the SNS FIFO topic, with each queue feeding one of the downstream services: search indexing, image watermarking, and email alerts.

Answer

The correct solution uses an Amazon SNS FIFO topic to fan out events to three separate Amazon SQS FIFO queues. This pattern ensures that each downstream service (search indexing, image watermarking, and email alerts) receives its own copy of the listing update event (fan-out) and processes them in the exact order they were published (FIFO), preventing race conditions where older updates could overwrite newer listing data.

Step-by-Step Solution

Analyze the concurrency and ordering requirements.

The platform needs to distribute listing updates to three downstream services (fan-out) while maintaining the chronological sequence of updates per property listing (ordering).

This determines that standard publish-subscribe messaging is insufficient because it does not guarantee first-in, first-out (FIFO) delivery, which is required to prevent older updates from overwriting newer ones.

Determine the appropriate AWS messaging integration pattern.

To implement fan-out with strict ordering, the solution must pair Amazon SNS FIFO with Amazon SQS FIFO.

An SNS FIFO topic preserves the order of messages published to it and delivers them to subscribed SQS FIFO queues in that same order. Each service needs its own SQS FIFO queue to avoid destructive reads.

Evaluate the subscription configuration constraints.

Subscribing SQS FIFO queues to an SNS FIFO topic ensures message ordering is preserved from end to end.

If standard SNS or standard SQS is introduced anywhere in the pipeline, ordering guarantees are lost, and subscribing a single queue to multiple consumers would prevent all services from receiving every update.

Key Concept

End-to-end first-in, first-out (FIFO) ordering in a fan-out architecture using Amazon SNS FIFO and Amazon SQS FIFO.

Estimated Time:1m 30s

Question 1332Question →

A property management portal hosts its application in the us-east-1 Region. The database tier runs on an Amazon RDS for PostgreSQL Multi-AZ DB instance. The application tier consists of Amazon EC2 instances inside an Auto Scaling group behind an Application Load Balancer. The company needs to design a disaster recovery (DR) strategy in the us-west-2 Region with a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. The solution must minimize ongoing operational and infrastructure costs. Which disaster recovery strategy should a solutions architect recommend to meet these requirements?

Configure a cross-region RDS read replica in the DR region. Save the application server configurations as an Amazon Machine Image (AMI) and store the network infrastructure configurations as an AWS CloudFormation template. During a disaster, deploy the infrastructure from the template, promote the RDS read replica to a standalone database, and scale the application tier.

Configure a cross-region RDS read replica in the DR region. Pre-deploy the application load balancer and the Auto Scaling group in the DR region, running at a minimum capacity of one EC2 instance. During a disaster, promote the RDS read replica and scale out the Auto Scaling group to handle the production traffic.

Configure a cross-region RDS read replica in the DR region. Configure Amazon Route 53 with an active-passive failover routing policy pointing to the primary database in the main region and the read replica in the DR region. In the event of a failure, Route 53 will automatically promote the replica and route all database write traffic to the DR region.

Configure daily snapshots of the primary database and copy them to an Amazon S3 Glacier Flexible Retrieval vault in the DR region. Store the application server backups in S3 Glacier. During a disaster, initiate an expedited retrieval of the snapshots, restore the database, and provision new EC2 instances.

Show answer & explanation

Answer: Configure a cross-region RDS read replica in the DR region. Save the application server configurations as an Amazon Machine Image (AMI) and store the network infrastructure configurations as an AWS CloudFormation template. During a disaster, deploy the infrastructure from the template, promote the RDS read replica to a standalone database, and scale the application tier.

Answer

The correct strategy is the Pilot Light pattern. By maintaining a cross-region RDS read replica, the database replication is continuous, satisfying the 15-minute RPO. Storing compute and networking tier configurations as CloudFormation templates and AMIs ensures that no EC2 instances or load balancers are running during normal operations, minimizing ongoing costs. Recreating these resources and promoting the RDS read replica during a failover can easily be completed within the 2-hour RTO.

Step-by-Step Solution

Analyze the RPO requirement of 15 minutes.

Identify that data must be replicated to the recovery region in near real-time. A cross-region Amazon RDS read replica meets this requirement by replicating data asynchronously with replication lag typically measured in seconds.

To ensure that data loss does not exceed 15 minutes in the event of a disaster.

Analyze the RTO requirement of 2 hours and the cost-optimization constraint.

Determine that a Pilot Light strategy is the most cost-effective approach. Instead of keeping active compute resources running, store configurations as AMIs and AWS CloudFormation templates. The 2-hour RTO allows sufficient time to deploy these templates and provision the compute tier dynamically.

To minimize running infrastructure costs in the recovery region while still meeting the recovery time limit.

Formulate the failover process.

During a disaster, promote the cross-region read replica to a standalone primary database, run the CloudFormation template to deploy the Application Load Balancer and Auto Scaling group, and launch instances using the saved AMIs.

To complete the recovery process and restore full service in the secondary region.

Key Concept

Disaster recovery strategies differ in RTO, RPO, and cost. A Pilot Light strategy keeps the database replication active but compute resources offline, making it highly cost-effective while still meeting moderate recovery time objectives.

Question 1333Question →

A company is establishing its security baseline on AWS. The company needs to grant daily administrative access to its IT team and federate access for hundreds of workforce users managed in an external identity provider. Additionally, they must secure the AWS account owner identity. Which TWO actions should the solutions architect recommend to meet these requirements securely?

Select all that apply

Configure AWS IAM Identity Center to federate the external identity provider and manage user permissions using IAM roles.

Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to actions that specifically require root credentials.

Create individual IAM users with long-term access keys for each workforce user and configure local password policies.

Use the AWS account root user credentials to perform daily administrative tasks to simplify operational overhead.

Store sensitive API secrets as plaintext parameters in Systems Manager Parameter Store to allow administrative scripts to retrieve them without encryption overhead.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the external identity provider and manage user permissions using IAM roles.; Enable multi-factor authentication (MFA) on the AWS account root user and restrict its use to actions that specifically require root credentials.

Answer

Configure AWS IAM Identity Center to federate the external identity provider and manage user permissions using IAM roles, and enable multi-factor authentication (MFA) on the AWS account root user while restricting its use to actions that specifically require root credentials.

Securing the AWS infrastructure requires following best practices for user access and account security. The recommended approach is to federate workforce users from the external identity provider using AWS IAM Identity Center, allowing them to assume IAM roles for daily operations. Additionally, the AWS account root user should be secured with multi-factor authentication (MFA) and reserved strictly for tasks that require root credentials, rather than daily operations.

Step-by-Step Solution

Evaluate identity management requirements for workforce users.

Identify that using federated access via AWS IAM Identity Center avoids managing individual IAM users with long-term keys.

Aligns with AWS security best practices for centralized identity management.

Evaluate security requirements for the account owner identity.

Identify that the AWS account root user should be protected with multi-factor authentication (MFA) and not used for daily administrative work.

Ensures root credentials are secure and adheres to the principle of least privilege.

Key Concept

AWS Identity and Access Management (IAM) security best practices, including federating workforce identities with AWS IAM Identity Center and securing the root user account.

Estimated Time:1m 30s

Question 1334Question →

A solutions architect is reviewing the security of a web application running on Amazon EC2 instances. The solutions architect finds that a database password is currently stored as a plaintext string parameter in Systems Manager Parameter Store. The company requires the database credentials to be encrypted at rest and rotated automatically every 30 days. Which solution should the solutions architect implement to meet these requirements?

Store the credentials in AWS Secrets Manager, enable automatic rotation, and configure the application to retrieve the credentials from Secrets Manager.

Store the credentials as a standard String parameter in Systems Manager Parameter Store and restrict access using an IAM policy.

Store the credentials as a SecureString parameter in Systems Manager Parameter Store, and configure the application to use the AWS account root user credentials to retrieve them.

Store the credentials as a SecureString parameter in Systems Manager Parameter Store, and enable AWS KMS automatic key rotation to rotate the database password.

Show answer & explanation

Answer: Store the credentials in AWS Secrets Manager, enable automatic rotation, and configure the application to retrieve the credentials from Secrets Manager.

Answer

Store the credentials in AWS Secrets Manager, enable automatic rotation, and configure the application to retrieve the credentials from Secrets Manager.

AWS Secrets Manager natively supports both encryption at rest and automatic credential rotation (such as for Amazon RDS databases) without requiring custom code or infrastructure. The application can securely query Secrets Manager at runtime to retrieve the current password.

Step-by-Step Solution

Identify the secure storage service that natively supports automatic credential rotation.

AWS Secrets Manager is chosen because it integrates directly with database services to handle password rotation automatically.

This avoids custom scripting overhead and satisfies the security requirements.

Configure the application to dynamically fetch the credentials at runtime using the AWS SDK.

The application is updated to call the Secrets Manager API instead of hardcoding or querying plaintext parameters.

Ensures the application always uses the active, rotated credentials securely.

Key Concept

Secure secrets storage and lifecycle management using AWS Secrets Manager

Question 1335Question →

A company is migrating an on-premises database client application to AWS. The application runs on Amazon EC2 instances and requires access to a database on Amazon RDS. Corporate users must be authenticated via their enterprise directory to access the application. The application also needs to retrieve database credentials securely. Which TWO steps should a solutions architect take to implement a secure access and credential management strategy? (Select TWO.)

Select all that apply

Create an IAM role with the required permissions for database access, and associate it with the EC2 instances as an instance profile.

Store the database credentials in AWS Secrets Manager and enable automatic rotation of the secrets.

Configure the application to use the AWS account root user access keys to ensure uninterrupted administrative connectivity.

Create individual IAM users with long-term access keys for each enterprise directory user to allow direct authentication to the EC2 instances.

Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to simplify retrieval.

Show answer & explanation

Answer: Create an IAM role with the required permissions for database access, and associate it with the EC2 instances as an instance profile.; Store the database credentials in AWS Secrets Manager and enable automatic rotation of the secrets.

Answer

The solutions architect should associate an IAM role with the EC2 instances as an instance profile and store the database credentials in AWS Secrets Manager with automatic rotation enabled.

Associating an IAM role via an instance profile allows applications running on EC2 instances to securely access database resources using temporary credentials. AWS Secrets Manager securely stores database credentials, encrypts them at rest, and provides native rotation features to automatically update the credentials without manual intervention.

Step-by-Step Solution

Determine the secure method for EC2 instances to access other AWS services.

Identify that using an IAM role via an instance profile allows applications running on EC2 instances to acquire temporary credentials.

This avoids the need to distribute and manage long-term AWS credentials on the EC2 instances, adhering to the principle of least privilege.

Select a secure mechanism for storing and rotating database credentials.

Identify AWS Secrets Manager as the appropriate service for storing database credentials, which supports encryption at rest and automated credential rotation.

Secrets Manager helps meet compliance requirements by rotating secrets automatically without service interruption.

Key Concept

AWS IAM roles for EC2 instances (instance profiles) and AWS Secrets Manager for secure, encrypted credentials storage and automated rotation.

Question 1336Question →

A company is designing a web-based educational testing platform. When a student submits an exam, the platform must process the submission asynchronously to calculate the score, generate a PDF certificate, and send an email notification. The grading service must process the answers in the exact order they were submitted by the student to prevent concurrency issues, and multiple backend microservices must receive the submission events independently. Which solution meets these requirements with the least operational overhead?

Publish the exam submission events to an Amazon SNS standard topic. Subscribe separate Amazon SQS standard queues for the grading, certificate, and notification services to the SNS standard topic.

Publish the exam submission events to an Amazon SNS standard topic. Subscribe separate Amazon SQS FIFO queues for the grading, certificate, and notification services to the SNS standard topic.

Publish the exam submission events to an Amazon SNS FIFO topic. Subscribe separate Amazon SQS FIFO queues for the grading, certificate, and notification services to the SNS FIFO topic.

Publish the exam submission events to a single Amazon SQS standard queue, and configure the consumer services to poll the queue and filter for their respective message types.

Show answer & explanation

Answer: Publish the exam submission events to an Amazon SNS FIFO topic. Subscribe separate Amazon SQS FIFO queues for the grading, certificate, and notification services to the SNS FIFO topic.

Answer

Publish the exam submission events to an Amazon SNS FIFO topic. Subscribe separate Amazon SQS FIFO queues for the grading, certificate, and notification services to the SNS FIFO topic.

The correct solution uses an Amazon SNS FIFO topic subscribed to by multiple Amazon SQS FIFO queues. An SNS FIFO topic ensures that message ordering is preserved during fan-out, and SQS FIFO queues guarantee that the consumer microservices process the messages in the exact order they were published. This satisfies both the decoupling/fan-out requirement and the strict message ordering constraint with minimal operational overhead.

Step-by-Step Solution

Identify the fan-out requirement where multiple distinct services (grading, certificate, and notification) need to process the same exam submission event.

Amazon SNS is the standard AWS service to achieve event fan-out to multiple subscribers.

It allows a single published message to be delivered to multiple downstream endpoints automatically.

Analyze the ordering requirement which specifies that events must be processed in the exact order they are received to prevent concurrency issues.

Both the message delivery (SNS) and queueing (SQS) layers must support First-In-First-Out (FIFO) ordering.

Standard SNS and SQS queues only provide best-effort ordering, which can result in out-of-order execution.

Select the integration pattern that natively supports both fan-out and ordered delivery with minimal operational overhead.

Combine Amazon SNS FIFO with Amazon SQS FIFO queues.

SNS FIFO topics can deliver messages to SQS FIFO queues while preserving the message order and message group ID, eliminating the need for custom ordering or filtering logic in application code.

Key Concept

Decoupling event-driven architectures with ordering guarantees using SNS FIFO and SQS FIFO fan-out pattern.

Estimated Time:1m 30s

Question 1337Question →

A company is onboarding a new team of systems engineers who need access to administrative and monitoring resources in the AWS Management Console. The solutions architect wants to configure access to the AWS environment in alignment with AWS security best practices.

Which TWO actions should the solutions architect take to meet these requirements?

Select all that apply

Configure AWS IAM Identity Center to federate the developers' corporate identities and manage permissions using permission sets.

Enable multi-factor authentication (MFA) on all accounts, secure the AWS account root user credentials, and restrict its usage to root-only tasks.

Create individual IAM users with long-term access keys for each developer to access the AWS Management Console daily.

Use the AWS account root user credentials for daily administrative and development tasks to simplify resource management.

Store application credentials as plaintext String parameters in Systems Manager Parameter Store for easy retrieval by developers.

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate the developers' corporate identities and manage permissions using permission sets.; Enable multi-factor authentication (MFA) on all accounts, secure the AWS account root user credentials, and restrict its usage to root-only tasks.

Answer

The correct actions are to configure AWS IAM Identity Center for federated identity access, and to enable multi-factor authentication (MFA) while securing the AWS account root user credentials.

Federating user identities via AWS IAM Identity Center eliminates the need to manage individual long-term IAM user credentials, which aligns with AWS best practices for human access. Additionally, protecting the AWS account root user by enabling MFA and avoiding its use for daily administrative tasks ensures secure foundation access.

Step-by-Step Solution

Determine the best practice for user identity management.

Identify that AWS recommends identity federation via AWS IAM Identity Center for human users rather than creating individual IAM users with long-term credentials.

This reduces the risk of credential exposure and simplifies user management.

Determine the best practice for securing administrative access.

Identify that AWS recommends enabling multi-factor authentication (MFA) on all accounts, securing the AWS account root user credentials, and restricting root user usage.

This protects the AWS environment from unauthorized administrative operations.

Key Concept

AWS IAM Security Best Practices including identity federation and root account protection

Estimated Time:1m 0s

Question 1338Question →

A retail banking compliance platform hosts its transaction reporting application in the us-east-1 Region. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, and it uses an Amazon RDS for PostgreSQL Multi-AZ DB instance. The bank wants to establish a disaster recovery (DR) strategy in the us-west-2 Region. The solution must support a Recovery Point Objective (RPO) of 10 minutes and a Recovery Time Objective (RTO) of 15 minutes, while minimizing ongoing running costs. Which solution meets these requirements?

Enable Multi-AZ deployment for the RDS DB instance and designate the us-west-2 Region as the secondary Availability Zone. Deploy an Application Load Balancer and a scaled-down Auto Scaling group with a minimum capacity of 1 in the us-west-2 Region. Configure Route 53 latency routing to route traffic between the Regions.

Create a cross-Region Read Replica of the RDS DB instance in the us-west-2 Region. Deploy a replica Application Load Balancer and an Auto Scaling group with a minimum capacity of 0 in the us-west-2 Region. Configure Route 53 failover routing to point to the active Application Load Balancer, and write an automation script to increase the Auto Scaling group minimum capacity to 2 and promote the read replica during failover.

Create a cross-Region Read Replica of the RDS DB instance in the us-west-2 Region. Deploy a replica Application Load Balancer and a scaled-down Auto Scaling group with a minimum capacity of 1 in the us-west-2 Region. Configure Route 53 failover routing to point to the active Application Load Balancer, and promote the read replica to a standalone DB instance during failover.

Configure the RDS DB instance to perform daily backups and copy the snapshots to an Amazon S3 bucket in the us-west-2 Region using S3 Glacier Flexible Retrieval. In the event of a disaster, initiate an expedited retrieval to restore the database, and deploy the EC2 instances using AWS CloudFormation.

Show answer & explanation

Answer: Create a cross-Region Read Replica of the RDS DB instance in the us-west-2 Region. Deploy a replica Application Load Balancer and a scaled-down Auto Scaling group with a minimum capacity of 1 in the us-west-2 Region. Configure Route 53 failover routing to point to the active Application Load Balancer, and promote the read replica to a standalone DB instance during failover.

Answer

The correct strategy is a Warm Standby. To meet the 10-minute RPO, a cross-Region Read Replica is deployed in the us-west-2 Region to continuously replicate data asynchronously. To meet the 15-minute RTO, a replica Application Load Balancer and a scaled-down Auto Scaling group with a minimum capacity of 1 are deployed in the target Region. This ensures that the application is running and can immediately begin accepting traffic when Route 53 failover routing is triggered, while the Auto Scaling group scales up dynamically. During failover, the read replica is promoted to a standalone primary database instance.

Step-by-Step Solution

Determine the database replication strategy to satisfy the 10-minute Recovery Point Objective (RPO).

Identify that a cross-Region Read Replica replicates transactions asynchronously with minimal lag (seconds or minutes), which successfully satisfies the 10-minute RPO. Daily backups fail this requirement.

Choosing the correct replication technology is necessary to ensure data loss is kept under the target threshold.

Select the appropriate disaster recovery (DR) strategy to satisfy the 15-minute Recovery Time Objective (RTO).

Determine that a Warm Standby strategy (keeping a minimum capacity of 1 running instance in the target Region) is required to meet the 15-minute RTO. A Pilot Light strategy (minimum capacity of 0) takes too long to spin up, configure, and pass load balancer health checks from scratch.

Active but scaled-down services ensure immediate traffic ingestion, which minimizes failover delay.

Configure the failover mechanism for DNS routing.

Use Amazon Route 53 with failover routing policies pointing to the primary and secondary Application Load Balancers.

This guarantees that incoming traffic is automatically or manually redirected to the disaster recovery Region during an outage.

Key Concept

Disaster recovery strategy trade-offs (RTO and RPO) and AWS cross-region replication configurations.

Estimated Time:2m 0s

Question 1339Question →

A media streaming company is building a real-time multiplayer gaming platform. The system must process player movement and action events in the exact chronological order they are received to maintain game state consistency. Additionally, the system must broadcast these events to a live leaderboard service and a security auditing service. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon SNS FIFO topic and publish the game events to it.

Create Amazon SQS FIFO queues, subscribe them to the SNS FIFO topic, and configure the downstream services to consume messages from these queues.

Create a standard Amazon SNS topic to publish the game events and fan them out to standard Amazon SQS queues.

Create a standard Amazon SQS queue to buffer game events and configure the downstream services to poll the queue directly.

Create an Amazon EventBridge event bus with a custom rule to route messages directly to the target services.

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic and publish the game events to it.; Create Amazon SQS FIFO queues, subscribe them to the SNS FIFO topic, and configure the downstream services to consume messages from these queues.

Answer

Create an Amazon SNS FIFO topic to receive the game events, and create Amazon SQS FIFO queues subscribed to the topic for downstream services to consume.

To achieve ordered processing and fan-out, the architecture must combine an Amazon SNS FIFO topic and Amazon SQS FIFO queues. An SNS FIFO topic ensures that message ordering is maintained when fanning out to multiple subscribers. Subscribing SQS FIFO queues to this topic ensures that downstream services consume the events in the exact chronological sequence they were published.

Step-by-Step Solution

Analyze the ordering and fan-out requirements.

Identified that game events must be processed in strict chronological order and distributed to multiple downstream services (leaderboard and auditing).

This establishes that a FIFO (First-In-First-Out) messaging mechanism is required alongside a pub/sub fan-out pattern.

Select the appropriate pub/sub service.

Choose Amazon SNS FIFO topics to enable ordered fan-out.

Standard SNS topics do not guarantee message ordering, whereas SNS FIFO topics maintain the sequence of messages for all subscribed queues.

Select the appropriate queue type for the subscribers.

Choose Amazon SQS FIFO queues as subscribers to the SNS FIFO topic.

SNS FIFO topics only support SQS FIFO queues as subscribers, which ensures that the strict message order is preserved end-to-end for downstream consumers.

Key Concept

Decoupling with SNS FIFO and SQS FIFO for ordered fan-out architectures.

Question 1340Question →

A financial services company is designing a secure multi-account environment using AWS Organizations. The architecture requires that all member accounts enforce continuous security auditing. Specifically, administrators of the member accounts must be blocked from stopping, modifying, or deleting the organizational AWS CloudTrail. Additionally, the company must centralize access control for its 5,000 corporate identities currently managed in an external Okta directory, ensuring they do not use local IAM credentials. The security controls must not restrict administrative or billing operations within the Organizations management account.

Which two actions should a solutions architect take to meet these governance requirements? (Select TWO.)

Select all that apply

Create an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` actions, and attach the SCP to the root of the organization.

Enable AWS IAM Identity Center in the management account, connect it to the Okta directory using SAML 2.0 and SCIM, and assign permission sets to corporate groups to manage target member accounts.

Create an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` actions, and attach it directly to the Organizations management account to prevent its root user from disabling auditing.

Create individual IAM users with long-term access keys in the Organizations management account for each corporate identity, and configure cross-account IAM roles for member account access.

Provision IAM users with administrative permissions in each member account for the corporate identities, and assign them to an IAM group with restricted permissions to prevent local credential modifications.

Show answer & explanation

Answer: Create an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:UpdateTrail`, and `cloudtrail:DeleteTrail` actions, and attach the SCP to the root of the organization.; Enable AWS IAM Identity Center in the management account, connect it to the Okta directory using SAML 2.0 and SCIM, and assign permission sets to corporate groups to manage target member accounts.

Answer

Create an SCP that denies the CloudTrail modification actions and attach it to the root of the organization, and enable AWS IAM Identity Center integrated with Okta to manage access.

Attaching the SCP to the root of the organization restricts CloudTrail modification actions on all member accounts by inheritance, but because SCPs do not apply to the management account, administrative operations in the management account remain unrestricted. Integrating AWS IAM Identity Center with Okta using SAML 2.0 and SCIM ensures centralized identity federation and dynamic access provisioning to member accounts without creating individual local IAM users or long-term credentials.

Step-by-Step Solution

Evaluate the CloudTrail protection requirement.

Identify that a Service Control Policy (SCP) denying delete, stop, and update actions is required to prevent member account administrators from altering CloudTrail.

SCPs allow organization-wide control over actions that member account administrators can perform.

Determine where to attach the SCP to meet the management account exemption.

Attach the SCP to the organization root. The policy will inherit down to all member accounts but will not restrict the management account itself.

SCPs do not apply to the Organizations management account.

Address the centralized identity requirement for Okta users.

Use AWS IAM Identity Center to federate with the external Okta directory using SAML 2.0 and SCIM.

This avoids creating local IAM users with long-term keys and automates user provisioning.

Configure permissions for the federated users.

Map Okta groups to IAM permission sets in the target member accounts.

This enforces centralized access control in a multi-account environment.

Key Concept

Applying Service Control Policies (SCPs) in AWS Organizations and configuring AWS IAM Identity Center for external identity provider integration.

Estimated Time:3m 0s

PreviousPage 67 / 74Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept