All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A company is designing a deployment pipeline using AWS CloudFormation to update a stateless API application running on Amazon EC2 instances. The instances are managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The update process must guarantee zero downtime. The new version of the API must be fully validated using synthetic test traffic in the production environment before receiving any live production traffic. If validation fails, the deployment must immediately revert to the previous version without configuration changes or downtime. Which deployment strategy should the solutions architect recommend to meet these requirements?

Configure a blue/green deployment strategy by defining a second target group and a second Auto Scaling group in the CloudFormation template. Use an ALB test listener to route synthetic test traffic to the new target group for validation. Once validation succeeds, update the ALB production listener default action to point to the new target group, and then scale down the old Auto Scaling group.

Configure the AutoScalingRollingUpdate update policy in the CloudFormation template, setting the MinInstancesInService parameter equal to the Auto Scaling group's desired capacity. Implement the cfn-signal helper script in the instance user data to notify CloudFormation of a successful bootstrap before updating the remaining instances.

Configure AWS CodeDeploy to manage a blue/green deployment using the existing Auto Scaling group. Define a deployment configuration that utilizes the AfterAllowTestTraffic lifecycle event hook to run validation tests on the new instances before CodeDeploy switches the production traffic to the new Auto Scaling group.

Create a nested CloudFormation stack containing the Auto Scaling group with the UpdateReplacePolicy attribute set to Retain. Deploy the new stack version alongside the old version, manually modify the ALB listener rules to point to the new Auto Scaling group's target group after validation, and then delete the old stack.

Show answer & explanation

Answer: Configure a blue/green deployment strategy by defining a second target group and a second Auto Scaling group in the CloudFormation template. Use an ALB test listener to route synthetic test traffic to the new target group for validation. Once validation succeeds, update the ALB production listener default action to point to the new target group, and then scale down the old Auto Scaling group.

Answer

Implementing a blue/green deployment by creating a secondary target group and Auto Scaling group via AWS CloudFormation fulfills all criteria. Using an Application Load Balancer (ALB) test listener enables validation with synthetic traffic on the new instances without affecting live users. Updating the production listener default action to point to the green target group provides an instantaneous, zero-downtime cutover that is easily reversible by pointing back to the blue target group if issues arise.

Step-by-Step Solution

Define target groups and Auto Scaling groups.

Two distinct target groups (Blue and Green) and two Auto Scaling groups are declared in the CloudFormation template, allowing isolated environments to run concurrently.

Separating environments is necessary to validate the new application version in production without impacting the live version.

Configure ALB test and production listeners.

A production listener routes user traffic to the active version, while a test listener routes QA/synthetic traffic to the new version.

This allows tests to run against the new code in the actual production environment without exposing live users to unvalidated code.

Perform the traffic swap and clean up.

Once validated, update the production listener's default action to point to the new target group. The old Auto Scaling group is then scaled down to optimize costs.

Swapping listener targets provides an instantaneous cutover with zero downtime and a simple rollback path if post-deployment anomalies occur.

Key Concept

Designing automated, zero-downtime blue/green deployment strategies using AWS CloudFormation and Application Load Balancer target group swapping.

Question 22Question →

A media streaming company manages a multi-account environment containing $60$ AWS accounts under a single AWS Organization. The security operations team requires all VPC Flow Logs from all member accounts to be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) to satisfy compliance guidelines. The solution must minimize administrative overhead and enforce least privilege.

Which TWO configurations must a Solutions Architect implement to achieve this goal?

Select all that apply

In the Security account, configure the S3 bucket policy to grant s3:PutObject and s3:GetBucketAcl permissions to the delivery.logs.amazonaws.com service principal, and restrict access using the aws:PrincipalOrgID condition key.

In the Security account, configure the KMS key policy for the customer managed key to grant kms:GenerateDataKey* and kms:Decrypt permissions to the delivery.logs.amazonaws.com service principal, and restrict access using the aws:PrincipalOrgID condition key.

In the Security account, configure the S3 bucket policy to grant s3:PutObject permissions to the IAM roles or root principals of the

60

member accounts using the aws:PrincipalOrgID condition key.

Enable Amazon S3 default encryption on the centralized bucket using the AWS managed key (aws/s3), and configure the S3 bucket policy to allow cross-account access.

Create and apply a Service Control Policy (SCP) at the organization root that grants s3:PutObject and kms:GenerateDataKey* permissions to the member accounts for the centralized bucket resource.

Show answer & explanation

Answer: In the Security account, configure the S3 bucket policy to grant s3:PutObject and s3:GetBucketAcl permissions to the delivery.logs.amazonaws.com service principal, and restrict access using the aws:PrincipalOrgID condition key.; In the Security account, configure the KMS key policy for the customer managed key to grant kms:GenerateDataKey* and kms:Decrypt permissions to the delivery.logs.amazonaws.com service principal, and restrict access using the aws:PrincipalOrgID condition key.

Answer

The correct configurations are: configuring the S3 bucket policy in the Security account to grant permission to the log delivery service principal, and configuring the customer managed KMS key policy to grant the log delivery service principal permission to use the key, both restricted by the Organization ID.

To centralize VPC Flow Logs to an S3 bucket in a different account, the S3 Log Delivery service principal (delivery.logs.amazonaws.com) requires permissions to write the logs. The S3 bucket policy must allow s3:PutObject and s3:GetBucketAcl for this service principal, restricted by the AWS Organization ID using the aws:PrincipalOrgID condition. Additionally, if the bucket is encrypted with a KMS customer managed key (CMK), the KMS key policy must grant kms:GenerateDataKey* and kms:Decrypt to the same service principal, also restricted by the Organization ID, because AWS managed keys (aws/s3) cannot be shared across accounts.

Step-by-Step Solution

Identify the service principal responsible for delivering VPC Flow Logs to Amazon S3.

The service principal is delivery.logs.amazonaws.com (S3 Log Delivery).

VPC Flow Logs are delivered by this managed AWS service principal rather than individual member account IAM roles or root principals.

Determine the required S3 bucket policy permissions and condition keys for cross-account organization-wide delivery.

The S3 bucket policy in the Security account must grant s3:PutObject and s3:GetBucketAcl to delivery.logs.amazonaws.com and restrict access using the aws:PrincipalOrgID condition.

This allows the S3 Log Delivery service to verify bucket ownership and write flow logs from any account in the AWS Organization while blocking external accounts.

Evaluate key management and encryption requirements for cross-account S3 log delivery.

The KMS key policy for the customer managed key must grant kms:GenerateDataKey* and kms:Decrypt to the delivery.logs.amazonaws.com service principal, restricted by aws:PrincipalOrgID.

AWS managed keys (aws/s3) cannot be used for cross-account log delivery because their policies cannot be modified. A customer managed key must be used, and the log delivery service principal needs permission to generate data keys to encrypt logs.

Key Concept

Centralized VPC Flow Logs ingestion using S3 Log Delivery and KMS Customer Managed Keys in a multi-account AWS Organization.

Question 23Question →

An enterprise is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of $30$ spoke VPCs spread across two AWS Regions: `us-east-1` and `us-west-2`. The VPCs are connected using an AWS Transit Gateway (TGW) in each region. The on-premises data center must connect to AWS with high availability and optimal performance.

The primary path is a $10$ Gbps AWS Direct Connect (DX) connection using a Transit Virtual Interface (Transit VIF) terminated at a Direct Connect Gateway (DXGW) associated with both TGWs. A backup path is established using an AWS Site-to-Site VPN connection over the internet, terminating directly on the TGWs.

During failover testing, the network team observes that traffic originating from the on-premises data center to the AWS spoke VPCs is being load-balanced across both the DX and VPN paths, causing asymmetric routing. Furthermore, outbound traffic from the AWS spoke VPCs to the on-premises network ( $10.0.0.0/8$ ) is preferring the VPN path because the on-premises router is advertising $10.0.0.0/8$ over the DX connection and more specific subnets ( $10.0.0.0/16$ and $10.1.0.0/16$ ) over the VPN connection.

Which combination of routing configurations will resolve these routing issues and ensure that the DX connection is prioritized for bi-directional traffic, while maintaining the VPN as a dynamic failover?

Configure the on-premises router to advertise the identical

10.0.0.0/8

prefix over both the DX and VPN BGP sessions. Set a higher BGP Local Preference on the on-premises router for routes received from AWS via the DX connection compared to the VPN. Prepend the on-premises Autonomous System (AS) number multiple times on the BGP advertisements sent to AWS over the VPN connection.

Configure the on-premises router to advertise the identical

10.0.0.0/8

prefix over both BGP sessions. Set a higher Multi-Exit Discriminator (MED) value on the BGP advertisements sent to AWS over the VPN connection. On the on-premises router, prepend the Autonomous System (AS) number on the DX BGP advertisements to skew the inbound path selection.

Leave the prefix advertisements as they are. In the AWS Transit Gateway route tables, configure a static route for

10.0.0.0/8

pointing to the DXGW attachment, and set its administrative distance lower than the propagated routes from the VPN connection to override the subnet specificity.

Route all on-premises and outbound traffic through a centralized egress VPC in each region containing a single NAT Gateway. On the on-premises router, configure policy-based routing to forward traffic to the NAT Gateway IP address, and configure the Transit Gateway to prioritize the NAT Gateway route over the VPN.

Show answer & explanation

Answer: Configure the on-premises router to advertise the identical $10.0.0.0/8$ prefix over both the DX and VPN BGP sessions. Set a higher BGP Local Preference on the on-premises router for routes received from AWS via the DX connection compared to the VPN. Prepend the on-premises Autonomous System (AS) number multiple times on the BGP advertisements sent to AWS over the VPN connection.

Answer

Configure the on-premises router to advertise the identical

10.0.0.0/8

The correct configuration addresses both inbound and outbound traffic paths. First, by advertising the identical prefix of

10.0.0.0/8

over both BGP sessions, it eliminates the longest prefix match bias toward the VPN. Second, by prepending the Autonomous System (AS) number on the VPN advertisements, the AS-path length for the VPN route becomes longer than the DX route, which causes AWS Transit Gateway to prefer the DX path for outbound traffic. Finally, setting a higher BGP Local Preference on the on-premises router for the DX connection ensures that traffic originating from the data center to AWS prefers the DX path, resolving the asymmetric routing issue.

Step-by-Step Solution

Align prefix advertisements across both hybrid paths.

The on-premises router is configured to advertise the same

10.0.0.0/8

prefix on both the DX Transit VIF and Site-to-Site VPN BGP sessions.

AWS Transit Gateway evaluates route preference starting with the longest prefix match. Because the VPN was advertising more specific subnets (

10.0.0.0/16

and

10.1.0.0/16

), AWS preferred the VPN path. Identical prefixes allow the TGW to move to the next BGP selection criteria.

Configure AS-path prepending on the standby path.

The Autonomous System (AS) number is prepended multiple times to BGP route advertisements sent over the VPN connection to AWS.

When prefix lengths are equal, AWS Transit Gateway prefers routes with shorter AS-path lengths. Prepending the AS-path on the VPN makes it look longer, forcing AWS to prefer the DX path for outbound traffic to on-premises.

Configure Local Preference on the customer gateway (on-premises router).

A higher BGP Local Preference is applied to routes received from AWS via the DX connection relative to those received via the VPN.

Local Preference is an attribute used within an Autonomous System to choose the exit point for outbound traffic. Setting it higher on the DX connection ensures that traffic originating from the data center to AWS prefers the DX connection over the VPN, preventing asymmetric routing.

Key Concept

BGP Path Selection and Longest Prefix Match in Hybrid AWS Environments

Question 24Question →

An international media broadcasting company is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of 50 spoke VPCs in a single AWS Region, which host various parts of a media processing pipeline. The company needs to establish a highly available, transitive connection between all VPCs and two on-premises sites: a primary production facility and a backup recovery center. The primary path must run over a 10 Gbps AWS Direct Connect connection. The backup path must use an IPsec VPN over the internet. The solution must minimize routing configuration complexity, automatically fail over to the backup path if the primary path is unavailable, and allow direct VPC-to-VPC communication. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Deploy an AWS Transit Gateway and attach all 50 spoke VPCs to it. Create a Direct Connect gateway, associate it with a transit virtual interface (transit VIF) on the Direct Connect connection, and attach the Direct Connect gateway to the Transit Gateway.

Create an AWS Site-to-Site VPN connection and terminate it on the AWS Transit Gateway. Advertise the same on-premises network prefixes over both the Direct Connect gateway and the VPN connection, using AS PATH prepending on the backup VPN connection to ensure the Direct Connect path is preferred.

Establish VPC peering connections between all 50 spoke VPCs to enable inter-VPC traffic. Create a Direct Connect gateway and attach it to a virtual private gateway (VGW) in each spoke VPC to handle hybrid routing.

Create a centralized egress VPC with a single NAT Gateway in one Availability Zone to route all outbound internet-bound traffic from the 50 spoke VPCs via the AWS Transit Gateway, modifying the spoke VPC route tables to point all 0.0.0.0/0 traffic to the Transit Gateway.

Show answer & explanation

Answer: Deploy an AWS Transit Gateway and attach all 50 spoke VPCs to it. Create a Direct Connect gateway, associate it with a transit virtual interface (transit VIF) on the Direct Connect connection, and attach the Direct Connect gateway to the Transit Gateway.; Create an AWS Site-to-Site VPN connection and terminate it on the AWS Transit Gateway. Advertise the same on-premises network prefixes over both the Direct Connect gateway and the VPN connection, using AS PATH prepending on the backup VPN connection to ensure the Direct Connect path is preferred.

Answer

The correct solution is to deploy an AWS Transit Gateway to connect the 50 spoke VPCs, routing hybrid traffic through a Direct Connect gateway with a transit virtual interface (transit VIF), while establishing a Site-to-Site VPN terminating on the Transit Gateway with AS PATH prepending on the VPN connection to ensure the Direct Connect path is preferred.

The correct solution involves deploying an AWS Transit Gateway to consolidate connectivity for the 50 spoke VPCs. The primary 10 Gbps path is established using a transit virtual interface (transit VIF) associated with a Direct Connect gateway attached to the Transit Gateway. The backup path is configured using a Site-to-Site VPN attachment directly on the Transit Gateway. To ensure the Direct Connect path is preferred, the same routes are advertised on both connections, but with AS PATH prepending configured on the VPN path.

Step-by-Step Solution

Select the hub-and-spoke connectivity pattern.

AWS Transit Gateway is selected to connect the 50 spoke VPCs, enabling scalable VPC-to-VPC and hybrid communications.

Standard VPC peering is difficult to scale for 50 VPCs, and virtual private gateways do not support transitive routing or sufficient associations.

Configure the primary hybrid path using AWS Direct Connect.

A transit virtual interface (transit VIF) is created on the Direct Connect connection, associated with a Direct Connect gateway, and attached to the Transit Gateway.

Transit VIFs are required when connecting Direct Connect to a Transit Gateway to enable hybrid routing to multiple VPCs.

Configure the backup hybrid path and path preference.

A Site-to-Site VPN connection is terminated on the Transit Gateway, and AS PATH prepending is configured on the VPN connection to make it less preferred than the Direct Connect path.

This guarantees high availability with automatic failover to the VPN while ensuring the Direct Connect connection is the primary path.

Key Concept

AWS Transit Gateway acts as a cloud router, enabling transitive routing between multiple VPCs and on-premises networks using transit VIFs for Direct Connect and Site-to-Site VPNs for failover.

Question 25Question →

A financial services company is designing a hybrid network architecture to connect $15$ spoke VPCs in a single AWS Region to its on-premises data center. The company has a dedicated $10\text{ Gbps}$ AWS Direct Connect connection and wants to establish an AWS Site-to-Site VPN connection over the public internet as a backup. The architecture must ensure that all spoke VPCs can communicate with the data center, that the VPN is only utilized if the Direct Connect connection becomes unavailable, and that administrative overhead is minimized. Which approach should the solutions architect recommend?

Create a Virtual Private Gateway (VGW) in each of the

15

spoke VPCs. Associate all

15

VGWs with a single Direct Connect Gateway (DXGW) connected via a Private Virtual Interface (Private VIF). Establish a separate Site-to-Site VPN connection from the on-premises data center to each of the

15

VGWs, using BGP routing with AS PATH prepending on the VPN connections.

Deploy an AWS Transit Gateway (TGW) and attach the

15

spoke VPCs to it. Associate the TGW with a Direct Connect Gateway (DXGW) connected via a Transit Virtual Interface (Transit VIF). Establish a single AWS Site-to-Site VPN connection from the on-premises data center to the TGW. Advertise identical prefixes over BGP for both paths, and prepend the AS PATH on the VPN connection to make it the less preferred path.

Deploy an AWS Transit Gateway (TGW) and attach the

15

spoke VPCs to it. Associate the TGW with a Direct Connect Gateway (DXGW) connected via a Private Virtual Interface (Private VIF). Establish a single AWS Site-to-Site VPN connection from the on-premises data center to the TGW. Configure static routes on the TGW pointing to the DXGW with a lower metric than the VPN routes.

Establish a hub-and-spoke VPC Peering topology by peering all

15

spoke VPCs with a central transit VPC. Associate the central VPC's Virtual Private Gateway (VGW) with a Direct Connect Gateway (DXGW) connected via a Private Virtual Interface (Private VIF). Create a single Site-to-Site VPN connection to the central VPC's VGW. Configure the route tables of the spoke VPCs to route on-premises traffic through the central VPC.

Show answer & explanation

Answer: Deploy an AWS Transit Gateway (TGW) and attach the $15$ spoke VPCs to it. Associate the TGW with a Direct Connect Gateway (DXGW) connected via a Transit Virtual Interface (Transit VIF). Establish a single AWS Site-to-Site VPN connection from the on-premises data center to the TGW. Advertise identical prefixes over BGP for both paths, and prepend the AS PATH on the VPN connection to make it the less preferred path.

Answer

Deploy an AWS Transit Gateway (TGW) and attach the

15

The correct solution uses AWS Transit Gateway to aggregate connectivity for the

15

spoke VPCs, bypassing the

10

VGW attachment limit of a Direct Connect Gateway. It utilizes a Transit Virtual Interface (Transit VIF) to connect the Transit Gateway to the Direct Connect Gateway, which is the only supported VIF type for Transit Gateway. Active/passive routing is achieved dynamically using BGP by advertising identical prefixes on both paths and prepending the AS PATH on the VPN connection, ensuring AWS prefers the shorter AS PATH on the Direct Connect connection under normal operations.

Step-by-Step Solution

Evaluate the scaling requirement for the

15

spoke VPCs.

Identify that a standard Direct Connect Gateway directly associated with Virtual Private Gateways (VGWs) is limited to a maximum of

10

VPCs, necessitating the use of AWS Transit Gateway (TGW) to aggregate the attachments.

Ensures the solution scales to meet the requirements of

15

VPCs without hitting service limits.

Determine the correct interface type for connecting the Transit Gateway to the Direct Connect Gateway.

Confirm that a Transit Virtual Interface (Transit VIF) is required on the Direct Connect connection to terminate on the Direct Connect Gateway and associate with the TGW.

Private VIFs only support VGW associations and cannot be used to connect to a Transit Gateway.

Configure backup routing and path preference.

Set up a Site-to-Site VPN connection to the Transit Gateway, advertise the same routes via BGP, and prepend the AS PATH on the VPN connection.

Allows BGP to automatically route traffic over the Direct Connect path as the primary route, while dynamically failing over to the VPN path only if the Direct Connect path goes offline.

Key Concept

Scale hybrid connectivity and configure active/passive routing over AWS Direct Connect and VPN using AWS Transit Gateway and Direct Connect Gateway.

Question 26Question →

A technology enterprise is designing a centralized monitoring and auditing solution for its AWS Organization, which contains $40$ member accounts. The security team requires that VPC Flow Logs from all VPCs across all member accounts be consolidated into a single Amazon S3 bucket located in a dedicated Monitoring account. The logs must be encrypted at rest using an AWS KMS key, and the transmission of logs must be secure and isolated to the organization. Which TWO configurations are required to establish this centralized log delivery architecture?

Select all that apply

Configure the centralized S3 bucket to use the default AWS-managed KMS key (aws/s3) to encrypt the delivered flow logs.

Configure an IAM role in each member account with s3:PutObject permissions for the centralized S3 bucket, and attach this role to the VPC Flow Logs configuration.

Attach a Service Control Policy (SCP) at the Organization root that explicitly grants s3:PutObject permissions to all member accounts for the destination S3 bucket.

Configure the S3 bucket policy in the Monitoring account to grant s3:PutObject and s3:GetBucketAcl permissions to the delivery.logs.amazonaws.com service principal.

Create a Customer Managed Key (CMK) in the Monitoring account, and configure its key policy to allow the delivery.logs.amazonaws.com service principal to use the kms:GenerateDataKey* and kms:Decrypt actions.

Show answer & explanation

Answer: Configure the S3 bucket policy in the Monitoring account to grant s3:PutObject and s3:GetBucketAcl permissions to the delivery.logs.amazonaws.com service principal.; Create a Customer Managed Key (CMK) in the Monitoring account, and configure its key policy to allow the delivery.logs.amazonaws.com service principal to use the kms:GenerateDataKey* and kms:Decrypt actions.

Answer

Configure the S3 bucket policy to allow the log delivery service principal to write objects and read bucket ACLs, and use a Customer Managed Key (CMK) with a key policy that grants the log delivery service principal permissions to generate data keys and decrypt.

The correct architecture uses the S3 bucket policy to grant necessary permissions to the AWS Log Delivery service principal (delivery.logs.amazonaws.com). In addition, since the logs are delivered across accounts and must be encrypted, a Customer Managed Key (CMK) must be configured to allow the log delivery service to generate data keys for encryption.

Step-by-Step Solution

Configure the destination Amazon S3 bucket policy in the Monitoring account.

The S3 bucket policy is updated to grant s3:PutObject and s3:GetBucketAcl permissions to the delivery.logs.amazonaws.com service principal, restricted by the Organization ID or source account IDs.

This allows the native AWS Log Delivery service to deliver the flow logs to the centralized bucket across account boundaries.

Create and configure a Customer Managed Key (CMK) in AWS KMS within the Monitoring account.

A Customer Managed Key is set up with a policy that allows the delivery.logs.amazonaws.com service principal to call kms:GenerateDataKey* and kms:Decrypt.

AWS-managed KMS keys do not support policy modification and cannot be used for cross-account log delivery encryption; thus, a Customer Managed Key must be used.

Key Concept

Centralized VPC Flow Logs delivery requires configuring permissions on both the S3 bucket and the KMS Customer Managed Key to allow the delivery.logs.amazonaws.com service principal to write and encrypt logs cross-account.

Question 27Question →

An enterprise is designing a hybrid network architecture to connect $30$ spoke VPCs in a single AWS Region to its on-premises data center. The primary connectivity must be established over a $10\text{ Gbps}$ AWS Direct Connect connection, with a backup AWS Site-to-Site VPN connection over the public internet. All outbound internet traffic from the spoke VPCs must be routed through a centralized egress VPC for security inspection. The solution must minimize routing complexity, avoid single points of failure, and support transitive routing between the VPCs.

Which of the following configuration steps should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Attach the Direct Connect Gateway (DXGW) to an AWS Transit Gateway using a Transit Virtual Interface (Transit VIF), and configure a backup AWS Site-to-Site VPN connection attached directly to the Transit Gateway.

In the Transit Gateway route table associated with the spoke VPCs, add a route for

0.0.0.0/0

pointing to the egress VPC attachment, and configure the spoke VPC subnet route tables with a default route pointing to the Transit Gateway.

Configure the Direct Connect Gateway (DXGW) to route traffic transitively between the spoke VPCs, and configure an AWS Site-to-Site VPN connection to a Virtual Private Gateway (VGW) in each spoke VPC.

Associate the internal Route 53 Private Hosted Zones with the egress VPC only, and configure a public virtual interface (VIF) on the Direct Connect connection to handle private multi-account VPC-to-VPC routing.

Deploy a single NAT Gateway in a single Availability Zone within the egress VPC, and update the spoke VPC subnet route tables to target the NAT Gateway directly for outbound traffic.

Show answer & explanation

Answer: Attach the Direct Connect Gateway (DXGW) to an AWS Transit Gateway using a Transit Virtual Interface (Transit VIF), and configure a backup AWS Site-to-Site VPN connection attached directly to the Transit Gateway.; In the Transit Gateway route table associated with the spoke VPCs, add a route for $0.0.0.0/0$ pointing to the egress VPC attachment, and configure the spoke VPC subnet route tables with a default route pointing to the Transit Gateway.

Answer

Attach the Direct Connect Gateway (DXGW) to an AWS Transit Gateway using a Transit Virtual Interface (Transit VIF), configure a backup AWS Site-to-Site VPN connection attached directly to the Transit Gateway, add a route for

0.0.0.0/0

in the Transit Gateway route table pointing to the egress VPC attachment, and configure spoke VPC subnet route tables to route default traffic to the Transit Gateway.

The correct solution involves deploying AWS Transit Gateway to handle both transitive VPC-to-VPC routing and centralized egress. The Direct Connect Gateway attaches to the Transit Gateway using a Transit VIF to scale hybrid bandwidth, while a backup AWS Site-to-Site VPN connection attaches directly to the Transit Gateway to provide a redundant path. Outbound internet traffic is centralized by directing spoke VPC default routes (

0.0.0.0/0

) to the Transit Gateway, and configuring the Transit Gateway's route tables to forward all

0.0.0.0/0

traffic to the egress VPC attachment.

Step-by-Step Solution

Determine the routing architecture for hybrid connectivity.

Deploy AWS Transit Gateway as a central hub, attach it to a Direct Connect Gateway using a Transit Virtual Interface (Transit VIF) for primary traffic, and configure AWS Site-to-Site VPN as a backup.

This supports transitive VPC-to-VPC routing and high-bandwidth primary hybrid connectivity with a redundant backup path.

Configure routing for centralized egress.

Add a default route (

0.0.0.0/0

) in the Transit Gateway route table pointing to the centralized egress VPC attachment. Configure spoke VPC subnet route tables with a default route (

0.0.0.0/0

) pointing to the Transit Gateway.

This centralizes outbound traffic to the egress VPC for security inspection while minimizing routing complexity.

Key Concept

AWS Transit Gateway acts as a centralized cloud router that simplifies hybrid connectivity by supporting Transit VIFs on Direct Connect Gateways and Site-to-Site VPNs, and enables centralized egress architecture by routing default routes (

0.0.0.0/0

) across VPC attachments.

Estimated Time:2m 0s

Question 28Question →

A company is developing a new regulatory reporting system. The application runs on Amazon ECS tasks in an Application account (Account ID: 123456789012). The system must write weekly reports to an Amazon S3 bucket located in a dedicated Compliance account (Account ID: 987654321098). The reports must be encrypted at rest using AWS KMS. The compliance team requires that the encryption key's access policy is managed under the Compliance account, and only the reporting application is authorized to perform encryption operations. Which design should a Solutions Architect recommend to meet these requirements securely?

In the Compliance account, create a Customer Managed Key (CMK). Configure the CMK's key policy to grant the ECS task role in the Application account permissions to perform kms:GenerateDataKey. Update the S3 bucket policy in the Compliance account to allow the ECS task role to perform s3:PutObject. Configure the ECS task role with IAM policies allowing s3:PutObject on the bucket and kms:GenerateDataKey on the CMK.

In the Compliance account, enable default S3 bucket encryption using the AWS-managed KMS key (aws/s3). Configure the S3 bucket policy in the Compliance account to allow the ECS task role in the Application account to perform s3:PutObject. Configure the ECS task role with IAM policies allowing s3:PutObject on the bucket and kms:GenerateDataKey on the AWS-managed key.

In the Compliance account, create a Customer Managed Key (CMK). Attach a Service Control Policy (SCP) to the Organizational Unit containing the Application account that grants the ECS task role permissions to perform kms:GenerateDataKey on the CMK in the Compliance account. Configure the S3 bucket policy to allow the Application account's ECS task role to perform s3:PutObject.

In the Compliance account, create a Customer Managed Key (CMK). Configure the S3 bucket policy in the Compliance account to allow the ECS task role to perform s3:PutObject and kms:GenerateDataKey. Configure the ECS task role with an IAM policy that allows s3:PutObject on the S3 bucket.

Show answer & explanation

Answer: In the Compliance account, create a Customer Managed Key (CMK). Configure the CMK's key policy to grant the ECS task role in the Application account permissions to perform kms:GenerateDataKey. Update the S3 bucket policy in the Compliance account to allow the ECS task role to perform s3:PutObject. Configure the ECS task role with IAM policies allowing s3:PutObject on the bucket and kms:GenerateDataKey on the CMK.

Answer

The correct design uses a Customer Managed Key (CMK) in the Compliance account and explicitly grants the Application account's ECS task role permission to perform the kms:GenerateDataKey operation. Because the S3 bucket and the KMS key are in a different account than the ECS task, the cross-account permissions must be granted on both the resource policies (S3 bucket policy and KMS key policy) and the ECS task role's IAM policy.

Step-by-Step Solution

Select the correct key type for cross-account operations.

Choose a Customer Managed Key (CMK) in the Compliance account because AWS-managed keys cannot be shared cross-account.

AWS-managed keys do not allow policy modifications, which are required to add the external Application account principal.

Configure the key policy for the Customer Managed Key.

Add a statement in the CMK policy that allows the ECS task role in the Application account to perform the kms:GenerateDataKey operation.

When writing to S3 with SSE-KMS, the caller must have the permission to generate a data key from the KMS key.

Configure the S3 bucket policy and IAM permissions.

Add a statement in the S3 bucket policy allowing s3:PutObject for the ECS task role, and ensure the ECS task role's IAM policy allows s3:PutObject and kms:GenerateDataKey.

Cross-account access requires permissions to be granted on both the trust resource policy (bucket policy/key policy) and the caller's identity-based policy (IAM policy).

Key Concept

Cross-account S3 access with KMS encryption requires Customer Managed Keys (CMKs) and correct alignment of both IAM policies and resource policies (S3 bucket and KMS key policies).

Estimated Time:2m 0s

Question 29Question →

A company is designing the deployment pipeline for a new web application. The application will run on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer (ALB). The infrastructure is provisioned using AWS CloudFormation. The team requires a deployment strategy that can route exactly $10\%$ of user traffic to the new version for testing. If any errors are detected, the deployment must immediately roll back all traffic to the old version. If the deployment is successful, all traffic must be shifted to the new version. The strategy must minimize both the time to roll back and the cost of keeping duplicate environments running after the deployment is complete.

Which deployment strategy meets these requirements?

Provision a second Auto Scaling group and a new ALB for the new application version. In Amazon Route 53, configure weighted routing policies for the application's domain name, setting a weight of

10

for the new ALB and

90

for the existing ALB. If errors occur, update the Route 53 weights to route

100\%

of the traffic to the existing ALB.

Configure the existing Auto Scaling group with a CloudFormation UpdatePolicy set to AutoScalingRollingUpdate. Configure the MaxBatchSize parameter to

10\%

of the total instance count to ensure only a subset of instances are updated first. Define CloudFormation rollback triggers using Amazon CloudWatch alarms to automatically revert the stack update if errors are detected.

Provision a second Auto Scaling group and a new ALB target group for the new application version. In the CloudFormation template, update the ALB listener rule to distribute traffic by assigning a weight of

10

to the new target group and

90

to the existing target group. After validating the deployment, update the CloudFormation template to set the weight of the new target group to

100

, and then terminate the old Auto Scaling group and target group.

Configure AWS CodeDeploy to perform an in-place deployment to the existing Auto Scaling group using the CodeDeployDefault.OneAtATime deployment configuration. Attach CloudWatch alarms to the deployment group to trigger an automatic rollback to the previous application version if errors are detected.

Show answer & explanation

Answer: Provision a second Auto Scaling group and a new ALB target group for the new application version. In the CloudFormation template, update the ALB listener rule to distribute traffic by assigning a weight of $10$ to the new target group and $90$ to the existing target group. After validating the deployment, update the CloudFormation template to set the weight of the new target group to $100$ , and then terminate the old Auto Scaling group and target group.

Answer

Provision a second Auto Scaling group and a new Application Load Balancer target group, then use AWS CloudFormation to shift traffic weights on the listener rule from 90/10 to 0/100.

The correct strategy uses Application Load Balancer (ALB) weighted target groups. This allows the system to direct exactly

10\%

of the live user traffic to the new Auto Scaling group and target group. Because the traffic shift happens at the load balancer layer, rollbacks can be performed instantaneously by updating the listener rule weights back to

100\%

for the old target group. Once the deployment is verified, the old Auto Scaling group and target group can be deleted, ensuring that duplicate costs are minimized.

Step-by-Step Solution

Provision a second Auto Scaling group and target group for the new version of the application using AWS CloudFormation.

A separate environment with the new version is created without impacting the existing production environment.

This allows testing the new version in isolation before routing live traffic to it.

Update the Application Load Balancer listener rule in CloudFormation to assign a weight of

10

to the new target group and

90

to the original target group.

Exactly

10\%

of incoming live traffic is immediately routed to the new version.

This establishes the requested canary testing configuration at the load balancer layer.

Monitor the deployment. If errors occur, revert the weights to route

100\%

of traffic to the original target group. If successful, set the weight of the new target group to

100\%

Traffic is either immediately rolled back or fully shifted to the new version, and the old Auto Scaling group and target group are terminated.

Shifting traffic at the Application Load Balancer level ensures instantaneous rollback or cutover, and terminating old resources minimizes ongoing costs.

Key Concept

Canary deployments using Application Load Balancer weighted target groups in AWS CloudFormation.

Estimated Time:2m 0s

Question 30Question →

A software-as-a-service (SaaS) provider manages $50$ AWS accounts using AWS Organizations. The security team is setting up an organization-wide trail in AWS CloudTrail to consolidate log delivery into a centralized Amazon S3 bucket in a dedicated Logging account. They require all consolidated logs to be encrypted at rest using an AWS Key Management Service (AWS KMS) key.

Which configuration is required to successfully deliver the encrypted logs from all accounts to the centralized S3 bucket?

Configure the S3 bucket policy in the Logging account to allow the s3:PutObject and s3:GetBucketAcl actions for the cloudtrail.amazonaws.com service principal with a condition matching the organization ID. Create a customer managed KMS key in the Logging account with a key policy that grants the kms:GenerateDataKey* and kms:DescribeKey permissions to the CloudTrail service principal with a condition matching the organization ARN.

Configure the S3 bucket policy in the Logging account to allow the s3:PutObject and s3:GetBucketAcl actions for the cloudtrail.amazonaws.com service principal with a condition matching the organization ID. Enable default S3 bucket encryption using the AWS-managed KMS key for S3 (aws/s3) in the Logging account, and configure the trail to use this key.

Create a customer managed KMS key in the Logging account with a key policy that grants the kms:GenerateDataKey* and kms:DescribeKey permissions to the CloudTrail service principal. Create an IAM role in the Logging account that allows the CloudTrail service principal to write to the S3 bucket, and rely on IAM delegation for member accounts without modifying the S3 bucket policy.

Create a customer managed KMS key in the Logging account with a key policy that grants the kms:GenerateDataKey* and kms:DescribeKey permissions to the CloudTrail service principal. Attach a Service Control Policy (SCP) to the root of the AWS Organization that explicitly grants the s3:PutObject permission on the centralized S3 bucket to the CloudTrail service principal for all OUs.

Show answer & explanation

Answer: Configure the S3 bucket policy in the Logging account to allow the s3:PutObject and s3:GetBucketAcl actions for the cloudtrail.amazonaws.com service principal with a condition matching the organization ID. Create a customer managed KMS key in the Logging account with a key policy that grants the kms:GenerateDataKey* and kms:DescribeKey permissions to the CloudTrail service principal with a condition matching the organization ARN.

Answer

The correct answer provides the necessary resource-based policies to authorize cross-account CloudTrail log delivery and KMS encryption. Specifically, the S3 bucket policy must allow the cloudtrail.amazonaws.com service principal to write objects and read ACLs, restricted to the organization ID. In addition, because logs from member accounts are delivered to a centralized bucket, an AWS-managed KMS key cannot be used since its policy cannot be modified to permit cross-account access. Therefore, a customer managed KMS key must be created, and its key policy must allow the CloudTrail service principal to generate data keys on behalf of the organization's accounts.

Step-by-Step Solution

Configure permissions for the S3 bucket in the Logging account.

The S3 bucket policy is updated to allow the cloudtrail.amazonaws.com service principal to write logs (s3:PutObject) and read bucket ACLs (s3:GetBucketAcl), restricted to the Organization ID using the aws:PrincipalOrgID condition.

CloudTrail requires explicit bucket policy permissions to deliver logs to an S3 bucket in a different account.

Create and configure a Customer Managed Key (CMK) in AWS KMS.

A customer managed KMS key is created in the Logging account. The key policy is configured to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the cloudtrail.amazonaws.com service principal, with conditions to restrict usage to trails within the Organization.

AWS-managed KMS keys cannot be shared cross-account. Consolidating encrypted logs from multiple member accounts requires a customer managed key with a custom key policy that allows cross-account usage.

Enable the KMS encryption on the organization trail.

The organization trail is configured to encrypt logs using the newly created customer managed KMS key.

This ensures that all logs delivered from any member account in the organization are securely encrypted using the customer managed KMS key before being stored in the centralized S3 bucket.

Key Concept

Centralized cross-account logging with encryption using AWS KMS customer managed keys and S3 bucket policies in a multi-account organization.

Estimated Time:2m 30s

Question 31Question →

An organization has a multi-account AWS environment with $25$ VPCs deployed across two AWS Regions: `us-east-1` and `us-west-2`. The organization has established a hybrid network using two $10\text{ Gbps}$ AWS Direct Connect connections terminating at separate DX locations. To ensure resiliency, they want to configure a backup path using a Site-to-Site VPN over the internet. The Direct Connect connections terminate at an AWS Direct Connect Gateway associated with AWS Transit Gateways in each region. Under normal operating conditions, all hybrid traffic must use the Direct Connect connections. The Site-to-Site VPN should only be used if both Direct Connect connections fail. Which two routing configurations must the solutions architect implement on the on-premises router and within AWS to achieve this dynamic failover behavior?

Select all that apply

Configure the on-premises router to advertise the on-premises IP prefixes to AWS with a shorter AS path over the Direct Connect transit virtual interface than over the Site-to-Site VPN connections.

Configure the on-premises router to assign a higher BGP local preference to the AWS routes received over the Direct Connect transit virtual interface than those received over the Site-to-Site VPN connections.

Configure the on-premises router to prepend its autonomous system (AS) number multiple times when advertising routes over the Direct Connect transit virtual interface.

Associate the Route 53 Private Hosted Zone of the organization's core services with the customer gateway device using a virtual private gateway.

Deploy a single NAT Gateway in a public subnet of a central egress VPC and configure all Transit Gateway route tables to route on-premises traffic through it.

Show answer & explanation

Answer: Configure the on-premises router to advertise the on-premises IP prefixes to AWS with a shorter AS path over the Direct Connect transit virtual interface than over the Site-to-Site VPN connections.; Configure the on-premises router to assign a higher BGP local preference to the AWS routes received over the Direct Connect transit virtual interface than those received over the Site-to-Site VPN connections.

Answer

The solutions architect should configure the on-premises router to advertise the on-premises IP prefixes with a shorter AS path over the Direct Connect virtual interface, and configure the on-premises router to assign a higher BGP local preference to the AWS routes received over the Direct Connect interface.

To ensure the Direct Connect connection is used as the primary path and the VPN as the backup, routing preferences must be set for both directions of traffic. For traffic going from AWS to on-premises (outbound), the Transit Gateway evaluates the BGP AS path length. By advertising the on-premises prefixes with a shorter AS path over the Direct Connect transit virtual interface, AWS will prefer this path. For traffic going from on-premises to AWS (inbound), the customer gateway should prefer the Direct Connect path by assigning it a higher BGP local preference, which is processed locally on the router before other BGP path attributes.

Step-by-Step Solution

Configure the outbound routing preference from AWS to on-premises by adjusting the AS path length advertised from the customer gateway.

The Transit Gateway receives routes for on-premises CIDRs over both Direct Connect and VPN, but prefers Direct Connect due to the shorter AS path length.

This guarantees that all outbound traffic from the AWS VPCs to the on-premises environment uses the Direct Connect path under normal operating conditions.

Configure the inbound routing preference from on-premises to AWS on the local router using BGP local preference.

The local router receives the AWS prefixes over both Direct Connect and VPN, and selects Direct Connect as the best path due to the higher local preference value.

This guarantees that all inbound traffic from the on-premises environment to AWS VPCs uses the Direct Connect path under normal operating conditions.

Key Concept

Using BGP attributes such as AS path length and local preference to establish symmetric routing preferences over hybrid network connections.

Question 32Question →

An enterprise is designing a deployment pipeline for a legacy Java application hosted on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer. The deployment must achieve zero downtime and allow for a 1-hour verification window where the old version remains active but receives no traffic, enabling rapid rollback if issues are detected. If the validation succeeds, the old instances must be automatically terminated. The deployment process must be fully managed with minimal custom configuration. Which two configurations should the Solutions Architect include in the AWS CodeDeploy deployment group to meet these requirements? (Select two.)

Select all that apply

Configure the deployment group to copy the Auto Scaling group and use the Application Load Balancer target group to route traffic.

Configure the deployment group settings to reroute traffic immediately, and set the original Auto Scaling group instances to terminate after a waiting period of 60 minutes.

Set the deployment configuration to CodeDeployDefault.EC2Linear10PercentEvery10Minutes to shift traffic between the blue and green environments.

Configure an Auto Scaling lifecycle hook on the original Auto Scaling group for the EC2_INSTANCE_TERMINATING transition with a heartbeat timeout of 3600 seconds.

Create a second Auto Scaling group for the new version and configure an Amazon Route 53 weighted routing policy to shift traffic between the two Auto Scaling groups over 60 minutes.

Show answer & explanation

Answer: Configure the deployment group to copy the Auto Scaling group and use the Application Load Balancer target group to route traffic.; Configure the deployment group settings to reroute traffic immediately, and set the original Auto Scaling group instances to terminate after a waiting period of 60 minutes.

Answer

Configure the deployment group to copy the Auto Scaling group and use the Application Load Balancer target group to route traffic, and configure the deployment group settings to reroute traffic immediately while setting the original Auto Scaling group instances to terminate after a waiting period of 60 minutes.

For an EC2 Auto Scaling deployment using CodeDeploy, a blue/green deployment requires copying the Auto Scaling group and using an Application Load Balancer target group to route traffic. Setting the deployment group to reroute traffic immediately and setting the original instances to terminate after a 60-minute wait time ensures that traffic shifts to the new version immediately while keeping the old instances running and deregistered from the load balancer. This provides a 1-hour window for verification and rapid rollback without downtime, followed by automated termination.

Step-by-Step Solution

Determine the deployment type and environment configuration.

CodeDeploy Blue/Green deployment is chosen, configuring the deployment group to copy the original Auto Scaling group and swap traffic via the Application Load Balancer target group.

This establishes a fully managed blue/green setup where CodeDeploy handles the creation of the green environment automatically.

Configure the traffic rerouting and validation window.

Set the deployment group to reroute traffic immediately once the green instances pass health checks, and configure the original instances' termination wait time to 60 minutes.

This meets the requirement of keeping the old instances active but not receiving traffic (deregistered) for a 1-hour verification period to allow rapid rollback.

Key Concept

AWS CodeDeploy Blue/Green deployment configurations for EC2 Auto Scaling Groups

Question 33Question →

An enterprise is designing a hybrid network architecture to connect ` $45$ ` spoke VPCs in the `us-east-1` Region to its on-premises corporate data center. The architecture must support a high-throughput primary path and a redundant backup path. The enterprise has provisioned a ` $10\text{ Gbps}$ ` AWS Direct Connect connection and wants to use an IPsec Site-to-Site VPN over the public internet as the backup. The design must ensure that the Direct Connect connection is the preferred path for all bidirectional traffic under normal operating conditions, failover to the VPN is automatic, routing is symmetric to support stateful firewalls on-premises, and administrative overhead is minimized. Which architecture and routing configuration will meet these requirements?

Configure an AWS Transit Gateway in `us-east-1` and attach the `

45

` spoke VPCs. Create a Direct Connect Gateway and associate it with the Transit Gateway using a Transit Virtual Interface. Establish an IPsec Site-to-Site VPN connection and attach it to the Transit Gateway. Enable BGP routing on both paths, and configure the on-premises router to assign a higher BGP Local Preference to routes received via the Direct Connect connection compared to the VPN connection.

Configure an AWS Transit Gateway in `us-east-1` and attach the `

45

` spoke VPCs. Create a Direct Connect Gateway and associate it with the Transit Gateway using a Private Virtual Interface. Establish an IPsec Site-to-Site VPN connection and attach it to the Transit Gateway. Configure static routes in the Transit Gateway route table pointing to the VPN attachment with a higher administrative distance to ensure it is only used during a failover.

Create a Virtual Private Gateway in each of the `

45

` spoke VPCs. Set up a mesh of VPC peering connections among all `

45

` VPCs to enable inter-VPC traffic. Associate each Virtual Private Gateway with a Direct Connect Gateway using Private Virtual Interfaces, and establish separate Site-to-Site VPN connections to each VPC to act as backup paths. Configure the on-premises router to prefer the Direct Connect path using BGP Local Preference.

Configure an AWS Transit Gateway in `us-east-1` and attach the `

45

` spoke VPCs. Create a Direct Connect Gateway and associate it with the Transit Gateway using a Transit Virtual Interface. Establish an IPsec Site-to-Site VPN connection to the Transit Gateway. Enable Equal-Cost Multi-Path routing on the Transit Gateway, and configure the on-premises router to advertise more specific prefixes over the VPN connection than over the Direct Connect connection.

Show answer & explanation

Answer: Configure an AWS Transit Gateway in `us-east-1` and attach the ` $45$ ` spoke VPCs. Create a Direct Connect Gateway and associate it with the Transit Gateway using a Transit Virtual Interface. Establish an IPsec Site-to-Site VPN connection and attach it to the Transit Gateway. Enable BGP routing on both paths, and configure the on-premises router to assign a higher BGP Local Preference to routes received via the Direct Connect connection compared to the VPN connection.

Answer

Configure an AWS Transit Gateway, connect the Direct Connect Gateway via a Transit Virtual Interface, establish a Site-to-Site VPN, use BGP routing on both paths, and configure the on-premises router to prefer the Direct Connect path using a higher BGP Local Preference.

The correct configuration uses AWS Transit Gateway to centralize connection management for the `

45

` spoke VPCs, which minimizes administrative overhead. By using a Direct Connect Gateway associated via a Transit Virtual Interface (Transit VIF), the enterprise can route traffic transitively from the Transit Gateway to the on-premises data center. BGP routing allows for dynamic failover. To ensure symmetric routing, the on-premises router must be configured with a higher BGP Local Preference for routes learned via Direct Connect, making it the preferred path for inbound traffic, while AWS automatically prefers the Direct Connect Gateway path over the VPN path for outbound traffic if AS path lengths are equal.

Step-by-Step Solution

Consolidate multi-VPC networking.

Attach all `

45

` spoke VPCs to a central AWS Transit Gateway to minimize administrative overhead.

Managing individual VPC connections or peering meshes at scale is administratively complex and does not scale.

Establish the primary and backup hybrid connectivity paths.

Associate the Direct Connect Gateway with the Transit Gateway via a Transit Virtual Interface (Transit VIF), and attach the IPsec Site-to-Site VPN directly to the Transit Gateway.

Transit Gateway requires a Transit VIF to integrate with Direct Connect Gateway for transitive routing. The Site-to-Site VPN acts as a backup path.

Configure dynamic routing for outbound traffic from AWS.

Enable BGP propagation. AWS Transit Gateway automatically prefers the Direct Connect Gateway path over the VPN path for outbound traffic when prefix lengths and AS path lengths are equal.

Using dynamic BGP propagation ensures automatic failover and allows AWS to utilize its default path selection hierarchy.

Configure dynamic routing for inbound traffic from on-premises and ensure symmetry.

Configure the customer gateway router to assign a higher BGP Local Preference to prefixes received over the Direct Connect path compared to the VPN path.

Symmetric routing is achieved when both inbound and outbound traffic prefer the same path under normal operating conditions. Local Preference is a local BGP attribute that ensures the on-premises router prefers the Direct Connect link.

Key Concept

Symmetric routing and failover in a hybrid Transit Gateway architecture using Direct Connect and Site-to-Site VPN.

Question 34Question →

An enterprise is designing a deployment pipeline for a critical transaction-processing application. The application runs on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The infrastructure is defined and managed using AWS CloudFormation. The application processes long-running database transactions that can take up to $12$ minutes to complete; interrupting these transactions results in data corruption. The deployment strategy must meet the following requirements:

1. Roll out updates with zero downtime.
2. Ensure that instances are never terminated while processing active transactions.
3. Automatically roll back the CloudFormation stack to the previous version if new instances fail to initialize or fail application-level health checks.
4. Minimize additional compute costs by avoiding the pre-allocation of a duplicate Auto Scaling group during the deployment.

Which configuration strategy should the Solutions Architect implement to meet these requirements?

Update the CloudFormation template to configure the ASG `UpdatePolicy` with `AutoScalingRollingUpdate`. Set `WaitOnResourceSignals` to `true` and define an appropriate `Timeout`. Configure an `EC2_INSTANCE_TERMINATING` lifecycle hook on the ASG that runs a script to wait for active connections to drain before completing the hook. In the EC2 user data, start the application, run a local health check script, and invoke the `cfn-signal` helper utility upon success.

Update the CloudFormation template to configure the ASG `UpdatePolicy` with `AutoScalingReplacingUpdate`. Rely on the ALB target group's default deregistration delay to drain connections. Configure the CloudFormation stack with a rollback trigger based on CloudWatch alarms monitoring the application's health.

Configure AWS CodeDeploy to perform an In-Place deployment using a `CodeDeployDefault.AllAtOnce` configuration. Use a CodeDeploy `ApplicationStop` lifecycle hook to wait for active connections to drain. Configure CloudWatch alarms to trigger a CodeDeploy automatic rollback on deployment failure.

Create a new AWS CloudFormation template that uses the `AWS::CodeDeploy::BlueGreen` hook to manage the EC2 Auto Scaling group deployment. Configure the deployment group to use a canary shifting strategy and monitor CloudWatch alarms to trigger an automatic rollback.

Show answer & explanation

Answer: Update the CloudFormation template to configure the ASG `UpdatePolicy` with `AutoScalingRollingUpdate`. Set `WaitOnResourceSignals` to `true` and define an appropriate `Timeout`. Configure an `EC2_INSTANCE_TERMINATING` lifecycle hook on the ASG that runs a script to wait for active connections to drain before completing the hook. In the EC2 user data, start the application, run a local health check script, and invoke the `cfn-signal` helper utility upon success.

Answer

Configure the Auto Scaling group's CloudFormation UpdatePolicy to use AutoScalingRollingUpdate, enable WaitOnResourceSignals, implement an EC2_INSTANCE_TERMINATING lifecycle hook, and use the cfn-signal helper utility in the EC2 user data.

The correct strategy uses the `AutoScalingRollingUpdate` policy in CloudFormation to update instances in place, which avoids the cost of a duplicate Auto Scaling group. By setting `WaitOnResourceSignals` to true and using `cfn-signal` in the EC2 user data, CloudFormation ensures that the application is fully running and healthy before continuing the rollout, automatically rolling back if any batch fails. The `EC2_INSTANCE_TERMINATING` lifecycle hook allows the instances to finish their long-running transactions (up to

12

minutes) before they are terminated, preventing data corruption.

Step-by-Step Solution

Configure the CloudFormation UpdatePolicy on the AWS::AutoScaling::AutoScalingGroup resource to use AutoScalingRollingUpdate.

This ensures that updates are rolled out in batches, maintaining service availability and avoiding the cost of a duplicate Auto Scaling group.

Meets the requirements of zero downtime and minimized resource costs during deployment.

Enable WaitOnResourceSignals and configure an appropriate Timeout in the AutoScalingRollingUpdate policy.

CloudFormation will pause the update and wait for a success signal from each newly launched EC2 instance before updating subsequent batches.

Allows CloudFormation to automatically roll back the stack if new instances fail to start or report healthy within the timeout period.

Configure an EC2_INSTANCE_TERMINATING lifecycle hook on the Auto Scaling group.

When an instance is selected for termination during the rolling update, the lifecycle hook transitions the instance to the Terminating:Wait state.

This pauses termination and allows a custom script or daemon on the instance to complete any ongoing long-running transactions (up to the

12

-minute limit) before signaling completion.

In the EC2 user data script, configure the application startup, run a local health check to verify its readiness, and call the cfn-signal utility.

Once the application is verified as fully functional on the new instance, a success signal is sent to CloudFormation.

Ensures that CloudFormation only proceeds with the deployment when the new version is confirmed healthy, triggering a rollback if the signal fails.

Key Concept

Auto Scaling Rolling Updates with Lifecycle Hooks and CloudFormation Signals

Question 35Question →

An e-commerce company is migrating its order processing service to a containerized application running on Amazon ECS with AWS Fargate, fronted by an Application Load Balancer (ALB). The service is highly sensitive to downtime, and any deployment must ensure zero downtime. Additionally, the development team wants to test new releases under production load by routing $10\%$ of the traffic to the new version for a $15$ -minute observation period. If the new version triggers any CloudWatch alarms for $5\text{xx}$ errors or high latency during this period, the deployment must automatically roll back. Which deployment strategy should the Solutions Architect design to satisfy these requirements?

Configure the Amazon ECS service to use the AWS CodeDeploy blue/green deployment controller. Create a CodeDeploy deployment group utilizing the CodeDeployDefault.ECSCanary10Percent15Minutes configuration, and specify the CloudWatch alarms for

5\text{xx}

errors and latency as rollback triggers in the deployment group.

Configure the Amazon ECS service to use the ECS rolling update deployment type. Enable the ECS deployment circuit breaker with rollback enabled, and set the minimum healthy percent to

100\%

and maximum percent to

200\%

Deploy a second Amazon ECS service with the new application version. Configure the Application Load Balancer with two path-based target groups. Use Amazon Route 53 weighted routing policies to route

10\%

of the traffic to the new ECS service, and configure an AWS Lambda function to monitor CloudWatch alarms and update Route 53 weights to

0\%

if alarms are triggered.

Configure the Amazon ECS service to use the ECS rolling update deployment type. Use an AWS Systems Manager Automation runbook to gradually register new Fargate tasks to the target group in

10\%

increments every

1.5

minutes, and configure the target group to deregister tasks if the

5\text{xx}

metric alarm triggers.

Show answer & explanation

Answer: Configure the Amazon ECS service to use the AWS CodeDeploy blue/green deployment controller. Create a CodeDeploy deployment group utilizing the CodeDeployDefault.ECSCanary10Percent15Minutes configuration, and specify the CloudWatch alarms for $5\text{xx}$ errors and latency as rollback triggers in the deployment group.

Answer

Configure the Amazon ECS service to use the AWS CodeDeploy blue/green deployment controller with the CodeDeployDefault.ECSCanary10Percent15Minutes configuration, and associate CloudWatch alarms with the deployment group for automated rollback.

The correct option is correct because AWS CodeDeploy blue/green deployment is the standard AWS solution for performing canary and linear deployments on Amazon ECS. It natively shifts a specified percentage of traffic (such as

10\%

) to the new task set for a defined duration (such as

15

minutes) using the Application Load Balancer's target groups. It also integrates directly with Amazon CloudWatch alarms to automatically trigger rollbacks if application-level errors or latency exceed thresholds during the deployment window.

Step-by-Step Solution

Change the deployment controller of the Amazon ECS service to AWS CodeDeploy.

Amazon ECS delegates the deployment and traffic routing process to AWS CodeDeploy rather than using the default rolling update scheduler.

CodeDeploy is required to manage weighted traffic shifting (canary/linear) between two task sets (Blue and Green) on ECS.

Configure the deployment group in AWS CodeDeploy to use the predefined Canary configuration.

The deployment group is set to CodeDeployDefault.ECSCanary10Percent15Minutes, which directs

10\%

of production traffic to the new Fargate tasks for

15

minutes.

This matches the requirement to test new releases under a small portion of production load for a specific duration.

Attach CloudWatch alarms for

5\text{xx}

errors and latency to the CodeDeploy deployment group's rollback configuration.

If any of the specified alarms enter the ALARM state during the

15

-minute canary period, CodeDeploy immediately aborts the deployment and routes

100\%

of traffic back to the original task set.

This fulfills the automated rollback requirement with zero downtime.

Key Concept

AWS CodeDeploy Blue/Green Deployment with Canary traffic shifting on ECS

Question 36Question →

A research organization is designing a genomic data processing platform. The processing applications run on Amazon EC2 instances in a dedicated Computation Account (Account A). The raw genome sequencing output files must be written directly to an Amazon S3 bucket located in a central Data Archive Account (Account B).

The organization's security policy requires:
- All data stored in the S3 bucket must be encrypted at rest using SSE-KMS with a Customer Managed Key (CMK) managed by the Data Archive Account (Account B).
- The Data Archive Account must maintain full ownership of all uploaded objects, and access control lists (ACLs) must be completely disabled.
- The EC2 instances in Account A must have the minimum necessary permissions to perform the uploads.

Which combination of configuration steps will meet these security requirements?

In Account B, configure S3 Object Ownership to Bucket Owner Enforced. Modify the KMS CMK key policy to grant the EC2 instance role in Account A permissions for kms:GenerateDataKey and kms:Decrypt. Configure the S3 bucket policy to allow s3:PutObject for the EC2 instance role in Account A. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject on the bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B.

In Account B, configure S3 Object Ownership to Bucket Owner Enforced and set the bucket's default encryption to use the AWS managed key (aws/s3). Configure the S3 bucket policy to allow s3:PutObject for the EC2 instance role in Account A. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject on the bucket in Account B.

In Account B, configure S3 Object Ownership to Bucket Owner Preferred. Modify the KMS CMK key policy to grant the EC2 instance role in Account A permissions for kms:GenerateDataKey and kms:Decrypt. Configure the S3 bucket policy to allow s3:PutObject for the EC2 instance role in Account A. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject and specifies the bucket-owner-full-control canned ACL during upload.

In Account B, configure S3 Object Ownership to Bucket Owner Enforced. In the AWS Organizations management account, attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A and Account B that allows s3:PutObject on the bucket and kms:GenerateDataKey on the KMS CMK. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject on the bucket in Account B.

Show answer & explanation

Answer: In Account B, configure S3 Object Ownership to Bucket Owner Enforced. Modify the KMS CMK key policy to grant the EC2 instance role in Account A permissions for kms:GenerateDataKey and kms:Decrypt. Configure the S3 bucket policy to allow s3:PutObject for the EC2 instance role in Account A. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject on the bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B.

Answer

The correct option addresses all security requirements by using a Customer Managed Key (CMK) whose key policy can be modified to grant the necessary KMS permissions to the external IAM role in Account A. Setting S3 Object Ownership to Bucket Owner Enforced disables ACLs completely and automatically assigns ownership of all uploaded objects to Account B. S3 bucket policies and IAM policies are correctly configured to allow the cross-account s3:PutObject operation.

Step-by-Step Solution

Disable ACLs and enforce bucket owner ownership in the target account.

S3 Object Ownership in the Data Archive Account (Account B) is set to Bucket Owner Enforced, disabling ACLs and ensuring all uploaded files are owned by the bucket owner.

Meets the requirement to maintain full ownership of all objects and completely disable ACLs.

Configure cross-account KMS permissions on the Customer Managed Key (CMK) in Account B.

The KMS key policy in Account B is updated to permit the IAM role from Account A to perform kms:GenerateDataKey and kms:Decrypt operations.

Allows the external account's role to generate data keys for encrypting files uploaded to the S3 bucket using the target KMS key.

Configure the S3 bucket policy in Account B and IAM role policy in Account A.

The S3 bucket policy in Account B allows s3:PutObject for the role in Account A. The IAM policy of the role in Account A allows s3:PutObject on the bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B.

Grants the necessary S3 and KMS permissions across the account boundary for a successful write operation.

Key Concept

Cross-account Amazon S3 uploads with SSE-KMS encryption and Bucket Owner Enforced object ownership

Question 37Question →

A multinational financial enterprise is building a regulatory reporting data pipeline. The application tier runs on Amazon EC2 instances in an Application Account (Account A: $111122223333$ ). The reporting logs must be delivered to an Amazon S3 bucket in a Centralized Security Account (Account B: $444455556666$ ). The compliance requirements mandate that all logs must be encrypted at rest using a Key Management Service (KMS) key, and the Centralized Security Account must have full ownership of all uploaded objects to prevent access delegation issues. The application tier must only have permissions to write objects and must not be allowed to decrypt the logs once written. Which combination of actions must the solutions architect take to meet these security requirements? (Select TWO.)

Select all that apply

Enable S3 Object Ownership with the Bucket Owner Enforced setting on the S3 bucket in Account B, and configure the S3 bucket policy in Account B to grant s3:PutObject permissions to Account A's EC2 instance profile role.

Create a customer managed KMS key in Account B, configure its key policy to grant kms:GenerateDataKey permissions to Account A's EC2 instance profile role, and configure the S3 bucket in Account B to use this customer managed KMS key for default encryption.

Enable default encryption on the destination S3 bucket in Account B using the default AWS managed key (aws/s3), and configure a Service Control Policy (SCP) in the organization to grant Account A cross-account access to the AWS managed key.

Configure the S3 bucket policy in Account B to grant s3:PutObject permissions to Account A's IAM role, and include kms:GenerateDataKey permissions within the S3 bucket policy to allow Account A to encrypt the objects.

Create an IAM role in Account B that has permissions to write to the S3 bucket and encrypt objects using the KMS key. Configure the role's trust policy to use the sts:AssumeRoleWithSAML action to allow the EC2 instances in Account A to assume the role.

Show answer & explanation

Answer: Enable S3 Object Ownership with the Bucket Owner Enforced setting on the S3 bucket in Account B, and configure the S3 bucket policy in Account B to grant s3:PutObject permissions to Account A's EC2 instance profile role.; Create a customer managed KMS key in Account B, configure its key policy to grant kms:GenerateDataKey permissions to Account A's EC2 instance profile role, and configure the S3 bucket in Account B to use this customer managed KMS key for default encryption.

Answer

Enable S3 Object Ownership with the Bucket Owner Enforced setting on the S3 bucket in Account B, configure the bucket policy to grant s3:PutObject permissions to Account A's role, and use a customer managed KMS key in Account B with key policy permissions for kms:GenerateDataKey granted to Account A.

To support cross-account KMS encryption, a customer managed key (CMK) must be created in the destination account because AWS managed keys (such as aws/s3) do not support policy modification and cannot be shared across accounts. Granting the writing role `kms:GenerateDataKey` allows the application to encrypt files without requiring `kms:Decrypt` access. Additionally, disabling S3 ACLs using the Bucket Owner Enforced setting ensures that all objects uploaded to the bucket are automatically owned by the bucket owner (the security account), resolving potential ownership and permission delegation issues.

Step-by-Step Solution

Address the cross-account encryption requirement by creating a customer managed key (CMK) in the destination security account (Account B).

A CMK is established which supports cross-account key policy delegation, unlike default AWS-managed KMS keys.

AWS-managed keys (e.g., aws/s3) cannot be shared across accounts as their policies are not editable.

Configure the key policy of the newly created CMK to allow Account A's EC2 instance profile role to generate data keys.

The application can perform encryption at write time by calling kms:GenerateDataKey without requiring decryption permissions.

Applying the principle of least privilege ensures the writing account cannot decrypt or read the logs once written.

Configure the destination S3 bucket in Account B with default encryption using the customer managed KMS key.

All objects uploaded to the bucket are automatically encrypted with the specified CMK.

Enforces compliance control for encryption at rest for all incoming reporting logs.

Enable the Bucket Owner Enforced setting under S3 Object Ownership on the bucket in Account B, and grant s3:PutObject permissions in the bucket policy to Account A's role.

S3 ACLs are disabled, and the Centralized Security Account (Account B) automatically owns all uploaded log objects.

Ensures that the security account maintains full control and ownership of the logs without relying on object ACLs from the writer account.

Key Concept

Designing cross-account security controls using KMS key policies and S3 Object Ownership (Bucket Owner Enforced) to maintain compliance and data ownership.

Question 38Question →

A healthcare provider is designing a new digital medical imaging archive and diagnostic report system. The system must store structured patient metadata logs (OLTP workload) and unstructured medical images in DICOM format (Object storage). The metadata database must support high-volume write transactions and scale read traffic to handle sudden spikes from hospital clients. The disaster recovery requirements demand a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $1$ minute. Additionally, for regulatory compliance, the medical images must be securely archived and replicated to a destination bucket in a secondary, isolated AWS account in a different AWS region, encrypted at rest using AWS KMS. Which of the following database and storage configurations should the solutions architect choose to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon Aurora global database with the primary cluster in the active region and a secondary cluster in the disaster recovery region, utilizing Aurora Replicas in both regions to handle database operations.

Deploy a Multi-AZ Amazon RDS PostgreSQL database in the primary region, and route read queries directly to the standby instance in the secondary Availability Zone to scale database performance during peak read hours.

Configure hourly database snapshots in the primary region, and schedule an AWS Lambda function to copy these snapshots to the disaster recovery region every

2

hours to reconstruct the database during a regional disaster.

Store the medical images in Amazon S3, and configure S3 Cross-Region Replication (CRR) to a destination bucket in the disaster recovery region using a Customer Managed Key (CMK) in AWS KMS with appropriate cross-account key policies.

Store the medical images in Amazon S3, and configure S3 Cross-Region Replication (CRR) to a destination bucket in a secondary AWS account using the default AWS-managed KMS key (aws/s3) to simplify cross-account encryption configuration.

Show answer & explanation

Answer: Deploy an Amazon Aurora global database with the primary cluster in the active region and a secondary cluster in the disaster recovery region, utilizing Aurora Replicas in both regions to handle database operations.; Store the medical images in Amazon S3, and configure S3 Cross-Region Replication (CRR) to a destination bucket in the disaster recovery region using a Customer Managed Key (CMK) in AWS KMS with appropriate cross-account key policies.

Answer

Deploy an Amazon Aurora global database with the primary cluster in the active region and a secondary cluster in the disaster recovery region, and store the medical images in Amazon S3, configuring S3 Cross-Region Replication (CRR) using a Customer Managed Key (CMK) in AWS KMS with cross-account key policies.

Deploying an Amazon Aurora global database provides sub-second replication to the disaster recovery region, satisfying the strict RTO of

15

minutes and RPO of

1

minute, while supporting read replicas for traffic scaling. For object storage, utilizing Amazon S3 with Cross-Region Replication (CRR) and a Customer Managed Key (CMK) configured with cross-account policies allows secure replication of medical images to a secondary AWS account, which is impossible with AWS-managed keys.

Step-by-Step Solution

Evaluate the database tier for high performance, read scaling, and strict RTO/RPO targets.

Determine that Amazon Aurora Global Database satisfies the RTO of

15

minutes and RPO of

1

minute via storage-based physical replication, while standard RDS snapshot replication fails the RPO target.

Aurora Global Database replicates data sub-second, allowing for near-zero RPO and rapid failover.

Assess the scalability and read routing configuration of the database options.

Eliminate the configuration routing read queries to the RDS standby instance because Multi-AZ standby instances do not accept read traffic.

RDS standby instances are purely passive; read scaling requires read replicas or Aurora replicas.

Evaluate S3 Cross-Region Replication (CRR) requirements for cross-account destination buckets.

Identify that the default AWS-managed KMS key (aws/s3) cannot be used because its policy cannot be modified to grant cross-account access.

A Customer Managed Key (CMK) is required to configure key policies allowing cross-account decryption and encryption.

Key Concept

Selecting and configuring highly available, secure, and compliant databases and storage with cross-region and cross-account capabilities to meet RTO/RPO constraints.

Question 39Question →

A global online retailer is launching a flash sale platform for limited-edition merchandise drops. The system expects sudden, extreme traffic surges where active users scale from $5,000$ to over $1,500,000$ within $60\text{ seconds}$ at the start of a sale. The current architecture consists of an Application Load Balancer (ALB), an Amazon ECS on AWS Fargate service, and an Amazon Aurora PostgreSQL database cluster. During testing, the sudden influx of connection requests led to HTTP $503$ Service Unavailable errors from the ALB, and database write latency spiked, causing the Fargate tasks to exhaust their connection pools. Which combination of architectural optimizations will best resolve these performance and scalability issues? (Select TWO)

Select all that apply

Submit an AWS Support ticket to pre-warm the Application Load Balancer (ALB) with the expected traffic profile and surge rates prior to the start of the drop event.

Decouple the write operations by routing order requests to an Amazon Kinesis Data Stream, and configure an AWS Lambda function to poll the stream and perform batch writes to the Amazon Aurora database.

Configure Application Auto Scaling on the Application Load Balancer to dynamically adjust capacity based on the ActiveConnectionCount metric.

Enable read routing on the Amazon Aurora Multi-AZ standby instance to offload read transactions during the event, scaling the standby dynamically to meet traffic requirements.

Deploy an Amazon ElastiCache for Memcached cluster with Multi-AZ replication enabled to persist the temporary shopping cart state across different Availability Zones.

Show answer & explanation

Answer: Submit an AWS Support ticket to pre-warm the Application Load Balancer (ALB) with the expected traffic profile and surge rates prior to the start of the drop event.; Decouple the write operations by routing order requests to an Amazon Kinesis Data Stream, and configure an AWS Lambda function to poll the stream and perform batch writes to the Amazon Aurora database.

Answer

Pre-warm the Application Load Balancer (ALB) by contacting AWS Support, and decouple the database write operations using Amazon Kinesis Data Streams and AWS Lambda to process database updates in batches.

Contacting AWS Support to pre-warm the ALB ensures that the load balancer is provisioned with sufficient capacity before the flash sale starts, preventing HTTP 503 errors. Decoupling the write path using Amazon Kinesis Data Streams and AWS Lambda allows the system to ingest massive transaction volumes instantly and write to the Aurora database in controlled, batched operations, preventing database CPU exhaustion.

Step-by-Step Solution

Analyze the bottleneck at the ingress layer (Application Load Balancer) during an instantaneous surge.

Dynamic auto-scaling policies cannot react quickly enough, causing HTTP 503 errors. Determine that ALB pre-warming via AWS Support is required.

ALBs scale gradually based on traffic trends, but a sudden flash spike from 5,000 to 1.5 million requests in 60 seconds will saturate the existing capacity before scaling completes.

Analyze the bottleneck at the database layer (Amazon Aurora PostgreSQL).

Determine that decoupling writes using a queuing/streaming ingestion tier is necessary to absorb the peak throughput.

Direct, concurrent database writes from scaled container tasks can exhaust database connection pools and CPU. Buffering updates in Amazon Kinesis and processing them in batches via AWS Lambda smooths out the database write load.

Evaluate the architectural validity of the distractors.

Identify that the options suggesting dynamic ALB auto-scaling, routing reads to a standby, and using replicated Memcached are invalid.

Aurora standby instances do not handle read scaling, Memcached does not support replication or persistence, and ALB dynamic scaling is too slow for flash spikes.

Key Concept

Architecting systems for extreme flash traffic spikes by pre-warming load balancers and decoupling database writes to manage scalability and performance.

Question 40Question →

A financial technology corporation is modernizing its legacy on-premises payment settlement API by migrating it to a serverless architecture on AWS. The solution must expose a private API to consumer applications deployed across multiple AWS accounts within the same AWS Organization. The architecture must satisfy the following requirements:
- All API communication must remain strictly within the AWS network.
- Cross-account consumers must authenticate using custom tokens verified by a central security account, which signs payloads using a custom AWS KMS key.
- The backend AWS Lambda functions must access a relational database securely.
- A sudden volume spike in a secondary, non-critical reporting API must not throttle or exhaust the execution capacity of the critical payment settlement API.
- The outbound traffic from the VPC-integrated Lambda functions to external verification endpoints must be highly resilient against Availability Zone failures.

Which of the following architectures meets these requirements while adhering to AWS best practices?

Create an Amazon API Gateway private REST API. Create an interface VPC endpoint (AWS PrivateLink) for API Gateway in each consumer VPC. Configure a custom Lambda authorizer that uses the default AWS-managed KMS key for API Gateway (aws/apigateway) to verify signed tokens from the central security account. Allocate reserved concurrency to the critical payment settlement Lambda functions. Deploy the VPC-integrated Lambda functions across multiple Availability Zones, routing outbound traffic through a dedicated NAT Gateway in each Availability Zone.

Create an Amazon API Gateway private REST API. Create an interface VPC endpoint (AWS PrivateLink) for API Gateway in each consumer VPC, using endpoint policies to restrict access. Configure a custom Lambda authorizer that uses a Customer Managed Key (CMK) in AWS KMS, with a key policy that grants cross-account decrypt permissions. Deploy the VPC-integrated Lambda functions across multiple Availability Zones, routing outbound traffic through a dedicated NAT Gateway in each Availability Zone. Run both the reporting and critical settlement Lambda functions using the default unreserved regional concurrency pool to maximize resource sharing.

Create an Amazon API Gateway private REST API. Create an interface VPC endpoint (AWS PrivateLink) for API Gateway in each consumer VPC, using endpoint policies to restrict access. Configure a custom Lambda authorizer that uses a Customer Managed Key (CMK) in AWS KMS, with a key policy that grants cross-account decrypt permissions to verify the signed tokens. Allocate reserved concurrency to the critical payment settlement Lambda functions to protect their capacity. Deploy the VPC-integrated Lambda functions across multiple Availability Zones, routing outbound traffic through a dedicated NAT Gateway in each Availability Zone.

Create an Amazon API Gateway private REST API. Create an interface VPC endpoint (AWS PrivateLink) for API Gateway in each consumer VPC, using endpoint policies to restrict access. Configure a custom Lambda authorizer that uses a Customer Managed Key (CMK) in AWS KMS, with a key policy that grants cross-account decrypt permissions. Allocate reserved concurrency to the critical payment settlement Lambda functions. Deploy the VPC-integrated Lambda functions across multiple Availability Zones, but route all outbound traffic through a single NAT Gateway located in a single public subnet to reduce NAT Gateway hourly charges.

Show answer & explanation

Answer: Create an Amazon API Gateway private REST API. Create an interface VPC endpoint (AWS PrivateLink) for API Gateway in each consumer VPC, using endpoint policies to restrict access. Configure a custom Lambda authorizer that uses a Customer Managed Key (CMK) in AWS KMS, with a key policy that grants cross-account decrypt permissions to verify the signed tokens. Allocate reserved concurrency to the critical payment settlement Lambda functions to protect their capacity. Deploy the VPC-integrated Lambda functions across multiple Availability Zones, routing outbound traffic through a dedicated NAT Gateway in each Availability Zone.

Answer

The correct architecture uses a private REST API with interface VPC endpoints, a Customer Managed Key for cross-account authorization, dedicated NAT Gateways in each Availability Zone for resilient outbound routing, and reserved concurrency limits on the critical Lambda functions to protect execution capacity.

The correct architecture uses a private REST API with interface VPC endpoints to ensure traffic does not traverse the public internet. It leverages a Customer Managed Key (CMK) with an explicit key policy because AWS-managed keys cannot be modified to grant cross-account decryption rights. To guarantee that traffic spikes on the secondary reporting API do not impact the payment settlement system, it assigns a reserved concurrency limit to the settlement functions, securing their execution capacity. Finally, it routes outbound VPC traffic through dedicated NAT Gateways in each Availability Zone to eliminate single points of failure.

Step-by-Step Solution

Establish secure private connectivity between cross-account consumer applications and the backend API.

Private REST API in API Gateway accessed via interface VPC endpoints (PrivateLink) with endpoint policies restricting access.

Ensures all API traffic remains strictly within the AWS network, fulfilling the security requirement without traversing the public internet.

Set up the custom Lambda authorizer to decrypt and verify the cross-account tokens.

Lambda authorizer configured using a KMS Customer Managed Key with a key policy allowing cross-account decryption.

AWS-managed KMS keys cannot be shared across accounts because their key policies cannot be modified. A CMK is required for cross-account token decryption.

Configure compute resource limits to prevent service degradation during traffic spikes.

Allocate reserved concurrency to the critical payment settlement Lambda functions.

Guarantees a dedicated execution capacity for critical settlement functions, preventing throttling when the secondary reporting API spikes and consumes concurrency.

Design the VPC routing for the VPC-integrated Lambda functions to connect to external endpoints.

Route outbound traffic from Lambda functions through a dedicated NAT Gateway deployed in each Availability Zone.

Eliminates single points of failure, ensuring that outbound internet routing remains highly available even if an entire Availability Zone fails.

Key Concept

Modernizing applications using private API Gateway endpoints, custom Lambda authorizers with cross-account KMS CMKs, reserved concurrency for resource isolation, and redundant NAT Gateways.

Estimated Time:3m 0s

PreviousPage 2 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept