All practice questions

723 questions

All types1,462 Multiple choice739 Multiple select723

A company hosts a critical e-commerce web application at the apex domain `example.com`. The primary infrastructure is deployed behind an Application Load Balancer (ALB) in the `us-east-1` Region. To implement a disaster recovery plan, the company deploys a warm standby version of the application behind another ALB in the `us-west-2` Region. The company wants to configure Amazon Route 53 to route all traffic to `us-east-1` under normal conditions and automatically fail over to `us-west-2` if the primary application becomes unhealthy.

Which TWO configuration steps must a solutions architect take in Route 53 to meet these requirements? (Select TWO.)

Select all that apply

Create a Failover Alias record for the apex domain pointing to the primary ALB, configure it as Primary, and set Evaluate Target Health to Yes.

Create a Failover Alias record for the apex domain pointing to the standby ALB, configure it as Secondary, and set Evaluate Target Health to Yes.

Create a CNAME record for the apex domain pointing to the DNS name of the primary ALB, and configure a secondary CNAME record with a Failover policy pointing to the standby ALB.

Create Latency Alias records pointing to both ALBs, and configure Route 53 to route 100% of the traffic to the primary region during normal operations.

Create a Failover record for the primary ALB, and configure a Route 53 health check that monitors the RDS PostgreSQL read replica in us-west-2 to trigger failover upon database promotion.

Show answer & explanation

Answer: Create a Failover Alias record for the apex domain pointing to the primary ALB, configure it as Primary, and set Evaluate Target Health to Yes.; Create a Failover Alias record for the apex domain pointing to the standby ALB, configure it as Secondary, and set Evaluate Target Health to Yes.

Answer

To configure active-passive failover at the apex domain, create a primary Failover Alias record pointing to the primary ALB, and a secondary Failover Alias record pointing to the standby ALB. For both records, set 'Evaluate Target Health' to 'Yes' to enable automatic health evaluation of the ALBs.

To set up active-passive failover for an apex domain pointing to Application Load Balancers, Route 53 requires two Failover Alias records (one Primary and one Secondary) sharing the same record name. The apex domain (example.com) cannot use CNAME records due to DNS specifications, so Alias records must be used. Setting 'Evaluate Target Health' to Yes on these Alias records allows Route 53 to automatically inherit the health status of the load balancers without requiring manual health check configurations.

Step-by-Step Solution

Select the apex domain in the Route 53 hosted zone and create a new record set.

A record set configuration window is opened for the zone apex (example.com).

The apex domain requires direct configuration of Alias records since CNAME records cannot exist at the zone apex.

Configure the primary record as an Alias to the primary Application Load Balancer in us-east-1, set the routing policy to Failover, select Primary as the failover type, and enable 'Evaluate Target Health'.

The primary record is configured to route all traffic to the us-east-1 ALB under normal operating conditions and monitor its health.

This establishes the active path and ensures Route 53 is aware of the health of the primary region's ALB.

Configure the secondary record as an Alias to the standby Application Load Balancer in us-west-2, set the routing policy to Failover, select Secondary as the failover type, and enable 'Evaluate Target Health'.

The secondary record is configured to receive traffic only when the primary record is determined to be unhealthy.

This establishes the passive failover path to the warm standby region when the primary region is unavailable.

Key Concept

Route 53 active-passive DNS failover configuration at the zone apex requires Primary and Secondary Failover Alias records pointing to the respective regional resources, with health evaluation enabled.

Estimated Time:2m 0s

Question 2Question →

A company hosts its main portal at the apex domain `example.com`. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in the `us-east-1` Region. The company wants to implement an active-passive disaster recovery strategy. If the ALB or the primary application becomes unhealthy, users must be redirected to a static maintenance page hosted on an Amazon S3 bucket configured for website hosting in the `us-west-2` Region. The database backend requires manual failover, so DNS routing must strictly route all users to the primary ALB under normal operations and only to the S3 bucket during a failure. Which two configurations should the solutions architect implement to meet these requirements?

Select all that apply

Create a Route 53 Failover Alias record for `example.com` pointing to the Application Load Balancer in `us-east-1`, set the Failover Record Type to Primary, and set Evaluate Target Health to Yes.

Create a Route 53 Failover Alias record for `example.com` pointing to the Amazon S3 static website endpoint in `us-west-2`, set the Failover Record Type to Secondary, and set Evaluate Target Health to No.

Create a Route 53 Latency Alias record for `example.com` pointing to the Application Load Balancer in `us-east-1` and set Evaluate Target Health to Yes to dynamically route users.

Create a CNAME record for `example.com` pointing to the Application Load Balancer DNS name, and configure a Route 53 HTTP health check to monitor the backend instances.

Create a Route 53 Failover record pointing to the Amazon RDS Read Replica, allowing Route 53 to automatically promote the replica to primary if the master database fails.

Show answer & explanation

Answer: Create a Route 53 Failover Alias record for `example.com` pointing to the Application Load Balancer in `us-east-1`, set the Failover Record Type to Primary, and set Evaluate Target Health to Yes.; Create a Route 53 Failover Alias record for `example.com` pointing to the Amazon S3 static website endpoint in `us-west-2`, set the Failover Record Type to Secondary, and set Evaluate Target Health to No.

Answer

Create a Route 53 Failover Alias record for the apex domain pointing to the Application Load Balancer in the primary region, set the record type as Primary, and enable Evaluate Target Health. Additionally, create a Route 53 Failover Alias record pointing to the S3 static website endpoint, set the record type as Secondary, and disable Evaluate Target Health.

To establish an active-passive failover for an apex domain, the solutions architect must configure Route 53 Failover Alias records. The Primary record points to the Application Load Balancer with Evaluate Target Health set to Yes. This configuration allows Route 53 to evaluate the health of the ALB and failover if the ALB is unhealthy. The Secondary record points to the S3 bucket website endpoint with Evaluate Target Health set to No, since the bucket serves as the static maintenance page and does not require further health validation.

Step-by-Step Solution

Determine the apex domain record requirements

Identify that the zone apex (`example.com`) cannot use a CNAME record, necessitating the use of Route 53 Alias records.

DNS standards prevent mapping a CNAME record directly to the root of a domain.

Configure the primary routing policy

Create a Failover Alias record pointing to the primary Application Load Balancer (ALB) and enable Evaluate Target Health.

This allows Route 53 to determine the health of the ALB using its built-in health indicators and dynamically failover when necessary.

Configure the backup routing policy

Create a Secondary Failover Alias record pointing to the Amazon S3 static website endpoint and disable Evaluate Target Health.

Disabling Evaluate Target Health on the secondary endpoint ensures traffic is successfully directed to the maintenance page during a failover event, without checking the health of the static page itself.

Key Concept

Route 53 active-passive DNS failover using Alias records at the zone apex

Question 3Question →

A gaming company is launching a multiplayer game and expects highly unpredictable traffic spikes during promotional events. The application requires microsecond read latency for player profiles and must scale dynamically to handle sudden write surges. A solutions architect chooses to use Amazon DynamoDB to store the profile data. Which database configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Configure the DynamoDB table to use on-demand capacity mode.

Deploy Amazon DynamoDB Accelerator (DAX) to cache read requests.

Configure the DynamoDB table to use provisioned capacity mode and enable auto scaling.

Design the table's partition key using a monotonically increasing timestamp.

Migrate the data to Amazon RDS for MySQL and configure read replicas as the primary automatic failover target.

Show answer & explanation

Answer: Configure the DynamoDB table to use on-demand capacity mode.; Deploy Amazon DynamoDB Accelerator (DAX) to cache read requests.

Answer

Configure the DynamoDB table to use on-demand capacity mode and deploy Amazon DynamoDB Accelerator (DAX) to cache read requests.

Configuring the DynamoDB table to use on-demand capacity mode ensures that DynamoDB scales instantly to handle sudden, unpredictable write spikes without throttling. Deploying Amazon DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read response times from milliseconds to microseconds, meeting the low-latency read requirements.

Step-by-Step Solution

Analyze the read latency requirement.

The application requires microsecond read latency.

Standard DynamoDB read response times are in single-digit milliseconds. Implementing Amazon DynamoDB Accelerator (DAX) is required to reduce read response times to microseconds.

Analyze the write scaling and traffic pattern requirements.

The workload is highly unpredictable with sudden spikes.

DynamoDB on-demand capacity mode is designed for workloads with unpredictable traffic spikes, providing instant capacity scaling without the delay associated with provisioned capacity auto scaling.

Key Concept

To achieve microsecond read latency and handle highly unpredictable traffic spikes with Amazon DynamoDB, solutions architects should combine DynamoDB Accelerator (DAX) for caching and on-demand capacity mode for instant scaling.

Question 4Question →

An enterprise is migrating a legacy customer management API to AWS. The API runs on a cluster of Amazon EC2 instances in a private subnet, configured to listen on port 8080. An Application Load Balancer (ALB) is deployed in public subnets to distribute incoming traffic. The application needs to dynamically scale based on demand while maintaining high availability. Traffic to the backend instances must be securely restricted, and the load balancer must accurately determine target health. Which two configurations should the solutions architect implement to satisfy these requirements? (Select two.)

Select all that apply

Configure the target group to route traffic to port 8080 and set the health check port to use the traffic port.

Configure the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the Application Load Balancer.

Configure the target group health check to query the default port 80 to ensure the web server is listening, while routing main traffic to port 8080.

Create a Network ACL on the private subnet that allows inbound traffic on port 8080 from the security group of the Application Load Balancer.

Configure an Amazon Route 53 latency-based routing policy to direct client requests directly to the private EC2 instances to handle the scaling load.

Show answer & explanation

Answer: Configure the target group to route traffic to port 8080 and set the health check port to use the traffic port.; Configure the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the Application Load Balancer.

Answer

To support an application running on port 8080, the target group must route traffic to port 8080 with the health check port matching the traffic port, and the EC2 instances' security group must allow inbound traffic on port 8080 from the security group of the Application Load Balancer.

To support an application running on port 8080, the target group must route traffic to port 8080 and its health checks must target the same port (or 'traffic-port') to ensure accurate status reporting. Additionally, to secure the architecture, the EC2 instances' security group should allow inbound traffic on port 8080 specifically from the security group of the Application Load Balancer.

Step-by-Step Solution

Configure the ELB Target Group mapping.

The target group is set to route requests to backend instances on port 8080.

Since the legacy API is configured to listen on port 8080, the ALB needs to target that specific port.

Align target health check port configuration.

The target group health checks query port 8080 (the traffic port).

Matching the health check port to the traffic port ensures that the load balancer correctly detects application availability without causing false unhealthy states.

Configure instance security group rules.

The EC2 instances' security group is restricted to allow port 8080 traffic only from the ALB's security group.

This implements the principle of least privilege by securing the backend instances so they can only receive traffic originating from the load balancer.

Key Concept

Integrating Elastic Load Balancing (ELB) with backend EC2 targets requires matching application ports for routing and health checks, and establishing secure path communications via security group chaining.

Estimated Time:2m 0s

Question 5Question →

A digital music distribution company hosts its core streaming platform in a primary AWS Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, and an Amazon Aurora MySQL database. The company wants to set up a disaster recovery (DR) solution in a secondary AWS Region with a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes, while minimizing ongoing infrastructure costs.

Which combination of actions should the solutions architect implement to meet these requirements at the lowest cost? (Select TWO.)

Select all that apply

Configure an Amazon Aurora Global Database with the primary database cluster in the primary Region and a secondary database cluster in the secondary Region.

Deploy a Pilot Light environment in the secondary Region with an Auto Scaling group set to a minimum capacity of zero, and scale it up during a failover event.

Configure an Amazon Route 53 latency routing policy to route traffic between Regions without configuring health checks.

Back up the database daily to Amazon S3 Glacier Flexible Retrieval in the primary Region and copy the archives to the secondary Region.

Configure a standard Amazon RDS MySQL Multi-AZ deployment and use a read replica in the secondary Region as the main automatic failover target.

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary database cluster in the primary Region and a secondary database cluster in the secondary Region.; Deploy a Pilot Light environment in the secondary Region with an Auto Scaling group set to a minimum capacity of zero, and scale it up during a failover event.

Answer

Configure an Amazon Aurora Global Database with a secondary cluster in the secondary Region, and deploy a Pilot Light environment in the secondary Region with an Auto Scaling group minimum capacity of zero.

The correct combination implements Amazon Aurora Global Database for sub-second cross-region data replication (satisfying the 5-minute RPO) and a Pilot Light environment in the secondary Region with compute resources set to a minimum capacity of zero (satisfying the 15-minute RTO at the lowest cost).

Step-by-Step Solution

Analyze the RPO requirement of 5 minutes to determine the database replication strategy.

Amazon Aurora Global Database provides sub-second cross-region replication, which easily satisfies the 5-minute RPO requirement.

Traditional backups or slower replication methods cannot meet a 5-minute recovery point objective.

Analyze the RTO requirement of 15 minutes and the goal of minimizing costs to determine the compute failover strategy.

A Pilot Light environment with an Auto Scaling group capacity set to zero ensures no running compute costs in the recovery Region while permitting new instances to spin up within 15 minutes.

A Warm Standby requires running active instances, which increases ongoing costs, while a Pilot Light meets both the recovery time and low-cost objectives.

Key Concept

Disaster Recovery (DR) strategies balancing RTO, RPO, and cost using Aurora Global Database and Pilot Light deployments.

Estimated Time:2m 0s

Question 6Question →

A financial technology startup recently deployed an application on AWS. The security team needs to establish continuous monitoring of resource configurations to ensure compliance with security standards. Specifically, they must detect when any Security Group allows unrestricted ingress traffic on port 22 or port 3389, and they must automatically remediate these non-compliant configurations by reverting the rules. Additionally, they need to centralize security alerts and compliance statuses across all AWS accounts in the organization. Which combination of AWS services and configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Implement AWS Config rules to monitor Security Group configurations and configure remediation using an AWS Systems Manager Automation document to remove non-compliant ingress rules.

Enable AWS Security Hub in the management account and configure it to aggregate compliance findings and security alerts from AWS Config across all accounts in the organization.

Deploy AWS WAF at the subnet level to inspect inbound traffic and automatically block unauthorized SSH and RDP connection attempts.

Configure stateful Network ACLs (NACLs) at the subnet level to monitor configuration changes and automatically block port 22 and port 3389 traffic.

Enable AWS Shield Advanced to continuously scan security group rules for compliance and automatically rotate security keys when unauthorized ports are open.

Show answer & explanation

Answer: Implement AWS Config rules to monitor Security Group configurations and configure remediation using an AWS Systems Manager Automation document to remove non-compliant ingress rules.; Enable AWS Security Hub in the management account and configure it to aggregate compliance findings and security alerts from AWS Config across all accounts in the organization.

Answer

Implement AWS Config rules to monitor and automatically remediate security groups using Systems Manager Automation, and use AWS Security Hub to centralize the aggregated findings across the organization.

AWS Config rules evaluate the configuration settings of AWS resources, detecting open ports in security groups and triggering automated remediation via AWS Systems Manager Automation. AWS Security Hub aggregates compliance data and security findings from AWS Config and other services across the organization into a centralized dashboard.

Step-by-Step Solution

Select AWS Config to track Security Group changes and configure automatic remediation.

AWS Config monitors configurations and triggers Systems Manager Automation to revert non-compliant rules.

AWS Config is the primary tool for monitoring configuration compliance, and AWS Systems Manager Automation provides remediation scripts.

Select AWS Security Hub to aggregate and centralize alerts.

AWS Security Hub acts as the centralized console to gather findings across the organization.

AWS Security Hub is designed to centralize and prioritize security alerts and compliance statuses across multiple AWS services and accounts.

Key Concept

Centralized compliance monitoring, configuration auditing, and automated remediation using AWS Config and AWS Security Hub.

Estimated Time:2m 0s

Question 7Question →

A global travel reservation platform hosts its application in the `us-east-1` Region. The architecture consists of an Amazon Aurora MySQL database cluster and a fleet of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The platform needs to establish a disaster recovery (DR) plan in the `us-west-2` Region. The DR solution must achieve a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $2$ minutes, while minimizing ongoing running costs in the secondary region.

Which combination of actions should a solutions architect perform to meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon Aurora Global Database with the primary cluster in `us-east-1` and a secondary cluster in `us-west-2`. In the event of a primary region outage, promote the secondary cluster to a standalone primary cluster.

Deploy an Application Load Balancer and an Auto Scaling group in `us-west-2` with minimum and desired capacities set to

1

. Configure Amazon Route 53 with failover routing and health checks to route traffic to the secondary load balancer.

Configure daily snapshots of the database cluster, copy them to Amazon S3 in `us-west-2`, and transition them to Amazon S3 Glacier Flexible Retrieval to minimize storage costs.

Configure Amazon Route 53 with latency-based routing to split client traffic equally between `us-east-1` and `us-west-2` without health checks, and maintain identical EC2 running capacity in both regions.

Deploy a standard Amazon RDS for MySQL database in `us-east-1` with a Read Replica in `us-west-2`, and rely on Amazon RDS to automatically fail over and redirect application write traffic to the Read Replica during a regional outage.

Show answer & explanation

Answer: Create an Amazon Aurora Global Database with the primary cluster in `us-east-1` and a secondary cluster in `us-west-2`. In the event of a primary region outage, promote the secondary cluster to a standalone primary cluster.; Deploy an Application Load Balancer and an Auto Scaling group in `us-west-2` with minimum and desired capacities set to $1$ . Configure Amazon Route 53 with failover routing and health checks to route traffic to the secondary load balancer.

Answer

Create an Amazon Aurora Global Database to replicate the database, and maintain a scaled-down Pilot Light compute tier in the secondary region with Route 53 failover routing.

Aurora Global Database replicates data across regions with latency under

1

second, satisfying the

2

-minute RPO. In a disaster, the secondary cluster can be promoted to a standalone primary cluster in less than

1

minute. Maintaining a scaled-down Auto Scaling group (Pilot Light) with a capacity of

1

in the secondary region minimizes ongoing costs while ensuring the infrastructure is ready to scale up within the

15

-minute RTO when Route 53 routes traffic there.

Step-by-Step Solution

Determine the database replication mechanism that meets the RPO of

2

minutes.

Aurora Global Database provides asynchronous replication with typical latency of less than

1

second, which fits the requirement.

Choosing a high-performing database replication technology is necessary to ensure data is constantly synchronized without violating the recovery point objective.

Determine the compute recovery strategy that meets the RTO of

15

minutes while minimizing running costs.

A Pilot Light strategy with an Auto Scaling group having a minimum/desired capacity of

1

keeps costs low while allowing rapid scaling when DNS failover is triggered.

Maintaining active but scaled-down services ensures that the endpoint infrastructure is online, which speeds up failover compared to building from backups.

Configure Amazon Route 53 failover routing with health checks.

DNS requests will resolve to the primary region under normal conditions and automatically redirect to the secondary region if the primary region becomes unhealthy.

Automatic failover requires health monitoring and dynamic DNS resolution routing policies to minimize manual intervention and meet the RTO.

Key Concept

Disaster Recovery (DR) strategies using Aurora Global Database and Pilot Light compute scaling across AWS Regions.

Question 8Question →

A company is designing a fleet management system that receives diagnostic alerts from vehicles. When an alert is received, it must be sent to two separate applications: a real-time notification service and a maintenance scheduling service. The system must decouple the alert reception from the processing services and handle traffic spikes without losing messages. Strict ordering of the alerts is not required.

Which combination of AWS services should a solutions architect choose to meet these requirements? (Select TWO.)

Select all that apply

Amazon Simple Notification Service (Amazon SNS) to fan out the alerts to multiple destination queues.

Amazon Simple Queue Service (Amazon SQS) standard queues to buffer the alerts for each processing service.

Amazon SQS FIFO queues to guarantee that all alerts are processed in the exact order they are received.

Amazon Route 53 with latency-based routing to distribute the alerts directly to the processing instances.

Show answer & explanation

Answer: Amazon Simple Notification Service (Amazon SNS) to fan out the alerts to multiple destination queues.; Amazon Simple Queue Service (Amazon SQS) standard queues to buffer the alerts for each processing service.

Answer

Amazon Simple Notification Service (Amazon SNS) to fan out the alerts to multiple destination queues, and Amazon Simple Queue Service (Amazon SQS) standard queues to buffer the alerts for each processing service.

To send the same event to multiple downstream systems and decouple them, the solutions architect should use the SNS-to-SQS fan-out pattern. Amazon SNS publishes the event once, and standard Amazon SQS queues subscribed to the SNS topic receive a copy of the message. This decouples the services, buffers the messages to handle traffic spikes, and avoids the unnecessary complexity of FIFO queues since ordering is not required.

Step-by-Step Solution

Analyze the requirements for decoupling and fan-out.

The alerts must be processed by two separate services independently (fan-out pattern) and decoupled to handle traffic spikes.

Identifying the patterns needed determines the correct architectural components.

Select the fan-out component.

Amazon SNS is selected to receive the alert and publish it to multiple destinations.

SNS is the standard AWS service for pub/sub messaging and fan-out patterns.

Select the buffering and queuing component.

Amazon SQS standard queues are selected to buffer the alerts for each subscriber service.

SQS standard queues provide message buffering, decoupling, and high throughput without requiring strict ordering.

Key Concept

The combination of Amazon SNS and Amazon SQS (fan-out pattern) allows messages to be sent to multiple destination queues, enabling decoupled, scale-resilient parallel processing without strict ordering requirements.

Question 9Question →

A global gaming platform is designing a network architecture to connect its on-premises development facility to multiple VPCs across different AWS Regions. The on-premises connection must be highly resilient, low-latency, and support a continuous simulation data stream of up to $5\text{ Gbps}$ . Additionally, the company hosts dynamic player APIs in both the `us-east-1` and `eu-west-1` Regions. Global players require the lowest possible network latency and high availability when accessing these dynamic endpoints. Which combination of AWS network architectures should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Establish an AWS Direct Connect connection to a Direct Connect gateway, and attach it to an AWS Transit Gateway to route traffic to the VPCs across multiple Regions.

Deploy AWS Global Accelerator to route dynamic player API traffic to the endpoints in both Regions using anycast IP addresses.

Set up a single AWS Site-to-Site VPN connection to a Transit Gateway to securely transport the

5\text{ Gbps}

simulation data stream over the internet.

Configure Amazon Route 53 latency-based routing policies to route dynamic API requests, relying on DNS caching to minimize latency for players.

Create a full mesh of VPC Peering connections between all Regions, and apply stateful Network Access Control Lists (NACLs) to manage access policies.

Show answer & explanation

Answer: Establish an AWS Direct Connect connection to a Direct Connect gateway, and attach it to an AWS Transit Gateway to route traffic to the VPCs across multiple Regions.; Deploy AWS Global Accelerator to route dynamic player API traffic to the endpoints in both Regions using anycast IP addresses.

Answer

The correct architecture combination includes establishing an AWS Direct Connect connection to a Direct Connect gateway attached to an AWS Transit Gateway, and deploying AWS Global Accelerator to route dynamic player API traffic using anycast IP addresses.

Establishing an AWS Direct Connect connection connected to a Direct Connect gateway and attached to an AWS Transit Gateway is the correct solution for the hybrid network. Direct Connect provides high bandwidth (up to

100\text{ Gbps}

) and low latency. Utilizing AWS Global Accelerator is the correct solution for player API traffic because it assigns anycast IP addresses that route traffic over the fast, congestion-free AWS global backbone network directly to the healthy ALB endpoints, bypassing the public internet.

Step-by-Step Solution

Analyze the on-premises throughput and multi-Region connection requirements.

Identify that the on-premises connection needs to support

5\text{ Gbps}

across multiple Regions with low latency.

Since a single VPN tunnel is limited to

1.25\text{ Gbps}

, AWS Direct Connect is required to meet the high bandwidth demand. Using a Direct Connect gateway with AWS Transit Gateway enables routing to multiple VPCs across different Regions.

Analyze the player API acceleration requirements for lowest latency and high availability.

Identify that the dynamic APIs are deployed in two Regions (`us-east-1` and `eu-west-1`) and require network acceleration.

AWS Global Accelerator uses anycast IP addresses to ingest traffic at edge locations and routes it over the high-performing AWS global network, which minimizes network hops and latency.

Evaluate and eliminate incorrect architectures.

Discard VPN due to bandwidth limits, Route 53 latency routing because it does not optimize TCP path latency, and stateful NACLs with VPC Peering because NACLs are stateless.

Eliminating invalid configurations ensures the proposed combination is both correct and optimal.

Key Concept

Designing high-performance, low-latency, and high-throughput hybrid and global network architectures using AWS Direct Connect, AWS Transit Gateway, and AWS Global Accelerator.

Question 10Question →

A global digital healthcare platform provides telehealth services through an Application Load Balancer (ALB) in the us-east-1 Region. The platform is experiencing intermittent latency due to a surge in malicious traffic, including distributed denial of service (DDoS) attempts at the network layer and SQL injection attempts at the application layer. The company needs to implement a solution that caches static healthcare resources at the edge, mitigates L3/L4 DDoS attacks, and blocks L7 malicious exploits before they reach the ALB. Which combination of configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache static assets and utilize built-in AWS Shield Standard for Layer 3 and Layer 4 protection.

Create an AWS WAF web ACL with SQL injection protection rules and associate it with the Amazon CloudFront distribution.

Enable AWS Shield Standard on the Application Load Balancer and configure it to inspect and block Layer 7 SQL injection attacks.

Configure stateless Network Access Control Lists (NACLs) at the subnet level to perform deep packet inspection and filter out SQL injection patterns.

Configure the Application Load Balancer security groups to block traffic originating from outside the local VPC CIDR block.

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache static assets and utilize built-in AWS Shield Standard for Layer 3 and Layer 4 protection.; Create an AWS WAF web ACL with SQL injection protection rules and associate it with the Amazon CloudFront distribution.

Answer

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer and associate an AWS WAF web ACL with the CloudFront distribution.

Deploying an Amazon CloudFront distribution provides global edge caching and automatically includes AWS Shield Standard protection to mitigate Layer 3 and Layer 4 DDoS attacks. Associating an AWS WAF web ACL with the CloudFront distribution allows the inspection of incoming HTTP requests at the edge, blocking Layer 7 exploits such as SQL injection before they reach the origin Application Load Balancer.

Step-by-Step Solution

Address caching and Layer 3/4 DDoS protection at the edge.

Amazon CloudFront is deployed to cache static content at edge locations. Traffic routed through CloudFront is automatically protected by AWS Shield Standard against infrastructure DDoS attacks.

This offloads traffic from the Application Load Balancer and mitigates L3/L4 network-layer threats before they hit internal systems.

Address Layer 7 SQL injection protection.

An AWS WAF web ACL is created with rules to detect SQL injection and is associated with the Amazon CloudFront distribution.

AWS WAF provides the deep packet inspection capabilities needed to inspect HTTP request bodies and block SQL injection attempts at the edge network.

Evaluate and eliminate incorrect firewall configurations.

Reject subnet Network ACLs and security groups as solutions for SQL injection protection.

NACLs and security groups operate at Layer 4 and cannot inspect Layer 7 payload content. Additionally, blocking external traffic via security groups would make the public platform inaccessible.

Key Concept

Combining Amazon CloudFront, AWS Shield Standard, and AWS WAF at the AWS edge to protect applications against Layer 3/4 DDoS and Layer 7 exploits.

Question 11Question →

A company is hosting a financial transaction processing application on Amazon EC2 instances in a private subnet (CIDR block $10.0.1.0/24$ ) within a VPC. The instances must meet the following network connectivity and security requirements:

1. Securely access Amazon S3 buckets to store transaction logs without traversing the public internet and without incurring data processing fees.
2. Establish outbound HTTPS connections to an external credit score API (destination IP address $203.0.113.50/32$ on TCP port $443$ ) while blocking all other outbound internet traffic.
3. Allow the return traffic from the external credit score API back to the EC2 instances.

A solutions architect has deployed a NAT gateway in a public subnet to handle internet egress. Which combination of network configuration steps must the solutions architect implement to satisfy these requirements? (Select TWO.)

Select all that apply

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the private subnet.

Configure the private subnet's Network ACL with an outbound rule allowing TCP port

443

203.0.113.50/32

. Do not configure an inbound rule for the return traffic, as Network ACLs are stateful and will automatically permit the response traffic.

Route all outbound traffic, including requests to Amazon S3, through the NAT gateway, and configure an Amazon S3 Interface VPC Endpoint in the public subnet to eliminate data processing fees.

Configure the private subnet's Network ACL with an outbound rule allowing TCP port

443

203.0.113.50/32

, and an inbound rule allowing TCP ports

1024-65535

from

203.0.113.50/32

Configure the security group attached to the EC2 instances with an inbound rule allowing TCP ports

1024-65535

from

203.0.113.50/32

to permit return traffic from the external credit score API.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the private subnet.; Configure the private subnet's Network ACL with an outbound rule allowing TCP port $443$ to $203.0.113.50/32$ , and an inbound rule allowing TCP ports $1024-65535$ from $203.0.113.50/32$ .

Answer

To secure the VPC network configuration, the solutions architect must create a Gateway VPC Endpoint for Amazon S3 associated with the private subnet's route table, and configure the private subnet's Network ACL with an outbound rule allowing TCP port 443 to the target API IP and an inbound rule allowing TCP ports 1024-65535 from the target API IP.

The correct architecture combines a Gateway VPC Endpoint for Amazon S3 with a stateless Network ACL configuration. First, using a Gateway VPC Endpoint for S3 is a free service that prevents S3 traffic from routing through the NAT gateway, thereby avoiding NAT data processing fees. Second, because Network ACLs are stateless, they require both an outbound rule to permit the request to the third-party API on port

443

and an inbound rule to permit the return traffic on the client's ephemeral port range (

1024-65535

) from the API's IP address.

Step-by-Step Solution

Address the S3 connectivity requirement by evaluating Gateway vs Interface endpoints.

Creating a Gateway VPC Endpoint for Amazon S3 is free, does not traverse the NAT gateway, and automatically updates the private subnet's route table to direct S3-destined traffic through the endpoint.

This satisfies the requirement to access Amazon S3 securely without using the internet or incurring data transfer costs.

Address the stateless filtering layer (Network ACLs) for the third-party API traffic.

An outbound Network ACL rule must allow traffic to

203.0.113.50/32

on port

443

. A corresponding inbound Network ACL rule must allow return traffic from

203.0.113.50/32

on ephemeral ports

1024-65535

Network ACLs are stateless; they do not track connection state, so return traffic must be explicitly permitted.

Address the stateful filtering layer (Security Groups) for the third-party API traffic.

The security group only needs an outbound rule allowing TCP port

443

203.0.113.50/32

. No inbound rule is needed.

Security groups are stateful; once outbound traffic is allowed, return traffic is dynamically permitted.

Key Concept

Stateless Network ACLs require explicit configuration for both outbound request traffic and inbound ephemeral return traffic, whereas stateful Security Groups handle return traffic automatically.

Estimated Time:3m 0s

Question 12Question →

A company has an application running on Amazon EC2 instances in AWS Account A (Development) that requires read-only access to an Amazon DynamoDB table located in AWS Account B (Production). According to security best practices, the application must not store long-term credentials on the EC2 instances. Which combination of actions should the solutions architect take to configure this access securely? (Select TWO.)

Select all that apply

Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and attach a permissions policy that grants read-only access to the DynamoDB table.

Configure an IAM role in Account A, attach it to the EC2 instances as an instance profile, and authorize the role to perform the sts:AssumeRole action on the Account B role.

Create access keys for the AWS account root user of Account B, and configure the application to retrieve them using instance metadata.

Create an IAM user in Account B, and configure the application to retrieve the user's access keys from a plaintext Systems Manager Parameter Store parameter of type String.

Create individual IAM users in Account B for the EC2 instances in Account A to use for federated access to the DynamoDB table.

Show answer & explanation

Answer: Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and attach a permissions policy that grants read-only access to the DynamoDB table.; Configure an IAM role in Account A, attach it to the EC2 instances as an instance profile, and authorize the role to perform the sts:AssumeRole action on the Account B role.

Answer

Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and configure an IAM role in Account A attached to the EC2 instances to authorize the sts:AssumeRole action on the Account B role.

The correct architecture uses cross-account role delegation. A role in Account B defines a trust relationship allowing Account A to assume it and carries the permission to read the DynamoDB table. The EC2 instances in Account A are assigned an instance profile with an IAM role that permits calling the sts:AssumeRole API on the role in Account B. This removes the need for long-term credentials on the instances.

Step-by-Step Solution

Define cross-account access trust in the target account

An IAM role is created in Account B with a trust policy allowing Account A to assume it, and a permission policy granting DynamoDB read permissions.

This establishes the target permissions and delegates trust to the source account.

Grant the EC2 instances permission to assume the cross-account role

An IAM role is created in Account A, attached as an EC2 instance profile, with policies allowing sts:AssumeRole on the role in Account B.

This enables the EC2 instances to dynamically request temporary credentials from STS for Account B.

Key Concept

Cross-account IAM role assumption and delegate trust pattern

Estimated Time:2m 0s

Question 13Question →

A weather research institute is deploying a distributed numerical weather prediction model on Amazon EC2. The application consists of tightly-coupled compute nodes that require sub-millisecond node-to-node network latency and maximum throughput to exchange state data. Additionally, a Solutions Architect must configure an Application Load Balancer (ALB) to route incoming analysis requests to the compute nodes, which listen on custom port 8080. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Deploy the EC2 instances in a cluster placement group.

Configure the Application Load Balancer target group health check to query port 8080.

Deploy the EC2 instances in a spread placement group.

Deploy the EC2 instances in a partition placement group.

Configure the Application Load Balancer target group health check to query the default port 80.

Show answer & explanation

Answer: Deploy the EC2 instances in a cluster placement group.; Configure the Application Load Balancer target group health check to query port 8080.

Answer

Deploying the EC2 instances in a cluster placement group and configuring the Application Load Balancer target group health check to query port 8080.

Deploying the EC2 instances in a cluster placement group places the instances close together within a single Availability Zone, which satisfies the requirement for sub-millisecond node-to-node latency and maximum network throughput. Additionally, because the application is listening on a custom port 8080, the target group health check must be explicitly configured to query port 8080 to ensure the load balancer can correctly monitor the application's status.

Step-by-Step Solution

Analyze the networking requirements of the distributed weather forecasting simulation nodes.

The nodes are tightly coupled and require sub-millisecond node-to-node latency and high network throughput.

This requirement determines the type of EC2 placement group needed.

Select the correct EC2 placement group style.

A cluster placement group is selected because it packs instances close together inside a single Availability Zone, achieving the lowest possible latency and highest network performance.

Spread and partition placement groups do not guarantee low-latency node-to-node communication.

Configure the Application Load Balancer target group settings for the simulation service.

The target group's health check is explicitly configured to query port 8080, matching the custom port on which the simulation service runs.

If the health check defaults to another port like 80, the load balancer will fail to reach the service, marking the healthy instances as unhealthy.

Key Concept

High-Performance Compute placement groups and target group health check port synchronization.

Estimated Time:2m 0s

Question 14Question →

A smart home IoT telemetry company runs its device monitoring platform in the us-east-1 Region. The database tier uses Amazon RDS for PostgreSQL. The compute tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The company needs to design a disaster recovery (DR) plan in the us-west-2 Region. The design must achieve a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 30 minutes, while keeping costs as low as possible. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Configure a cross-region read replica of the database in the secondary Region, and promote the replica to a standalone DB instance during a failover event.

Maintain a warm standby compute environment in the secondary Region with a scaled-down Auto Scaling group of EC2 instances, and scale it up to handle production traffic during a failover.

Deploy an RDS Multi-AZ deployment across the primary and secondary Regions to provide synchronous database replication and automatic failover.

Configure Amazon Route 53 with latency-based routing to automatically route traffic to the secondary Region without configuring health checks.

Export PostgreSQL database backups to Amazon S3 Glacier Deep Archive every 5 minutes, and restore the database from the backup during a failover.

Show answer & explanation

Answer: Configure a cross-region read replica of the database in the secondary Region, and promote the replica to a standalone DB instance during a failover event.; Maintain a warm standby compute environment in the secondary Region with a scaled-down Auto Scaling group of EC2 instances, and scale it up to handle production traffic during a failover.

Answer

The correct combination of actions is to configure a cross-region read replica of the database in the secondary Region, promoting it to a standalone DB instance during failover, and to maintain a warm standby compute environment in the secondary Region with a scaled-down Auto Scaling group of EC2 instances, scaling it up to handle production traffic during failover.

The correct strategy combines a database cross-region read replica and a warm standby compute environment. The cross-region read replica replicates data asynchronously, meeting the 5-minute RPO, and can be promoted to primary within minutes. A warm standby compute tier runs at a minimal capacity to reduce costs, and can be scaled out within 30 minutes to satisfy the RTO.

Step-by-Step Solution

Analyze the disaster recovery objectives: RPO is 5 minutes, and RTO is 30 minutes.

The replication lag must be under 5 minutes, and the recovery process (database promotion and compute scaling) must take less than 30 minutes.

This establishes the boundaries for data replication and infrastructure restoration speed.

Select the database replication strategy.

An Amazon RDS cross-region read replica provides asynchronous replication with low lag (meeting RPO) and can be promoted quickly (meeting RTO). RDS Multi-AZ is rejected because it is limited to a single Region.

Choosing the database configuration that provides cross-region capabilities is necessary to meet both RPO and RTO constraints.

Select the compute recovery strategy.

A warm standby compute environment keeps a scaled-down Auto Scaling group running in the secondary Region, keeping costs low while allowing quick scale-up during failover to meet the RTO.

This ensures the compute capacity is ready to serve traffic within the 30-minute RTO window without incurring the full cost of an active-active setup.

Key Concept

Disaster recovery strategies differ in RTO, RPO, and cost. A warm standby approach combined with cross-region read replicas provides a cost-effective solution for low RTO and RPO requirements across AWS Regions.

Question 15Question →

A company is designing a secure architecture for an application running on Amazon EC2 instances. The application needs to retrieve data from an Amazon RDS database and store reports in an Amazon S3 bucket. The security policy mandates that:

1. The EC2 instances must use short-term credentials to access the S3 bucket.
2. The database credentials must be rotated every 30 days without downtime.
3. The AWS KMS Customer Managed Key (CMK) used to encrypt S3 reports must be rotated annually without interrupting access to historical reports.

Which combination of actions should the company perform to meet these requirements? (Select TWO.)

Select all that apply

Attach an IAM role to the EC2 instances to grant S3 permissions, and use AWS Secrets Manager to store and automatically rotate the database credentials every 30 days.

Enable automatic annual rotation for the KMS Customer Managed Key, which creates a new backing key version for new writes while keeping old versions available for decryption.

Create an IAM user, store the long-term credentials in a configuration file on the EC2 instances, and store the database credentials as plaintext parameters in Systems Manager Parameter Store.

Enable automatic key rotation for the KMS key, and execute a custom script to immediately decrypt and re-encrypt all existing S3 reports with the new key version.

Log in to the AWS account root user to configure the database credentials in AWS Secrets Manager and to manually trigger the annual rotation of the KMS key.

Show answer & explanation

Answer: Attach an IAM role to the EC2 instances to grant S3 permissions, and use AWS Secrets Manager to store and automatically rotate the database credentials every 30 days.; Enable automatic annual rotation for the KMS Customer Managed Key, which creates a new backing key version for new writes while keeping old versions available for decryption.

Answer

The correct options are the ones suggesting to attach an IAM role to the EC2 instances and store database credentials in AWS Secrets Manager, and to enable automatic annual rotation for the KMS Customer Managed Key.

Attaching an IAM role to the EC2 instances allows them to retrieve temporary credentials to access the S3 bucket safely. AWS Secrets Manager can store database credentials and rotate them automatically without downtime. Enabling automatic annual key rotation on KMS Customer Managed Keys manages the backing keys seamlessly: it uses the new backing key for encryption, while keeping older backing key versions available to decrypt historical data without needing manual re-encryption or application updates.

Step-by-Step Solution

Address the requirement for secure, temporary credentials for the EC2 instances.

Attach an IAM role to the EC2 instances instead of using long-term IAM user access keys.

IAM roles utilize AWS Security Token Service (STS) to provide temporary security credentials, reducing credential leakage risks.

Address the requirement for database credential storage and automated rotation.

Use AWS Secrets Manager to store credentials and configure a 30-day automatic rotation schedule.

AWS Secrets Manager natively integrates with RDS to rotate credentials using Lambda without application downtime.

Address the requirement for KMS Customer Managed Key rotation.

Enable automatic annual rotation for the customer managed key.

Automatic KMS key rotation generates a new backing key for encryption while preserving older backing key versions for seamless decryption of historical data, requiring no manual re-encryption.

Key Concept

AWS Identity and Access Management (IAM) Roles, Secrets Manager rotation integration, and AWS KMS automatic key rotation mechanics.

Question 16Question →

A logistics company is designing an event-driven delivery tracking system. Status updates for each delivery package must be processed in the exact chronological order in which they are generated by drivers. The updates need to be delivered to two separate systems: an analytics dashboard that requires strict ordering of events per package, and an audit service that does not require ordered processing. The solution must scale to handle traffic spikes during peak hours without losing any updates.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create an Amazon SNS FIFO topic to receive the updates, and subscribe an Amazon SQS FIFO queue to the topic for the analytics dashboard.

Subscribe an Amazon SQS Standard queue to the Amazon SNS FIFO topic for the audit service.

Create an Amazon SNS Standard topic to receive the updates, and subscribe Amazon SQS FIFO queues to the topic for both the analytics dashboard and the audit service.

Create an Amazon SQS Standard queue to receive the updates, and configure both the analytics dashboard and the audit service to consume messages from the same queue.

Show answer & explanation

Answer: Create an Amazon SNS FIFO topic to receive the updates, and subscribe an Amazon SQS FIFO queue to the topic for the analytics dashboard.; Subscribe an Amazon SQS Standard queue to the Amazon SNS FIFO topic for the audit service.

Answer

Create an Amazon SNS FIFO topic and subscribe an Amazon SQS FIFO queue to it for the ordered analytics dashboard, and subscribe an Amazon SQS Standard queue to the same SNS FIFO topic for the unordered audit service.

To preserve message ordering during a fan-out pattern, an Amazon SNS FIFO topic must be used. SQS FIFO queues can be subscribed to the SNS FIFO topic to receive messages in chronological order, satisfying the requirements of the analytics dashboard. SQS Standard queues can also be subscribed to the same SNS FIFO topic, which satisfies the audit service's requirement since it does not need ordered processing.

Step-by-Step Solution

Identify the ordering requirements and fan-out architecture.

The analytics dashboard requires strict chronological order per package, while the audit service can process updates out of order. Both must receive all updates, necessitating a fan-out pattern.

This establishes that we need a messaging service capable of fan-out (such as Amazon SNS) combined with queuing (Amazon SQS) to decouple the publishers and subscribers.

Select the appropriate Amazon SNS topic type.

Choose Amazon SNS FIFO because it guarantees message ordering and deduplication, and supports delivering to SQS FIFO queues.

Standard SNS topics do not guarantee ordering and cannot deliver to SQS FIFO queues.

Select and subscribe the queues for each consumer.

Subscribe an Amazon SQS FIFO queue to the SNS FIFO topic for the ordered analytics dashboard. Subscribe an Amazon SQS Standard queue to the same SNS FIFO topic for the unordered audit service.

This setup preserves ordering for the dashboard through the end-to-end FIFO path while allowing the audit service to consume messages using a standard queue, since ordering is not required for auditing.

Key Concept

FIFO Fan-out using SNS FIFO and SQS FIFO/Standard

Question 17Question →

A company hosts a containerized backend application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application listens on custom port 8443, and the ALB terminates SSL/TLS on port 443. The solutions architect notices two issues: first, when instances fail internally, the ALB marks them as unhealthy, but the ASG continues to treat them as healthy and does not replace them; second, newly launched instances fail health checks immediately because traffic is blocked between the ALB and the instances. Which actions should the solutions architect take to resolve these issues and ensure a resilient architecture? (Select two.)

Select all that apply

Update the health check type of the Auto Scaling group from EC2 to ELB.

Configure the target group's health check to use port 8443, and ensure the EC2 instances' security group allows inbound traffic from the ALB security group on port 8443.

Modify the target group's health check to query the default HTTP port 80 to minimize processing overhead on the application's secure port.

Configure a stateless Network ACL on the subnet that allows inbound traffic on port 443 and blocks outbound ephemeral port traffic to secure the return path.

Establish an Amazon Route 53 latency routing policy pointing directly to the EC2 instances' public IP addresses to bypass the ALB during periods of high latency.

Show answer & explanation

Answer: Update the health check type of the Auto Scaling group from EC2 to ELB.; Configure the target group's health check to use port 8443, and ensure the EC2 instances' security group allows inbound traffic from the ALB security group on port 8443.

Answer

The correct actions are to update the health check type of the Auto Scaling group from EC2 to ELB, configure the target group's health check to use port 8443, and ensure the EC2 instances' security group allows inbound traffic from the ALB security group on port 8443.

To ensure that unhealthy application instances are replaced, the Auto Scaling group's health check type must be updated from EC2 to ELB so that target group health status changes trigger auto-replacement. Additionally, because the application runs on custom port 8443, the target group's health check must be explicitly set to port 8443, and the security group of the EC2 instances must allow inbound traffic from the ALB security group on port 8443.

Step-by-Step Solution

Analyze the Auto Scaling group health check settings.

Identify that EC2 health checks only monitor the hardware/hypervisor level, meaning application failures are ignored. Setting the ASG health check type to ELB aligns instance replacement with the ALB's status.

This guarantees that instances failing application-level checks are automatically terminated and replaced by the Auto Scaling group.

Verify communication paths and ports between the ALB and EC2 instances.

Confirm that the application listens on custom port 8443, meaning target group health checks must query 8443, and security groups must permit inbound traffic on port 8443 from the ALB security group.

This establishes a valid connection path for the ALB health checks, preventing newly launched healthy instances from being flagged as unhealthy.

Key Concept

Auto Scaling health check configurations and load balancer target group routing over custom ports.

Question 18Question →

A company is deploying a secure database client application on Amazon EC2 instances in a private application subnet (CIDR $10.100.2.0/24$ ) of a VPC. The application must securely query an AWS service using an Interface VPC Endpoint. To enhance security boundaries, the Interface VPC Endpoint is deployed in a separate dedicated endpoint subnet (CIDR $10.100.10.0/24$ ). Both subnets are associated with custom Network Access Control Lists (NACLs) that deny all inbound and outbound traffic by default. The EC2 instances must initiate HTTPS connections on port $443$ to the Interface VPC Endpoint. Which configuration steps must be implemented to allow this communication while maintaining the principle of least privilege? (Select TWO.)

Select all that apply

In the Network ACL associated with the private application subnet, add an outbound rule that allows outbound TCP traffic on port

443

to the destination CIDR

10.100.10.0/24

, and an inbound rule that allows inbound TCP traffic on ports

1024-65535

from the source CIDR

10.100.10.0/24

In the Network ACL associated with the VPC endpoint subnet, add an inbound rule that allows inbound TCP traffic on port

443

from the source CIDR

10.100.2.0/24

, and an outbound rule that allows outbound TCP traffic on ports

1024-65535

to the destination CIDR

10.100.2.0/24

In the Network ACL associated with the private application subnet, add an outbound rule that allows outbound TCP traffic on port

443

to the destination CIDR

10.100.10.0/24

. No corresponding inbound rule is required because Network ACLs automatically allow return traffic.

In the security group attached to the EC2 instances, add an outbound rule allowing TCP traffic on port

443

to the Interface VPC Endpoint's security group, and an inbound rule allowing TCP traffic on ports

1024-65535

from the Interface VPC Endpoint's security group.

In the security group attached to the Interface VPC Endpoint, add an inbound rule allowing TCP traffic on port

443

from the EC2 instances' security group. No security group rules are required on the EC2 instances because security groups are applied at the subnet boundary.

Show answer & explanation

Answer: In the Network ACL associated with the private application subnet, add an outbound rule that allows outbound TCP traffic on port $443$ to the destination CIDR $10.100.10.0/24$ , and an inbound rule that allows inbound TCP traffic on ports $1024-65535$ from the source CIDR $10.100.10.0/24$ .; In the Network ACL associated with the VPC endpoint subnet, add an inbound rule that allows inbound TCP traffic on port $443$ from the source CIDR $10.100.2.0/24$ , and an outbound rule that allows outbound TCP traffic on ports $1024-65535$ to the destination CIDR $10.100.2.0/24$ .

Answer

To establish communication under a default-deny Network ACL architecture, the Network ACL for the application subnet must allow outbound traffic on port

443

and inbound traffic on ephemeral ports

1024-65535

. Concurrently, the Network ACL for the endpoint subnet must allow inbound traffic on port

443

and outbound traffic on ephemeral ports

1024-65535

Because Network ACLs are stateless, they evaluate traffic in each direction independently. Since the EC2 client initiates an HTTPS request to the Interface VPC Endpoint across subnet boundaries, the application subnet's Network ACL must permit outbound TCP traffic on port

443

and inbound return traffic on the ephemeral port range (

1024-65535

). Reciprocally, the endpoint subnet's Network ACL must permit inbound TCP traffic on port

443

and outbound return traffic on the ephemeral port range (

1024-65535

) back to the application subnet.

Step-by-Step Solution

Analyze the statefulness of the firewalls involved.

Security groups are stateful (automatically tracking connections), whereas Network ACLs are stateless (requiring separate rules for inbound and outbound traffic).

This determines whether return traffic rules are required for each layer.

Determine the necessary rules for the stateless Network ACL in the client application subnet.

An outbound rule allowing destination port

443

to the endpoint subnet, and an inbound rule allowing source ephemeral ports

1024-65535

from the endpoint subnet.

Since the client initiates the connection, outbound traffic leaves on port

443

and returns on ephemeral ports.

Determine the necessary rules for the stateless Network ACL in the VPC endpoint subnet.

An inbound rule allowing destination port

443

from the application subnet, and an outbound rule allowing target ephemeral ports

1024-65535

to the application subnet.

Since the VPC endpoint receives the connection, inbound traffic enters on port

443

and return traffic is sent back to the client's ephemeral port range.

Key Concept

The stateless nature of Network ACLs requiring explicit configuration for both request and response traffic paths, compared to the stateful nature of Security Groups.

Estimated Time:2m 30s

Question 19Question →

A game development studio is migrating its build pipelines and testing environments to AWS. The studio manages all employees using an on-premises Microsoft Active Directory domain. The solutions architect must implement a single sign-on (SSO) solution that allows developers to access their respective AWS accounts within AWS Organizations using their existing on-premises credentials. The solution must minimize operational overhead, require no password replication to the cloud, and avoid manually managing long-term AWS credentials. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Deploy an AWS Directory Service AD Connector to establish a gateway that redirects directory requests to the on-premises Active Directory.

Enable AWS IAM Identity Center and configure the identity source to use the Active Directory directory connected via AD Connector.

Manually create individual IAM users in each AWS account for the developers and configure them to federate with the on-premises Active Directory.

Use the AWS Organizations management account root user to set up a shared cross-account role and distribute the root credentials to senior developers.

Show answer & explanation

Answer: Deploy an AWS Directory Service AD Connector to establish a gateway that redirects directory requests to the on-premises Active Directory.; Enable AWS IAM Identity Center and configure the identity source to use the Active Directory directory connected via AD Connector.

Answer

Deploy an AWS Directory Service AD Connector to redirect directory requests to the on-premises Active Directory, and configure AWS IAM Identity Center to use that directory as the identity source.

To integrate an on-premises Microsoft Active Directory with AWS for user access without replicating password hashes, the best approach is to deploy an AD Connector. The AD Connector acts as a proxy, directing authentication requests back to the on-premises directory. By enabling AWS IAM Identity Center and configuring it to point to the AD Connector directory, users can sign in using their corporate credentials and gain access to their assigned AWS accounts seamlessly.

Step-by-Step Solution

Deploy an AWS Directory Service AD Connector.

This establishes a directory gateway that connects AWS services to the on-premises Active Directory without duplicating credentials or password hashes.

This meets the requirement of not replicating passwords to the cloud while keeping operational overhead low.

Enable AWS IAM Identity Center and select the Active Directory directory as the identity source.

Developers can now sign in using their existing on-premises credentials via the AWS access portal.

This enables centralized SSO access to multiple AWS accounts within the organization without managing individual IAM users.

Key Concept

AWS Directory Service AD Connector and AWS IAM Identity Center integration for hybrid directory federation

Question 20Question →

An IoT asset tracking platform for a cold chain logistics company runs its application tier on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer in the us-east-1 Region. The database tier uses a Single-AZ Amazon RDS for PostgreSQL DB instance. The company needs to design a disaster recovery (DR) strategy in the us-west-2 Region that achieves a Recovery Point Objective (RPO) of $5$ minutes and a Recovery Time Objective (RTO) of $15$ minutes, while minimizing ongoing run costs. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Configure a cross-region read replica for the Amazon RDS for PostgreSQL DB instance in us-west-2 to replicate data asynchronously.

Configure Amazon RDS Multi-AZ replication directly between us-east-1 and us-west-2 to enable automatic, synchronous database failover to the secondary region.

Pre-deploy the Application Load Balancer in us-west-2, configure an Auto Scaling group with a minimum capacity of

1

instance, and use Amazon Route 53 failover routing with active health checks.

Deploy an Amazon Route 53 latency routing policy to distribute traffic across both regions, and use AWS CloudFormation to provision the Application Load Balancer and Auto Scaling group in us-west-2 from scratch upon detecting a failure.

Back up the database daily using AWS Backup, copy the recovery points to an Amazon S3 Glacier Flexible Retrieval vault in us-west-2, and restore the database to a new instance during a failover.

Show answer & explanation

Answer: Configure a cross-region read replica for the Amazon RDS for PostgreSQL DB instance in us-west-2 to replicate data asynchronously.; Pre-deploy the Application Load Balancer in us-west-2, configure an Auto Scaling group with a minimum capacity of $1$ instance, and use Amazon Route 53 failover routing with active health checks.

Answer

The correct strategy combines configuring an Amazon RDS for PostgreSQL cross-region read replica in the standby region with pre-deploying the Application Load Balancer and a scaled-down Auto Scaling group (minimum capacity of

1

instance) in that region, combined with Route 53 failover routing and health checks.

To meet both the

5

-minute RPO and

15

-minute RTO cost-effectively, a Warm Standby disaster recovery pattern is required. The database tier uses asynchronous cross-region read replication to keep replica lag under a few minutes, meeting the RPO. Promoting the replica to primary takes under

10

minutes. The compute tier pre-deploys the Application Load Balancer and keeps a minimum of

1

EC2 instance active in the Auto Scaling group, enabling immediate request handling upon failover and rapid scale-out, satisfying the RTO. Route 53 failover routing automatically detects primary region failure and routes traffic to the standby load balancer.

Step-by-Step Solution

Evaluate database disaster recovery options that satisfy the recovery objectives.

Confirm that an Amazon RDS cross-region read replica meets the

5

-minute RPO through asynchronous replication, and its promotion time meets the

15

-minute RTO.

Asynchronous replication across regions minimizes performance overhead on the primary database while keeping the standby database updated within seconds or minutes.

Determine the minimum compute deployment required in the secondary region to guarantee a failover time of less than

15

minutes.

Choose a Warm Standby pattern by pre-deploying the Application Load Balancer and running a minimum of

1

EC2 instance in the Auto Scaling group in the recovery region.

Deploying resources from scratch on failover (Pilot Light) takes too long to meet the

15

-minute RTO, whereas keeping a scaled-down compute tier active allows rapid scale-out and immediate request routing.

Configure DNS routing to handle failover automated detection.

Implement an Amazon Route 53 failover routing policy using health checks pointed at the primary region's resources.

Active health checks allow Route 53 to automatically detect a regional outage and redirect users to the pre-deployed standby load balancer in the secondary region.

Key Concept

Warm Standby Disaster Recovery Pattern

Page 1 / 37Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept