Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 881Question →

A financial services company is designing a hybrid network architecture for its AWS multi-account environment. The environment consists of several Production spoke VPCs and Non-Production spoke VPCs, all connected to a central AWS Transit Gateway (TGW) in a network transit account. The company has the following requirements for connectivity to their on-premises network (192.168.0.0/16192.168.0.0/16):

- Production traffic must utilize a primary 1010 Gbps Direct Connect (DX) connection at DX-Location-A. If DX-Location-A fails, traffic must fail over to a 1010 Gbps DX connection at DX-Location-B. If both DX connections fail, production traffic must fail over to a backup Site-to-Site VPN connection.
- Non-Production traffic must only use the DX connection at DX-Location-B to preserve bandwidth on the primary connection. It must never use DX-Location-A or the Site-to-Site VPN under any circumstances.
- Asymmetric routing between the on-premises network and AWS must be prevented.

Which combination of architectural and routing configurations must the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Establish two separate Direct Connect Gateways: DXGW-A connected to the Transit VIF of DX-Location-A, and DXGW-B connected to the Transit VIF of DX-Location-B. Associate both DXGWs and the Site-to-Site VPN with the TGW. Create separate TGW route tables for Production and Non-Production. Associate the Non-Production TGW route table only with the DXGW-B attachment, and the Production TGW route table with DXGW-A, DXGW-B, and the VPN attachments.; Advertise the on-premises prefix 192.168.0.0/16192.168.0.0/16 via BGP over all paths. On DX-Location-B, prepend the AS-Path 33 times, and on the VPN connection, prepend the AS-Path 66 times. In the TGW association for DXGW-B, configure prefix-level AS-Path prepending for the Production VPC CIDR blocks advertised to the on-premises router.

Answer

Establish separate Direct Connect Gateways (DXGW-A and DXGW-B) to create two distinct Transit Gateway attachments, which allows the Non-Production TGW route table to only associate with DXGW-B while the Production TGW route table associates with both DXGWs and the VPN. Use BGP AS-Path prepending on the on-premises router and on the TGW-to-DXGW-B association for the Production VPC prefixes to enforce symmetric active/passive path selection.
To satisfy the requirements, the Solutions Architect must separate the egress paths at the Transit Gateway (TGW) level. Because a single Direct Connect Gateway (DXGW) attachment represents all underlying virtual interfaces (VIFs), a single DXGW cannot selectively route different spoke VPCs to specific DX locations. By establishing two distinct DXGWs (DXGW-A and DXGW-B), the TGW has separate attachments for each path, allowing the Non-Production TGW route table to only associate with the DXGW-B attachment. For Production, using BGP AS-Path prepending on DX-Location-B (33 times) and the VPN (66 times) ensures AWS prefers DX-Location-A for outbound traffic, while prepending the AS-Path on the TGW-to-DXGW-B association for the Production VPC prefixes ensures the on-premises network prefers DX-Location-A for inbound traffic to Production, preventing asymmetric routing.

Step-by-Step Solution

1
Address the egress path isolation requirement for Non-Production traffic.
Determine that a single Direct Connect Gateway (DXGW) attachment to a Transit Gateway (TGW) cannot separate egress traffic by individual Direct Connect locations. To solve this, two separate DXGWs (DXGW-A and DXGW-B) must be used to create two distinct TGW attachments.
This configuration allows the Non-Production TGW route table to be associated only with the DXGW-B attachment, preventing Non-Production traffic from using DX-Location-A.
2
Configure the TGW route table associations and propagations for Production and Non-Production.
Associate Production spoke VPCs with the Production TGW route table and propagate DXGW-A, DXGW-B, and VPN attachments. Associate Non-Production spoke VPCs with the Non-Production TGW route table and propagate only the DXGW-B attachment.
This guarantees that Non-Production traffic has no route to the VPN or DX-Location-A, satisfying the cost-preservation and isolation constraints.
3
Influence outbound routing from AWS to on-premises.
Advertise the 192.168.0.0/16192.168.0.0/16 prefix over all paths, prepending the AS-Path 33 times on DX-Location-B and 66 times on the VPN.
This ensures that AWS prefers DX-Location-A for Production outbound traffic, failing over to DX-Location-B second, and the VPN third.
4
Influence inbound routing from on-premises to AWS to prevent asymmetric routing.
Configure prefix-level AS-Path prepending on the TGW-to-DXGW-B association for the Production VPC CIDR blocks advertised to the on-premises router.
This forces the on-premises router to prefer sending Production-destined traffic through DX-Location-A, keeping the traffic paths symmetric.

Key Concept

TGW routing isolation using multiple Direct Connect Gateways combined with BGP path selection attributes (AS-Path prepending) to prevent asymmetric routing in hybrid multi-account topologies.
Estimated Time:3m 0s
Question 882Question →

A global pharmaceutical logistics company is designing a temperature-controlled vaccine shipment monitoring system on AWS. The application runs on Amazon EC2 instances in private subnets across multiple Availability Zones in both the `us-east-1` and `eu-west-1` Regions. The EC2 instances must query a database containing shipping telemetry and connect to external internet-based pharmaceutical registries to report alerts.

The business has specified a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 2 minutes. The architecture must automatically route end-users to the region with the lowest latency during normal operations, and redirect them to the alternate region if one region becomes unhealthy. Furthermore, internal microservices in both regions must resolve the internal endpoint `api.coldchain.internal` hosted in a Route 53 Private Hosted Zone (PHZ).

Which two configuration strategies should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Amazon Aurora Global Database with the primary cluster in `us-east-1` and a secondary cluster in `eu-west-1`. Deploy Route 53 latency-based routing records with associated health checks pointing to the Application Load Balancers in both regions.; Deploy a NAT Gateway in each Availability Zone in both regions where the EC2 instances are located. Associate the Route 53 Private Hosted Zone containing the internal API record with the VPCs in both `us-east-1` and `eu-west-1`.

Answer

The correct configurations are deploying Amazon Aurora Global Database for low RPO/RTO replication along with Route 53 latency-based routing with health checks, and deploying redundant NAT Gateways in each Availability Zone in both regions while associating the Route 53 Private Hosted Zone with the VPCs in both regions.
The correct strategy combines Amazon Aurora Global Database to achieve near-instant replication across regions (meeting RPO and RTO needs) and Route 53 latency records with health checks to steer users dynamically. High availability is maintained by configuring a NAT Gateway in each Availability Zone where workloads run, and the Route 53 Private Hosted Zone is associated with both VPCs to ensure local resolution works seamlessly.

Step-by-Step Solution

1
Evaluate the database tier requirements against the target RPO of 2 minutes and RTO of 15 minutes across two AWS regions.
Identify that Amazon Aurora Global Database is required because it offers sub-second cross-region replication lag (meeting the 2-minute RPO) and can be promoted to a primary cluster in under a minute (meeting the 15-minute RTO). Traditional backups or RDS standby reads fail to satisfy these constraints.
Ensures that the database engine selection complies with the recovery window constraints of the disaster recovery plan.
2
Design the network outbound internet connectivity for the EC2 instances in private subnets in both regions.
Determine that a dedicated NAT Gateway must be placed in each Availability Zone where EC2 instances reside to avoid a single point of failure. If an AZ goes down, the remaining AZs continue to have independent outbound internet paths.
Maintains high availability for telemetry upload tasks by avoiding single points of failure at the NAT Gateway tier.
3
Configure internal DNS resolution for the microservice endpoint 'api.coldchain.internal' across both VPCs.
Associate the Route 53 Private Hosted Zone hosting the record with the VPCs in both the primary and secondary regions.
Allows instances in both regions to resolve the internal microservice address natively without relying on complex custom DNS forwarding or failing due to VPC peering routing assumptions.
4
Configure external user routing for low latency and automatic failover.
Set up Route 53 latency-based routing records pointing to the Application Load Balancers in both regions, and attach health checks to these records.
Directs users to the closest region for optimal performance and automatically routes traffic away from an unhealthy region in the event of a regional disaster.

Key Concept

Designing a multi-region active-passive architecture using Route 53 latency-based routing, Amazon Aurora Global Database for low RPO/RTO data replication, and establishing highly available outbound network access and shared DNS spaces.
Estimated Time:3m 0s
Question 883Question →

An enterprise has a critical order-processing application deployed in AWS. The current architecture runs in a single AWS Region across multiple Availability Zones, utilizing an Application Load Balancer (ALB), an Auto Scaling group of Amazon EC2 instances, and an Amazon Aurora PostgreSQL Global Database with a primary cluster in us-east-1 and a secondary read-only cluster in us-west-2. Route 53 is used for DNS routing with simple routing records pointing to the us-east-1 ALB. During a recent regional outage in us-east-1, the operations team suffered significant recovery delays because the Route 53 DNS records had to be updated manually. Additionally, internal microservices in the secondary VPC failed to resolve internal endpoints because the Route 53 Private Hosted Zone (PHZ) was not accessible, and the application's database connection pool crashed because the database endpoint names changed. The company requires a disaster recovery strategy that provides an Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 1 minute. Which of the following solutions should a Solutions Architect implement to meet these requirements with the least operational complexity?

Show answer & explanation

Answer: Configure Route 53 Application Recovery Controller (ARC) routing controls to manage failover between the ALBs in both regions. Associate the Route 53 Private Hosted Zone in the primary account with the VPC in us-west-2. Use an AWS Systems Manager Automation runbook to promote the secondary Aurora cluster using the failover-global-cluster command and update a Route 53 CNAME record pointing to the promoted database endpoint.

Answer

Configure Route 53 Application Recovery Controller (ARC) routing controls to manage failover between the ALBs in both regions. Associate the Route 53 Private Hosted Zone in the primary account with the VPC in us-west-2. Use an AWS Systems Manager Automation runbook to promote the secondary Aurora cluster using the failover-global-cluster command and update a Route 53 CNAME record pointing to the promoted database endpoint.
The correct solution uses Route 53 Application Recovery Controller (ARC) to coordinate regional traffic failover reliably, associates the existing Route 53 Private Hosted Zone with the VPC in us-west-2 to resolve internal resolution errors, and promotes the secondary Aurora cluster using the failover-global-cluster command via Systems Manager Automation, satisfying the strict 15-minute RTO and 1-minute RPO constraints.

Step-by-Step Solution

1
Link the Route 53 Private Hosted Zone in the primary account to the us-west-2 VPC.
Internal microservices in us-west-2 can successfully resolve internal service endpoints upon regional failover.
Resolves cross-VPC DNS resolution issues by extending the namespace authorization to the recovery region VPC.
2
Configure Route 53 Application Recovery Controller (ARC) routing controls and health checks for both ALBs.
Ensures highly reliable, manual, or automated active-passive traffic routing redirection without relying on default Route 53 TTL expiration.
Allows rapid redirection of user traffic under a controlled failover workflow to maintain an RTO of less than 15 minutes.
3
Execute the unplanned failover for the Aurora Global Database using the AWS CLI or SDK failover-global-cluster call, and update the application CNAME record.
Promotes the secondary cluster to primary write status while preserving data replica consistency within the sub-second replication lag.
Maintains RPO within the 1-minute boundary and prevents client configuration updates by abstracting the writer endpoint behind a CNAME record.

Key Concept

Cross-region disaster recovery orchestration and DNS/database failover automation
Question 884Question →

A company has configured an active-passive disaster recovery strategy for its web application across two AWS Regions. They use Amazon Route 53 with failover routing policies to direct traffic. During a disaster recovery simulation, the primary region's application server is shut down, but Route 53 continues to resolve DNS queries to the primary region's load balancer. Which of the following is the most likely cause of this behavior?

Show answer & explanation

Answer: The failover routing record for the primary region is not associated with a Route 53 health check.

Answer

The failover routing record for the primary region is not associated with a Route 53 health check.
The correct answer is that the failover routing record for the primary region is not associated with a Route 53 health check. Route 53 requires a health check to be associated with a record to determine when to fail over. Without a health check, Route 53 considers the endpoint healthy by default and continues to route traffic to the primary region.

Step-by-Step Solution

1
Analyze how Amazon Route 53 determines endpoint health for failover routing.
Route 53 relies on health checks associated with the resource record sets to evaluate whether an endpoint is healthy or unhealthy.
If no health check is associated with the primary record, Route 53 assumes the primary endpoint is always healthy.
2
Identify the cause of the failover failure during the simulation.
Since the server was shut down but DNS traffic was not redirected, Route 53 was unable to detect the outage.
This indicates a missing association between the Route 53 failover record and a health check monitoring the primary endpoint.

Key Concept

Amazon Route 53 DNS Failover and Health Checks
Estimated Time:1m 0s
Question 885Question →

A company hosts a web application behind an Application Load Balancer in the us-east-1 Region. Users in Europe and Asia are reporting high latency during the initial connection setup phase. A solutions architect needs to optimize network performance and reduce connection latency for these global users by onboarding the application to the AWS global network edge. Which service should the solutions architect use to meet these requirements?

Show answer & explanation

Answer: AWS Global Accelerator.

Answer

AWS Global Accelerator
AWS Global Accelerator provides static IP addresses that act as a fixed entry point to the application. It routes user traffic to the closest edge location over the AWS global network, terminating the TCP connection near the user and forwarding the traffic to the Application Load Balancer. This dramatically reduces TCP connection setup latency and overall round-trip time.

Step-by-Step Solution

1
Analyze user reports of high latency over long distances during the TCP handshake phase.
Identify that routing traffic over the public internet across continents introduces high latency and jitter.
Understanding the root cause helps determine that an edge network routing solution is required.
2
Evaluate AWS edge networking options to optimize traffic ingestion closer to the users.
AWS Global Accelerator is identified as the service that routes traffic through AWS edge locations over the AWS global network.
This bypasses the congested public internet and terminates TCP connections closer to the user to reduce latency.

Key Concept

AWS Global Accelerator optimizes network latency for global users by routing traffic over the AWS global network instead of the public internet.
Estimated Time:1m 0s
Question 886Question →

An enterprise is designing a centralized compliance logging solution across its AWS Organization, which consists of a Management Account (111111111111111111111111), a Security Account (222222222222222222222222), and multiple production member accounts. The security team is setting up an organization trail from the Management Account to deliver logs to a centralized Amazon S3 bucket named `central-audit-logs` located in the Security Account. The company's compliance policy dictates that all logs must be encrypted at rest using a customer managed key (CMK) and that access to read these logs must be restricted to an auditor role in the Security Account, who federates via an external SAML Identity Provider (IdP). Which combination of configuration steps will successfully meet these requirements?

Show answer & explanation

Answer: Create a Customer Managed Key (CMK) in the Security Account. Update the CMK key policy to allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions, with a condition matching the organization trail ARN. Configure the S3 bucket policy in the Security Account to grant `s3:GetBucketAcl` and `s3:PutObject` permissions to the CloudTrail service principal, with a condition matching the AWS Organization ID. Configure the auditor role's trust policy with `sts:AssumeRoleWithSAML` pointing to the SAML IdP provider.

Answer

Create a Customer Managed Key (CMK) in the Security Account. Update the CMK key policy to allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions, with a condition matching the organization trail ARN. Configure the S3 bucket policy in the Security Account to grant `s3:GetBucketAcl` and `s3:PutObject` permissions to the CloudTrail service principal, with a condition matching the AWS Organization ID. Configure the auditor role's trust policy with `sts:AssumeRoleWithSAML` pointing to the SAML IdP provider.
The correct configuration combines three essential elements. First, a Customer Managed Key (CMK) is created in the Security Account, and its key policy is modified to allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to generate data keys for encrypting the log objects. Second, the S3 bucket policy allows the CloudTrail service principal to write logs cross-account, protected by a condition that restricts writes to the specific AWS Organization ID. Third, the auditor role's trust policy is configured with the `sts:AssumeRoleWithSAML` action, which is mandatory for external SAML 2.0 Identity Provider federation.

Step-by-Step Solution

1
Select the correct KMS key type and configure key access.
Create a Customer Managed Key (CMK) in the Security Account. Grant `kms:GenerateDataKey*` and `kms:DescribeKey` to `cloudtrail.amazonaws.com` with an `aws:SourceArn` condition pointing to the organization trail ARN.
AWS-managed keys cannot be shared cross-account or have their policies modified. A CMK is required to delegate permissions to the CloudTrail service principal.
2
Configure the centralized S3 bucket policy.
The S3 bucket policy must allow `s3:GetBucketAcl` and `s3:PutObject` to the principal `cloudtrail.amazonaws.com` with a condition verifying the Organization ID.
Since CloudTrail is a service, log delivery is executed by the service principal rather than the member accounts. Securing the policy with the Organization ID ensures only trails within the organization can write to the bucket.
3
Establish the SAML federation trust relationship.
Configure the auditor IAM role's trust policy with the action `sts:AssumeRoleWithSAML` and reference the SAML IdP ARN.
Standard cross-account delegation uses `sts:AssumeRole`, but direct federation with an external SAML Identity Provider must use `sts:AssumeRoleWithSAML` in the trust relationship.

Key Concept

Cross-account security controls integration for organization-wide logging, key management, and SAML federation.
Question 887Question →

An enterprise financial platform operates its core transaction processing engine in a private subnet within the us-east-1 region. The application exposes HTTPS endpoints via an internet-facing Application Load Balancer (ALB). The platform is experiencing latency issues for clients connecting from London and Singapore, with average round-trip times (RTT) exceeding 450 ms450\text{ ms}. The database layer in us-east-1 must maintain strict immediate consistency, preventing multi-region database replication. Security compliance dictates that client source IP addresses must be preserved at the application layer for audit logging, and connections must benefit from TCP optimization by entering the AWS network as close to the users as possible. Which architecture optimization should the Solutions Architect implement to minimize latency for international clients while adhering to all constraints?

Show answer & explanation

Answer: Deploy AWS Global Accelerator and associate the existing ALB in us-east-1 as the endpoint. Configure the accelerator to preserve the client IP address, and route client traffic using the provided Anycast IP addresses.

Answer

Deploy AWS Global Accelerator and associate the existing ALB in us-east-1 as the endpoint. Configure the accelerator to preserve the client IP address, and route client traffic using the provided Anycast IP addresses.
Deploying AWS Global Accelerator optimizes the network path by terminating the TCP connection at the nearest edge location via Anycast IP routing, and then forwarding the payload over the congestion-free AWS backbone to the ALB in us-east-1. It fully satisfies the compliance constraint of client IP preservation for ALB targets, and does not require cross-region database queries.

Step-by-Step Solution

1
Analyze client connectivity entry points and identify where TCP handshakes occur.
Using public internet direct to the ALB requires TCP handshakes to traverse the global internet, increasing RTT.
Establishing TCP connections closer to the user reduces the connection setup time.
2
Evaluate options for routing over the private AWS backbone vs. the public internet.
AWS Global Accelerator routes traffic over the private global backbone network from the nearest edge location, bypassing public internet congestion.
The private AWS backbone provides lower jitter and latency compared to the public internet.
3
Verify compliance with the audit logging (client IP preservation) and database constraints.
AWS Global Accelerator supports client IP preservation for ALB endpoints, and keeping the application processing in us-east-1 prevents cross-region database queries.
This keeps data processing local to the single-region database to meet consistency requirements without introducing SQL RTT latency.

Key Concept

AWS Global Accelerator optimizes global client performance by onboarding traffic at edge locations and routing it over the AWS global network backbone, while natively supporting client IP preservation for Application Load Balancers.
Question 888Question →

An enterprise is designing a new multi-account, multi-region architecture on AWS to support its migration. The architecture consists of 10 VPCs in `us-east-1` and 10 VPCs in `us-west-2`, each deployed across two Availability Zones. The design must satisfy the following requirements:
1. Low-latency, private connectivity between all VPCs and the on-premises data center using an existing 10 Gbps AWS Direct Connect (DX) connection terminated in `us-east-1`.
2. VPCs within the same region must be able to communicate with each other, but cross-region VPC-to-VPC communication must be prevented.
3. High availability for outbound-only internet traffic from private subnets in all VPCs must be maintained during Availability Zone outages.
4. Internal DNS resolution for a single private namespace (`corp.internal`) must be available across all VPCs and on-premises.

Which of the following designs meets these requirements with the lowest operational complexity and cost?

Show answer & explanation

Answer: Deploy an AWS Transit Gateway (TGW) in each region and attach the local VPCs. Associate both TGWs with a single Direct Connect Gateway connected to the Direct Connect connection. Deploy a NAT Gateway in each Availability Zone of each VPC. Create a Route 53 Private Hosted Zone (PHZ) for the namespace and associate it with all 20 VPCs, and deploy Route 53 Inbound Resolver endpoints in a shared VPC in `us-east-1`.

Answer

Deploying an AWS Transit Gateway in each region connected to a single Direct Connect Gateway provides local VPC-to-VPC routing and hybrid connectivity without cross-region VPC communication. Deploying a NAT Gateway in each Availability Zone of each VPC maintains high availability, and associating the Route 53 Private Hosted Zone with all 20 VPCs ensures correct DNS resolution.
The correct design uses a Transit Gateway (TGW) in each region to route traffic between local VPCs, fulfilling the requirement for intra-region VPC-to-VPC communication. By connecting both TGWs to a single Direct Connect Gateway (DXGW), the architecture establishes on-premises connectivity. Since a DXGW does not route traffic between associated Transit Gateways, cross-region VPC-to-VPC communication is prevented by default. Deploying a NAT Gateway in each Availability Zone of every VPC ensures that outbound internet access is resilient to Availability Zone failures. Finally, associating the Route 53 Private Hosted Zone (PHZ) with all 20 VPCs ensures that DNS resolution for the `corp.internal` namespace works everywhere, as PHZs must be associated with each VPC in which resolution is needed.

Step-by-Step Solution

1
Design regional transit routing and hybrid connectivity.
Deploy a Transit Gateway (TGW) in each region and associate both TGWs with a single Direct Connect Gateway (DXGW) connected to the on-premises Direct Connect location.
This setup enables VPC-to-VPC communication within each region via the local TGW. Since the DXGW does not route traffic transitively between associated TGWs, cross-region VPC-to-VPC traffic is prevented, and hybrid connectivity is securely established.
2
Implement highly available outbound internet egress.
Deploy a NAT Gateway in each Availability Zone of each VPC and update private route tables to route egress traffic (0.0.0.0/00.0.0.0/0) to the local NAT Gateway in the same zone.
This guarantees that if an Availability Zone experiences an outage, instances in the remaining zones can still access the internet, satisfying the high availability constraint.
3
Configure private DNS resolution across all VPCs and on-premises.
Create a Route 53 Private Hosted Zone for `corp.internal` and associate it with all 20 VPCs across both regions. Deploy Route 53 Inbound Resolver endpoints in a shared VPC in `us-east-1` to process queries from on-premises DNS forwarders.
Private Hosted Zones do not support transitive resolution across Transit Gateway attachments; they must be explicitly associated with each VPC that needs name resolution.

Key Concept

Multi-region hybrid network design with Transit Gateway, Direct Connect Gateway, redundant NAT Gateways, and cross-account Route 53 Private Hosted Zone association.
Estimated Time:2m 30s
Question 889Question →

An enterprise runs a critical web application in the us-east-1 Region. The architecture consists of an Application Load Balancer (ALB), an Auto Scaling group of Amazon EC2 instances, and an Amazon RDS for PostgreSQL Multi-AZ database. The database endpoint is resolved via a Route 53 Private Hosted Zone. To enhance reliability and meet compliance mandates, the enterprise needs to establish a pilot light disaster recovery (DR) solution in the us-west-2 Region. The solution must achieve a Recovery Point Objective (RPO) of 1515 minutes and a Recovery Time Objective (RTO) of 3030 minutes. Which strategy should a solutions architect recommend to meet these requirements with the lowest operational overhead?

Show answer & explanation

Answer: Configure a cross-region read replica of the RDS database in us-west-2. Deploy the application infrastructure in us-west-2 with the Auto Scaling group desired capacity set to 00. Associate the Route 53 Private Hosted Zone with the VPC in us-west-2. Set up Route 53 Active-Passive failover routing pointing to the primary ALB, and associate it with a Route 53 health check that monitors the primary application. During DR activation, promote the read replica and scale up the Auto Scaling group.

Answer

Configure a cross-region read replica of the RDS database in us-west-2. Deploy the application infrastructure in us-west-2 with the Auto Scaling group desired capacity set to 00. Associate the Route 53 Private Hosted Zone with the VPC in us-west-2. Set up Route 53 Active-Passive failover routing pointing to the primary ALB, and associate it with a Route 53 health check that monitors the primary application. During DR activation, promote the read replica and scale up the Auto Scaling group.
The correct strategy combines RDS cross-region replication (to achieve the 1515-minute RPO), keeping the secondary Auto Scaling group scaled to 00 (establishing a low-cost pilot light architecture), associating the Route 53 Private Hosted Zone with the secondary VPC (to ensure database resolution), and configuring a Route 53 health check on the active failover record (to enable automatic DNS redirection).

Step-by-Step Solution

1
Select a disaster recovery pattern that meets the 1515-minute RPO and 3030-minute RTO constraints.
Identify that the Pilot Light pattern meets the RTO/RPO target by replicating data continuously and keeping compute resources shut down or scaled to zero in the secondary region.
Establishing database replication ensures data loss is minimal, while keeping application servers scaled down reduces operational costs.
2
Ensure DNS resolution is configured correctly across regions.
Associate the Route 53 Private Hosted Zone hosting the database endpoint with the VPC in the secondary region (us-west-2).
Without this association, the application servers running in the secondary region will not be able to resolve the database DNS name to connect to the promoted RDS instance.
3
Configure DNS failover routing.
Set up Route 53 failover records pointing to the primary ALB and associate a Route 53 health check with the primary record.
Route 53 requires a health check to detect that the primary region's endpoint is degraded in order to automatically direct client requests to the secondary region.

Key Concept

Disaster Recovery pattern selection (Pilot Light) combined with cross-region DNS and database replication configurations in AWS.

Alternative Method

Instead of setting the Auto Scaling group capacity to 00, a Warm Standby strategy could keep a minimal number of instances running to further reduce RTO, though at a slightly higher cost. However, the pilot light requirement is fully satisfied by a capacity of 00 since the 3030-minute RTO permits the time needed to spin up instances.
Estimated Time:2m 0s
Question 890Question →

An organization runs a batch processing application on Amazon EC2 instances in an Auto Scaling Group. The workload uses memory-optimized `r5.xlarge` instances, each attached to a `100 GiB100\text{ GiB}` Amazon EBS General Purpose SSD (`gp2`) volume. A Solutions Architect reviews Amazon CloudWatch metrics and notes the following: average CPU utilization is `85%85\%` during peak operations, average memory utilization is `12%12\%`, and the EBS volumes are experiencing I/O throttling at `300 IOPS300\text{ IOPS}`, leading to high disk I/O wait times. Which configuration change should the Solutions Architect recommend to optimize both compute and storage performance while minimizing costs?

Show answer & explanation

Answer: Modify the Auto Scaling Group launch template to use `c5.xlarge` instances, and upgrade the EBS volumes to `gp3` with a configuration of `3000 IOPS3000\text{ IOPS}.

Answer

Modify the Auto Scaling Group launch template to use `c5.xlarge` instances, and upgrade the EBS volumes to `gp3` with a configuration of `3000 IOPS3000\text{ IOPS}.
The correct answer identifies that the workload is compute-bound rather than memory-bound, meaning a switch from `r5` (memory-optimized) to `c5` (compute-optimized) instances reduces cost while providing the necessary CPU. Furthermore, the storage bottleneck is caused by the `3 IOPS/GiB3\text{ IOPS/GiB}` limitation of the `100 GiB100\text{ GiB}` `gp2` volume (yielding only `300 IOPS300\text{ IOPS}`). Moving to `gp3` provides a baseline of `3000 IOPS3000\text{ IOPS}` immediately, resolving the throttling and improving performance at a lower storage price point.

Step-by-Step Solution

1
Analyze the compute utilization profile.
CPU utilization is high (`85%85\%`) while memory utilization is low (`12%12\%`), showing the memory-optimized `r5` instances are over-provisioned for memory and under-provisioned for CPU.
Identifying the mismatch between actual resource utilization and instance type helps determine the correct instance family to choose.
2
Identify the storage bottleneck.
The `100 GiB100\text{ GiB}` `gp2` EBS volumes are limited to `300 IOPS300\text{ IOPS}` (based on the standard `3 IOPS/GiB3\text{ IOPS/GiB}` ratio), leading to I/O throttling.
Determining the baseline performance of the existing storage clarifies why the application is facing high disk wait times.
3
Evaluate remediation paths for compute and storage.
Switching to compute-optimized `c5.xlarge` instances matching the CPU needs reduces costs. Migrating to `gp3` EBS volumes provides a free baseline performance of `3000 IOPS3000\text{ IOPS}`, eliminating the I/O bottleneck.
Combining these two optimizations resolves both the compute resource allocation mismatch and the storage performance constraint at a lower cost.

Key Concept

Compute and Storage Performance Optimization
Estimated Time:2m 0s
Question 891Question →

A solutions architect is designing a new AWS networking infrastructure for an enterprise. The architecture includes three VPCs in the us-west-2 region: VPC-Production, VPC-UAT, and VPC-SharedServices. The design must support:
- Private, scalable VPC-to-VPC routing.
- Hybrid connectivity to an on-premises data center via a new AWS Direct Connect connection.
- Outbound internet access from private subnets in all VPCs that is highly available, resilient to Availability Zone outages, and avoids cross-AZ data transfer charges.
- Resolution of a Route 53 Private Hosted Zone (PHZ) managed in the VPC-SharedServices account by resources in both VPC-Production and VPC-UAT.

Which design satisfies these requirements?

Show answer & explanation

Answer: Deploy an AWS Transit Gateway (TGW) to connect the three VPCs. Set up a Transit Gateway attachment to an AWS Direct Connect Gateway connected to a transit virtual interface (transit VIF). Deploy a NAT Gateway in each active Availability Zone's public subnet in VPC-Production, VPC-UAT, and VPC-SharedServices, configuring private subnet route tables to point outbound traffic to the local NAT Gateway. Authorize and associate the Route 53 Private Hosted Zone in VPC-SharedServices with VPC-Production and VPC-UAT.

Answer

Deploy an AWS Transit Gateway to connect the VPCs, use a Direct Connect Gateway with a transit VIF for hybrid routing, deploy a NAT Gateway in each active Availability Zone of each VPC for redundant and cost-efficient egress, and associate the Route 53 Private Hosted Zone with the consumer VPCs.
The correct design uses AWS Transit Gateway to establish transitive routing between the VPCs and to integrate with a Direct Connect Gateway using a transit virtual interface (transit VIF) for hybrid connectivity. To ensure high availability and prevent cross-AZ data transfer charges, NAT Gateways must be deployed in each active Availability Zone in each VPC. Lastly, the Route 53 Private Hosted Zone (PHZ) in VPC-SharedServices must be explicitly associated with VPC-Production and VPC-UAT using cross-account VPC association, allowing direct DNS resolution without endpoint costs.

Step-by-Step Solution

1
Select the appropriate hybrid and VPC-to-VPC routing component.
AWS Transit Gateway (TGW) attached to the VPCs and to a Direct Connect Gateway via a transit VIF.
Transit Gateway is required to support both scalable VPC-to-VPC transitive routing and hybrid connectivity over a single Direct Connect connection.
2
Design the outbound internet egress architecture.
Deploy a NAT Gateway in each active Availability Zone's public subnet within each VPC.
This guarantees high availability against Availability Zone outages and prevents cross-AZ data transfer charges.
3
Establish DNS resolution for the shared Private Hosted Zone.
Authorize and associate the Private Hosted Zone in VPC-SharedServices with VPC-Production and VPC-UAT.
Cross-account PHZ association allows the consumer VPCs to natively resolve domains in the private hosted zone without additional routing or endpoint costs.

Key Concept

Designing highly available, scalable hybrid network topologies with AWS Transit Gateway, redundant NAT Gateways, and cross-account Private Hosted Zone association.

Alternative Method

Instead of direct PHZ association, Route 53 Resolver Inbound and Outbound Endpoints could be used to forward queries, but this introduces additional cost, management overhead, and latency compared to native cross-account PHZ association.
Estimated Time:3m 0s
Question 892Question →

A company operates a nightly batch processing workload on AWS. The workload runs in two distinct phases:

* Phase 1: A fleet of Amazon EC2 instances in an Auto Scaling group (ASG) downloads large raw data files from Amazon S3. The instances process these files and write large intermediate datasets to attached 500 GB500\text{ GB} Amazon EBS `gp3` volumes configured with default settings (3000 IOPS3{}000\text{ IOPS} and 125 MB/s125\text{ MB/s} throughput). During this phase, performance metrics show that the EBS volumes reach 100%100\% write throughput utilization, while the average CPU utilization of the EC2 instances remains under 20%20\%.
* Phase 2: After the intermediate files are processed, a high-volume AWS Lambda function executes up to 30003{}000 concurrent runs to perform secondary transformations and write the outputs to Amazon DynamoDB. During this phase, critical real-time API-driven Lambda functions in the same AWS account are intermittently throttled.

Which combination of actions should a Solutions Architect recommend to optimize performance and resolve the throttling issues?

Show answer & explanation

Answer: Modify the existing `gp3` volumes to increase their throughput allocation to 250 MB/s250\text{ MB/s}, and configure reserved concurrency on the batch processing Lambda function to limit its concurrent executions.

Answer

Modify the existing `gp3` volumes to increase their throughput allocation to 250 MB/s250\text{ MB/s}, and configure reserved concurrency on the batch processing Lambda function to limit its concurrent executions.
Increasing the throughput of the `gp3` volumes to 250 MB/s250\text{ MB/s} directly addresses the primary performance bottleneck identified in Phase 1, where the write throughput limit of 125 MB/s125\text{ MB/s} was fully utilized, causing low CPU utilization due to I/O wait times. Configuring reserved concurrency on the batch processing Lambda function ensures it cannot scale beyond a set threshold, thereby limiting its concurrent executions and protecting the account's unreserved concurrency pool from being exhausted. This prevents other critical real-time Lambda functions in the same account from being throttled.

Step-by-Step Solution

1
Analyze Phase 1 performance metrics to identify the primary bottleneck.
The metrics show 100%100\% write throughput utilization on the `gp3` volumes while average CPU utilization is under 20%20\%, indicating a storage throughput bottleneck.
Understanding whether performance is limited by IOPS or throughput is critical to choosing the correct volume modification action.
2
Determine the appropriate EBS volume modification to resolve the storage bottleneck.
Increase the throughput of the `gp3` volumes to 250 MB/s250\text{ MB/s} online. Since `gp3` allows independent scaling of throughput up to 1000 MB/s1{}000\text{ MB/s} without changing volume size or type, this directly resolves the bottleneck.
This optimizes storage performance cost-effectively without requiring a migrate to expensive `io2` volumes or increasing IOPS unnecessarily.
3
Analyze the Phase 2 Lambda throttling behavior and identify the solution.
The batch processing Lambda runs up to 30003{}000 concurrent executions, exhausting the regional account-level concurrency limit and throttling other functions.
Configuring reserved concurrency on the batch processing function limits its maximum concurrent executions, thereby preserving a portion of the concurrency pool for critical real-time functions.

Key Concept

Identifying and resolving throughput-based storage bottlenecks on EBS gp3 volumes, and managing Lambda concurrent executions using reserved concurrency to prevent account-level resource starvation.
Question 893Question →

An enterprise runs a multi-tier application across several VPCs in us-east-1 with database workloads on Amazon Aurora PostgreSQL Serverless v2. The internal microservices rely on a Route 53 Private Hosted Zone (PHZ) managed in a centralized Shared Services account. Currently, all outbound internet traffic from the private application subnets is routed through a single NAT Gateway in us-east-1's Availability Zone A.

To improve reliability and implement a disaster recovery (DR) strategy in us-west-2, the Solutions Architect must design a solution meeting an RTO of 1515 minutes and an RPO of 55 minutes. The strategy must resolve existing single points of failure in the network path and ensure internal microservices resolution works seamlessly in both regions during a failover.

Which combination of actions will meet these requirements while minimizing operational complexity?

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone in us-east-1 and update the respective private subnet route tables. Create an Amazon Aurora Global Database with a secondary cluster in us-west-2 containing Serverless v2 instances. Associate the centralized Route 53 PHZ in the Shared Services account with the new VPCs in us-west-2. Configure an active-passive Route 53 Failover routing policy pointing to the Application Load Balancers in both regions, and attach Route 53 active health checks that monitor end-to-end application health.

Answer

Deploy a NAT Gateway in each Availability Zone in us-east-1 and update route tables. Create an Amazon Aurora Global Database with a secondary cluster in us-west-2. Associate the centralized Route 53 Private Hosted Zone (PHZ) in the Shared Services account with the new VPCs in us-west-2. Configure an active-passive Route 53 Failover routing policy with active health checks.
The correct answer provides a comprehensive disaster recovery and reliability enhancement plan. It resolves the network single point of failure by adding redundant NAT Gateways per Availability Zone. It guarantees the 5-minute RPO using Amazon Aurora Global Database, which offers low-latency asynchronous cross-region replication. It resolves cross-region internal service resolution by associating the central Route 53 Private Hosted Zone with the DR VPCs. Lastly, it implements automated failover using active health checks with a Route 53 Failover policy to satisfy the 15-minute RTO.

Step-by-Step Solution

1
Address the single point of failure in the egress network path by deploying a NAT Gateway in each Availability Zone in the primary region.
Outbound internet access is made redundant across all Availability Zones, preventing a single zone outage from disrupting traffic in the other zones.
Routing all private subnet traffic through a single NAT Gateway creates a critical single point of failure.
2
Set up an Amazon Aurora Global Database with a primary cluster in us-east-1 and a secondary cluster in us-west-2.
Physical storage replication is performed asynchronously with latency typically under 1 second.
This setup allows the database tier to achieve an RPO of less than 5 minutes and supports promotion to primary within minutes to satisfy the 15-minute RTO.
3
Associate the centralized Route 53 Private Hosted Zone (PHZ) from the Shared Services account with the VPCs in us-west-2.
The application servers in us-west-2 can immediately resolve internal microservices endpoints.
This establishes cross-account VPC association with the central host zone, avoiding DNS resolution failures or duplicate zone maintenance overhead.
4
Configure a Route 53 Failover routing policy with active health checks pointing to the Application Load Balancers in both regions.
Traffic automatically shifts to the disaster recovery region when the primary region's ALBs or underlying applications become unhealthy.
Active health checks are required to trigger automated failover within the 15-minute RTO window.

Key Concept

Multi-region disaster recovery requires redundant network egress, cross-region database replication, proper multi-account private DNS association, and automated DNS failover with health checks.
Question 894Question →

An enterprise runs a critical application on Amazon EC2 instances in an Auto Scaling group across multiple AWS accounts. The application writes log events to a local file at `/var/log/app/production.log`. A log rotation utility runs hourly, renaming the file to `/var/log/app/production.log.YYYY-MM-DD-HH` and creating a new empty `/var/log/app/production.log` file. Currently, the Unified CloudWatch Agent is installed on the EC2 instances, and its configuration file specifies `/var/log/app/production.log` as the log source. The operations team reports that log events written immediately before and during the hourly rotation are frequently missing from Amazon CloudWatch Logs. Additionally, the company's security policy requires all application logs to be consolidated into a single Amazon S3 bucket located in a dedicated Security account for long-term retention. Which combination of actions should the Solutions Architect recommend to resolve the log loss and establish the centralized logging pipeline?

Show answer & explanation

Answer: Update the CloudWatch Agent configuration on the EC2 instances by setting the `file_path` parameter to `/var/log/app/production.log*`. Configure a CloudWatch Logs subscription filter in each application account to stream the logs to an Amazon Kinesis Data Firehose delivery stream in the same account. Configure each Kinesis Data Firehose stream to deliver the logs to the centralized S3 bucket in the Security account, and update the S3 bucket policy in the Security account to grant `s3:PutObject` permissions to the IAM role principal of the Kinesis Data Firehose stream from each application account.

Answer

Update the CloudWatch Agent configuration on the EC2 instances to use a wildcard (`/var/log/app/production.log*`) for the `file_path` parameter. Establish a CloudWatch Logs subscription filter in each application account to send logs to Kinesis Data Firehose, and configure Firehose to deliver logs to the centralized S3 bucket in the Security account while updating the S3 bucket policy to grant `s3:PutObject` permissions to the Firehose IAM role principal from each application account.
The correct option addresses the log rotation issue by using a wildcard pattern (`/var/log/app/production.log*`) in the CloudWatch agent's `file_path` configuration. This ensures that the agent continues to read the rotated log files until they are fully consumed. Centralizing these logs is achieved by utilizing CloudWatch Logs subscription filters to send data to Kinesis Data Firehose in each application account, which then writes to the central S3 bucket in the Security account. The S3 bucket policy is updated to explicitly allow the Kinesis Data Firehose IAM roles from the application accounts to write (`s3:PutObject`) to the bucket, which is the standard, secure way to enable cross-account delivery.

Step-by-Step Solution

1
Configure the CloudWatch Agent with a wildcard in the file path.
The CloudWatch Agent tracks both the active log file and any rotated log files matching the pattern.
When log files are rotated, the active file is renamed (e.g., `production.log.YYYY-MM-DD-HH`). Using a static path causes the agent to stop tailing the rotated file, resulting in missing log entries that had not yet been processed at the moment of rotation. A wildcard pattern ensures the agent tails the rotated file to completion.
2
Set up CloudWatch Logs subscription filters to stream logs to Amazon Kinesis Data Firehose.
Logs are automatically streamed in near real-time from CloudWatch Logs to the Firehose delivery stream.
Streaming logs from CloudWatch Logs via subscription filters is a robust and scalable pattern to export log data without manual intervention or batch scripts.
3
Configure Kinesis Data Firehose to write to the centralized S3 bucket and configure the cross-account bucket policy.
Kinesis Data Firehose delivers log files to the centralized S3 bucket in the Security account securely.
To support cross-account log delivery, the Kinesis Data Firehose IAM role in the application account must be granted permission in the Security account's S3 bucket policy using the role's ARN as the principal.

Key Concept

Log file rotation tracking and cross-account log centralisation
Question 895Question →

An enterprise is deploying a new high-throughput, latency-sensitive application across two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). The architecture consists of the following components:

* Two application VPCs: App-VPC-US1 in us-east-1 and App-VPC-US2 in us-west-2, each deployed across three Availability Zones.
* A central shared services VPC: Shared-VPC-US1 in us-east-1 containing a Route 53 Private Hosted Zone (PHZ) named app.corp.internal and Route 53 Resolver Outbound Endpoints to resolve on-premises DNS queries.
* Hybrid connectivity via AWS Direct Connect (DX) with a Direct Connect Gateway (DXGW) connected to an on-premises data center, and a backup Site-to-Site VPN.

The solution must satisfy the following constraints:
1. Cross-region network traffic between App-VPC-US1 and App-VPC-US2 must achieve the lowest latency and highest throughput possible, bypassing intermediate hubs.
2. Private instances in all three VPCs must be able to resolve records in app.corp.internal and route queries for corp.internal to on-premises DNS servers.
3. Outbound internet egress for private subnets in all VPCs must remain resilient to single Availability Zone failures within their respective regions.
4. Cross-region hybrid connectivity failover must be dynamic and automated.

Which network architecture design fully satisfies these requirements with the lowest latency and lowest administrative overhead?

Show answer & explanation

Answer: Deploy a Transit Gateway in each region (TGW-US1 and TGW-US2). Associate the local VPCs to their respective Transit Gateways. Connect the Transit Gateways to the Direct Connect Gateway using Transit Virtual Interfaces (Transit VIFs) for primary hybrid connectivity, and establish a Site-to-Site VPN connection to each Transit Gateway as a backup. Create a direct VPC Peering connection between App-VPC-US1 and App-VPC-US2 for low-latency cross-region application traffic. In each VPC, deploy a NAT Gateway in every Availability Zone (three per VPC) to handle outbound internet egress. Associate the app.corp.internal Private Hosted Zone with App-VPC-US1, App-VPC-US2, and Shared-VPC-US1. Configure Route 53 Resolver Outbound Endpoints in Shared-VPC-US1 and associate the forwarding rules for corp.internal with all VPCs.

Answer

The correct architecture uses a Transit Gateway in each region connected to a Direct Connect Gateway using Transit VIFs and Site-to-Site VPNs for resilient hybrid routing, establishes a direct VPC Peering connection between App-VPC-US1 and App-VPC-US2 for the lowest latency application path, deploys a NAT Gateway per Availability Zone within each VPC for egress redundancy, and associates the Private Hosted Zone directly with all three VPCs to enable native resolution.
The correct solution correctly separates high-performance local application routing from hybrid gateway failover. Direct VPC Peering ensures application traffic bypasses Transit Gateways, meeting the latency constraint. Redundant NAT Gateways per AZ preserve egress availability. Associating the Private Hosted Zone with all target VPCs achieves optimal private name resolution natively. Using regional Transit Gateways connected via Transit VIFs to a Direct Connect Gateway satisfies dynamic failover and backup constraints.

Step-by-Step Solution

1
Evaluate the cross-region application routing path for latency constraints.
Identify that VPC Peering provides direct, point-to-point cross-region routing without a transit hop, bypassing Transit Gateway peering to deliver the lowest latency and highest throughput.
Transit Gateway peering adds processing hops and data processing fees, whereas VPC Peering routes directly over the AWS backbone.
2
Design high availability for outbound internet egress.
Determine that a NAT Gateway must be deployed in each Availability Zone where private subnets are present (three NAT Gateways per VPC).
Configuring route tables to share a single NAT Gateway across multiple Availability Zones introduces a single point of failure in case of an AZ outage.
3
Address private hosted zone DNS resolution constraints.
Associate the Route 53 Private Hosted Zone (app.corp.internal) directly with App-VPC-US1, App-VPC-US2, and Shared-VPC-US1.
Route 53 Resolver Inbound Endpoints are not required and add latency. Direct association with VPCs is the native and recommended method to resolve a PHZ across multiple VPCs.
4
Design dynamic hybrid failover with backup paths.
Connect regional Transit Gateways (TGWs) to the Direct Connect Gateway (DXGW) using Transit VIFs, and run backup Site-to-Site VPN connections to the TGWs.
Direct Connect Gateway alone associated with VGWs does not support transitive routing or VPN backup failover patterns for multiple spoke VPCs.

Key Concept

Multi-region hybrid networking design balancing lowest latency (VPC Peering) with high availability (multi-AZ NAT Gateways, Transit Gateway for hybrid failover) and native DNS resolution (PHZ multi-VPC association).
Estimated Time:3m 0s
Question 896Question →

An enterprise reporting application runs on a fleet of Amazon EC2 instances in an Auto Scaling Group behind an Application Load Balancer (ALB). The application queries an Amazon RDS for PostgreSQL DB instance configured in a Multi-AZ deployment. At the start of every fiscal quarter, the number of concurrent users spikes from 100100 to over 50,00050,000 within a 55-minute window to run complex data extraction reports. During this peak window, the application experiences high latency and drops connections, resulting in `HTTP 504 Gateway Timeout` errors. CloudWatch metrics indicate that the RDS DB instance CPU utilization reaches 100%100\% due to read-heavy queries, while write IOPS remain negligible. The database storage is configured with a 2 TiB2\text{ TiB} General Purpose SSD (`gp3`) volume. Which strategy should a Solutions Architect implement to optimize the compute and storage layers to handle the quarterly spike with minimum latency and zero dropped requests?

Show answer & explanation

Answer: Migrate the RDS PostgreSQL database to Amazon Aurora PostgreSQL. Configure Aurora Auto Scaling to scale reader instances dynamically based on CPU utilization, and update the application to route read queries to the Aurora reader endpoint. Submit a support ticket to AWS Support to pre-warm the Application Load Balancer before the quarterly reporting window begins.

Answer

Migrate the RDS PostgreSQL database to Amazon Aurora PostgreSQL, configure Aurora Auto Scaling for reader instances, route read queries to the reader endpoint, and submit a support ticket to AWS Support to pre-warm the Application Load Balancer prior to the start of the quarterly reporting window.
Migrating to Amazon Aurora PostgreSQL allows the database layer to scale out read capacity horizontally using Aurora reader replicas. Configuring Aurora Auto Scaling enables the read capacity to dynamically match the query load. Updating the reporting application to use the reader endpoint routes the heavy read queries away from the writer instance, preserving its performance. Crucially, the sudden traffic surge from 100100 to 50,00050,000 concurrent users in 55 minutes constitutes a flash traffic event. While the Application Load Balancer scales automatically, it cannot scale fast enough to prevent connection failures during such a rapid spike. Pre-warming the Application Load Balancer by contacting AWS Support ensures that the ALB has sufficient capacity provisioned beforehand, avoiding HTTP 504 errors and dropped connections.

Step-by-Step Solution

1
Identify the database performance bottleneck.
The database bottleneck is caused by read-heavy queries reaching 100%100\% CPU utilization on the RDS primary instance.
To resolve this, we need to offload read queries to horizontal read replicas. RDS PostgreSQL supports read replicas, but migrating to Aurora PostgreSQL provides superior replication performance and native Auto Scaling for reader instances.
2
Address database read scaling and connection routing.
Migrate the database to Aurora PostgreSQL, configure reader instances with Aurora Auto Scaling, and update the application to use the reader endpoint.
This separates read and write traffic, ensuring that the primary database instance is not overwhelmed by the quarterly reporting queries.
3
Analyze the traffic pattern and network load balancing behavior.
A traffic spike from 100100 to 50,00050,000 concurrent users in 55 minutes is classified as a flash traffic event.
Standard Application Load Balancer auto-scaling is reactive and cannot scale up connection capacity rapidly enough to match this rate of increase, causing gateway timeouts.
4
Apply ALB capacity optimization.
Submit a request to AWS Support to pre-warm the Application Load Balancer before the reporting window starts.
Pre-warming provisions the necessary network and compute resources on the ALB in advance, allowing it to handle the immediate influx of connections without dropping requests.

Key Concept

Database read scaling via Aurora Replicas combined with Application Load Balancer pre-warming to mitigate flash traffic failures.
Estimated Time:3m 0s
Question 897Question →

An enterprise manages its applications using a multi-account AWS Organizations structure. A critical multi-tier application has its primary deployment in the us-east-1 Region under a Production Account, and its disaster recovery (DR) environment in the us-west-2 Region under a DR Account. The database tier consists of an Amazon Aurora PostgreSQL Global Database, with the primary cluster in us-east-1 and a secondary cluster in us-west-2. The enterprise has a target Recovery Time Objective (RTO) of 1515 minutes. During a recent DR drill, the solutions architect identified the following issues:
1. Internal microservices running in the us-west-2 VPC could not resolve the DNS names of internal dependencies defined in the Route 53 Private Hosted Zone (PHZ) hosted in the us-east-1 Production Account.
2. The database failover took longer than the RTO because it required manual database promotion and manual updates to the database connection string in the application configuration.

Which TWO actions should the solutions architect take to resolve these issues and meet the RTO? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a VPC association authorization for the us-west-2 VPC in the primary Production Account, and then associate the us-west-2 VPC with the Route 53 Private Hosted Zone using the AWS CLI or SDK from the DR Account.; Create a Route 53 CNAME record with a low Time to Live (TTL) of 1010 seconds pointing to the active Aurora regional cluster endpoint, and write an AWS Lambda function triggered by Amazon EventBridge to automate the promotion of the secondary Aurora cluster and update the CNAME record during a failover event.

Answer

The correct answer states that you must authorize and associate the Route 53 Private Hosted Zone from the Production Account with the VPC in the DR Account, and automate the Aurora Global Database failover and Route 53 CNAME updates using AWS Lambda and EventBridge.
To resolve the internal DNS resolution issue, a VPC association authorization must be created in the account hosting the Route 53 Private Hosted Zone (Production Account), followed by associating the VPC in the DR Account with that hosted zone. To automate the database failover and meet the 1515-minute RTO, the Solutions Architect should automate database promotion using the Aurora Global Database managed failover API via Lambda and EventBridge, and map the application database connection strings to a Route 53 CNAME record with a short TTL that points to the active regional cluster endpoint.

Step-by-Step Solution

1
Authorize VPC association across accounts
The Route 53 Private Hosted Zone in the Production Account permits association from the DR Account's VPC.
Before a Private Hosted Zone can be associated with a VPC in a different AWS account, the owner of the hosted zone must explicitly authorize the association.
2
Associate the secondary VPC with the Private Hosted Zone
Internal DNS records in the Private Hosted Zone resolve correctly within the secondary VPC in us-west-2.
This establishes cross-account private DNS resolution so that secondary microservices can locate dependencies.
3
Create an EventBridge rule and Lambda function for database failover orchestration
Automated promotion of the secondary Aurora database cluster during failovers.
Manual database promotion is too slow and violates the 1515-minute RTO; automation is required to meet the goal.
4
Configure a low-TTL CNAME record pointing to the active regional Aurora writer endpoint
Applications dynamically resolve the active writer endpoint within seconds after failover without manual config updates.
Low TTL prevents DNS caching delays and eliminates the need to update database connection strings on the application servers.

Key Concept

Cross-account Route 53 Private Hosted Zone association and automated database DR failover orchestration.
Question 898Question →

A financial services firm is building a new multi-account landing zone on AWS in the us-east-1 Region. The architecture requires connecting two spoke VPCs, Retail-App-VPC (Account A) and Wholesale-App-VPC (Account B), to a central hub VPC named Transit-Core-VPC (Account C) using an AWS Transit Gateway. Spoke-to-spoke IP routing between Retail-App-VPC and Wholesale-App-VPC is strictly prohibited due to compliance regulations.

All outbound internet traffic from the private subnets of both spoke VPCs must be inspected through a cluster of security firewalls hosted in Transit-Core-VPC. A 10 Gbps10\text{ Gbps} AWS Direct Connect connection terminates at an on-premises data center and is attached to a Direct Connect Gateway associated with the Transit Gateway. Additionally, DNS resolution must be configured such that resources in the spoke VPCs can resolve on-premises services in the corp.internal domain, while on-premises servers and the spoke VPCs must be able to resolve resource records in a Route 53 Private Hosted Zone (PHZ) for aws.platform.internal hosted in Account C.

Which of the following designs meets these requirements while ensuring maximum availability, preventing single points of failure, and minimizing operational and data transfer overhead?

Show answer & explanation

Answer: Deploy an AWS Transit Gateway and attach Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC. Configure two Transit Gateway route tables: one associated with the spoke VPCs directing 0.0.0.0/00.0.0.0/0 traffic to the Transit-Core-VPC attachment, and another associated with Transit-Core-VPC routing traffic back to the spokes. In Transit-Core-VPC, deploy NAT Gateways across multiple Availability Zones, and configure a dedicated route table for each Transit Gateway subnet attachment that routes 0.0.0.0/00.0.0.0/0 to the NAT Gateway in the same Availability Zone. Associate the aws.platform.internal Private Hosted Zone with Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC. Deploy Route 53 Resolver inbound and outbound endpoints across multiple Availability Zones in Transit-Core-VPC, and associate the outbound Resolver forwarding rules with all three VPCs.

Answer

Deploy an AWS Transit Gateway and attach all three VPCs. Configure Spoke and Hub Transit Gateway route tables to isolate spoke-to-spoke traffic while routing egress traffic to the hub. In the hub VPC, deploy NAT Gateways across multiple Availability Zones and configure dedicated route tables for each Transit Gateway subnet attachment to route default traffic locally to the NAT Gateway in the same zone. Explicitly associate the Private Hosted Zone with all three VPCs and configure Route 53 Resolver inbound and outbound endpoints across multiple Availability Zones.
The correct design uses Transit Gateway route tables to segment spoke-to-spoke traffic while routing outbound internet traffic to the central hub VPC. By deploying NAT Gateways across multiple Availability Zones in the central VPC and routing traffic from each Transit Gateway subnet attachment to its local NAT Gateway, Availability Zone redundancy is preserved, preventing a single point of failure and avoiding cross-AZ data transfer fees. Finally, associating the Private Hosted Zone with all three VPCs is required for private resolution across accounts, and Route 53 Resolver inbound and outbound endpoints facilitate hybrid resolution.

Step-by-Step Solution

1
Configure Transit Gateway routing to segregate spoke traffic and allow hub egress.
Create Spoke-TGW-RT and Hub-TGW-RT. Spoke-TGW-RT routes 0.0.0.0/00.0.0.0/0 to the hub VPC attachment and has no routes to other spokes, preventing spoke-to-spoke communication.
Ensures compliance requirements are met by isolating the spokes while forwarding egress traffic to the central security hub.
2
Design highly available egress within the Transit-Core-VPC using multi-AZ NAT Gateways.
Deploy NAT Gateways in multiple Availability Zones. Configure TGW subnet attachment route tables to route 0.0.0.0/00.0.0.0/0 to the NAT Gateway in the same Availability Zone.
Avoids cross-AZ data transfer fees and prevents a single Availability Zone outage from impacting outbound traffic across the entire architecture.
3
Configure Private Hosted Zone DNS associations.
Associate the aws.platform.internal Private Hosted Zone in Account C with Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC.
Route 53 Private Hosted Zones do not support transitive resolution across Transit Gateway attachments; they must be explicitly associated with each VPC requiring DNS resolution.
4
Establish hybrid DNS resolution via Route 53 Resolver endpoints.
Deploy Resolver inbound endpoints for on-premises DNS forwarding, and Resolver outbound endpoints with forwarding rules for corp.internal associated with all three VPCs.
Allows bi-directional DNS resolution between the on-premises network and the AWS VPCs over the AWS Direct Connect connection.

Key Concept

Multi-VPC hybrid routing and DNS resolution using Transit Gateway, multi-AZ NAT Gateways, and Route 53 Private Hosted Zone associations.
Estimated Time:3m 0s
Question 899Question →

An enterprise operates a high-volume microservices application running on a fleet of Amazon EC2 instances in an Auto Scaling group within a Production AWS account. The instances run the Unified CloudWatch Agent to collect application logs from `/var/log/app/output.log`. The logs undergo hourly rotation, where the active file is renamed to `/var/log/app/output.log.YYYY-MM-DD-HH` and a new empty `/var/log/app/output.log` is created.

To improve operational excellence, a Solutions Architect must centralize these logs into a CloudWatch log group in a dedicated Security account. The architecture must guarantee zero log loss during rotation, prevent duplicate ingestion of historical log lines, and secure the logs in transit and at rest using a customer-managed KMS key in the Security account.

Which of the following configurations meets these requirements with the least operational complexity?

Show answer & explanation

Answer: Configure the CloudWatch agent with the wildcard path `/var/log/app/output.log*` and specify a cross-account IAM role ARN in the agent's credentials configuration. Grant the cross-account role permissions to write to the central log group and access the customer-managed KMS key in the Security account.

Answer

Configure the CloudWatch agent with the wildcard path `/var/log/app/output.log*` and specify a cross-account IAM role ARN in the agent's credentials configuration. Grant the cross-account role permissions to write to the central log group and access the customer-managed KMS key in the Security account.
The correct configuration uses the wildcard path to ensure that both the active log file and any recently rotated hourly log files are scanned. By utilizing the credentials feature in the Unified CloudWatch Agent, the agent can assume the target IAM role in the Security account directly to execute `PutLogEvents`. A customer-managed KMS key is required because its key policy can be modified to grant the cross-account role permissions to decrypt and encrypt logs.

Step-by-Step Solution

1
Select the correct log path pattern in the CloudWatch agent config.
Using `/var/log/app/output.log*` allows the agent to monitor active and rotated logs simultaneously. The agent tracks state using file inodes to avoid duplicate ingestion.
Static paths like `/var/log/app/output.log` will fail to track logs written to the rotated file if there is any delay in delivery or if the agent restarts.
2
Configure cross-account log delivery in the Unified CloudWatch Agent.
The agent assumes the designated IAM role in the Security account using the credentials configuration.
This avoids having to route logs through a local log group and subscription filters, simplifying the architecture.
3
Ensure encryption compatibility for cross-account access.
Use a customer-managed KMS key in the Security account and update its key policy to allow the assumed cross-account IAM role to use the key.
AWS-managed KMS keys do not support policy modifications and cannot be used for cross-account delivery.

Key Concept

Unified CloudWatch Agent log path wildcarding and cross-account KMS key policy delegation.
Estimated Time:3m 0s
Question 900Question →

A company is improving the monitoring and auditing of its AWS environment. The company has a multi-account structure managed under AWS Organizations. An application running on Amazon EC2 instances in a member account writes logs to `/var/log/app/app.log`, which are rotated hourly. Additionally, the company needs to centralize CloudTrail logs from all member accounts into a single Amazon S3 bucket located in a central security account.

Which of the following actions should the Solutions Architect take to configure these logging requirements correctly? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the CloudWatch agent on the EC2 instances using a wildcard in the file_path pattern, such as `/var/log/app/app.log*`, to capture rotated log files.; Configure the S3 bucket policy in the security account to grant the `s3:PutObject` permission to the AWS CloudTrail service principal, specifying conditions for the AWS Organization ID.

Answer

To capture rotated application logs, configure the CloudWatch agent with a wildcard pattern (e.g., `/var/log/app/app.log*`). To allow cross-account CloudTrail log delivery, configure the S3 bucket policy in the destination account to grant write permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`) and restrict access using the Organization ID condition.
To ensure continuous log collection after log rotation on Amazon EC2, the CloudWatch agent config must use wildcard patterns (e.g., `/var/log/app/app.log*`) so it matches newly rotated files. For centralizing CloudTrail logs across an organization to a single S3 bucket, the S3 bucket policy in the destination account must explicitly permit the CloudTrail service principal (`cloudtrail.amazonaws.com`) to write logs, restricted by the AWS Organization ID.

Step-by-Step Solution

1
Analyze the log rotation behavior on the EC2 instances.
Since the logs at `/var/log/app/app.log` are rotated hourly, they will be renamed. A static path configuration will fail to match rotated files.
Ensures that log collection is continuous across file rotations.
2
Select the correct CloudWatch agent file path pattern.
A wildcard pattern `/var/log/app/app.log*` is specified in the agent's configuration file.
Allows the agent to find and upload rotated logs.
3
Determine how CloudTrail delivers logs to S3.
CloudTrail uses the service principal `cloudtrail.amazonaws.com` rather than IAM roles from individual member accounts to write logs.
Required to design the correct IAM policy statements.
4
Configure the S3 bucket policy in the security account.
Grant `s3:PutObject` permissions to `cloudtrail.amazonaws.com` with a condition evaluating `aws:PrincipalOrgID`.
Secures the central logging bucket while allowing all organization accounts to deliver logs.

Key Concept

Continuous monitoring and log centralization require proper path wildcards for rotated files and appropriate resource-based policies for AWS service principals.
PreviousPage 45 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin