Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 921Question →

A logistics enterprise uses AWS Organizations to manage a multi-account environment. The production application runs on a fleet of Amazon EC2 instances in a production account. The application logs are written to `/var/log/app/production-active.log` and are rotated hourly by renaming the active file to `/var/log/app/production-YYYYMMDD-HH.log` before creating a new active log file. The enterprise also wants to centralize AWS CloudTrail logs from all organization accounts into an Amazon S3 bucket in a dedicated Logging account. A Solutions Architect is tasked with designing a highly secure, reliable logging architecture that ensures zero log loss for the application logs during rotation and successful centralized delivery of CloudTrail logs. Which combination of configurations should the Solutions Architect implement?

Show answer & explanation

Answer: Configure the Unified CloudWatch Agent on the EC2 instances with the log file path set to `/var/log/app/production-*.log`. In the Logging account, configure the S3 bucket policy to grant `s3:PutObject` permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`) and include a condition checking that the `aws:PrincipalOrgID` matches the organization's ID.

Answer

Configure the Unified CloudWatch Agent with a wildcard path pattern and configure the S3 bucket policy to authorize the CloudTrail service principal restricted by the organization ID.
The correct option addresses both requirements securely and reliably. By using a wildcard pattern `/var/log/app/production-*.log` in the Unified CloudWatch Agent configuration, the agent monitors all matching logs including the active and newly rotated files, preventing log loss during rotation. For centralized auditing, the S3 bucket policy correctly identifies the CloudTrail service principal (`cloudtrail.amazonaws.com`) and secures access by checking the `aws:PrincipalOrgID` condition to ensure only member accounts write to the bucket.

Step-by-Step Solution

1
Address the log rotation behavior of the application on the EC2 instances.
The Solutions Architect must specify a wildcard path (`/var/log/app/production-*.log`) in the CloudWatch Agent configuration.
This allows the agent to monitor both the active and renamed log files, ensuring the agent reads the remaining contents of the rotated file before it is archived or deleted.
2
Define the target IAM policy principal for the centralized S3 bucket in the Logging account.
The policy must target the CloudTrail service principal (`cloudtrail.amazonaws.com`).
CloudTrail is the service responsible for delivering the audit logs across all accounts in the organization.
3
Implement cross-account organizational security boundaries in the S3 bucket policy.
Incorporate the `aws:PrincipalOrgID` condition key matching the organization's ID.
This restricts write access to the S3 bucket to only the trails originating from accounts within the specific organization.

Key Concept

Ensuring operational log integrity during rotation and configuring secure centralized cross-account logging boundaries.
Question 922Question →

A company has three VPCs in the us-east-1 Region: a production VPC, a shared services VPC, and a data analytics VPC. Currently, the VPCs are interconnected using an AWS Transit Gateway. The data analytics team reports that transferring large datasets between the production VPC and the data analytics VPC is experiencing throughput bottlenecks and higher-than-expected latency. Which solution will provide the highest throughput and lowest latency for inter-VPC traffic?

Show answer & explanation

Answer: Establish a direct VPC Peering connection between the production VPC and the data analytics VPC, and update the VPC route tables to route traffic through the peering connection.

Answer

Establish a direct VPC Peering connection between the production VPC and the data analytics VPC, and update the VPC route tables to route traffic through the peering connection.
Establishing a direct VPC Peering connection provides a point-to-point network path with the lowest latency and no bandwidth limitations. While AWS Transit Gateway is excellent for managing multi-VPC spoke topologies, it adds a small latency hop and has default bandwidth limitations per connection. Point-to-point VPC Peering between the high-throughput VPCs resolves the bottleneck.

Step-by-Step Solution

1
Analyze the performance requirements.
The workload requires the lowest latency and highest throughput between two specific VPCs in the same AWS region.
Transit Gateway introduces a processing hop and default bandwidth limits (50 Gbps per VPC attachment) which can cause bottlenecks during large dataset transfers.
2
Compare connection alternatives.
VPC Peering provides a direct, single-hop connection with no bandwidth limits, routing traffic over the private AWS backbone.
Choosing VPC Peering directly bypasses the Transit Gateway performance constraints for this specific peer relationship.
3
Configure routing.
Update the route tables of both VPCs to target the peering connection for the destination VPC CIDR block.
Ensures that the traffic flows directly via the low-latency peered path instead of the default Transit Gateway route.

Key Concept

VPC Peering vs. AWS Transit Gateway Latency and Throughput Characteristics
Estimated Time:1m 0s
Question 923Question →

An application runs on Amazon EC2 instances and writes log events to a local file at /var/log/app/current.log. The logs are rotated hourly and renamed with a timestamp suffix, after which a new current.log file is created. The CloudWatch agent is configured to collect these logs, but it regularly fails to capture log events that are written during the rotation window. How should a solutions architect update the CloudWatch agent configuration to resolve this issue?

Show answer & explanation

Answer: Update the file_path setting in the CloudWatch agent configuration file to use a wildcard pattern, such as /var/log/app/current.log*, to ensure both the active and rotated log files are tracked.

Answer

Update the log file path configuration in the CloudWatch agent to use a wildcard pattern to track both the active and rotated files.
Using a wildcard pattern in the file path configuration allows the CloudWatch agent to monitor both the active log file and any rotated files matching the pattern. The agent tracks the state of each file based on its file system fingerprint (inode) and file offset, ensuring that log events written during the rotation window are successfully sent without duplicate delivery.

Step-by-Step Solution

1
Analyze how the log rotation affects file tracking in the CloudWatch agent.
Renaming the file breaks tracking for static file paths during the rotation window because the agent might not monitor the renamed files.
Understanding the root cause is necessary to configure the correct file monitoring settings.
2
Modify the agent configuration file to use wildcards.
Setting the file_path to /var/log/app/current.log* enables the agent to match both the active and renamed log files.
Using a wildcard pattern ensures the agent tracks rotated files during the transition window.
3
Deploy the updated configuration file and restart the CloudWatch agent.
The agent continuously monitors and sends logs without loss during rotation.
Applying the changes enables the agent to start tracking the files using the new wildcard path pattern.

Key Concept

Configuring the Unified CloudWatch Agent for Log Rotation using Wildcards
Question 924Question →

A company is designing a new AWS environment with a single VPC containing private subnets across two Availability Zones: us-west-2a and us-west-2b. The workloads in the private subnets must access external APIs on the internet for updates. The solutions architect must design a highly available outbound connectivity solution that prevents an outage in one Availability Zone from impacting internet access in the other Availability Zone. Which networking configuration satisfies these requirements?

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet in us-west-2a and another NAT Gateway in a public subnet in us-west-2b. Route outbound traffic (0.0.0.0/00.0.0.0/0) from the private subnet in each Availability Zone to the NAT Gateway in the same zone.

Answer

Deploy a NAT Gateway in a public subnet in us-west-2a and another NAT Gateway in a public subnet in us-west-2b, and route outbound traffic (0.0.0.0/00.0.0.0/0) from the private subnet in each Availability Zone to the NAT Gateway in the same zone.
To prevent an outage in one Availability Zone from impacting internet access in another, the architecture must avoid cross-AZ network dependencies. Deploying a NAT Gateway in each Availability Zone and configuring the respective private subnet route tables to use the NAT Gateway in the same zone ensures high availability and isolates failures to a single zone.

Step-by-Step Solution

1
Analyze availability constraints.
Identified that internet access must be resilient to a single Availability Zone outage.
This establishes that a single, centralized NAT Gateway will not meet the redundancy requirement.
2
Evaluate NAT Gateway deployment layout.
Select a multi-NAT Gateway architecture with one NAT Gateway per Availability Zone.
Deploying a NAT Gateway in each zone ensures that the network path to the internet remains entirely within the boundaries of each active zone.
3
Configure VPC route tables.
Create separate route tables for the private subnets in us-west-2a and us-west-2b, routing (0.0.0.0/00.0.0.0/0) traffic to the NAT Gateway in the respective zone.
This prevents cross-AZ dependencies and satisfies the high-availability constraint.

Key Concept

Availability Zone Redundancy for Outbound NAT Traffic
Estimated Time:1m 0s
Question 925Question →

A retail company is launching a new customer-facing application in a dedicated VPC in the us−west−2us-west-2 Region. The application runs on Amazon EC2 instances distributed across three Availability Zones (us−west−2aus-west-2a, us−west−2bus-west-2b, and us−west−2cus-west-2c) within private subnets. The instances require outbound internet connectivity to download real-time currency exchange rates and must also resolve internal domain names within a Route 53 Private Hosted Zone (PHZ) named internal.retail.awsinternal.retail.aws that is managed in a separate Shared Services AWS account. Which design configuration satisfies these requirements while minimizing latency, preventing a single point of failure for outbound traffic, and ensuring proper internal name resolution?

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet in each of the three Availability Zones. Configure the route table of each private subnet to route internet-bound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway in its corresponding Availability Zone. Associate the internal.retail.awsinternal.retail.aws Private Hosted Zone in the Shared Services account with the new application VPC.

Answer

Deploy a NAT Gateway in a public subnet in each of the three Availability Zones, route each private subnet's internet-bound traffic to the NAT Gateway in its corresponding zone, and associate the Private Hosted Zone with the application VPC.
Deploying a NAT Gateway in each Availability Zone ensures that workloads in each zone have a local, redundant path to the internet. This design avoids cross-AZ data transfer charges for internet egress and ensures that an outage in one Availability Zone does not disrupt internet connectivity in the other zones. Additionally, associating the cross-account Private Hosted Zone with the application VPC allows the application's default Route 53 Resolver to resolve domains within the private hosted zone.

Step-by-Step Solution

1
Ensure NAT Gateway redundancy by deploying a NAT Gateway in a public subnet in each Availability Zone.
Workloads in each Availability Zone route outbound traffic locally, preventing a single point of failure and avoiding cross-AZ data transfer latency and costs.
Designing for high availability requires eliminating single points of failure at the Availability Zone level.
2
Associate the Route 53 Private Hosted Zone (PHZ) in the Shared Services account with the application VPC.
The VPC is authorized to query the private DNS records hosted in the Shared Services account.
Private Hosted Zones must be explicitly associated with a VPC to allow internal DNS resolution from within that VPC.

Key Concept

High-availability VPC egress design and cross-account Route 53 Private Hosted Zone association.
Estimated Time:1m 30s
Question 926Question →

A company is configuring centralized logging and monitoring for its multi-account environment managed by AWS Organizations. The goal is to collect application logs from Amazon EC2 instances in various application accounts and deliver them to a central S3 bucket in a dedicated Security account. On the EC2 instances, the application logs are rotated hourly. Additionally, the company needs to collect memory utilization metrics from the EC2 instances. Which two configurations are required to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure the Unified CloudWatch Agent on the EC2 instances using a wildcard path pattern such as /var/log/app/*.log to capture both active and rotated logs, and include the memory metrics under the metrics section of the agent configuration file.; Apply a bucket policy to the centralized S3 bucket in the Security account that grants s3:PutObject permissions to the application accounts, specifying a condition that restricts access to the AWS Organization ID.

Answer

Configure the Unified CloudWatch Agent with wildcard paths and memory metrics, and apply an S3 bucket policy in the central security account allowing writes from the organization.
The correct configuration requires configuring the Unified CloudWatch Agent with wildcard path patterns to collect rotated logs and memory metrics, and applying a bucket policy on the centralized S3 bucket that permits write access to the AWS Organization's accounts using the organizational ID condition.

Step-by-Step Solution

1
Configure the Unified CloudWatch Agent on the EC2 instances.
Memory metrics and rotated log files (using wildcard paths) are successfully published to CloudWatch Logs.
This is required because standard EC2 memory metrics are not sent to CloudWatch by default, and rotated logs will be missed if static file paths are used.
2
Configure the centralized S3 bucket policy in the security account.
The bucket policy allows cross-account log delivery from all accounts within the AWS Organization.
Cross-account access to the central S3 bucket must be explicitly allowed using a bucket policy with an organizational ID condition.

Key Concept

Operational Excellence via centralized logging and monitoring involves configuring agents to handle rotated log patterns and setting up secure cross-account permissions on destination buckets.
Question 927Question →

A company runs a critical reporting application that queries an Amazon RDS PostgreSQL Multi-AZ DB instance. During monthly billing cycles, CPU utilization on the database spikes to 100% due to heavy read-only queries, causing performance degradation for other application functions. A solutions architect needs to optimize the database performance to offload these read queries. Which of the following is the most effective solution to resolve the bottleneck?

Show answer & explanation

Answer: Create one or more RDS Read Replicas of the database, and configure the reporting application to direct its read queries to the read replica endpoints.

Answer

Create one or more RDS Read Replicas of the database, and configure the reporting application to direct its read queries to the read replica endpoints.
Creating RDS Read Replicas allows you to offload read-heavy workloads from the primary DB instance, reducing CPU utilization and optimizing database performance. Amazon RDS supports replication to multiple read replicas, allowing client applications to separate read and write paths efficiently.

Step-by-Step Solution

1
Identify the performance bottleneck on the primary database.
Heavy read-only query spikes during billing cycles are causing 100% CPU utilization.
This establishes that the database is experiencing a read-bound compute bottleneck.
2
Evaluate the current Multi-AZ deployment's capability to handle read queries.
Multi-AZ standby instances are passive and cannot be queried.
This eliminates using the standby instance directly for reads.
3
Implement a horizontal read-scaling solution.
Provision RDS Read Replicas that asynchronously replicate data from the primary instance.
Read replicas are designed specifically to offload query workloads and scale read operations.
4
Point the reporting application to the new read replica endpoints.
Analytical traffic is isolated to the read replicas, relieving CPU pressure on the primary database.
This completes the optimization path by redirecting read queries away from the primary transactional instance.

Key Concept

Scaling read performance using Amazon RDS Read Replicas
Estimated Time:1m 0s
Question 928Question →

An enterprise runs a critical e-commerce platform in an active-passive disaster recovery configuration across two AWS Regions: us-east-1 (Primary) and us-west-2 (Secondary). The architecture includes an Application Load Balancer (ALB) and an Auto Scaling group of Amazon EC2 instances in each region. The database layer uses an Amazon Aurora PostgreSQL Global Database, with the primary cluster in us-east-1 and a read replica cluster in us-west-2. Amazon Route 53 public hosted zones are configured with failover routing records pointing to the primary and secondary ALBs. During a simulated database outage in us-east-1, the database became completely unresponsive, but the EC2 instances and ALB remained healthy, preventing Route 53 from failing over and causing client requests to fail. Which combination of actions should the Solutions Architect implement to automate failover to the secondary region while meeting an RTO of 15 minutes and an RPO of 5 minutes?

Show answer & explanation

Answer: Modify the web application's health check endpoint to execute a query verifying database read and write capability. Set the Application Load Balancer (ALB) target group in the primary region to use this endpoint. In Amazon Route 53, configure the primary failover alias record with 'Evaluate Target Health' set to true. Create an Amazon CloudWatch alarm on the Route 53 health check status that triggers an AWS Lambda function to promote the secondary Aurora database cluster in the secondary region when the primary region is unhealthy.

Answer

Modify the web application's health check endpoint to validate database connectivity, enable 'Evaluate Target Health' on the primary Route 53 record, and use a CloudWatch alarm with an AWS Lambda function to promote the secondary Aurora cluster.
The correct solution updates the application health check endpoint to check database connectivity. This allows the ALB to determine if the backend database is down and report the targets as unhealthy. By setting 'Evaluate Target Health' to true on the primary Route 53 failover record, Route 53 automatically stops routing traffic to the primary ALB when all targets are unhealthy, and fails over to the secondary ALB. Concurrently, a CloudWatch alarm triggers an AWS Lambda function to promote the secondary Aurora cluster to primary, allowing the secondary region to accept writes and satisfy the RTO and RPO requirements.

Step-by-Step Solution

1
Implement a database connectivity query within the application's health check endpoint (e.g., `/health`).
The ALB target group health check will fail if the EC2 instances cannot connect to or write to the Aurora database.
This links the health of the database layer to the health of the application layer from the ALB's perspective.
2
Enable 'Evaluate Target Health' on the primary Route 53 failover alias record pointing to the primary ALB.
Route 53 will mark the primary alias record as unhealthy when all EC2 instances fail the health check due to the database outage.
This automates public DNS failover to the secondary region's ALB without manual intervention.
3
Create a CloudWatch alarm on the Route 53 health check or ALB target group health to trigger an AWS Lambda function.
The Lambda function executes and calls `rds.promote_read_replica_db_cluster` on the secondary Aurora cluster in us-west-2.
Promoting the secondary cluster is required to turn it into a standalone primary cluster capable of accepting write traffic, meeting the recovery objectives.

Key Concept

End-to-end health checking and automated database promotion are required to ensure successful multi-region disaster recovery failover.
Estimated Time:2m 30s
Question 929Question →

An enterprise maintains a legacy critical application hosted on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in AWS Organizations. The application rotates its internal logs hourly, renaming the active log file `/var/log/app/transaction.log` to `/var/log/app/transaction.log.YYYY-MM-DD-HH` and compressing it. System operators need to aggregate these rotated logs into a centralized Amazon S3 bucket located in a dedicated Security account. The collection must occur in near real-time, preserve the rotated files, and tolerate instance termination. The current setup uses a CloudWatch agent configuration that fails to send rotated logs consistently, and logs are occasionally lost. Which of the following solutions should a Solutions Architect implement to resolve this logging gap and ensure operational excellence?

Show answer & explanation

Answer: Update the CloudWatch agent configuration on the EC2 instances to specify `/var/log/app/transaction.log*` in the file path and enable log auto-rotation tracking. Configure the CloudWatch log group to stream to an Amazon Kinesis Data Firehose in the Security account via a cross-account CloudWatch subscription filter, which then delivers the logs to the centralized S3 bucket.

Answer

Configure the CloudWatch agent to track rotated files with a wildcard pattern and stream logs cross-account using CloudWatch subscription filters to Amazon Kinesis Data Firehose, which writes to the centralized S3 bucket.
The correct solution uses the CloudWatch agent configured with a wildcard pattern to ensure log rotation does not interrupt log ingestion. It then leverages CloudWatch subscription filters to stream logs to a centralized Kinesis Data Firehose in the Security account in near real-time, guaranteeing durability and decoupling the source instances from direct S3 access.

Step-by-Step Solution

1
Configure the CloudWatch agent with wildcards.
The agent tracks the active log file and rotated files matching the pattern `/var/log/app/transaction.log*`.
This ensures that when the log is rotated and renamed, the agent identifies the rotation and continues forwarding new logs without loss.
2
Set up CloudWatch Subscription Filters.
Log groups in individual accounts stream log data to a destination in the centralized Security account.
This provides real-time, cross-account log routing directly from CloudWatch Logs to a centralized processing stream.
3
Deploy Amazon Kinesis Data Firehose.
Log data is batched, compressed, and delivered to the central S3 bucket in the Security account.
This ensures delivery reliability, manages ingestion rate limits, and secures logs in a read-only centralized location.

Key Concept

Cross-account log aggregation with rotation resilience
Question 930Question →

A logistics platform runs a fleet of delivery tracking services on Amazon EC2 instances. The tracking application outputs internal transaction metrics to a file located at `/var/log/tracking/session.log`. During peak hours, a cron job on the server executes a log rotation script that compresses and renames the active log file to `/var/log/tracking/archive-[timestamp].log.gz` and creates a new empty `/var/log/tracking/session.log`. The operations team uses the Unified CloudWatch Agent to monitor these metrics, but they notice that metrics are missing for hours at a time, specifically starting immediately after each log rotation event. Which configuration change will ensure that the CloudWatch Agent continuously collects the log files without interruption?

Show answer & explanation

Answer: Update the agent configuration file to use the wildcard path `/var/log/tracking/session*` in the `file_path` parameter, ensuring that the agent dynamically tracks both the active and renamed log files.

Answer

Updating the CloudWatch Agent configuration file to use a wildcard path such as `/var/log/tracking/session*` in the `file_path` parameter is the correct solution.
Updating the agent configuration file to use a wildcard path allows the agent to track both the active and renamed log files dynamically, preventing any interruption in log collection.

Step-by-Step Solution

1
Identify how the log rotation script behaves on the EC2 instances.
The script renames the active file `/var/log/tracking/session.log` and creates a new empty file, which changes the file identity (inode/descriptor) tracked by the agent.
Understanding the rotation mechanism helps determine why a static file path configuration fails to capture logs post-rotation.
2
Evaluate the CloudWatch Agent configuration options for file paths.
A static file path fails to track renamed files, whereas a wildcard pattern like `/var/log/tracking/session*` allows the agent to dynamically discover and monitor files matching the pattern.
Selecting the correct wildcard path resolves the tracking gap during and after log rotation.

Key Concept

Configuring CloudWatch Agent to handle log rotation using wildcards.
Question 931Question →

A financial enterprise is designing a new multi-account AWS architecture in the us-west-2 Region. The design includes two spoke VPCs, App-VPC-01 (CIDR 10.1.0.0/16) and App-VPC-02 (CIDR 10.2.0.0/16), which host application workloads in private subnets across two Availability Zones. A third VPC, Shared-Services-VPC (CIDR 10.100.0.0/16), hosts a shared database cluster. The enterprise has the following requirements:

* Workloads in both spoke VPCs must access the shared database cluster in the Shared-Services-VPC.
* Workloads in App-VPC-01 and App-VPC-02 must be strictly isolated from each other at the network routing layer.
* Workloads in the spoke VPCs must privately resolve the database domain db.corp.internal, which is hosted in a Route 53 Private Hosted Zone (PHZ) in the shared services account.
* Outbound internet egress for all VPCs must be routed through a centralized egress VPC (Egress-VPC) for inspection via AWS Network Firewall. The outbound egress architecture must be resilient to Availability Zone outages.

Which of the following designs meets these requirements with the least operational complexity?

Show answer & explanation

Answer: Deploy an AWS Transit Gateway. Create a Spoke Transit Gateway Route Table associated with the App-VPC-01 and App-VPC-02 attachments, with routes to the Shared-Services-VPC attachment and a default route (0.0.0.0/0) pointing to the Egress-VPC attachment. Create a Shared Services Transit Gateway Route Table associated with the Shared-Services-VPC attachment, with routes to both spoke VPC attachments and a default route to the Egress-VPC attachment. Deploy NAT Gateways in multiple Availability Zones within the Egress-VPC. Associate the db.corp.internal Private Hosted Zone with App-VPC-01, App-VPC-02, and Shared-Services-VPC using cross-account authorization.

Answer

Deploy an AWS Transit Gateway with separate Spoke and Shared Services Route Tables to enforce routing isolation. Deploy NAT Gateways in multiple Availability Zones in the Egress-VPC for resiliency. Associate the Private Hosted Zone with all VPCs using cross-account authorization.
The correct solution uses Transit Gateway custom route tables to prevent spoke-to-spoke communication at the routing layer. It routes spoke traffic only to the shared services and egress VPCs, fulfilling the isolation requirement. Outbound resilience is achieved by deploying NAT Gateways across multiple Availability Zones in the egress VPC. DNS resolution is correctly and efficiently achieved by directly associating the Private Hosted Zone with the spoke VPCs via cross-account authorization.

Step-by-Step Solution

1
Configure Transit Gateway custom routing tables.
Create separate Spoke and Shared Services Transit Gateway route tables. Associate the spoke VPC attachments with the Spoke Route Table and configure routes to the Shared-Services-VPC and the default route to the Egress-VPC. Associate the Shared-Services-VPC attachment with the Shared Services Route Table and configure routes to both spoke VPCs. This isolates the spoke VPCs at the network routing layer.
Prevents spoke-to-spoke communication while allowing spoke-to-shared and spoke-to-egress traffic.
2
Ensure outbound resiliency in the central egress VPC.
Deploy NAT Gateways in multiple Availability Zones in the Egress-VPC. Outbound traffic from Transit Gateway is distributed across these NAT Gateways based on availability.
Prevents a single Availability Zone outage from disrupting outbound internet access for all VPCs.
3
Set up private DNS resolution cross-account.
Associate the db.corp.internal Private Hosted Zone in the Shared Services account with App-VPC-01 and App-VPC-02 using Route 53 cross-account PHZ association commands.
Allows workloads in the spoke VPCs to resolve the database domain name using their local Route 53 resolvers without needing costly inbound/outbound resolver endpoints or trying to route DNS traffic over the Transit Gateway to a non-routable resolver IP address.

Key Concept

Multi-VPC isolation, private DNS resolution, and resilient egress routing using AWS Transit Gateway, Route 53 Private Hosted Zones, and multi-AZ NAT Gateways.
Estimated Time:3m 0s
Question 932Question →

An enterprise operates a multi-tier application across two AWS accounts in an AWS Organization. The production deployment is in VPC-A within the us-east-1 region, and the disaster recovery (DR) site is in VPC-B within the us-west-2 region. The database tier uses an Amazon Aurora PostgreSQL Global Database, with the primary cluster in VPC-A and a secondary replica cluster in VPC-B. For internal communication, the database cluster's endpoints are registered in a Route 53 Private Hosted Zone (PHZ) named db.internal.example.com created in the production account.

During a disaster recovery exercise, the Solutions Architect initiates a failover by promoting the secondary database cluster in us-west-2 to primary and updates the DNS records. Although the Aurora database cluster promotion is successful, the application servers in VPC-B fail to connect to db.internal.example.com, resulting in DNS resolution failures.

What is the root cause of this failure, and how should it be resolved to ensure reliable disaster recovery?

Show answer & explanation

Answer: The Route 53 Private Hosted Zone is not associated with VPC-B. To resolve this, authorize the association of VPC-B with the Private Hosted Zone from the production account, and then associate VPC-B with the Private Hosted Zone from the disaster recovery account.

Answer

The root cause is that the Route 53 Private Hosted Zone was not associated with VPC-B. To resolve it, the owner of the Private Hosted Zone in the production account must authorize the cross-account VPC association, and the DR account must then associate VPC-B with the hosted zone.
The correct answer identifies that a Route 53 Private Hosted Zone (PHZ) is only accessible to VPCs that are explicitly associated with it. Since the PHZ is created in the production account and associated with VPC-A, it is not accessible to VPC-B in the disaster recovery account by default. To resolve this in a multi-account environment, the production account must authorize the association of VPC-B with the PHZ, and then the disaster recovery account must associate VPC-B with the PHZ. Once this association is established, the application servers in VPC-B will be able to resolve database endpoints using the PHZ.

Step-by-Step Solution

1
Verify DNS resolution from the disaster recovery VPC (VPC-B).
The application servers fail to resolve db.internal.example.com to any IP address.
By default, Route 53 Private Hosted Zones are only accessible to VPCs that have been explicitly associated with them.
2
Authorize the cross-account VPC association.
The production account authorizes VPC-B in the DR account to associate with the Private Hosted Zone.
AWS cross-account Route 53 Private Hosted Zone association requires explicit authorization from the hosting account before the association can be made.
3
Associate the VPC with the Private Hosted Zone from the DR account.
VPC-B is successfully associated with db.internal.example.com.
Once authorized, the DR account can submit the association request, allowing instances in VPC-B to resolve the database endpoints.

Key Concept

Cross-account and cross-VPC DNS resolution using Route 53 Private Hosted Zones for disaster recovery failover.
Estimated Time:2m 0s
Question 933Question →

A company runs a three-tier web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application's database is a single-node Amazon RDS for PostgreSQL instance. During high-traffic events, users experience slow response times. System metrics indicate that EC2 CPU utilization remains below 35%35\%, but the RDS instance CPU utilization reaches 98%98\% due to a large volume of read-only reporting queries. Which architectural optimization should a solutions architect implement to resolve the performance bottleneck with the least operational overhead?

Show answer & explanation

Answer: Deploy Amazon RDS Read Replicas and configure the application to route read-only queries to the read replica endpoints.

Answer

Deploy Amazon RDS Read Replicas and configure the application to route read-only queries to the read replica endpoints.
Deploying Amazon RDS Read Replicas is the correct strategy because it allows the read-only reporting queries to be directed to a separate read replica endpoint. This offloads read traffic from the primary database instance, lowering its CPU utilization and resolving the performance bottleneck without requiring significant application refactoring.

Step-by-Step Solution

1
Identify the primary source of the performance bottleneck.
EC2 instances have low CPU utilization (<35%<35\%), but the RDS database has extremely high CPU utilization (98%98\%) due to read-only queries.
Resolving the database CPU bottleneck is the key to improving application response times.
2
Select the correct optimization strategy for read-heavy RDS databases.
RDS Read Replicas are identified as the standard mechanism to offload read-only traffic from the primary instance.
Routing reporting queries to read replicas directly reduces the primary database CPU workload without modifying the database engine.

Key Concept

Horizontal scaling of database workloads using Read Replicas versus High Availability configurations.
Question 934Question →

An enterprise is reviewing the network architecture of its multi-tier application in the us-east-1 region to optimize performance and reduce latency. The application is deployed across multiple private subnets in three Availability Zones. Currently, the instances in all three Availability Zones access external APIs via a single NAT Gateway located in Availability Zone us-east-1a. During peak hours, the application experiences high latency and connection timeouts when communicating with external API endpoints. Additionally, instances need to resolve internal service names hosted in a Route 53 Private Hosted Zone (PHZ) created in a shared services VPC, but internal queries currently resolve to public endpoints over the internet, causing additional latency and security concerns. Which set of actions will resolve the latency issues and optimize network performance?

Show answer & explanation

Answer: Deploy a NAT Gateway in each of the three Availability Zones, update the route tables for the private subnets to route outbound traffic through the local NAT Gateway in their respective zones, and associate the shared services Private Hosted Zone with the application VPC.

Answer

Deploy a NAT Gateway in each of the three Availability Zones, update the route tables for the private subnets to route outbound traffic through the local NAT Gateway in their respective zones, and associate the shared services Private Hosted Zone with the application VPC.
Deploying local NAT Gateways in each Availability Zone ensures that outbound traffic does not cross AZ boundaries, eliminating the latency bottleneck and single point of failure. Associating the Private Hosted Zone with the application VPC enables private DNS resolution directly within the VPC, reducing resolution latency and keeping traffic secure.

Step-by-Step Solution

1
Analyze and eliminate the NAT Gateway bottleneck.
Identify that routing traffic from all three Availability Zones through a single NAT Gateway in us-east-1a causes bottlenecking and latency. Deploying a NAT Gateway in each Availability Zone and updating subnet route tables resolves the bottleneck.
This keeps outbound internet traffic local to each Availability Zone, reducing inter-AZ latency and resolving throughput issues.
2
Resolve the DNS resolution latency issue.
Associate the Route 53 Private Hosted Zone (PHZ) created in the shared services VPC with the application VPC.
This allows internal service names to resolve privately and locally within the application VPC, bypassing public internet DNS lookup latency.
3
Verify transitive routing configuration.
Keep the existing AWS Transit Gateway configuration for VPC-to-VPC routing instead of attempting transitive routing via a Direct Connect Gateway.
Direct Connect Gateway does not support transitive VPC-to-VPC routing, and Transit Gateway is required for this topology.

Key Concept

Optimizing hybrid and multi-VPC networking through redundant NAT Gateways and Private Hosted Zone associations.
Estimated Time:2m 0s
Question 935Question →

A pharmaceutical company is launching a new research platform using AWS Organizations. The architecture requires a compliance auditing application hosted on an Amazon Elastic Container Service (ECS) cluster running on AWS Fargate in the Compliance account (444444444444444444444444) to regularly analyze raw clinical research data stored in an Amazon S3 bucket within the Research account (555555555555555555555555). The clinical research data is encrypted at rest using AWS KMS. The security policy mandates that all access to the S3 bucket must be restricted to authorized roles, and the ECS task role in the Compliance account must have read-only access to the S3 bucket and be able to decrypt the objects. An SCP is attached to the Research OU that allows KMS decryption actions. Which of the following configurations will securely enable the ECS task role to access and decrypt the S3 objects?

Show answer & explanation

Answer: In the Research account, create a Customer Managed Key (CMK) and configure its key policy to grant the Compliance account's ECS task role (arn:aws:iam::444444444444:role/EcsTaskRole) permission for kms:Decrypt. In the Research account, update the S3 bucket policy to grant s3:GetObject to the ECS task role. In the Compliance account, attach an IAM policy to the ECS task role that allows s3:GetObject on the Research S3 bucket and kms:Decrypt on the Research CMK.

Answer

In the Research account, create a Customer Managed Key (CMK) and configure its key policy to grant the Compliance account's ECS task role permission for kms:Decrypt. In the Research account, update the S3 bucket policy to grant s3:GetObject to the ECS task role. In the Compliance account, attach an IAM policy to the ECS task role that allows s3:GetObject on the Research S3 bucket and kms:Decrypt on the Research CMK.
The correct configuration establishes a complete trust chain for cross-account access: the Research account's S3 bucket policy allows the Compliance ECS task role to perform s3:GetObject, the Research CMK key policy allows the ECS task role to perform kms:Decrypt, and the Compliance account's IAM policy grants the ECS task role the necessary permissions to call these resources. A Customer Managed Key (CMK) is used because AWS-managed keys cannot be shared across accounts.

Step-by-Step Solution

1
Select a key type that supports cross-account delegation.
Choose a Customer Managed Key (CMK) instead of the AWS-managed KMS key for S3 (aws/s3), because AWS-managed keys cannot be shared across accounts.
AWS-managed keys have key policies that cannot be modified, which makes cross-account decryption impossible.
2
Configure permissions in the trust-owning account (Research account).
Update the S3 bucket policy to allow the Compliance ECS task role to perform s3:GetObject, and configure the CMK key policy to allow the Compliance ECS task role to perform kms:Decrypt.
Cross-account access to S3 and KMS requires the resource owner to explicitly trust the external principal.
3
Configure permissions in the calling account (Compliance account).
Attach an IAM policy to the ECS task role that grants s3:GetObject on the Research S3 bucket and kms:Decrypt on the Research CMK.
The IAM principal must be granted local permission to execute these actions on the remote resources.

Key Concept

Cross-account access with KMS encryption requires explicit authorization in the resource-owning account's policies (S3 bucket policy and KMS key policy) and the caller account's IAM policy, and cannot utilize AWS-managed keys.
Estimated Time:3m 0s
Question 936Question →

An IoT fleet tracking platform processes telemetry data from 500,000 devices. The ingestion layer uses an Application Load Balancer (ALB) routing traffic to an Auto Scaling group (ASG) of Amazon EC2 c6i.xlarge instances. The instances write raw telemetry payloads to 100 GB Amazon EBS gp3 volumes (configured with default 3,000 IOPS and 125 MB/s throughput) for local validation, sorting, and batching before saving the consolidated records to an Amazon Aurora PostgreSQL database. During scheduled daily synchronization events, device telemetry spikes instantly by 10x. During these periods, users experience slow API responses, and CloudWatch metrics reveal high write latency on the EC2 instances, a significant spike in HTTPCode_ELB_5XX_Count at the start of the synchronization, and increased read replica lag on Aurora Reader instances. Which combination of architectural modifications will resolve these performance bottlenecks with the lowest latency and cost?

Show answer & explanation

Answer: Migrate the EC2 instances to c6id.xlarge instances and configure the application to write temporary validation files to the local NVMe instance store; request AWS Support to pre-warm the ALB prior to the scheduled daily synchronization events; and implement Aurora Auto Scaling for Aurora Replicas to handle the database read load.

Answer

Migrate the EC2 instances to c6id.xlarge instances and configure the application to write temporary validation files to the local NVMe instance store; request AWS Support to pre-warm the ALB prior to the scheduled daily synchronization events; and implement Aurora Auto Scaling for Aurora Replicas to handle the database read load.
The correct solution addresses the storage bottleneck by migrating the processing nodes to c6id instances that include high-performance, low-latency local NVMe instance store. This is ideal for short-term processing and validation files, eliminating the cost and bottleneck of provisioned EBS volumes. For the sudden, scheduled 10x flash traffic spike, requesting AWS to pre-warm the Application Load Balancer ensures that the load balancer has the immediate capacity to handle the connection rate without dropping packets or throwing 5XX errors. Finally, implementing Aurora Auto Scaling for the replicas dynamically increases read capacity to prevent replication lag during heavy processing.

Step-by-Step Solution

1
Address the local storage bottleneck by replacing the EBS volumes with local NVMe instance stores.
Temporary validation files are written to low-latency, high-IOPS local NVMe disks on c6id instances, eliminating EBS write latency and queue depth issues.
Since the validation, sorting, and batching files are temporary before being stored in the database, they do not require persistent EBS storage and can leverage the high performance of ephemeral instance stores.
2
Address the ALB connection drops by preparing for the flash traffic spike.
AWS Support pre-warms the ALB to have sufficient capacity to handle the 10x instant traffic increase.
Standard Auto Scaling and load balancer scaling are reactive and take time. For scheduled events with massive instantaneous traffic spikes, pre-warming is required to avoid 503 Service Unavailable errors.
3
Address database read performance bottlenecks.
Aurora Auto Scaling automatically adds Aurora Replicas to the cluster as read lag increases, scaling out query capacity.
Aurora Reader instances handle read queries, and scaling them dynamically ensures the application maintains low latency under peak read traffic.

Key Concept

Optimizing compute and storage performance requires identifying ephemeral vs. persistent data access patterns, configuring appropriate instance-attached storage (NVMe instance store vs. EBS), pre-warming network resources for flash traffic, and correctly scaling databases using read replicas rather than standby instances.

Alternative Method

Instead of pre-warming the ALB, if the client telemetry ingestion protocol can be modified, decoupling the ingestion layer by placing Amazon Kinesis Data Streams or Amazon SQS directly behind the API Gateway or ALB can buffer the incoming telemetry data, allowing the EC2 instances to process the queue at a steady rate without overloading the storage layer or database.
Estimated Time:3m 0s
Question 937Question →

A company hosts a critical web application in a single AWS Region. The application tier runs on Amazon EC2 instances within an Auto Scaling group, and the database tier uses Amazon RDS for PostgreSQL. The company wants to implement a cost-effective Pilot Light disaster recovery (DR) strategy in a secondary AWS Region. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon RDS cross-region read replica in the secondary Region to replicate database changes.; Pre-configure an Auto Scaling group in the secondary Region using Amazon Machine Images (AMIs) copied from the primary Region, keeping the desired capacity at zero.

Answer

Configure an Amazon RDS cross-region read replica in the secondary Region, and pre-configure an Auto Scaling group in the secondary Region using AMIs copied from the primary Region with a desired capacity of zero.
In a Pilot Light disaster recovery architecture, the database is kept running in the recovery region and updated continuously. The option recommending an Amazon RDS cross-region read replica meets this requirement by asynchronously copying data changes to the secondary Region. The compute resources remain inactive to minimize costs, which is accomplished by pre-configuring the Auto Scaling group in the secondary Region with a desired capacity of zero and preparing the necessary AMIs.

Step-by-Step Solution

1
Determine the data replication requirement for the Pilot Light strategy.
Identify that the database must be kept active and updated asynchronously in the disaster recovery region.
This maintains a low Recovery Point Objective (RPO) without incurring the cost of a fully active multi-region database setup.
2
Determine the compute resource requirement for the Pilot Light strategy.
Identify that compute resources like EC2 instances should not be running during normal operations to save costs, but must be ready to provision quickly.
An Auto Scaling group configured with a desired capacity of zero ensures no charges are incurred for active compute instances, but the configuration template is ready for rapid scaling.

Key Concept

The Pilot Light disaster recovery pattern keeps core data services active and replicating while keeping application and compute servers scaled down to zero until a failover is initiated.
Question 938Question →

A media company hosts a video processing platform on AWS. The application runs on Amazon EC2 instances in an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The instances process large 4K video uploads (averaging 40 GB40\text{ GB} to 60 GB60\text{ GB} each) that are downloaded from Amazon S3, transcoded locally, and uploaded back to S3. The transcoding software requires metadata from an Amazon Aurora PostgreSQL database deployed in a Multi-AZ configuration.

During recent scheduled marketing campaigns, the company encountered several performance issues:
* Transcoding execution times increased significantly, and the EC2 instances showed high I/O wait times and disk queue length, while instance CPU utilization remained under 35%35\%. The instances utilize 1 TB1\text{ TB} Amazon EBS gp3 volumes with default settings (3,0003,000 IOPS and 125 MB/s125\text{ MB/s} throughput).
* The ALB dropped incoming user connections at the start of the campaigns before the ASG could launch new instances.
* The database experienced high CPU utilization and query timeouts due to a spike in read-intensive analytical queries.

Which combination of actions will optimize the performance of the system to resolve these bottlenecks?

Show answer & explanation

Answer: Increase the throughput of the gp3 volumes to 500 MB/s500\text{ MB/s} to resolve the storage bottleneck. Submit a request to AWS Support to pre-warm the Application Load Balancer prior to the scheduled marketing campaigns. Create Aurora Replicas to offload the read-intensive queries and update the application to use the Aurora reader endpoint.

Answer

Increase the throughput of the gp3 volumes to 500 MB/s500\text{ MB/s}, request ALB pre-warming from AWS Support prior to the campaigns, and add Aurora Replicas to serve read-intensive queries via the reader endpoint.
The correct option addresses the throughput bottleneck on the EBS volumes by increasing the gp3 throughput to 500 MB/s500\text{ MB/s} (since large video file processing is highly sequential and throughput-bound rather than IOPS-bound). It solves the ALB flash traffic connection drops by proactively pre-warming the ALB via AWS Support. Lastly, it resolves the database query timeouts by scaling the database reads horizontally using Aurora Replicas and routing them to the reader endpoint.

Step-by-Step Solution

1
Identify the EBS storage bottleneck.
The 1 TB1\text{ TB} gp3 volume provides 125 MB/s125\text{ MB/s} throughput by default. Transcoding large files (up to 60 GB60\text{ GB}) is highly sequential and throughput-bound, causing high disk queue length and I/O wait times despite low CPU.
Increasing gp3 throughput to 500 MB/s500\text{ MB/s} removes this bottleneck without changing the volume type.
2
Address the load balancer capacity during flash traffic.
ALB auto-scaling is gradual and cannot handle sudden 10x spikes instantly, causing connection drops.
Pre-warming the ALB via AWS Support scales the load balancer capacity in advance of the campaign.
3
Scale the database read throughput.
The database runs analytical queries on a Multi-AZ deployment.
Multi-AZ standby instances are passive and cannot serve read traffic. Adding Aurora Replicas and using the reader endpoint scales reads horizontally.

Key Concept

Identifying and optimizing compute, storage, and load balancing bottlenecks by utilizing GP3 throughput scaling, ALB pre-warming for flash traffic, and Aurora Replicas for read scalability.
Question 939Question →

An enterprise web application is hosted in the us-east-1 Region. Users located in Europe are experiencing high latency when accessing the application. At the same time, internal resources in the application VPC are unable to resolve the domain names of shared services hosted in a separate VPC. A Solutions Architect needs to optimize the network performance for global users and fix the internal resolution issues. Which of the following actions should the Solutions Architect take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy AWS Global Accelerator to route user traffic over the AWS global network to the application endpoints.; Associate the Route 53 Private Hosted Zone of the shared services VPC with the application VPC.

Answer

Deploying AWS Global Accelerator to route user traffic over the AWS global network, and associating the Route 53 Private Hosted Zone of the shared services VPC with the application VPC.
Deploying AWS Global Accelerator optimizes user access by onboarding traffic at edge locations near the users and routing it via the AWS backbone network, mitigating internet latency. Associating the Route 53 Private Hosted Zone with the application VPC ensures that resources within the application VPC can perform DNS queries for resources in the shared services VPC.

Step-by-Step Solution

1
Address the high latency for European users accessing the us-east-1 application.
Identify AWS Global Accelerator as a service that routes user traffic over the AWS global network rather than the public internet, reducing latency.
Global Accelerator utilizes anycast IP addresses to ingest traffic at the edge location closest to the user and forwards it over the AWS global network.
2
Address the internal DNS resolution issues for shared services VPC.
Associate the Route 53 Private Hosted Zone of the shared services VPC with the application VPC.
A Private Hosted Zone must be associated with a VPC to allow EC2 instances within that VPC to resolve the domain names defined in the host zone.

Key Concept

Optimizing external user network performance using AWS Global Accelerator, and resolving internal cross-VPC DNS resolution using Route 53 Private Hosted Zones.
Question 940Question →

A company is designing a new multi-tier application on AWS. The application workloads will be deployed across two Availability Zones in private subnets within a single VPC. The instances in the private subnets require outbound internet access to download software updates, but they must not receive inbound connections from the internet. The network design must be highly available and resilient to Availability Zone failures. Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a NAT Gateway in the public subnet of each Availability Zone.; Create a route in the route table of each private subnet that directs outbound traffic (0.0.0.0/0) to the NAT Gateway in the same Availability Zone.

Answer

To design a highly available outbound internet connectivity solution, deploy a NAT Gateway in the public subnet of each Availability Zone, and configure the private subnet route tables to direct outbound traffic to their respective local NAT Gateway.
To achieve high availability and zone resilience, a NAT Gateway must be deployed in the public subnet of each Availability Zone, and the route tables for the private subnets must be configured to point to their local NAT Gateway. This ensures that a failure in one Availability Zone does not impact the outbound connectivity of instances in the remaining active Availability Zone.

Step-by-Step Solution

1
Deploy a NAT Gateway in the public subnet of each Availability Zone.
This ensures that each Availability Zone has a local egress point, preventing a single zone outage from affecting egress connectivity across the entire VPC.
High availability requirements demand that we avoid single points of failure like a single NAT Gateway for multiple zones.
2
Create or update the route table for each private subnet, adding a route for 0.0.0.0/0 pointing to the local NAT Gateway.
Outbound traffic from the private subnets is correctly routed to the NAT Gateway residing in the same Availability Zone.
This establishes path redundancy and alignment with the NAT Gateways deployed in step 1.

Key Concept

Deploying multi-AZ NAT Gateways for highly available, resilient outbound network address translation.
PreviousPage 47 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin