Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 841Question →

A manufacturing corporation is designing a disaster recovery (DR) architecture for its new high-precision IoT telemetry ingestion engine. The ingestion layer runs on Amazon ECS on AWS Fargate in the primary Region (eu-west-1) across three Availability Zones. The telemetry data is stored in an Amazon Aurora PostgreSQL DB cluster in eu-west-1. Ingestion tasks must make outbound API calls to an external validation service using static IP addresses.

The secondary Region for DR is eu-central-1. The corporation demands a recovery point objective (RPO) of less than 1 minute, a recovery time objective (RTO) of less than 15 minutes, and minimal idle infrastructure costs in the secondary Region.

Which two actions should a Solutions Architect take to design a highly available and resilient solution that meets these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary cluster in eu-west-1 and a secondary cluster in eu-central-1, provisioning a single, low-specification Aurora Replica in the secondary cluster.; Deploy a public NAT Gateway in each of the three Availability Zones in both the primary and disaster recovery Regions, assign Elastic IP addresses to each NAT Gateway, and whitelist these Elastic IPs with the external validation service.

Answer

To satisfy the RPO and RTO constraints while avoiding single points of failure, the Solutions Architect should establish an Amazon Aurora Global Database with a single replica in the disaster recovery Region, and deploy NAT Gateways across all three Availability Zones in both the primary and disaster recovery Regions to maintain redundant outbound paths.
Deploying an Amazon Aurora Global Database ensures physical block-level replication with sub-second latency, satisfying the RPO requirement of less than 1 minute. Running a single reader instance in the secondary cluster minimizes ongoing infrastructure costs while facilitating rapid promotion to primary status, which aligns with the RTO of less than 15 minutes. To ensure the ingestion layer remains highly available and resilient to zone failures, public NAT Gateways must be deployed in each Availability Zone in both regions. Whitelisting the Elastic IP addresses of all NAT Gateways guarantees outbound validation API calls succeed from any zone or region.

Step-by-Step Solution

1
Determine the database replication strategy to satisfy the RPO and RTO constraints.
Select Amazon Aurora Global Database over snapshot replication.
Aurora Global Database replicates data at the physical level with a typical latency of less than a second, meeting the sub-minute RPO. Maintaining a single replica in the secondary cluster provides a low-cost, warm target that can be promoted to a primary cluster in under 15 minutes.
2
Design highly available outbound networking paths for the Fargate tasks.
Provision NAT Gateways in each Availability Zone where the application tasks are deployed.
To satisfy high availability requirements and prevent localized outages from disrupting the ingestion process, each Availability Zone must have its own NAT Gateway. Relying on a single NAT Gateway creates a single point of failure.
3
Configure IP address validation alignment.
Whitelist all Elastic IP addresses assigned to all NAT Gateways across both Regions.
Because tasks run in private subnets and must connect to an external service using static IPs, the Elastic IPs of all NAT Gateways must be pre-whitelisted with the external provider to prevent authentication blocks during a failover.

Key Concept

Disaster recovery architectures must minimize replication lag to satisfy low RPOs while removing single points of failure in networking paths to prevent local Availability Zone events from cascading into regional service interruptions.
Question 842Question →

A company is designing a deployment pipeline for a web application running on Amazon EC2 instances managed by an Auto Scaling group behind an Application Load Balancer (ALB). The infrastructure is managed using AWS CloudFormation. A solutions architect must design a deployment strategy that meets the following requirements:
- Production traffic must be shifted gradually to the new version: 10% of the traffic must be routed to the new version for a 15-minute evaluation period, followed by 100% of the traffic if no errors are detected.
- If any application errors or high latency are detected during the deployment or the evaluation period, traffic must be rolled back immediately with zero downtime and without waiting to launch or provision new instances.
- The entire deployment and rollback process must be fully automated and defined as infrastructure as code.

Which two actions should the solutions architect combine to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the Application Load Balancer listener rule with two target groups (blue and green) and use AWS CloudFormation to shift traffic weights from 90:10 to 0:100.; Define AWS CloudFormation rollback triggers linked to Amazon CloudWatch alarms monitoring application error metrics to automatically revert the stack update if issues occur during the evaluation period.

Answer

The correct strategy combines using an Application Load Balancer with blue and green target groups managed by AWS CloudFormation to shift traffic weights, along with CloudFormation rollback triggers linked to CloudWatch alarms to automate the rollback.
To satisfy the requirements of gradual traffic shifting, zero downtime, and instant rollback for EC2 instances, the architecture must perform routing adjustments at the load balancer layer. By using an Application Load Balancer with weighted target groups, the solutions architect can split traffic at a precise 90:10 ratio. Managing these weights inside a CloudFormation template ensures the deployment is defined as infrastructure as code. Linking CloudFormation rollback triggers to CloudWatch alarms ensures that if any metric degrades during the 15-minute evaluation, CloudFormation will immediately rollback the stack update, resetting the listener rule weight back to 100% for the original target group. This rollback takes effect instantly because the original EC2 instances in the blue target group are kept active during the deployment.

Step-by-Step Solution

1
Configure the Application Load Balancer with two separate target groups: one containing the existing Auto Scaling group instances (blue) and one containing the new Auto Scaling group instances (green).
Both environments are provisioned and registered under the load balancer but isolated into distinct target groups.
This allows for precise control of traffic distribution at the load balancer level, avoiding the limitations of DNS caching.
2
Configure the Application Load Balancer listener rule in AWS CloudFormation to distribute traffic between the two target groups using weights, starting with a 90:10 ratio (90% to blue, 10% to green) and planning to shift to 0:100 after 15 minutes.
A controlled subset of production traffic is directed to the new version for canary testing.
This fulfills the requirement of shifting 10% of traffic for a 15-minute evaluation period using infrastructure as code.
3
Attach AWS CloudFormation rollback triggers linked to Amazon CloudWatch alarms that monitor key application performance metrics (such as HTTP 5XX error rates and target response times) during the deployment.
The stack update is monitored dynamically, and if any alarm breaches its threshold, CloudFormation immediately rolls back the listener rule weights to the previous state.
This guarantees an automated, immediate rollback with zero downtime by routing all traffic back to the still-running blue target group instances, without needing to provision new instances.

Key Concept

Combining Application Load Balancer weighted target groups with CloudFormation rollback triggers enables a fully automated, IaC-defined canary deployment and instant rollback for EC2-based applications.
Question 843Question →

A company is deploying a new version of a critical payment processing microservice built on AWS Lambda. To limit blast radius, the deployment strategy must gradually shift traffic to the new version in equal increments. Specifically, the system must route 10%10\% of the traffic to the new Lambda version initially, and then increase the traffic by another 10%10\% every 1010 minutes until the new version handles all traffic. If the error rate exceeds a specified threshold during the migration, the deployment must automatically roll back. Which AWS CodeDeploy deployment configuration should the solutions architect select?

Show answer & explanation

Answer: LambdaLinear10PercentEvery10Minutes

Answer

LambdaLinear10PercentEvery10Minutes
The configuration named 'LambdaLinear10PercentEvery10Minutes' correctly shifts traffic linearly in equal steps of 10%10\% every 1010 minutes until the transition is complete. Combined with CloudWatch alarms, this allows CodeDeploy to automatically roll back the deployment if the error rate exceeds the threshold.

Step-by-Step Solution

1
Analyze the traffic shifting requirement to determine if it is canary or linear.
Since traffic must be shifted in equal increments (10%10\% at a time) at regular intervals (1010 minutes), a linear deployment strategy is required.
Canary deployment shifts a fixed percentage initially and the rest at the end of the window, whereas linear deployment shifts traffic in multiple equal steps.
2
Identify the target parameters for the linear deployment strategy.
The parameters are 10%10\% increment size and 1010 minutes interval duration.
This establishes the exact naming convention required to locate the predefined AWS CodeDeploy configuration.
3
Compare the parameters against the available predefined AWS CodeDeploy configurations for AWS Lambda.
The configuration named 'LambdaLinear10PercentEvery10Minutes' matches the required behavior.
Predefined configurations are named using the pattern 'LambdaLinear[Percentage]PercentEvery[Minutes]Minutes'.

Key Concept

Predefined AWS CodeDeploy configuration patterns for gradual, automated AWS Lambda traffic shifting.
Question 844Question →

A smart-grid utility operator is designing a critical telemetry ingestion and processing platform on AWS. The ingestion tier runs on Amazon EC2 instances in private subnets across three Availability Zones (AZs) in both a primary Region (us-east-1) and a disaster recovery Region (us-west-2). Outbound internet connectivity is required for the EC2 instances to fetch software updates, and it must remain highly available even if an entire Availability Zone experiences an outage. The telemetry data must be stored in a relational database. The platform requires a multi-region disaster recovery strategy with a Recovery Time Objective (RTO) of 10 minutes and a Recovery Point Objective (RPO) of 1 minute. The database connection endpoint must be resolved using a private DNS domain name (db.utility.internal) from both regions. The database must be encrypted at rest using Customer Managed Keys (CMKs). Which architecture meets these requirements with the lowest operational complexity and failover time?

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, encrypted with AWS KMS multi-Region customer managed keys. Deploy a NAT Gateway in each of the three Availability Zones in both regions. Create a Route 53 Private Hosted Zone for db.utility.internal, and associate it with both the us-east-1 and us-west-2 VPCs. Configure Route 53 active-passive failover routing for the db.utility.internal record pointing to the primary cluster endpoint, with a failover record pointing to the secondary cluster endpoint, managed by a Route 53 health check that monitors the primary database cluster health.

Answer

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, encrypted with AWS KMS multi-Region customer managed keys. Deploy a NAT Gateway in each of the three Availability Zones in both regions. Create a Route 53 Private Hosted Zone for db.utility.internal, and associate it with both the us-east-1 and us-west-2 VPCs. Configure Route 53 active-passive failover routing for the db.utility.internal record pointing to the primary cluster endpoint, with a failover record pointing to the secondary cluster endpoint, managed by a Route 53 health check that monitors the primary database cluster health.
The correct architecture uses Amazon Aurora Global Database to achieve near-zero RPO and sub-minute RTO. By deploying NAT Gateways in every Availability Zone, outbound internet traffic is fully protected against AZ outages. Associating the Route 53 Private Hosted Zone with the VPCs in both regions allows local DNS resolution to point to the active database endpoint, and the Route 53 failover routing policy automates regional routing changes based on health checks.

Step-by-Step Solution

1
Select the appropriate database replication architecture that meets the strict RTO of 10 minutes and RPO of 1 minute.
Amazon Aurora Global Database is chosen because it replicates data cross-region with a typical latency of less than 1 second (RPO < 1 second) and supports regional failovers in under a minute (RTO < 1 minute).
Standard RDS cross-Region replication and manual promotion exceed the RTO/RPO limits and increase operational complexity during failover.
2
Configure the private DNS resolution for both regions.
A single Route 53 Private Hosted Zone is created for the private database domain and associated with the VPCs in both the primary and standby regions.
This allows EC2 instances in both VPCs to resolve the database private DNS endpoint locally and ensures seamless failover transition.
3
Ensure highly available outbound internet connectivity for the EC2 application servers.
NAT Gateways are deployed in each of the three Availability Zones in both VPCs.
Deploying a single NAT Gateway per region introduces a single point of failure; deploying them in each AZ guarantees that an AZ outage does not interrupt outbound traffic for the surviving zones.

Key Concept

Designing multi-region disaster recovery using Amazon Aurora Global Database and Route 53 Private Hosted Zones, combined with redundant NAT Gateways for high availability.
Question 845Question →

A gaming company is launching a multiplayer mobile game. The game includes a daily leaderboard challenge that ends at exactly 18:0018:00 UTC. For a 1010-minute window immediately following the event's end, active user traffic increases from a baseline of 2,0002,000 requests per second to 150,000150,000 requests per second as players check their final rankings. The application is hosted on Amazon ECS tasks running on AWS Fargate behind an Application Load Balancer (ALB), with an Amazon Aurora MySQL database cluster storing player scores. Which two actions should the solutions architect take to ensure the application scales efficiently and handles the sudden traffic spike without dropping requests?

Select all that apply

Show answer & explanation

Answer: Submit a support case to AWS to pre-warm the Application Load Balancer to the expected peak of 150,000150,000 requests per second.; Configure Scheduled Scaling for the Amazon ECS service and pre-provision Amazon Aurora Replicas to scale out resources before 18:0018:00 UTC.

Answer

Submit a support case to AWS to pre-warm the Application Load Balancer, and configure Scheduled Scaling for the Amazon ECS service along with pre-provisioning Amazon Aurora Replicas before the daily peak event.
For predictable daily spikes that scale up instantly, reactive target tracking scaling is ineffective. Pre-warming the Application Load Balancer ensures that AWS provisions the underlying resources necessary to route the 150,000150,000 requests per second without dropping packets. Simultaneously, using Scheduled Scaling on ECS and pre-provisioning Aurora Replicas guarantees that the compute and database tiers are fully scaled out before the traffic arrives at 18:0018:00 UTC.

Step-by-Step Solution

1
Analyze the nature of the traffic surge.
The surge is instantaneous (from 2,0002,000 to 150,000150,000 requests per second) and occurs at a predictable daily time (18:0018:00 UTC).
This predictability dictates that scheduled scaling is superior to reactive dynamic scaling, which takes several minutes to boot up instances.
2
Determine the scaling requirements for the entry point (Application Load Balancer).
The ALB must be pre-warmed by submitting a support ticket to AWS.
ALBs scale gradually based on traffic. A sudden 75x increase will cause connection timeouts and dropped requests unless the load balancer is pre-warmed to the expected capacity.
3
Address compute scaling for the containerized application layer.
Schedule the ECS service to scale out tasks ahead of 18:0018:00 UTC.
Target tracking scaling policies cannot react fast enough to instantiate new containers within the short 1010-minute window.
4
Address read scaling for the database layer.
Pre-provision Aurora Replicas to handle the surge in query volume.
Aurora Replicas handle read scaling, whereas RDS Multi-AZ standby instances are passive and cannot serve read traffic.

Key Concept

Handling predictable flash traffic requires proactive resource scheduling and pre-warming of edge/load balancing services, rather than relying on reactive auto-scaling policies.
Question 846Question →

A global e-commerce platform is launching a high-profile, limited-edition flash sale. The platform's baseline database workload is 5,0005,000 write requests per second (RPS). However, historical data shows that during a flash sale, the traffic spikes instantaneously to 250,000250,000 write RPS within 1010 seconds. Each write request represents a transactional inventory deduction that must be atomic, isolated, and completed with sub-10 ms10\text{ ms} latency. The architecture must guarantee that zero requests are dropped or throttled during this rapid transition. Which architecture represents the most performant, scalable, and operationally efficient solution according to AWS best practices?

Show answer & explanation

Answer: Deploy a Network Load Balancer (NLB) targeting an Amazon Elastic Container Service (Amazon ECS) service on AWS Fargate, pre-scaled to the expected peak task count. Store the inventory in an Amazon DynamoDB table configured in provisioned capacity mode with Write Capacity Units (WCUs) pre-allocated to 250,000250,000, using DynamoDB Transactions for the atomic updates.

Answer

Deploying a Network Load Balancer targeting a pre-scaled Amazon ECS service on AWS Fargate, combined with an Amazon DynamoDB table using pre-allocated provisioned Write Capacity Units (WCUs), provides the necessary instantaneous scaling and performance.
The correct architecture uses a Network Load Balancer (NLB) because it is engineered to handle sudden spikes of millions of requests per second without needing to be pre-warmed. By pre-allocating DynamoDB Write Capacity Units (WCUs) to 250,000250,000 in provisioned capacity mode, the database immediately has the necessary write throughput available, preventing any write throttling. Finally, pre-scaling the Amazon ECS on AWS Fargate tasks ensures that the compute layer is ready to process the load immediately without relying on slow reactive scaling policies.

Step-by-Step Solution

1
Analyze the load balancer performance characteristics under flash-sale conditions.
Identify that a Network Load Balancer (NLB) is required to handle the sudden, massive spike from 5,0005,000 to 250,000250,000 RPS without pre-warming, whereas an Application Load Balancer (ALB) would fail due to gradual scaling limitations.
Choosing the right entry point prevents request drops at the edge.
2
Evaluate the database scaling constraints for write-intensive transactional operations.
Determine that Amazon DynamoDB with pre-allocated Provisioned Capacity Mode is necessary to handle the instantaneous 50×50\times write surge. Reject On-Demand mode due to the 2×2\times peak scaling limit, and reject Aurora MySQL Reader Auto Scaling since reader replicas cannot process write transactions.
Ensures the database layer does not throttle the incoming transactions.
3
Select and configure the compute layer to handle the load securely and reliably.
Choose ECS on Fargate pre-scaled to the peak demand, avoiding cold starts or regional concurrency exhaustion associated with unreserved AWS Lambda functions.
Guarantees that compute resources are immediately available to process the incoming requests.

Key Concept

Handling instantaneous, extreme traffic spikes requires pre-allocating capacity at both the database layer (DynamoDB Provisioned Capacity) and compute layer (pre-scaled ECS tasks) combined with a load balancer designed for rapid scaling (Network Load Balancer).
Question 847Question →

An enterprise manages its multi-account environment using AWS Organizations. The security team is implementing federated access using an on-premises SAML 2.0-compliant Identity Provider (IdP) to allow corporate users to access the AWS Management Console and AWS CLI across member accounts. A Service Control Policy (SCP) is applied at the organization root to restrict all operations to the eu−central−1eu-central-1 and eu−west−1eu-west-1 regions. However, during testing, federated users receive access denied errors when attempting to authenticate and assume roles in any member account.

Which of the following configuration steps must be performed to successfully establish federated access and resolve the authentication issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the IAM role trust policy in each member account to allow the sts:AssumeRoleWithSAML action for the SAML identity provider principal.; Modify the regional restriction SCP to exclude the Security Token Service (STS) endpoint from the restriction, allowing users to authenticate via the global STS endpoint.

Answer

To establish federated access, the IAM roles in the member accounts must trust the SAML identity provider using the sts:AssumeRoleWithSAML action, and the regional restriction SCP must exempt the global STS service from its deny conditions to allow authentication requests to succeed.
Establishing direct SAML federation requires configuring the IAM role trust policy in each member account to permit the sts:AssumeRoleWithSAML action for the SAML identity provider principal. Additionally, because the SAML login process relies on the global STS endpoint, any SCP that restricts actions by region must specifically exempt STS so that the authentication request can be processed.

Step-by-Step Solution

1
Establish the trust relationship in the IAM roles.
The IAM role trust policy in each member account is updated to define the SAML provider as the principal and allow the sts:AssumeRoleWithSAML action.
This configuration is required by AWS IAM to successfully authenticate users and return temporary credentials when exchanging the SAML assertion.
2
Add an exemption to the regional restriction Service Control Policy (SCP).
The SCP at the organization root is updated with a condition that excludes the Security Token Service (STS) from the global deny block.
Because the default SAML login endpoint redirects to the global STS service (which resolves to us-east-1), a regional SCP that restricts operations to specific European regions will block the authentication traffic unless STS is explicitly exempted.

Key Concept

Configuring SAML 2.0 federation and accommodating global services within regional restriction SCPs.
Question 848Question →

A multinational e-commerce corporation manages its cloud environment using AWS Organizations. The security team requires a multi-account governance strategy that meets the following criteria:

1. Developers in the Development Organizational Unit (OU) must have the flexibility to experiment with new AWS services, but they must be prevented from disabling CloudTrail or altering IAM roles provisioned by the central security team.
2. In the Production OU, administrators must be restricted to launching only approved EC2 instance types, and all EBS volumes must be encrypted using a Customer Managed Key (CMK) owned by the central security account.
3. Local administrators must not be able to bypass these restrictions, and the solution should minimize operational overhead.

Which two of the following strategies should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply an SCP to the Production OU that denies the ec2:RunInstances action if the instance type is not in the approved list, or if the EBS volume is not encrypted using the specified Customer Managed Key (CMK) ARN from the central security account.; Apply an SCP to the Root of the organization that denies modifications to CloudTrail configurations and denies modifications to IAM roles that begin with a specific path or prefix reserved for the central security team.

Answer

Apply an SCP to the Production OU enforcing approved instance types and encryption with the central Customer Managed Key (CMK), and apply an SCP to the Root of the organization to deny modifications to CloudTrail configurations and central security IAM roles.
The correct strategy uses Service Control Policies (SCPs) to implement guardrails that local administrators cannot override. Applying an SCP at the Root level protects central IAM roles and CloudTrail configurations organization-wide (covering both Development and Production OUs). Enforcing EC2 instance types and the use of the central Customer Managed Key (CMK) via a Production OU SCP ensures compliance while allowing cross-account encryption, since the central CMK key policy can be updated to delegate usage rights to the production accounts.

Step-by-Step Solution

1
Determine the scope of the governance rules for general protection.
Identify that CloudTrail protection and central IAM role protection must apply globally, including to the Development OU.
SCPs attached to the Root of the organization automatically inherit down the entire OU hierarchy, providing a global safeguard.
2
Determine the scope and requirements of the Production OU restrictions.
Identify that production instances must use specific types and that EBS volumes must use a Customer Managed Key from the central security account.
AWS-managed keys cannot be shared across accounts. A Customer Managed Key in the central security account must be used and shared via its key policy, while an SCP on the Production OU enforces its usage.
3
Formulate the SCP policies and attach them to the appropriate levels.
Create a Root-level SCP for global resource protection and a Production-level SCP to restrict EC2 run instances properties.
This configuration meets all constraints with minimal administrative overhead and prevents local administrators from overriding the policies.

Key Concept

Using Service Control Policies (SCPs) in AWS Organizations to establish multi-account security guardrails, understanding that SCPs act as filters rather than direct permission grants, and knowing how cross-account KMS key sharing functions.
Question 849Question →

An enterprise is setting up a new multi-account environment using AWS Organizations to support multiple development teams. The security team requires central auditing, compliance guardrails, and centralized network administration. Arrange the steps in the correct logical sequence to establish this governed multi-account structure.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps to establish the governed multi-account structure is: first, create the Organizational Units (OUs); second, configure the delegated administrator for central logging; third, apply Service Control Policies (SCPs) to the OUs; and fourth, share VPC subnets using AWS Resource Access Manager (RAM).
Establishing the OUs first provides the structural hierarchy. Next, configuring delegated administration for CloudTrail guarantees all actions are audited from the start. Then, applying SCPs ensures security guardrails are active. Finally, sharing network resources via AWS RAM allows workloads to deploy safely within these predefined boundaries.

Step-by-Step Solution

1
Set up the OU hierarchy in the management account.
Establishes the container structure (OUs) representing Security, Infrastructure, and Workloads.
OUs must exist first because all policy attachments, account assignments, and RAM shares target either OUs or the accounts inside them.
2
Configure delegated administration for AWS CloudTrail to the Security account.
Enables the Security account to manage the organizational trail, writing logs to a centralized S3 bucket.
Centralized auditing must be established before provisioning infrastructure resources or deploying applications to maintain compliance and capture all audit events from the beginning.
3
Draft and attach Service Control Policies (SCPs) to the Workloads OU.
Establishes top-level compliance guardrails that apply to all member accounts in that OU.
SCPs must be active before resources are provisioned or shared to ensure no user in the member accounts can perform restricted actions during setup.
4
Use AWS Resource Access Manager (RAM) in the Infrastructure account to share VPC subnets with the Workloads OU.
Enables member accounts in the Workloads OU to deploy resources in the shared subnets.
Sharing network resources is the final deployment step that allows application teams to deploy workloads inside a secure, monitored, and governed environment.

Key Concept

Establishment of a governed multi-account landing zone using AWS Organizations OUs, delegated administration, SCPs, and RAM sharing.
Estimated Time:2m 0s
Question 850Question →

A financial technology company is deploying a credit card payment gateway on AWS. The application must be highly available and resilient to regional disasters, with a target Recovery Time Objective (RTO) of less than 10 minutes and a Recovery Point Objective (RPO) of less than 1 minute. The primary infrastructure is located in us-east-1, and a secondary warm standby infrastructure is deployed in us-west-2. The application tier consists of Amazon EC2 instances in Auto Scaling groups behind Application Load Balancers. The database layer uses Amazon Aurora PostgreSQL. Outbound API calls to external payment networks must flow through NAT Gateways. Internal microservice endpoints are resolved using a Route 53 private hosted zone.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 containing an active Aurora Serverless v2 reader instance.; Create a Route 53 failover routing policy for the public DNS record, directing traffic to the us-east-1 load balancer as primary and the us-west-2 load balancer as secondary, and associate it with an active Route 53 health check.

Answer

Configure Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the standby region containing an active Aurora Serverless v2 reader instance, and create a Route 53 failover routing policy for the public DNS record directing traffic to the primary load balancer as primary and the secondary load balancer as secondary with an active health check.
The option proposing Amazon Aurora Global Database is correct because it uses dedicated physical replication to copy data from the primary to the secondary region with sub-second replication lag, meeting the 1-minute RPO. The secondary cluster can be promoted in less than a minute, satisfying the 10-minute RTO. The option proposing Route 53 failover routing is correct because it automatically detects failures in the primary region's ALB and dynamically redirects client traffic to the secondary region's ALB, keeping recovery times well within the 10-minute RTO.

Step-by-Step Solution

1
Determine the required cross-region database replication strategy to satisfy the 1-minute RPO requirement.
Identify Amazon Aurora Global Database as the correct solution because it replicates data asynchronously with sub-second lag, ensuring compliance with the RPO.
Alternative backup-based replication strategies fail the 1-minute RPO limit.
2
Design the failover mechanism to meet the 10-minute RTO requirement.
Implement a Route 53 failover routing policy linked to a health check that monitors the primary endpoint and automatically switches traffic to the secondary region.
Automated DNS failover minimizes manual intervention and keeps recovery time within the 10-minute constraint.
3
Identify high-availability gaps in the network architecture.
Ensure NAT Gateways are deployed redundantly in each Availability Zone and region, and associate the Route 53 private hosted zone with the VPCs in both regions.
Single NAT Gateways or unassociated private hosted zones introduce single points of failure and routing outages during disaster recovery execution.

Key Concept

Multi-Region Active-Passive Disaster Recovery
Question 851Question →

A financial company is building a regulatory compliance portal in a production account (Account ID 999988887777999988887777). The portal needs to securely ingest audit reports generated by a third-party audit firm's application. The third-party application runs on-premises and must authenticate via an external SAML 2.0 identity provider (IdP). The portal must store these files in an Amazon S3 bucket encrypted using AWS KMS. The audit firm's application will upload the files directly to the S3 bucket using temporary security credentials. Which set of configurations should the solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Create a SAML identity provider in IAM within the production account. Create an IAM role with a trust policy that allows the `sts:AssumeRoleWithSAML` action for the SAML provider principal. Attach an IAM policy to the role that grants `s3:PutObject` on the S3 bucket, and `kms:GenerateDataKey` and `kms:Decrypt` on a Customer Managed Key (CMK). Configure the CMK's key policy to permit the IAM role to use the key.

Answer

Create a SAML identity provider in IAM within the production account. Create an IAM role with a trust policy that allows the `sts:AssumeRoleWithSAML` action for the SAML provider principal. Attach an IAM policy to the role that grants `s3:PutObject` on the S3 bucket, and `kms:GenerateDataKey` and `kms:Decrypt` on a Customer Managed Key (CMK). Configure the CMK's key policy to permit the IAM role to use the key.
The correct solution involves creating a SAML identity provider in IAM and an IAM role with a trust policy that allows the `sts:AssumeRoleWithSAML` action. Furthermore, a Customer Managed Key (CMK) must be used since its key policy can be modified to grant the assumed role permissions to generate data keys and decrypt. Finally, the IAM role must have an attached permission policy that allows S3 uploads and KMS cryptographic actions.

Step-by-Step Solution

1
Establish trust for the third-party application using SAML federation.
A SAML identity provider is configured in IAM, and an IAM role is created with a trust policy allowing `sts:AssumeRoleWithSAML`.
SAML federation requires the specific `sts:AssumeRoleWithSAML` API action to exchange SAML assertions for temporary AWS security credentials.
2
Configure server-side encryption using a Customer Managed Key (CMK).
A CMK is created, and the KMS key policy is updated to allow the IAM role to perform `kms:GenerateDataKey` and `kms:Decrypt`.
AWS managed keys (like `aws/s3`) cannot be used for cross-account or external service delegation because their key policies cannot be modified.
3
Assign standard permission policies to the IAM role.
An IAM policy is attached to the role granting `s3:PutObject` on the S3 bucket.
SCPs only restrict permissions and do not grant them; therefore, an IAM policy attached to the role is required to authorize the upload.

Key Concept

Configuring identity federation and customer-managed KMS key policies for secure data ingestion.
Question 852Question →

An enterprise runs a critical tier-1 transaction application across two AWS regions: us-east-1 (Primary, Account A) and us-west-2 (Recovery, Account B). The us-east-1 VPC deploys an Amazon Aurora PostgreSQL database, an Application Load Balancer (ALB), and Amazon ECS tasks on AWS Fargate. Outbound internet traffic from Fargate in us-east-1 is routed via redundant NAT Gateways. In us-west-2, a warm standby environment is deployed, utilizing a single NAT Gateway to reduce idle costs, and an Aurora PostgreSQL cross-region read replica.

Internal services resolve the database using a Route 53 Private Hosted Zone (PHZ) in Account A. During a disaster recovery (DR) drill, two issues are identified:
1. Internal microservices in Account B cannot resolve the database endpoint using the PHZ, causing connection failures.
2. A simulated database crash in us-east-1 did not trigger external DNS failover to us-west-2, as Route 53 continued routing traffic to the us-east-1 ALB because the ALB itself remained healthy.

The business requires a recovery time objective (RTO) of less than 15 minutes, a recovery point objective (RPO) of less than 1 minute, and high availability during failover.

Which combination of actions should a solutions architect recommend to resolve these issues and satisfy the RTO and RPO requirements?

Show answer & explanation

Answer: Configure AWS Route 53 Application Recovery Controller (ARC) routing controls linked to Route 53 health checks. Create a Route 53 Private Hosted Zone association authorization in Account A for the us-west-2 VPC in Account B, and associate the VPC. Deploy redundant NAT Gateways across multiple Availability Zones in us-west-2. Convert the database to an Amazon Aurora Global Database.

Answer

The correct approach is to configure AWS Route 53 Application Recovery Controller (ARC) routing controls linked to Route 53 health checks, create a Route 53 Private Hosted Zone association authorization in Account A for the us-west-2 VPC in Account B and associate the VPC, deploy redundant NAT Gateways across multiple Availability Zones in us-west-2, and convert the database to an Amazon Aurora Global Database.
The correct response addresses all RTO, RPO, and high availability constraints. Converting the database to an Amazon Aurora Global Database ensures physical replication lag remains under a second, meeting the RPO of less than 1 minute. Utilizing Route 53 Private Hosted Zone association authorizations resolves cross-account internal DNS queries correctly, as AWS Resource Access Manager does not support Route 53 Private Hosted Zones. Deploying redundant NAT Gateways across Availability Zones in the recovery region avoids a single point of failure during failover. Finally, managing failover through AWS Route 53 Application Recovery Controller (ARC) routing controls ensures failover executes cleanly when the backend database becomes degraded, avoiding the failure mode where Route 53 continues routing traffic to a healthy ALB that has lost database connectivity.

Step-by-Step Solution

1
Select replication method to achieve RPO < 1 minute.
Amazon Aurora Global Database provides storage-based physical replication that achieves typical replication lag of less than 1 second, meeting the RPO requirement.
Standard cross-region read replicas use asynchronous logical replication, which can experience high replication lag under load, and their promotion is a manual or script-driven process that can exceed RTO and RPO limits.
2
Resolve cross-account Private Hosted Zone (PHZ) resolution.
Authorize the VPC in Account B to associate with the PHZ in Account A using the AWS CLI or Route 53 API, then accept the association in Account B.
Route 53 Private Hosted Zones cannot be shared via AWS Resource Access Manager (RAM); cross-account association requires a two-step authorization and association process.
3
Address high availability of egress traffic in the recovery region.
Replace the single NAT Gateway in us-west-2 with redundant NAT Gateways deployed across all utilized Availability Zones.
A single NAT Gateway creates a single point of failure (SPOF) for outbound internet traffic from ECS tasks on AWS Fargate in the event of an Availability Zone outage.
4
Configure DNS failover routing behavior.
Use Route 53 Application Recovery Controller (ARC) routing controls or custom health checks linked to application/database health metrics.
Relying on Route 53 ALB alias records with Evaluate Target Health enabled fails to detect database outages because the ALB and its targets remain healthy even when the backend database is down.

Key Concept

Multi-region disaster recovery orchestration with cross-account Route 53 DNS private hosted zone resolution, Aurora Global Database physical replication, and network redundancy.
Estimated Time:3m 0s
Question 853Question →

A company is configuring federated single sign-on (SSO) access to multiple AWS member accounts in an AWS Organization using an on-premises Active Directory Federation Services (AD FS) identity provider. A solutions architect has created a SAML identity provider in each AWS member account. To allow authenticated enterprise users to assume specific IAM roles in the member accounts, which configuration is required in the trust policy of these IAM roles?

Show answer & explanation

Answer: Configure the Principal element to reference the ARN of the SAML identity provider created in the member account, and set the Action element to sts:AssumeRoleWithSAML.

Answer

Configure the Principal element to reference the ARN of the SAML identity provider created in the member account, and set the Action element to sts:AssumeRoleWithSAML.
The correct answer specifies configuring the Principal element to reference the ARN of the SAML identity provider and setting the Action element to sts:AssumeRoleWithSAML. To establish trust for federated users, the IAM role's trust policy must explicitly trust the local SAML provider created in the account and permit the sts:AssumeRoleWithSAML action.

Step-by-Step Solution

1
Identify the federation protocol used by the corporate identity provider.
The corporate identity provider uses SAML 2.0.
Choosing the correct Security Token Service (STS) API action requires knowing the authentication protocol.
2
Identify the correct trust relationship principal for the IAM roles.
The local SAML identity provider ARN in the member account must be set as the Principal.
IAM roles must explicitly trust the local identity provider to accept assertions from it.
3
Select the correct STS action that enables the exchange of SAML assertions.
The action is sts:AssumeRoleWithSAML.
This specific action enables exchanging the SAML assertion for temporary AWS security credentials.

Key Concept

To implement SAML 2.0 federation, target IAM roles in member accounts must contain a trust policy that sets the SAML provider ARN as the Principal and permits the sts:AssumeRoleWithSAML action.
Estimated Time:2m 0s
Question 854Question →

A logistics company is designing its AWS multi-account environment using AWS Organizations. The compliance team mandates that all AWS CloudTrail logs from all current and future member accounts must be securely consolidated into a single Amazon S3 bucket within a dedicated Log Archive account. Additionally, these logs must be encrypted using AWS KMS keys, and member account administrators must be prevented from disabling or altering any trail configuration. Which of the following solutions meets these security and compliance requirements with the lowest administrative effort?

Show answer & explanation

Answer: Deploy an organization trail from the management account that logs all events and delivers them to a central S3 bucket in the Log Archive account. Configure the S3 bucket policy and a KMS customer managed key policy in the Log Archive account to grant write permissions to the CloudTrail service principal, restricted by the organization ID. Attach a Service Control Policy (SCP) at the organization root that denies member accounts the ability to stop, delete, or update any CloudTrail configuration.

Answer

Deploy an organization trail from the management account that logs all events and delivers them to a central S3 bucket in the Log Archive account. Configure the S3 bucket policy and a KMS customer managed key policy in the Log Archive account to grant write permissions to the CloudTrail service principal, restricted by the organization ID. Attach a Service Control Policy (SCP) at the organization root that denies member accounts the ability to stop, delete, or update any CloudTrail configuration.
Deploying an organization trail from the management account automatically captures events from all current and future accounts, sending them to a centralized S3 bucket. A customer managed KMS key is required because AWS managed keys (such as aws/s3) cannot be shared across accounts or customized with policy statements to allow cross-account service access. The S3 bucket policy and KMS key policy must authorize the CloudTrail service principal with the organization ID condition. Lastly, a Service Control Policy (SCP) applied at the organization root effectively restricts member account administrators from altering or disabling the trail configuration, regardless of their local IAM permissions.

Step-by-Step Solution

1
Configure the centralized storage in the Log Archive account.
An S3 bucket is created with a bucket policy allowing the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, restricted by the aws:PrincipalOrgID condition.
This guarantees that only accounts within the AWS Organization can write logs to this central location.
2
Configure the encryption key in the Log Archive account.
A customer managed AWS KMS key is created with a key policy allowing CloudTrail to generate data keys and decrypt, restricted by the organization ID.
AWS managed keys cannot be shared cross-account, so a Customer Managed Key is required to enable member accounts to write encrypted logs to the centralized bucket.
3
Deploy the trail organization-wide.
An organization trail is created from the management account, which automatically deploys and manages logging across all current and future member accounts.
This ensures complete coverage and reduces administrative overhead compared to manually deploying trails.
4
Enforce governance using Service Control Policies (SCPs).
An SCP is attached to the organization root that denies permissions for stopping, deleting, or updating trails in member accounts.
This prevents administrators in member accounts from tampering with the logging configuration, regardless of their local IAM permissions.

Key Concept

Organization Trails, Customer Managed KMS Keys, and SCP Guardrails
Question 855Question →

A global enterprise uses AWS Organizations to manage its multi-account environment. The security team wants to establish a governance framework for the 'Product-Teams' Organizational Unit (OU). The framework must ensure that developers can only provision AWS resources, such as Amazon EC2 instances and Amazon RDS databases, using pre-approved templates defined in AWS Service Catalog. Direct resource provisioning via the AWS Management Console or AWS CLI must be blocked. The underlying CloudFormation templates are stored in a central Amazon S3 bucket in a shared services account and must be encrypted at rest. The solution must minimize administrative overhead and avoid managing local IAM policies in each member account to restrict resource creation. Which solution meets these requirements?

Show answer & explanation

Answer: Register a delegated administrator account for AWS Service Catalog. Create the portfolios in this account and share them with the 'Product-Teams' OU using AWS Organizations sharing. Store the templates in an S3 bucket encrypted with an AWS KMS Customer Managed Key (CMK), and grant the member accounts access to the CMK. Apply a Service Control Policy (SCP) to the OU that denies direct resource creation actions unless the 'aws:CalledVia' condition key contains 'cloudformation.amazonaws.com'.

Answer

Register a delegated administrator account for AWS Service Catalog, share portfolios via AWS Organizations sharing, encrypt the templates using a KMS Customer Managed Key (CMK) with cross-account access enabled, and apply an SCP denying direct resource creation unless called via CloudFormation.
Centralizing Service Catalog portfolios under a delegated administrator account and sharing them using AWS Organizations provides a scalable distribution model. Because AWS-managed KMS keys cannot be shared with other accounts, encrypting templates with a Customer Managed Key (CMK) and granting the member accounts access is required for cross-account deployments. Using an SCP with the 'aws:CalledVia' condition key containing 'cloudformation.amazonaws.com' ensures that direct resource creation is blocked while allowing the Service Catalog (which relies on CloudFormation) to successfully provision the resources.

Step-by-Step Solution

1
Configure AWS Service Catalog portfolio sharing across the organization.
A delegated administrator account is registered, and portfolios are shared with the 'Product-Teams' OU, allowing automatic propagation of approved templates.
This provides centralized template management and minimizes administrative overhead.
2
Configure template encryption and key policies for cross-account access.
Templates in the S3 bucket are encrypted with a Customer Managed Key (CMK), and the key policy allows member accounts to use the key.
AWS-managed KMS keys cannot be shared or used for cross-account decryption by the member accounts.
3
Create and apply a Service Control Policy (SCP) to the OU with an aws:CalledVia condition key.
Direct API calls to create resources are blocked, but calls made via CloudFormation (triggered by Service Catalog) are permitted.
This acts as a centralized guardrail enforcing the use of Service Catalog without requiring individual IAM policy updates in each member account.

Key Concept

Centralized multi-account governance using AWS Service Catalog, SCPs with CalledVia conditions, and cross-account Customer Managed Keys.
Question 856Question →

A global retail conglomerate manages 340340 member accounts organized under AWS Organizations. The security team wants to implement a centralized logging architecture to consolidate VPC Flow Logs from all existing and future VPCs into a single Amazon S3 bucket located in a dedicated Security Operations account. The logs must be encrypted at rest using SSE-KMS, and member accounts must be prevented from disabling or altering the flow log configurations. How should a solutions architect design this solution to meet these requirements?

Show answer & explanation

Answer: Create an Amazon S3 bucket in the Security Operations account, encrypted using a customer managed KMS key. Configure the S3 bucket policy to allow the `delivery.logs.amazonaws.com` service principal `s3:PutObject` and `s3:GetBucketAcl` permissions. Update the KMS key policy to grant the `delivery.logs.amazonaws.com` service principal `kms:GenerateDataKey*` and `kms:Decrypt` permissions. Deploy VPC Flow Logs in all VPCs pointing to the central S3 bucket. Apply a Service Control Policy (SCP) to the organization root that denies `ec2:DeleteFlowLogs` and `ec2:ModifyFlowLogs` unless the call is made by a designated administrative role.

Answer

The correct solution is to create an Amazon S3 bucket in the Security Operations account encrypted using a customer managed KMS key, configure both the S3 bucket policy and KMS key policy to trust the `delivery.logs.amazonaws.com` service principal, and apply a Service Control Policy (SCP) to prevent unauthorized tampering of flow logs across the organization.
The correct solution requires configuring a customer managed KMS key and an S3 bucket policy that both explicitly grant access to the `delivery.logs.amazonaws.com` service principal. A customer managed key is necessary because the default AWS-managed key (`aws/s3`) cannot be configured with custom policies to allow cross-account service principal authorization. Additionally, the Service Control Policy (SCP) acts as an effective guardrail to prevent modification of the VPC Flow Logs in the member accounts without attempting to grant access itself.

Step-by-Step Solution

1
Determine the entity responsible for VPC Flow Log delivery.
Identify that the log delivery service uses the `delivery.logs.amazonaws.com` service principal rather than individual IAM identities.
This determines which principal must be granted permission in the S3 bucket policy and the KMS key policy.
2
Determine the type of KMS key needed for cross-account log encryption.
Select a customer managed KMS key instead of the AWS-managed key `aws/s3`.
AWS-managed keys do not support policy modification and cannot be configured to allow the log delivery service to generate data keys on behalf of other accounts.
3
Configure destination permissions and policies.
Configure the S3 bucket policy to allow `s3:PutObject` and `s3:GetBucketAcl` for `delivery.logs.amazonaws.com`, and the KMS key policy to allow `kms:GenerateDataKey*` and `kms:Decrypt` for the same service principal.
These resource policies are necessary to authorize the service to write encrypted files to the target bucket.
4
Implement governance guardrails at the organization level.
Apply an SCP that denies `ec2:DeleteFlowLogs` and `ec2:ModifyFlowLogs` actions to the organization root, excluding administrative roles.
An SCP is the correct mechanism to enforce log integrity policies across all AWS member accounts.

Key Concept

Cross-account log aggregation with AWS KMS encryption and S3 bucket policies.
Estimated Time:3m 0s
Question 857Question →

An enterprise has a multi-account AWS environment managed under AWS Organizations. The company has segregated its workloads into a Production Organizational Unit (OU) and a Development OU. A centralized Transit Gateway (TGW) in a Shared Services account is used to interconnect all spoke VPCs across both OUs using AWS Resource Access Manager (RAM).

The company has a 10 Gbps AWS Direct Connect (DX) connection to connect its on-premises data center to AWS. The on-premises network uses Virtual Routing and Forwarding (VRF) to isolate production traffic from development traffic.

The Solutions Architect must design a hybrid connectivity solution that satisfies the following requirements:
- Maintain strict end-to-end logical isolation between Production and Development traffic across the AWS environment and the on-premises network.
- Production VPCs must only communicate with other Production VPCs and the on-premises production VRF.
- Development VPCs must only communicate with other Development VPCs and the on-premises development VRF.
- Minimize the number of Transit Gateways and Direct Connect connections to optimize cost and reduce administrative complexity.

Which TWO actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create two separate AWS Direct Connect Gateways (DXGWs) and provision two Transit Virtual Interfaces (VIFs) on the dedicated Direct Connect connection, terminating one Transit VIF on each DXGW.; Associate both DXGWs with the centralized Transit Gateway. Create separate Transit Gateway route tables for Production and Development. Associate the Production DXGW attachment and the Production VPC attachments with the Production Transit Gateway route table, and associate the Development DXGW attachment and the Development VPC attachments with the Development Transit Gateway route table.

Answer

To establish end-to-end logical isolation while minimizing Transit Gateways, the Solutions Architect should provision two Transit VIFs on the Direct Connect connection terminating on two separate Direct Connect Gateways, and associate each Direct Connect Gateway with the centralized Transit Gateway, routing traffic through separate Production and Development Transit Gateway route tables.
To maintain end-to-end logical isolation while minimizing Transit Gateways, the Solutions Architect must separate the traffic at the Direct Connect layer. By creating two Transit VIFs and terminating them on separate Direct Connect Gateways (DXGWs), the on-premises VRFs are mapped to isolated virtual gateways. These DXGWs can both be associated with the same centralized Transit Gateway, creating two distinct attachments. Inside the Transit Gateway, separate route tables are created for Production and Development. The Production DXGW attachment and Production VPC attachments are associated with the Production route table, while the Development DXGW attachment and Development VPC attachments are associated with the Development route table, guaranteeing complete logical isolation of traffic both in transit and within AWS.

Step-by-Step Solution

1
Provision two Transit VIFs on the dedicated Direct Connect connection and terminate them on two separate DXGWs.
This establishes logical isolation at the physical and gateway layers, mapping the on-premises Production and Development VRFs to isolated AWS entry points.
Traffic must be separated before entering the centralized Transit Gateway; otherwise, the VRF separation on-premises cannot be maintained over the shared Direct Connect link.
2
Associate both DXGWs with the centralized Transit Gateway, creating two distinct DXGW attachments on the Transit Gateway.
Two distinct attachments are generated on the centralized Transit Gateway, representing the Production and Development paths from the Direct Connect connection.
This allows the Transit Gateway to treat incoming traffic from each DXGW as a separate attachment, which can then be associated with different route tables.
3
Implement routing isolation inside the Transit Gateway by creating separate Transit Gateway route tables for Production and Development.
Separate routing tables exist within the Transit Gateway, ensuring that routes from Production do not mix with routes from Development.
Route tables are the logical partition within a Transit Gateway that prevent cross-VRF/cross-OU traffic communication.
4
Associate the Production DXGW attachment and the Production VPC attachments with the Production Transit Gateway route table, and associate the Development DXGW attachment and the Development VPC attachments with the Development Transit Gateway route table.
Production traffic only uses the Production route table (having access to only Production VPCs and Production on-premises), and Development traffic only uses the Development route table.
This completes the end-to-end logical path segregation without requiring multiple Transit Gateways.

Key Concept

End-to-end logical isolation in hybrid AWS networks using a single Transit Gateway, multiple Direct Connect Gateways, and separated Transit Gateway route tables.
Question 858Question →

A financial technology company is designing a multi-region disaster recovery (DR) architecture for a core banking application deployed across two AWS Regions: us-east-1 (Primary) and us-west-2 (Secondary). The application runs on Amazon EC2 instances in private subnets behind a public Application Load Balancer (ALB) in each region. The application must achieve a Recovery Time Objective (RTO) of 3 minutes and a Recovery Point Objective (RPO) of 15 seconds. Under normal operations, user requests must be routed to the closest region to minimize latency, with read traffic served locally in each region, and all write operations executed against the primary database. The EC2 instances require redundant outbound internet access to download compliance updates, and internal services must resolve names consistently across both regions using a Route 53 Private Hosted Zone. Which of the following architectures meets these requirements while minimizing recovery time and complexity?

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, enabling write forwarding on the secondary cluster. Configure Route 53 Latency-based routing with associated health checks pointing to the public ALBs in both regions. For outbound internet access, deploy a NAT Gateway in each Availability Zone of the VPCs in both regions. Associate the Route 53 Private Hosted Zone with the VPCs in both us-east-1 and us-west-2.

Answer

The architecture utilizing Amazon Aurora PostgreSQL Global Database with write forwarding, Route 53 latency-based routing with health checks, NAT Gateways in each Availability Zone of both regions, and Route 53 Private Hosted Zone associated with both VPCs.
The architecture leveraging Amazon Aurora PostgreSQL Global Database with write forwarding meets the low RTO and RPO requirements by utilizing physical cross-region replication (RPO < 1 second) and enabling database promotion in under a minute. Enabling write forwarding allows application instances in the secondary region to issue write statements that are forwarded to the primary region, while reading from local replicas. Deploying NAT Gateways in each Availability Zone prevents cross-AZ dependency for outbound traffic. Finally, associating the Route 53 Private Hosted Zone with the VPCs in both regions ensures consistent name resolution across the environment.

Step-by-Step Solution

1
Select a multi-region database solution that supports local reads, writes forwarded to the primary region, and replication speeds supporting a 15-second RPO.
Amazon Aurora PostgreSQL Global Database with write forwarding enabled on the secondary cluster satisfies these constraints by utilizing storage-level physical replication (RPO < 1 second).
Standard RDS replicas do not support write forwarding, and snapshot-based replication fails to meet the strict RPO.
2
Ensure high availability and fault tolerance for outbound internet access within private subnets.
Deploy a NAT Gateway in each Availability Zone across both regions.
Using a single NAT Gateway per region introduces a single point of failure if the hosting Availability Zone goes down.
3
Establish consistent cross-region internal DNS resolution.
Associate the Route 53 Private Hosted Zone with both the primary and secondary VPCs.
Private Hosted Zones do not resolve transitively over VPC peering or routing paths unless explicitly associated with the client VPCs.
4
Configure external DNS routing to minimize latency and automate failover within the RTO target.
Use Route 53 Latency-based routing with associated health checks pointing to the public Application Load Balancers.
This automatically detects regional degradation and shifts traffic to the alternate region within the 3-minute RTO limit.

Key Concept

Multi-Region High Availability and Disaster Recovery Design with Aurora Global Database and Route 53 Routing Policies
Estimated Time:3m 0s
Question 859Question →

A financial startup is launching a new processing service where a serverless ingestion application in a Development Account (123456789012123456789012) must write sensitive audit logs directly to a centralized Amazon S3 bucket in a Security Account (987654321098987654321098). The compliance requirements dictate that all uploaded objects must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS, and the security team must control key access and rotation. Which of the following configuration steps must be performed to enable this cross-account write access and encryption? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the Security Account, modify the key policy of the Customer Managed Key to grant the IAM role in the Development Account permissions to perform kms:GenerateDataKey and kms:Decrypt actions.; In the Security Account, configure the S3 bucket policy to allow the IAM role from the Development Account to perform s3:PutObject actions.

Answer

In the Security Account, modify the key policy of the Customer Managed Key to grant the IAM role in the Development Account permissions to perform kms:GenerateDataKey and kms:Decrypt actions, and configure the S3 bucket policy to allow the IAM role from the Development Account to perform s3:PutObject actions.
To allow cross-account access to encrypted S3 buckets, two permissions are required: first, the bucket policy in the destination account (Security Account) must explicitly allow the source account's IAM principal to perform write operations (such as `s3:PutObject`). Second, because a Customer Managed Key (CMK) is used for encryption, the key policy of the CMK in the destination account must be updated to grant the source account's IAM principal permission to generate data keys (`kms:GenerateDataKey`) and decrypt them (`kms:Decrypt`). S3 uses these KMS actions to encrypt the object during upload.

Step-by-Step Solution

1
Configure permissions on the destination S3 bucket in the Security Account (987654321098987654321098).
The S3 bucket policy allows the IAM role in the Development Account (123456789012123456789012) to perform s3:PutObject operations.
By default, cross-account access requires explicit permission in the resource-based policy of the target S3 bucket.
2
Configure cross-account permissions on the Customer Managed Key (CMK) in the Security Account.
The KMS key policy is updated to allow the IAM role in the Development Account to perform kms:GenerateDataKey and kms:Decrypt.
Since the bucket is encrypted using a Customer Managed Key, the client uploading objects must have permissions to generate data keys to encrypt the data before it is stored in S3.

Key Concept

Cross-account resource sharing and encryption control design using resource-based policies (S3 Bucket Policies) and KMS Key Policies.
Estimated Time:2m 0s
Question 860Question →

An automotive telematics enterprise manages its AWS environment through AWS Organizations. A central Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for the domain name `fleet.telematics.internal`. The company has deployed a new vehicle-tracking application in a separate Production account within its own VPC. The application must resolve resource records within `fleet.telematics.internal`. Additionally, on-premises diagnostic servers connected via AWS Direct Connect must also resolve records in this PHZ. Which strategy should a solutions architect implement to enable DNS resolution for both the Production VPC and the on-premises servers?

Show answer & explanation

Answer: Submit a VPC association authorization for the Production VPC from the Shared Services account using the AWS CLI or SDK, accept the association from the Production account, and deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC to receive forwarded DNS queries from the on-premises DNS servers.

Answer

Authorize the VPC association from the Shared Services account using the AWS CLI or SDK, accept the association from the Production account, and deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC to receive forwarded DNS queries from the on-premises DNS servers.
The correct strategy uses the official Route 53 cross-account VPC association workflow (create authorization from the owner account, then associate from the member VPC account) to allow the Production VPC to resolve records in the Shared Services PHZ. It also correctly utilizes Route 53 Resolver Inbound Endpoints to listen for DNS queries forwarded from the on-premises DNS servers over Direct Connect.

Step-by-Step Solution

1
Authorize cross-account Private Hosted Zone association.
The Shared Services account (owner of the PHZ) runs `aws route53 create-vpc-association-authorization` targeting the Production VPC ID.
This establishes permission for the Production VPC to be associated with the Private Hosted Zone in the Shared Services account.
2
Associate the Production VPC with the Private Hosted Zone.
The Production account runs `aws route53 associate-vpc-with-hosted-zone` using the PHZ ID and its VPC ID.
This allows EC2 instances in the Production VPC to natively resolve DNS queries for the `fleet.telematics.internal` domain.
3
Configure hybrid DNS resolution for on-premises clients.
Create Route 53 Resolver Inbound Endpoints in the Shared Services VPC and configure on-premises DNS forwarders to target these endpoint IP addresses over Direct Connect.
This allows on-premises diagnostic servers to route DNS requests for `fleet.telematics.internal` into the AWS network to be resolved by Route 53.

Key Concept

Cross-account Private Hosted Zone (PHZ) association requires a two-step authorization and association process via the Route 53 API/CLI. Hybrid DNS resolution from on-premises to AWS requires Route 53 Resolver Inbound Endpoints.
Estimated Time:2m 0s
PreviousPage 43 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin