Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 61Question →

A retail company is modernizing its order fulfillment processing system by migrating its legacy database and order-receiving application to a serverless architecture on AWS. The system must process orders via a public HTTPS endpoint, run validation logic in AWS Lambda, and store transaction details in an Amazon Aurora PostgreSQL database. During seasonal promotional events, order volume spikes unpredictably. The solutions architect must ensure that the database is protected from connection exhaustion, outbound transactions to external credit card processors remain highly available, and the serverless components do not disrupt other critical applications in the same AWS region by exhausting shared concurrency limits.

Which TWO of the following actions should the Solutions Architect take to build a secure, resilient, and high-performing architecture?

Select all that apply

Show answer & explanation

Answer: Deploy Amazon RDS Proxy in the private subnets of the VPC to manage and pool database connections from the Lambda functions to the Aurora PostgreSQL cluster.; Configure reserved concurrency on the validation Lambda function to limit its maximum concurrent executions and protect the regional concurrency pool.

Answer

Deploy Amazon RDS Proxy in the private subnets to pool database connections, and configure reserved concurrency on the Lambda function to limit its maximum executions and protect the regional pool.
Deploying Amazon RDS Proxy allows connection pooling and reuse, protecting the Amazon Aurora PostgreSQL database from exhaustion due to the ephemeral nature of Lambda functions. Configuring reserved concurrency limits the maximum executions of the validation function, protecting the shared regional concurrency pool and ensuring other critical production functions are not throttled.

Step-by-Step Solution

1
Analyze database connection limits and scaling requirements.
Identify that rapid scaling of serverless Lambda functions can easily exhaust the Aurora PostgreSQL database's connection pool, requiring a proxying layer.
Amazon RDS Proxy pools and shares database connections to prevent connection exhaustion during traffic spikes.
2
Evaluate regional Lambda concurrency requirements.
Determine that an unconstrained, high-volume Lambda function can consume all available regional concurrency (1,0001,000 by default).
Setting reserved concurrency limits the function's maximum capacity, protecting the regional pool for other services.
3
Review high availability and security configurations for VPC networking and Secrets Manager.
Verify that NAT Gateways must be deployed in multiple Availability Zones to prevent a single point of failure, and customer-managed KMS keys must be used for cross-account credential sharing.
AWS-managed keys cannot be shared across accounts, and single AZ NAT Gateways violate multi-AZ resilience guidelines.

Key Concept

Modernizing legacy transactional architectures to serverless using API Gateway, Lambda, RDS Proxy, and resilient networking configurations.
Question 62Question →

A healthcare provider is establishing a centralized patient records archiving platform. Medical reports generated by application servers in the Processing account are uploaded to an Amazon S3 bucket located in the Archival account. To meet HIPAA compliance, all archived objects must be encrypted at rest using a Customer Managed Key (CMK) managed in a centralized Security account. A data auditing application running on Amazon ECS tasks in a separate Auditing account requires read access to these archived reports.

Which combination of policy configurations must be implemented to allow the ECS tasks in the Auditing account to retrieve and decrypt the records?

Show answer & explanation

Answer: Configure the S3 bucket policy in the Archival account to allow s3:GetObject for the ECS task role in the Auditing account. Configure the KMS key policy in the Security account to allow kms:Decrypt for the ECS task role. Attach an IAM policy to the ECS task role in the Auditing account that grants s3:GetObject on the S3 bucket and kms:Decrypt on the KMS CMK.

Answer

Configure the S3 bucket policy in the Archival account to allow s3:GetObject for the ECS task role in the Auditing account. Configure the KMS key policy in the Security account to allow kms:Decrypt for the ECS task role. Attach an IAM policy to the ECS task role in the Auditing account that grants s3:GetObject on the S3 bucket and kms:Decrypt on the KMS CMK.
To successfully read an S3 object encrypted with a KMS CMK when the caller, the S3 bucket, and the KMS key are all in different accounts, permissions must be explicitly granted at three trust boundaries: the caller's IAM policy must allow both S3 and KMS actions, the S3 bucket policy must allow the cross-account caller to retrieve objects, and the KMS key policy must allow the cross-account caller to decrypt.

Step-by-Step Solution

1
Configure the calling principal's local identity policy.
The ECS task role in the Auditing account is granted permissions to perform s3:GetObject on the target bucket and kms:Decrypt on the target KMS CMK ARN.
IAM entities require explicit identity-based policies to access resources in other accounts.
2
Configure the resource policy on the destination S3 bucket.
The S3 bucket policy in the Archival account is updated to trust the ECS task role in the Auditing account for s3:GetObject.
Cross-account access to S3 resources must be explicitly allowed by the resource-owner account's bucket policy.
3
Configure the KMS key policy on the Customer Managed Key (CMK).
The key policy in the Security account is modified to include the ECS task role in the Auditing account as a principal allowed to perform kms:Decrypt.
Since the KMS key resides in a third account, its key policy must explicitly authorize the cross-account principal, as S3 cannot delegate KMS permissions on behalf of the caller.

Key Concept

Cross-account access to KMS-encrypted S3 objects requires explicit authorization at the caller's IAM policy, the S3 bucket policy, and the KMS key policy, using a Customer Managed Key (CMK) since AWS-managed keys cannot be shared across accounts.
Question 63Question →

A logistics company is modernizing a retail stock allocation API. The API is hosted on AWS using Amazon API Gateway and AWS Lambda, and must securely interact with an Amazon Aurora PostgreSQL database located in a private subnet. The application experiences extreme traffic spikes during promotions, increasing from 50 to 10,000 requests per second. The security policy requires database credentials to be stored in AWS Secrets Manager, encrypted using a customer-managed KMS key to allow granular access control via key policies. The network architecture must be highly available, minimize exposure to the public internet, and prevent database connection exhaustion. Which of the following architectures meets these requirements with the highest availability and security?

Show answer & explanation

Answer: Configure a regional API Gateway. Deploy Amazon RDS Proxy in the database subnets. Configure the Lambda function to run in the private subnets of the VPC across multiple Availability Zones, and configure VPC endpoints for AWS Secrets Manager and KMS. Store the database credentials in AWS Secrets Manager, encrypted with a customer-managed KMS key, and set a reserved concurrency limit on the Lambda function.

Answer

Configure a regional API Gateway, deploy Amazon RDS Proxy in the database subnets, run the Lambda function in the private subnets of the VPC across multiple Availability Zones with VPC endpoints for AWS Secrets Manager and KMS, encrypt the secret with a customer-managed KMS key, and configure reserved concurrency on the Lambda function.
The correct architecture uses Amazon RDS Proxy to handle connection pooling for the database, runs the Lambda function within the VPC using interface VPC endpoints to securely retrieve secrets and decrypt them without internet egress, utilizes a customer-managed KMS key to support explicit key policy configuration, and configures reserved concurrency on the Lambda function to protect the regional execution pool.

Step-by-Step Solution

1
Address database connection pooling for massive spikes.
Amazon RDS Proxy is deployed in the database subnets to pool connections and prevent database exhaustion.
Sudden traffic spikes from 50 to 10,000 requests per second can easily overwhelm a relational database with connection establishment overhead.
2
Establish secure private network pathways to AWS Secrets Manager and KMS.
Interface VPC endpoints (AWS PrivateLink) are created for Secrets Manager and KMS within the VPC.
This keeps traffic within the AWS private network and avoids the latency, cost, and reliability risks of traversing the public internet via NAT Gateways.
3
Configure encryption keys with custom permissions control.
A Customer Managed Key (CMK) is used to encrypt the Secrets Manager secret.
Unlike default AWS-managed keys (e.g., aws/secretsmanager), Customer Managed Keys allow modification of the key policy to enforce strict decryption access limits for the Lambda function's execution role.
4
Protect regional concurrency limits.
Reserved concurrency is set on the Lambda function.
Restricting the function's maximum concurrency prevents it from consuming the entire unreserved concurrency pool of the regional AWS account, which would throttle other critical applications.

Key Concept

Combining Lambda VPC integration, RDS Proxy connection pooling, PrivateLink endpoints, customer-managed KMS key policies, and Lambda concurrency management to build secure, highly available serverless workloads.
Estimated Time:3m 0s
Question 64Question →

A retail company is designing a new centralized transaction auditing solution. The application tier runs on Amazon EC2 instances within an Application account (Account A). The application must write transaction logs to an Amazon S3 bucket located in a dedicated Security account (Account B). The logs must be encrypted at rest using AWS KMS. The security team requires that the Security account (Account B) must maintain full ownership and control over all uploaded log files to enforce lifecycle retention policies. Which configuration strategy should the solutions architect implement to meet these requirements?

Show answer & explanation

Answer: Configure a customer managed KMS key in Account B, and update its key policy to allow the IAM role in Account A to perform kms:GenerateDataKey and kms:Decrypt actions. Update Account B's S3 bucket policy to allow the IAM role in Account A to perform s3:PutObject actions, and configure S3 Object Ownership on the bucket to Bucket Owner Enforced.

Answer

Configure a customer managed KMS key in Account B, allow Account A's IAM role to use it, grant s3:PutObject permissions in Account B's bucket policy, and set S3 Object Ownership to Bucket Owner Enforced.
The correct strategy is to use a customer managed KMS key in Account B, configure its key policy to allow Account A's IAM role to generate data keys, allow s3:PutObject in Account B's bucket policy, and enable S3 Object Ownership Bucket Owner Enforced. Using a customer managed KMS key allows cross-account policy updates, which is not possible with AWS-managed keys. Specifying Bucket Owner Enforced disables S3 ACLs and automatically transfers ownership of all uploaded objects to Account B, satisfying the ownership and control requirement.

Step-by-Step Solution

1
Identify key sharing limits.
Determine that the default AWS-managed KMS key (aws/s3) cannot be shared across AWS accounts because its policy cannot be modified. A customer managed KMS key must be used in the destination account.
Ensures that Account A's IAM role has permission to generate data keys from the key in Account B.
2
Configure the KMS key policy.
Allow Account A's IAM role to perform kms:GenerateDataKey and kms:Decrypt operations on the customer managed key in Account B.
Allows the application to encrypt logs using the key managed by the Security account.
3
Configure cross-account S3 bucket policy.
Create a bucket policy in Account B that explicitly allows Account A's IAM role to perform s3:PutObject.
Grants the necessary write permissions across accounts, which local IAM policies in the source account cannot do on their own.
4
Enforce bucket ownership.
Set the S3 Object Ownership configuration to Bucket Owner Enforced.
Disables ACLs and automatically transfers ownership of all uploaded log files to Account B, meeting the security and compliance requirements.

Key Concept

Cross-account security and compliance control design using KMS key policies, S3 bucket policies, and S3 Object Ownership settings.
Question 65Question →

An enterprise is modernizing a legacy internal reporting application by refactoring it into a serverless microservice. The microservice consists of an Amazon API Gateway API backed by an AWS Lambda function. The API Gateway and Lambda function are deployed in a producer AWS account. The API must only be accessible by client applications running within a VPC in a consumer AWS account. Both AWS accounts are members of the same AWS Organization. The solution must ensure that all API traffic remains private without traversing the public internet, and administrative overhead must be minimized. Which architecture should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Deploy a private API Gateway in the producer account, and attach an API Gateway resource policy that allows access from the consumer VPC endpoint. In the consumer account, create an interface VPC endpoint for API Gateway in the consumer VPC. In the producer account, authorize the association of the API's private hosted zone with the consumer VPC, and complete the association in the consumer account.

Answer

Deploy a private API Gateway in the producer account, and attach an API Gateway resource policy that allows access from the consumer VPC endpoint. In the consumer account, create an interface VPC endpoint for API Gateway in the consumer VPC. In the producer account, authorize the association of the API's private hosted zone with the consumer VPC, and complete the association in the consumer account.
The architecture using a private API Gateway in the producer account, an interface VPC endpoint in the consumer account, and a cross-account Route 53 Private Hosted Zone association is the correct solution because it keeps all traffic private, resolves DNS natively, and minimizes administrative overhead.

Step-by-Step Solution

1
Deploy a private API Gateway in the producer account and associate it with the backend Lambda function.
The API is created but is not yet accessible from the consumer VPC.
Establishing a private endpoint requires a private API Gateway configuration.
2
In the consumer VPC, create an interface VPC endpoint (execute-api) for API Gateway.
An elastic network interface is created in the consumer VPC to route traffic privately to API Gateway.
This allows client applications in the consumer VPC to reach API Gateway without traversing the public internet.
3
Attach a resource policy to the private API Gateway in the producer account to allow access from the interface VPC endpoint ID in the consumer VPC.
API Gateway permissions are configured to authorize requests originating from the consumer's VPC endpoint.
Private API Gateways require a resource policy that explicitly allows access from the specific VPC endpoint.
4
Authorize the association of the private hosted zone of the API with the consumer VPC from the producer account, and then associate the consumer VPC with the private hosted zone in the consumer account.
The consumer VPC can now resolve the private API Gateway's DNS name locally.
Cross-account Private Hosted Zone association is required for native DNS resolution across different AWS accounts.

Key Concept

Cross-account private API Gateway access and Private Hosted Zone association
Question 66Question →

A digital health platform hosts a virtual daily fitness challenge. Every day at exactly 12:00 PM UTC, the platform experiences a sudden surge of 1,000,0001,000,000 concurrent users synchronizing their wearable telemetry data and requesting a live leaderboard. This activity window lasts for 55 minutes, resulting in an immediate 1010-fold increase in HTTP POST and GET requests. The architecture consists of an Application Load Balancer (ALB) routing requests to an Amazon Elastic Container Service (ECS) cluster on AWS Fargate, backed by an Amazon Aurora PostgreSQL database. Which design strategy provides the most performant, scalable, and operationally efficient solution to handle this daily traffic spike without dropping requests?

Show answer & explanation

Answer: Configure scheduled scaling for the ECS tasks to scale out before 12:00 PM UTC. Submit a request to AWS Support to pre-warm the ALB prior to the daily challenge window. Configure Aurora Auto Scaling to add Aurora Replicas to the DB cluster, and direct leaderboard read queries to the reader endpoint.

Answer

Configure scheduled scaling for the ECS tasks to scale out before the event, request AWS Support to pre-warm the ALB, and configure Aurora Auto Scaling with Aurora Replicas while directing read queries to the reader endpoint.
The correct strategy uses scheduled scaling for ECS tasks and pre-warming for the ALB to handle the sudden, predictable spike, while scaling Aurora reads using Aurora Replicas via the reader endpoint.

Step-by-Step Solution

1
Address the sudden network ingress spike at the load balancer tier.
Contact AWS Support to pre-warm the ALB so it is provisioned with sufficient capacity before the surge.
Standard ALB auto-scaling is reactive and cannot scale fast enough to prevent connection timeouts during an immediate 10-fold surge.
2
Address the compute scaling latency for container tasks.
Apply scheduled scaling to the ECS service to pre-provision Fargate tasks before 12:00 PM UTC.
Target tracking scaling policies take several minutes to detect high CPU and launch new tasks, which would fail to handle the initial minutes of the 5-minute peak.
3
Address the database read scaling requirements.
Configure Aurora Auto Scaling with Aurora Replicas and route read queries to the Aurora Reader endpoint.
Aurora Replicas handle read queries horizontally, unlike Multi-AZ standby instances which do not accept read traffic.

Key Concept

Handling predictable flash traffic spikes requires proactive resource provisioning at the load balancer and compute tiers, combined with horizontal read replica scaling at the database tier.
Estimated Time:2m 30s
Question 67Question →

A multinational enterprise is building a financial transaction platform using a multi-account structure in AWS Organizations. The application tier runs on Amazon EC2 instances in an Application account (account 444455556666). The transaction logs must be stored in a secured Amazon S3 bucket within the Application account. A compliance mandate dictates that all logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) hosted and managed centrally in a dedicated Security account (account 111122223333). Additionally, the system must reject any write operation to the S3 bucket if the data is not encrypted with the specified cross-account CMK. Which combination of actions should the Solutions Architect take to meet these compliance and security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the Security account, configure a Customer Managed Key key policy that grants the Application account root principal (arn:aws:iam::444455556666:root) permissions to perform kms:GenerateDataKey* and kms:Decrypt. In the Application account, attach an IAM policy to the EC2 instance profile's IAM role allowing these same KMS actions on the CMK ARN.; In the Application account, configure an S3 bucket policy that denies the s3:PutObject action unless the s3:x-amz-server-side-encryption-aws-kms-key-id request header matches the ARN of the KMS CMK in the Security account. In the Application account, grant the EC2 instance profile's IAM role permission to perform s3:PutObject on the S3 bucket.

Answer

The correct combination of actions is to configure a Customer Managed Key key policy in the Security account allowing the Application account root principal to perform key operations while attaching a corresponding local IAM policy to the EC2 instances, and to apply an S3 bucket policy in the Application account that denies writes without the designated KMS CMK ARN header.
The correct solution involves two main aspects of security control design: cross-account KMS usage and encryption enforcement. The option configuring a Customer Managed Key key policy to trust the Application account root principal combined with local IAM policies correctly implements the required cross-account KMS trust. The option implementing an S3 bucket policy that denies s3:PutObject requests unless the CMK ARN header is specified ensures compliance is enforced at the bucket level.

Step-by-Step Solution

1
Delegate cross-account KMS access from the owning account.
The KMS key policy in the Security account is modified to include the Application account root principal as an authorized entity for cryptographic operations.
KMS requires explicit delegation in the key policy for cross-account access before the target account can use IAM to assign permissions to individual roles.
2
Grant local identity-based permissions for the cross-account KMS key.
The IAM role assigned to the EC2 instances in the Application account is updated with permissions to perform kms:GenerateDataKey* and kms:Decrypt on the external CMK ARN.
Cross-account access requires a two-way handshake: trust in the resource policy (key policy) and permission in the identity policy (IAM policy).
3
Enforce encryption compliance via S3 bucket policies.
A bucket policy is applied to the S3 bucket in the Application account to deny any s3:PutObject operation if the encryption key used does not match the specific KMS CMK ARN.
This guarantees that even with correct IAM permissions, objects cannot be written unless they adhere to the mandated encryption controls.

Key Concept

Cross-account AWS KMS key access requires trust delegation in the Customer Managed Key's policy to the consumer account's root principal, followed by identity-based IAM policies in the consumer account. To enforce specific encryption requirements, S3 bucket policies must check condition keys such as s3:x-amz-server-side-encryption-aws-kms-key-id.
Question 68Question →

A biotechnology organization is launching a centralized clinical trial telemetry portal. Every quarter, hundreds of partner laboratories upload trial results simultaneously within a 15-minute window, causing web traffic to instantly spike from 100 requests per second to over 60,000 requests per second. The application layer runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The database backend is a Single-AZ Amazon RDS for PostgreSQL DB instance, where 90% of the operations during the submission window are read-heavy validation queries. Which strategy should a Solutions Architect implement to optimize the performance and scalability of the architecture under this load?

Show answer & explanation

Answer: Submit an AWS Support request to pre-warm the Application Load Balancer prior to the upload window. Migrate the database to Amazon Aurora PostgreSQL, and configure Aurora Auto Scaling to dynamically provision Aurora Replicas to handle the read query volume.

Answer

Submit an AWS Support request to pre-warm the Application Load Balancer prior to the upload window. Migrate the database to Amazon Aurora PostgreSQL, and configure Aurora Auto Scaling to dynamically provision Aurora Replicas to handle the read query volume.
The correct solution involves requesting AWS Support to pre-warm the Application Load Balancer to accommodate the sudden spike from 100 to 60,000 requests per second, which exceeds the normal dynamic scaling speed of the ALB. To scale the database layer, which is 90% read-heavy, migrating to Amazon Aurora PostgreSQL and configuring Aurora Auto Scaling dynamically provisions read replicas to distribute the read query workload.

Step-by-Step Solution

1
Address the immediate ALB scaling bottleneck.
By pre-warming the ALB, AWS provisions sufficient capacity in advance to handle the massive traffic spike from 100 to 60,000 requests per second, avoiding HTTP 503 errors and dropped requests.
Standard ELB auto-scaling is gradual and cannot scale instantly to a multi-magnitude traffic spike within minutes.
2
Select a database engine that supports horizontal read scaling.
Migrating to Amazon Aurora PostgreSQL allows the addition of up to 15 Aurora Replicas that share the same underlying storage volume.
Single-instance RDS for PostgreSQL or standard RDS Multi-AZ deployments cannot dynamically scale read operations horizontally.
3
Implement dynamic database read scaling.
Aurora Auto Scaling automatically adds and removes replicas based on CPU utilization or connection count targets, scaling the database capacity during peak periods.
This matches the read-heavy nature of the telemetry validation workload (90% reads) and optimizes operational overhead and cost.

Key Concept

Handling massive traffic spikes requires pre-warming the load balancer, while scaling read-heavy database workloads requires horizontal replica scaling instead of relying on passive standby instances.
Question 69Question →

A global educational institution is launching a synchronized national online examination platform. At exactly 09:00 AM UTC, up to 250,000 students will simultaneously log in, retrieve their personalized exam papers, and start submitting their answers. The architecture will use an Application Load Balancer (ALB) to distribute traffic to Amazon ECS on AWS Fargate tasks, with Amazon Aurora PostgreSQL as the database. To handle this massive, instantaneous surge in traffic without dropping requests or causing database bottlenecks, which of the following actions should the Solutions Architect perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Open a support ticket to pre-provision capacity for the Application Load Balancer (ALB) in anticipation of the 250,000 concurrent student connections.; Establish a time-based scaling plan for the Amazon ECS service to provision the maximum required Fargate tasks 30 minutes prior to the exam start time.

Answer

The correct actions are to pre-provision Application Load Balancer (ALB) capacity by opening a support ticket and to establish a scheduled time-based scaling plan for the Amazon ECS service to spin up Fargate tasks before the exam begins.
To support a massive, synchronized event with 250,000 concurrent users at an exact start time, the architecture must pre-provision capacity. Pre-warming the Application Load Balancer ensures that the load balancing tier is ready to accept the sudden wave of connections without dropping requests. Using a scheduled time-based scaling policy for Amazon ECS Fargate tasks guarantees that the compute capacity is fully scaled out and operational before the load hits, preventing latency and request failures during task initialization.

Step-by-Step Solution

1
Analyze the traffic pattern and workload characteristics.
The workload exhibits a massive, instant spike (flash traffic) of 250,000 users starting exactly at 09:00 AM UTC, which cannot be handled by dynamic reactive scaling.
Understanding the rapid ramp-up time is critical to choosing proactive scaling and pre-provisioning strategies over reactive ones.
2
Evaluate the scaling mechanics of the Application Load Balancer (ALB).
Standard ALBs scale progressively. For immediate spikes of this scale, requests will fail unless the ALB is pre-warmed.
Pre-warming ensures the load balancer's network capacity is configured for the expected surge in advance.
3
Evaluate the scaling mechanics of the compute tier (ECS on Fargate).
Dynamic scaling policies based on metrics like CPU utilization take several minutes to trigger and launch tasks, which is too slow. Scheduled scaling ensures the required Fargate tasks are running before the start time.
Proactive time-based scaling eliminates the startup delay associated with provisioning container capacity under load.

Key Concept

Handling instantaneous flash traffic spikes requires proactive capacity management, including pre-warming load balancers and using scheduled scaling policies for the compute tier, rather than relying on reactive scaling.
Question 70Question →

An enterprise is designing a secure document processing pipeline. The application runs on Amazon ECS tasks in an Application account. The ECS tasks process documents and must write the output to an Amazon S3 bucket in a separate Compliance account. All documents stored in the S3 bucket must be encrypted at rest using a Customer Managed Key (CMK) that is managed in a centralized Security account. Which combination of configuration steps should the Solutions Architect perform to allow the ECS tasks to successfully write the encrypted objects to the S3 bucket? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the KMS key policy in the Security account to allow the ECS task role in the Application account to perform the kms:GenerateDataKey and kms:Decrypt actions.; Configure the S3 bucket policy in the Compliance account to allow the ECS task role in the Application account to perform the s3:PutObject action.

Answer

To enable cross-account S3 uploads encrypted with a centralized KMS key, the KMS key policy in the Security account must grant key access (kms:GenerateDataKey and kms:Decrypt) to the ECS task role, and the S3 bucket policy in the Compliance account must grant write permissions (s3:PutObject) to the ECS task role.
To enable cross-account S3 uploads using KMS encryption, the writing principal needs access to both the target S3 bucket and the encryption key. The S3 bucket policy in the destination Compliance account must allow write access (s3:PutObject) to the ECS task role in the Application account. Concurrently, the KMS key policy of the Customer Managed Key (CMK) in the Security account must allow the same ECS task role to perform key operations (kms:GenerateDataKey and kms:Decrypt) to handle the server-side encryption.

Step-by-Step Solution

1
Evaluate KMS key type limitations.
Ensure a Customer Managed Key (CMK) is used in the Security account instead of an AWS-managed key.
AWS-managed keys do not support policy modification and cannot be shared across AWS accounts.
2
Configure KMS Key Policy in the Security account.
Grant the ECS task role in the Application account the kms:GenerateDataKey and kms:Decrypt actions in the CMK policy.
The ECS task role needs permission to use the KMS key to generate a data key for server-side encryption when writing to the S3 bucket.
3
Configure the S3 Bucket Policy in the Compliance account.
Grant the ECS task role in the Application account the s3:PutObject action in the bucket policy.
Cross-account access to S3 requires the destination bucket's resource policy to explicitly trust the external IAM principal.

Key Concept

Cross-account security controls using IAM, S3 bucket policies, and KMS key policies
Question 71Question →

A logistics company is deploying a telemetry system that ingests location data from 500,000 connected devices. The devices send data via HTTPS POST requests to a REST API hosted behind an Application Load Balancer (ALB). During scheduled shift changes, the system experiences instantaneous traffic surges, jumping from 5,000 requests per second to 300,000 requests per second within seconds. The data must be ingested reliably without loss and stored in an Amazon Aurora PostgreSQL database. Read operations for real-time dashboards must be scaled dynamically to handle peak periods. Which two configurations should a Solutions Architect implement to optimize the performance and scalability of this system?

Select all that apply

Show answer & explanation

Answer: Deploy Aurora Replicas in the Aurora PostgreSQL cluster and configure Aurora Auto Scaling to dynamically adjust the number of reader nodes based on target tracking metrics.; Submit a support ticket to AWS to pre-warm the Application Load Balancer before the scheduled shift changes to handle the instantaneous load increase.

Answer

To optimize performance and scalability, the Solutions Architect should deploy Aurora Replicas with Aurora Auto Scaling to dynamically handle dashboard reads, and submit a support ticket to AWS to pre-warm the Application Load Balancer to prevent dropped requests from the scheduled traffic spikes.
Pre-warming the Application Load Balancer ensures that the underlying resources are scaled out ahead of the scheduled surge, preventing connections from being dropped. Using Aurora Replicas with Aurora Auto Scaling dynamically provisions reader instances in response to database read demand, offloading the primary write instance.

Step-by-Step Solution

1
Analyze the load balancing and traffic pattern requirements.
The traffic spikes instantaneously from 5,000 to 300,000 requests per second during scheduled shift changes. The Application Load Balancer's automatic scaling algorithm is reactive and too slow to handle such sharp increases, which would cause connection timeouts and dropped packets.
Identifying the scaling limitation of the ALB under instantaneous load helps determine that pre-warming is required.
2
Determine the correct scaling mechanism for the database read queries.
Read operations for dashboards need to scale dynamically. Aurora PostgreSQL supports Aurora Replicas and Aurora Auto Scaling using target tracking policies to scale read capacity out and in.
This establishes that reader nodes are the correct resource to scale, rather than standby instances.
3
Evaluate and eliminate incorrect database and caching architectures.
Multi-AZ standby nodes do not serve read traffic in AWS RDS or Aurora (they are passive replication targets). Additionally, ElastiCache for Memcached lacks multi-AZ replication capabilities, which are only supported by ElastiCache for Redis.
Eliminating invalid configurations ensures the selected architecture adheres to AWS limitations and capabilities.

Key Concept

Handling sudden flash traffic on load balancers via pre-warming, and scaling database read workloads using Aurora Replicas and Aurora Auto Scaling.
Question 72Question →

A solutions architect is designing a storage and database architecture for a new financial auditing application (OLTP workload). The application will run in a primary AWS account and must access audit logs and transaction history stored in an Amazon S3 bucket in a centralized security account. The architecture must satisfy the following requirements:

1. The transaction ledger database requires a highly available, MySQL-compatible relational database with a recovery point objective (RPO) of 0 and a recovery time objective (RTO) of less than 60 seconds. High read throughput must be supported by dynamically scaling read capacity during end-of-month reporting.
2. The audit logs in S3 must be encrypted at rest, and the primary account's application role must be able to read and write to the central S3 bucket.
3. A low-latency session caching layer must support replication across multiple Availability Zones to prevent session loss if a primary cache node fails.

Which of the following database, caching, and storage designs meets these requirements?

Show answer & explanation

Answer: Configure Amazon Aurora MySQL with a Multi-AZ deployment and Aurora Replica Auto Scaling for the database. Encrypt the central S3 bucket using a Customer Managed Key (CMK) in AWS KMS, and configure both the KMS key policy and the S3 bucket policy to grant cross-account permissions to the primary account's IAM role. Deploy Amazon ElastiCache for Redis with Multi-AZ enabled to handle the session caching layer.

Answer

The correct design configures Amazon Aurora MySQL with Aurora Replica Auto Scaling, encrypts the S3 bucket using a Customer Managed Key (CMK) with appropriate cross-account permissions, and deploys Amazon ElastiCache for Redis with Multi-AZ.
The correct design uses Amazon Aurora MySQL because its Multi-AZ architecture supports rapid failover (RTO < 60s) with zero data loss (RPO = 0), and Aurora Auto Scaling dynamically scales read replicas to handle reporting loads. For cross-account access to encrypted S3 buckets, a Customer Managed Key (CMK) is required because AWS-managed keys (like aws/s3) cannot be shared across accounts via key policies. Amazon ElastiCache for Redis supports replication and automatic failover across Availability Zones, which prevents session loss upon node failure.

Step-by-Step Solution

1
Evaluate database requirements for MySQL compatibility, RPO of 0, RTO under 60 seconds, and dynamic read scaling.
Amazon Aurora MySQL with Multi-AZ and Aurora Replica Auto Scaling is selected.
Aurora's active-active storage layer replication enables rapid failover under 60 seconds with no data loss, and read replicas can auto-scale horizontally to offload reporting queries.
2
Determine the encryption and cross-account access mechanism for the S3 bucket.
Select a Customer Managed Key (CMK) in AWS KMS and configure a cross-account key policy.
AWS-managed keys (like aws/s3) do not support policy modification and cannot be shared across accounts. A CMK allows explicitly granting decrypt/encrypt permissions to the primary account.
3
Select the session caching layer that supports low latency and multi-AZ replication.
Amazon ElastiCache for Redis with Multi-AZ is selected.
ElastiCache for Redis supports replication, data persistence, and automatic failover across Availability Zones to prevent session loss, whereas Memcached does not support replication.

Key Concept

Selecting and integrating appropriate AWS database, cache, and storage services under strict high-availability, scaling, and cross-account security constraints.
Estimated Time:2m 0s
Question 73Question →

A company is modernizing a legacy financial ledger processing application. The application must receive ledger transaction payloads from an on-premises network over an AWS Direct Connect connection and process them using a private serverless backend on AWS. The solutions architect designs the backend using Amazon API Gateway and AWS Lambda. The Lambda functions must store processed transactions in an Amazon Aurora PostgreSQL database. The backend must be completely isolated from the public internet, and access to the API must be restricted to authorized internal corporate applications. Which TWO configurations should the solutions architect implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure a private API Gateway with an interface VPC endpoint in the VPC, and apply an API Gateway resource policy that restricts access to the VPC endpoint ID.; Configure the Lambda functions to run within the private subnets of the VPC, and establish connection pooling by deploying an Amazon RDS Proxy between the Lambda functions and the Aurora PostgreSQL database.

Answer

Configure a private API Gateway with an interface VPC endpoint in the VPC, and apply an API Gateway resource policy that restricts access to the VPC endpoint ID. Additionally, configure the Lambda functions to run within the private subnets of the VPC, and establish connection pooling by deploying an Amazon RDS Proxy between the Lambda functions and the Aurora PostgreSQL database.
The correct options configure a secure, private, and resilient path. By utilizing a private API Gateway with an interface VPC endpoint and an API Gateway resource policy, incoming API requests are isolated from the public internet. Deploying AWS Lambda in the private subnets of the VPC allows secure connectivity to Aurora PostgreSQL, while Amazon RDS Proxy manages database connection pooling to handle serverless scale without exhausting database connections.

Step-by-Step Solution

1
Establish private and authorized API endpoints.
Deploy Amazon API Gateway as a private API, configure an interface VPC endpoint, and attach a resource policy restricting access to the VPC endpoint.
This prevents public internet access to the API and secures traffic from on-premises clients crossing the Direct Connect path.
2
Integrate compute into the private network.
Configure the AWS Lambda functions with VPC execution roles and map them to private subnets.
This allows the functions to securely access database resources inside the private VPC without crossing the public internet.
3
Manage database connection pressure.
Deploy an Amazon RDS Proxy in the VPC between the Lambda functions and the Aurora PostgreSQL database.
Lambda functions scale rapidly and open many concurrent connections. RDS Proxy pools these connections, protecting the database from resource exhaustion.

Key Concept

Building secure, private, and highly scalable serverless architectures using API Gateway Private APIs, VPC-integrated Lambda functions, and RDS Proxy connection pooling.
Question 74Question →

Aria BioPharma is designing a secure compliance monitoring platform. In the Shared Services account (Account 111111111111111111111111), a build pipeline generates custom Amazon Machine Images (AMIs) containing proprietary security auditing software. The root EBS volumes of these AMIs are encrypted using an AWS KMS Customer Managed Key (CMK) located in the Shared Services account. To deploy these AMIs, the solutions architect must configure an Auto Scaling group in the Production account (Account 222222222222222222222222) to launch EC2 instances from the shared AMIs. Which of the following configurations will allow the Auto Scaling group in the Production account to successfully launch the instances while maintaining the principle of least privilege?

Show answer & explanation

Answer: Share the custom AMI with Account 222222222222222222222222. In Account 111111111111111111111111, modify the KMS key policy to grant the Auto Scaling service-linked role in Account 222222222222222222222222 (arn:aws:iam::222222222222:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling) permissions to kms:Decrypt, kms:DescribeKey, and kms:CreateGrant.

Answer

Sharing the custom AMI with the Production account and modifying the KMS key policy in the Shared Services account to grant the Production account's Auto Scaling service-linked role kms:Decrypt, kms:DescribeKey, and kms:CreateGrant permissions.
To deploy an instance from an encrypted AMI in another account using an Auto Scaling group, the source account must share the AMI and update its Customer Managed Key (CMK) policy. The key policy must grant the target account's Auto Scaling service-linked role (AWSServiceRoleForAutoScaling) the kms:Decrypt, kms:DescribeKey, and kms:CreateGrant permissions. The kms:CreateGrant permission is critical because it allows Auto Scaling to create a grant on the key, delegating decryption permissions to the Amazon EC2 service which mounts the volume.

Step-by-Step Solution

1
Share the custom AMI from the Shared Services account with the Production account.
The Production account gains access to reference the shared AMI in its launch templates or launch configurations.
AMI sharing makes the AMI metadata and snapshot permissions available to the target account.
2
Add the Auto Scaling service-linked role of the Production account as a principal in the key policy of the Customer Managed Key (CMK) in the Shared Services account.
The external service-linked role is trusted to use the CMK.
For cross-account access to KMS keys, the key policy in the owning account must explicitly allow the external principal.
3
Grant the service-linked role permissions for kms:Decrypt, kms:DescribeKey, and kms:CreateGrant.
The Auto Scaling service-linked role can decrypt the encrypted volume and delegate the decryption to the EC2 service.
Auto Scaling uses cryptographic grants to delegate decryption rights to the EC2 service for attaching and mounting the EBS root volume.

Key Concept

Cross-account KMS Customer Managed Key sharing with service-linked roles for encrypted AMI deployments.
Estimated Time:2m 30s
Question 75Question →

An automotive company is modernizing its vehicle telematics ingestion pipeline by migrating a legacy on-premises system to AWS. The new architecture must ingest telemetry payloads from over 100,000100,000 active vehicles, resulting in sudden traffic bursts of up to 10,00010,000 requests per second. The telemetry data must be processed and stored in an Amazon Aurora PostgreSQL database cluster deployed in a private subnet. Additionally, the processing components must securely perform outbound API calls to an external third-party service for real-time fleet health checks, and this outbound path must be highly available. The modernization must ensure that the database is protected from connection exhaustion, that telemetry data is not dropped during traffic bursts, and that the ingestion workload does not exhaust the regional AWS Lambda concurrency pool of the AWS account.

Which architectural design meets these requirements while maximizing reliability and performance efficiency?

Show answer & explanation

Answer: Configure Amazon API Gateway with an AWS service integration to publish incoming telemetry payloads directly to an Amazon SQS queue. Configure the Lambda function to be triggered by the SQS queue, and set the maximum concurrency on the SQS event source mapping to limit the number of concurrent executions. Deploy the Lambda function in private subnets across multiple Availability Zones, routing outbound internet traffic through a dedicated NAT Gateway in each Availability Zone. Configure the Lambda function to connect to the Aurora PostgreSQL database through an Amazon RDS Proxy.

Answer

Configure Amazon API Gateway with an AWS service integration to publish incoming telemetry payloads directly to an Amazon SQS queue. Configure the Lambda function to be triggered by the SQS queue, and set the maximum concurrency on the SQS event source mapping to limit the number of concurrent executions. Deploy the Lambda function in private subnets across multiple Availability Zones, routing outbound internet traffic through a dedicated NAT Gateway in each Availability Zone. Configure the Lambda function to connect to the Aurora PostgreSQL database through an Amazon RDS Proxy.
The correct design uses Amazon API Gateway to buffer bursts of telemetry traffic by integrating directly with Amazon SQS. SQS decouples the ingestion layer from the processing layer, preventing any data loss during spikes. Limiting the maximum concurrency on the SQS event source mapping ensures that the Lambda function does not consume the account's entire concurrency pool. Deploying the Lambda function in private subnets across multiple Availability Zones with dedicated NAT Gateways in each Availability Zone provides high availability for the outbound calls. Finally, Amazon RDS Proxy pools database connections, preventing Lambda from exhausting the Aurora PostgreSQL cluster's connections.

Step-by-Step Solution

1
Analyze ingestion buffer requirements to handle traffic bursts.
Using API Gateway with a direct AWS service integration to Amazon SQS buffers incoming payloads, preventing 429429 throttles or dropped data from vehicles.
Vehicle telemetry bursts of up to 10,00010,000 requests per second require an asynchronous message queue to absorb traffic spikes without scaling the compute layer instantaneously or dropping requests.
2
Examine account concurrency protection.
Setting the maximum concurrency on the SQS-to-Lambda event source mapping limits concurrent Lambda executions.
This protects the account's regional concurrency pool (1,0001,000 executions by default) from exhaustion by the telemetry workload, ensuring other serverless applications in the same account remain functional.
3
Address database connection scaling.
Introduce Amazon RDS Proxy between the Lambda function and the private Aurora PostgreSQL cluster.
Aurora PostgreSQL uses a process-per-connection model. Under heavy Lambda concurrency, direct connections will exhaust database resources. RDS Proxy pools and reuses database connections to maintain performance.
4
Design highly available outbound network path.
Deploy the Lambda function in private subnets spanning multiple Availability Zones and route internet traffic through a NAT Gateway in each Availability Zone.
Outbound calls to the third-party fleet health API must be highly available. A single NAT Gateway is a single point of failure, so multiple NAT Gateways are required.

Key Concept

Decoupling bursty serverless workloads using SQS, managing Lambda concurrency boundaries, and optimizing database connections with RDS Proxy in a high-availability VPC design.
Question 76Question →

A scientific research organization is designing a data archiving system on AWS to store telemetry data from meteorological sensors. The architecture requires storing files in an Amazon S3 bucket within a shared Logging and Archival account under AWS Organizations. The ingestion workloads run in a separate Ingest account. The organization's security policy requires that all archived data must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS, and the Ingest account must not have permission to decrypt the archived data once it is written. The security team needs to configure the cross-account access securely while adhering to the principle of least privilege. Which combination of configurations will meet these requirements?

Show answer & explanation

Answer: Create a Customer Managed Key (CMK) in the Archival account. In the CMK key policy, grant the Ingest account's IAM role permissions for the kms:GenerateDataKey and kms:DescribeKey actions. In the Ingest account, configure the IAM role policy to allow s3:PutObject on the Archival S3 bucket and kms:GenerateDataKey on the CMK. In the Archival account, configure the S3 bucket policy to allow s3:PutObject from the Ingest account's IAM role.

Answer

Create a Customer Managed Key (CMK) in the Archival account, grant the Ingest account's IAM role permissions for kms:GenerateDataKey and kms:DescribeKey in the key policy, and configure the Ingest account's IAM policy and the Archival S3 bucket policy to allow the s3:PutObject action.
The correct configuration uses a Customer Managed Key (CMK) in the Archival account, which allows key policy modification. By granting the Ingest account's IAM role the permissions for kms:GenerateDataKey and kms:DescribeKey, the ingestion workload can encrypt data during S3 uploads without having the ability to decrypt the data. This satisfies the least privilege requirement. Additionally, granting s3:PutObject permissions in both the Ingest account's IAM policy and the Archival account's S3 bucket policy completes the cross-account access delegation.

Step-by-Step Solution

1
Select the correct KMS key type for cross-account access.
A Customer Managed Key (CMK) must be used instead of an AWS-managed key, because AWS-managed keys cannot be shared cross-account.
AWS-managed keys (aws/s3) do not support key policy modifications, preventing cross-account delegation.
2
Configure the key policy for the Customer Managed Key (CMK) in the Archival account.
The key policy must explicitly grant the Ingest account's IAM role access to kms:GenerateDataKey and kms:DescribeKey.
For cross-account operations, IAM policies in the source account cannot grant access to the key unless the key policy in the target account delegates that authority to the source account.
3
Ensure the principle of least privilege is followed regarding decryption.
Exclude the kms:Decrypt permission from the Ingest account's IAM policy and the KMS key policy.
The Ingest account only needs to write and encrypt objects, which requires kms:GenerateDataKey and kms:DescribeKey. Excluding kms:Decrypt ensures it cannot read or decrypt the archived data.
4
Configure S3 access permissions.
Add s3:PutObject permissions to the Ingest account's IAM policy and allow the Ingest account's IAM role to perform s3:PutObject in the Archival account's S3 bucket policy.
Cross-account S3 operations require permission in both the caller's IAM policy and the destination bucket's S3 bucket policy.

Key Concept

Cross-account resource access with KMS encryption requires explicit authorization in the KMS key policy, the S3 bucket policy, and the caller's IAM policy, utilizing Customer Managed Keys (CMKs) to support cross-account delegation under the principle of least privilege.
Question 77Question →

An enterprise is designing the database and storage strategy for a new containerized web application deployed on AWS across multiple Availability Zones. The application has the following architecture requirements:

* A shared file storage system to store user-uploaded media files. The storage must support standard POSIX file system permissions and allow concurrent read and write access from Linux containers running in multiple Availability Zones.
* A database tier that handles high-volume OLTP transactions, scales read operations horizontally with minimum replication lag, and supports automatic failover with low RTO.

Which two database and storage configurations should the solutions architect choose to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Elastic File System (Amazon EFS) to provide shared, elastic file storage accessible concurrently by Linux containers across multiple Availability Zones.; Amazon Aurora MySQL with Auto Scaling for Aurora Replicas to scale read queries horizontally and provide low-latency failover.

Answer

The correct configurations are using Amazon Elastic File System (Amazon EFS) to provide shared, POSIX-compliant file storage across multiple Availability Zones, and using Amazon Aurora MySQL with Auto Scaling for Aurora Replicas to scale read queries horizontally with low latency and support automatic failover.
The correct configurations are Amazon Elastic File System (Amazon EFS) and Amazon Aurora MySQL with Auto Scaling for Aurora Replicas. Amazon EFS natively supports the NFSv4 protocol and standard POSIX permissions, enabling concurrent read and write access for Linux containers across multiple Availability Zones. Amazon Aurora MySQL provides horizontal read scaling with low replication lag using Aurora Replicas and supports rapid automatic failover, meeting the database tier requirements.

Step-by-Step Solution

1
Identify the shared storage requirements.
Amazon EFS is selected because it supports the NFSv4 protocol, POSIX file permissions, and concurrent read/write access from Linux containers across multiple Availability Zones.
Linux containers require a shared filesystem that respects standard file permissions and allows simultaneous writes.
2
Evaluate the database tier requirements.
Amazon Aurora MySQL with Aurora Replicas and Auto Scaling is chosen.
Aurora Replicas provide horizontal read scaling with low replication lag (usually sub-100ms) and serve as rapid failover targets to minimize RTO.
3
Analyze and eliminate incorrect options.
RDS Multi-AZ standbys cannot serve read traffic; pilot light patterns do not achieve near-zero RTO/RPO; and AWS-managed KMS keys cannot be shared cross-account.
Ensures that constraints around read scaling, recovery objectives, and encryption key sharing are not violated.

Key Concept

Selecting appropriate AWS storage and database services based on protocol support (POSIX/NFS), read scaling capability, replication behavior, and access delegation constraints.
Question 78Question →

An e-commerce company, VeloCart Solutions, is designing a secure logging architecture. The application tier runs on Amazon EC2 instances in a Production account. These instances assume an IAM role to write transactional logs containing sensitive customer data. The company requires these logs to be stored in an Amazon S3 bucket in a central Logging account. The logs must be encrypted at rest using a Customer Managed Key (CMK) managed within the Logging account. Which TWO actions must the solutions architect take to ensure the application tier can successfully write the encrypted logs to the central S3 bucket? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the Logging account, configure the S3 bucket policy to grant the Production account's IAM role permission to perform the s3:PutObject action.; In the Logging account, modify the key policy of the Customer Managed Key to grant the Production account's IAM role permission to perform the kms:GenerateDataKey and kms:Decrypt actions.

Answer

The solutions architect must configure the S3 bucket policy in the Logging account to grant the Production account's IAM role permission to perform the s3:PutObject action, and modify the KMS key policy in the Logging account to allow the Production account's IAM role to perform the kms:GenerateDataKey and kms:Decrypt actions.
Establishing cross-account write capabilities to an encrypted S3 bucket requires resource policies in the destination account to explicitly authorize the source account's IAM principal. The S3 bucket policy must allow the s3:PutObject action, and the KMS key policy of the Customer Managed Key must allow the kms:GenerateDataKey and kms:Decrypt actions so the application can encrypt objects.

Step-by-Step Solution

1
Configure the S3 bucket policy in the Logging account.
The Production account's IAM role is granted explicit cross-account write permissions (s3:PutObject) on the central logging bucket.
By default, cross-account access is denied. The target bucket's resource policy must explicitly trust the external IAM identity.
2
Configure the KMS Customer Managed Key policy in the Logging account.
The Production account's IAM role is granted the permissions to generate a data key and decrypt using the KMS key.
When writing to an S3 bucket encrypted with a Customer Managed Key, the writing principal must have permissions to interact with the KMS key to encrypt the payload.

Key Concept

Cross-account security control design for S3 and KMS encryption
Estimated Time:2m 0s
Question 79Question →

A media company is planning the launch of a new subscription-based video streaming service. During a major live sporting event broadcast, a promotional code will be displayed on screen. The company expects the traffic to the subscription registration endpoint to instantly spike from a baseline of 100100 requests per second (RPS) to over 150,000150,000 RPS within a 3030-second window. The registration application is hosted on a fleet of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB), and it queries an Amazon Aurora PostgreSQL database for promotion eligibility checks. Which design should a solutions architect implement to ensure the architecture scales to meet this peak demand without dropping requests or experiencing latency degradation?

Show answer & explanation

Answer: Submit a support ticket to AWS to pre-warm the Application Load Balancer to the target throughput of 150,000150,000 requests per second. Configure a scheduled scaling policy for the EC2 Auto Scaling group to launch the required number of instances 3030 minutes before the promotional broadcast. Deploy Amazon Aurora Replicas and configure Aurora Auto Scaling based on reader average CPU utilization to scale the database tier.

Answer

The architecture must use a pre-warmed Application Load Balancer, a scheduled scaling policy for EC2, and Aurora Replicas with Aurora Auto Scaling.
The correct design resolves all scaling bottlenecks. For a massive, near-instantaneous traffic spike (100100 to 150,000150,000 RPS), an Application Load Balancer requires pre-warming to avoid dropping connection requests. An EC2 Auto Scaling group cannot scale out fast enough using dynamic scaling policies due to instance launch and bootstrapping times, so a scheduled scaling policy must be configured to provision capacity before the event. Amazon Aurora Replicas with Aurora Auto Scaling successfully distribute the read load horizontally.

Step-by-Step Solution

1
Analyze the load profile and load balancer scaling limitations.
The traffic spikes from 100100 to 150,000150,000 RPS in 3030 seconds. Because this rate of increase exceeds the default scaling rate of an Application Load Balancer, the architect must request ALB pre-warming from AWS Support.
Prevents connection timeouts and dropped packets at the load balancer entry point during the sudden traffic spike.
2
Address backend compute scaling delays.
EC2 instance boot times and application bootstrapping typically take several minutes, meaning dynamic reactive scaling policies (like target tracking or step scaling) will react too slowly, causing service degradation. The architect must configure a scheduled scaling policy to pre-provision EC2 instances 3030 minutes before the event.
Ensures sufficient backend compute capacity is fully active and ready to process requests before the promotional code is broadcast.
3
Optimize the database read tier for increased query volumes.
The promotion eligibility queries are read-heavy. The architect must deploy Aurora Replicas and configure Aurora Auto Scaling based on reader average CPU utilization.
Allows the database to scale read capacity horizontally to handle the influx of queries without overloading the primary writer instance.

Key Concept

Handling flash traffic spikes by combining load balancer pre-warming, scheduled instance scaling, and database read replica auto-scaling.
Question 80Question →

A retail company is launching a new flash sale platform that expects an immediate and massive surge in traffic, going from 00 to 500,000500,000 concurrent requests per second within less than 2 minutes. The architecture consists of a public-facing Application Load Balancer (ALB), an Amazon ECS cluster on AWS Fargate for the web tier, and an Amazon Aurora PostgreSQL database cluster for the transactional backend. The application profile is highly read-intensive during the sale. Which two options should a Solutions Architect recommend to optimize the performance and scalability of the platform under this sudden load?

Select all that apply

Show answer & explanation

Answer: Request AWS Support to pre-warm the Application Load Balancer (ALB) to handle the anticipated surge of 500,000500,000 requests per second, and configure scheduled scaling for the Amazon ECS tasks to scale out prior to the start of the event.; Add Aurora Replicas to the Amazon Aurora PostgreSQL database cluster, configure Aurora Auto Scaling to scale the reader nodes dynamically, and configure the application to direct read queries to the Aurora reader endpoint.

Answer

Request AWS Support to pre-warm the Application Load Balancer (ALB) with scheduled scaling for the ECS tasks, and deploy Aurora Replicas using Aurora Auto Scaling with read queries directed to the reader endpoint.
To survive an instantaneous surge in traffic, the entry point must be pre-warmed to ensure AWS has pre-provisioned sufficient ALB capacity. Correspondingly, Scheduled Auto Scaling must be used to ensure the ECS tasks are ready before the traffic starts. Database read scalability must be solved by routing queries to the Aurora reader endpoint, which distributes connections among dynamically scaled Aurora Replicas.

Step-by-Step Solution

1
Analyze the load balancing tier scalability limits under instant flash traffic.
Identify that a sudden surge to 500,000500,000 requests per second in 2 minutes exceeds the default automatic scaling rate of an ALB.
Requesting ALB pre-warming from AWS Support is required to prevent packet loss, and scheduled scaling ensures ECS tasks are running before the spike occurs.
2
Evaluate the database tier capability for read-intensive workloads.
Determine that scaling database reads requires horizontal replicas and load-balanced reader connections.
Aurora PostgreSQL Replicas with Auto Scaling and the reader endpoint satisfy high-throughput read demands, whereas Multi-AZ standbys cannot serve read traffic.

Key Concept

Architectures facing sudden, massive flash traffic must pre-allocate capacity at the load balancing and compute layers (pre-warming and scheduled scaling) and leverage horizontal scaling replica architectures at the database tier.
PreviousPage 4 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin