All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

An enterprise is reviewing its existing AWS network setup to optimize performance and latency. The architecture consists of multiple VPCs, including a shared services VPC containing a Route 53 Private Hosted Zone (PHZ) for internal service discovery. The instances in the private subnets of a new application VPC need to download software updates from the internet and resolve DNS names hosted in the shared services VPC. Currently, they experience high inter-zone latency and name resolution failures. Which two actions should the solutions architect take to resolve these issues and optimize performance?

Select all that apply

Deploy a NAT Gateway in each Availability Zone and configure the route tables of the private subnets to route outbound traffic through the NAT Gateway in their respective zone.

Associate the Route 53 Private Hosted Zone of the shared services VPC with the new application VPC to allow local, low-latency DNS resolution.

Configure all private subnets across multiple Availability Zones to route outbound internet traffic through a single NAT Gateway deployed in a single Availability Zone to reduce costs.

Establish VPC peering between the VPCs and rely on the default VPC DNS server without associating the Route 53 Private Hosted Zone with the new application VPC.

Configure a Direct Connect gateway to route transitive traffic directly between the VPCs to handle internal service name resolution and data transfer.

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone and configure the route tables of the private subnets to route outbound traffic through the NAT Gateway in their respective zone.; Associate the Route 53 Private Hosted Zone of the shared services VPC with the new application VPC to allow local, low-latency DNS resolution.

Answer

Deploy a NAT Gateway in each Availability Zone and associate the Route 53 Private Hosted Zone of the shared services VPC with the new application VPC.

Deploying a NAT Gateway in each Availability Zone ensures that outbound traffic stays within the same zone, eliminating cross-AZ latency and improving overall performance and availability. Explicitly associating the Route 53 Private Hosted Zone of the shared services VPC with the new application VPC allows resources in the application VPC to perform local and low-latency DNS resolution for internal services.

Step-by-Step Solution

Analyze outbound internet traffic performance and latency issues.

Identified that routing traffic across Availability Zones to a single NAT Gateway introduces cross-AZ latency and data transfer costs, while posing a single point of failure risk.

To optimize performance, outbound traffic should remain local to the active Availability Zone by using dedicated NAT Gateways.

Analyze internal service name resolution failure.

Recognized that DNS resolution for a Route 53 Private Hosted Zone (PHZ) does not extend transitively to other VPCs unless the hosted zone is explicitly associated with them.

Associating the PHZ with the new VPC enables local DNS resolution of the shared service domain names.

Key Concept

Optimizing multi-VPC network latency and redundancy by utilizing local NAT Gateways per Availability Zone and associating Route 53 Private Hosted Zones with consumer VPCs.

Question 902Question →

A company is designing a new application environment on AWS. The application consists of workloads running in private subnets across two Availability Zones (us-east-1a and us-east-1b) in VPC-A. The workloads in VPC-A must access external updates from the internet securely and also resolve private domain names hosted in a Route 53 Private Hosted Zone in VPC-B. VPC-A and VPC-B are connected using an AWS Transit Gateway. Which two configuration steps should the solutions architect perform to establish secure, redundant internet egress and private DNS resolution? (Select TWO.)

Select all that apply

Deploy a NAT Gateway in a public subnet in us-east-1a and a second NAT Gateway in a public subnet in us-east-1b. Configure the route table of each private subnet to direct outbound 0.0.0.0/0 traffic to the NAT Gateway in its respective Availability Zone.

Associate the Route 53 Private Hosted Zone in VPC-B with VPC-A, and verify that DNS resolution and DNS hostnames are enabled for VPC-A.

Deploy a single NAT Gateway in a public subnet in us-east-1a. Configure a single route table shared across both private subnets in us-east-1a and us-east-1b to route outbound 0.0.0.0/0 traffic to this NAT Gateway.

Configure Transit Gateway route tables to route all outbound internet traffic from VPC-A through a Direct Connect Gateway associated with VPC-B.

Set up a Route 53 Resolver outbound endpoint in VPC-B and a Route 53 Resolver inbound endpoint in VPC-A to forward and resolve private DNS queries between the VPCs.

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet in us-east-1a and a second NAT Gateway in a public subnet in us-east-1b. Configure the route table of each private subnet to direct outbound 0.0.0.0/0 traffic to the NAT Gateway in its respective Availability Zone.; Associate the Route 53 Private Hosted Zone in VPC-B with VPC-A, and verify that DNS resolution and DNS hostnames are enabled for VPC-A.

Answer

Deploy a NAT Gateway in each Availability Zone and associate VPC-A's private route tables to their local NAT Gateway, then associate the Route 53 Private Hosted Zone in VPC-B directly with VPC-A.

Deploying a NAT Gateway in each Availability Zone avoids cross-AZ dependencies and ensures egress redundancy. For private DNS resolution within AWS, associating the Route 53 Private Hosted Zone from VPC-B with VPC-A directly resolves queries across the VPC boundaries without extra infrastructure.

Step-by-Step Solution

Address high availability requirements for outbound internet traffic.

Deploy one NAT Gateway per Availability Zone (us-east-1a and us-east-1b) in public subnets, and configure separate private route tables mapping 0.0.0.0/0 to the local zone's NAT Gateway.

Ensures that Availability Zone failures do not cause a complete loss of internet egress for workloads in the surviving zone.

Address cross-VPC private DNS resolution requirements.

Associate the Route 53 Private Hosted Zone belonging to VPC-B with VPC-A.

Allows instances in VPC-A to resolve private domain names defined in VPC-B directly, without needing to route queries through costly and complex resolver endpoints.

Key Concept

High availability network egress design using multi-AZ NAT Gateways combined with cross-VPC Route 53 Private Hosted Zone association.

Question 903Question →

A company hosts a high-frequency flash sale application on a fleet of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application data is stored in an Amazon RDS for MySQL Multi-AZ DB instance. During scheduled weekly flash sales, traffic surges instantly by $300\%$ within two minutes. During these peaks, users experience HTTP 503 Service Unavailable errors, and database read response times increase significantly. A Solutions Architect needs to optimize both compute and storage performance to handle the next flash sale without service degradation.

Which combination of actions should the Solutions Architect take to address these performance issues? (Select TWO.)

Select all that apply

Migrate the database to Amazon Aurora MySQL, deploy Aurora Replicas, and configure Aurora Auto Scaling to dynamically adjust the number of replicas.

Request AWS Support to pre-warm the Application Load Balancer to the expected capacity prior to the scheduled flash sales.

Configure the application to route read queries to the standby replica instance of the Amazon RDS MySQL Multi-AZ deployment during peak traffic.

Rely on the Application Load Balancer's automatic scaling metrics to dynamically provision capacity during the flash sale traffic spike.

Deploy an Amazon ElastiCache for Memcached cluster to act as a persistent database replication target and cache transactional data.

Show answer & explanation

Answer: Migrate the database to Amazon Aurora MySQL, deploy Aurora Replicas, and configure Aurora Auto Scaling to dynamically adjust the number of replicas.; Request AWS Support to pre-warm the Application Load Balancer to the expected capacity prior to the scheduled flash sales.

Answer

Migrate the database to Amazon Aurora MySQL with Aurora Auto Scaling and request AWS Support to pre-warm the Application Load Balancer before the sale.

Pre-warming the Application Load Balancer handles sudden, massive traffic spikes that exceed standard automatic scaling rates. Migrating to Amazon Aurora MySQL allows read workloads to be distributed across multiple Aurora Replicas that scale dynamically with Auto Scaling, resolving the storage bottleneck.

Step-by-Step Solution

Analyze the load balancer scaling limitation.

The Application Load Balancer cannot scale quickly enough to handle the sudden

300\%

increase in traffic within two minutes, which triggers HTTP 503 errors.

Determine the need to pre-warm the ALB to ensure capacity is available prior to the scheduled flash sale.

Analyze the database read performance constraint.

The primary database experiences high read latency, and the RDS Multi-AZ standby cannot be used for read scaling.

Identify the need to migrate to Amazon Aurora MySQL to use active Aurora Replicas and leverage auto-scaling to distribute read loads.

Combine the compute and storage tier optimizations.

Pre-warming the ALB resolves the ingress routing limit, and migrating to Aurora with replica scaling resolves the read performance limit.

Ensure a comprehensive architecture that prevents bottlenecking at both the load balancing and storage layers.

Key Concept

Optimizing compute scaling limits using ALB pre-warming and database read capacity scaling using Amazon Aurora Replicas.

Question 904Question →

An enterprise is designing a high-performance network topology to connect its on-premises corporate offices to three VPCs in the `eu-west-1` Region: a shared services VPC and two application spoke VPCs. The architecture requires resilient, private, bidirectional connectivity between the on-premises networks and all VPCs, as well as private DNS resolution. Specifically, DNS queries for the private on-premises domain `corp.internal` must resolve from the application spoke VPCs, and DNS queries for the AWS private domain `aws.internal` must resolve from the on-premises network. The design must also enforce that outbound internet egress from the spoke VPCs is centralized through a firewall cluster in the shared services VPC.

Which of the following configurations should the solutions architect implement to satisfy these requirements? (Select TWO.)

Select all that apply

Deploy an AWS Transit Gateway, and attach the shared services VPC and both application spoke VPCs to it. Establish a Transit Virtual Interface (Transit VIF) on the Direct Connect connection, associate it with a Direct Connect Gateway, and attach the Direct Connect Gateway to the Transit Gateway. In the application spoke VPC route tables, route default traffic (0.0.0.0/0) to the Transit Gateway.

Create the Route 53 Private Hosted Zone aws.internal and associate it with all three VPCs. Deploy Route 53 Resolver inbound endpoints in the shared services VPC to receive queries from the on-premises DNS servers. Deploy Route 53 Resolver outbound endpoints in the shared services VPC, create a forwarding rule for corp.internal pointing to the on-premises DNS servers, and associate this rule with all three VPCs.

Create the Route 53 Private Hosted Zone aws.internal and associate it only with the shared services VPC. Deploy Route 53 Resolver inbound endpoints in the shared services VPC. Configure a custom DHCP options set in the application spoke VPCs pointing to the inbound endpoint IP addresses to enable DNS resolution of the private domain.

Establish a Private Virtual Interface (Private VIF) on the Direct Connect connection, associate it with a Direct Connect Gateway, and attach the Direct Connect Gateway directly to all three VPCs. Configure the Direct Connect Gateway to route traffic between the spoke VPCs and to route outbound internet traffic through the shared services VPC.

Deploy a single NAT Gateway in a public subnet of the shared services VPC. Configure the application spoke VPC route tables to route all outbound internet traffic to the Transit Gateway, and configure a single Transit Gateway route table to direct all default route (0.0.0.0/0) traffic to the NAT Gateway.

Show answer & explanation

Answer: Deploy an AWS Transit Gateway, and attach the shared services VPC and both application spoke VPCs to it. Establish a Transit Virtual Interface (Transit VIF) on the Direct Connect connection, associate it with a Direct Connect Gateway, and attach the Direct Connect Gateway to the Transit Gateway. In the application spoke VPC route tables, route default traffic (0.0.0.0/0) to the Transit Gateway.; Create the Route 53 Private Hosted Zone aws.internal and associate it with all three VPCs. Deploy Route 53 Resolver inbound endpoints in the shared services VPC to receive queries from the on-premises DNS servers. Deploy Route 53 Resolver outbound endpoints in the shared services VPC, create a forwarding rule for corp.internal pointing to the on-premises DNS servers, and associate this rule with all three VPCs.

Answer

Deploy an AWS Transit Gateway, connect the spoke and shared services VPCs, and associate it with a Direct Connect Gateway using a Transit VIF. Additionally, associate the Private Hosted Zone with all three VPCs, and set up Route 53 Resolver inbound and outbound endpoints with forwarding rules associated with the VPCs.

To connect multiple VPCs transitively to an on-premises data center over AWS Direct Connect, a Transit Gateway must be used in conjunction with a Direct Connect Gateway and a Transit VIF. Additionally, Route 53 Private Hosted Zones must be associated with all VPCs that need to resolve the records. Deploying inbound and outbound Route 53 Resolver endpoints in the shared services VPC allows bidirectional DNS resolution between the on-premises network and AWS.

Step-by-Step Solution

Analyze hybrid connectivity requirements and select the appropriate AWS Direct Connect configuration.

Determine that an AWS Transit Gateway combined with a Direct Connect Gateway and a Transit VIF is required to support transitive routing between multiple VPCs and the on-premises network.

Direct Connect Gateway alone cannot route traffic transitively between VPCs or support centralized egress, and Transit Gateway requires a Transit VIF.

Analyze private DNS resolution requirements between the on-premises network and AWS VPCs.

Establish Route 53 Resolver inbound endpoints for on-premises-to-AWS queries, outbound endpoints with forwarding rules for AWS-to-on-premises queries, and associate the Private Hosted Zone with all three VPCs.

AWS Private Hosted Zones are not transitively resolvable and must be explicitly associated with each consumer VPC, and Resolver endpoints are required to bridge hybrid DNS resolution.

Evaluate resiliency requirements for centralized outbound internet traffic.

Determine that deploying NAT Gateways across multiple Availability Zones in the shared services VPC is required to avoid a single point of failure.

A single NAT Gateway in one Availability Zone represents a single point of failure, violating the resiliency constraints of the scenario.

Key Concept

Designing highly resilient hybrid network architectures with centralized egress and bidirectional DNS resolution across multiple VPCs.

Question 905Question →

A solutions architect is auditing a multi-account AWS environment to strengthen identity and access controls. A new member AWS account is placed under an Organizational Unit (OU) that has a Service Control Policy (SCP) attached. The SCP explicitly allows only read and write actions for Amazon S3. The administrator expects the IAM users in the member account to immediately have access to Amazon S3, but the users receive 'Access Denied' errors when attempting to list S3 buckets. Which of the following explains why the users cannot access Amazon S3?

Service Control Policies establish permission boundaries by filtering permissions but do not grant access directly; the users must also be granted permission by local IAM policies.

The SCP automatically grants S3 permissions, but the default implicit deny in the member account's root user account policy overrides the SCP permissions.

The S3 buckets are encrypted using AWS-managed KMS keys, which cannot be accessed by IAM users in member accounts unless the key policy is explicitly modified to delegate trust.

The IAM users are attempting to access the S3 buckets through an interface VPC endpoint, and the Route 53 Private Hosted Zone for S3 has not been associated with the member account's VPC.

Show answer & explanation

Answer: Service Control Policies establish permission boundaries by filtering permissions but do not grant access directly; the users must also be granted permission by local IAM policies.

Answer

Service Control Policies establish permission boundaries by filtering permissions but do not grant access directly; the users must also be granted permission by local IAM policies.

The correct option is that Service Control Policies establish permission boundaries by filtering permissions but do not grant access directly, requiring local IAM policies to grant permissions. In AWS Organizations, access is only permitted if it is allowed by both the SCP and the identity-based policy. The SCP acts as a filter, while the IAM policy acts as the grant.

Step-by-Step Solution

Analyze how Service Control Policies (SCPs) function within AWS Organizations.

SCPs act as a filter to define the maximum allowed permissions for accounts within an OU. They do not grant permissions directly to IAM users, groups, or roles.

Understanding the inheritance and boundary nature of SCPs is critical to troubleshooting multi-account access control.

Determine the local configuration requirements in the member account.

To access S3, the IAM users must have local IAM policies attached that explicitly grant them the necessary S3 permissions.

An identity-based policy is required to grant the actual access, which is then restricted (or filtered) by the boundary set by the SCP.

Key Concept

SCPs act as permission guardrails or filters rather than permission grants. Access is only allowed when both the SCP and the local IAM policy explicitly permit the action.

Question 906Question →

An enterprise has a web application running in a single AWS Region. The application uses an Amazon RDS for PostgreSQL database and an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer. The Solutions Architect needs to configure a Pilot Light disaster recovery (DR) strategy in a secondary Region. The company requires a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 4 hours. Which of the following actions should the Solutions Architect take to meet these requirements at the lowest cost? (Select TWO.)

Select all that apply

Create a cross-Region Read Replica of the primary database instance in the secondary Region.

Deploy the application tier using AWS CloudFormation in the secondary Region, keeping the Auto Scaling group's desired capacity set to zero.

Use AWS Backup to take daily snapshots of the database, copy them to the secondary Region, and restore the database from the snapshots during failover.

Configure an Amazon Route 53 active-active weighted routing policy directing traffic to both regions without attaching health checks to the records.

Create a Route 53 Private Hosted Zone for the database domain name in the primary Region VPC, but do not associate it with the secondary Region VPC.

Show answer & explanation

Answer: Create a cross-Region Read Replica of the primary database instance in the secondary Region.; Deploy the application tier using AWS CloudFormation in the secondary Region, keeping the Auto Scaling group's desired capacity set to zero.

Answer

Create a cross-Region Read Replica of the primary database instance in the secondary Region, and deploy the application tier using AWS CloudFormation in the secondary Region, keeping the Auto Scaling group's desired capacity set to zero.

The correct architecture uses a Pilot Light DR pattern. This is accomplished by setting up a cross-Region Read Replica of the RDS database to maintain continuous replication (RPO < 1 hour) and preparing the application environment using CloudFormation templates with the Auto Scaling group scaled to zero capacity. This ensures no compute costs are incurred in the disaster recovery region until a failover event occurs, which can be accomplished well within the 4-hour RTO window.

Step-by-Step Solution

Select a replication mechanism that supports an RPO of 1 hour for the database tier.

Establish a cross-Region Read Replica of the RDS PostgreSQL database in the secondary Region to enable continuous asynchronous replication.

This keeps data replication latency very low (typically seconds to minutes) and easily satisfies the 1-hour RPO requirement.

Determine the application tier deployment strategy to meet the 4-hour RTO at the lowest cost.

Deploy the compute infrastructure using CloudFormation with the Auto Scaling group desired capacity set to 0.

This implements the 'pilot light' pattern where the application tier does not consume active running resources (saving costs) but can be scaled up within minutes during a failover, meeting the 4-hour RTO.

Key Concept

The Pilot Light disaster recovery pattern uses continuous database replication with dormant application infrastructure to achieve low RTO and RPO objectives cost-effectively.

Estimated Time:2m 0s

Question 907Question →

A company runs a high-traffic e-commerce application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application reads and writes data to an Amazon Aurora MySQL DB cluster. During seasonal sales events, the application experiences sudden spikes in traffic, leading to CPU exhaustion on the EC2 instances and increased read replication lag on the Aurora database due to a surge in read queries. Which combination of actions should a solutions architect implement to optimize compute and storage performance? (Select TWO.)

Select all that apply

Deploy Amazon Aurora Replicas in the DB cluster and configure Aurora Auto Scaling to dynamically add reader instances as read demand increases.

Transition the EC2 instances to a compute-optimized instance family and configure a target tracking scaling policy based on average CPU utilization.

Enable Amazon RDS Multi-AZ replication and configure the Application Load Balancer to route read traffic directly to the standby DB instance.

Submit a request to AWS Support to pre-warm the Application Load Balancer to resolve the CPU exhaustion on the backend EC2 instances.

Configure the Auto Scaling group cooldown period to be shorter than the instance boot time to speed up the launch of new compute resources.

Show answer & explanation

Answer: Deploy Amazon Aurora Replicas in the DB cluster and configure Aurora Auto Scaling to dynamically add reader instances as read demand increases.; Transition the EC2 instances to a compute-optimized instance family and configure a target tracking scaling policy based on average CPU utilization.

Answer

Deploy Amazon Aurora Replicas in the DB cluster and configure Aurora Auto Scaling to dynamically add reader instances as read demand increases. Transition the EC2 instances to a compute-optimized instance family and configure a target tracking scaling policy based on average CPU utilization.

The correct options recommend deploying Aurora Replicas with Auto Scaling to handle the database read load, and migrating the EC2 instances to compute-optimized instance types with target tracking policies to handle the compute load.

Step-by-Step Solution

Analyze the compute bottleneck

Identify that the EC2 instances are experiencing CPU exhaustion during traffic spikes, requiring a transition to compute-optimized instances and a proper scaling policy.

Compute-optimized instances provide better CPU-to-memory ratios for processing-heavy workloads, and target tracking scaling allows the Auto Scaling group to scale dynamically.

Analyze the database storage and read bottleneck

Identify that read replication lag increases due to high read query volume, which can be resolved by scaling readers horizontally using Aurora Replicas.

Aurora Auto Scaling adds reader instances to handle read queries, distributing the load and keeping replication lag low.

Key Concept

Scaling compute resources using target tracking and scaling database read capacity using Aurora Replicas with Auto Scaling.

Question 908Question →

An enterprise is designing a new VPC named `Production-VPC` in the `us-east-1` Region to host a web application across two Availability Zones, `us-east-1a` and `us-east-1b`. EC2 instances in the private subnets of both zones require outbound internet access to download software updates, but they must not be directly reachable from the internet. The solution must be highly resilient to Availability Zone outages and minimize operational overhead.

Which of the following configuration steps should the Solutions Architect perform to meet these requirements? (Select TWO.)

Select all that apply

Deploy a NAT Gateway named `nat-gw-az1` in a public subnet in `us-east-1a`, and configure the route table of the private subnet in `us-east-1a` with a route of `0.0.0.0/0` pointing to `nat-gw-az1`.

Deploy a NAT Gateway named `nat-gw-az2` in a public subnet in `us-east-1b`, and configure the route table of the private subnet in `us-east-1b` with a route of `0.0.0.0/0` pointing to `nat-gw-az2`.

Deploy a single NAT Gateway named `nat-gw-central` in a public subnet in `us-east-1a`, and configure the route tables of the private subnets in both `us-east-1a` and `us-east-1b` to point outbound traffic to `nat-gw-central`.

Deploy an AWS Transit Gateway named `tgw-egress`, configure it to route all outbound internet traffic from both private subnets directly to the internet, and associate the Transit Gateway with an Internet Gateway.

Configure a Route 53 Private Hosted Zone named `internal.updates` to resolve external repositories, and configure the private subnets' route tables to point outbound traffic directly to the Route 53 Resolver.

Show answer & explanation

Answer: Deploy a NAT Gateway named `nat-gw-az1` in a public subnet in `us-east-1a`, and configure the route table of the private subnet in `us-east-1a` with a route of `0.0.0.0/0` pointing to `nat-gw-az1`.; Deploy a NAT Gateway named `nat-gw-az2` in a public subnet in `us-east-1b`, and configure the route table of the private subnet in `us-east-1b` with a route of `0.0.0.0/0` pointing to `nat-gw-az2`.

Answer

Deploy two independent NAT Gateways (one in each Availability Zone) and configure the route tables of each private subnet to point outbound traffic to the local NAT Gateway in their respective Availability Zone.

The correct solution involves deploying a NAT Gateway in a public subnet in each Availability Zone and pointing the default route (0.0.0.0/0) of each private subnet to its local NAT Gateway. This ensures high availability because if one Availability Zone experiences an outage, outbound connectivity for the other Availability Zone is completely unaffected, satisfying the requirement to be highly resilient to AZ outages with minimal operational overhead.

Step-by-Step Solution

Analyze the requirements for high availability and zero direct inbound access.

Identified the need for NAT devices to translate private IP addresses for outbound-only internet communication without allowing direct inbound connections.

NAT Gateways are AWS-managed services that meet these criteria with low operational overhead.

Analyze the resiliency requirement against Availability Zone outages.

Determined that a NAT Gateway is redundant within a single zone but is a single point of failure if that zone fails.

To ensure AZ-resiliency, a separate NAT Gateway must be deployed in each of the active Availability Zones.

Configure the VPC route tables for the private subnets.

Updated the route table of the private subnet in the first Availability Zone to point its default route (0.0.0.0/0) to the NAT Gateway in the same zone, and repeated the configuration for the second Availability Zone.

This isolates the failure domain of each zone's outbound path to that zone itself.

Key Concept

Designing highly available outbound VPC internet connectivity using multi-AZ NAT Gateways to avoid single points of failure.

Question 909Question →

A financial services firm hosts a critical transactional application on AWS. The application runs on Amazon ECS tasks on AWS Fargate in the us-east-1 Region, across three Availability Zones. The tasks connect to an Amazon Aurora MySQL database cluster in the same Region. Outbound traffic to external payment processors is routed through a single NAT Gateway located in one of the public subnets.

The firm needs to enhance the reliability of the system and establish a disaster recovery (DR) strategy in the us-west-2 Region. The DR solution must support a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. Additionally, the outbound connectivity in the primary Region must be highly resilient against Availability Zone failures.

Which TWO actions should the Solutions Architect take to meet these requirements?

Select all that apply

Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Pre-deploy the Amazon ECS tasks on AWS Fargate in us-west-2 at a minimum scale, and set up Amazon Route 53 Application Recovery Controller (ARC) routing controls to manage failover.

Deploy a NAT Gateway in each Availability Zone within the primary Region, and update the private subnet route tables to route outbound internet traffic through the NAT Gateway in their respective Availability Zone.

Set up a cross-Region Aurora replica in the secondary Region, and schedule daily database backups. Upon failover, restore the database from the backup to achieve the lowest cost solution.

Implement a Route 53 active-passive failover routing policy pointing to Application Load Balancers in both Regions, disabling Route 53 health checks on the primary record to prevent false failover triggers.

Maintain the single NAT Gateway configuration in the primary Region, and configure all private subnet route tables to use this gateway to simplify network architecture and reduce costs.

Deploy a Route 53 Private Hosted Zone for database endpoint resolution, but do not associate it with the standby VPC in us-west-2 to avoid cross-VPC DNS resolution overhead.

Show answer & explanation

Answer: Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Pre-deploy the Amazon ECS tasks on AWS Fargate in us-west-2 at a minimum scale, and set up Amazon Route 53 Application Recovery Controller (ARC) routing controls to manage failover.; Deploy a NAT Gateway in each Availability Zone within the primary Region, and update the private subnet route tables to route outbound internet traffic through the NAT Gateway in their respective Availability Zone.

Answer

The correct options are deploying a NAT Gateway in each Availability Zone within the primary Region to remove the single point of failure, and configuring an Amazon Aurora Global Database with pre-deployed ECS tasks on Fargate at a minimum scale in the secondary Region managed by Route 53 ARC to meet the RTO/RPO targets.

Deploying a NAT Gateway per Availability Zone removes the single point of failure in the primary Region's outbound traffic. Implementing Amazon Aurora Global Database alongside pre-deployed ECS tasks in the secondary Region ensures RPO is under 1 second and RTO is under 15 minutes, with Route 53 ARC providing controlled and fast failover orchestration.

Step-by-Step Solution

Address the single point of failure in the outbound path within the primary Region.

Identify that the single NAT Gateway in us-east-1 is a bottleneck and risk. To achieve resiliency against Availability Zone failures, deploy a NAT Gateway in each Availability Zone and associate them with the respective private subnet route tables.

This isolates Availability Zone failures and ensures outbound internet traffic continues flowing from the remaining healthy zones.

Select a database disaster recovery pattern that meets the 5-minute RPO.

Choose Amazon Aurora Global Database, which replicates data asynchronously to the secondary Region with typical lag of less than 1 second.

This comfortably satisfies the RPO requirement of 5 minutes without the data loss associated with daily backups.

Select a compute disaster recovery pattern that meets the 15-minute RTO.

Pre-deploy the ECS Fargate tasks at a minimum scale in the secondary Region and use Route 53 ARC for rapid failover routing.

Pre-deploying the ECS tasks allows the compute layer to scale out rapidly rather than starting from scratch, fitting the tight 15-minute RTO.

Key Concept

Enhancing existing infrastructure reliability requires eliminating single points of failure (such as single NAT Gateways) and using multi-region database replication (like Aurora Global Database) combined with warm standby compute patterns to meet low RTO and RPO objectives.

Estimated Time:3m 0s

Question 910Question →

A media processing company hosts a video rendering application across two VPCs in the us-west-2 Region. The rendering nodes in VPC A need to transfer large, uncompressed media files to a storage caching cluster in VPC B. Both sets of EC2 instances are located within the same Availability Zone (us-west-2a). Currently, the VPCs are connected via an AWS Transit Gateway, but the transfer times are high and network latency is inconsistent. The company needs to optimize the network path to maximize throughput and minimize latency between these systems.

Which two actions should the Solutions Architect take to achieve this?

Select all that apply

Establish a VPC peering connection between VPC A and VPC B, and update the VPC route tables to route traffic directly through the peering connection.

Launch the rendering nodes and caching cluster instances in a cluster placement group, and configure the operating systems to use Jumbo Frames (

9001

MTU).

Configure an AWS Transit Gateway Connect attachment with GRE tunnels between the VPCs to scale the network bandwidth dynamically.

Associate a single Route 53 Private Hosted Zone with both VPCs and configure latency-based routing policies for the internal DNS endpoints.

Deploy NAT Gateways in us-west-2a for both VPCs and configure the route tables to direct inter-VPC traffic through the NAT Gateways.

Show answer & explanation

Answer: Establish a VPC peering connection between VPC A and VPC B, and update the VPC route tables to route traffic directly through the peering connection.; Launch the rendering nodes and caching cluster instances in a cluster placement group, and configure the operating systems to use Jumbo Frames ( $9001$ MTU).

Answer

Establish a VPC peering connection between the VPCs to route traffic directly, and launch the instances within a cluster placement group utilizing Jumbo Frames (

9001

MTU).

Establishing a VPC peering connection allows direct IP routing between the instances in the two VPCs, bypassing the Transit Gateway transit hop, thereby lowering latency. Placing the EC2 instances in a cluster placement group ensures they are physically close to each other on the hardware level, minimizing network latency. Configuring Jumbo Frames (

9001

MTU) allows the instances to send larger packets, reducing CPU processing overhead per byte transferred and maximizing network throughput.

Step-by-Step Solution

Analyze the network topology and identify the performance bottleneck.

The current path through AWS Transit Gateway introduces an extra routing hop and potential bandwidth caps for high-throughput, low-latency traffic within the same Availability Zone.

Identifying the overhead of Transit Gateway for same-region, same-AZ traffic helps determine the need for a direct peering path.

Select a direct network path to bypass the Transit Gateway hop.

VPC peering is selected because it enables direct routing on the AWS network fabric without bandwidth limits or extra hops.

Bypassing Transit Gateway via VPC peering reduces inter-VPC latency and removes processing overhead.

Configure instance placement and packet size parameters.

Instances are launched in a cluster placement group within the same Availability Zone, and Jumbo Frames (

9001

MTU) are configured.

Cluster placement groups minimize physical distance between nodes for low latency, while Jumbo Frames reduce packet processing overhead to maximize throughput.

Key Concept

Bypassing routing hops (like Transit Gateway) using VPC Peering and leveraging cluster placement groups with Jumbo Frames (

9001

MTU) optimizes network performance and latency for intensive workloads within the same Availability Zone.

Question 911Question →

A company is hosting a hybrid application on a fleet of self-managed Linux EC2 instances. The application writes its runtime logs to `/var/log/app/application.log`. These logs are rotated hourly using a log utility that renames the active file to `application.log.YYYY-MM-DD-HH` and creates a new empty `application.log` file. The solutions architect needs to centralize these application logs into an Amazon CloudWatch Logs group in a central Security account. Additionally, the solutions architect must configure a multi-account AWS CloudTrail trail to deliver management events from all AWS accounts in the AWS Organization to a centralized Amazon S3 bucket in the same Security account. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure the S3 bucket policy in the Security account to grant the `cloudtrail.amazonaws.com` service principal `s3:PutObject` permissions, and use the `aws:PrincipalOrgID` condition key to allow log delivery from the organization's member accounts.

Configure the CloudWatch agent on the EC2 instances with the static file path `/var/log/app/application.log` in the `file_path` parameter, relying on the agent's file descriptor tracking to automatically monitor rotated log files.

Configure the S3 bucket policy in the Security account to grant `s3:PutObject` permissions to the IAM roles of all member accounts in the organization, enabling the local CloudTrail service in each account to write logs directly to the bucket.

Attach a Service Control Policy (SCP) to the organization's root that grants the CloudTrail service principal in all member accounts permission to perform `s3:PutObject` on the centralized S3 bucket in the Security account.

Show answer & explanation

Answer: Configure the CloudWatch agent on the EC2 instances using a wildcard path, such as `/var/log/app/application.log*`, in the `file_path` parameter of the agent configuration file to ensure all rotated log files are tracked and ingested.; Configure the S3 bucket policy in the Security account to grant the `cloudtrail.amazonaws.com` service principal `s3:PutObject` permissions, and use the `aws:PrincipalOrgID` condition key to allow log delivery from the organization's member accounts.

Answer

Configure the CloudWatch agent on the EC2 instances using a wildcard path, such as `/var/log/app/application.log*`, in the `file_path` parameter of the agent configuration file, and configure the S3 bucket policy in the Security account to grant the `cloudtrail.amazonaws.com` service principal `s3:PutObject` permissions while using the `aws:PrincipalOrgID` condition key to allow log delivery from the organization's member accounts.

The correct options involve configuring the CloudWatch agent to use a wildcard path (such as `/var/log/app/application.log*`) to monitor all rotated files and avoid data loss, and configuring the centralized S3 bucket policy to allow the `cloudtrail.amazonaws.com` service principal to write objects while restricting access to the organization using the `aws:PrincipalOrgID` condition.

Step-by-Step Solution

Configure the CloudWatch agent configuration file with a wildcard path pattern.

The agent matches rotated log files (e.g., `application.log.2026-07-16-11`) and successfully ingests remaining log entries before they are locked or deleted.

Log rotation renames the active file, and a static path config would lose track of the renamed files.

Create an S3 bucket in the Security account and attach a bucket policy allowing `cloudtrail.amazonaws.com` to perform `s3:PutObject`.

The central S3 bucket accepts log writes from the CloudTrail service principal.

CloudTrail is a service principal that writes logs directly, requiring resource-based permissions on the target S3 bucket.

Add an `aws:PrincipalOrgID` condition to the S3 bucket policy.

Only CloudTrail services originating from accounts within the specific AWS Organization can write to the bucket.

This secures the bucket and enables all organization member accounts to centralize logs without listing individual account IDs.

Key Concept

Improving operational excellence involves configuring agents properly to handle log rotation and ensuring secure centralized logging architectures via resource-based policies and organizational conditions.

Question 912Question →

An enterprise is designing a highly secure and regulated payment processing network on AWS. The architecture is deployed across three AWS Regions (us-east-1, eu-west-1, and ap-southeast-1) and utilizes a multi-account structure managed under AWS Organizations. A dedicated Shared Services account hosts core services, including a Route 53 Private Hosted Zone (PHZ) named payment.internal. Multiple application accounts contain spoke VPCs that run transactional workloads across multiple Availability Zones. These workloads require resolution of names within payment.internal, resilient outbound internet access, and low-latency hybrid connectivity to an on-premises partner data center via AWS Direct Connect. Which TWO configurations should a solutions architect implement to meet these requirements while preventing single points of failure and routing limitations?

Select all that apply

In the Shared Services account, create a Route 53 Private Hosted Zone association authorization for each application spoke VPC, and then associate the zone with those VPCs from their respective application accounts using the Route 53 API or AWS CLI.

In each application spoke VPC, deploy a NAT Gateway in each Availability Zone where application workloads are running, and configure the route table of the private subnets in each Availability Zone to route default outbound traffic (0.0.0.0/0) to the local NAT Gateway in that same Availability Zone.

Deploy a Route 53 Resolver inbound endpoint in the Shared Services VPC, and configure Route 53 Resolver outbound endpoints in the application spoke VPCs to forward queries for payment.internal directly to the inbound endpoint without associating the Private Hosted Zone with the spoke VPCs.

Deploy a single NAT Gateway in the Shared Services VPC, and configure the regional Transit Gateways to route all default outbound traffic (0.0.0.0/0) from the application spoke VPCs to this central NAT Gateway to minimize NAT processing costs.

Configure the Direct Connect Gateway to act as a transitive hub between the application spoke VPCs and the on-premises partner network, allowing direct VPC-to-VPC routing over the Direct Connect Gateway without using AWS Transit Gateway.

Show answer & explanation

Answer: In the Shared Services account, create a Route 53 Private Hosted Zone association authorization for each application spoke VPC, and then associate the zone with those VPCs from their respective application accounts using the Route 53 API or AWS CLI.; In each application spoke VPC, deploy a NAT Gateway in each Availability Zone where application workloads are running, and configure the route table of the private subnets in each Availability Zone to route default outbound traffic (0.0.0.0/0) to the local NAT Gateway in that same Availability Zone.

Answer

To satisfy the requirements, the solutions architect must associate the Private Hosted Zone with the consumer VPCs using cross-account association authorizations, and deploy redundant, independent NAT Gateways in each Availability Zone for private subnet outbound routing.

To achieve secure, cross-account resolution of names within the Private Hosted Zone, the zone must be associated with the application spoke VPCs. Since the VPCs and the zone reside in different AWS accounts, the zone owner must first create a Private Hosted Zone association authorization, and then the spoke VPC owners must associate the zone. Additionally, to avoid a single point of failure for outbound internet traffic, NAT Gateways must be deployed in each active Availability Zone with local subnet routing. This setup prevents an outage in one Availability Zone from taking down egress connectivity for workloads in other Availability Zones.

Step-by-Step Solution

Establish cross-account DNS resolution

Authorize the association of the Private Hosted Zone from the Shared Services account to the spoke VPCs, then submit the association requests from the application accounts.

Route 53 Private Hosted Zones require direct VPC association to resolve queries locally. In a multi-account environment, this is achieved via the association authorization workflow.

Ensure NAT Gateway redundancy

Deploy a NAT Gateway in each active Availability Zone within each spoke VPC and map local private subnet route tables to their respective zone's NAT Gateway.

This configuration ensures that an outage in one Availability Zone does not impact egress network paths for workloads running in different Availability Zones, avoiding a single point of failure.

Acknowledge transitive routing limits of Direct Connect Gateway

Ensure AWS Transit Gateway is used for multi-VPC routing instead of attempting to use Direct Connect Gateway for VPC-to-VPC routing.

Direct Connect Gateway does not support transitive VPC-to-VPC routing.

Key Concept

Multi-account private DNS resolution and high-availability egress routing

Estimated Time:3m 0s

Question 913Question →

An enterprise SaaS company has a multi-region application deployed in us-west-2 and ap-northeast-1 behind Application Load Balancers (ALBs). Users in Asia are reporting high latency and connection instability when connecting to the application's public endpoints. Additionally, the company's on-premises data center in Tokyo is connected to the ap-northeast-1 VPC via an AWS Direct Connect (DX) connection with a Private Virtual Interface (VIF) to a Virtual Private Gateway (VGW). The Solutions Architect must optimize global network performance, reduce latency for end-users, and enable transitive routing from the on-premises data center to both the ap-northeast-1 and us-west-2 VPCs. Which two actions should the Solutions Architect take to meet these requirements?

Select all that apply

Deploy AWS Global Accelerator and associate the regional ALBs with the accelerator to route client traffic over the AWS congestion-free global network.

Create an AWS Transit Gateway in both regions, peer the Transit Gateways, and connect the on-premises Direct Connect connection via a Transit VIF to a Direct Connect Gateway attached to the Transit Gateways.

Associate the Direct Connect Gateway directly with the Virtual Private Gateways (VGWs) of both VPCs using the existing Private VIF to enable transitive routing between the on-premises data center and both regions.

Set up a Route 53 Resolver Inbound Endpoint in the ap-northeast-1 VPC to resolve the database domain names without associating the private hosted zone with the ap-northeast-1 VPC.

Consolidate all outbound traffic through a single NAT Gateway in each region to minimize routing hops and rely on standard ALB scaling to handle instant, massive traffic spikes.

Show answer & explanation

Answer: Deploy AWS Global Accelerator and associate the regional ALBs with the accelerator to route client traffic over the AWS congestion-free global network.; Create an AWS Transit Gateway in both regions, peer the Transit Gateways, and connect the on-premises Direct Connect connection via a Transit VIF to a Direct Connect Gateway attached to the Transit Gateways.

Answer

The correct actions are to deploy AWS Global Accelerator to route client traffic over the AWS global network and to establish peered AWS Transit Gateways in both regions connected to the on-premises Direct Connect link via a Transit VIF and Direct Connect Gateway.

Deploying AWS Global Accelerator optimizes end-user latency by routing traffic over the private AWS global network instead of the public internet. Setting up peered AWS Transit Gateways in both regions connected via a Transit VIF to a Direct Connect Gateway enables scalable transitive routing between the on-premises network and both VPCs.

Step-by-Step Solution

Address client-side network latency and instability.

Deploy AWS Global Accelerator to onboard client traffic from Asia onto the AWS global network close to the users, bypassing the congested public internet.

Global Accelerator uses Anycast to route traffic to the nearest AWS edge location and then over the high-speed AWS backbone to the regional ALBs.

Address hybrid connectivity and transitive routing requirements.

Implement peered AWS Transit Gateways in us-west-2 and ap-northeast-1, and attach them to a Direct Connect Gateway using a Transit VIF.

Transit Gateway supports transitive routing between peered regions and on-premises networks, which standard VGW associations with Direct Connect Gateways do not support.

Key Concept

Optimizing end-user latency globally using AWS Global Accelerator and establishing transitive routing for hybrid networks using peered AWS Transit Gateways with Direct Connect Gateway.

Question 914Question →

An enterprise manages a multi-account environment using AWS Organizations. The transaction workloads run on Amazon ECS on AWS Fargate across several member accounts, with application containers sending log events to local Amazon CloudWatch log groups. To comply with security audits, the enterprise must aggregate all member account AWS CloudTrail trails into a centralized Amazon S3 bucket in a dedicated security account. Additionally, all application logs must be streamed in real-time to an Amazon OpenSearch Service domain located in the security account. Currently, cross-account CloudTrail logs are failing to deliver to the S3 bucket, and application logs remain isolated within their local member accounts. Which combination of actions will securely centralize both the CloudTrail logs and the application logs with the least operational overhead? (Select TWO.)

Select all that apply

In the security account, configure the centralized S3 bucket policy to allow the `s3:PutObject` action for the `cloudtrail.amazonaws.com` service principal, and include a condition that checks `aws:PrincipalOrgID` to match the enterprise's Organization ID.

In the security account, configure the S3 bucket policy to grant `s3:PutObject` directly to the root IAM ARNs of all member accounts, and enable default bucket encryption using the AWS-managed KMS key `aws/s3` while granting the member accounts cross-account access to the key.

In the security account, create an Amazon Kinesis Data Stream and a CloudWatch Logs destination pointing to it. Configure the destination's access policy to allow `logs:PutSubscriptionFilter` from the Organization, and create an IAM role trusted by `logs.amazonaws.com` to write to the stream. In the member accounts, create CloudWatch Logs subscription filters targeting the centralized destination.

In the security account, modify the S3 bucket policy to allow `s3:PutObject` only to the parent AWS Organization's root account ID, and in the member accounts, update the CloudTrail trail configuration to use the S3 bucket's regional endpoint directly without the `cloudtrail.amazonaws.com` service principal in the bucket policy.

In the member accounts, configure the CloudWatch agent on the Fargate tasks to ship logs directly to the security account's S3 bucket by modifying the agent's configuration file to use static log file paths. Associate an IAM role with the task execution role that has a trust relationship allowing the security account's root user to write objects to the S3 bucket.

Show answer & explanation

Answer: In the security account, configure the centralized S3 bucket policy to allow the `s3:PutObject` action for the `cloudtrail.amazonaws.com` service principal, and include a condition that checks `aws:PrincipalOrgID` to match the enterprise's Organization ID.; In the security account, create an Amazon Kinesis Data Stream and a CloudWatch Logs destination pointing to it. Configure the destination's access policy to allow `logs:PutSubscriptionFilter` from the Organization, and create an IAM role trusted by `logs.amazonaws.com` to write to the stream. In the member accounts, create CloudWatch Logs subscription filters targeting the centralized destination.

Answer

The correct options are configuring the S3 bucket policy in the security account to trust the CloudTrail service principal with an Organization ID condition, and establishing a cross-account CloudWatch Logs subscription filter topology targeting an Amazon Kinesis Data Stream in the security account.

Configuring the centralized S3 bucket policy in the security account to trust the CloudTrail service principal with an Organization ID condition ensures that CloudTrail can successfully write logs from all present and future member accounts securely. Establishing a CloudWatch Logs destination in the security account backed by Kinesis Data Streams allows member accounts to use native subscription filters to stream container logs across accounts efficiently, without embedding credentials or managing complex agent configurations.

Step-by-Step Solution

Configure centralized S3 bucket policy for CloudTrail.

The S3 bucket policy in the security account allows `s3:PutObject` for the service principal `cloudtrail.amazonaws.com` and utilizes the `aws:PrincipalOrgID` condition.

This enables secure, cross-account log delivery from all Organization member accounts without listing individual account IDs.

Set up centralized CloudWatch Logs ingestion target in the security account.

An Amazon Kinesis Data Stream is created, and a CloudWatch Logs destination is associated with it, protected by an access policy allowing the Organization's member accounts to write to it.

This establishes a secure endpoint in the security account that can receive logs from other accounts.

Configure subscription filters in member accounts.

CloudWatch Logs subscription filters in the member accounts target the centralized destination ARN in the security account.

This routes the local container logs in real time across accounts to the centralized Kinesis Data Stream, which then feeds the OpenSearch domain.

Key Concept

Cross-account log aggregation using S3 bucket policies for CloudTrail and CloudWatch Logs subscription destinations for real-time application log ingestion.

Question 915Question →

An enterprise hosts a critical transaction session synchronization layer across two AWS Regions. The compute layer runs on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate in a Production Account. The caching and session state layer is managed by an Amazon ElastiCache for Redis Global Datastore, with the primary cluster in us-east-1 and a read-only secondary cluster in us-west-2. Internal microservices resolve the Redis cluster endpoint using a Route 53 Private Hosted Zone (PHZ) for cache.internal managed in a separate Shared Services Account. The enterprise wants to optimize their disaster recovery (DR) strategy to achieve a Recovery Time Objective (RTO) of under 10 minutes and a Recovery Point Objective (RPO) of under 1 minute. During a DR simulation where a primary region outage is simulated, the secondary ECS tasks in us-west-2 fail to resolve cache.internal, and write operations to the cache in us-west-2 are blocked because the secondary cluster remains read-only. Which TWO actions should the Solutions Architect take to resolve these issues and establish a reliable multi-region DR failover process?

Select all that apply

In the Shared Services Account, create a VPC association authorization for the Production Account's us-west-2 VPCs. In the Production Account, associate the Route 53 Private Hosted Zone with the us-west-2 VPCs using the AWS CLI or SDK.

Implement AWS Route 53 Application Recovery Controller (ARC) routing controls to manage regional traffic failover, and create a failover automation script that promotes the secondary ElastiCache cluster in us-west-2 to primary.

Use AWS Resource Access Manager (RAM) to share the Route 53 Private Hosted Zone from the Shared Services Account to the Production Account, allowing the us-west-2 VPCs to inherit the DNS resolution rules.

Configure Route 53 failover routing policies using health checks targeting the Redis cluster endpoints to automatically promote the secondary cluster to primary when the primary cluster becomes unhealthy.

Enable multi-region multi-writer replication on the ElastiCache Global Datastore to allow concurrent writes in both regions, and use Route 53 latency-based routing to automatically direct write traffic.

Show answer & explanation

Answer: In the Shared Services Account, create a VPC association authorization for the Production Account's us-west-2 VPCs. In the Production Account, associate the Route 53 Private Hosted Zone with the us-west-2 VPCs using the AWS CLI or SDK.; Implement AWS Route 53 Application Recovery Controller (ARC) routing controls to manage regional traffic failover, and create a failover automation script that promotes the secondary ElastiCache cluster in us-west-2 to primary.

Answer

Create a VPC association authorization in the Shared Services Account and associate the private hosted zone with the us-west-2 VPCs in the Production Account; and implement AWS Route 53 ARC routing controls to manage failover and execute an API script to promote the secondary ElastiCache cluster.

The correct options resolve the two major issues. First, establishing cross-account DNS resolution requires creating a VPC association authorization in the hosted zone's account (Shared Services) and then performing the association in the VPC's account (Production). Second, ElastiCache for Redis Global Datastore does not automate cross-region write promotion; the secondary cluster must be promoted to primary via an API call (using AWS SDK/CLI) during a failover event. Route 53 Application Recovery Controller (ARC) routing controls manage regional traffic redirection reliably without relying on unstable DNS health checks that might trigger split-brain states.

Step-by-Step Solution

Create a VPC association authorization from the owner account.

The Shared Services Account authorizes the association between the Private Hosted Zone and the us-west-2 VPC in the Production Account.

Route 53 requires explicit cross-account permission before a private hosted zone can be associated with a VPC in a different AWS account.

Associate the VPC with the Private Hosted Zone.

The Production Account associates its us-west-2 VPC with the hosted zone.

Allows ECS tasks in the secondary region to resolve local resources using the private hosted zone name.

Implement Route 53 Application Recovery Controller (ARC) routing controls.

Defines routing control states that can be toggled to shift regional ingress traffic systematically.

Provides deterministic control over traffic routing to prevent premature or split-brain failovers.

Orchestrate ElastiCache secondary cluster promotion.

Promotes the us-west-2 secondary cluster to primary via API/script.

ElastiCache Global Datastore requires manual or scripted promotion because it does not perform automatic failover of the primary write endpoint across regions.

Key Concept

Cross-account private DNS configuration and automated database promotion strategies for multi-region disaster recovery.

Question 916Question →

A financial transaction processor uses AWS Organizations to manage multiple member accounts. Under PCI-DSS compliance requirements, all payment gateway application logs must be secured and centrally archived. The payment gateway runs on Amazon ECS using AWS Fargate within a Production account ( $444444444444$ ). These logs must be written directly to a centralized Amazon S3 bucket located in a Security Auditing account ( $999999999999$ ). The S3 bucket is configured with default encryption using a customer-managed AWS KMS key (KMS CMK) to enforce security team control over key rotation and policies. The architecture must enforce the principle of least privilege, preventing unauthorized internal access from other accounts within the AWS Organization.

Which two configurations are required to establish this secure log transport?

Select all that apply

In the Security Auditing account (

999999999999

), configure the key policy of the Customer Managed KMS key to allow the Production account's ECS task role IAM principal (

arn:aws:iam::444444444444:role/PaymentGatewayTaskRole

) to perform `kms:GenerateDataKey` and `kms:Decrypt` actions. In the destination S3 bucket policy, allow the same ECS task role principal to perform `s3:PutObject` actions.

In the Production account (

444444444444

), attach an IAM policy to the ECS task role that grants `s3:PutObject` permissions on the destination S3 bucket in the Security Auditing account, and `kms:GenerateDataKey` and `kms:Decrypt` permissions on the KMS key ARN in the Security Auditing account.

In the Security Auditing account (

999999999999

), configure default S3 bucket encryption using the AWS-managed S3 key (`aws/s3`). In the Production account (

444444444444

), attach an IAM policy to the ECS task role allowing `kms:GenerateDataKey` on the `aws/s3` key resource in the Security Auditing account.

In the AWS Organizations Management account, create and attach a Service Control Policy (SCP) to the Production account's Organizational Unit (OU) that grants `s3:PutObject` and `kms:GenerateDataKey` permissions to the ECS task role, thereby bypassing the need to create local IAM policies in the Production account.

In the Security Auditing account (

999999999999

), configure the destination S3 bucket policy with a wildcard Principal (`"Principal": "*"`) and include a condition for `"StringEquals": {"aws:PrincipalOrgID": "o-exampleorgid"}` to allow any identity within the Organization to write logs, relying on the KMS key policy alone to restrict access to the ECS task role.

Show answer & explanation

Answer: In the Security Auditing account ( $999999999999$ ), configure the key policy of the Customer Managed KMS key to allow the Production account's ECS task role IAM principal ( $arn:aws:iam::444444444444:role/PaymentGatewayTaskRole$ ) to perform `kms:GenerateDataKey` and `kms:Decrypt` actions. In the destination S3 bucket policy, allow the same ECS task role principal to perform `s3:PutObject` actions.; In the Production account ( $444444444444$ ), attach an IAM policy to the ECS task role that grants `s3:PutObject` permissions on the destination S3 bucket in the Security Auditing account, and `kms:GenerateDataKey` and `kms:Decrypt` permissions on the KMS key ARN in the Security Auditing account.

Answer

The correct configurations are: (1) configuring the Customer Managed Key policy and S3 bucket policy in the Security Auditing account to permit cross-account access to the Production ECS task role, and (2) attaching an IAM policy to the Production ECS task role allowing write operations to the S3 bucket and data key generation on the KMS key.

To achieve secure cross-account log delivery to an S3 bucket encrypted with a KMS key under strict least-privilege requirements, you must perform two main configurations: First, the resource policies in the destination Security Auditing account (both the S3 bucket policy and the KMS Customer Managed Key policy) must explicitly trust and permit access to the specific ECS task role principal in the Production account. Second, the identity policy (IAM policy) in the source Production account attached to the ECS task role must authorize outbound access to both the external S3 bucket and the KMS key. Customer Managed Keys are required since AWS-managed keys cannot be shared across accounts.

Step-by-Step Solution

Establish a Customer Managed Key (CMK) in the Security Auditing account (

999999999999

A key is provisioned whose key policy can be modified to grant cross-account permissions.

AWS-managed keys (like `aws/s3`) do not support cross-account sharing because their key policies cannot be modified.

Modify the KMS key policy in the Security Auditing account.

The Production account ECS task role is allowed to perform `kms:GenerateDataKey` and `kms:Decrypt` operations.

Resource-based policies (like the KMS key policy) must explicitly trust the external IAM principal for cross-account operations.

Modify the destination S3 bucket policy in the Security Auditing account.

The Production account ECS task role is allowed to perform `s3:PutObject` operations.

The bucket policy must explicitly permit the cross-account principal to upload objects to the destination bucket.

Attach a local IAM policy to the ECS task role in the Production account (

444444444444

The task role is authorized to interact with both the external S3 bucket and the external KMS key.

Cross-account access requires authorization from both the identity-based policy in the source account and the resource-based policies in the destination account.

Key Concept

Cross-account access to S3 buckets encrypted with Customer Managed KMS Keys

Question 917Question →

An enterprise financial analytics company runs daily risk simulation models on AWS. The simulation runs on a fleet of Amazon EC2 `c5.4xlarge` instances in an Auto Scaling group. The simulations read a massive set of historical market data (around $2\text{ TB}$ ) from an Amazon S3 bucket at the start of each run and write massive temporary scratch files (up to $500\text{ GB}$ per instance) during execution.

Currently, the EC2 instances are configured with a single $1\text{ TB}$ General Purpose SSD (gp3) EBS volume for both the operating system and scratch space. During the run, the company observes that scratch writes hit I/O limits, causing CPU utilization to drop while waiting for I/O. Additionally, the initial download of the $2\text{ TB}$ historical market data from S3 takes over $30\text{ minutes}$ , delaying the start of the simulation.

Which two modifications should the Solutions Architect implement to optimize the compute and storage performance for this workload? (Select two.)

Select all that apply

Change the instance type of the simulation fleet to `c5d.4xlarge` to utilize the local NVMe-based instance store volumes, and configure the simulation software to use this instance store for writing temporary scratch files.

Configure the simulation application to download the historical market data from Amazon S3 using parallel byte-range requests across multiple threads to saturate the instance's network interface.

Request AWS Support to pre-warm the Application Load Balancer (ALB) that routes traffic to the simulation fleet to prevent connection dropping during the initial data download from Amazon S3.

Migrate the historical market data from Amazon S3 to an Amazon Aurora PostgreSQL database, and route read queries to the Multi-AZ standby instance to scale the data retrieval capacity.

Decrease the Auto Scaling group scale-out cooldown period to

15\text{ seconds}

to allow the fleet to rapidly add new instances when the initial S3 download causes a spike in CPU usage.

Show answer & explanation

Answer: Change the instance type of the simulation fleet to `c5d.4xlarge` to utilize the local NVMe-based instance store volumes, and configure the simulation software to use this instance store for writing temporary scratch files.; Configure the simulation application to download the historical market data from Amazon S3 using parallel byte-range requests across multiple threads to saturate the instance's network interface.

Answer

To optimize performance, change the EC2 instance type to `c5d.4xlarge` to utilize the local NVMe instance store for temporary scratch space, and configure the application to download historical market data from Amazon S3 using parallel byte-range requests.

Utilizing local NVMe instance stores (via `c5d` instances) provides high-performance, low-latency disk access for temporary scratch files, resolving the EBS I/O bottleneck. Downloading from S3 using parallel byte-range requests allows the application to utilize the full network bandwidth of the instance, resolving the S3 transfer delay.

Step-by-Step Solution

Analyze the scratch space performance bottleneck.

The simulation writes up to

500\text{ GB}

of temporary data per instance and is hitting I/O limits on EBS gp3. Because these scratch files are temporary and do not need to persist beyond the simulation run, local NVMe-based instance store volumes on `c5d` instances are the most performant and cost-effective solution.

This offloads I/O from network-attached EBS volumes to local bus-attached NVMe storage, achieving lower latency and avoiding costs associated with provisioning extra EBS IOPS/throughput.

Analyze the S3 download throughput bottleneck.

Downloading

2\text{ TB}

of historical market data sequentially limits network throughput. The S3 throughput can be scaled by requesting parallel byte-range requests concurrently across multiple threads, allowing the instance to saturate its network bandwidth.

S3 scales performance by prefix and by horizontal request concurrency. Parallel range requests enable the application to download multiple chunks of the file at the same time, maximizing utilization of the 10 Gbps network capacity of the instance.

Evaluate and eliminate incorrect architectural options.

Pre-warming the ALB is rejected because ALB is for inbound client traffic, not outbound S3 connections. Using an Aurora Multi-AZ standby for queries is rejected because standby nodes do not serve read traffic. Shortening the ASG cooldown period is rejected because it leads to ASG thrashing.

Eliminating invalid configurations ensures the system does not introduce unnecessary cost, deployment thrashing, or architectural patterns that violate AWS service limits.

Key Concept

Optimizing compute and storage performance by utilizing local NVMe instance stores for high-performance scratch space and parallel range requests to maximize Amazon S3 read throughput.

Question 918Question →

A financial services firm runs a real-time risk analysis engine on Amazon EC2 instances in an Auto Scaling group. The instances process large market feeds retrieved from an Amazon S3 bucket, write large temporary datasets to attached $1\text{ TB}$ EBS `gp3` volumes, and query metadata from an Amazon Aurora PostgreSQL database.

During market open hours, the following performance bottlenecks are observed:
* The EC2 instances experience high I/O wait times; the EBS volumes are operating at the baseline performance of $3{}000\text{ IOPS}$ and $125\text{ MB/s}$ throughput.
* The application receives HTTP $503$ (Slow Down) errors from Amazon S3 due to a high volume of concurrent GET requests directed at a single date-based folder structure (e.g., `s3://bucket/year=2026/month=07/day=16/`).
* Read queries to the Aurora database experience high latency due to transient read spikes, and the application requires read-scaling without impacting write performance.

Which combination of actions will optimize compute and storage performance while resolving these bottlenecks? (Select TWO.)

Select all that apply

Modify the configurations of the existing EBS `gp3` volumes to increase the provisioned throughput and IOPS to meet the peak write demands, and implement a prefix partitioning strategy for the S3 bucket keys by prepending a hash value to the object paths.

Configure Amazon Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization, and configure the application to route read queries to the cluster's reader endpoint.

Request AWS Support to pre-warm the Application Load Balancer (ALB) servicing the EC2 instances to handle the burst in traffic and resolve the S3 HTTP

503

(Slow Down) errors.

Enable Multi-AZ standby deployment for the Aurora PostgreSQL cluster and configure the application's read traffic to target the standby instance endpoint to distribute the query load.

Decrease the Auto Scaling group scale-out cooldown period to

10\text{ seconds}

to quickly spin up new EC2 instances to handle the concurrent S3 request spikes.

Show answer & explanation

Answer: Modify the configurations of the existing EBS `gp3` volumes to increase the provisioned throughput and IOPS to meet the peak write demands, and implement a prefix partitioning strategy for the S3 bucket keys by prepending a hash value to the object paths.; Configure Amazon Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization, and configure the application to route read queries to the cluster's reader endpoint.

Answer

Modify the EBS gp3 volume configurations to provision higher IOPS and throughput, implement S3 prefix partitioning by prepending a hash to key paths, configure Amazon Aurora Auto Scaling to dynamically provision Aurora Replicas, and route read queries to the cluster's reader endpoint.

Modifying the gp3 volume configurations to provision higher IOPS and throughput resolves the EBS performance bottleneck immediately. Prepending a hash value to S3 object keys creates distinct logical prefixes, which dynamically scales S3 throughput limits and eliminates HTTP 503 errors. In addition, implementing Aurora Auto Scaling for replicas combined with the reader endpoint scales out read throughput dynamically based on workload demands.

Step-by-Step Solution

Analyze the EBS gp3 storage constraint.

Identify that the volumes are hitting the baseline limits (

3{}000\text{ IOPS}

and

125\text{ MB/s}

throughput) despite having

1\text{ TB}

of storage capacity.

By default, gp3 volumes offer these baseline parameters; performance can be scaled up to

16{}000\text{ IOPS}

and

1{}000\text{ MB/s}

independently of volume size by adjusting the provisioned throughput and IOPS settings.

Address S3 HTTP 503 (Slow Down) errors.

Implement a hash-based prefix partitioning scheme for object keys.

Amazon S3 supports

5{}500\text{ GET}

requests per second per prefix. Prepending a hash distributes the data across multiple prefixes, allowing S3 to scale throughput horizontally.

Scale the database read capacity.

Enable Aurora Auto Scaling and configure reader routing.

Aurora Replicas share cluster storage and can serve read traffic. Dynamic scaling based on CPU utilization combined with the reader endpoint handles read spikes transparently.

Eliminate inappropriate architectural responses.

Rule out ALB pre-warming, Multi-AZ standby routing, and aggressive cooldown modifications.

ALB pre-warming does not affect S3; standby DB instances cannot process query workloads; a 10-second cooldown causes cluster instability.

Key Concept

Identifying and scaling compute, storage, and database bottlenecks across S3, EBS, and Aurora PostgreSQL.

Estimated Time:3m 0s

Question 919Question →

A financial technology company deploys a multi-tenant payment gateway application across multiple AWS accounts managed under a single organization in AWS Organizations. The application is hosted on Amazon EC2 instances within Auto Scaling groups. The application writes transaction events locally to /var/log/payment-app/transaction.log. A local script rotates these log files hourly by appending the current timestamp to the filename (e.g., transaction.log.2026-07-16-11) and creating a new empty transaction.log file.

To comply with audit regulations, all transaction logs must be aggregated in near real-time into a centralized Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS, and the architecture must prevent log loss or duplicate log ingestion.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure the CloudWatch agent on the EC2 instances to monitor the log file using the static path /var/log/payment-app/transaction.log without wildcards, allowing the agent to automatically track file rotation using inodes.

Create an Amazon Kinesis Data Stream in the Security account, configure a centralized CloudWatch Logs destination that points to the stream, and create CloudWatch Logs subscription filters in the member accounts to forward the log events.

Configure the CloudWatch agent on the EC2 instances to monitor the log files using the path /var/log/payment-app/transaction.log* with a wildcard to ensure that all rotated logs are explicitly matched and streamed during the hourly rotation transition.

Configure the central S3 bucket to use the default AWS-managed S3 key (aws/s3) for encryption at rest, and update the S3 bucket policy to allow the member account IAM roles to perform s3:PutObject operations.

Configure the CloudWatch agent to write log files directly to a shared Amazon EFS volume mounted across accounts, and configure AWS DataSync to copy the files to the centralized S3 bucket hourly.

Show answer & explanation

Answer: Configure the CloudWatch agent on the EC2 instances to monitor the log file using the static path /var/log/payment-app/transaction.log without wildcards, allowing the agent to automatically track file rotation using inodes.; Create an Amazon Kinesis Data Stream in the Security account, configure a centralized CloudWatch Logs destination that points to the stream, and create CloudWatch Logs subscription filters in the member accounts to forward the log events.

Answer

The solutions architect should configure the CloudWatch agent to monitor the static log path /var/log/payment-app/transaction.log without wildcards, and set up an Amazon Kinesis Data Stream with cross-account CloudWatch Logs destinations and subscription filters.

To achieve operational excellence, the CloudWatch agent must be configured to watch the static active log file path. Since the agent tracks log files via file descriptor/inode, it automatically detects when a file is renamed (rotated) and continues reading it to the end while starting to read the new empty active file. This prevents both log loss and duplicate ingestion. For cross-account centralization, establishing a CloudWatch Logs destination in the Security account linked to a Kinesis Data Stream, and configuring subscription filters in the member accounts, is the standard real-time streaming pattern. Encryption with a Customer Managed Key (CMK) ensures that key policies can be customized to grant cross-account permissions.

Step-by-Step Solution

Configure the CloudWatch agent on the EC2 instances to point directly to the active log file /var/log/payment-app/transaction.log.

The agent will track the log file using its inode, ensuring that hourly log rotation is handled correctly without duplicate ingestion or log loss.

Specifying a wildcard pattern would cause the agent to re-read and upload rotated files, causing duplicates.

Create a central Amazon Kinesis Data Stream in the Security account to ingest the incoming log events.

A streaming entry point is created in the Security account to receive logs from all member accounts.

Kinesis Data Streams can ingest log streams from multiple cross-account sources at high throughput.

Configure a CloudWatch Logs destination in the Security account pointing to the Kinesis Data Stream and grant cross-account permissions via a destination policy.

A centralized destination is established that accepts subscription filters from member accounts within the AWS Organization.

A destination policy is required to authorize other AWS accounts to write to the Security account's log destination.

Set up CloudWatch Logs subscription filters in each member account's log group pointing to the central destination in the Security account.

Log events are streamed in near real-time from the local log groups to the central Security account.

Subscription filters are the standard and operationally excellent way to stream logs in real-time between AWS accounts.

Key Concept

Near real-time cross-account log centralization with CloudWatch agent file rotation handling and KMS key considerations.

Question 920Question →

A solutions architect is configuring an active-passive multi-region disaster recovery solution using Amazon Route 53 failover routing. The architect creates a primary failover record pointing to the application load balancer in the primary region, and a secondary failover record pointing to the disaster recovery site in the secondary region. During a failure drill, the primary region is simulated to be completely offline, but client traffic continues to be routed to the primary region. What is the most likely cause of this behavior?

The primary Route 53 Private Hosted Zone has not been associated with the VPC in the secondary recovery region.

The Route 53 failover routing record for the primary region is not associated with an active health check.

Active-passive disaster recovery configurations do not support automatic DNS-level failover without a pilot light database replica.

The Route 53 health check could not reach the backend instances due to a missing NAT Gateway in the secondary region.

Show answer & explanation

Answer: The Route 53 failover routing record for the primary region is not associated with an active health check.

Answer

The Route 53 failover routing record for the primary region is not associated with an active health check.

For Route 53 active-passive failover routing to function, the primary routing record must be associated with an active Route 53 health check. If no health check is associated, Route 53 treats the primary endpoint as constantly healthy and will not redirect traffic to the secondary endpoint, even if the primary region experiences a complete failure.

Step-by-Step Solution

Analyze Route 53 active-passive failover mechanism.

Route 53 requires health checks to dynamically evaluate whether the primary endpoint is healthy or unhealthy.

Without a health check, Route 53 default behavior is to treat the endpoint as always healthy, which prevents any automatic failover actions from executing.

Identify the cause of the failure drill symptoms.

The traffic is still routed to the offline primary region because the routing record has no health check attached to detect the simulated outage.

Associating the record with a health check is the key prerequisite for Route 53 to route traffic to the secondary endpoint when the primary goes offline.

Key Concept

Route 53 Failover Routing and Health Check Association

Estimated Time:45s

PreviousPage 46 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept