All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A financial technology company is modernizing its legacy ledger auditing API by migrating it to a serverless architecture on AWS. The new API must be hosted privately and accessed securely by internal microservices running in different VPCs across multiple AWS accounts within the same AWS Organization. The architecture must ensure that API traffic does not traverse the public internet and must minimize both network latency and administrative overhead by avoiding the management of inter-VPC transit routing or peering connections. The company also requires identity-based access control at the API Gateway layer. Which architecture meets these requirements with the least administrative complexity?

Deploy the API as an Amazon API Gateway private API. Configure a Route 53 Private Hosted Zone (PHZ) in the provider account for the API Gateway default endpoint and associate it only with the provider VPC. Establish VPC Peering between the provider VPC and the consumer VPCs, and update all route tables. Encrypt the payload using a shared AWS KMS customer managed key to enforce access control.

Deploy the API as an Amazon API Gateway private API. Configure the API to use AWS_IAM authorization. Instruct the consumer accounts to create Interface VPC Endpoints for the API Gateway service (com.amazonaws.region.execute-api) in their respective VPCs. Attach an API Gateway resource policy to the private API that allows execute-api:Invoke permissions to the organization's accounts, conditional on the request originating from the consumer VPC Endpoints.

Deploy the API as an Amazon API Gateway regional API. Set up an AWS Transit Gateway and connect all consumer VPCs to a central transit VPC in the provider account. Deploy an Application Load Balancer (ALB) inside the transit VPC to route traffic to the regional API Gateway endpoint. Restrict access at the API Gateway layer using a Service Control Policy (SCP) attached to the Organization root.

Deploy the API as an Amazon API Gateway private API. Use AWS Resource Access Manager (RAM) to share the private API Gateway resource with the consumer AWS accounts. Create an Interface VPC Endpoint for the shared API Gateway in a central shared VPC. Share the VPC endpoint with the consumer accounts, and use AWS-managed KMS keys for request signing and decryption.

Show answer & explanation

Answer: Deploy the API as an Amazon API Gateway private API. Configure the API to use AWS_IAM authorization. Instruct the consumer accounts to create Interface VPC Endpoints for the API Gateway service (com.amazonaws.region.execute-api) in their respective VPCs. Attach an API Gateway resource policy to the private API that allows execute-api:Invoke permissions to the organization's accounts, conditional on the request originating from the consumer VPC Endpoints.

Answer

The correct architecture is to deploy the API as an Amazon API Gateway private API using AWS_IAM authorization, create Interface VPC Endpoints in the consumer accounts, and attach an API Gateway resource policy that allows access from those VPC Endpoints.

The correct solution involves deploying a private API Gateway and utilizing Interface VPC Endpoints in the consumer accounts. API Gateway private APIs use AWS PrivateLink to allow secure, private access from VPCs. By creating Interface VPC Endpoints for the execute-api service in each consumer VPC, the microservices can access the provider's private API Gateway directly over the AWS network without needing VPC Peering or Transit Gateway routing. Configuring AWS_IAM authorization and applying an API Gateway resource policy that allows invoke permissions from the consumer VPC Endpoints secures the API at the Gateway layer with minimal administrative overhead.

Step-by-Step Solution

Deploy the API as an API Gateway private API.

This keeps the API completely private and restricts access to traffic originating from VPC endpoints over the AWS PrivateLink network, preventing public internet exposure.

To satisfy the requirement that traffic must not traverse the public internet and remain entirely private.

Configure AWS_IAM authorization on the private API.

This ensures that only requests signed with valid AWS credentials (using SigV4) are authenticated, fulfilling the identity-based access control requirement.

To enforce identity-based access control at the API Gateway layer.

Instruct consumer accounts to create Interface VPC Endpoints (com.amazonaws.region.execute-api) in their VPCs.

This allows the microservices to route API requests privately through AWS PrivateLink without establishing VPC Peering or Transit Gateway connections.

To minimize both network latency and administrative overhead by avoiding inter-VPC transit routing or peering.

Attach a resource policy to the private API that allows the execute-api:Invoke action for the consumer VPC Endpoints.

This grants access to the cross-account requests at the API Gateway boundary.

To authorize the consumer VPC endpoints and accounts to call the private API Gateway.

Key Concept

Cross-account private API access using API Gateway private APIs, Interface VPC Endpoints, and API Gateway resource policies.

Question 42Question →

A financial services company is launching a personalized dashboard that provides real-time portfolio performance metrics to $2,000,000$ active customers. During the stock market opening at 9:30 AM, query traffic is projected to surge instantly from $2,000$ requests per second to $300,000$ requests per second. The application is hosted on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer (ALB), and the portfolio data resides in an Amazon RDS for PostgreSQL database. To handle this daily flash traffic spike without dropping connections or incurring high latency, which strategy should a solutions architect implement?

Enable Multi-AZ replication on the Amazon RDS for PostgreSQL database, and configure the application to route read queries to the standby replica. Use target tracking scaling policies based on Application Load Balancer request count per target to dynamically scale the EC2 instances.

Implement an Amazon ElastiCache for Memcached cluster to cache portfolio data across multiple Availability Zones. Configure the EC2 Auto Scaling group cooldown period to

30

seconds to ensure the fleet scales out quickly enough to match the traffic rate.

Deploy an Amazon ElastiCache for Redis cluster in front of the PostgreSQL database to cache read-heavy queries. Configure the Auto Scaling group to use step scaling policies based on CPU utilization, and contact AWS Support to pre-warm the Application Load Balancer prior to the market opening.

Vertically scale the existing EC2 instances and the Amazon RDS database instance to the largest available instance types before the market opens. Rely on the default auto-scaling behavior of the Application Load Balancer to absorb the sudden load spike at 9:30 AM.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster in front of the PostgreSQL database to cache read-heavy queries. Configure the Auto Scaling group to use step scaling policies based on CPU utilization, and contact AWS Support to pre-warm the Application Load Balancer prior to the market opening.

Answer

The correct strategy combines caching at the database layer (ElastiCache for Redis) to reduce query load, proactive capacity allocation (ALB pre-warming) to handle the instant 150-fold traffic surge, and horizontal step scaling to add EC2 instances in response to CPU metrics. This ensures both the ingress layer (ALB) and the compute/storage layers scale dynamically and performantly.

Step-by-Step Solution

Analyze load scaling limits of the Application Load Balancer (ALB).

Identify that a sudden 150-fold traffic spike will outpace the ALB's automatic scaling rate, necessitating pre-warming by AWS Support.

ALB auto-scaling is gradual and cannot react instantly to massive, sub-minute surges.

Optimize database read throughput using a caching layer.

Place an Amazon ElastiCache for Redis cluster in front of the RDS PostgreSQL database to handle high-frequency, read-heavy query loads.

Caching prevents database bottlenecking and reduces query response times during peak hours.

Configure the Auto Scaling group to react quickly and stably to load surges.

Apply step scaling policies with appropriate warm-up times to scale out EC2 instances in defined increments.

Step scaling is more responsive to large spikes than simple scaling, and proper warm-up times prevent premature scaling evaluation.

Key Concept

Handling instantaneous flash traffic spikes by combining load balancer pre-warming, database query caching, and horizontal step scaling.

Estimated Time:2m 0s

Question 43Question →

A digital advertising company is designing a real-time bidding (RTB) platform that processes ad auction requests from global ad exchanges. The system must handle a baseline of $100,000$ requests per second (RPS) and scale to support sudden spikes of up to $800,000$ RPS with sub- $15$ millisecond response times. The current design proposes using an Application Load Balancer (ALB) routing traffic to Amazon ECS tasks running on AWS Fargate, with Amazon Aurora PostgreSQL as the persistent database.

Which two actions should the solutions architect take to meet the performance and latency requirements under peak traffic loads? (Select two.)

Select all that apply

Request AWS Support to pre-warm the ALB to the expected peak traffic capacity of

800,000

requests per second.

Configure Aurora Replicas in the database cluster and set up Auto Scaling to dynamically add replicas based on read load.

Rely on the ALB's default automatic scaling behavior to handle the surge from the baseline of

100,000

800,000

requests per second.

Direct a portion of the read queries to the Multi-AZ standby instance of the Aurora PostgreSQL database during peak traffic.

Deploy Amazon ElastiCache for Memcached to store user sessions and configure multi-AZ replication to ensure persistence during a failover.

Show answer & explanation

Answer: Request AWS Support to pre-warm the ALB to the expected peak traffic capacity of $800,000$ requests per second.; Configure Aurora Replicas in the database cluster and set up Auto Scaling to dynamically add replicas based on read load.

Answer

The correct actions are to request AWS Support to pre-warm the Application Load Balancer (ALB) to the expected peak traffic capacity of

800,000

requests per second, and to configure Aurora Replicas in the database cluster with Auto Scaling to dynamically handle the read load.

Pre-warming the Application Load Balancer (ALB) ensures that it has sufficient capacity provisioned beforehand to handle the massive, instantaneous 8-fold traffic spike without dropping connections. Utilizing Aurora Replicas with Auto Scaling allows the database layer to horizontally scale read capacity to handle the increased query volume, preserving sub-15ms response times.

Step-by-Step Solution

Analyze traffic characteristics and scaling limitations of the load balancing tier.

The application faces an immediate 8-fold traffic surge from

100,000

800,000

requests per second. Under default behavior, the ALB will fail to scale quickly enough, resulting in dropped packets and increased latency.

Requesting pre-warming for the ALB is necessary to prepare the balancer's capacity ahead of time for the peak spike.

Evaluate the database read-scaling capabilities of Amazon Aurora.

Dynamic read-scaling is achieved by adding Aurora Replicas to the cluster and configuring Auto Scaling based on metrics such as CPU utilization.

This offloads read operations from the primary writer node to the horizontally scaled reader nodes.

Eliminate incorrect configurations for databases and caches.

Multi-AZ standby instances cannot receive read queries. Amazon ElastiCache for Memcached does not offer replication or persistent failover features.

Identifying invalid database replication architectures and cache engine features helps refine the solution to comply with best practices.

Key Concept

Handling sudden massive spikes requires pre-provisioning capacity on the entry layer (ELB pre-warming) and utilizing scalable read replicas at the database tier.

Estimated Time:2m 0s

Question 44Question →

An enterprise is building a new content delivery portal. The architecture requires two storage tiers:

1. A persistent store for user session data (NoSQL workload) requiring sub-millisecond latencies for active sessions and active-active replication between two AWS regions.
2. A shared file system (File storage) to host legacy application files that must be concurrently mounted by multiple Linux-based Amazon EC2 instances across three Availability Zones. The file system must be encrypted at rest using a key that allows the enterprise to delegate access to a central security auditing account.

Which two storage and database configurations should the solutions architect select to meet these requirements? (Select TWO.)

Select all that apply

Amazon DynamoDB global tables to store the user session data.

Amazon Elastic File System (Amazon EFS) encrypted at rest using a customer managed KMS key.

Amazon ElastiCache for Memcached configured with cross-region replication to store the user session data.

Amazon Elastic File System (Amazon EFS) encrypted at rest using the default AWS managed KMS key (aws/elasticfilesystem).

Amazon RDS Multi-AZ standby instances deployed in the secondary region to serve read traffic for session data.

Show answer & explanation

Answer: Amazon DynamoDB global tables to store the user session data.; Amazon Elastic File System (Amazon EFS) encrypted at rest using a customer managed KMS key.

Answer

Amazon DynamoDB global tables to store the user session data, and Amazon Elastic File System (Amazon EFS) encrypted at rest using a customer managed KMS key.

To store the NoSQL user session data with sub-millisecond latency and active-active replication, Amazon DynamoDB global tables are the optimal choice. For the legacy shared file system, Amazon Elastic File System (Amazon EFS) natively supports concurrent mounts across multiple Availability Zones for Linux-based EC2 instances. To allow cross-account access delegation to the security auditing account, EFS must be encrypted at rest with a customer managed KMS key, as its key policy can be customized to grant cross-account permissions.

Step-by-Step Solution

Analyze the session data requirements: NoSQL workload, sub-millisecond latencies, active-active cross-region replication.

Identify Amazon DynamoDB global tables as the matching service because DynamoDB is a NoSQL store that supports sub-millisecond read/write latency with global tables offering active-active multi-region replication.

This guarantees that session data is available and replicated across both target regions with high performance.

Analyze the file storage requirements: shared file system concurrently mounted by Linux instances across three Availability Zones.

Identify Amazon Elastic File System (Amazon EFS) as the appropriate managed file storage service since it supports NFSv4 mounts across multiple Availability Zones concurrently.

EFS is a native shared file storage service designed for concurrent access from Linux hosts.

Evaluate key delegation requirements for EFS encryption at rest.

Choose a customer managed KMS key rather than an AWS managed key.

AWS managed keys do not support policy modification to delegate cross-account access to the security auditing account, whereas customer managed keys support full policy customization.

Key Concept

Selecting appropriate database and storage services based on workload characteristics (NoSQL vs. File), performance parameters, replication capabilities, and cross-account encryption access control requirements.

Estimated Time:2m 30s

Question 45Question →

A solutions architect is designing a database strategy for a new high-performance retail application (OLTP workload) that requires a MySQL-compatible database. The application expects massive spikes in read traffic that must be handled with minimal latency. The business requires a disaster recovery (DR) strategy in a secondary AWS Region with a recovery time objective (RTO) of less than $10\text{ minutes}$ and a recovery point objective (RPO) of less than $1\text{ minute}$ . Furthermore, all database snapshots and transaction logs must be exported to an Amazon S3 bucket in a separate central security account, and the security auditing team must be able to decrypt the database exports using a cross-account IAM role. Which database and storage strategy should the solutions architect choose to meet these requirements?

Deploy a Multi-AZ Amazon RDS for MySQL database in the main region. To handle read spikes, rely on the Multi-AZ standby instance to automatically scale and serve read traffic. Set up cross-region read replicas in the disaster recovery region for cross-region replication. Encrypt the database using a Customer Managed Key (CMK) shared with the security account.

Deploy a single-region Amazon Aurora MySQL database. Configure Aurora Auto Scaling for reader instances in the primary cluster to handle read spikes. Set up automated database snapshot copies to a secondary AWS Region every hour to meet the disaster recovery requirements. Encrypt the database using a Customer Managed Key (CMK) shared with the security account.

Deploy an Amazon Aurora Global Database with the primary cluster in the main region and a secondary cluster in the disaster recovery region. Configure Aurora Auto Scaling for reader instances in the primary cluster to handle read spikes. Enable database encryption at rest using a KMS Customer Managed Key (CMK), and modify the key policy to allow access to the cross-account security IAM role.

Deploy an Amazon Aurora Global Database with the primary cluster in the main region and a secondary cluster in the disaster recovery region. Configure Aurora Auto Scaling for reader instances in the primary cluster to handle read spikes. Enable database encryption at rest using the default AWS-managed KMS key (`aws/rds`), and configure the S3 bucket policy in the central security account to grant decrypt permissions.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in the main region and a secondary cluster in the disaster recovery region. Configure Aurora Auto Scaling for reader instances in the primary cluster to handle read spikes. Enable database encryption at rest using a KMS Customer Managed Key (CMK), and modify the key policy to allow access to the cross-account security IAM role.

Answer

Deploy an Amazon Aurora Global Database with reader Auto Scaling, using a KMS Customer Managed Key (CMK) shared with the security account to encrypt database storage.

The correct strategy uses Amazon Aurora Global Database, which replicates data with latency typically under

1\text{ second}

to a secondary AWS Region, fulfilling the

1\text{ minute}

RPO and

10\text{ minute}

RTO requirements. Using Aurora Auto Scaling for read replicas handles dynamic read scaling. To allow a separate AWS account to decrypt the database backups exported to S3, a Customer Managed Key (CMK) is required because AWS-managed keys (like `aws/rds`) cannot be shared across accounts.

Step-by-Step Solution

Analyze the disaster recovery (DR) requirement of less than

1\text{ minute}

RPO and

10\text{ minutes}

RTO.

Determine that periodic snapshots are insufficient due to RPO limits. Physical replication is required. Amazon Aurora Global Database replicates data cross-region with sub-second latency and allows regional failover within minutes.

To satisfy the database replication and recovery time objectives.

Evaluate the read-scaling requirement for handling read spikes.

Determine that Amazon Aurora Replicas with Auto Scaling can handle read scaling, whereas standard RDS Multi-AZ standbys cannot serve read traffic.

To choose a compute strategy that dynamically scales reads and maintains low latency.

Determine the encryption key type required for cross-account decryption of database exports in S3.

Establish that a Customer Managed Key (CMK) must be used. Modify the KMS key policy to grant the cross-account security IAM role permission to use the key.

AWS-managed KMS keys do not support cross-account sharing, which is a hard constraint for the external security audit requirement.

Key Concept

Architecting relational databases for high availability, low-latency cross-region disaster recovery, and cross-account secure encryption key management.

Estimated Time:2m 30s

Question 46Question →

An online tax-filing platform is preparing for the final filing day of the tax year. The platform currently handles a baseline load of $2,000$ requests per second (RPS) using Amazon ECS tasks on AWS Fargate behind an Application Load Balancer (ALB). The backend database is an Amazon Aurora PostgreSQL DB cluster. Based on historical data, traffic is expected to spike instantaneously to $120,000$ RPS within a $2$ -minute window. During this peak period, users will also run resource-intensive financial reporting dashboards that execute complex analytical queries. Which two actions should the Solutions Architect take to optimize the performance and scalability of this solution? (Select TWO.)

Select all that apply

Submit a support ticket to AWS to pre-warm the Application Load Balancer to the expected peak of

120,000

requests per second prior to the scheduled filing deadline.

Configure Amazon Aurora Auto Scaling to dynamically scale reader instances in the cluster and update the reporting application to query the cluster reader endpoint.

Rely on the Application Load Balancer's built-in automatic scaling to dynamically partition and provision capacity as traffic increases during the peak filing hours.

Configure a Multi-AZ deployment for the database cluster and configure the reporting application to direct analytical queries to the passive standby instance in the secondary Availability Zone.

Migrate the backend APIs to AWS Lambda functions and configure them to run with default unreserved concurrency to allow unlimited scaling during the peak hours.

Show answer & explanation

Answer: Submit a support ticket to AWS to pre-warm the Application Load Balancer to the expected peak of $120,000$ requests per second prior to the scheduled filing deadline.; Configure Amazon Aurora Auto Scaling to dynamically scale reader instances in the cluster and update the reporting application to query the cluster reader endpoint.

Answer

The correct actions are submitting a support ticket to AWS to pre-warm the Application Load Balancer to the expected peak traffic, and configuring Amazon Aurora Auto Scaling to dynamically provision reader instances while directing reporting queries to the reader endpoint.

The correct architecture requires pre-warming the Application Load Balancer (ALB) because standard load balancer scaling is reactive and cannot keep up with an instantaneous

6,000\%

surge in traffic within a

2

-minute window. Pre-warming pre-partitions the ALB's capacity. Additionally, to handle resource-intensive reporting queries without impacting write transactions on the primary DB instance, the reporting queries must be routed to the reader endpoint, backed by Aurora Auto Scaling. This dynamically adds reader instances (Aurora Replicas) as read load increases.

Step-by-Step Solution

Identify the scaling limits of the Application Load Balancer (ALB) under flash traffic conditions.

An instantaneous traffic increase from

2,000

RPS to

120,000

RPS (a

6,000\%

increase) will overwhelm the ALB's normal scaling rate, causing dropped requests.

Requesting AWS Support to pre-warm the ALB ensures the load balancer is pre-partitioned with the necessary capacity.

Analyze the database read scalability requirement.

The database is receiving heavy write traffic from tax filings, while users are running intensive reporting queries. To prevent performance degradation on the primary database instance, read queries should be routed to the reader endpoint.

By separating read and write workloads, write performance remains unaffected by heavy read traffic.

Configure horizontal read scaling.

Enabling Amazon Aurora Auto Scaling dynamically provisions additional Aurora Replicas to handle the read workload on the reader endpoint.

Ensuring low-latency query performance without affecting the primary instance.

Key Concept

Performance and Scalability Optimization under sudden flash traffic and mixed database workloads.

Question 47Question →

An enterprise is designing a new document archiving system. The application tier runs on Amazon EC2 instances in an Application account. The system must store documents in an Amazon S3 bucket located in a central Archive account within the same AWS Organization. The documents must be encrypted at rest using a KMS key. The security team requires that the KMS key be managed in the Archive account. Furthermore, an organization-wide guardrail must prevent any user or role in the Application account from deleting the S3 bucket or scheduling the deletion of the KMS key. Which two actions should the solutions architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Create a KMS customer managed key in the Archive account and configure its key policy to allow the EC2 instance IAM role in the Application account to perform the kms:GenerateDataKey and kms:DescribeKey actions.

Create a Service Control Policy (SCP) that denies the s3:DeleteBucket and kms:ScheduleKeyDeletion actions, and apply this SCP to the Organizational Unit (OU) containing the Application account.

Configure the S3 bucket default encryption in the Archive account to use the AWS-managed KMS key for Amazon S3 (aws/s3), and modify its key policy to trust the Application account's IAM role.

Create a Service Control Policy (SCP) that explicitly grants s3:PutObject and kms:GenerateDataKey permissions to the Application account, and attach it to the target Organizational Unit (OU).

Modify the S3 bucket policy in the Archive account to allow the S3 service principal (s3.amazonaws.com) to write logs, omitting specific source account or organizational conditions.

Show answer & explanation

Answer: Create a KMS customer managed key in the Archive account and configure its key policy to allow the EC2 instance IAM role in the Application account to perform the kms:GenerateDataKey and kms:DescribeKey actions.; Create a Service Control Policy (SCP) that denies the s3:DeleteBucket and kms:ScheduleKeyDeletion actions, and apply this SCP to the Organizational Unit (OU) containing the Application account.

Answer

Configure a customer managed key in the Archive account with cross-account access granted via its key policy to the Application account's IAM role, and implement a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies bucket and key deletion.

To satisfy the requirements, the solutions architect must use a Customer Managed Key (CMK) in the Archive account and configure its key policy to explicitly trust the EC2 instance role in the Application account, enabling cross-account encryption. Additionally, the solutions architect must apply a Service Control Policy (SCP) to the OU containing the Application account to enforce compliance by denying bucket deletion and key deletion actions.

Step-by-Step Solution

Analyze key ownership requirements.

Identify that an AWS-managed key cannot be used since it does not support cross-account access delegation.

AWS-managed KMS keys do not support custom key policies and are restricted to the account in which they reside.

Configure the KMS key policy in the Archive account.

A Customer Managed Key is created, and its key policy is updated to grant permissions to the Application account's EC2 instance IAM role.

This enables the EC2 instances in the Application account to use the key for generating data keys to encrypt uploaded documents.

Design and apply the organization guardrail.

A Service Control Policy (SCP) is created that denies the destructive actions (s3:DeleteBucket and kms:ScheduleKeyDeletion) and is applied to the OU of the Application account.

SCPs act as permission guardrails that restrict actions across all principals in member accounts, ensuring compliance.

Key Concept

Cross-account KMS key delegation and Service Control Policies (SCPs) acting as permission guardrails

Question 48Question →

A media broadcasting company is modernizing its user subscription metadata API by refactoring a legacy application into a serverless architecture on AWS. The new system will use Amazon API Gateway and AWS Lambda to query an Amazon RDS PostgreSQL database. The database resides in private VPC subnets. The Lambda function must also make outbound HTTPS calls to an external partner's payment gateway. The migration has the following requirements:

* The database must be protected against connection exhaustion during high-traffic broadcast events.
* High availability must be maintained for all outbound external payments API calls.
* The subscription API function must not impact other critical serverless workloads in the same AWS account by exhausting the regional concurrency limit during peak events.
* All environment variables containing sensitive database credentials must be encrypted using an AWS KMS key that supports custom key policies for auditing by an external security team's AWS account.

Which configuration should a Solutions Architect recommend?

Deploy Amazon RDS Proxy in the database VPC to manage connection pooling. Configure the Lambda function to run inside the VPC's private subnets, and deploy NAT Gateways in multiple Availability Zones. Configure Provisioned Concurrency for the Lambda function without setting a Reserved Concurrency limit, and encrypt environment variables using a Customer Managed Key with a key policy allowing cross-account access.

Deploy Amazon RDS Proxy in the database VPC to manage connection pooling. Configure the Lambda function to run inside the VPC's private subnets, and deploy NAT Gateways in multiple Availability Zones to provide redundant outbound paths for external payment calls. Configure Reserved Concurrency for the Lambda function, and encrypt environment variables using a Customer Managed Key with a key policy that allows cross-account read access to the auditing team.

Deploy Amazon RDS Proxy in the database VPC to manage connection pooling. Configure the Lambda function to run inside the VPC's private subnets, and deploy a single NAT Gateway in a public subnet to route outbound payment calls to the internet. Configure Reserved Concurrency for the Lambda function, and encrypt environment variables using a Customer Managed Key with a key policy that allows cross-account access.

Deploy Amazon RDS Proxy in the database VPC to manage connection pooling. Configure the Lambda function to run inside the VPC's private subnets, and deploy NAT Gateways in multiple Availability Zones. Configure Reserved Concurrency for the Lambda function, and encrypt environment variables using the default AWS-managed KMS key (aws/lambda) while adding the auditing team's AWS account role to the key policy.

Show answer & explanation

Answer: Deploy Amazon RDS Proxy in the database VPC to manage connection pooling. Configure the Lambda function to run inside the VPC's private subnets, and deploy NAT Gateways in multiple Availability Zones to provide redundant outbound paths for external payment calls. Configure Reserved Concurrency for the Lambda function, and encrypt environment variables using a Customer Managed Key with a key policy that allows cross-account read access to the auditing team.

Answer

Deploy Amazon RDS Proxy, place the Lambda function in private subnets with NAT Gateways in multiple Availability Zones, configure Reserved Concurrency on the function, and encrypt sensitive environment variables using a Customer Managed Key.

Deploying Amazon RDS Proxy handles connection pooling to protect the PostgreSQL database. Running the Lambda function in the VPC's private subnets and routing outbound internet traffic through multiple NAT Gateways ensures high availability for the external payment gateway calls. Setting Reserved Concurrency limits the maximum concurrent executions for this specific function, preventing it from consuming the entire regional pool and starving other functions in the account. Using a Customer Managed Key (CMK) allows the key policy to be customized, facilitating auditing access for the external security team's AWS account.

Step-by-Step Solution

Configure database connection management

Deploy Amazon RDS Proxy in the database VPC.

RDS Proxy pools and shares database connections to prevent the PostgreSQL database from running out of connections during traffic spikes.

Configure Lambda network routing and high availability for outbound traffic

Place Lambda in private subnets and deploy NAT Gateways in multiple Availability Zones.

Lambda functions in private subnets require NAT Gateways to access the external payment gateway over the internet. Multiple NAT Gateways ensure high availability across Availability Zones.

Enforce concurrency boundaries

Configure Reserved Concurrency on the subscription API Lambda function.

Reserved Concurrency guarantees a maximum limit of concurrent executions for the function, protecting the remaining regional concurrency pool for other serverless applications in the AWS account.

Configure encryption key policies for cross-account auditing

Create a Customer Managed Key in AWS KMS and associate it with the Lambda environment variables.

Customer Managed Keys allow key policy customization to grant cross-account read access, which is not supported by default AWS-managed KMS keys.

Key Concept

Designing highly available, secure, and resilient serverless architectures using Lambda, API Gateway, RDS Proxy, and custom KMS keys.

Estimated Time:2m 30s

Question 49Question →

A smart utility provider is designing a new serverless telemetry platform to ingest power consumption data from $5,000,000$ smart meters. Each meter transmits a $2\text{ KB}$ JSON payload every $15$ seconds. During grid emergency events, the system must support flash traffic where meters transmit data every second. The application must process the incoming telemetry in near-real-time to detect anomalies, store the data for long-term historical analytics, and support a high-volume dashboard that queries the latest meter status with sub-second latency. Which combination of architectural decisions should a Solutions Architect recommend to achieve optimal performance and scalability? (Select TWO.)

Select all that apply

Ingest telemetry data using Amazon Kinesis Data Streams, and configure AWS Lambda with a Parallelization Factor to process the records and write them to an Amazon DynamoDB table.

Deploy an Amazon Aurora PostgreSQL database with Aurora Replicas, configure Aurora Auto Scaling to dynamically scale the replicas based on CPU utilization, and route dashboard queries to the reader endpoint.

Ingest telemetry data using an Application Load Balancer (ALB) and an Auto Scaling group of Amazon ECS tasks, relying solely on default ALB target tracking scaling policies to handle the sudden transition to

1

-second transmission intervals.

Scale the dashboard query performance during peak loads by deploying an Amazon RDS for PostgreSQL database in a Multi-AZ configuration, and configure the application to send read queries to the passive standby instance in the secondary Availability Zone.

Cache the latest meter statuses and session tokens using an Amazon ElastiCache for Memcached cluster, configuring multi-region replication and data persistence to prevent cache loss during failovers.

Show answer & explanation

Answer: Ingest telemetry data using Amazon Kinesis Data Streams, and configure AWS Lambda with a Parallelization Factor to process the records and write them to an Amazon DynamoDB table.; Deploy an Amazon Aurora PostgreSQL database with Aurora Replicas, configure Aurora Auto Scaling to dynamically scale the replicas based on CPU utilization, and route dashboard queries to the reader endpoint.

Answer

The optimal scalable design uses Amazon Kinesis Data Streams, AWS Lambda with Parallelization Factor, and Amazon DynamoDB for ingestion, and Amazon Aurora PostgreSQL with reader Auto Scaling and Aurora Replicas for scaling read queries.

Using Amazon Kinesis Data Streams ensures the system can absorb large streams of telemetry data. Processing with AWS Lambda using a Parallelization Factor allows faster stream consumption by running multiple Lambda invocations concurrently for each shard, which accelerates writing to Amazon DynamoDB. To scale database reads, Amazon Aurora PostgreSQL read replicas scale out automatically and are load-balanced via the reader endpoint to handle high-frequency dashboard queries.

Step-by-Step Solution

Select ingestion and processing components designed for real-time high-throughput streams.

Amazon Kinesis Data Streams coupled with AWS Lambda (Parallelization Factor) and Amazon DynamoDB.

Allows massive horizontal scaling of the ingestion layer while handling concurrent record processing on individual shards without increasing shard count.

Select database read scaling components for high-volume dashboard queries.

Amazon Aurora PostgreSQL read replicas and reader endpoints with Auto Scaling.

Offloads the primary database engine by routing read traffic to scaled replicas, preventing dashboard query degradation.

Exclude solutions relying on Application Load Balancer target tracking without pre-warming for instant spikes, RDS Multi-AZ passive standbys for reads, and Memcached for persistent replication.

Eliminated options using sub-optimal patterns.

These architectures violate performance efficiency and reliability best practices by assuming features that these services do not natively support.

Key Concept

Decoupling ingestion and scaling read capacity independently are core design strategies for high-performance and high-scalability workloads on AWS.

Estimated Time:3m 0s

Question 50Question →

An enterprise is designing a containerized web application on AWS that will be deployed using Amazon ECS across multiple Availability Zones. The application needs to dynamically process files and requires a shared, POSIX-compliant file system with sub-millisecond latencies for random read/write operations. Additionally, the application metadata must be stored in a relational database that handles high-volume OLTP workloads and supports automatic horizontal read scaling to accommodate traffic bursts. The architecture must achieve a Recovery Time Objective (RTO) of less than 30 minutes and a Recovery Point Objective (RPO) of less than 5 minutes.

Which two storage and database configurations should the solutions architect select to meet these requirements? (Select TWO.)

Select all that apply

Use Amazon FSx for NetApp ONTAP to provide the POSIX-compliant shared file system with sub-millisecond latency.

Use Amazon Aurora PostgreSQL with Auto Scaling for Aurora Replicas to scale read capacity.

Use Amazon RDS for PostgreSQL in a Multi-AZ deployment and configure the application to direct read traffic to the standby instance during traffic spikes.

Use Amazon EFS in General Purpose mode with daily backups to satisfy the disaster recovery objectives.

Use Amazon S3 with cross-account replication enabled and an AWS-managed KMS key (aws/s3) to store the shared files and delegate cross-account access.

Show answer & explanation

Answer: Use Amazon FSx for NetApp ONTAP to provide the POSIX-compliant shared file system with sub-millisecond latency.; Use Amazon Aurora PostgreSQL with Auto Scaling for Aurora Replicas to scale read capacity.

Answer

Use Amazon FSx for NetApp ONTAP to provide the POSIX-compliant shared file system with sub-millisecond latency, and use Amazon Aurora PostgreSQL with Auto Scaling for Aurora Replicas to scale read capacity.

The correct options are using Amazon FSx for NetApp ONTAP for the shared file system and Amazon Aurora PostgreSQL with auto-scaling replicas. FSx for NetApp ONTAP delivers sub-millisecond latencies and is POSIX-compliant, satisfying the performance and compatibility requirements. Amazon Aurora PostgreSQL with Auto Scaling for Aurora Replicas scales read capacity horizontally in response to traffic demands and natively supports the required low RPO/RTO metrics.

Step-by-Step Solution

Evaluate the file storage options against performance and protocol constraints.

Amazon FSx for NetApp ONTAP is selected because it is POSIX-compliant and supports sub-millisecond read/write latencies. Amazon EFS does not consistently meet the sub-millisecond requirement, and Amazon S3 is object storage, not a POSIX file system.

To satisfy the performance and file system constraints of the media application.

Evaluate the database and read-scaling requirements.

Amazon Aurora PostgreSQL with Auto Scaling for Aurora Replicas is chosen. Amazon RDS Multi-AZ standby instances cannot serve read requests.

To dynamically scale read operations during traffic bursts for the OLTP metadata database.

Verify RTO and RPO objectives for the chosen components.

Both Amazon FSx for NetApp ONTAP and Amazon Aurora PostgreSQL support multi-AZ replication, automated snapshots, and rapid failover mechanisms that easily meet the 30-minute RTO and 5-minute RPO.

To ensure compliance with the disaster recovery requirements.

Key Concept

Selecting high-performance shared file storage and auto-scaling relational database strategies while meeting RTO/RPO limits.

Estimated Time:2m 30s

Question 51Question →

A Solutions Architect is designing a centralized compliance auditing solution for a large enterprise. The enterprise has an AWS Organization containing multiple member accounts. The requirement is to enable AWS CloudTrail in all member accounts and have them deliver their log files to a single Amazon S3 bucket located in a dedicated Security account. All logs must be encrypted at rest. The solution must follow the principle of least privilege and prevent unauthorized accounts from writing to the S3 bucket or using the encryption key. Which of the following represents the most secure and compliant architecture design to meet these requirements?

In the Security account, configure the S3 bucket to use the AWS-managed KMS key (aws/s3) for default encryption. Configure the S3 bucket policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) from all member accounts to write to the bucket. Configure the organization-wide CloudTrail trail to use this S3 bucket.

In the Security account, create a customer managed KMS key with a key policy that allows the CloudTrail service principal (cloudtrail.amazonaws.com) to perform kms:GenerateDataKey and kms:DescribeKey, restricted by a condition for the Organization ID. Configure the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl for the CloudTrail service principal, also restricted by a condition for the Organization ID. Configure the organization-wide CloudTrail trail to use this S3 bucket and customer managed KMS key.

In the Security account, create a customer managed KMS key with a key policy allowing the CloudTrail service principal. Configure the S3 bucket policy to allow s3:PutObject for a wildcard principal (*) to ensure all member accounts can write logs, relying on S3 Object Ownership to restrict read access to the Security account.

Create a Service Control Policy (SCP) at the AWS Organizations root level that allows s3:PutObject on the centralized S3 bucket and kms:GenerateDataKey on the encryption key for the CloudTrail service principal. Apply this SCP to all member account OUs, assuming this grants the required permissions without modifying the S3 bucket policy or the KMS key policy in the Security account.

Show answer & explanation

Answer: In the Security account, create a customer managed KMS key with a key policy that allows the CloudTrail service principal (cloudtrail.amazonaws.com) to perform kms:GenerateDataKey and kms:DescribeKey, restricted by a condition for the Organization ID. Configure the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl for the CloudTrail service principal, also restricted by a condition for the Organization ID. Configure the organization-wide CloudTrail trail to use this S3 bucket and customer managed KMS key.

Answer

Create a customer managed KMS key and an S3 bucket in the Security account. Configure their policies to allow the CloudTrail service principal, restricted by the AWS Organization ID, and configure the organization-wide CloudTrail trail to use these resources.

The correct answer provides a secure setup by using a customer managed KMS key, which allows key policies to be customized. The S3 bucket policy and KMS key policy both enforce least privilege by restricting access to the CloudTrail service principal under the specific AWS Organization ID condition, preventing unauthorized accounts from writing to the bucket or using the key.

Step-by-Step Solution

Identify the encryption requirements and select the appropriate KMS key type.

Determine that a Customer Managed Key (CMK) is required.

AWS-managed KMS keys (like aws/s3) do not allow policy modifications and cannot be shared cross-account or with external services across accounts.

Configure the S3 bucket policy and KMS key policy in the Security account.

Define policies that grant the CloudTrail service principal permission to perform write and key generation operations, restricted to the organization ID.

This implements the principle of least privilege, preventing external unauthorized entities from writing to the bucket or using the key.

Enable and configure the organization trail.

Configure the CloudTrail trail at the organization level to direct logs to the central S3 bucket and encrypt them using the CMK.

This automates log delivery from all current and future member accounts in the organization.

Key Concept

Cross-account resource sharing and encryption control design for centralized auditing using AWS KMS and Amazon S3 bucket policies.

Estimated Time:2m 0s

Question 52Question →

A financial services company is designing a cross-account backup recovery strategy under AWS Organizations. The production workload database runs in a production account (Account ID: $111122223333$ ) and stores backups in a primary backup vault. The compliance policy requires that database backups must be copied daily to a secure disaster recovery (DR) account (Account ID: $444455556666$ ) and stored in a destination backup vault. Both backup vaults must encrypt backups at rest using Customer Managed Keys (CMKs) to satisfy auditing requirements. The copy operation must be initiated from the production account and run automatically using AWS Backup. Which combination of actions should the Solutions Architect perform to configure the required security and compliance controls for this cross-account backup copy operation? (Select TWO.)

Select all that apply

In the destination account (

444455556666

), configure the key policy of the destination vault's Customer Managed Key to grant `kms:CreateGrant` and `kms:DescribeKey` permissions to the AWS Backup service role in the source production account (

111122223333

In the destination account (

444455556666

), configure the Backup Vault access policy of the destination backup vault to allow the `backup:CopyIntoBackupVault` action for the AWS Backup service role in the source production account (

111122223333

In the source production account (

111122223333

), encrypt the primary backup vault using the AWS-managed KMS key for backups (`aws/backup`), and configure the destination account's backup service role to decrypt using this key.

Create a Service Control Policy (SCP) in the Organizations management account that grants the `backup:CopyIntoBackupVault` permission to the source production account's backup service role, and attach the SCP to the Organizational Unit (OU) containing the destination account (

444455556666

Configure a resource policy on the Amazon S3 bucket used by the destination backup vault to allow the `s3:PutObject` action for the AWS Backup service role in the source production account (

111122223333

Show answer & explanation

Answer: In the destination account ( $444455556666$ ), configure the key policy of the destination vault's Customer Managed Key to grant `kms:CreateGrant` and `kms:DescribeKey` permissions to the AWS Backup service role in the source production account ( $111122223333$ ).; In the destination account ( $444455556666$ ), configure the Backup Vault access policy of the destination backup vault to allow the `backup:CopyIntoBackupVault` action for the AWS Backup service role in the source production account ( $111122223333$ ).

Answer

In the destination account, configure the key policy of the destination vault's Customer Managed Key to grant `kms:CreateGrant` and `kms:DescribeKey` permissions to the AWS Backup service role in the source production account, and configure the Backup Vault access policy of the destination backup vault to allow the `backup:CopyIntoBackupVault` action for the AWS Backup service role in the source production account.

For cross-account backup copying, the AWS Backup service role in the source account requires permissions to encrypt backups in the destination vault. To achieve this, the destination Customer Managed Key's key policy must grant `kms:CreateGrant` and `kms:DescribeKey` permissions to the source account's AWS Backup service role. Additionally, the destination vault's Backup Vault access policy must allow the `backup:CopyIntoBackupVault` action for the source service role.

Step-by-Step Solution

Ensure the source backup vault is encrypted using a Customer Managed Key (CMK) instead of the default AWS-managed key.

Allows key policy modification, which is required because AWS-managed keys cannot be shared across accounts.

AWS Backup requires a customer managed key on the source vault for cross-account copying.

Modify the KMS key policy of the destination Customer Managed Key in the destination account.

Grants `kms:CreateGrant` and `kms:DescribeKey` permissions to the AWS Backup service role of the source account.

Allows AWS Backup in the source account to encrypt the copy inside the destination vault using the destination key.

Modify the Backup Vault access policy of the destination backup vault in the destination account.

Grants `backup:CopyIntoBackupVault` permission to the AWS Backup service role in the source production account.

Authorizes the cross-account write operation at the vault level.

Key Concept

Cross-account AWS Backup copy configuration requires a Customer Managed Key (CMK) at the source and appropriate resource policies (Backup Vault access policy and KMS key policy) to authorize the cross-account encryption and write operations.

Question 53Question →

A global food delivery application is launching a real-time order tracking feature. During daily lunch and dinner peak hours, order tracking activity increases significantly. The system must support a peak of $50,000$ database writes per second for order status updates, and a peak of $250,000$ database reads per second for customers checking their order status. The backend architecture consists of an Application Load Balancer (ALB), an Auto Scaling group of Amazon EC2 instances, and an Amazon Aurora MySQL database cluster with one writer and one reader instance. During peak hours, database CPU utilization on the writer node spikes to $95\%$ , causing order status update delays and connection timeouts. The application requires sub-second latency for all operations. Which of the following database tier optimization strategies will meet these requirements while maintaining operational efficiency and high availability?

Deploy an Amazon ElastiCache for Redis cluster to cache the active order status records. Configure the application to query the cache first and update the cache when database writes occur. Enable Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization to handle residual queries routed to the reader endpoint.

Configure the Aurora cluster as a Multi-AZ deployment, and configure the application's read connection pool to direct status query traffic to the passive standby instance's endpoint to distribute read workloads.

Submit an AWS Support ticket to pre-warm the Application Load Balancer before the daily lunch and dinner peak windows, and scale the primary Aurora writer instance vertically to a larger instance class to handle the peak write and read traffic.

Configure the EC2 Auto Scaling group scaling policy with a cooldown period of

10

seconds to ensure instances launch immediately when CPU spikes, and configure Aurora Auto Scaling to dynamically scale the primary writer instance's size to match the query throughput.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster to cache the active order status records. Configure the application to query the cache first and update the cache when database writes occur. Enable Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization to handle residual queries routed to the reader endpoint.

Answer

The correct strategy offloads read operations (

250,000

reads per second) to a fast caching tier using Amazon ElastiCache for Redis. This reduces the CPU utilization on the database cluster significantly. Any database reads that miss the cache are directed to the Aurora reader endpoint, which scales horizontally via Aurora Auto Scaling. This handles the scale requirement efficiently and maintains sub-second latency.

Step-by-Step Solution

Analyze the database bottleneck under the specified workload.

Identify that the primary writer node is overloaded due to a mix of

50,000

writes per second and

250,000

reads per second.

Determining that horizontal scaling or caching is needed because vertical scaling of a single writer cannot sustain this combined throughput.

Implement a caching tier for hot reads.

Deploy Amazon ElastiCache for Redis to cache order status read requests.

Caching offloads the vast majority of the

250,000

reads per second from the database cluster, lowering latency and CPU load.

Configure read scaling for remaining database queries.

Configure Aurora Auto Scaling to scale reader replicas based on average CPU utilization, routing reads via the reader endpoint.

This handles any cache misses or residual read traffic dynamically without affecting the primary writer node.

Key Concept

Database Read Scaling and Caching Strategy

Question 54Question →

A digital healthcare provider is modernizing its medical document processing application by refactoring a legacy webhook receiver into a serverless architecture on AWS. The webhook receiver accepts completed document upload notifications from external partner AWS accounts, decrypts the payloads using an AWS KMS key shared with the partners, and processes the payload metadata before writing it to an Amazon Aurora PostgreSQL database.

The solution must meet the following architectural requirements:
- Provide a highly available, public HTTPS endpoint to receive webhook notifications.
- Prevent large spikes in partner webhook volume from consuming all execution concurrency in the AWS account, which would throttle other critical synchronous API functions.
- Support key sharing and decryption of the payloads sent by external partner AWS accounts.
- Prevent connection exhaustion on the Aurora database during traffic bursts.
- Maintain high availability across multiple Availability Zones for all compute and network egress components.

Which of the following architectures meets these requirements with the least operational risk?

Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that uses an AWS KMS Customer Managed Key (CMK) with a key policy allowing cross-account access for the partner accounts. Deploy the Lambda function across multiple private subnets in different Availability Zones using redundant NAT Gateways, configure an Amazon RDS Proxy, and apply Reserved Concurrency to the Lambda function.

Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that uses an AWS KMS Customer Managed Key (CMK) with a key policy allowing cross-account access for the partner accounts. Deploy the Lambda function across multiple private subnets in different Availability Zones using redundant NAT Gateways and configure an Amazon RDS Proxy, but do not set any concurrency limit on the Lambda function to allow it to auto-scale freely during sudden payload surges.

Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that decrypts payloads using the default AWS-managed KMS key for Lambda (aws/lambda) with cross-account access enabled. Deploy the Lambda function across multiple private subnets in different Availability Zones using redundant NAT Gateways, configure an Amazon RDS Proxy, and apply Reserved Concurrency to the Lambda function.

Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that uses an AWS KMS Customer Managed Key (CMK) with a key policy allowing cross-account access for the partner accounts. Deploy the Lambda function inside a single private subnet in one Availability Zone with a single NAT Gateway to reduce egress costs, configure an Amazon RDS Proxy, and apply Reserved Concurrency to the Lambda function.

Show answer & explanation

Answer: Configure an Amazon API Gateway REST API as the public endpoint. Integrate the API Gateway with a Lambda function that uses an AWS KMS Customer Managed Key (CMK) with a key policy allowing cross-account access for the partner accounts. Deploy the Lambda function across multiple private subnets in different Availability Zones using redundant NAT Gateways, configure an Amazon RDS Proxy, and apply Reserved Concurrency to the Lambda function.

Answer

The correct architecture uses Amazon API Gateway to provide the public HTTPS endpoint and a Lambda function configured with a Customer Managed Key (CMK) to allow the necessary cross-account decryption permissions. By setting Reserved Concurrency on the Lambda function, the workload is prevented from exhausting the regional execution pool and throttling other synchronous services. Deploying the function across multiple subnets with redundant NAT Gateways ensures high availability for network egress, and RDS Proxy prevents database connection pool exhaustion during traffic surges.

Step-by-Step Solution

Expose the API public endpoint and handle scaling.

Use API Gateway REST API to receive partner webhooks and trigger the Lambda function.

API Gateway automatically handles HTTPS endpoints and scales transparently with incoming webhook traffic.

Configure secure decryption of payloads from external accounts.

Create a KMS Customer Managed Key and configure the key policy to permit cross-account kms:Decrypt actions for partner IAM identities.

AWS-managed keys (like aws/lambda) cannot have their policies altered to allow cross-account access, so a Customer Managed Key is required.

Apply concurrency control to protect the AWS account.

Configure Reserved Concurrency on the Lambda function.

Setting Reserved Concurrency restricts the maximum concurrent executions of this specific function, preventing it from consuming the entire regional pool and starving other business-critical synchronous functions.

Ensure secure, scalable database connectivity and network egress high availability.

Deploy the Lambda function in private subnets across multiple Availability Zones with redundant NAT Gateways and route DB queries through an Amazon RDS Proxy.

Using RDS Proxy protects Aurora from connection exhaustion during Lambda scaling, and redundant NAT Gateways prevent a single Availability Zone outage from disrupting outbound traffic.

Key Concept

Applying Reserved Concurrency on Lambda prevents unconstrained scaling from exhausting the regional concurrency pool, while Customer Managed Keys enable secure cross-account key sharing and RDS Proxy protects databases from connection spikes.

Question 55Question →

A media company is launching a live interactive voting feature during a weekly television broadcast. The platform expects an immediate traffic spike of $300,000$ concurrent requests within the first $30$ seconds of the voting window opening. The application retrieves user profiles and records votes. The current architecture consists of an Application Load Balancer (ALB) routing traffic to an Amazon ECS service running on AWS Fargate, backed by an Amazon Aurora PostgreSQL DB cluster. During load testing, the ALB drops requests with $503$ Service Unavailable errors during the first minute of the spike, and the database becomes unresponsive due to read contention on the user profiles table. Which combination of actions will resolve these performance and scalability issues?

Request AWS Support to pre-warm the ALB to the expected traffic volume before the broadcast, and create Aurora Replicas with Aurora Auto Scaling enabled to scale the read capacity of the database cluster.

Enable target tracking scaling policies on the ALB based on active connections, and enable Amazon RDS Multi-AZ deployment to route read queries to the standby database instance.

Request AWS Support to pre-warm the ALB to the expected traffic volume before the broadcast, and enable Amazon RDS Multi-AZ deployment to distribute the read query load to the standby instance.

Configure ECS scheduled scaling to pre-provision Fargate tasks, increase the instance size of the primary Aurora DB instance to handle the read query volume, and rely on the ALB's default automatic scaling.

Show answer & explanation

Answer: Request AWS Support to pre-warm the ALB to the expected traffic volume before the broadcast, and create Aurora Replicas with Aurora Auto Scaling enabled to scale the read capacity of the database cluster.

Answer

The correct solution addresses the load balancer bottleneck by pre-warming the Application Load Balancer (ALB) via AWS Support to ensure it is pre-provisioned for the anticipated spike. It addresses the database bottleneck by adding Aurora Replicas and enabling Aurora Auto Scaling, which scales read capacity horizontally to handle the user profile queries.

Step-by-Step Solution

Address the load balancer scaling limitation for flash traffic.

By pre-warming the Application Load Balancer (ALB) before the scheduled broadcast, the ALB is provisioned with sufficient capacity to handle the sudden burst of

300,000

concurrent requests, preventing

503

errors.

Standard ELB scaling is gradual and cannot keep pace with instant spikes of this magnitude.

Address the database read query contention.

By creating Aurora Replicas and configuring Aurora Auto Scaling, read queries can be offloaded from the primary instance and distributed across multiple replicas that scale dynamically.

Offloading reads to replicas resolves database contention, and Aurora Auto Scaling ensures capacity matches the load.

Key Concept

Horizontal scalability of load balancing and database read layers to handle predictable flash traffic spikes.

Alternative Method

Instead of relying on database query scaling, user profiles could be cached using Amazon ElastiCache for Redis or offloaded to a high-throughput NoSQL database like Amazon DynamoDB if the data structure permits. However, within the relational DB context, scaling reads horizontally via Aurora Replicas is the standard primary solution.

Estimated Time:2m 30s

Question 56Question →

A healthcare provider is modernizing its patient portal backend by refactoring a legacy monolithic API into a serverless architecture. The new design uses Amazon API Gateway and AWS Lambda functions that query a PostgreSQL database in a private subnet. The architecture must satisfy the following requirements:

1. The API must be accessible only from the on-premises network via an existing AWS Direct Connect connection.
2. The database must be protected from connection exhaustion during sudden morning login spikes, while ensuring Lambda functions remain highly available.
3. A single high-volume notification function must not exhaust the regional concurrency limit and disrupt other critical portal operations.
4. All application logs must be encrypted using a KMS Customer Managed Key (CMK) that is shared with a centralized security account.

Which TWO configurations should the Solutions Architect implement to meet these requirements?

Select all that apply

Deploy an Amazon RDS Proxy in the private subnets of the VPC to manage database connections, and configure a reserved concurrency limit on the high-volume notification Lambda function.

Use the default AWS managed key (aws/logs) to encrypt the Amazon CloudWatch log groups, and modify the key policy to grant the centralized security account cross-account decryption permissions.

Configure the private subnets where the Lambda functions are located to route outbound traffic through a single NAT Gateway deployed in a single public subnet to control egress costs, and rely on the default regional concurrency limit.

Enable provisioned concurrency on all Lambda functions to guarantee start times during peak morning spikes, and configure an Application Load Balancer to act as the entry point to route traffic directly to the private Lambda functions.

Show answer & explanation

Answer: Create a Private API in Amazon API Gateway, establish an interface VPC endpoint for API Gateway in the private subnets of the VPC, and apply an API Gateway resource policy that allows access only from the VPC endpoint.; Deploy an Amazon RDS Proxy in the private subnets of the VPC to manage database connections, and configure a reserved concurrency limit on the high-volume notification Lambda function.

Answer

Create a Private API in Amazon API Gateway, establish an interface VPC endpoint for API Gateway in the private subnets of the VPC, and apply an API Gateway resource policy that allows access only from the VPC endpoint. Additionally, deploy an Amazon RDS Proxy in the private subnets of the VPC to manage database connections, and configure a reserved concurrency limit on the high-volume notification Lambda function.

To establish a private API connection over Direct Connect, a Private API Gateway integrated with an interface VPC endpoint (VPCE) is required, secured by an API Gateway resource policy that restricts access to the VPC endpoint. To manage relational database connections effectively and prevent connection pool exhaustion from scaling serverless functions, Amazon RDS Proxy is deployed to pool database connections. Setting reserved concurrency on the high-volume function restricts its capacity, ensuring it cannot consume the entire account's regional concurrency pool and throttle other critical services.

Step-by-Step Solution

Configure private API Gateway access

Create a Private API and attach an interface VPC endpoint (execute-api) inside the private subnets, restricting access with an API Gateway resource policy.

This allows secure on-premises access over AWS Direct Connect without routing traffic over the public internet.

Prevent database connection exhaustion

Deploy Amazon RDS Proxy in the target VPC private subnets.

RDS Proxy pools database connections, preventing the scaling Lambda functions from overwhelming the relational database's connection limits.

Isolate high-volume function concurrency

Set a reserved concurrency limit on the high-volume notification Lambda function.

Reserved concurrency acts as a ceiling for the function, ensuring it cannot consume the entire regional concurrency pool and throttle other critical microservices.

Key Concept

Serverless application modernization requiring secure private endpoints, database connection pooling, Lambda concurrency isolation, and compliance-aligned KMS key management.

Question 57Question →

A healthcare provider is designing a new medical imaging analysis solution. The ingestion tier runs on Amazon ECS tasks in an Ingestion account (Account A). The processed high-resolution images must be securely stored in an Amazon S3 bucket within a centralized Archiving account (Account B) under HIPAA compliance. The images must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). The solution must ensure that only ECS tasks in Account A can upload files and perform cryptographic operations using the CMK. Which two actions should the Solutions Architect perform to implement this secure cross-account storage and encryption architecture? (Select TWO.)

Select all that apply

In the Archiving account (Account B), configure the S3 bucket default encryption to use the AWS managed key (aws/s3) and modify its policy to delegate usage permissions to the ECS task IAM role in the Ingestion account (Account A).

In the Archiving account (Account B), create a customer managed KMS key and configure its key policy to grant the ECS task IAM role in the Ingestion account (Account A) permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.

Create a Service Control Policy (SCP) in the AWS Organizations management account that grants s3:PutObject and kms:GenerateDataKey permissions to the Ingestion account (Account A) OU, eliminating the need for local IAM policies.

In the Archiving account (Account B), configure the S3 bucket policy to allow the IAM role of the ECS tasks in the Ingestion account (Account A) to perform s3:PutObject and s3:GetObject actions.

In the Archiving account (Account B), configure the S3 bucket policy to allow public access (Principal: "*") while using a bucket condition to restrict access based on the source VPC ID from the Ingestion account (Account A).

Show answer & explanation

Answer: In the Archiving account (Account B), create a customer managed KMS key and configure its key policy to grant the ECS task IAM role in the Ingestion account (Account A) permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.; In the Archiving account (Account B), configure the S3 bucket policy to allow the IAM role of the ECS tasks in the Ingestion account (Account A) to perform s3:PutObject and s3:GetObject actions.

Answer

Create a customer managed KMS key in the archiving account and configure its key policy to allow the external ECS task IAM role to perform cryptographic operations. Additionally, configure the S3 bucket policy in the archiving account to allow the external ECS task IAM role to perform the required S3 actions.

To secure cross-account workloads that use S3 buckets encrypted with KMS keys, you must create a customer managed KMS key in the destination account because AWS-managed keys cannot be shared cross-account. You must then configure both the KMS key policy and the S3 bucket policy in the destination account to explicitly authorize the IAM role of the client task in the source account.

Step-by-Step Solution

Select a customer managed KMS key instead of an AWS managed key.

Enables the ability to edit the key policy for cross-account access delegation.

AWS managed KMS keys (like aws/s3) cannot be shared across accounts as their key policies are immutable.

Configure the key policy of the customer managed KMS key in Account B.

Grants the ECS task IAM role in Account A permission to generate data keys and decrypt.

Without KMS key policy authorization, the external principal cannot perform the cryptographic operations required to upload and download encrypted files.

Configure the S3 bucket policy in Account B.

Grants the ECS task IAM role in Account A permission to perform S3 actions.

For cross-account S3 operations, the bucket policy in the destination account must explicitly permit the external IAM principal.

Key Concept

Cross-account access delegation for encrypted S3 buckets requires using Customer Managed Keys (CMKs) rather than AWS Managed Keys, combined with both S3 bucket policy and KMS key policy authorization targeting the external IAM identity.

Estimated Time:2m 0s

Question 58Question →

A solutions architect is designing the database strategy for a new online ticketing application (OLTP workload). The application requires a relational database backend that can handle a high rate of transactions. The architecture must achieve a Recovery Time Objective (RTO) of less than 30 seconds and a Recovery Point Objective (RPO) of less than 5 seconds in the event of an Availability Zone outage. Additionally, the system must scale its read capacity dynamically to handle sudden spikes in query volume. The security policy mandates that database encryption keys must be managed in a centralized security AWS account. Which design strategy meets these requirements?

Deploy an Amazon Aurora PostgreSQL DB cluster with Auto Scaling Aurora Replicas, and encrypt the cluster using an AWS KMS Customer Managed Key (CMK) that is created in the centralized security account and shared with the application account.

Deploy an Amazon RDS for PostgreSQL DB instance in a Multi-AZ deployment, configure the application to route read traffic to the Multi-AZ standby replica to scale capacity during peak events, and encrypt the database with an AWS KMS Customer Managed Key (CMK) shared from the centralized security account.

Deploy an Amazon Aurora PostgreSQL DB cluster with Auto Scaling Aurora Replicas, encrypt the cluster using the default AWS-managed KMS key (aws/rds) in the application account, and modify the IAM policy of the centralized security account to manage the key.

Deploy an Amazon RDS for PostgreSQL Single-AZ DB instance with automated backups, and copy the snapshots to another AWS Region using an AWS KMS Customer Managed Key (CMK) to achieve high availability and scale reads from the copied snapshots.

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL DB cluster with Auto Scaling Aurora Replicas, and encrypt the cluster using an AWS KMS Customer Managed Key (CMK) that is created in the centralized security account and shared with the application account.

Answer

The correct architecture uses Amazon Aurora PostgreSQL with Auto Scaling Aurora Replicas. Aurora's storage architecture replicates data across multiple Availability Zones, allowing failover in under 30 seconds and minimal RPO. Read capacity is scaled horizontally and dynamically via Aurora Replicas. Using a Customer Managed Key (CMK) created in the centralized security account and shared via key policy changes allows the database to be securely encrypted cross-account.

Step-by-Step Solution

Evaluate the database tier requirements for high availability, RTO/RPO, and read scaling.

Amazon Aurora is selected because it replicates data across 3 Availability Zones, supports failover in less than 30 seconds (RTO < 30 seconds, RPO < 5 seconds), and supports horizontal scaling of reads via Auto Scaling Aurora Replicas.

Standard RDS Multi-AZ standby instances do not support read traffic, and a Single-AZ setup cannot meet the tight RTO requirement during an AZ outage.

Evaluate the cross-account encryption requirements.

Identify that a Customer Managed Key (CMK) in the centralized security account must be used and shared with the database application account.

AWS-managed KMS keys (e.g., aws/rds) are restricted to their own account and cannot be modified or shared across accounts.

Key Concept

Selecting high-availability database architectures that support dynamic read scaling and cross-account key management in compliance with RTO/RPO objectives.

Question 59Question →

A financial trading platform is launching a new real-time market simulation application. During the opening bell at $9:30$ AM EST daily, traffic instantly surges from a baseline of near zero to over $200,000$ concurrent connections within a two-minute window. The application requires sub-millisecond read access to the current price tickers and must handle the write traffic of order placements. The architecture consists of an Application Load Balancer (ALB), an Auto Scaling group of Amazon EC2 instances, and an Amazon Aurora PostgreSQL database. Which architecture design should a solutions architect recommend to optimize performance and scalability during the daily peak?

Configure a target tracking scaling policy for the EC2 Auto Scaling group with a cooldown period of

10

seconds to respond quickly to the surge. Rely on the ALB to scale dynamically as traffic increases. Use Aurora Replicas with Auto Scaling to handle the database read load.

Configure a target tracking scaling policy for the EC2 Auto Scaling group based on ALB request count per target. Enable RDS Multi-AZ on the database cluster, directing read traffic to the standby instance in the secondary Availability Zone to offload queries from the primary writer instance during peak hours.

Configure a scheduled scaling policy for the EC2 Auto Scaling group to scale out before

9:30

AM EST, and submit a support ticket to AWS to pre-warm the ALB for the expected traffic. Add Aurora Replicas to the database cluster and configure Aurora Auto Scaling based on CPU utilization to scale reads, while utilizing Amazon ElastiCache for Redis to cache ticker prices.

Replace the EC2 tier with AWS Lambda functions triggered by the ALB. Use Aurora Replicas to scale reads. Do not configure reserved concurrency on the Lambda functions so they can burst freely up to the regional account limits to handle the burst.

Show answer & explanation

Answer: Configure a scheduled scaling policy for the EC2 Auto Scaling group to scale out before $9:30$ AM EST, and submit a support ticket to AWS to pre-warm the ALB for the expected traffic. Add Aurora Replicas to the database cluster and configure Aurora Auto Scaling based on CPU utilization to scale reads, while utilizing Amazon ElastiCache for Redis to cache ticker prices.

Answer

Configure a scheduled scaling policy for the EC2 Auto Scaling group to scale out before

9:30

The correct architecture addresses the flash traffic pattern by proactively scaling out the compute tier using scheduled scaling prior to the known peak at

9:30

AM EST, and requesting ALB pre-warming from AWS Support. Read throughput is scaled horizontally using Aurora Replicas combined with Amazon ElastiCache for Redis to satisfy the sub-millisecond latency requirement.

Step-by-Step Solution

Address the ALB scaling limitation for sudden flash traffic.

Determine that standard ALB scaling is too slow for a spike from zero to

200,000

connections in

2

minutes. Pre-warming must be requested from AWS Support.

ALBs scale gradually based on traffic patterns. Immediate massive spikes cause packet drops unless the load balancer is pre-warmed.

Ensure EC2 compute capacity is available immediately at market open.

Configure a scheduled scaling policy to launch EC2 instances before the

9:30

AM EST spike.

Target tracking or step scaling policies are reactive and take minutes to bootstrap new instances, which is too slow for this fast-onset scenario.

Optimize database read scaling and sub-millisecond query requirements.

Add Aurora Replicas with Auto Scaling and implement an Amazon ElastiCache for Redis caching tier.

Aurora Replicas allow horizontal scaling of the read tier. ElastiCache for Redis caches the frequently accessed price tickers to achieve sub-millisecond read latency and offload queries from the primary database engine.

Key Concept

Handling flash traffic surges requires proactive scaling (pre-warming load balancers and scheduled EC2 scaling) combined with read scaling through read replicas and caching layers.

Estimated Time:2m 30s

Question 60Question →

A gaming company is modernizing its multiplayer matchmaking lobby backend by migrating to a serverless architecture on AWS. The design features a public Amazon API Gateway HTTP API that routes incoming requests to an AWS Lambda function. The Lambda function must perform low-latency read and write operations against an Amazon ElastiCache for Redis cluster deployed in private subnets across $3$ Availability Zones ( $AZs$ ). The Lambda function also requires outbound internet connectivity to communicate with external gaming partner APIs. Additionally, the Lambda function must retrieve and decrypt game configuration settings stored in a centralized security account, which are encrypted using an AWS KMS key. The architecture must protect other administrative Lambda functions in the same account from concurrency exhaustion during high-traffic peaks, avoid single points of network failure, and ensure that updates to the Lambda function can be rolled back automatically if error rates increase.

Which of the following configurations meets these requirements?

Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways (one per Availability Zone). Set reserved concurrency on the matchmaking Lambda function. Encrypt game configurations using a Customer Managed Key (CMK) in the central account and update its key policy to allow cross-account access. Deploy the Lambda function using AWS CodeDeploy with a canary deployment configuration and CloudWatch alarm-based rollbacks.

Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways (one per Availability Zone). Rely on the default regional unreserved concurrency pool to allow the function to scale dynamically to meet spikes. Encrypt game configurations using a Customer Managed Key (CMK) in the central account and update its key policy to allow cross-account access. Deploy the Lambda function using AWS CodeDeploy with a canary deployment configuration and CloudWatch alarm-based rollbacks.

Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones, routing all outbound internet traffic through a single NAT Gateway deployed in one public subnet to reduce operating costs. Set reserved concurrency on the matchmaking Lambda function. Encrypt game configurations using a Customer Managed Key (CMK) in the central account and update its key policy to allow cross-account access. Deploy the Lambda function using AWS CodeDeploy with a canary deployment configuration and CloudWatch alarm-based rollbacks.

Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways (one per Availability Zone). Set reserved concurrency on the matchmaking Lambda function. Encrypt game configurations using the AWS-managed KMS key for Systems Manager (aws/ssm) in the central account and modify its key policy to grant cross-account decryption access. Deploy the Lambda function using AWS CodeDeploy with a canary deployment configuration and CloudWatch alarm-based rollbacks.

Show answer & explanation

Answer: Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways (one per Availability Zone). Set reserved concurrency on the matchmaking Lambda function. Encrypt game configurations using a Customer Managed Key (CMK) in the central account and update its key policy to allow cross-account access. Deploy the Lambda function using AWS CodeDeploy with a canary deployment configuration and CloudWatch alarm-based rollbacks.

Answer

Configure the Lambda function inside the VPC's private subnets across multiple Availability Zones with redundant NAT Gateways, set reserved concurrency, use a cross-account Customer Managed Key (CMK) for game configuration decryption, and deploy using AWS CodeDeploy canary configuration with CloudWatch alarm-based rollbacks.

The correct answer provides high availability by utilizing private subnets across multiple Availability Zones with redundant NAT Gateways, preventing single-AZ network failures. It protects regional account-level concurrency by explicitly defining reserved concurrency for the matchmaking function. It satisfies the cross-account encryption requirement by utilizing a Customer Managed Key (CMK) with a modified key policy. Finally, it ensures safe deployments with a reduced blast radius through CodeDeploy canary configurations and automated CloudWatch rollbacks.

Step-by-Step Solution

Evaluate the networking requirements for high availability and outbound internet access.

The Lambda function needs to be placed inside the private subnets of the VPC to communicate with the private ElastiCache cluster. For internet communication without a single point of failure, outbound traffic must route through redundant NAT Gateways (one per Availability Zone).

Ensuring a NAT Gateway is deployed per Availability Zone prevents a single AZ outage from interrupting outbound internet connectivity.

Analyze concurrency management to protect administrative functions.

Apply reserved concurrency to the matchmaking Lambda function to set a dedicated limit on its scaling.

Reserved concurrency acts as both a guarantee for the function and a ceiling that prevents it from consuming the entire regional account-level concurrency pool, which would throttle other functions.

Determine the correct KMS configuration for cross-account decryption.

Utilize a Customer Managed Key (CMK) in the central security account and configure the key policy to grant decrypt permissions to the matchmaking Lambda function's IAM role.

AWS-managed keys (e.g., aws/ssm) cannot have their key policies modified and therefore do not support cross-account access.

Select the proper deployment strategy to minimize blast radius and support automated rollbacks.

Use AWS CodeDeploy with a canary deployment configuration integrated with CloudWatch alarms.

A canary deployment routes a small percentage of traffic to the new version first and automatically rolls back if CloudWatch alarms (e.g., measuring latency or error rates) are triggered, minimizing blast radius.

Key Concept

Designing secure, highly available, and resilient serverless architectures using AWS Lambda, API Gateway, VPC networking, Reserved Concurrency, Customer Managed Keys, and CodeDeploy Canary deployments.

PreviousPage 3 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution