All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A company is preparing to deploy a new version of a microservice that runs on Amazon ECS using the AWS Fargate launch type. The microservice is behind an Application Load Balancer (ALB). The solutions architect must design a deployment strategy that routes 10% of production traffic to the new version initially, pauses for 15 minutes to monitor for errors, and then shifts the remaining 90% of the traffic to the new version. If any application errors or elevated response times are observed during the deployment, the traffic must be immediately redirected back to the old version. Which two options should the solutions architect select to implement this deployment strategy? (Select two.)

Select all that apply

Configure the AWS CodeDeploy deployment group to use the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration.

Create Amazon CloudWatch alarms for the Application Load Balancer target group metrics, and add these alarms to the rollback configuration of the CodeDeploy deployment group.

Configure the ECS service deployment controller to use the ECS rolling update type, and specify a minimum healthy percent of 90%.

Configure the AWS CodeDeploy deployment group to use the CodeDeployDefault.ECSLinear10PercentEvery1Minutes deployment configuration.

Configure the Application Load Balancer listener rules with weighted target groups to route 10% of traffic to the new ECS service, and use an AWS Lambda function to increment the weight to 100% after 15 minutes.

Show answer & explanation

Answer: Configure the AWS CodeDeploy deployment group to use the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration.; Create Amazon CloudWatch alarms for the Application Load Balancer target group metrics, and add these alarms to the rollback configuration of the CodeDeploy deployment group.

Answer

Configure the AWS CodeDeploy deployment group to use the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration, and create Amazon CloudWatch alarms for the Application Load Balancer target group metrics to add to the rollback configuration of the CodeDeploy deployment group.

The correct strategy uses AWS CodeDeploy to orchestrate an ECS blue/green deployment. The predefined configuration stating CodeDeployDefault.ECSCanary10Percent15Minutes routes 10% of traffic to the green target group for 15 minutes before routing 100%. Associating CloudWatch alarms for ALB target group metrics with the deployment group ensures that CodeDeploy automatically rolls back the deployment to the original task set if errors or latency spikes occur.

Step-by-Step Solution

Determine the required traffic-shifting pattern.

The requirement specifies shifting 10% of traffic to the new version, holding for 15 minutes, and then shifting the remaining 90% in a single step. This matches a canary deployment strategy.

This establishes that a canary strategy is required rather than a linear or rolling update strategy.

Select the correct AWS CodeDeploy deployment configuration.

Identify the CodeDeployDefault.ECSCanary10Percent15Minutes configuration as the native setting that aligns with the desired traffic-shifting parameters.

Using native predefined configurations simplifies deployment orchestration and avoids custom scripting.

Configure the rollback monitoring mechanism.

Create CloudWatch alarms for ALB target group metrics (e.g., target response time, HTTP 5xx count) and configure the CodeDeploy deployment group to automatically roll back the deployment if these alarms are triggered.

This satisfies the requirement to immediately redirect traffic back to the old version if any errors or elevated response times occur.

Key Concept

AWS CodeDeploy handles blue/green deployments for Amazon ECS by using Application Load Balancer target groups to shift traffic. Predefined deployment configurations, such as Canary, allow a solutions architect to shift a specific percentage of traffic for a set period before shifting the rest. Automated rollbacks are configured by associating CloudWatch alarms directly with the CodeDeploy deployment group.

Question 402Question →

Kestrel Analytics is modernizing its legacy telemetry processing application by migrating it from an on-premises data center to AWS. The application processes high-throughput sensor data and writes the results to a self-managed database cluster running in a private subnet within a Virtual Private Cloud (VPC). The analytics team wants to containerize the application and run it on Amazon ECS using the AWS Fargate launch type to reduce operational overhead. The tasks must securely connect to the database cluster and must not have direct public internet connectivity, while the database security group must restrict inbound traffic to only the tasks. Which network configuration should a solutions architect recommend to meet these requirements?

Configure the ECS task definition to use the awsvpc network mode. Deploy the Fargate tasks in private subnets, and configure the database security group to allow inbound traffic from the security group assigned to the ECS tasks.

Configure the ECS task definition to use the bridge network mode to allow container port mapping. Deploy the Fargate tasks in private subnets, and configure the database security group to allow inbound traffic from the security group of the underlying container instances.

Configure the ECS task definition to use the host network mode. Deploy the Fargate tasks in private subnets, and resolve the database hostname using a Route 53 Private Hosted Zone that is created but not associated with the VPC.

Configure the ECS task definition to use the awsvpc network mode. Deploy the Fargate tasks in a single Availability Zone, and configure the route tables to direct all database-bound traffic through a single NAT Gateway deployed in a single public subnet.

Show answer & explanation

Answer: Configure the ECS task definition to use the awsvpc network mode. Deploy the Fargate tasks in private subnets, and configure the database security group to allow inbound traffic from the security group assigned to the ECS tasks.

Answer

Configuring the ECS task definition to use the awsvpc network mode allows each task to receive its own ENI and security group. The database security group can then be configured to allow inbound access specifically from the task security group, ensuring secure, least-privilege access.

Step-by-Step Solution

Select the correct network mode for AWS Fargate tasks.

AWS Fargate only supports the awsvpc network mode, which assigns a dedicated Elastic Network Interface (ENI) to each task.

This network mode allows standard VPC security groups to be attached directly to ECS Fargate tasks.

Deploy the tasks in private subnets and configure security groups.

The tasks are placed in private subnets with no direct public internet access, and are assigned a specific task security group.

This setup isolates the compute resources from external exposure.

Configure the database security group inbound rules.

An inbound rule is added to the database's security group that references the security group of the ECS Fargate tasks as the source.

This ensures that only traffic originating from Fargate tasks with that security group can connect to the database, implementing the principle of least privilege.

Key Concept

AWS Fargate tasks only support the awsvpc network mode, which allows them to obtain dedicated ENIs and use security groups to secure task-to-database communication.

Question 403Question →

A company is designing a new multi-region disaster recovery (DR) architecture for a critical legal compliance workflow application. The application runs on Amazon EC2 instances in private subnets behind an Application Load Balancer (ALB) in Region A. The instances must access external regulatory APIs on the internet. An internal Route 53 Private Hosted Zone (PHZ) is used for microservice communication. The backend database is Amazon Aurora PostgreSQL. The DR design must support a secondary region (Region B) with a recovery point objective (RPO) of 5 minutes, a recovery time objective (RTO) of 15 minutes, and minimize ongoing costs while ensuring no single points of failure within either region. Which architecture meets these requirements?

Deploy Amazon Aurora PostgreSQL Global Database with the primary cluster in Region A and a secondary cluster in Region B. Create a Route 53 Private Hosted Zone associated with both VPCs. To minimize running costs, deploy a single NAT Gateway in one Availability Zone in the Region A VPC and another single NAT Gateway in the Region B VPC. Configure Route 53 Active-Passive Failover routing policy with health checks.

Deploy Amazon Aurora PostgreSQL Global Database with the primary cluster in Region A and a secondary cluster in Region B. Create a Route 53 Private Hosted Zone for internal service discovery and associate it with both the Region A and Region B VPCs. Deploy one NAT Gateway per Availability Zone in the public subnets of both VPCs. Configure Route 53 Active-Passive Failover routing policy with health checks to route public traffic to Region A, falling back to Region B.

Deploy Amazon Aurora PostgreSQL Global Database with the primary cluster in Region A and a secondary cluster in Region B. Create a Route 53 Private Hosted Zone for internal service discovery and associate it only with the VPC in Region A. Deploy one NAT Gateway per Availability Zone in both VPCs. Configure Route 53 Active-Passive Failover routing policy with health checks.

Implement an AWS Backup plan that creates hourly snapshots of the Aurora PostgreSQL database in Region A and replicates them to Region B. Create a Route 53 Private Hosted Zone associated with both VPCs. Deploy one NAT Gateway per Availability Zone in both VPCs. Configure Route 53 Active-Passive Failover routing policy to route traffic to Region B, where a script will restore the database from the latest snapshot and launch the application servers upon failover.

Show answer & explanation

Answer: Deploy Amazon Aurora PostgreSQL Global Database with the primary cluster in Region A and a secondary cluster in Region B. Create a Route 53 Private Hosted Zone for internal service discovery and associate it with both the Region A and Region B VPCs. Deploy one NAT Gateway per Availability Zone in the public subnets of both VPCs. Configure Route 53 Active-Passive Failover routing policy with health checks to route public traffic to Region A, falling back to Region B.

Answer

Deploying Amazon Aurora PostgreSQL Global Database, associating the internal Route 53 Private Hosted Zone with both VPCs, deploying NAT Gateways in each Availability Zone in both VPCs, and configuring Route 53 Active-Passive Failover routing policy.

The correct architecture uses Amazon Aurora PostgreSQL Global Database to replicate data asynchronously to the secondary region, which easily meets the 5-minute RPO. High availability for outbound traffic is maintained in both VPCs by deploying a NAT Gateway in each Availability Zone. Furthermore, associating the Route 53 Private Hosted Zone with the VPCs in both regions guarantees that internal microservices can resolve internal DNS names after a failover. Finally, configuring Route 53 Active-Passive Failover routing policy dynamically reroutes client requests to Region B if the primary region fails.

Step-by-Step Solution

Evaluate database disaster recovery requirements.

Select Amazon Aurora PostgreSQL Global Database.

Since the target RPO is 5 minutes, database replication must be continuous. Aurora Global Database replicates asynchronously with typical lag under 1 second, meeting the RPO.

Establish internal DNS name resolution.

Associate the Route 53 Private Hosted Zone with both the primary and secondary VPCs.

The application uses a Private Hosted Zone for internal service discovery. During a disaster recovery failover to Region B, instances in Region B must resolve these names, requiring the zone to be associated with both VPCs.

Configure outbound internet connectivity.

Deploy one NAT Gateway per Availability Zone in each VPC.

The instances must access external APIs. Using a single NAT Gateway creates a single point of failure for that Availability Zone, violating high-availability requirements.

Design client routing mechanism.

Configure Route 53 Active-Passive Failover routing policy with health checks.

Route 53 will monitor the health of the primary ALB and automatically route client traffic to the secondary region if the primary region goes down, supporting the 15-minute RTO.

Key Concept

Multi-region disaster recovery design incorporating Route 53 active-passive failover, Private Hosted Zone VPC association, Aurora replication, and NAT Gateway redundancy.

Estimated Time:3m 0s

Question 404Question →

An advertising technology organization is building a real-time bidding application across two AWS Regions: us-east-1 (Primary) and us-west-2 (Secondary). The database backend requires a recovery point objective (RPO) of less than 1 minute and a recovery time objective (RTO) of less than 5 minutes. The architecture must dynamically route client traffic to the region with the lowest latency, and automatically fail over to the remaining region if one region becomes degraded. In addition, the application servers in the private subnets of both regions require highly resilient outbound internet access for third-party API verification. Which TWO options should the solutions architect combine to meet these requirements?

Select all that apply

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. During a regional failure, promote the secondary cluster to primary using a managed failover.

Configure Amazon Route 53 latency-based routing policies pointing to Application Load Balancers (ALBs) in both regions, associate each routing record with a Route 53 health check, and deploy a NAT Gateway in every Availability Zone containing compute resources in both VPCs.

Deploy a single NAT Gateway in a public subnet in us-east-1 and another single NAT Gateway in a public subnet in us-west-2 to handle outbound internet traffic for the private subnets across all Availability Zones in each respective VPC.

Configure AWS Backup to replicate RDS snapshots from us-east-1 to us-west-2 every 4 hours, and configure a warm standby Aurora PostgreSQL cluster in us-west-2 to restore from the latest snapshot during a failover event.

Deploy a primary Amazon RDS for PostgreSQL instance with Multi-AZ enabled in us-east-1 and configure a cross-region read replica in us-west-2, relying on the Multi-AZ standby instance in us-west-2 to dynamically scale read workloads.

Create a Route 53 Private Hosted Zone (PHZ) for internal service endpoints in the primary VPC of us-east-1, and rely on custom DNS forwarders to query this zone from the VPC in us-west-2 without associating the PHZ directly with the us-west-2 VPC.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. During a regional failure, promote the secondary cluster to primary using a managed failover.; Configure Amazon Route 53 latency-based routing policies pointing to Application Load Balancers (ALBs) in both regions, associate each routing record with a Route 53 health check, and deploy a NAT Gateway in every Availability Zone containing compute resources in both VPCs.

Answer

Deploy Amazon Aurora Global Database for multi-region database replication and managed failover, and configure Route 53 latency-based routing with health checks combined with NAT Gateways deployed in every Availability Zone in both regions.

To achieve an RPO of less than 1 minute and RTO of less than 5 minutes for database operations, deploying Amazon Aurora Global Database is the ideal pattern. It offers asynchronous replication with lag typically under 1 second and supports managed failover. For routing and high availability, using Route 53 latency-based routing with health checks ensures traffic is routed to the closest healthy region. Deploying a NAT Gateway in each Availability Zone prevents a single Availability Zone outage from disrupting outbound connectivity.

Step-by-Step Solution

Evaluate the database tier requirements against the target RTO (under 5 minutes) and RPO (under 1 minute).

Identify that snapshot replication or typical cross-region database backups cannot meet the sub-minute RPO. Choose Amazon Aurora Global Database, which offers replication lag under 1 second and managed cross-region failover that meets both constraints.

Aurora Global Database replicates data asynchronously with minimal lag and allows promoting a secondary region to primary in less than a minute.

Design client routing to satisfy the low-latency target and automatically redirect requests if a region fails.

Implement Route 53 latency-based routing pointing to the Application Load Balancers (ALBs) in both regions and configure Route 53 active health checks on the ALBs.

Latency-based routing routes requests to the region that offers the lowest latency, while health checks ensure that traffic is dynamically diverted to the other region if one region becomes unavailable.

Ensure high availability and fault tolerance for outbound internet traffic in the private subnets.

Provision a NAT Gateway in each Availability Zone containing compute resources in both VPCs.

Deploying a single NAT Gateway per VPC creates a single point of failure; if the Availability Zone containing that NAT Gateway fails, instances in other zones lose outbound internet access.

Key Concept

High Availability and Disaster Recovery Design

Estimated Time:3m 0s

Question 405Question →

A SaaS company is designing a secure document archiving solution in AWS. The architecture requires applications running on Amazon EC2 instances in a Production Account (Account A) to write PDF reports directly to an Amazon S3 bucket located in a dedicated Compliance Archive Account (Account B). The reports contain sensitive data and must be encrypted at rest. The compliance team mandates that the encryption keys must be managed centrally in the Compliance Archive Account (Account B), and cross-account access to the encryption key must be strictly limited to the specific EC2 instance role in the Production Account. Which configuration strategy should the solutions architect implement to meet these requirements?

In Account B, configure the S3 bucket to use the default AWS-managed KMS key (aws/s3). In Account A, attach an IAM policy to the EC2 instance role that grants decryption and encryption permissions to the AWS-managed KMS key in Account B.

In Account B, create a customer managed KMS key and update its key policy to allow the EC2 instance IAM role in Account A to perform KMS cryptographic operations. In Account B, configure the S3 bucket to use this customer managed KMS key as the default encryption key.

In Account B, create a customer managed KMS key. In AWS Organizations, apply a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A that allows the kms:GenerateDataKey and kms:Decrypt actions on the KMS key in Account B, bypassing the need for local IAM and KMS key policy configurations.

In Account B, create a customer managed KMS key. Configure the S3 bucket policy in Account B to grant the EC2 instance IAM role in Account A permissions to perform KMS cryptographic operations on the KMS key.

Show answer & explanation

Answer: In Account B, create a customer managed KMS key and update its key policy to allow the EC2 instance IAM role in Account A to perform KMS cryptographic operations. In Account B, configure the S3 bucket to use this customer managed KMS key as the default encryption key.

Answer

The correct answer correctly specifies creating a customer managed key in the archive account (Account B) and configuring the key policy to delegate access to the EC2 instance IAM role in the production account (Account A). This is required because AWS-managed keys cannot be shared across accounts, and KMS access controls must be defined directly in the key policy.

Step-by-Step Solution

Select the correct key type for cross-account operations.

Determine that an AWS-managed key cannot be used since its policy cannot be modified to grant cross-account access. A customer managed key is selected.

AWS-managed keys (such as aws/s3) do not allow changes to their key policies and cannot be shared across accounts.

Configure the key policy in the target account.

In Account B (Compliance Archive Account), configure the customer managed key policy to allow the EC2 instance role ARN from Account A (Production Account) to perform actions such as kms:GenerateDataKey and kms:Decrypt.

Cross-account access to KMS requires the key policy to explicitly trust the external IAM entity.

Apply IAM permissions in the source account.

Configure the EC2 instance profile IAM role in Account A to permit kms:GenerateDataKey and kms:Decrypt on the customer managed key in Account B.

For cross-account access, permissions must be granted both in the key policy (delegating access to the external account or role) and in the local IAM policy (authorizing the role to call KMS).

Key Concept

Cross-account KMS key sharing and policy requirements

Question 406Question →

A multinational digital payment platform is designing a new multi-region disaster recovery architecture for its core ledger application. The application will run in us-east-1 (primary) and us-west-2 (secondary). The business requires a Recovery Time Objective (RTO) of less than 2 minutes and a Recovery Point Objective (RPO) of less than 5 seconds. To support compliance audits, the application servers in the private subnets of both VPCs must routinely download third-party security lists from the internet. The solutions architect needs to design a highly available and resilient networking and database replication architecture that minimizes latency and ensures automated failover. Which TWO actions should the solutions architect take to meet these requirements?

Select all that apply

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and configure the application to write to the primary region.

Create an Amazon Route 53 failover routing policy with an active record pointing to the us-east-1 Application Load Balancer and a passive record pointing to the us-west-2 Application Load Balancer, both associated with Route 53 active application health checks.

Deploy a single NAT Gateway in the primary Availability Zone of each VPC to consolidate outbound egress traffic for all private subnets across all Availability Zones in that region.

Deploy an Amazon RDS PostgreSQL DB instance with synchronous Multi-AZ replication enabled across both us-east-1 and us-west-2 regions to achieve zero data loss.

Configure Amazon Aurora Auto Scaling in the secondary region to scale out reader endpoints, allowing them to automatically start accepting write traffic prior to promoting the secondary cluster.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and configure the application to write to the primary region.; Create an Amazon Route 53 failover routing policy with an active record pointing to the us-east-1 Application Load Balancer and a passive record pointing to the us-west-2 Application Load Balancer, both associated with Route 53 active application health checks.

Answer

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and configure the application to write to the primary region; and create an Amazon Route 53 failover routing policy with an active record pointing to the us-east-1 Application Load Balancer and a passive record pointing to the us-west-2 Application Load Balancer, both associated with Route 53 active application health checks.

The correct combination involves deploying Amazon Aurora Global Database to achieve the required sub-second cross-region replication (RPO < 5s) and quick failover (RTO < 2m), paired with an Amazon Route 53 active-passive failover routing policy that redirects application traffic to the secondary region's Application Load Balancer upon primary health check failure.

Step-by-Step Solution

Select a database replication strategy that meets the target RTO of less than 2 minutes and RPO of less than 5 seconds.

Identify Amazon Aurora Global Database as the correct solution because it achieves sub-second cross-region replication (meeting the RPO) and supports failover/promotion in under a minute (meeting the RTO).

Standard RDS Multi-AZ is regional, and cross-region RDS replication is asynchronous with higher promotion overhead. Aurora Global DB fits the strict HA/DR objectives.

Choose a DNS routing policy to automate traffic failover between regions.

Select Route 53 Active-Passive Failover routing policy combined with health checks linked to the Application Load Balancers.

This guarantees that user requests are dynamically routed to the secondary region if the primary region's endpoint becomes unhealthy, minimizing RTO.

Ensure egress networking is highly available across Availability Zones.

Avoid placing a single NAT Gateway in one Availability Zone, as it represents a single point of failure.

Highly available multi-AZ egress architectures require a NAT Gateway in each Availability Zone.

Key Concept

Designing a resilient multi-region architecture using Route 53 failover routing, Amazon Aurora Global Database replication, and redundant multi-AZ networking.

Question 407Question →

A logistics company utilizes AWS Organizations to manage 55 member accounts. The security team requires that all VPC Flow Logs from all VPCs across these member accounts be aggregated into a single, centrally managed Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted at rest using an encryption key that allows the company to manage key rotation and access policies in compliance with internal security guidelines. The design must adhere to the principle of least privilege.

Which TWO actions must a Solutions Architect take to configure the Amazon S3 bucket and its encryption to support this centralized logging architecture?

Select all that apply

Configure the S3 bucket to use an AWS KMS Customer Managed Key (CMK) for encryption, and update the key policy to grant the delivery.logs.amazonaws.com service principal permissions for kms:GenerateDataKey* and kms:Decrypt.

Apply an S3 bucket policy to the central logging bucket that allows the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions.

Configure the central S3 bucket to use the default AWS-managed KMS key (aws/s3) for server-side encryption, as this key automatically trusts and accepts cross-account log delivery requests from within the AWS Organization.

Create an S3 bucket policy that permits s3:PutObject actions where the Principal is set to the IAM roles defined in each member account for publishing VPC Flow Logs.

Apply a Service Control Policy (SCP) at the root of the AWS Organization that grants the s3:PutObject permission on the destination bucket to all accounts in the organization.

Show answer & explanation

Answer: Configure the S3 bucket to use an AWS KMS Customer Managed Key (CMK) for encryption, and update the key policy to grant the delivery.logs.amazonaws.com service principal permissions for kms:GenerateDataKey* and kms:Decrypt.; Apply an S3 bucket policy to the central logging bucket that allows the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions.

Answer

Configure the S3 bucket to use an AWS KMS Customer Managed Key (CMK) and update its policy to allow the log delivery service principal. Additionally, configure the S3 bucket policy to allow the log delivery service principal to write objects and get bucket ACLs.

For cross-account VPC Flow Logs delivery, the logs are written by the AWS Log Delivery service principal (delivery.logs.amazonaws.com). Therefore, the S3 bucket policy in the central security account must explicitly allow this service principal to perform s3:PutObject and s3:GetBucketAcl actions. Furthermore, if KMS encryption is required, an AWS KMS Customer Managed Key (CMK) must be used. The KMS key policy must be updated to allow the delivery.logs.amazonaws.com service principal to run kms:GenerateDataKey* and kms:Decrypt, because the default AWS-managed KMS key (aws/s3) cannot be modified to delegate permissions to this service principal.

Step-by-Step Solution

Configure S3 bucket policy in the central Security account

Allows the AWS Log Delivery service principal (delivery.logs.amazonaws.com) to write objects (s3:PutObject) and read the bucket ACL (s3:GetBucketAcl).

Since VPC Flow Logs are delivered directly by the Log Delivery service principal on behalf of the member accounts, the destination S3 bucket policy must explicitly permit this service principal.

Set up a Customer Managed Key (CMK) and update its key policy

Enables the Log Delivery service principal to perform kms:GenerateDataKey* and kms:Decrypt operations on the CMK.

AWS-managed KMS keys cannot be shared cross-account or modified to allow service principals to encrypt/decrypt logs. A Customer Managed Key must be used, with its key policy updated to authorize the log delivery service principal.

Key Concept

Cross-account log aggregation for VPC Flow Logs using the Log Delivery service principal, S3 bucket policies, and Customer Managed Keys (CMKs).

Estimated Time:2m 30s

Question 408Question →

An enterprise SaaS company is building a collaborative video processing pipeline across multiple AWS accounts within an AWS Organizations organization. The media ingestion application runs on Amazon EC2 instances in Account A (AWS account ID: $111122223333$ ) and must upload raw media files directly to an Amazon S3 bucket located in Account B (AWS account ID: $444455556666$ ).

The following security controls are required:
1. All objects uploaded to the S3 bucket must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) located in Account B.
2. The S3 bucket owner (Account B) must automatically own all uploaded objects and have full control over them, disabling access control lists (ACLs).
3. The ingestion application's IAM role in Account A must have the minimum necessary privileges to perform the uploads and encrypt the objects.

Which combination of actions must the Solutions Architect perform to meet these requirements? (Select TWO.)

Select all that apply

In Account B, configure the KMS Customer Managed Key policy to grant the ingestion application's IAM role in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.

In Account B, configure the S3 bucket to use the Bucket Owner Enforced setting for S3 Object Ownership, and update the bucket policy to grant s3:PutObject permissions to the ingestion application's IAM role in Account A.

In Account B, configure the S3 bucket to use the AWS-managed KMS key for Amazon S3 (aws/s3) for default encryption, and configure the bucket policy to delegate cross-account access to Account A.

In AWS Organizations, attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A that explicitly allows the ingestion application's IAM role to perform s3:PutObject and kms:GenerateDataKey actions.

In Account B, configure the S3 bucket policy with the Principal set to a wildcard '*' and use the aws:PrincipalOrgID condition key, relying on Account A's local IAM policy to restrict write access to the ingestion application.

Show answer & explanation

Answer: In Account B, configure the KMS Customer Managed Key policy to grant the ingestion application's IAM role in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.; In Account B, configure the S3 bucket to use the Bucket Owner Enforced setting for S3 Object Ownership, and update the bucket policy to grant s3:PutObject permissions to the ingestion application's IAM role in Account A.

Answer

Configure the KMS Customer Managed Key policy in Account B to allow the ingestion application's IAM role in Account A to perform kms:GenerateDataKey and kms:Decrypt actions, and configure S3 Object Ownership with Bucket Owner Enforced alongside a bucket policy in Account B granting write access to the application's IAM role.

For cross-account S3 uploads using SSE-KMS, the uploading principal in Account A requires permissions from both the KMS key policy and the S3 bucket policy in Account B. Because AWS-managed keys cannot be shared across accounts, a Customer Managed Key (CMK) must be used, and its key policy must allow the IAM role in Account A to generate data keys and decrypt. Enabling S3 Object Ownership with Bucket Owner Enforced disables ACLs, ensuring Account B automatically owns all uploaded files and has full control over them.

Step-by-Step Solution

Evaluate the encryption requirements for cross-account KMS operations.

Identify that a Customer Managed Key in Account B must be used because AWS-managed keys cannot be shared cross-account. The KMS key policy in Account B must be updated to allow the IAM role in Account A to use the key.

KMS key policies control cross-account delegation. Without this permission, S3 SSE-KMS uploads from Account A will fail with an Access Denied error.

Evaluate the ownership requirement.

Select the Bucket Owner Enforced setting for S3 Object Ownership in Account B.

This setting disables all ACLs and ensures that the bucket owner automatically owns all objects written to the bucket, regardless of which account uploaded them.

Establish the resource-based access policy on the S3 bucket.

Create a bucket policy in Account B that permits the specific ingestion application IAM role in Account A to perform s3:PutObject.

For cross-account access, both the IAM policy in the source account and the resource policy (bucket policy) in the target account must permit the action.

Key Concept

To establish cross-account writing and encryption in AWS, resource policies in the target account must explicitly grant permissions to the source principal. AWS-managed keys cannot be used cross-account. Using S3 Object Ownership (Bucket Owner Enforced) simplifies object permissions by disabling ACLs.

Question 409Question →

An enterprise is migrating $180\text{ TB}$ of historical records from an on-premises HDFS cluster to Amazon S3. The migration must be completed within a strict 14-day window. The enterprise has a $1\text{ Gbps}$ AWS Direct Connect connection, with a maximum of $400\text{ Mbps}$ allocated for migration traffic. Concurrently, the enterprise needs to replace a legacy on-premises SFTP server used by external partners to upload daily reports directly to their storage backend. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Order multiple AWS Snowball Edge Storage Optimized devices, configure them with an HDFS client, load the historical data, and ship them back to AWS for import into Amazon S3.

Configure AWS DataSync with on-premises agents to transfer the

180\text{ TB}

of historical HDFS data directly to the Amazon S3 buckets over the Direct Connect link.

Deploy an AWS Transfer Family SFTP endpoint backed by Amazon S3, and map the partner identities to IAM roles that access the S3 buckets.

Encrypt the imported S3 buckets using the default AWS managed key (aws/s3) and configure a cross-account IAM role to allow external partner accounts to modify the key policy.

Configure a Transit Gateway with Direct Connect Gateway to enable transitive VPC-to-VPC routing for the external partner SFTP traffic to target private EC2 instances hosting SFTP daemons.

Show answer & explanation

Answer: Order multiple AWS Snowball Edge Storage Optimized devices, configure them with an HDFS client, load the historical data, and ship them back to AWS for import into Amazon S3.; Deploy an AWS Transfer Family SFTP endpoint backed by Amazon S3, and map the partner identities to IAM roles that access the S3 buckets.

Answer

Order multiple AWS Snowball Edge Storage Optimized devices to physically migrate the historical HDFS data to Amazon S3, and deploy an AWS Transfer Family SFTP endpoint backed by Amazon S3 for external partner daily file ingestion.

The correct options recommend ordering physical AWS Snowball Edge Storage Optimized devices for the offline transfer and deploying AWS Transfer Family for partner ingestion. Because the network calculation indicates that a

180\text{ TB}

transfer over

400\text{ Mbps}

requires more than 41 days, online transit using DataSync violates the 14-day requirement. Therefore, offline shipping via Snowball is required. To replace the legacy SFTP server natively and serverlessly, AWS Transfer Family backed by Amazon S3 is the optimal choice.

Step-by-Step Solution

Calculate the transfer time for migrating the

180\text{ TB}

dataset over the available network bandwidth.

The available bandwidth is

400\text{ Mbps}

. Converting the dataset size yields

180\text{ TB} = 1.44 \times 10^{15}\text{ bits}

. The time required is

1.44 \times 10^{15} / (400 \times 10^6\text{ bps}) = 3,600,000\text{ seconds} \approx 41.7\text{ days}

To determine whether online network migration (using AWS DataSync) can satisfy the 14-day migration window.

Identify the appropriate migration method based on the time constraints.

Since

41.7\text{ days}

exceeds the 14-day limit, an offline data transfer method is required. AWS Snowball Edge Storage Optimized devices can physically transport the data to AWS within a few days.

To satisfy the migration window requirements by avoiding slow network transit.

Select a solution for the external partner SFTP ingestion workflow.

AWS Transfer Family manages SFTP protocols natively and stores the uploaded objects directly in Amazon S3, replacing the legacy SFTP server without managing virtual machine infrastructure.

To transition partner integration to a scalable, serverless managed service.

Key Concept

Selecting the optimal data transfer mechanisms (Snowball Edge vs. DataSync) based on network constraint calculations, and integrating serverless file transfer protocols (AWS Transfer Family) for external ingestion.

Question 410Question →

An enterprise is planning to migrate its workloads from an on-premises VMware vSphere environment to a VMware Cloud on AWS Software-Defined Data Center (SDDC). The workloads consist of a critical 2 TB database virtual machine (VM) that must remain online with zero downtime during the migration, and 40 application server VMs that can tolerate a brief service interruption of under 15 minutes. The migration must be scheduled to switch over during a weekend maintenance window. The network connectivity is a dedicated 1 Gbps AWS Direct Connect connection with a round-trip latency of 35 ms. Which migration strategy meets these requirements with the least operational impact?

Configure VMware HCX. Use HCX vMotion to migrate the critical database VM with zero downtime, and use HCX Bulk Migration to replicate and schedule the switchover of the 40 application server VMs during the maintenance window.

Configure VMware HCX. Use HCX Bulk Migration for all virtual machines, including the database VM, to perform parallel replication and ensure consistent switchover times for all workloads.

Install the AWS Application Migration Service (MGN) agent on all virtual machines, replicate the volumes over the AWS Direct Connect connection, and launch the instances directly into the VMware Cloud on AWS SDDC cluster.

Configure VMware HCX. Use HCX Replication-Assisted vMotion (RAV) for all virtual machines. Route the migration traffic over the Direct Connect connection through an AWS Transit Gateway directly to the VMware ESXi hosts without establishing an HCX L2 Network Extension.

Show answer & explanation

Answer: Configure VMware HCX. Use HCX vMotion to migrate the critical database VM with zero downtime, and use HCX Bulk Migration to replicate and schedule the switchover of the 40 application server VMs during the maintenance window.

Answer

The correct strategy combines VMware HCX vMotion and HCX Bulk Migration. Since the database VM requires zero downtime and the Direct Connect link latency (35 ms) is below the 150 ms threshold, HCX vMotion is the ideal choice. For the remaining 40 application VMs, HCX Bulk Migration allows them to be replicated in parallel over time and switched over with a minimal reboot downtime (less than 15 minutes) during the weekend maintenance window, reducing the risk and complexity of migrating all hosts simultaneously via live migration.

Step-by-Step Solution

Analyze the downtime constraints for each workload class: the database VM requires zero downtime (ruling out Bulk Migration for it), while the 40 application servers can tolerate up to 15 minutes of downtime.

Identify that a live migration method (such as HCX vMotion or RAV) is required for the database VM, while a bulk/replicated method (HCX Bulk Migration) is suitable for the application servers.

Matching migration methods to the recovery/downtime objectives ensures business continuity requirements are met.

Verify network prerequisites for HCX vMotion, including checking the latency and bandwidth of the AWS Direct Connect connection.

Confirm that the 35 ms latency is well below the 150 ms maximum limit required for HCX vMotion.

vMotion is latency-sensitive; verifying latency ensures the migration will not fail mid-process.

Select the appropriate HCX migration type for each workload.

Choose HCX vMotion for the database VM to achieve zero downtime, and HCX Bulk Migration for the 40 application VMs to allow parallel replication and scheduled cutover.

Combining these methods optimizes bandwidth utilization and minimizes overall risk during the scheduled maintenance window.

Key Concept

Selecting the correct VMware HCX migration method based on virtual machine downtime tolerance, latency limits, and target architecture.

Question 411Question →

A pharmaceutical manufacturing company is designing a critical supply chain tracking and validation application on AWS. The application tier runs on Amazon EC2 instances across three Availability Zones in the primary region eu-west-1 and three Availability Zones in the secondary region us-east-1. The application requires a relational database backend and needs to initiate outbound connections to external public regulatory APIs for compliance verification.

The system architecture must meet a Recovery Time Objective (RTO) of 5 minutes and a Recovery Point Objective (RPO) of 30 seconds. Additionally, outbound connection capability to the external APIs must remain highly available even during a single Availability Zone outage within a region. Private microservices within the architecture also require private DNS name resolution across the VPCs in both regions.

Which TWO solutions should a solutions architect implement to meet these requirements?

Select all that apply

Deploy an Amazon Aurora Global Database with the primary cluster in eu-west-1 and a secondary cluster in us-east-1. Configure Amazon Route 53 active-passive failover routing policies using application health checks to manage DNS failover.

Deploy a NAT Gateway in each Availability Zone of the VPCs in both regions, and configure private subnet route tables to route outbound internet traffic through the NAT Gateway in the same Availability Zone.

Deploy a single NAT Gateway in the primary Availability Zone of each region's VPC, and configure the private subnet route tables across all Availability Zones to route outbound internet traffic through this single NAT Gateway.

Create a Route 53 Private Hosted Zone for private microservices in the primary VPC, but do not associate this hosted zone with the secondary VPC to prevent DNS resolution conflicts during a regional failover.

Deploy an Amazon RDS Multi-AZ DB cluster in eu-west-1, and configure the application to route read-heavy traffic to the standby instance located in the secondary Availability Zone to reduce load on the primary DB instance.

Configure a Pilot Light disaster recovery strategy by using AWS Backup to copy daily database snapshots from eu-west-1 to us-east-1, and deploy CloudFormation templates to launch the secondary infrastructure only when an outage occurs.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in eu-west-1 and a secondary cluster in us-east-1. Configure Amazon Route 53 active-passive failover routing policies using application health checks to manage DNS failover.; Deploy a NAT Gateway in each Availability Zone of the VPCs in both regions, and configure private subnet route tables to route outbound internet traffic through the NAT Gateway in the same Availability Zone.

Answer

To satisfy the RTO and RPO constraints, the database must be replicated to the secondary region with minimal lag and fail over quickly, which is achieved by deploying an Amazon Aurora Global Database across eu-west-1 and us-east-1 and configuring Route 53 active-passive failover. To satisfy the outbound high-availability requirement during a single Availability Zone outage, a NAT Gateway must be provisioned in each Availability Zone of the VPCs in both regions, and route tables must be updated to route traffic through the local zone's NAT Gateway.

Deploying Amazon Aurora Global Database ensures storage-level replication with lag under 1 second, meeting the 30-second RPO, and supports promotion of the secondary cluster in less than 1 minute, meeting the 5-minute RTO. Route 53 active-passive failover routing handles client redirection. Deploying a NAT Gateway in each Availability Zone ensures that outbound connectivity to external APIs is zone-independent, meaning an outage in one zone does not impact the outbound capabilities of the remaining healthy zones.

Step-by-Step Solution

Analyze RTO and RPO requirements to determine database strategy.

An RPO of 30 seconds requires real-time or near-real-time replication. Amazon Aurora Global Database uses storage-level replication with lag under 1 second, and its promotion time is under 1 minute, which fits the RTO of 5 minutes.

Standard backup-and-restore or Pilot Light strategies take too long to restore databases and copy snapshots, failing the target metrics.

Select routing mechanism for client traffic failover.

Configure Amazon Route 53 active-passive failover routing policies using application health checks.

This automatically redirects inbound client traffic to the secondary region if the primary region's application endpoints fail, helping achieve the 5-minute RTO.

Design highly available outbound network path.

Deploy a NAT Gateway in each Availability Zone of the VPCs in both regions and update private subnet route tables to route outbound traffic through their respective local zone's NAT Gateway.

Sharing a single NAT Gateway across multiple Availability Zones introduces a single point of failure. If the hosting zone fails, all other zones lose outbound internet access.

Key Concept

Designing multi-region architectures with strict RTO and RPO limits requires databases with near-instantaneous cross-region replication (like Aurora Global Database) and automated client routing, combined with zone-independent outbound paths (NAT Gateways in each Availability Zone) to avoid cross-AZ dependency failures.

Estimated Time:3m 0s

Question 412Question →

An enterprise manages $65$ member accounts in an AWS Organization. The security team requires all custom application logs currently written to Amazon CloudWatch Logs groups in the member accounts to be consolidated into a single Amazon S3 bucket in a central Logging account. The centralized logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. Which solution meets these requirements with the least administrative overhead?

In the central Logging account, create the S3 bucket and configure an S3 bucket policy that permits all member accounts to perform s3:PutObject. In each member account, create a CloudWatch Logs subscription filter that directly references the central S3 bucket ARN as the destination, using a customer managed KMS key in each member account for encryption.

In the central Logging account, create an Amazon Data Firehose delivery stream that writes to the S3 bucket. Configure the S3 bucket to use the default AWS-managed KMS key (aws/s3) for encryption. In the central Logging account, create a CloudWatch Logs destination that points to the Firehose stream, and configure its policy to permit the member accounts. In each member account, configure a subscription filter pointing to the destination.

In the central Logging account, create an Amazon Data Firehose delivery stream that writes to the S3 bucket, and create a CloudWatch Logs destination that points to this stream. Update the destination policy to permit the logs:PutSubscriptionFilter action for the AWS Organization. Create an AWS KMS customer managed key (CMK) and configure its key policy to allow Data Firehose to perform kms:GenerateDataKey and kms:Encrypt operations. In each member account, create a CloudWatch Logs subscription filter associated with the central destination.

In the central Logging account, create an Amazon Data Firehose delivery stream pointing to the S3 bucket. Attach a Service Control Policy (SCP) to the Root organizational unit (OU) that grants the member accounts logs:PutSubscriptionFilter permission to write directly to the central Data Firehose stream, and configure a customer managed KMS key in the central account.

Show answer & explanation

Answer: In the central Logging account, create an Amazon Data Firehose delivery stream that writes to the S3 bucket, and create a CloudWatch Logs destination that points to this stream. Update the destination policy to permit the logs:PutSubscriptionFilter action for the AWS Organization. Create an AWS KMS customer managed key (CMK) and configure its key policy to allow Data Firehose to perform kms:GenerateDataKey and kms:Encrypt operations. In each member account, create a CloudWatch Logs subscription filter associated with the central destination.

Answer

Create an Amazon Data Firehose delivery stream and a CloudWatch Logs destination in the central Logging account, configuring the destination policy to allow the AWS Organization to write log data. Use a Customer Managed Key (CMK) with a key policy allowing Data Firehose to perform encryption, and set up subscription filters in the member accounts targeting the destination.

The correct solution uses a CloudWatch Logs destination in the central Logging account to receive log streams from other accounts. The destination routes the logs to an Amazon Data Firehose delivery stream, which writes them to the S3 bucket. Since the logs must be encrypted using a Customer Managed Key (CMK), the key policy must grant permissions to the Data Firehose service role to generate data keys and encrypt the data.

Step-by-Step Solution

Set up centralized ingestion in the central Logging account.

Create an S3 bucket for consolidated logs, a Data Firehose delivery stream, and a CloudWatch Logs destination pointing to the Firehose stream.

Centralizing log collection requires an ingestion mechanism that handles cross-account writes from member accounts.

Configure permissions for the central ingestion point.

Configure the CloudWatch Logs destination policy to allow the AWS Organization to call logs:PutSubscriptionFilter, and configure the Customer Managed KMS Key policy to allow the Firehose delivery stream to perform kms:GenerateDataKey and kms:Encrypt.

The central account must explicitly trust the member accounts to write logs, and the encryption key must trust the delivery service to encrypt the objects.

Configure the log sources in the member accounts.

Create CloudWatch Logs subscription filters in each member account pointing to the central destination ARN.

This establishes the push mechanism that automatically forwards logs from individual account log groups to the central destination.

Key Concept

Cross-account log aggregation with CloudWatch Logs Destinations, Amazon Data Firehose, and KMS Customer Managed Keys.

Question 413Question →

A logistics enterprise is refactoring its legacy package tracking and routing service into a serverless architecture on AWS. The application will receive high-volume, bursty updates via Amazon API Gateway, which triggers an AWS Lambda function. This function must query and update shipment status in an Amazon Aurora PostgreSQL database deployed within private subnets of a VPC. The Lambda function also needs to connect to an external third-party traffic routing API via the public internet to calculate delivery times. The solution must ensure high availability, scale efficiently under load without exhausting database connection pools, and secure outbound internet access. Which TWO actions should a Solutions Architect take to design a solution that meets these requirements?

Select all that apply

Deploy an Amazon RDS Proxy in the private subnets of the VPC to manage the database connection pooling, and configure the Lambda function to connect to the database via the proxy endpoint.

Deploy redundant NAT Gateways across multiple Availability Zones in the public subnets, and configure the route tables of the Lambda function's private subnets to route internet-bound traffic through them.

Deploy a single NAT Gateway in one public subnet, and configure the route tables of the Lambda function's private subnets across all Availability Zones to route outbound internet traffic through this gateway.

Use the default AWS-managed KMS key (aws/secretsmanager) to encrypt the database credentials in AWS Secrets Manager, and grant the Lambda execution role cross-account permissions to read and decrypt with this key.

Allow the Lambda function to scale dynamically without setting any reserved concurrency limits to guarantee that all bursty shipment updates are processed with zero latency.

Configure a basic rolling deployment strategy in AWS CloudFormation to update the Lambda function, relying on manual monitoring instead of automated CloudWatch alarm rollbacks to reduce deployment overhead.

Show answer & explanation

Answer: Deploy an Amazon RDS Proxy in the private subnets of the VPC to manage the database connection pooling, and configure the Lambda function to connect to the database via the proxy endpoint.; Deploy redundant NAT Gateways across multiple Availability Zones in the public subnets, and configure the route tables of the Lambda function's private subnets to route internet-bound traffic through them.

Answer

Deploy an Amazon RDS Proxy in the private subnets of the VPC to manage database connection pooling, and deploy redundant NAT Gateways across multiple Availability Zones in the public subnets to handle internet-bound traffic from the private subnets.

Deploying an Amazon RDS Proxy manages connection scaling dynamically, ensuring that the database does not crash under high connection volume. Deploying redundant NAT Gateways across multiple Availability Zones provides fault-tolerant outbound connectivity, ensuring the Lambda function can reliably query the external API.

Step-by-Step Solution

Evaluate the database scaling constraints under serverless workloads.

Identify that rapid scaling of the Lambda function will saturate database connections.

Amazon RDS Proxy pools database connections, shielding the Aurora PostgreSQL database from connection depletion.

Design the network topology for private resources requiring internet access.

Identify that the Lambda function must be placed in a VPC to communicate with the database, and needs a path to the internet for the third-party API.

Routing internet-bound traffic from private subnets requires NAT Gateways deployed in public subnets.

Ensure the design achieves high availability.

Choose redundant NAT Gateways in multiple Availability Zones over a single NAT Gateway.

A single NAT Gateway is a single point of failure, whereas multi-AZ NAT Gateways ensure connectivity persists during an Availability Zone outage.

Key Concept

Designing secure, serverless architectures with high availability and database connection pooling in a VPC.

Question 414Question →

An enterprise needs to migrate $140\text{ TB}$ of document archives from an on-premises NFS file system to an Amazon S3 bucket in a target AWS account. The enterprise has a $100\text{ Mbps}$ internet connection available for this migration. The migration must be completed within $25\text{ days}$ . The data must be encrypted at rest in Amazon S3 using a customer managed key (CMK) in AWS KMS. Which of the following is the most efficient and secure method to perform this migration?

Create an import job for two AWS Snowball Edge Storage Optimized devices in the target AWS account, specifying the target S3 bucket and a customer managed KMS key. Ship the devices to the on-premises datacenter, copy the NFS data to the devices, and ship them back to AWS.

Deploy AWS DataSync agents on-premises, establish an AWS Site-to-Site VPN over the internet, and configure a DataSync task to sync the NFS data directly to the S3 bucket in the target account using the customer managed KMS key.

Create an import job for two AWS Snowball Edge Storage Optimized devices in the source AWS account, specifying the target S3 bucket in the target AWS account, and encrypting the data using the default AWS managed key (aws/s3). Copy the NFS data to the devices and ship them back to AWS.

Configure an AWS Transit Gateway with a VPN connection to the on-premises network, deploy AWS DataSync agents on-premises, and set up transitive routing through the Transit Gateway to transfer the data over the network to the S3 bucket utilizing the customer managed KMS key.

Show answer & explanation

Answer: Create an import job for two AWS Snowball Edge Storage Optimized devices in the target AWS account, specifying the target S3 bucket and a customer managed KMS key. Ship the devices to the on-premises datacenter, copy the NFS data to the devices, and ship them back to AWS.

Answer

The correct option correctly identifies that network transfer is infeasible due to the timeline limit of

25\text{ days}

and bandwidth of

100\text{ Mbps}

. Using two AWS Snowball Edge Storage Optimized devices (each providing

80\text{ TB}

of usable storage) allows physical transport of the

140\text{ TB}

dataset. Creating the import job in the target AWS account and using a customer managed KMS key ensures that permissions are correctly configured for secure data ingest into the destination S3 bucket.

Step-by-Step Solution

Calculate the theoretical and realistic online transfer time for

140\text{ TB}

over a

100\text{ Mbps}

link.

100\text{ Mbps}

, the transfer takes approximately

130\text{ days}

under 100% efficiency, which is far beyond the required

25\text{ days}

. This mandates an offline physical migration path.

Determining network transfer limitations ensures that physical shipment is selected instead of online synchronization.

Determine the type and quantity of Snow family devices required.

AWS Snowball Edge Storage Optimized devices provide

80\text{ TB}

of usable storage capacity. Two devices are needed to accommodate the

140\text{ TB}

dataset.

Selecting the correct hardware capacity ensures all data fits on the shipped devices.

Determine the account context and KMS key constraints for the Snowball job.

Create the Snowball Edge import job directly in the target AWS account where the destination S3 bucket resides, and select a customer managed key (CMK) for encryption because AWS managed keys (aws/s3) cannot be modified to authorize the Snowball service or cross-account access.

AWS Snowball Edge requires custom policy configurations on KMS CMKs to encrypt the imported data successfully into the target bucket.

Key Concept

Selecting between online network transit and offline physical shipping based on bandwidth constraints, and configuring target account encryption keys under AWS KMS policies.

Estimated Time:3m 0s

Question 415Question →

A high-traffic e-commerce company is launching a highly anticipated flash sale event. The application is hosted on Amazon ECS tasks using the AWS Fargate launch type behind an Application Load Balancer (ALB). The database tier consists of an Amazon Aurora MySQL cluster. Normal operations generate approximately $1,200$ requests per second, but telemetry from previous events indicates that traffic will instantly spike to $450,000$ requests per second within a $60$ -second window at the start of the sale. The majority of the traffic consists of read-heavy product catalog searches and inventory queries, along with a high volume of order placements.

Which two architectural optimizations should the Solutions Architect implement to ensure the application scales effectively without dropping requests or suffering from high latency? (Select TWO.)

Select all that apply

Submit an AWS Support case to pre-warm the Application Load Balancer with the expected request rate, and configure scheduled scaling for the ECS tasks to scale out before the sale begins.

Configure a Multi-AZ standby instance in the Aurora cluster and route the read-heavy queries to the standby instance to distribute the query load.

Add Aurora Replicas to the cluster and configure Aurora Auto Scaling to scale the reader instances dynamically based on average CPU utilization.

Rely on the Application Load Balancer to automatically scale in response to the sudden traffic spike, and configure target tracking scaling policies on the ECS service based on the ApplicationLoadBalancerRequestCountPerTarget metric.

Deploy an Amazon ElastiCache for Memcached cluster to cache catalog queries, relying on Memcached's native multi-AZ replication to ensure read scalability.

Show answer & explanation

Answer: Submit an AWS Support case to pre-warm the Application Load Balancer with the expected request rate, and configure scheduled scaling for the ECS tasks to scale out before the sale begins.; Add Aurora Replicas to the cluster and configure Aurora Auto Scaling to scale the reader instances dynamically based on average CPU utilization.

Answer

Submit an AWS Support case to pre-warm the Application Load Balancer with the expected request rate, and configure scheduled scaling for the ECS tasks to scale out before the sale begins; and add Aurora Replicas to the cluster and configure Aurora Auto Scaling to scale the reader instances dynamically based on average CPU utilization.

Pre-warming the Application Load Balancer (ALB) and pre-scaling the ECS tasks using scheduled scaling ensures the infrastructure is ready to accept the massive, instantaneous spike of

450,000

requests per second without causing connection timeouts or container provisioning delays. Scaling database read performance is achieved by adding Aurora Replicas and using Aurora Auto Scaling, which dynamically adjusts reader capacity based on CPU usage to distribute read-heavy query loads.

Step-by-Step Solution

Analyze the scale and rate of the incoming traffic spike.

The traffic scales traffic from

1,200

requests per second to

450,000

requests per second within a

60

-second window.

Identifying this extremely short ramp-up window prevents the use of reactive scaling methods for front-end components.

Determine the scalability strategy for the ingress/routing tier.

The Application Load Balancer must be manually pre-warmed via AWS Support, and ECS tasks must be pre-scaled using scheduled scaling.

Dynamic scaling of the ALB and reactive scaling of ECS tasks based on metrics are too slow to absorb a massive spike in under a minute without causing dropped connections and latency.

Select the appropriate scaling mechanism for the database read capacity.

Aurora Replicas are deployed and managed with Aurora Auto Scaling linked to the reader endpoint.

Amazon Aurora requires active reader replicas to offload read-heavy query traffic, and standard standby nodes are not designed to serve read traffic.

Key Concept

Handling massive, near-instantaneous traffic spikes (flash traffic) requires pre-provisioning capacity (ALB pre-warming and scheduled task scaling) and horizontally scaling the database layer using reader replicas rather than relying on dynamic load balancer scaling or passive standby instances.

Estimated Time:3m 0s

Question 416Question →

A pharmaceutical company is modernizing its clinical trial drug dispatch API on AWS. The system must process high-volume, bursty request patterns from external medical partners. The backend database is hosted on an Amazon Aurora PostgreSQL DB cluster inside a VPC. The API must be private, accessible only from the partners' on-premises networks via an existing AWS Direct Connect connection. To prevent database connection exhaustion during peak traffic, the architecture must incorporate an Amazon RDS Proxy. The security policy dictates that database credentials must be encrypted using a Customer Managed Key (CMK) in AWS KMS, and the Lambda functions must be restricted from accessing the public internet.

Which TWO actions should a solutions architect take to meet these requirements?

Select all that apply

Create an Amazon API Gateway private REST API and configure an interface VPC endpoint for API Gateway in the VPC. Attach an API Gateway resource policy to the private API that allows access only from the interface VPC endpoint ID, and route on-premises traffic through the Direct Connect connection to the private IP addresses of the VPC endpoint.

Create an Amazon Secrets Manager secret containing the database credentials, encrypted with a Customer Managed Key (CMK) in AWS KMS. Configure the RDS Proxy to use this secret, and grant the Lambda execution role and RDS Proxy role permissions to retrieve the secret and decrypt it using the CMK.

Deploy the Lambda functions in private subnets with a route table directing outbound internet traffic to a single NAT Gateway to facilitate the database connection, while removing all concurrency limits on the Lambda functions to allow maximum scaling.

Store the database credentials in AWS Secrets Manager using the default AWS-managed KMS key (aws/secretsmanager), and configure the Secrets Manager resource policy to grant the cross-account Lambda execution role decryption permissions.

Configure the Lambda functions to connect directly to the database writer endpoint, and set the reserved concurrency of the Lambda functions to zero to protect other critical serverless workloads in the AWS account from resource exhaustion.

Show answer & explanation

Answer: Create an Amazon API Gateway private REST API and configure an interface VPC endpoint for API Gateway in the VPC. Attach an API Gateway resource policy to the private API that allows access only from the interface VPC endpoint ID, and route on-premises traffic through the Direct Connect connection to the private IP addresses of the VPC endpoint.; Create an Amazon Secrets Manager secret containing the database credentials, encrypted with a Customer Managed Key (CMK) in AWS KMS. Configure the RDS Proxy to use this secret, and grant the Lambda execution role and RDS Proxy role permissions to retrieve the secret and decrypt it using the CMK.

Answer

Create an Amazon API Gateway private REST API with an interface VPC endpoint and resource policy, and use AWS Secrets Manager with a Customer Managed Key to store credentials for the RDS Proxy.

Creating a private API Gateway REST API with an interface VPC endpoint and restricting access via resource policies ensures that all traffic remains private and travels over the Direct Connect connection. Using AWS Secrets Manager with a Customer Managed Key (CMK) satisfies the encryption requirements and allows appropriate IAM role access delegation for the RDS Proxy and Lambda functions.

Step-by-Step Solution

Configure the private API entry point

An API Gateway private REST API is created and associated with an interface VPC endpoint (execute-api) in the customer's VPC. A resource policy restricts access to this endpoint.

This ensures that API traffic remains private and is only accessible from the VPC and routed from on-premises over Direct Connect.

Configure database credential security and proxy access

An Amazon Secrets Manager secret is created and encrypted using a Customer Managed Key (CMK). The RDS Proxy is configured to retrieve these credentials using an IAM role.

This satisfies the requirement to use a CMK for encrypting credentials and allows the RDS Proxy to authenticate with the database.

Configure Lambda function network and IAM permissions

The Lambda functions are deployed within private subnets in the VPC with no route to a NAT Gateway, and are granted permissions to decrypt the database credentials via the KMS CMK policy.

This restricts the Lambda functions from accessing the public internet while allowing them to connect to the database via RDS Proxy and decrypt secrets.

Key Concept

Modernizing legacy workloads using a combination of API Gateway private endpoints, VPC-integrated Lambda functions, RDS Proxy for connection pooling, and Secrets Manager with KMS Customer Managed Keys.

Question 417Question →

A financial services company is building a transaction archiving solution on AWS. The architecture is split across two AWS accounts: a Processing Account where an application on Amazon EC2 instances writes daily transaction logs, and a Compliance Account where the logs must be stored in an Amazon S3 bucket. The compliance guidelines dictate that all logs must be encrypted at rest using SSE-KMS with a key managed by the Compliance Account, and the compliance team must automatically own all uploaded log objects. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create a Customer Managed Key (CMK) in the Compliance Account, and configure its key policy to grant the EC2 instance IAM role in the Processing Account permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions.

Configure the S3 bucket policy in the Compliance Account to grant the EC2 instance IAM role in the Processing Account `s3:PutObject` permission, and set the S3 Object Ownership setting on the bucket to Bucket Owner Enforced.

Use the default AWS-managed KMS key for S3 (`aws/s3`) in the Compliance Account, and configure its key policy to allow the EC2 instance IAM role in the Processing Account to encrypt and decrypt the logs.

Attach a Service Control Policy (SCP) to the Processing Account's Organizational Unit (OU) that explicitly grants `s3:PutObject` and `kms:GenerateDataKey` permissions to the EC2 instance IAM role, without configuring local IAM policies in the Processing Account.

Configure the S3 bucket policy in the Compliance Account by specifying the Processing Account's ID in the Resource block of the policy instead of the Principal block, relying on the S3 bucket policy to automatically authorize the EC2 instance IAM role.

Show answer & explanation

Answer: Create a Customer Managed Key (CMK) in the Compliance Account, and configure its key policy to grant the EC2 instance IAM role in the Processing Account permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions.; Configure the S3 bucket policy in the Compliance Account to grant the EC2 instance IAM role in the Processing Account `s3:PutObject` permission, and set the S3 Object Ownership setting on the bucket to Bucket Owner Enforced.

Answer

Create a Customer Managed Key (CMK) in the Compliance Account and configure its key policy to grant the EC2 instance IAM role in the Processing Account permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions, and configure the S3 bucket policy in the Compliance Account to grant the EC2 instance IAM role in the Processing Account `s3:PutObject` permission, while setting the S3 Object Ownership setting on the bucket to Bucket Owner Enforced.

To set up secure cross-account uploads with encryption, you must use a Customer Managed Key (CMK) because the default AWS-managed KMS keys do not support policy modification for cross-account access. The key policy of the CMK must grant the external EC2 instance IAM role permissions for `kms:GenerateDataKey` and `kms:Decrypt`. Additionally, the S3 bucket policy must allow the EC2 instance IAM role to perform `s3:PutObject`, and the S3 Object Ownership setting on the bucket must be configured as Bucket Owner Enforced. This automatically transfers ownership of all uploaded objects to the bucket owner and disables ACLs.

Step-by-Step Solution

Select the correct KMS key type for cross-account encryption.

Identify that a Customer Managed Key (CMK) is required because AWS-managed keys (`aws/s3`) cannot have their key policies modified for cross-account delegation.

KMS cross-account access requires explicit permission delegation in the key policy.

Configure the S3 bucket policy and Object Ownership settings in the Compliance Account.

Write a bucket policy targeting the EC2 instance IAM role in the Processing Account for `s3:PutObject` access, and configure S3 Object Ownership to Bucket Owner Enforced.

This grants write permissions across accounts while transferring ownership of the uploaded files to the destination bucket owner.

Key Concept

Cross-account resource sharing using S3 bucket policies, KMS key policies, and S3 Object Ownership configuration.

Estimated Time:2m 0s

Question 418Question →

An enterprise is designing a deployment pipeline for a serverless microservice using the AWS Serverless Application Model (SAM). The microservice is deployed as an AWS Lambda function behind an Amazon API Gateway REST API. The company requires a deployment strategy that routes $10\%$ of the production traffic to the new version, and then increases the traffic to the new version by $10\%$ every $10$ minutes until it reaches $100\%$ . If the error rate of the microservice increases during the deployment, the process must automatically roll back.

Which TWO configurations must the Solutions Architect implement in the AWS SAM template to achieve this deployment strategy? (Select TWO.)

Select all that apply

Set the `Type` property of the `DeploymentPreference` for the Lambda function to `Linear10PercentEvery10Minutes` and specify an `AutoPublishAlias` for the function.

Set the `Type` property of the `DeploymentPreference` for the Lambda function to `Canary10Percent10Minutes` and specify an `AutoPublishAlias` for the function.

Create an Amazon CloudWatch alarm that monitors the `Errors` metric of the Lambda function alias, and list this alarm in the `Alarms` property of the `DeploymentPreference`.

Create an Amazon CloudWatch alarm that monitors the `Errors` metric of the global `$LATEST` version of the Lambda function, and list this alarm in the `Alarms` property of the `DeploymentPreference`.

Set the `Type` property of the `DeploymentPreference` for the Lambda function to `AllAtOnce` and configure a pre-traffic hook Lambda function to test the deployment.

Show answer & explanation

Answer: Set the `Type` property of the `DeploymentPreference` for the Lambda function to `Linear10PercentEvery10Minutes` and specify an `AutoPublishAlias` for the function.; Create an Amazon CloudWatch alarm that monitors the `Errors` metric of the Lambda function alias, and list this alarm in the `Alarms` property of the `DeploymentPreference`.

Answer

Setting the deployment preference type to `Linear10PercentEvery10Minutes` with an `AutoPublishAlias` configured, and creating an Amazon CloudWatch alarm that monitors the `Errors` metric of the Lambda function alias listed in the `Alarms` property of the `DeploymentPreference`.

To satisfy the deployment requirements, the solutions architect must use the `Linear10PercentEvery10Minutes` configuration in the deployment preference, which shifts

10\%

of the traffic to the new version every

10

minutes until completion. Since AWS SAM uses Lambda aliases to manage these shifts, the `AutoPublishAlias` property is required. Additionally, to automate rollbacks on failure, a CloudWatch alarm monitoring the `Errors` metric of the specific Lambda function alias must be associated with the deployment preference. This ensures CodeDeploy can monitor the health of both versions during traffic shifting and trigger a rollback if error thresholds are exceeded.

Step-by-Step Solution

Determine the correct deployment preference type that matches a gradual linear traffic increase of

10\%

every

10

minutes.

Identify `Linear10PercentEvery10Minutes` as the AWS SAM deployment type that satisfies the requirement, unlike `Canary10Percent10Minutes` which performs a single canary step before routing all traffic.

This step ensures that the deployment configuration aligns exactly with the gradual linear scaling requirement.

Configure the required Lambda properties to enable traffic shifting.

Specify both the `DeploymentPreference` and the `AutoPublishAlias` properties in the AWS SAM template.

AWS SAM and AWS CodeDeploy require a Lambda function alias to coordinate version weight shifting. Without an alias, traffic shifting cannot occur.

Configure an automated monitoring and rollback mechanism for the deployment.

Create a CloudWatch alarm targeting the `Errors` metric of the specific Lambda function alias, and link it to the `DeploymentPreference` alarms.

Monitoring the alias ensures that only metrics relevant to the active traffic-shifted versions are evaluated, and listing it in the deployment preference allows CodeDeploy to automatically roll back on failure.

Key Concept

AWS SAM deployment preferences and CodeDeploy traffic shifting configurations for Lambda functions using aliases and CloudWatch alarms.

Question 419Question →

A global pharmaceutical corporation is designing a new cloud-based Manufacturing Execution System (MES) to monitor cleanroom environments and record regulatory batch records. The application will be deployed across two AWS Regions: eu-west-1 (Primary) and us-east-1 (Secondary). The system has a strict Recovery Time Objective (RTO) of 10 minutes and a Recovery Point Objective (RPO) of 1 minute.

The backend database is Amazon Aurora PostgreSQL. The application tier runs on Amazon EC2 instances in an Auto Scaling Group behind an Application Load Balancer (ALB) in each Region. The application instances must query a Private Hosted Zone (PHZ) in a shared services VPC for centralized configuration parameters. The application also requires highly available outbound internet connectivity in each Region to download regulatory compliance templates without being susceptible to a single Availability Zone (AZ) failure.

Which combination of actions should the Solutions Architect take to meet these requirements while minimizing downtime and maximizing fault tolerance? (Select TWO.)

Select all that apply

Deploy an Amazon Aurora Global Database with the primary cluster in eu-west-1 and a secondary cluster in us-east-1. Associate the Private Hosted Zone containing configuration details with the application VPCs in both AWS Regions.

Deploy a NAT Gateway in each Availability Zone in each Region's VPC, and configure the route tables of the private subnets in each Availability Zone to route outbound internet traffic through the NAT Gateway in their respective zone.

To minimize database replication costs, establish a cross-region replication strategy using daily database snapshots copied to us-east-1, and use AWS Backup to restore the database cluster in the secondary Region during a failover event.

Deploy a single NAT Gateway in the first Availability Zone of each Region's VPC, and configure the route tables of the private subnets across all Availability Zones in that Region to route outbound internet traffic through this single NAT Gateway.

Associate the Private Hosted Zone with the shared services VPC in the primary Region, and rely on cross-region VPC peering to automatically resolve the configuration hostnames from the application VPC in the secondary Region.

Configure an Amazon Aurora Auto Scaling policy on the secondary cluster in us-east-1 to dynamically scale read replicas to handle write operations when the primary database cluster in eu-west-1 fails.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in eu-west-1 and a secondary cluster in us-east-1. Associate the Private Hosted Zone containing configuration details with the application VPCs in both AWS Regions.; Deploy a NAT Gateway in each Availability Zone in each Region's VPC, and configure the route tables of the private subnets in each Availability Zone to route outbound internet traffic through the NAT Gateway in their respective zone.

Answer

Deploy an Amazon Aurora Global Database with the primary cluster in eu-west-1 and a secondary cluster in us-east-1, associate the Private Hosted Zone containing configuration details with the application VPCs in both AWS Regions, and deploy a NAT Gateway in each Availability Zone in each Region's VPC with local routing in private subnets.

The solution requires deploying an Amazon Aurora Global Database to achieve the RPO of 1 minute, as it uses storage-based replication with latency of less than 1 second. Promoting the secondary cluster in the event of an outage takes less than 1 minute, matching the 10-minute RTO. Additionally, the Private Hosted Zone must be associated with the application VPCs in both Regions to resolve DNS hostnames locally. Outbound NAT Gateway redundancy is achieved by deploying a NAT Gateway in each Availability Zone, preventing an outage in one Availability Zone from interrupting outbound traffic from other Availability Zones.

Step-by-Step Solution

Evaluate database replication options against RTO (10 minutes) and RPO (1 minute) constraints.

Identify that Amazon Aurora Global Database provides sub-second replication (RPO) and quick cross-region promotion (RTO), whereas snapshot restore methods fail both metrics.

Ensures the selected database architecture satisfies the strict disaster recovery SLA.

Determine Private Hosted Zone (PHZ) association requirements for multi-region DNS resolution.

Determine that the PHZ must be explicitly associated with the VPCs in both regions, as cross-VPC DNS resolution does not automatically work over peered VPCs without association.

Enables instances in the secondary region to resolve configuration endpoints.

Assess NAT Gateway deployment strategy for Availability Zone fault tolerance.

Choose to deploy a NAT Gateway per Availability Zone rather than a single NAT Gateway shared across multiple zones.

Eliminates a single point of failure for outbound internet traffic in case of an Availability Zone outage.

Key Concept

Designing multi-region disaster recovery using Amazon Aurora Global Databases, private DNS routing configuration, and AZ-redundant internet gateways.

Question 420Question →

A manufacturing corporation uses AWS Organizations to manage $30$ member accounts. The security team is designing a centralized logging and auditing solution. They want to collect AWS CloudTrail logs from all accounts and regions into a single Amazon S3 bucket located in a dedicated Security account. The solution must ensure that all log data is encrypted at rest using an AWS KMS key managed by the security team, member accounts cannot disable logging, and log delivery follows the principle of least privilege. Which combination of actions should the Solutions Architect perform to meet these requirements? (Select TWO.)

Select all that apply

Create an organization trail in the AWS Organizations management account that delivers logs to the central S3 bucket in the Security account, and apply an S3 bucket policy that allows write operations from the CloudTrail service principal under the condition that the organization ID matches the management account's organization.

Enable encryption on the organization trail using the default AWS-managed KMS key for CloudTrail in the Security account to automatically secure all logs sent from member accounts.

Create a customer managed KMS key in the Security account, configure the key policy to allow the CloudTrail service principal to generate data keys and decrypt logs across the organization, and associate this key with the organization trail.

Configure the central S3 bucket policy to grant write access directly to the root IAM user of each member account individually to verify identity before log delivery.

Attach a Service Control Policy (SCP) to the organization's Root OU that grants write permissions to the central S3 bucket for all member accounts to allow their local CloudTrail configurations to deliver logs.

Show answer & explanation

Answer: Create an organization trail in the AWS Organizations management account that delivers logs to the central S3 bucket in the Security account, and apply an S3 bucket policy that allows write operations from the CloudTrail service principal under the condition that the organization ID matches the management account's organization.; Create a customer managed KMS key in the Security account, configure the key policy to allow the CloudTrail service principal to generate data keys and decrypt logs across the organization, and associate this key with the organization trail.

Answer

Create an organization trail in the AWS Organizations management account that delivers logs to the central S3 bucket in the Security account, apply a bucket policy allowing the CloudTrail service principal restricted by the organization ID, and create a customer managed KMS key in the Security account with a key policy allowing cross-account CloudTrail access.

The correct solution uses an organization trail to consolidate log files from all AWS accounts within the Organization. The S3 bucket policy must allow the CloudTrail service principal to write logs, restricted by the organization ID to secure access. Because AWS-managed KMS keys cannot be shared across accounts, a customer managed key must be created in the Security account with a policy allowing the CloudTrail service principal to perform encryption operations.

Step-by-Step Solution

Establish Centralized Organization Trail

An organization trail is created in the management account, which automatically deploys and locks the trail configuration across all member accounts, ensuring logs from all accounts and regions are routed to a central S3 bucket.

This prevents local administrators in member accounts from stopping the trail or modifying its delivery destination.

Configure the S3 Bucket Policy in the Security Account

The central S3 bucket policy is configured to allow the CloudTrail service principal to put objects, restricted by the organization ID condition.

This ensures the S3 bucket accepts writes only from authenticated CloudTrail deliveries belonging to the specific AWS Organization.

Create and Configure a Customer Managed KMS Key

A customer managed key is deployed in the Security account with a key policy that grants permissions to the CloudTrail service principal for cross-account log encryption.

AWS-managed KMS keys cannot be shared or modified for cross-account usage, making a customer managed key necessary to encrypt centralized logs.

Key Concept

Centralized auditing requires an organization-wide trail, a service-principal-aware S3 bucket policy restricted by organization ID, and a customer managed KMS key to handle cross-account encryption permissions.

PreviousPage 21 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept