All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A global software-as-a-service (SaaS) provider operates a multi-account environment within AWS Organizations consisting of $80$ member accounts. The security compliance mandate requires that all AWS CloudTrail management events across all accounts and Regions be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. Security analysts in the Security account must be able to review these logs, but member accounts must have no access to read or modify them. The solution must minimize operational overhead, prevent member accounts from disabling the logging configuration, and ensure log integrity. Which TWO configuration steps must the Solutions Architect implement to meet these requirements?

Select all that apply

Create an organization trail in the Organizations management account that targets the S3 bucket in the Security account. Configure a bucket policy on the Security S3 bucket that grants 's3:PutObject' and 's3:GetBucketLocation' permissions to the CloudTrail service principal, restricted by a condition matching the AWS Organization ID.

Create a Customer Managed Key (CMK) in the Security account. Configure its key policy to grant 'kms:GenerateDataKey*' and 'kms:DescribeKey' permissions to the CloudTrail service principal, restricted by a condition matching the organization trail ARN, and grant 'kms:Decrypt' permissions to the Security account analysts' role.

Configure S3 default encryption on the Security S3 bucket using the AWS-managed key 'aws/s3', and apply a Service Control Policy (SCP) at the Organization root that grants member accounts permissions to write to this key.

Configure the S3 bucket policy in the Security account to grant write access to the IAM roles of all administrators in the member accounts, and require each member account to manually configure a trail pointing to the Security account S3 bucket.

Deploy a Service Control Policy (SCP) at the root of the AWS Organization that permits the 's3:PutObject' action on the Security account's S3 bucket, and configure the member accounts' local trails to encrypt logs using the default AWS-managed KMS key 'aws/cloudtrail'.

Show answer & explanation

Answer: Create an organization trail in the Organizations management account that targets the S3 bucket in the Security account. Configure a bucket policy on the Security S3 bucket that grants 's3:PutObject' and 's3:GetBucketLocation' permissions to the CloudTrail service principal, restricted by a condition matching the AWS Organization ID.; Create a Customer Managed Key (CMK) in the Security account. Configure its key policy to grant 'kms:GenerateDataKey*' and 'kms:DescribeKey' permissions to the CloudTrail service principal, restricted by a condition matching the organization trail ARN, and grant 'kms:Decrypt' permissions to the Security account analysts' role.

Answer

Create an organization trail in the Organizations management account targeting the Security account S3 bucket, with a bucket policy permitting the CloudTrail service principal under the organization ID condition. Additionally, create a Customer Managed Key (CMK) in the Security account with a key policy allowing the CloudTrail service principal to generate data keys and describe the key, and allowing the analysts' role to decrypt.

The correct solution involves creating an organization trail in the management account to automatically aggregate logs across all accounts and Regions, coupled with a bucket policy in the Security account that allows the CloudTrail service principal to deliver logs using the organization ID condition. Additionally, a Customer Managed Key (CMK) must be created in the Security account with a key policy that allows the CloudTrail service principal to perform data key generation and key description, restricted to the trail's ARN, while granting decrypt permissions to the security analysts' IAM role.

Step-by-Step Solution

Configure the S3 bucket in the Security account with a bucket policy allowing the CloudTrail service principal to write objects.

The bucket policy allows 's3:PutObject' and 's3:GetBucketLocation' for 'cloudtrail.amazonaws.com' under the condition 'aws:PrincipalOrgID' matching the organization's ID.

This enables secure log delivery from any account within the organization to the central S3 bucket.

Create a Customer Managed Key (CMK) in the Security account and configure its key policy.

The CMK key policy allows 'kms:GenerateDataKey*' and 'kms:DescribeKey' for 'cloudtrail.amazonaws.com', constrained by the trail's source ARN, and allows 'kms:Decrypt' for the security analysts.

CloudTrail requires these permissions on the customer managed key to perform envelope encryption across the organization's accounts, and analysts need decrypt permissions to view the logs.

Create the Organization Trail in the management account pointing to the Security account S3 bucket and KMS CMK.

The trail automatically deploys across all member accounts and Regions, sending logs to the central bucket and encrypting them with the CMK.

This guarantees uniform logging coverage, reduces management overhead, and prevents member account admins from altering or disabling the trail.

Key Concept

Centralized multi-account logging with cross-account KMS encryption and S3 bucket policies using organization constraints.

Question 782Question →

A retail company uses AWS Organizations to manage a multi-account environment consisting of a Management account, a Core Network account, and multiple business unit accounts grouped into Production, Development, and Sandbox Organizational Units (OUs). A central networking team has created a shared VPC in the Core Network account. The finance team has purchased Compute Savings Plans in the Management account to reduce overall compute costs.

The company's solutions architect must design a solution that meets the following requirements:
* The subnets in the shared VPC must be accessible only to the Production and Development accounts, with auto-acceptance of shared resources enabled.
* The Compute Savings Plan discounts must apply to all Production and Development accounts, but must not apply to workloads in the Sandbox accounts.

Which combination of actions should the solutions architect take to satisfy these requirements?

Enable resource sharing within the AWS Organization in the AWS Resource Access Manager (RAM) settings. In the Core Network account, create a resource share in AWS RAM for the VPC subnets, and associate the share with the Production and Development OUs. In the Management account, navigate to the Billing preferences and disable Savings Plans discount sharing for the Sandbox accounts.

In the Core Network account, use AWS RAM to share the VPC subnets with the Production and Development OUs. In the Management account, create a Service Control Policy (SCP) that denies the savingsplans:ApplyDiscount action, and attach this SCP to the Sandbox OU to prevent Sandbox workloads from utilizing the Compute Savings Plans.

In the Core Network account, create an AWS RAM resource share for the VPC subnets, and add the individual account IDs for all Production and Development accounts to the share. In each recipient account, manually accept the RAM resource share invitation. In the Management account, configure a billing policy that excludes Sandbox accounts from the consolidated billing family.

Enable resource sharing within the AWS Organization in the AWS RAM settings. In the Core Network account, share the VPC subnets with the Production and Development OUs. Enable default EBS volume encryption in the Core Network account using the AWS-managed KMS key (aws/ebs), share this key with the member accounts via AWS RAM, and disable Savings Plans discount sharing for the Sandbox accounts in Billing preferences.

Show answer & explanation

Answer: Enable resource sharing within the AWS Organization in the AWS Resource Access Manager (RAM) settings. In the Core Network account, create a resource share in AWS RAM for the VPC subnets, and associate the share with the Production and Development OUs. In the Management account, navigate to the Billing preferences and disable Savings Plans discount sharing for the Sandbox accounts.

Answer

The strategy that enables sharing within the AWS Organization in AWS RAM, shares the VPC subnets with the Production and Development OUs, and disables Savings Plans discount sharing for the Sandbox accounts in the Management account's Billing preferences.

The correct solution involves enabling AWS Organization sharing within AWS RAM, which allows resources shared with OUs to be accepted automatically. The subnets are then shared with the Production and Development OUs. Additionally, to exclude Sandbox accounts from the Compute Savings Plans benefits, the Solutions Architect must disable discount sharing for those accounts under the Billing preferences in the Management account.

Step-by-Step Solution

Enable Organization Sharing in AWS RAM

Allows resources shared within the Organization to be automatically accepted by member accounts without manual invitation handling.

This satisfies the requirement for auto-acceptance of shared subnets.

Create and Associate the Resource Share in AWS RAM

The subnets are shared specifically with the Production and Development OUs.

This restricts access to only the authorized OUs while leaving the Sandbox accounts excluded from the VPC sharing.

Configure Savings Plans sharing in the Management account's Billing preferences

Deactivates Savings Plans discount sharing for the specific account IDs belonging to the Sandbox OU.

This prevents workloads in the Sandbox accounts from applying and consuming the centralized Compute Savings Plans discounts.

Key Concept

Multi-account resource sharing and selective discount allocation within AWS Organizations

Estimated Time:2m 0s

Question 783Question →

A company is launching a global online ticket booking platform. The architecture consists of an Application Load Balancer (ALB) routing requests to an Amazon Elastic Container Service (Amazon ECS) cluster running on AWS Fargate. The application stores ticket availability and booking details in an Amazon Aurora PostgreSQL database. During major ticket release events, traffic is expected to scale instantly from a baseline of $1,000$ requests per second to a peak of $150,000$ requests per second. During testing, the rapid surge in traffic caused the ALB to return HTTP 503 Service Unavailable errors. Additionally, the primary database instance suffered from high CPU utilization due to a massive volume of read-only queries from users searching for available seats. The solutions architect must optimize the platform's performance and scalability to handle the flash traffic without dropping requests or degrading the user experience. Which two recommendations should the Solutions Architect make to scale the platform and prevent performance degradation?

Select all that apply

Request AWS Support to pre-warm the Application Load Balancer to the expected capacity prior to the ticket release events, to prevent dropped connections from the instantaneous traffic burst.

Deploy Amazon Aurora Replicas in multiple Availability Zones and configure Aurora Auto Scaling to dynamically scale the read capacity based on reader CPU utilization.

Rely on the Application Load Balancer's automatic scaling policies to scale out in response to the traffic surge, as pre-warming is handled natively without prior request.

Configure the application to route search queries to the Amazon RDS Multi-AZ standby instance to offload the primary database instance and scale query capacity.

Deploy an Amazon ElastiCache for Memcached cluster to cache search results and replicate session state with multi-AZ persistence.

Show answer & explanation

Answer: Request AWS Support to pre-warm the Application Load Balancer to the expected capacity prior to the ticket release events, to prevent dropped connections from the instantaneous traffic burst.; Deploy Amazon Aurora Replicas in multiple Availability Zones and configure Aurora Auto Scaling to dynamically scale the read capacity based on reader CPU utilization.

Answer

The correct recommendations are to request AWS Support to pre-warm the Application Load Balancer to the expected capacity, and to deploy Amazon Aurora Replicas with Aurora Auto Scaling to handle the read query spikes.

Requesting AWS Support to pre-warm the Application Load Balancer ensures that it is provisioned with sufficient capacity to handle the immediate burst to 150,000 requests per second without dropping connections. Deploying Aurora Replicas and configuring Aurora Auto Scaling allows the platform to dynamically scale the read capacity in response to the spike in search queries, preventing CPU exhaustion on the primary writer node.

Step-by-Step Solution

Analyze the load balancer performance characteristics under flash traffic.

Determine that the ALB needs to be pre-warmed to prevent HTTP 503 errors from sudden traffic bursts.

Standard ALB auto-scaling takes time to respond to traffic spikes, making pre-warming necessary for instant spikes.

Evaluate the database layer to address high CPU usage caused by read-only queries.

Identify that horizontal scaling of the database reads using Aurora Replicas is required.

Aurora Replicas allow read workloads to be distributed across multiple reader nodes, which can scale dynamically using Aurora Auto Scaling.

Key Concept

Handling flash traffic through ELB pre-warming and database read replica auto-scaling.

Question 784Question →

A multi-national enterprise manages its workloads across multiple AWS accounts organized under AWS Organizations. The company has established SAML 2.0 federation with Okta to allow database administrators to log in and manage resources in a dedicated database account. The administrators must assume an IAM role named `DBAdminRole` in the database account.

To enforce compliance, the security team attached a Service Control Policy (SCP) to the database account's Organizational Unit (OU) that explicitly allows only Amazon RDS and Amazon DynamoDB actions, while denying all other services. To minimize administrative overhead within the database account, the team created the `DBAdminRole` without any inline or managed IAM identity-based policies, assuming the OU-level SCP would grant the necessary database permissions to the federated role.

During testing, database administrators are unable to access any resources after authenticating through Okta. Additionally, logs show that some administrators cannot assume the role at all because the role's trust policy is configured with `sts:AssumeRole` instead of `sts:AssumeRoleWithSAML`.

Which combination of actions will resolve these issues and allow the database administrators to perform their duties?

Update the trust policy of `DBAdminRole` in the database account to use the `sts:AssumeRole` action with the Okta SAML provider as the principal, and attach an IAM identity-based policy to `DBAdminRole` that explicitly grants the required RDS and DynamoDB permissions.

Update the trust policy of `DBAdminRole` in the database account to use the `sts:AssumeRoleWithSAML` action with the Okta SAML provider as the federated principal, and modify the SCP at the OU level to include an Allow statement that explicitly grants database access to the federated role principal without attaching local IAM policies.

Update the trust policy of `DBAdminRole` in the database account to use the `sts:AssumeRoleWithSAML` action with the Okta SAML provider as the federated principal, and attach an IAM identity-based policy to `DBAdminRole` that explicitly grants the required RDS and DynamoDB permissions.

Update the trust policy of `DBAdminRole` in the database account to use the `sts:AssumeRoleWithWebIdentity` action with the Okta SAML provider as the principal, and modify the database account's default IAM settings to allow SCP permissions to inherit directly to all roles that have a trust relationship with external providers.

Show answer & explanation

Answer: Update the trust policy of `DBAdminRole` in the database account to use the `sts:AssumeRoleWithSAML` action with the Okta SAML provider as the federated principal, and attach an IAM identity-based policy to `DBAdminRole` that explicitly grants the required RDS and DynamoDB permissions.

Answer

Update the trust policy of the role to use the `sts:AssumeRoleWithSAML` action with the Okta SAML provider as the federated principal, and attach an IAM identity-based policy to the role that explicitly grants the required RDS and DynamoDB permissions.

The correct solution resolves the federation failure by updating the role's trust policy to use `sts:AssumeRoleWithSAML`, which is the correct action for SAML 2.0 federation. It also resolves the access denied errors by attaching a local identity-based policy to the role. Because Service Control Policies (SCPs) serve only as filters (defining the maximum boundary of what is allowed) and do not grant permissions directly, the federated role must have its own IAM policy to permit database operations.

Step-by-Step Solution

Verify and correct the IAM role trust policy for SAML 2.0 federation.

The trust policy must use the `sts:AssumeRoleWithSAML` action and set the Okta SAML provider ARN as the federated principal.

SAML-based federation requires the specific AWS Security Token Service (STS) action `sts:AssumeRoleWithSAML` to process SAML assertions. The standard `sts:AssumeRole` action only supports cross-account or service assumptions.

Configure the local IAM permissions for the federated role.

Attach an identity-based IAM policy to the local role in the member account that explicitly grants RDS and DynamoDB permissions.

Service Control Policies (SCPs) in AWS Organizations do not grant permissions; they only act as a maximum permission filter. A local IAM policy is required to actually grant the permissions.

Key Concept

Interaction between SAML 2.0 trust policies and AWS Organizations Service Control Policies (SCPs).

Question 785Question →

A global logistics provider manages its multi-account environment using AWS Organizations. The environment contains a Development OU, a Production OU, and a Security OU. The security team wants to establish a governance policy that prevents developers, including root users in the member accounts under the Development OU, from disabling AWS CloudTrail or modifying its configurations. Additionally, the team needs to enable AWS GuardDuty across all current and future member accounts, with administration centralized in the Security OU account. Which approach meets these governance requirements with the least administrative overhead?

Attach a Service Control Policy (SCP) to the Development OU that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions. In the AWS Organizations management account, register the Security OU account as the delegated administrator for AWS GuardDuty. From the GuardDuty console in the Security OU account, enable GuardDuty for all current and future member accounts within the organization.

Attach a Service Control Policy (SCP) to the Development OU that permits cloudtrail:StartLogging and explicitly denies all other CloudTrail actions, assuming this SCP grants permissions to the developers without requiring local IAM policies. Register the Security OU account as the delegated administrator for AWS GuardDuty from the organization management account.

Attach an IAM permissions boundary to all roles in the Development OU member accounts that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail. Share the GuardDuty detector from the Security OU account to all member accounts using AWS Resource Access Manager (RAM) to allow centralized security management.

Create a Customer Managed Key (CMK) in the Security OU account to encrypt CloudTrail logs. In each member account under the Development OU, create a local IAM role with a trust policy configured to allow the Security OU account's IAM roles to assume it and manage CloudTrail directly, without using SCPs. In the AWS Organizations management account, enable GuardDuty and configure it to replicate alerts to the Security OU account using a SAML 2.0 federated role trust relationship.

Show answer & explanation

Answer: Attach a Service Control Policy (SCP) to the Development OU that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions. In the AWS Organizations management account, register the Security OU account as the delegated administrator for AWS GuardDuty. From the GuardDuty console in the Security OU account, enable GuardDuty for all current and future member accounts within the organization.

Answer

The correct approach involves attaching a deny Service Control Policy (SCP) for CloudTrail modifications to the Development OU, and registering the Security OU account as the delegated administrator for AWS GuardDuty to enable it organization-wide.

The correct solution uses a Service Control Policy (SCP) to enforce an absolute guardrail that prevents any entity, including the root user, from modifying CloudTrail settings in the Development OU. Concurrently, it leverages AWS Organizations delegated administration for GuardDuty to automate security monitoring across the entire organization from a central security account, minimizing operational complexity.

Step-by-Step Solution

Identify the governance mechanism required to prevent any user (including root) from modifying AWS CloudTrail.

Determine that a Service Control Policy (SCP) attached at the Organizational Unit (OU) or account level is required, as local IAM policies and permissions boundaries can be bypassed by root users or local administrators.

SCPs act as guardrails that define the maximum available permissions for member accounts, overriding even local administrative privileges.

Identify the correct way to centralize security operations (like GuardDuty) across all member accounts with minimal overhead.

Determine that registering the Security OU account as the delegated administrator for AWS GuardDuty is the AWS-recommended approach.

Delegated administration allows the designated security account to manage the service, enable detectors, and aggregate findings organization-wide without requiring credentials in the management account.

Combine these governance actions into a single comprehensive solution and evaluate against the options.

The solution that combines attaching a deny-based SCP for CloudTrail modification to the Development OU and registering the Security OU account as the delegated administrator for GuardDuty is the correct path.

This satisfies all security constraints while maintaining operational efficiency and adhering to the AWS well-architected multi-account guidance.

Key Concept

Implementing Multi-Account Governance with SCP Guardrails and Delegated Service Administration

Estimated Time:2m 0s

Question 786Question →

A global sports streaming platform is launching a new interactive live-betting feature for an upcoming championship event. The platform expects an instantaneous surge in traffic, growing from a baseline of $1,000$ requests per second to over $600,000$ concurrent write-heavy API requests per second within a $2$ -minute window whenever a critical game event occurs. The backend architecture must process these bets with sub-10 millisecond database write latencies and support real-time read queries for live odds updates, which scale dynamically based on active viewers. The current design draft proposes using an Application Load Balancer (ALB) backed by an Amazon Auto Scaling group of Amazon EC2 instances, with Amazon Aurora PostgreSQL as the primary database.

Which architecture optimization strategy will meet these performance and scalability requirements with the least operational overhead?

Configure the Application Load Balancer (ALB) to rely on its default automatic scaling behaviors to absorb the traffic burst. Deploy an Amazon Aurora PostgreSQL DB cluster, configure Aurora Serverless v2 to automatically scale the writer node, and implement Aurora Auto Scaling to dynamically add read replicas to handle live odds query spikes.

Contact AWS Support to pre-warm the Application Load Balancer (ALB) for the target transaction volume. To manage database scaling, deploy a primary Amazon RDS for PostgreSQL DB instance with a Multi-AZ standby replica, and configure the application to route read queries for live odds directly to the standby replica.

Contact AWS Support to pre-warm the Application Load Balancer (ALB) for the anticipated traffic volume. Migrate the ingestion tier to Amazon DynamoDB with pre-split partitions and provisioned capacity to handle the write burst, and deploy Amazon DynamoDB Accelerator (DAX) to deliver sub-millisecond read latency for live odds.

Utilize Amazon Route 53 latency routing to distribute the traffic across multiple Application Load Balancers (ALBs) without pre-warming. Deploy Amazon Aurora PostgreSQL and configure an Amazon ElastiCache for Memcached cluster to act as a database cache, relying on the application to dynamically write updates to Memcached and database standby instances simultaneously.

Show answer & explanation

Answer: Contact AWS Support to pre-warm the Application Load Balancer (ALB) for the anticipated traffic volume. Migrate the ingestion tier to Amazon DynamoDB with pre-split partitions and provisioned capacity to handle the write burst, and deploy Amazon DynamoDB Accelerator (DAX) to deliver sub-millisecond read latency for live odds.

Answer

The correct architecture addresses both the load balancing and database scalability bottlenecks. Pre-warming the ALB ensures that AWS pre-configures the load balancer's capacity to handle the 600,000 requests per second immediately. Amazon DynamoDB scales horizontally, and with pre-split partitions and provisioned capacity, it can easily handle the 600,000 writes per second. Amazon DynamoDB Accelerator (DAX) handles the read-heavy live odds queries with sub-millisecond latencies, offloading the database.

Step-by-Step Solution

Analyze ingress scaling capabilities.

Identify that a sudden jump from

1,000

600,000

requests per second in 2 minutes is too fast for standard ALB scaling. AWS Support pre-warming is required to provision sufficient capacity in advance.

Default ALB scaling uses a gradual DNS and IP provisioning process that cannot react to instantaneous multi-hundred-thousand request spikes, causing HTTP 503 errors and dropped requests.

Evaluate database write scaling requirements.

Determine that relational databases (like Aurora PostgreSQL or RDS PostgreSQL) with a single writer cannot scale to support 600,000 concurrent writes/sec. Migrate the database tier to Amazon DynamoDB.

DynamoDB is a non-relational database designed for horizontal scalability. By pre-splitting partitions and provisioning the required write capacity units, it can handle virtually unlimited writes/sec.

Determine the optimal read cache strategy.

Select Amazon DynamoDB Accelerator (DAX) to cache the live odds read queries.

DAX is a fully managed, highly available in-memory cache for DynamoDB that delivers microsecond response times for read-heavy workloads at scale.

Key Concept

Handling extreme flash traffic spikes requires pre-warming the load balancing tier and utilizing horizontally scalable, non-relational database architectures with caching.

Estimated Time:3m 0s

Question 787Question →

An enterprise software provider is structuring its multi-account environment using AWS Organizations. The architecture consists of a Core Organizational Unit (OU) for shared services and a Deployments OU for application workloads. The security team must implement a governance strategy with the following requirements:

* Production and staging member accounts in the Deployments OU must be prevented from using any AWS services other than Amazon EC2, Amazon S3, and Amazon DynamoDB.
* A centrally managed IAM role named PlatformSecurityAuditor must be able to run configuration checks and access all AWS services across all member accounts in the Deployments OU.
* Member accounts must be strictly prevented from leaving the AWS Organization.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Apply a Service Control Policy (SCP) to the Deployments OU that blocks the organizations:LeaveOrganization action.

Apply a Service Control Policy (SCP) to the Deployments OU with a Deny effect, a NotAction block listing the approved services along with necessary IAM and STS actions, and a condition key of ArnNotEquals for aws:PrincipalARN that specifies the PlatformSecurityAuditor role ARN.

Apply a Service Control Policy (SCP) to the Deployments OU with an Allow effect that lists only the approved services, and rely on IAM policies in the member accounts to grant the PlatformSecurityAuditor role access to all services.

Create an IAM permissions boundary in each member account that restricts access to the approved services, and apply this boundary to all IAM identities, including the account root user, while exempting the PlatformSecurityAuditor role.

Apply a Service Control Policy (SCP) to the Deployments OU that denies the organizations:RemoveAccountFromOrganization action, and create an IAM policy for the PlatformSecurityAuditor role that permits all actions.

Show answer & explanation

Answer: Apply a Service Control Policy (SCP) to the Deployments OU that blocks the organizations:LeaveOrganization action.; Apply a Service Control Policy (SCP) to the Deployments OU with a Deny effect, a NotAction block listing the approved services along with necessary IAM and STS actions, and a condition key of ArnNotEquals for aws:PrincipalARN that specifies the PlatformSecurityAuditor role ARN.

Answer

Apply a Service Control Policy (SCP) to the Deployments OU that blocks the organizations:LeaveOrganization action, and apply a Service Control Policy (SCP) to the Deployments OU with a Deny effect, a NotAction block listing the approved services along with necessary IAM and STS actions, and a condition key of ArnNotEquals for aws:PrincipalARN that specifies the PlatformSecurityAuditor role ARN.

To meet all requirements, two SCPs must be applied to the Deployments OU. First, to prevent member accounts from leaving the AWS Organization, the organizations:LeaveOrganization action must be denied in an SCP. Second, to restrict service access while exempting the PlatformSecurityAuditor role, a Deny SCP with a NotAction element is used to list the approved services and essential IAM/STS actions. Using the ArnNotEquals condition with the aws:PrincipalARN key ensures the security auditor role is not subject to the service restriction, while all other roles and the root user are restricted.

Step-by-Step Solution

Analyze how to prevent member accounts from leaving the AWS Organization.

Identify that the organizations:LeaveOrganization action must be blocked at the member account level via an SCP.

SCPs apply to all member accounts in the OU. Denying LeaveOrganization ensures that no identity, including the root user, can remove the account from the organization.

Determine how to restrict service access for all roles and the root user except the PlatformSecurityAuditor role.

Formulate a Deny SCP with a NotAction element listing the allowed services (EC2, S3, DynamoDB) and management actions (IAM, STS), then add an ArnNotEquals condition for aws:PrincipalARN.

SCPs apply to the root user, whereas IAM permissions boundaries do not. By default, SCPs filter permissions. A Deny SCP overrides any Allow permissions. The ArnNotEquals condition ensures the auditor role is excluded from this restriction, allowing it to inherit full permissions from its IAM policies.

Key Concept

SCPs function as permission filters that apply to all users and roles in member accounts, including the root user. To exempt specific roles from global restrictions, conditional Deny policies must be used, as Allow SCPs cannot grant permissions or bypass local IAM restrictions.

Question 788Question →

A financial technology organization is designing a high-volume transaction ledger platform. The application must achieve a recovery time objective (RTO) of under $10$ seconds and a recovery point objective (RPO) of under $5$ seconds for cross-region disaster recovery between us-east-1 and us-west-2. The data layer requires active-active multi-region write capability to prevent regional write bottlenecks. For internal communications, microservices must resolve a shared private DNS namespace across the VPCs in both regions. Additionally, all outbound transaction compliance reports sent to external financial clearinghouses must originate from static, whitelisted public IP addresses from both regions. Which of the following architectures meets these requirements while ensuring high availability and compliance?

Deploy Amazon DynamoDB Global Tables replicated between us-east-1 and us-west-2. In both regions, deploy active application servers in Auto Scaling groups behind Application Load Balancers (ALBs). Configure Route 53 with an Active-Active Latency-based routing policy associated with health checks. Associate the Route 53 Private Hosted Zone (PHZ) for the internal DNS namespace with the VPCs in both regions. Deploy redundant NAT Gateways across multiple Availability Zones in both VPCs, allocating Elastic IP addresses for outbound traffic.

Deploy Amazon DynamoDB Global Tables replicated between us-east-1 and us-west-2. In us-east-1, deploy active application servers in Auto Scaling groups behind an ALB. In us-west-2, deploy an ALB but keep the application servers scaled down to zero instances, configured to scale out during a failover event. Configure Route 53 with an Active-Passive Failover routing policy. Associate the Route 53 Private Hosted Zone (PHZ) for the internal DNS namespace with the VPCs in both regions. Deploy redundant NAT Gateways across multiple Availability Zones in both VPCs, allocating Elastic IP addresses for outbound traffic.

Deploy Amazon DynamoDB Global Tables replicated between us-east-1 and us-west-2. In both regions, deploy active application servers in Auto Scaling groups behind ALBs. Configure Route 53 with an Active-Active Latency-based routing policy associated with health checks. Associate the Route 53 Private Hosted Zone (PHZ) for the internal DNS namespace only with the us-east-1 VPC. Deploy redundant NAT Gateways across multiple Availability Zones in both VPCs, allocating Elastic IP addresses for outbound traffic.

Deploy Amazon DynamoDB Global Tables replicated between us-east-1 and us-west-2. In both regions, deploy active application servers in Auto Scaling groups behind ALBs. Configure Route 53 with an Active-Active Latency-based routing policy associated with health checks. Associate the Route 53 Private Hosted Zone (PHZ) for the internal DNS namespace with the VPCs in both regions. Deploy a single NAT Gateway in each region's primary Availability Zone to minimize network gateway costs, allocating Elastic IP addresses for outbound traffic.

Show answer & explanation

Answer: Deploy Amazon DynamoDB Global Tables replicated between us-east-1 and us-west-2. In both regions, deploy active application servers in Auto Scaling groups behind Application Load Balancers (ALBs). Configure Route 53 with an Active-Active Latency-based routing policy associated with health checks. Associate the Route 53 Private Hosted Zone (PHZ) for the internal DNS namespace with the VPCs in both regions. Deploy redundant NAT Gateways across multiple Availability Zones in both VPCs, allocating Elastic IP addresses for outbound traffic.

Answer

The correct architecture uses Amazon DynamoDB Global Tables for active-active multi-region replication to satisfy the sub-5 second RPO. Deploying active application instances behind ALBs in both regions and utilizing Route 53 Latency-based routing meets the sub-10 second RTO requirement. Redundant NAT Gateways across multiple Availability Zones ensure high availability for outbound traffic, while associating the Private Hosted Zone with both VPCs enables internal name resolution in both regions.

Step-by-Step Solution

Evaluate the database tier against the RPO and active-active write requirements.

Amazon DynamoDB Global Tables provide fully managed active-active replication with sub-second replication latency, satisfying the sub-5 second RPO target and preventing write bottlenecks.

Relational options (like Aurora Global Database) only support a single primary writer region in standard configurations, which does not satisfy the active-active multi-region write requirement.

Evaluate the compute tier and Route 53 routing against the RTO requirement.

Deploying active application instances behind ALBs in both regions with Route 53 Latency-based routing enables near-instant routing shifts, satisfying the sub-10 second RTO.

A pilot light or warm standby setup that scales from zero cannot provision and bootstrap compute resources within 10 seconds.

Assess the internal DNS name resolution requirement across regions.

Associate the Route 53 Private Hosted Zone (PHZ) with the VPCs in both us-east-1 and us-west-2.

A Private Hosted Zone must be explicitly associated with each VPC that needs to resolve those internal DNS records.

Assess the outbound NAT gateway configuration against the high availability and compliance constraints.

Deploy redundant NAT Gateways across multiple Availability Zones in each VPC and associate Elastic IP addresses to them.

A single NAT Gateway per VPC creates a single point of failure. Redundant gateways are required to ensure continuous outbound flow during a zone failure.

Key Concept

Multi-Region Active-Active High Availability and DNS routing coordination

Estimated Time:3m 0s

Question 789Question →

A global e-commerce enterprise uses AWS Organizations to manage 85 member accounts. The security team requires a centralized auditing solution that aggregates AWS CloudTrail management and data events across all AWS regions into a single Amazon S3 bucket located in a dedicated Auditing account. The architecture must ensure that all logs are encrypted at rest using a Customer Managed Key (CMK) created in the Auditing account. The configuration must be enforced globally, preventing member account administrators from bypassing or modifying the log delivery. Which combination of configurations is required to establish this architecture? (Select TWO.)

Select all that apply

From the AWS Organizations management account, create an organization trail that is configured to deliver logs to the centralized S3 bucket in the Auditing account and specifies the Customer Managed Key (CMK) in the Auditing account for encryption.

In the Auditing account, update the S3 bucket policy to grant s3:PutObject permissions to the CloudTrail service principal, and update the KMS key policy to grant kms:GenerateDataKey* permissions to the CloudTrail service principal, both restricted by the aws:PrincipalOrgID condition matching the organization's ID.

In the Auditing account, configure the S3 bucket policy to allow the root principal of each member account to perform s3:PutObject, and configure an IAM role in each member account that allows the CloudTrail service to assume it.

Apply a Service Control Policy (SCP) at the AWS Organizations root level that grants s3:PutObject and kms:GenerateDataKey* permissions directly to the CloudTrail service principal across all member accounts.

In the Auditing account, configure the central S3 bucket to use the default AWS-managed KMS key (aws/s3) for server-side encryption, and add a bucket policy that grants the CloudTrail service principal read and write access.

Show answer & explanation

Answer: From the AWS Organizations management account, create an organization trail that is configured to deliver logs to the centralized S3 bucket in the Auditing account and specifies the Customer Managed Key (CMK) in the Auditing account for encryption.; In the Auditing account, update the S3 bucket policy to grant s3:PutObject permissions to the CloudTrail service principal, and update the KMS key policy to grant kms:GenerateDataKey* permissions to the CloudTrail service principal, both restricted by the aws:PrincipalOrgID condition matching the organization's ID.

Answer

To establish a centralized, secure auditing solution, the organization trail must be created from the AWS Organizations management account, pointing to the S3 bucket and KMS CMK in the Auditing account. The Auditing account must configure the S3 bucket policy to allow the CloudTrail service principal to write logs and update the KMS CMK key policy to allow the CloudTrail service principal to generate data keys, restricting both resources using the organization ID condition.

The correct solution involves creating an organization trail from the Organizations management account, ensuring that log generation is immutable for member account admins. The centralized resources (S3 bucket and KMS CMK) reside in a dedicated Auditing account, which must trust the CloudTrail service principal. By modifying the S3 bucket policy and the KMS key policy in the Auditing account to permit access to the CloudTrail service principal, and constraining it with the organization's ID condition key, logs can be securely consolidated and encrypted across all member accounts without granting overly broad access.

Step-by-Step Solution

Create the Organization Trail

An organization trail is established from the management account, which automatically logs events across all member accounts and regions, delivering them centrally.

Creating the trail at the organization level enforces logging across all current and future member accounts and prevents member account administrators from disabling or modifying the trail.

Configure Centralized S3 Bucket Access

The S3 bucket in the Auditing account accepts log files written by the CloudTrail service.

Since log delivery is a cross-account action, the destination S3 bucket must have a policy allowing the CloudTrail service principal to put objects, secured with the organization ID condition to ensure isolation.

Configure KMS Key Policy for Encryption

The KMS CMK in the Auditing account allows CloudTrail to request data keys to encrypt logs at rest.

AWS CloudTrail requires permissions to generate data keys using the specified CMK. The key policy must explicitly allow the CloudTrail service principal to perform this action, restricted to the organization ID.

Key Concept

Cross-Account Centralized Log Aggregation using AWS Organizations Trails and Custom KMS Encryption

Question 790Question →

A solutions architect is configuring AWS CloudTrail in a member account to deliver log files to a centralized Amazon S3 bucket in a dedicated security account. The log delivery is currently failing. Which configuration must be applied to the S3 bucket in the security account to allow CloudTrail to write the logs?

Configure the S3 bucket policy in the security account to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.

Configure the S3 bucket policy in the security account to grant access to the member account's root user principal, relying on the member account to delegate permissions to CloudTrail.

Attach a Service Control Policy (SCP) to the Organizational Unit (OU) of the member account that grants the s3:PutObject action on the centralized S3 bucket.

Configure default encryption on the centralized S3 bucket using the AWS managed key (aws/s3) and grant CloudTrail permissions to use this key.

Show answer & explanation

Answer: Configure the S3 bucket policy in the security account to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.

Answer

Configure the S3 bucket policy in the security account to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.

The correct configuration requires modifying the S3 bucket policy in the security account to grant the s3:PutObject permission directly to the CloudTrail service principal (cloudtrail.amazonaws.com). Since CloudTrail writes logs as an AWS service principal, a direct resource-based policy trust must be established on the destination bucket.

Step-by-Step Solution

Identify the writer principal.

The writer is the AWS CloudTrail service principal (cloudtrail.amazonaws.com), not an IAM user or role within the member account.

AWS services delivering logs act as service principals and must be granted permissions directly by the resource owner.

Configure the resource-based policy.

Apply an S3 bucket policy to the centralized bucket in the security account.

Cross-account resource access requires a resource-based policy (the S3 bucket policy) to authorize access from external principals.

Specify the action and conditions.

Grant s3:PutObject to cloudtrail.amazonaws.com, optionally adding conditions to restrict writes to specific organization IDs or ARNs.

This ensures only authorized CloudTrail trails can write to the centralized bucket, preventing unauthorized write attempts.

Key Concept

Cross-account resource sharing and service principal access delegation in AWS.

Estimated Time:1m 30s

Question 791Question →

A healthcare provider is designing a new patient portal system. The system's backend database must be PostgreSQL-compatible. The primary infrastructure will be hosted in us-east-1 with a disaster recovery (DR) site in us-west-2. The business requirements state a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. The application requires outbound internet access to perform external verification of medical licenses. The architecture must remain highly available within the primary region, ensuring no single point of failure exists for outbound traffic. Which of the following configurations should the solutions architect choose to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, using Aurora global replication to maintain an RPO of less than 1 minute.

Deploy a NAT Gateway in each Availability Zone in the us-east-1 VPC, and configure the route tables of the private subnets in each Availability Zone to route outbound traffic through the local NAT Gateway in that same zone.

Deploy an Amazon RDS for PostgreSQL Multi-AZ database in us-east-1, and configure the standby instance in the secondary Availability Zone to serve read traffic and perform cross-region disaster recovery.

Deploy a single NAT Gateway in one public subnet of the us-east-1 VPC, and configure the route tables of all private subnets across all Availability Zones to route outbound traffic through this NAT Gateway to minimize running costs.

Configure AWS Backup to take database snapshots every 6 hours, copy them to us-west-2, and write a script to restore them during failover.

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, using Aurora global replication to maintain an RPO of less than 1 minute.; Deploy a NAT Gateway in each Availability Zone in the us-east-1 VPC, and configure the route tables of the private subnets in each Availability Zone to route outbound traffic through the local NAT Gateway in that same zone.

Answer

Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and deploy a NAT Gateway in each Availability Zone in the us-east-1 VPC.

The correct architecture uses Amazon Aurora Global Database to achieve cross-region physical replication with low latency, satisfying the 5-minute RPO and 15-minute RTO. Additionally, it deploys redundant NAT Gateways across all Availability Zones in the primary region's VPC, which removes any single point of failure for outbound internet traffic.

Step-by-Step Solution

Analyze the database RTO and RPO requirements.

Determine that the database replication strategy must support an RPO of under 5 minutes and an RTO of under 15 minutes across AWS Regions.

This eliminates slow backup-and-restore strategies and points to cross-region database replication like Aurora Global Database.

Analyze the high availability requirement for outbound traffic in the primary region.

Determine that a single NAT Gateway setup is insufficient because it creates a single point of failure.

To ensure high availability, NAT Gateways must be deployed in each Availability Zone where application workloads are running.

Select the combination of configurations that satisfies all requirements.

Choose Aurora Global Database for multi-region replication and Multi-AZ NAT Gateways for local outbound redundancy.

These two choices address the multi-region RTO/RPO goals and the local high availability constraints respectively.

Key Concept

Designing database replication and network infrastructure to meet target RTO/RPO and high availability constraints without introducing single points of failure.

Question 792Question →

A global hospitality and travel conglomerate is designing a hybrid DNS resolution strategy for its multi-account AWS environment, which is connected to an on-premises datacenter via AWS Direct Connect. The on-premises environment hosts the DNS domain `hospitality.local`. Within AWS, a central Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for `aws.hospitality.internal`. Several application VPCs exist in separate member accounts under AWS Organizations, and they must resolve both `hospitality.local` and `aws.hospitality.internal`. Additionally, on-premises systems must resolve `aws.hospitality.internal`.

Which combination of steps should a solutions architect perform to implement this DNS architecture? (Select TWO.)

Select all that apply

Authorize the association of the `aws.hospitality.internal` Private Hosted Zone with each consumer VPC in the application accounts by running the `CreateVPCAssociationAuthorization` API operation from the Shared Services account, and then complete the association in the application accounts.

Create an outbound Route 53 Resolver endpoint in a central Network VPC. Create a Route 53 Resolver forwarding rule for the `hospitality.local` domain that points to the on-premises DNS servers, share this rule with the organization using AWS Resource Access Manager (RAM), and associate it with all application VPCs.

Associate the `aws.hospitality.internal` Private Hosted Zone only with the central Network VPC, allowing the application VPCs to transitively resolve the domain through the Transit Gateway connection without local zone associations.

Deploy a Route 53 Resolver inbound endpoint directly onto the Direct Connect Gateway, and configure the on-premises DNS servers to forward queries for `aws.hospitality.internal` to this endpoint's interface.

Share the `aws.hospitality.internal` Private Hosted Zone with the application accounts using AWS Resource Access Manager (RAM), allowing the administrator of each account to directly associate it with their VPCs.

Show answer & explanation

Answer: Authorize the association of the `aws.hospitality.internal` Private Hosted Zone with each consumer VPC in the application accounts by running the `CreateVPCAssociationAuthorization` API operation from the Shared Services account, and then complete the association in the application accounts.; Create an outbound Route 53 Resolver endpoint in a central Network VPC. Create a Route 53 Resolver forwarding rule for the `hospitality.local` domain that points to the on-premises DNS servers, share this rule with the organization using AWS Resource Access Manager (RAM), and associate it with all application VPCs.

Answer

Authorize the association of the Private Hosted Zone with consumer VPCs using the cross-account authorization API from the owner account, and create a Route 53 Resolver outbound forwarding rule for the on-premises domain in a central Network VPC, sharing it across the organization using AWS Resource Access Manager.

To resolve private hosted zones across accounts, you must establish an association between the zone and the consumer VPCs. Because the zone and the VPCs belong to different AWS accounts, the zone owner must first authorize the association, and the VPC owner must then submit the association request. For hybrid DNS resolution pointing to on-premises networks, Route 53 Resolver outbound endpoints are created in a central VPC, and forwarding rules are shared across the organization using AWS Resource Access Manager (RAM) to allow other VPCs to reuse the outbound connectivity.

Step-by-Step Solution

Set up outbound DNS resolution to the on-premises datacenter.

Create an outbound Route 53 Resolver endpoint in a centralized VPC. Define a Route 53 Resolver rule for `hospitality.local` pointing to the target IP addresses of the on-premises DNS servers.

This enables resources inside the AWS VPC network to forward query requests for the local on-premises domain to the on-premises DNS infrastructure.

Share the DNS forwarding rules with the member accounts.

Use AWS Resource Access Manager (RAM) to share the outbound resolver rule across the AWS Organization, and associate it with each application VPC.

Sharing the rule centrally avoids deploying duplicate resolver endpoints in every single member account VPC, reducing complexity and costs.

Enable cross-account Private Hosted Zone (PHZ) resolution.

Generate association authorizations using the `CreateVPCAssociationAuthorization` API command from the Shared Services account for each application VPC, and execute the association from the respective member accounts.

VPCs must be associated with the Private Hosted Zone to resolve its records, and AWS RAM does not support sharing Private Hosted Zones directly.

Key Concept

Cross-Account Private Hosted Zone Association and Centralized Hybrid DNS

Question 793Question →

A company is designing a deployment pipeline for a high-transaction serverless application that uses Amazon API Gateway (REST API) and AWS Lambda. The application is accessed via a custom domain. The upcoming release contains both API Gateway resource configuration changes and Lambda function updates. The deployment process must meet the following requirements:

* Route exactly $10\%$ of the live production traffic to the new version of the API and Lambda function for a 30-minute validation period, then automatically promote it to $100\%$ if successful.
* Monitor API Gateway-level integration latency and HTTP $5\text{XX}$ error rates specifically for the canary traffic, isolated from the main production traffic.
* Automatically roll back all changes to the previous stable state within 2 minutes if the canary $5\text{XX}$ error rate exceeds $0.1\%$ or if the average integration latency of the canary exceeds $250\text{ ms}$ during the validation period.

Which deployment strategy meets these requirements with the lowest operational complexity?

Create a new Lambda version and configure AWS CodeDeploy to shift traffic using the CodeDeployDefault.LambdaCanary10Percent30Minutes deployment configuration on the Lambda function's production alias. Configure API Gateway to integrate with this alias. Create CloudWatch Alarms on the API Gateway stage-level 5XXError and IntegrationLatency metrics, and associate these alarms with the CodeDeploy deployment group to trigger automatic rollback.

Deploy the new API Gateway configuration and Lambda function to a new API Gateway stage named canary. Configure Route 53 with weighted routing records under the custom domain name, pointing 90% of traffic to the prod stage and 10% of traffic to the canary stage. Create CloudWatch Alarms on the canary stage's 5XXError and IntegrationLatency metrics. Configure an AWS Lambda function triggered by the alarms to change the Route 53 weight for the prod stage to 100% if an alarm triggers.

Configure the API Gateway stage to use a Canary release with a 10% traffic weight. Define a stage variable in API Gateway pointing to a Lambda alias, and configure the stage's canary settings to override the stage variable to point to the new Lambda version's alias. Create Amazon CloudWatch Alarms on the API Gateway canary metrics (5XXError and IntegrationLatency with the Stage and Canary dimensions). Configure an AWS Lambda function triggered by the alarms to call the API Gateway UpdateStage API to delete the canary settings to initiate rollback, and use an automated workflow to promote the canary to production after 30 minutes of successful monitoring.

Deploy the changes using AWS CloudFormation. In the CloudFormation template, update the API Gateway stage resource to enable a CanarySetting of 10% traffic. Configure CloudFormation Rollback Triggers using CloudWatch Alarms on the API Gateway stage-level 5XXError and IntegrationLatency metrics. If the alarms trigger during the stack update, CloudFormation will roll back the stack. Otherwise, manually perform a second stack update after 30 minutes to promote the canary.

Show answer & explanation

Answer: Configure the API Gateway stage to use a Canary release with a 10% traffic weight. Define a stage variable in API Gateway pointing to a Lambda alias, and configure the stage's canary settings to override the stage variable to point to the new Lambda version's alias. Create Amazon CloudWatch Alarms on the API Gateway canary metrics (5XXError and IntegrationLatency with the Stage and Canary dimensions). Configure an AWS Lambda function triggered by the alarms to call the API Gateway UpdateStage API to delete the canary settings to initiate rollback, and use an automated workflow to promote the canary to production after 30 minutes of successful monitoring.

Answer

Configure the API Gateway stage to use a Canary release with a 10% traffic weight, override stage variables to point to the new Lambda version's alias, monitor the canary-specific CloudWatch metrics, and trigger a Lambda function to delete the canary settings if alarms are breached.

The deployment strategy using API Gateway stage canary with a 10% traffic weight and stage variable overrides is the most optimal. API Gateway stage canaries allow simultaneous testing of API Gateway configuration changes and Lambda function updates by overriding the stage variable (e.g., lambdaAlias) to point to the new Lambda version's alias. API Gateway automatically publishes dedicated metrics with the 'Canary=true' dimension, allowing the monitoring of canary-specific HTTP 5XX error rates and integration latency without dilution. If these metrics exceed the threshold, a CloudWatch Alarm triggers a Lambda function that calls the API Gateway UpdateStage API to delete the canary, initiating a near-instant rollback of all traffic back to the production version.

Step-by-Step Solution

Configure the API Gateway REST API stage to enable a Canary release with 10% traffic, and configure stage variables such that the main stage points to the production Lambda alias while the canary override points to the new Lambda version alias.

API Gateway routes 90% of requests to the production API configuration and Lambda alias, and 10% of requests to the new API configuration and new Lambda version alias.

This allows simultaneous testing of API Gateway configuration changes and backend Lambda code changes on a fraction of production traffic.

Create CloudWatch Alarms on the API Gateway metrics filtered by the dimensions Stage and Canary (Canary=true) for 5XXError and IntegrationLatency.

Alarms are configured to monitor the isolated performance of only the canary traffic, preventing metric dilution from the healthy production traffic.

Isolating canary metrics ensures that even small anomalies in the new deployment (e.g., a 1% error rate on the canary) trigger alarms immediately rather than being masked by the production traffic.

Configure the CloudWatch Alarms to trigger an AWS Lambda function that calls the API Gateway UpdateStage API (or update-stage CLI command) to delete the canary settings.

If an alarm breaches, the canary configuration is removed from the stage, immediately reverting 100% of traffic to the stable production version.

Deleting the canary release settings on the stage rolls back the deployment instantly, satisfying the 2-minute recovery SLA.

Configure an automated Step Functions workflow or CI/CD pipeline to promote the API Gateway canary to the production stage after 30 minutes of successful execution without any alarm triggers.

The canary deployment configuration is promoted to the production stage, shifting 100% of traffic to the new version.

This automates the promotion phase, completing the deployment process with minimal operational overhead.

Key Concept

API Gateway Canary releases combined with stage variable overrides and isolated CloudWatch metric monitoring enable safe, automated canary deployments and rapid rollbacks for both API configurations and backend Lambda code.

Estimated Time:3m 0s

Question 794Question →

An enterprise is designing a centralized logging architecture to consolidate AWS CloudTrail logs from all member accounts within an AWS Organization into a single Amazon S3 bucket located in a dedicated Security Account. The organization requires that all logs are encrypted at rest using AWS KMS. Which configuration design correctly establishes the security and compliance controls for this architecture?

Configure the target S3 bucket in the Security Account with a bucket policy that allows the CloudTrail service principal to perform s3:PutObject actions, restricted using the aws:PrincipalOrgID condition. Use a Customer Managed Key (CMK) in the Security Account with a key policy that allows the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations.

Configure the target S3 bucket in the Security Account with a bucket policy allowing the CloudTrail service principal to write objects. Enable default S3 bucket encryption using the AWS managed key (aws/s3) in the Security Account, and update the key policy to delegate cross-account key usage permissions to all member accounts.

Create a Service Control Policy (SCP) at the Organization root level that explicitly permits s3:PutObject and kms:GenerateDataKey for all member accounts targeting the Security Account's S3 bucket and KMS key, and rely on this SCP to grant access without modifying the target S3 bucket policy or the KMS key policy.

Configure the target S3 bucket policy in the Security Account to grant direct s3:PutObject access to the IAM Admin roles of all member accounts in the organization, and configure CloudTrail in the member accounts to use those IAM roles to write log objects to the central bucket.

Show answer & explanation

Answer: Configure the target S3 bucket in the Security Account with a bucket policy that allows the CloudTrail service principal to perform s3:PutObject actions, restricted using the aws:PrincipalOrgID condition. Use a Customer Managed Key (CMK) in the Security Account with a key policy that allows the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations.

Answer

Configure the target S3 bucket in the Security Account with a bucket policy that allows the CloudTrail service principal to perform s3:PutObject actions, restricted using the aws:PrincipalOrgID condition, and use a Customer Managed Key (CMK) in the Security Account with a key policy that allows the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations.

The correct configuration uses a Customer Managed Key (CMK) in the Security Account, as only CMKs support the key policy edits required to grant cross-account access to the CloudTrail service principal. Additionally, the target S3 bucket policy must explicitly permit the CloudTrail service principal to upload objects, restricted to the organization via the aws:PrincipalOrgID condition.

Step-by-Step Solution

Select the correct KMS key type for cross-account S3 encryption.

Choose a Customer Managed Key (CMK) in the Security Account.

AWS-managed keys (like aws/s3) cannot have their policies modified and cannot be accessed or used across accounts.

Configure the S3 bucket policy in the central Security Account.

Allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject, restricted by the organization ID (aws:PrincipalOrgID).

CloudTrail writes logs via its service principal, so the resource-based S3 bucket policy must trust the principal while restricting access to the specific AWS Organization.

Configure the KMS key policy in the central Security Account.

Grant the CloudTrail service principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey.

CloudTrail needs these permissions to generate data keys for encrypting objects before writing them to the bucket.

Key Concept

Cross-account encryption and resource access control for centralized services using Customer Managed Keys (CMKs) and service-principal resource policies.

Estimated Time:2m 0s

Question 795Question →

A financial technology company is launching a new mobile micro-investing application. During a high-profile marketing event, the application expects an immediate traffic spike from a baseline of 500 requests per second to over 150,000 requests per second within a three-minute window. The architecture utilizes an Application Load Balancer (ALB) that routes traffic to Amazon ECS tasks, and an Amazon Aurora MySQL database cluster. The majority of the surge traffic will consist of read-only queries fetching market tickers and user balance summaries. Which strategy should a solutions architect recommend to optimize the performance and scalability of the application during this launch?

Configure the Application Load Balancer with target tracking scaling policies to handle the traffic spike, scale the Amazon ECS tasks horizontally, and configure the database cluster to scale up vertically.

Submit a request to AWS Support to pre-provision Application Load Balancer capacity, configure Aurora Auto Scaling to dynamically scale reader nodes to handle read queries, and implement Amazon ElastiCache (Redis OSS) to cache market tickers.

Submit a request to AWS Support to pre-provision Application Load Balancer capacity, route read queries directly to the primary database's Multi-AZ standby instance, and scale the ECS tasks using step scaling.

Submit a request to AWS Support to pre-provision Application Load Balancer capacity, configure Aurora Auto Scaling to scale reader nodes, and deploy Amazon ElastiCache for Memcached to replicate and persist session state across multiple regions.

Show answer & explanation

Answer: Submit a request to AWS Support to pre-provision Application Load Balancer capacity, configure Aurora Auto Scaling to dynamically scale reader nodes to handle read queries, and implement Amazon ElastiCache (Redis OSS) to cache market tickers.

Answer

The correct answer resolves the immediate capacity needs of the load balancer through pre-provisioning, scales database read capabilities with Aurora reader nodes, and uses Redis caching to minimize load on the database layer.

Step-by-Step Solution

Analyze the load profile and timing

An immediate traffic spike from 500 to 150,000 requests per second in 3 minutes cannot be absorbed by the default warm-up rate of an Application Load Balancer.

Identifying this constraint necessitates pre-warming the load balancer via AWS Support.

Determine database scaling strategy for read queries

Select Aurora Auto Scaling with reader nodes to scale out read operations.

Since standard standby instances cannot serve read traffic, horizontal scaling must use Aurora Replicas.

Implement caching for hot query data

Use Amazon ElastiCache (Redis OSS) to cache the frequently read ticker details.

An in-memory cache offloads read pressure from the database, ensuring low-latency retrieval for repeating queries.

Key Concept

Handling rapid, large-scale traffic surges through load balancer pre-provisioning, horizontal database read-scaling, and in-memory caching.

Estimated Time:2m 0s

Question 796Question →

A media streaming company with $45$ AWS accounts organized under a single organization in AWS Organizations needs to implement a centralized auditing architecture. The security team requires that all API activity across all current and future accounts and regions be recorded using AWS CloudTrail. The logs must be consolidated in a centralized Amazon S3 bucket within a dedicated Security account. The logs must be encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) that is owned and managed by the Security account. Additionally, member account administrators must be prevented from modifying or deleting the CloudTrail configuration. Which of the following architectures meets these requirements with the least operational overhead?

Create an organization trail from the AWS Organizations management account to write logs directly to the Security account's S3 bucket. Rather than modifying the S3 bucket policy in the Security account, attach a Service Control Policy (SCP) to the root of the organization that allows s3:PutObject access for all member accounts to the Security account's S3 bucket, and rely on IAM policy inheritance to grant write access.

Configure an organization trail from the AWS Organizations management account to deliver logs to the S3 bucket in the Security account. In the Security account, update the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's S3 prefix path. Configure the KMS key policy for the Customer Managed Key (CMK) in the Security account to allow the cloudtrail.amazonaws.com service principal to use the key with a condition restricting access to the organization's CloudTrail ARNs. Apply a Service Control Policy (SCP) at the Organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions.

Configure individual trails in each of the

45

member accounts to deliver logs to local S3 buckets. Enable S3 Cross-Region Replication (CRR) to copy all log objects to the centralized S3 bucket in the Security account. Encrypt the destination S3 bucket using the AWS-managed KMS key (aws/s3) to avoid managing custom key policies, and attach a Service Control Policy (SCP) to the organization root that denies member accounts the ability to modify replication configurations.

Configure an organization trail from the AWS Organizations management account to deliver logs to the Security account's S3 bucket. Update the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions to all IAM users within the member accounts by specifying the wildcard * principal combined with the aws:PrincipalOrgID condition. Set up the KMS CMK key policy in the Security account to grant kms:GenerateDataKey* permissions to the member accounts' IAM roles.

Show answer & explanation

Answer: Configure an organization trail from the AWS Organizations management account to deliver logs to the S3 bucket in the Security account. In the Security account, update the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's S3 prefix path. Configure the KMS key policy for the Customer Managed Key (CMK) in the Security account to allow the cloudtrail.amazonaws.com service principal to use the key with a condition restricting access to the organization's CloudTrail ARNs. Apply a Service Control Policy (SCP) at the Organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions.

Answer

The correct architecture uses an Organization Trail which automatically deploys logging to all member accounts. The Security account S3 bucket policy and KMS key policy correctly target the 'cloudtrail.amazonaws.com' service principal, which is required because the CloudTrail service itself writes the logs. The SCP at the root OUs prevents local administrators from disabling this logging, securing the audit trail.

Step-by-Step Solution

Select the centralized log collection mechanism.

An organization trail is chosen to cover all

45

accounts automatically (including future accounts) with minimal operational overhead.

Creating individual trails in member accounts increases configuration drift risks and administrative overhead.

Configure permissions for the S3 bucket and KMS CMK in the Security account.

The S3 bucket policy and KMS key policy are updated to trust the 'cloudtrail.amazonaws.com' service principal.

CloudTrail is an AWS service that delivers logs directly; it does not assume IAM roles from member accounts to perform writes, so the service principal must be granted direct permission.

Enforce compliance using Service Control Policies (SCPs).

An SCP is attached to the Organization root to deny destructive actions like 'cloudtrail:StopLogging' and 'cloudtrail:DeleteTrail' to member accounts.

SCPs act as a centralized guardrail to prevent member account administrators from disabling organization-wide logging.

Key Concept

Centralized Organization Trail with S3, KMS CMK, and SCP guardrails

Question 797Question →

A financial services company is designing a new solution on AWS. They need to store sensitive audit logs in an Amazon S3 bucket in a dedicated security account (111122223333). These logs must be encrypted at rest. A partner application running in a separate AWS account (444455556666) requires daily read access to these logs. The company must implement a secure access mechanism that allows cross-account read access to the encrypted logs, adhering to the principle of least privilege. Which two configuration steps are required to establish this cross-account access? (Select TWO.)

Select all that apply

Configure the S3 bucket policy in the security account (111122223333) to allow s3:GetObject and s3:ListBucket permissions for the IAM role in the partner account (444455556666).

Configure the key policy of a Customer Managed Key (CMK) in the security account (111122223333) to grant kms:Decrypt and kms:DescribeKey permissions to the IAM role in the partner account (444455556666).

Encrypt the S3 bucket in the security account using the default AWS managed key (aws/s3) and delegate decryption permissions via the partner account's local IAM policy.

Attach a Service Control Policy (SCP) to the organizational unit containing the security account to explicitly grant cross-account read access and decrypt permissions to the partner account (444455556666).

Configure the S3 bucket policy in the partner account (444455556666) to pull logs from the security account (111122223333) and enable cross-account access.

Show answer & explanation

Answer: Configure the S3 bucket policy in the security account (111122223333) to allow s3:GetObject and s3:ListBucket permissions for the IAM role in the partner account (444455556666).; Configure the key policy of a Customer Managed Key (CMK) in the security account (111122223333) to grant kms:Decrypt and kms:DescribeKey permissions to the IAM role in the partner account (444455556666).

Answer

Configure the S3 bucket policy in the security account to allow access to the partner's IAM role, and configure the key policy of a Customer Managed Key (CMK) in the security account to grant decrypt permissions to the partner's IAM role.

To establish cross-account access to encrypted S3 objects, the owning account must explicitly grant permissions on both the S3 bucket and the KMS key. The S3 bucket policy in the security account must allow s3:GetObject and s3:ListBucket for the partner role principal. Furthermore, because default key policies do not allow cross-account access and AWS managed keys cannot be modified, a Customer Managed Key (CMK) must be used. The CMK's key policy must be updated to grant kms:Decrypt and kms:DescribeKey permissions to the partner role.

Step-by-Step Solution

Ensure the S3 bucket is encrypted using a Customer Managed Key (CMK) rather than an AWS managed key.

This allows the key policy to be customized for cross-account access.

AWS managed keys do not support policy modification and cannot be shared across accounts.

Add a statement to the S3 bucket policy in the security account (111122223333) targeting the partner's IAM role ARN from account 444455556666.

Grants the external role permission to list and get objects from the bucket.

Cross-account S3 access requires explicit authorization from the resource owner via a bucket policy.

Modify the KMS key policy of the CMK in the security account (111122223333) to allow the partner's IAM role to perform kms:Decrypt and kms:DescribeKey actions.

Authorizes the external role to decrypt the data when retrieving objects.

Without KMS key policy delegation, cross-account calls to decrypt the objects will fail.

Key Concept

Cross-account resource access with KMS encryption requires explicit delegation in both the resource policy (S3 bucket policy) and the encryption key policy (KMS CMK policy), as AWS managed keys cannot be shared cross-account.

Question 798Question →

An enterprise is designing a highly available, multi-Region hybrid network architecture for its AWS Organizations environment. Spoke VPCs in the ` $eu-west-1$ ` (Ireland) and ` $eu-central-1$ ` (Frankfurt) Regions are connected via local regional AWS Transit Gateways (TGWs) that are peered with one another. The on-premises network spans two main hubs: London (primary for ` $eu-west-1$ `) and Frankfurt (primary for ` $eu-central-1$ `), utilizing the aggregated corporate network range of ` $10.0.0.0/8$ `. The London data center connects to the ` $eu-west-1$ ` TGW using a ` $10$ Gbps AWS Direct Connect (DX) connection via a shared DX Gateway, and has a backup Site-to-Site VPN attachment directly on the ` $eu-west-1$ ` TGW. The Frankfurt data center is configured similarly with a DX and VPN connection to the ` $eu-central-1$ ` TGW. The network design requires that outbound traffic from ` $eu-west-1$ ` to ` $10.0.0.0/8$ ` prefers the London DX as the primary path, fails over to the local London VPN as the secondary path, and only routes over the peered TGW connection to egress via the Frankfurt data center paths if both London connections are offline. Which routing configuration achieves this design while preventing sub-optimal routing under normal conditions?

Advertise the summary prefix `

10.0.0.0/8

` from the London data center over both the local Direct Connect (DX) and VPN connections. In the `

eu-west-1

` Transit Gateway (TGW) route table, enable propagation for the DX Gateway and VPN attachments. Add a static route for `

10.0.0.0/8

` pointing to the TGW peering attachment, configuring it with a higher administrative weight or metric to act as a fallback.

Advertise the summary prefix `

10.0.0.0/8

` from both the London and Frankfurt data centers. Configure dynamic BGP peering over the Transit Gateway (TGW) peering attachment. In the `

eu-west-1

` TGW route table, configure BGP local preference to prioritize the local Direct Connect Gateway and VPN routes over the routes learned via the peering attachment.

Advertise the more specific prefixes `

10.0.0.0/9

` and `

10.128.0.0/9

` from the London data center over the local Direct Connect (DX) and VPN connections, using BGP AS-path prepending on the VPN. Enable route propagation from the Direct Connect Gateway (DXGW) and VPN attachments to the `

eu-west-1

` Transit Gateway (TGW) route table, and add a static route for `

10.0.0.0/8

` pointing to the TGW peering attachment.

Deploy a single NAT Gateway in a centralized egress VPC in each region to handle hybrid outbound routing. Associate a Route 53 Private Hosted Zone (PHZ) for the on-premises domain with all VPCs across both regions, and configure Route 53 Resolver endpoints to forward traffic over the peering link as a backup when the local Direct Connect fails.

Show answer & explanation

Answer: Advertise the more specific prefixes ` $10.0.0.0/9$ ` and ` $10.128.0.0/9$ ` from the London data center over the local Direct Connect (DX) and VPN connections, using BGP AS-path prepending on the VPN. Enable route propagation from the Direct Connect Gateway (DXGW) and VPN attachments to the ` $eu-west-1$ ` Transit Gateway (TGW) route table, and add a static route for ` $10.0.0.0/8$ ` pointing to the TGW peering attachment.

Answer

Advertise the more specific prefixes `

10.0.0.0/9

` and `

10.128.0.0/9

` from the local data center over Direct Connect and VPN, use AS-path prepending on the VPN, and configure a static route for `

10.0.0.0/8

` pointing to the Transit Gateway peering attachment.

The correct architecture leverages the longest prefix match rule of AWS Transit Gateway. By advertising more specific prefixes (`

10.0.0.0/9

` and `

10.128.0.0/9

`) from the local data center over both the local Direct Connect (DX) and Site-to-Site VPN, workloads in the local region will prefer the local paths over the peered static route of `

10.0.0.0/8

`. BGP AS-path prepending on the VPN ensures the DX path is preferred over the VPN under normal conditions. If both local paths fail, the specific prefixes are withdrawn, and traffic falls back to the static `

10.0.0.0/8

` route pointing to the Transit Gateway peering attachment, sending traffic to the peered region.

Step-by-Step Solution

Analyze Transit Gateway route table precedence rules.

Static routes always take precedence over propagated routes for identical prefix lengths.

Determines that a static route for `

10.0.0.0/8

` pointing to the peering attachment would override propagated `

10.0.0.0/8

` routes from local DX and VPN, requiring a longest-prefix match strategy.

Design on-premises BGP advertisement strategy.

Advertise more specific prefixes (`

10.0.0.0/9

` and `

10.128.0.0/9

`) from the local data center.

Ensures the Transit Gateway prefers local paths due to longest prefix match, bypassing the `

10.0.0.0/8

` static peering route under normal operations.

Establish path preference between local Direct Connect and VPN.

Prepend BGP AS-path on the local VPN connection.

Forces the Transit Gateway to select the local Direct Connect connection as the primary path and the VPN as the local backup.

Configure the backup route to the peered region.

Add a static route for the summary prefix `

10.0.0.0/8

` pointing to the peering attachment.

Ensures that when both local specific routes fail and are withdrawn, traffic falls back to the peered region's TGW.

Key Concept

AWS Transit Gateway route evaluation order prioritizing static routes over propagated routes for identical prefixes, and utilizing the longest prefix match to implement fallback routing over peering attachments.

Question 799Question →

A financial services company is preparing to deploy a major update to its client-facing web application. The application's frontend is hosted on Amazon S3 and served via an Amazon CloudFront distribution, while the backend APIs are hosted on Amazon ECS Fargate.

To minimize the risk of the release, the DevOps team must design a deployment strategy that routes exactly 10% of the live production traffic to a new staging environment (incorporating updated CloudFront cache policies, a new S3 bucket, and a new ECS service version). The traffic routing must support session stickiness to ensure a consistent user experience during testing. If any anomalies are detected, the team must be able to roll back the traffic immediately with zero downtime.

Which two configurations must be implemented to achieve this deployment strategy? (Select two.)

Select all that apply

Create a staging CloudFront distribution using the production distribution as a template, and configure it with the new S3 bucket origin and cache behaviors. Create a continuous deployment policy with a session-based routing configuration, set the weight to 10.0%, enable session stickiness, and associate the policy with the production distribution.

After verifying the deployment, promote the staging distribution to production using the CloudFront console or AWS CLI. This action copies the staging distribution's configuration directly into the production distribution, shifting 100% of traffic to the new configuration with zero downtime.

Create a second production CloudFront distribution with the same Alternate Domain Name (CNAME). Use Route 53 weighted alias records to route 10% of traffic to the second distribution, and configure Route 53 IP-based routing to maintain session stickiness.

Create a staging CloudFront distribution. Configure a continuous deployment policy with a header-based routing configuration matching the header X-Route-Staging. Deploy a CloudFront Function on the viewer request event of the production distribution that randomly generates the header for 10% of requests and appends a custom cookie for session stickiness.

Create a new Application Load Balancer (ALB) and register the new S3 bucket as an IP target. Configure a Route 53 weighted routing policy to route 10% of traffic to the ALB and 90% of traffic to the production CloudFront distribution, using ALB cookie-based stickiness to maintain session persistence.

Show answer & explanation

Answer: Create a staging CloudFront distribution using the production distribution as a template, and configure it with the new S3 bucket origin and cache behaviors. Create a continuous deployment policy with a session-based routing configuration, set the weight to 10.0%, enable session stickiness, and associate the policy with the production distribution.; After verifying the deployment, promote the staging distribution to production using the CloudFront console or AWS CLI. This action copies the staging distribution's configuration directly into the production distribution, shifting 100% of traffic to the new configuration with zero downtime.

Answer

The correct configurations are: creating a staging CloudFront distribution with the new S3 bucket origin and cache behaviors, setting up a continuous deployment policy with a session-based routing configuration of 10% weight and session stickiness associated with the production distribution; and promoting the staging distribution to production to shift 100% of traffic to the new configuration with zero downtime.

The correct configurations involve using CloudFront continuous deployment policies. First, you create a staging distribution using the production distribution as a template, configured with the new origins and behaviors. You then set up a continuous deployment policy with session-based routing at 10% weight and associate it with the production distribution. CloudFront automatically routes 10% of traffic to the staging distribution while maintaining session stickiness. Once verified, promoting the staging distribution seamlessly copies its configurations to the production distribution, shifting 100% of traffic with zero downtime.

Step-by-Step Solution

Assess the routing and session stickiness requirements for the deployment.

Determine that using a CloudFront continuous deployment policy with session-based routing at 10% weight satisfies both the traffic percentage and session stickiness requirements natively.

This avoids DNS CNAME conflicts and eliminates the need for custom header injection logic.

Configure the staging environment and traffic policy.

Create a staging CloudFront distribution using the production distribution as a template, set up the new origin/cache configurations, and associate a session-based continuous deployment policy with the production distribution.

This isolates the test traffic to the new version using the native aws-cf-cd-co cookie for stickiness.

Promote the staging configuration to complete the deployment.

Promote the staging distribution to production via the AWS Console or CLI.

This copies the staging configurations onto the production distribution, seamlessly shifting 100% of production traffic with zero downtime.

Key Concept

Deployment Strategy Design using CloudFront Continuous Deployment Staging Distributions

Question 800Question →

A logistics enterprise is designing a multi-region disaster recovery (DR) architecture for its new fleet tracking system. The primary database runs on an Amazon Aurora PostgreSQL DB cluster in the us-east-1 Region. The system has a strict Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes in the us-west-2 Region. The architecture must minimize ongoing operational costs while ensuring automated regional failover and high availability in both regions. Which architecture should a solutions architect select to meet these requirements?

Deploy an Amazon Aurora PostgreSQL DB cluster in us-east-1 and configure automated cross-region replication of hourly snapshots to us-west-2. In the event of a disaster, restore the database from the latest snapshot and deploy the application using AWS CloudFormation. Use Amazon Route 53 failover routing with health checks to update DNS records automatically.

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In us-west-2, deploy application servers in a warm standby configuration with minimal compute capacity. Configure Amazon Route 53 failover routing associated with health checks to automatically redirect traffic to us-west-2 during a regional failure, and promote the secondary database cluster.

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy active application servers in both regions. Use Amazon Route 53 latency-based routing to distribute traffic across both regions without health checks. In the event of an outage in us-east-1, manually promote the secondary Aurora cluster and update DNS records to point all traffic to us-west-2.

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In us-west-2, deploy the standby application servers across multiple Availability Zones, configuring their subnet route tables to route all outbound internet traffic through a single NAT Gateway in one Availability Zone to minimize standby costs. Configure Route 53 failover routing with health checks to route traffic to us-west-2 upon primary failure.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In us-west-2, deploy application servers in a warm standby configuration with minimal compute capacity. Configure Amazon Route 53 failover routing associated with health checks to automatically redirect traffic to us-west-2 during a regional failure, and promote the secondary database cluster.

Answer

The architecture that uses Amazon Aurora Global Database with a warm standby application configuration and Route 53 failover routing with health checks.

The correct solution utilizes Amazon Aurora Global Database to replicate data from the primary to the secondary region with latency typical of less than 1 second, fulfilling the 5-minute RPO requirement. Utilizing a warm standby architecture for the application servers minimizes ongoing costs while keeping RTO low. Configuring Route 53 with active-passive failover routing and health checks ensures traffic is automatically redirected to the secondary region upon primary failure, which, combined with database promotion, meets the 15-minute RTO.

Step-by-Step Solution

Select a database replication mechanism that meets the RPO constraint.

Amazon Aurora Global Database provides storage-level, cross-region replication with a typical lag of less than 1 second, easily meeting the 5-minute RPO requirement.

Hourly backups or snapshots would allow up to 60 minutes of data loss, which violates the RPO threshold.

Select a compute scaling strategy that balances cost and recovery time constraints.

A warm standby application configuration in us-west-2 maintains minimal active resources to reduce idle costs, yet can be rapidly scaled up to handle the production workload during an event.

An active-active deployment in both regions incurs double the production compute cost, while a backup-and-restore setup from scratch is too slow to reliably meet the 15-minute RTO.

Establish the network routing policy to enable automated failover.

Configure Route 53 failover routing paired with health checks to monitor the health of the primary region's endpoint and automatically redirect clients to the standby endpoint when the primary is degraded.

Latency-based routing without health checks or manual DNS record modifications would require operator intervention, delaying recovery beyond the 15-minute RTO.

Key Concept

Multi-Region Disaster Recovery Design using Amazon Aurora Global Database and Route 53 Failover Routing

PreviousPage 40 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept