All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A company hosts a real-time financial transaction reconciliation application on AWS. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The database tier utilizes an Amazon RDS for PostgreSQL Multi-AZ DB instance with 1 TB gp3 storage.

During scheduled end-of-day reconciliation events, the application experiences a massive, instantaneous surge in traffic. This results in HTTP 503 Service Unavailable errors from the ALB, high write latency on the database, and CPU utilization reaching 100% on the primary database instance due to concurrent read-heavy audit queries.

Which combination of actions should a Solutions Architect take to optimize the compute, database, and storage performance to handle the peak load?

Submit a request to AWS Support to pre-warm the Application Load Balancer prior to the scheduled reconciliation events. Deploy one or more Amazon RDS for PostgreSQL Read Replicas, and update the application to route read-heavy audit queries to the read replica endpoints. Increase the provisioned IOPS and throughput of the gp3 storage on the primary DB instance to meet the peak write requirements.

Configure the Application Load Balancer to auto-scale dynamically by reducing the target group registration delay. Modify the application to route the read-heavy audit queries to the standby DB instance endpoint of the Multi-AZ deployment to distribute the CPU load. Upgrade the database storage from gp3 to gp2 to leverage burstable performance.

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache dynamic transaction traffic. Deploy an Amazon ElastiCache for Memcached cluster, configure it with multi-AZ replication, and use it to store and persist the transactional log data for audit queries. Increase the database instance size to scale the write throughput.

Modify the EC2 Auto Scaling group launch template to use a minimal Amazon Machine Image (AMI), and set the scaling cooldown period to 15 seconds to allow the compute tier to scale out rapidly during the spike. Deploy one or more Amazon RDS for PostgreSQL Read Replicas to offload audit queries. Migrate the primary database storage to an io2 volume with 64,000 provisioned IOPS to resolve write latency.

Show answer & explanation

Answer: Submit a request to AWS Support to pre-warm the Application Load Balancer prior to the scheduled reconciliation events. Deploy one or more Amazon RDS for PostgreSQL Read Replicas, and update the application to route read-heavy audit queries to the read replica endpoints. Increase the provisioned IOPS and throughput of the gp3 storage on the primary DB instance to meet the peak write requirements.

Answer

The correct solution resolves the Application Load Balancer capacity issues by proactively requesting pre-warming for scheduled events, offloads database reads to dedicated RDS Read Replicas (since standby instances in standard Multi-AZ deployments cannot accept connections), and increases gp3 provisioned IOPS and throughput to resolve write latency issues at the storage layer.

Step-by-Step Solution

Address load balancer bottleneck for scheduled flash traffic.

Request AWS Support to pre-warm the Application Load Balancer.

Since the traffic spike is instantaneous and scheduled, standard reactive scaling of the ALB is too slow and will cause dropped requests (HTTP 503 errors).

Address primary database CPU saturation caused by read operations.

Deploy Amazon RDS PostgreSQL Read Replicas and route read-heavy audit queries to their endpoints.

Standard Multi-AZ standby instances cannot serve read connections. Read replicas offload query workloads from the primary DB instance, freeing up resources for transaction writes.

Optimize storage performance on the primary database.

Increase provisioned IOPS and throughput for the existing gp3 storage volumes.

gp3 volumes allow independent scaling of performance characteristics (IOPS and throughput) up to 16,000 IOPS and 1,000 MB/s, mitigating write latency bottlenecks without requiring dynamic storage tier migrations.

Key Concept

Performance optimization across compute, database, and storage layers under high transactional load and flash traffic.

Question 982Question →

A gaming company has a mobile application that retrieves a high volume of read-only player profile data from an Amazon Aurora MySQL database, causing high read latency during peak hours. The database administrator wants to implement an in-memory caching layer to offload the database. The caching solution must support replication across multiple Availability Zones to ensure high availability. Which caching solution should a Solutions Architect recommend to meet these requirements?

Amazon RDS Multi-AZ standby instance configured to serve the read queries

Amazon ElastiCache for Memcached

Amazon ElastiCache for Redis

Amazon DynamoDB Accelerator (DAX)

Show answer & explanation

Answer: Amazon ElastiCache for Redis

Answer

Amazon ElastiCache for Redis

The correct answer is Amazon ElastiCache for Redis because it provides in-memory caching to decrease read latency and natively supports data replication across multiple Availability Zones to ensure high availability.

Step-by-Step Solution

Identify the caching layer requirements from the scenario.

The application needs an in-memory caching layer to offload reads from Amazon Aurora MySQL, with support for replication across multiple Availability Zones.

Understanding the need for an in-memory cache and its high availability constraints narrows the service choices.

Evaluate Amazon ElastiCache options based on replication capabilities.

Amazon ElastiCache for Redis supports replication, Multi-AZ clustering, and automatic failover, whereas Amazon ElastiCache for Memcached does not support native replication.

This rules out Memcached and confirms Redis as the correct caching engine.

Key Concept

Distinguishing between ElastiCache engines based on replication and high availability capabilities.

Estimated Time:1m 0s

Question 983Question →

A company is reviewing the AWS WAF configuration for an existing web application hosted behind an Application Load Balancer. The security team has configured an AWS WAF Web ACL with two rules: a rule with priority 10 that allows all traffic from a partner's IP address range, and a rule with priority 20 that blocks requests containing SQL injection patterns. Developers report that malicious SQL injection attacks originating from the partner's IP address range are successfully reaching the application. Which adjustment should a solutions architect recommend to resolve this security issue?

Reorder the Web ACL rules so that the SQL injection block rule has a higher priority (lower priority number) than the partner IP address allow rule.

Apply a Service Control Policy (SCP) to the AWS Organizations member account that denies SQL injection attempts, as SCPs override local WAF rule evaluation orders.

Configure the WAF Web ACL logs to be encrypted with an AWS-managed KMS key (aws/s3) and delegate decryption access directly to the partner's IAM role.

Associate the Application Load Balancer's public VPC with a Route 53 Private Hosted Zone containing resolver rules that drop the SQL injection requests.

Show answer & explanation

Answer: Reorder the Web ACL rules so that the SQL injection block rule has a higher priority (lower priority number) than the partner IP address allow rule.

Answer

Reorder the Web ACL rules so that the SQL injection block rule has a higher priority (lower priority number) than the partner IP address allow rule.

AWS WAF evaluates rules in a Web ACL sequentially starting from the lowest priority number. Because the allow rule for the partner's IP has a priority of 10 and the SQL injection block rule has a priority of 20, any request from that IP matches the allow rule first and stops evaluation. Reordering the rules so that the SQL injection block rule has a higher priority (lower priority number) ensures that malicious SQL injection payloads from any source are inspected and blocked before the IP allow rule is processed.

Step-by-Step Solution

Analyze how AWS WAF processes Web ACL rules.

AWS WAF processes rules sequentially based on their priority values, starting from the lowest numerical value.

Understanding the sequential evaluation model is necessary to diagnose why the block rule is bypassed.

Determine the cause of the rule bypass.

Requests from the partner's IP match the allow rule at priority 10 first, terminating further evaluation and skipping the block rule at priority 20.

Allow actions in AWS WAF are terminating actions, meaning matching requests stop further Web ACL processing.

Adjust the rule evaluation sequence.

Moving the SQL injection block rule to a lower numerical priority (e.g., priority 5) ensures it runs before the partner IP rule.

This guarantees that malicious requests are blocked before the partner IP's allow action can be evaluated.

Key Concept

AWS WAF sequential rule evaluation and terminating actions

Question 984Question →

A startup is deploying a payment processing application in a VPC across three Availability Zones. The application instances reside in private subnets and must connect to external payment APIs over the internet. The architecture must protect these instances from inbound internet traffic and survive the failure of any single Availability Zone. Which of the following networking designs should the solutions architect select?

Deploy a single NAT Gateway in a public subnet in one Availability Zone, and configure the route tables of all private subnets across all zones to direct outbound internet traffic to this single NAT Gateway.

Deploy one NAT Gateway in a public subnet within each Availability Zone, and configure the route tables of the private subnets to direct outbound internet traffic to the NAT Gateway in the same zone.

Deploy a Direct Connect Gateway to establish transitive routing between the VPC private subnets and a shared services VPC containing a single NAT Gateway, directing all outbound traffic through the Direct Connect Gateway.

Deploy a NAT Gateway in a shared services VPC and create a Route 53 Private Hosted Zone for the external API endpoints, without associating the hosted zone with the application VPC.

Show answer & explanation

Answer: Deploy one NAT Gateway in a public subnet within each Availability Zone, and configure the route tables of the private subnets to direct outbound internet traffic to the NAT Gateway in the same zone.

Answer

Deploy one NAT Gateway in a public subnet within each Availability Zone, and configure the route tables of the private subnets to direct outbound internet traffic to the NAT Gateway in the same zone.

Deploying a NAT Gateway in each Availability Zone ensures that if one zone experiences an outage, instances in the remaining zones can still access the internet through their local NAT Gateways. This provides high availability and resilience.

Step-by-Step Solution

Analyze the high-availability requirement for outbound internet access across three Availability Zones.

Outbound connectivity must survive the failure of any single Availability Zone.

This requires redundancy at the zone level so that no single zone outage disrupts traffic in other zones.

Evaluate the options for NAT Gateway placement.

A single NAT Gateway creates a single point of failure, whereas one NAT Gateway per Availability Zone provides independent path redundancy.

Directing traffic from each private subnet to its local NAT Gateway prevents cross-AZ dependencies.

Key Concept

NAT Gateway redundancy across multiple Availability Zones to ensure high availability and prevent single points of failure.

Estimated Time:1m 0s

Question 985Question →

An enterprise's primary workload runs in VPC-A within Account 1 (Production) in the us-east-1 region. The database layer uses an Amazon Aurora MySQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Centralized DNS is managed in Account 2 (Shared Services) using a Route 53 private hosted zone (PHZ) named corp.internal. A CNAME record db.corp.internal points to the primary Aurora cluster endpoint in us-east-1. VPC-A is currently associated with this PHZ.

To improve disaster recovery, the enterprise is planning a pilot light strategy. During a region-wide outage in us-east-1, the application tier must failover to VPC-B within Account 1 in the us-west-2 region. The disaster recovery requirements specify a database Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 1 minute. Additionally, all DNS queries must remain strictly private, routing privately over the AWS network without using custom DNS servers or public Route 53 health check endpoints.

Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Authorize the association of the corp.internal private hosted zone in Account 2 with VPC-B in Account 1 using cross-account VPC association authorization, then associate the zone in Account 1.

Implement Route 53 Application Recovery Controller (ARC) routing controls, create Route 53 health checks associated with the routing controls, and configure failover routing records in Account 2 for db.corp.internal pointing to the regional Aurora endpoints.

Create a duplicate private hosted zone named corp.internal in Account 1 associated with VPC-B, and create a static CNAME record db.corp.internal pointing to the us-west-2 Aurora cluster endpoint.

Configure Route 53 failover routing records in Account 2 for db.corp.internal, and create standard Route 53 HTTP health checks pointing directly to the private IP addresses of the Aurora database endpoints to automate DNS failover.

Replace the Aurora Global Database with daily snapshot replication from us-east-1 to us-west-2, and write a Lambda function to restore the database from the latest snapshot in us-west-2 during failover.

Show answer & explanation

Answer: Authorize the association of the corp.internal private hosted zone in Account 2 with VPC-B in Account 1 using cross-account VPC association authorization, then associate the zone in Account 1.; Implement Route 53 Application Recovery Controller (ARC) routing controls, create Route 53 health checks associated with the routing controls, and configure failover routing records in Account 2 for db.corp.internal pointing to the regional Aurora endpoints.

Answer

Associate VPC-B with the centralized private hosted zone using cross-account authorization, and configure Route 53 Application Recovery Controller routing controls with failover routing records pointing to the regional database endpoints.

The correct architecture utilizes Aurora Global Database to achieve the required sub-minute RPO and multi-region failover speed. To manage DNS routing dynamically and privately, the centralized private hosted zone in Account 2 must be associated with the recovery VPC (VPC-B in Account 1) via cross-account VPC association authorization. Since standard Route 53 health checks cannot directly query private IP addresses in a VPC, Route 53 Application Recovery Controller (ARC) routing controls are implemented. Route 53 health checks are created to monitor the status of the ARC routing controls, allowing the failover routing policy in the private hosted zone to securely redirect the database endpoint resolution during failover without exposing queries or endpoints to the public internet.

Step-by-Step Solution

Configure cross-account private hosted zone association for the recovery VPC.

VPC-B in Account 1 is authorized and associated with the corp.internal private hosted zone in Account 2.

By default, private hosted zones are only accessible within the account they are created in. To allow VPC-B in Account 1 to resolve names in Account 2's PHZ, a cross-account authorization must be created in Account 2 using the CLI/API, and then accepted in Account 1.

Ensure database replication meets recovery objectives using Aurora Global Database.

Active-passive replication is established with sub-second replication latency between the primary and secondary regions.

Aurora Global Database utilizes physical storage-level replication to achieve an RPO of less than 1 second, directly supporting the business RPO constraint.

Configure Route 53 Application Recovery Controller (ARC) routing controls.

Routing controls are created, and corresponding Route 53 health checks are linked to the routing control states.

Because standard Route 53 health checks cannot access resources inside a private VPC, ARC routing controls are used as a control plane mechanism. The associated health checks monitor the control plane state rather than the data plane directly, keeping all monitoring traffic private.

Create DNS failover records in the private hosted zone in Account 2.

Failover records for db.corp.internal point to us-east-1 (primary) and us-west-2 (secondary), evaluated using the ARC-linked health checks.

During an outage, the database is failed over, and the ARC routing control state is updated to redirect application queries to the promoted secondary database cluster in us-west-2.

Key Concept

Multi-account private hosted zone routing and multi-region database failover using Route 53 ARC.

Question 986Question →

A company is designing a new two-tier application in a VPC across two Availability Zones (us-east-1a and us-east-1b). The application servers are located in private subnets and must access the internet to download security patches. Additionally, the application servers must resolve domain names within a Route 53 Private Hosted Zone (corp.internal) hosted in a separate administrative VPC. Which two configuration steps must the Solutions Architect perform to meet these requirements with high availability?

Select all that apply

Deploy a NAT Gateway in the public subnet of each Availability Zone, and configure the route tables of the private subnets to direct internet-bound traffic to the local NAT Gateway in the same Availability Zone.

Associate the Route 53 Private Hosted Zone corp.internal with the new application VPC.

Deploy a single NAT Gateway in the public subnet of us-east-1a, and update the route tables of both private subnets to route outbound traffic through this single NAT Gateway.

Establish a Transit Gateway attachment between the two VPCs and rely on Transit Gateway routing to automatically resolve DNS queries for corp.internal from the application VPC.

Create a public Route 53 hosted zone for corp.internal and use IAM policies to restrict resolution to the instances within the application VPC.

Show answer & explanation

Answer: Deploy a NAT Gateway in the public subnet of each Availability Zone, and configure the route tables of the private subnets to direct internet-bound traffic to the local NAT Gateway in the same Availability Zone.; Associate the Route 53 Private Hosted Zone corp.internal with the new application VPC.

Answer

Deploy a NAT Gateway in the public subnet of each Availability Zone, and associate the Route 53 Private Hosted Zone corp.internal with the application VPC.

Deploying a NAT Gateway in the public subnet of each Availability Zone provides fault tolerance, preventing a single zone outage from disrupting internet access for other zones. Additionally, associating the Route 53 Private Hosted Zone corp.internal with the application VPC is a required step to allow instances in that VPC to resolve the private domain names.

Step-by-Step Solution

Configure highly available outbound internet access.

A NAT Gateway is deployed in the public subnet of each Availability Zone (us-east-1a and us-east-1b). The route tables for the private subnets in us-east-1a are updated to point

0.0.0.0/0

to the NAT Gateway in us-east-1a, and the route tables for the private subnets in us-east-1b are updated to point

0.0.0.0/0

to the NAT Gateway in us-east-1b.

This guarantees that if one Availability Zone experiences an outage, the other Availability Zone maintains outbound internet access.

Enable private DNS resolution for the administrative domain.

The Route 53 Private Hosted Zone corp.internal is associated with the new application VPC.

VPCs must be associated with a Private Hosted Zone to resolve the DNS records within that zone.

Key Concept

High availability for outbound VPC traffic and DNS resolution across multiple VPCs using NAT Gateways and Route 53 Private Hosted Zone associations.

Question 987Question →

A financial services company runs a batch processing pipeline on Amazon EC2 instances in an Auto Scaling group. The EC2 instances process raw data and write intermediate transaction metadata to an Amazon RDS for PostgreSQL DB instance configured in a Multi-AZ deployment. The final reports are saved to an Amazon S3 bucket.

During peak processing periods, the database performance degrades significantly. CloudWatch metrics indicate a write latency ( $WriteLatency$ ) of over $45\text{ ms}$ on the RDS DB instance, while CPU utilization remains below $25\%$ . The DB instance uses General Purpose SSD (gp3) storage with default configurations.

Additionally, during sudden traffic spikes, the EC2 instances struggle to scale out quickly enough to prevent processing queues from backing up. The custom AMI used by the Auto Scaling group takes approximately $7\text{ minutes}$ to bootstrap and start application services. The Auto Scaling group uses a target tracking scaling policy based on CPU utilization with a default cooldown period of $150\text{ seconds}$ .

Which two actions should a Solutions Architect take to resolve these performance bottlenecks?

Select all that apply

Modify the RDS PostgreSQL DB instance storage type to Provisioned IOPS SSD (io2) to increase the available IOPS and throughput capacity.

Configure an Auto Scaling warm pool for the EC2 Auto Scaling group to keep pre-warmed instances in a Stopped state, and increase the default cooldown period to

450\text{ seconds}

Enable read-replica auto-scaling on the Multi-AZ secondary standby instance to offload heavy write transactions to the secondary Availability Zone.

Request AWS Support to pre-warm the Application Load Balancer (ALB) to handle the incoming transaction load and bypass the EC2 instance boot time.

Decrease the Auto Scaling group cooldown period to

60\text{ seconds}

to allow the scaling policy to trigger consecutive scaling activities more rapidly during spikes.

Show answer & explanation

Answer: Modify the RDS PostgreSQL DB instance storage type to Provisioned IOPS SSD (io2) to increase the available IOPS and throughput capacity.; Configure an Auto Scaling warm pool for the EC2 Auto Scaling group to keep pre-warmed instances in a Stopped state, and increase the default cooldown period to $450\text{ seconds}$ .

Answer

To resolve the performance bottlenecks, the Solutions Architect should modify the RDS PostgreSQL DB instance storage type to Provisioned IOPS SSD (io2) and configure an Auto Scaling warm pool for the EC2 Auto Scaling group while increasing the default cooldown period to

450\text{ seconds}

Provisioning io2 storage addresses the write latency bottleneck by providing dedicated I/O performance independent of storage size. Configuring a warm pool with instances in a Stopped state significantly speeds up the scale-out process by bypassing most of the

7\text{ minute}

bootstrapping delay, while increasing the cooldown period to

450\text{ seconds}

ensures the scaling policy waits for the newly launched instances to become healthy before triggering further scaling actions.

Step-by-Step Solution

Analyze the RDS storage bottleneck.

Identify that the DB instance is experiencing high write latency with low CPU utilization, indicating that the default gp3 IOPS/throughput is insufficient.

Choosing Provisioned IOPS SSD (io2) storage will resolve the write queue delay by delivering dedicated, higher I/O performance.

Analyze the EC2 scaling delay.

Identify that the

7\text{ minute}

bootstrapping process causes a scaling lag, which is exacerbated by a cooldown period that is too short (

150\text{ seconds}

Configuring a warm pool allows pre-bootstrapped instances to quickly transition to the Running state, reducing scaling lag.

Adjust the Auto Scaling group cooldown setting.

Increase the cooldown period to

450\text{ seconds}

(exceeding the

7\text{ minute}

bootstrapping duration).

This prevents the scaling policy from launching additional instances prematurely while the initial scaling batch is still initializing.

Key Concept

Optimizing write storage I/O using Provisioned IOPS and managing EC2 Auto Scaling behavior via warm pools and appropriate cooldown thresholds to match instance bootstrap times.

Question 988Question →

A media company hosts a legacy video rendering application in the `us-west-2` Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB), and a multi-AZ Amazon Aurora PostgreSQL database cluster. The company needs to implement a disaster recovery (DR) strategy in the `us-east-1` Region. The business requires a Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 15 minutes. Which configuration should a Solutions Architect recommend to meet these requirements with the lowest operational overhead?

Configure an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Deploy a duplicate Application Load Balancer (ALB) and a warm standby Auto Scaling group with minimum capacity in us-east-1. Create Route 53 failover routing records pointing to the ALBs, associated with Route 53 health checks that monitor an application health endpoint. In a disaster, perform a managed failover of the Aurora Global Database and scale up the Auto Scaling group.

Set up a cron job in us-west-2 to take hourly snapshots of the database, copy them to us-east-1, and write a script to restore the database from the latest snapshot during a disaster. Deploy the EC2 instances in us-east-1 using AWS CloudFormation after a disaster is declared. Use Route 53 failover routing to point to the Application Load Balancers.

Configure an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Deploy a duplicate Application Load Balancer (ALB) and a warm standby Auto Scaling group in us-east-1. Create Route 53 failover routing records pointing to the ALBs, but configure the Route 53 health checks to only verify the TCP port of the ALB without checking the underlying database or application status.

Configure an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Deploy a duplicate Application Load Balancer (ALB) and a warm standby Auto Scaling group in us-east-1. Create a Route 53 Private Hosted Zone (PHZ) in the primary account to resolve the database endpoint, but only associate the PHZ with the primary VPC in us-west-2.

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Deploy a duplicate Application Load Balancer (ALB) and a warm standby Auto Scaling group with minimum capacity in us-east-1. Create Route 53 failover routing records pointing to the ALBs, associated with Route 53 health checks that monitor an application health endpoint. In a disaster, perform a managed failover of the Aurora Global Database and scale up the Auto Scaling group.

Answer

The correct configuration uses Amazon Aurora Global Database, which utilizes storage-based replication with a typical lag of less than one second, satisfying the RPO requirement of under 1 minute. Utilizing a warm standby EC2 fleet with an ALB in the secondary region allows the application to be scaled up rapidly during a failover event. Configuring Route 53 failover records with application-level health checks ensures that failures at either the application or database level trigger DNS failover, meeting the RTO requirement of under 15 minutes.

Step-by-Step Solution

Evaluate the database replication strategy to satisfy the Recovery Point Objective (RPO) of less than 1 minute.

Aurora Global Database is selected because it uses storage-based, physical replication with typical lag under 1 second.

Cross-region snapshot copying or standard backup restorations are too slow and fail to meet the sub-minute RPO requirement.

Design the failover routing and health checking mechanism to achieve the Recovery Time Objective (RTO) of less than 15 minutes.

Route 53 failover routing is configured with health checks pointing to an application endpoint that validates database connectivity and application status.

If health checks only monitor the ALB TCP port, application or database failures won't trigger DNS failover, leaving the system in a degraded state.

Ensure DNS resolution is functional across regions.

Any Private Hosted Zone used for internal service discovery must be associated with the VPCs in both the primary and disaster recovery regions.

Without cross-VPC association, the application instances in the recovery region cannot resolve the database endpoints.

Key Concept

Disaster recovery planning requires mapping business RPO/RTO metrics with appropriate data replication and DNS failover strategies, ensuring end-to-end service availability.

Estimated Time:2m 0s

Question 989Question →

A retail company operates a multi-tier application across two AWS accounts within an AWS Organization. The primary infrastructure is located in us-east-1 (Account 1), and a disaster recovery (DR) site is set up in us-west-2 (Account 2). The database layer is an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a read-only secondary cluster in us-west-2. Internal service names and database endpoints are resolved using a Route 53 private hosted zone corp.internal managed in Account 1. The company has a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $1$ minute. During a DR drill, the failover fails because the secondary region's Application Load Balancer cannot resolve the database endpoints, and manual failover steps take too long. Which TWO actions should a Solutions Architect recommend to automate the failover and meet the RTO and RPO requirements?

Select all that apply

Associate the Route 53 private hosted zone corp.internal with the VPC in us-west-2 by authorizing the association from Account 1 and creating the association from Account 2.

Use AWS Route 53 Application Recovery Controller (ARC) routing controls to redirect application traffic, and promote the secondary DB cluster in us-west-2 using the managed failover feature of Aurora Global Databases.

Create a duplicate Route 53 private hosted zone named corp.internal in Account 2 and associate it with the us-west-2 VPC, creating local database DNS records pointing to the secondary cluster.

Configure Route 53 failover routing records pointing directly to the private IP address of the primary DB instance, using a standard Route 53 health check that directly probes the database port to automate routing changes.

Transition the DR architecture to a pilot light model by deleting all database instances in the secondary Aurora cluster to reduce costs, and restore a new instance from a cross-region snapshot during failover.

Show answer & explanation

Answer: Associate the Route 53 private hosted zone corp.internal with the VPC in us-west-2 by authorizing the association from Account 1 and creating the association from Account 2.; Use AWS Route 53 Application Recovery Controller (ARC) routing controls to redirect application traffic, and promote the secondary DB cluster in us-west-2 using the managed failover feature of Aurora Global Databases.

Answer

Associate the Route 53 private hosted zone corp.internal with the VPC in us-west-2 via cross-account authorization, and use Route 53 ARC along with Aurora Global Database managed failover to automate traffic shifting and database promotion.

To satisfy the requirements, the Solutions Architect must resolve the DNS resolution failure and automate database promotion. The private hosted zone in the primary account must be associated with the secondary VPC in the secondary account by authorizing the association from Account 1 and executing the association from Account 2. To automate the failover within the strict RTO/RPO objectives, the architect must use AWS Route 53 Application Recovery Controller (ARC) routing controls to redirect traffic and use the Aurora Global Database managed failover feature to promote the secondary DB cluster.

Step-by-Step Solution

Submit a VPC hosted zone association authorization from the account owning the private hosted zone (Account 1) targeting the VPC in Account 2.

Permission is granted for Account 2's VPC to be associated with Account 1's private hosted zone.

Allows cross-account private DNS resolution so the DR VPC can resolve internal endpoints.

Associate the secondary VPC with the private hosted zone using Account 2 credentials.

The VPC in us-west-2 can now resolve the domain corp.internal.

Establishes name resolution parity in the secondary region during disaster recovery.

Use AWS Route 53 ARC to orchestrate routing failover, and initiate the managed failover (planned or unplanned) of the Aurora Global Database.

Traffic is shifted to the secondary region, and the secondary DB cluster is promoted to primary with minimal data loss.

Ensures the 15-minute RTO and 1-minute RPO targets are met using native automated replication failover.

Key Concept

Cross-Region Disaster Recovery for Aurora Global Databases and Route 53 DNS Configuration

Alternative Method

Rather than managed failover via Aurora Global Database, a customized automation pipeline using AWS EventBridge, AWS Step Functions, and API calls could execute the database promotion, but this introduces operational complexity compared to the native managed failover capability.

Estimated Time:3m 0s

Question 990Question →

An organization uses AWS CloudFormation to deploy and manage its web application infrastructure. A system administrator manually modifies the instance type of a production EC2 instance via the AWS Management Console to handle a temporary traffic spike. Later, when the DevOps team runs a CloudFormation stack update to deploy an unrelated security group change, the stack update fails and rolls back. Which of the following is the root cause of this update failure?

The EC2 instance was encrypted using an AWS-managed KMS key, which restricts CloudFormation from executing updates once a manual console modification occurs.

The manual update in the console triggered a Service Control Policy (SCP) that permanently blocked the CloudFormation service role from applying changes to the target account.

The manual modification created configuration drift, causing CloudFormation to encounter a conflict when comparing the template's expected state with the actual state of the resource.

CloudFormation requires a Canary deployment strategy to reconcile manual changes, and the default rolling update strategy failed because it could not merge the manual update.

Show answer & explanation

Answer: The manual modification created configuration drift, causing CloudFormation to encounter a conflict when comparing the template's expected state with the actual state of the resource.

Answer

The manual modification created configuration drift, causing CloudFormation to encounter a conflict when comparing the template's expected state with the actual state of the resource.

The correct answer identifies that manual changes to resources under CloudFormation management result in configuration drift. When an update is triggered, CloudFormation attempts to apply the stack changes based on the expected state. When the actual state differs, the update can fail or rollback.

Step-by-Step Solution

Identify the modification path of the EC2 instance.

The instance type was modified manually via the console, outside of CloudFormation management.

This establishes that the resource has deviated from the state defined in the CloudFormation template.

Analyze how CloudFormation handles updates when resources deviate from the template.

CloudFormation detects configuration drift, resulting in update conflicts or failures.

CloudFormation expects resources to match the state defined in its database and template; out-of-band updates violate this expectation.

Key Concept

Detecting and managing configuration drift in AWS CloudFormation managed resources.

Estimated Time:1m 0s

Question 991Question →

A global retail company runs its checkout application on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in an organization in AWS Organizations. The application writes transaction logs to `/var/log/checkout/app.log`. The application server rotates logs hourly, renaming the active log file to `/var/log/checkout/app.log.1` (and shifting older logs to `app.log.2`, `app.log.3`, etc.) while creating a new `app.log` file.

The company wants to centralize these logs into an Amazon S3 bucket located in a dedicated Security account. The architecture must stream logs from the EC2 instances to CloudWatch Logs, and then forward them to the centralized S3 bucket via Amazon Kinesis Data Firehose. The solution must handle hourly log rotations without log loss and enforce least-privilege cross-account access.

Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

In the Unified CloudWatch Agent configuration file on the EC2 instances, configure the logs section with "file_path": "/var/log/checkout/app.log*" to monitor the log files.

In the Unified CloudWatch Agent configuration file on the EC2 instances, configure the logs section with "file_path": "/var/log/checkout/app.log" and enable the "auto_reopen_on_rotate": true setting.

Configure the S3 bucket policy in the Security account to grant s3:PutObject and s3:PutObjectAcl permissions to the IAM roles assumed by the Kinesis Data Firehose delivery streams in the member accounts, using the aws:PrincipalOrgID condition key to restrict access to the organization.

Configure the S3 bucket policy in the Security account to allow s3:PutObject actions for the principal "*", and apply a Service Control Policy (SCP) at the organizational root level that allows the member accounts' Kinesis Data Firehose IAM roles to write to the Security account's S3 bucket.

In the Unified CloudWatch Agent configuration file on the EC2 instances, configure the logs section with "file_path": "/var/log/checkout/app.log" and configure a pre-rotation script on the EC2 instances that restarts the CloudWatch Agent service immediately after the log rotation occurs.

Show answer & explanation

Answer: In the Unified CloudWatch Agent configuration file on the EC2 instances, configure the logs section with "file_path": "/var/log/checkout/app.log*" to monitor the log files.; Configure the S3 bucket policy in the Security account to grant s3:PutObject and s3:PutObjectAcl permissions to the IAM roles assumed by the Kinesis Data Firehose delivery streams in the member accounts, using the aws:PrincipalOrgID condition key to restrict access to the organization.

Answer

To achieve the monitoring and security goals, configure the Unified CloudWatch Agent on the EC2 instances with a wildcard path (`/var/log/checkout/app.log*`) to capture both active and rotated logs, and configure the central S3 bucket policy in the Security account to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the IAM roles of the member accounts' Kinesis Data Firehose delivery streams, scoped with the `aws:PrincipalOrgID` condition key.

The correct answer combines proper agent path configuration and cross-account permissions. Configuring the Unified CloudWatch Agent's `file_path` with a wildcard (`/var/log/checkout/app.log*`) ensures that renamed log files are tracked and read before the agent re-locks onto the newly created active log file, ensuring no data loss during rotation. In the central security account, the S3 bucket policy must permit the Kinesis Data Firehose IAM roles from member accounts to write to it (`s3:PutObject` and `s3:PutObjectAcl`). The policy must be secured by restricting access to the specific organization using the `aws:PrincipalOrgID` condition key, ensuring only trusted accounts within the AWS Organization can write to the central logging bucket.

Step-by-Step Solution

Configure log file path patterns in the CloudWatch Agent configuration.

Setting the `file_path` to `/var/log/checkout/app.log*` allows the agent to monitor both active and rotated log files, preventing data loss when logs are renamed.

Log files are renamed during hourly rotation. A static file path configuration misses logs written right before rotation that have not been read by the agent yet. Using a wildcard ensures the agent processes all rotated files.

Set up a cross-account S3 bucket policy in the Security account.

The bucket policy allows Kinesis Data Firehose IAM roles from member accounts to perform write operations.

S3 resources are private by default. For cross-account resources to write to the centralized bucket, the bucket owner must explicitly grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the cross-account principals.

Enforce organization-wide security boundaries using AWS IAM condition keys.

Adding the `aws:PrincipalOrgID` condition key to the bucket policy ensures that only Firehose roles within the designated AWS Organization can write to the bucket.

This implements the principle of least privilege, preventing unauthorized external entities from writing to the centralized logging repository.

Key Concept

Handling rotated log files via Unified CloudWatch Agent wildcards and configuring cross-account S3 log delivery with AWS Organizations restriction keys.

Question 992Question →

A global logistics company hosts its central inventory tracking platform in the us-west-2 Region. The application layer runs on Amazon EC2 instances in private subnets across two Availability Zones. Outbound tracking updates are sent to third-party shipping partners over the internet via a single NAT Gateway located in one Availability Zone. Additionally, users located in Europe and South America experience high latency when accessing the platform's web interface, which is behind an Application Load Balancer (ALB).

The company requires a solution that minimizes network latency for global clients without deploying the application layer in multiple AWS Regions. The solution must also eliminate single points of failure for outbound traffic and minimize cross-Availability Zone data transfer costs.

Which combination of architectural changes should the Solutions Architect implement? (Select TWO.)

Select all that apply

Create an AWS Global Accelerator accelerator and associate it with the Application Load Balancer to route global client traffic over the AWS edge network.

Deploy a NAT Gateway in each Availability Zone where the EC2 instances are running, and update the private subnet route tables to direct outbound traffic to the NAT Gateway in the same zone.

Request AWS Support to pre-warm the Application Load Balancer to handle the fluctuating traffic spikes from global users and reduce initial connection latency.

Create a Route 53 Private Hosted Zone with the public domain names of the shipping partners to resolve their IP addresses locally within the VPC.

Configure a single AWS Transit Gateway to route outbound traffic transitively through a dedicated transit VPC in a different AWS Region to centralize egress paths.

Show answer & explanation

Answer: Create an AWS Global Accelerator accelerator and associate it with the Application Load Balancer to route global client traffic over the AWS edge network.; Deploy a NAT Gateway in each Availability Zone where the EC2 instances are running, and update the private subnet route tables to direct outbound traffic to the NAT Gateway in the same zone.

Answer

Deploying AWS Global Accelerator associated with the Application Load Balancer, and deploying a NAT Gateway in each Availability Zone where the EC2 instances are running with updated local route tables.

The correct solution involves deploying AWS Global Accelerator and deploying a NAT Gateway in each Availability Zone. AWS Global Accelerator routes traffic from clients in Europe and South America over the AWS global network to the Application Load Balancer in the us-west-2 Region, reducing latency and packet loss. Deploying a NAT Gateway in each Availability Zone and updating the route tables ensures that outbound traffic to the shipping partners does not cross Availability Zones, eliminating cross-AZ data transfer costs and removing the single NAT Gateway as a single point of failure.

Step-by-Step Solution

Address the inbound latency for global users by routing their traffic over the AWS global network.

By provisioning an AWS Global Accelerator and pointing it to the Application Load Balancer, client requests from Europe and South America are onboarded at the nearest AWS edge location and routed over the high-performance AWS global network instead of the public internet.

This minimizes network latency and packet loss without the administrative overhead of deploying and managing the application layer in multiple AWS Regions.

Address outbound connection resiliency and eliminate single points of failure for outbound traffic.

Deploying a NAT Gateway in each Availability Zone ensures that if one zone experiences an outage, the other zone's outbound traffic remains unaffected.

This configuration provides high availability for internet-bound connections to the third-party shipping partners.

Optimize internal routing to minimize cross-Availability Zone data transfer costs.

By updating the route tables of the private subnets to send 0.0.0.0/0 traffic to the NAT Gateway in the same Availability Zone, outbound traffic is kept local to the AZ.

This avoids cross-AZ data transfer fees and reduces internal network latency.

Key Concept

Optimizing geographic inbound network performance using AWS Global Accelerator and improving outbound connectivity resiliency and cost-efficiency using multi-AZ NAT Gateways.

Question 993Question →

An enterprise is designing a new network architecture in the `us-east-1` region to support three spoke VPCs (`vpc-prod`, `vpc-dev`, and `vpc-test`) and a central egress VPC (`vpc-egress`). An AWS Transit Gateway (`tgw-central`) connects all four VPCs. The workloads in the spoke VPCs are distributed across two Availability Zones ( $AZ-A$ and $AZ-B$ ) and require outbound internet access to download software updates. The design must ensure that the failure of a single Availability Zone does not disrupt outbound internet connectivity for any of the workloads, while minimizing overall NAT Gateway costs. Which of the following architectures should the Solutions Architect recommend?

Deploy two NAT Gateways in `vpc-egress`, with one in a public subnet in

AZ-A

and the other in a public subnet in

AZ-B

. Configure the Transit Gateway route table to route

0.0.0.0/0

traffic from the spoke VPCs to the `vpc-egress` attachment. Within `vpc-egress`, configure the route tables of the Transit Gateway subnets in each Availability Zone to route outbound traffic to the local NAT Gateway in the same zone.

Deploy a single NAT Gateway in `vpc-egress` in a public subnet in

AZ-A

. Configure the Transit Gateway route table to route all

0.0.0.0/0

traffic from the spoke VPCs to the `vpc-egress` attachment. Within `vpc-egress`, configure the route tables of the Transit Gateway subnets in both

AZ-A

and

AZ-B

to route outbound traffic to this single NAT Gateway.

Deploy two NAT Gateways in `vpc-egress`, with one in

AZ-A

and one in

AZ-B

. In the spoke VPCs, associate a Route 53 Private Hosted Zone (PHZ) for the update endpoints with `vpc-egress` only. Rely on the Transit Gateway to transitively forward the DNS queries from the spoke VPCs to the PHZ associated with `vpc-egress` to resolve update endpoint domain names.

Deploy two NAT Gateways in `vpc-egress` across

AZ-A

and

AZ-B

. Instead of using AWS Transit Gateway, configure AWS Direct Connect Gateway to establish transitive routing connections between the spoke VPCs and the central egress VPC for all outbound internet traffic.

Show answer & explanation

Answer: Deploy two NAT Gateways in `vpc-egress`, with one in a public subnet in $AZ-A$ and the other in a public subnet in $AZ-B$ . Configure the Transit Gateway route table to route $0.0.0.0/0$ traffic from the spoke VPCs to the `vpc-egress` attachment. Within `vpc-egress`, configure the route tables of the Transit Gateway subnets in each Availability Zone to route outbound traffic to the local NAT Gateway in the same zone.

Answer

Deploying two NAT Gateways in the central egress VPC (one in each Availability Zone) and routing traffic from the spoke VPCs through the Transit Gateway to the egress VPC, where zone-specific routing directs traffic to the local NAT Gateway.

The correct architecture centralizes outbound internet egress in a shared `vpc-egress` VPC by deploying two NAT Gateways across two Availability Zones (

AZ-A

and

AZ-B

). Outbound traffic from the spoke VPCs is sent to the AWS Transit Gateway, which routes it to the egress VPC. By configuring the route tables in `vpc-egress` to send traffic from the Transit Gateway subnet attachment in each zone to the corresponding local NAT Gateway, the architecture ensures full Availability Zone redundancy while keeping the NAT Gateway count to a minimum of two instead of deploying two per spoke VPC.

Step-by-Step Solution

Analyze the high availability requirement for outbound internet access across Availability Zones.

Determined that at least two NAT Gateways are required, distributed across two different Availability Zones to avoid a single point of failure.

If only one NAT Gateway is used, an outage in that Availability Zone would disrupt internet access for all workloads in all zones.

Evaluate the cost constraint of minimizing NAT Gateway deployment costs.

Centralizing egress traffic into a single shared Egress VPC requires only two NAT Gateways in total, rather than deploying two NAT Gateways in each of the three spoke VPCs (which would require six NAT Gateways).

NAT Gateways incur hourly charges and data processing rates. Minimizing the count of NAT Gateways reduces fixed hourly costs.

Configure Transit Gateway and local subnet routing for the egress path.

Workloads route

0.0.0.0/0

to the Transit Gateway, which forwards traffic to `vpc-egress`. Within `vpc-egress`, routing ensures that traffic originating from or landing in

AZ-A

goes to the NAT Gateway in

AZ-A

, and traffic for

AZ-B

goes to the NAT Gateway in

AZ-B

This keeps traffic within the same Availability Zone for resilience and lower latency, preventing cross-AZ traffic charges where possible and securing path isolation.

Key Concept

Centralized egress VPC architecture with multi-AZ NAT Gateway redundancy and Transit Gateway routing.

Estimated Time:2m 0s

Question 994Question →

An enterprise is designing a multi-account, multi-VPC architecture in the us-east-1 Region. The design includes vpc-app-prod (10.100.0.0/16) in Account A, containing business-critical application instances in private subnets across two Availability Zones (us-east-1a and us-east-1b). Account B hosts vpc-shared-dns (10.200.0.0/16) containing a Route 53 Private Hosted Zone (PHZ) app.corp.internal. Account B also contains vpc-egress-inspect (10.250.0.0/16), which handles outbound traffic via a cluster of firewalls. All VPCs are interconnected using an AWS Transit Gateway (tgw-east-hub). The application instances must resolve domain names hosted in app.corp.internal, and all outbound internet traffic must be inspected by the firewalls in vpc-egress-inspect. The network architecture must be highly resilient, cost-effective, and avoid any single points of failure. Which two configurations should the solutions architect implement to establish connectivity and name resolution while meeting these requirements?

Select all that apply

Deploy one NAT Gateway in a public subnet in us-east-1a and another NAT Gateway in a public subnet in us-east-1b within vpc-egress-inspect. Configure the subnet route tables in vpc-app-prod to route 0.0.0.0/0 traffic to tgw-east-hub, and configure the Transit Gateway route tables to route all outbound traffic to the vpc-egress-inspect attachment.

Deploy a single NAT Gateway in a public subnet within us-east-1a in vpc-egress-inspect to minimize running costs. Configure the private subnets in both Availability Zones of vpc-app-prod to route egress traffic through tgw-east-hub to this single NAT Gateway.

Associate the Route 53 Private Hosted Zone app.corp.internal directly with both vpc-shared-dns and vpc-app-prod by creating VPC associations, enabling direct internal DNS resolution within both VPCs.

Establish an AWS Direct Connect Gateway (DXGW) and associate it with the Virtual Private Gateways of both vpc-app-prod and vpc-egress-inspect. Configure the routing tables to route inter-VPC traffic and egress traffic transitively through the DXGW.

Deploy Route 53 Resolver inbound endpoints in vpc-shared-dns and outbound endpoints in vpc-app-prod. Create a Route 53 Resolver forwarding rule for app.corp.internal that targets the inbound endpoints to resolve DNS queries across the VPCs.

Show answer & explanation

Answer: Deploy one NAT Gateway in a public subnet in us-east-1a and another NAT Gateway in a public subnet in us-east-1b within vpc-egress-inspect. Configure the subnet route tables in vpc-app-prod to route 0.0.0.0/0 traffic to tgw-east-hub, and configure the Transit Gateway route tables to route all outbound traffic to the vpc-egress-inspect attachment.; Associate the Route 53 Private Hosted Zone app.corp.internal directly with both vpc-shared-dns and vpc-app-prod by creating VPC associations, enabling direct internal DNS resolution within both VPCs.

Answer

Deploy redundant NAT Gateways across Availability Zones in the egress VPC and configure routing via the Transit Gateway, while associating the Route 53 Private Hosted Zone directly with all required VPCs.

Deploying redundant NAT Gateways across multiple Availability Zones in the egress VPC provides highly available internet egress. Routing egress traffic via the Transit Gateway centralized route table satisfies the inspection and egress requirements. Direct VPC association of the Route 53 Private Hosted Zone (PHZ) with the application VPC provides the most direct and cost-effective DNS resolution strategy.

Step-by-Step Solution

Analyze high-availability egress requirements.

Identified that deploying a NAT Gateway in only one Availability Zone creates a single point of failure. Deploying one NAT Gateway in us-east-1a and one in us-east-1b ensures egress redundancy.

Production architectures require NAT Gateway redundancy across active Availability Zones to maintain egress connectivity during a zone outage.

Determine the optimal routing path for egress traffic through Transit Gateway.

Configure subnet route tables in vpc-app-prod to direct 0.0.0.0/0 to the Transit Gateway, and configure the Transit Gateway's route tables to route that traffic to the vpc-egress-inspect attachment.

Transit Gateway allows centralizing egress traffic from spoke VPCs to a central egress/security VPC.

Analyze DNS resolution requirements for the Private Hosted Zone.

Associate the Private Hosted Zone app.corp.internal directly with both vpc-shared-dns and vpc-app-prod.

Cross-account Private Hosted Zone association allows resources in consumer VPCs to resolve internal names natively and cost-effectively without deploying Route 53 Resolver endpoints.

Key Concept

Multi-AZ NAT Gateway deployment for resilient egress combined with cross-account Route 53 Private Hosted Zone association.

Question 995Question →

A company is reviewing the security posture of an existing web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are currently residing in public subnets, and the ALB receives public HTTP/HTTPS traffic. The company wants to strengthen network security by restricting backend instance access and blocking common web exploits at the edge. Which two options should the solutions architect recommend to achieve this? (Select TWO.)

Select all that apply

Migrate the EC2 instances to private subnets, and configure their security groups to accept inbound traffic only from the Application Load Balancer's security group.

Associate an AWS WAF Web ACL with the Application Load Balancer, configuring SQL injection mitigation rules prioritized at the beginning of the Web ACL evaluation order.

Deploy an AWS WAF Web ACL on the Application Load Balancer, placing specific SQL injection block rules after a default allow rule in the Web ACL evaluation order.

Configure cross-account access to log files in an S3 bucket by modifying the key policy of the default AWS-managed KMS key (aws/s3) in the source account.

Apply a Service Control Policy (SCP) to the member account containing the Application Load Balancer to grant administrative access to the security team without defining local IAM roles.

Show answer & explanation

Answer: Migrate the EC2 instances to private subnets, and configure their security groups to accept inbound traffic only from the Application Load Balancer's security group.; Associate an AWS WAF Web ACL with the Application Load Balancer, configuring SQL injection mitigation rules prioritized at the beginning of the Web ACL evaluation order.

Answer

Migrating the EC2 instances to private subnets and configuring their security groups to accept inbound traffic only from the Application Load Balancer's security group, and associating an AWS WAF Web ACL with the Application Load Balancer with SQL injection mitigation rules prioritized first.

The correct solution involves migrating backend instances to private subnets and locking down their security groups to only accept traffic from the ALB's security group, while utilizing AWS WAF on the ALB with properly prioritized block rules at the start of the evaluation order to block exploits before general rules apply.

Step-by-Step Solution

Identify the current architecture weaknesses where EC2 instances are in public subnets and exposed directly to the internet.

Realize that backend instances must be isolated from the public internet.

Exposing backend instances directly to the internet increases the attack surface unnecessarily.

Isolate the backend servers by moving the EC2 instances to private subnets and modifying their security groups to allow inbound traffic only from the Application Load Balancer.

Backend instances are no longer directly addressable from the internet and only process traffic forwarded by the load balancer.

This establishes a layered network design where only the load balancer is public-facing.

Add edge security to the Application Load Balancer by associating a Web ACL with AWS WAF.

The load balancer is equipped with application-layer filtering.

AWS WAF can inspect HTTP/HTTPS headers and payloads to detect and block malicious web requests.

Configure rules inside the WAF Web ACL, ensuring specific block rules like SQL injection are placed at the beginning of the evaluation sequence.

Malicious requests are successfully filtered out before reaching the backend servers.

Proper rule evaluation order ensures that block rules are executed before generic allow rules, preventing bypass vulnerabilities.

Key Concept

Implementing defense-in-depth by separating subnet tiers and applying edge security with AWS WAF on the ALB.

Estimated Time:2m 0s

Question 996Question →

An enterprise is designing a centralized data processing platform across multiple AWS accounts. Application servers running in Account A ( $111122223333$ ) must write telemetry data directly to an Amazon S3 bucket located in the central Analytics Account ( $444455556666$ ).

The security policy mandates the following requirements:
1. All data written to the S3 bucket must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) created and managed in a dedicated Security Account ( $777788889999$ ).
2. Separation of duties must be enforced, ensuring that Account A has no administrative control over the KMS key, and Account A's IAM administrators cannot modify the key policy.
3. Access must follow the principle of least privilege.

Which of the following combinations of actions should the Solutions Architect take to configure the permissions for this architecture? (Select TWO.)

Select all that apply

In the Security Account (

777788889999

), update the KMS Customer Managed Key policy to grant the IAM role in Account A (

111122223333

) permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.

In the Analytics Account (

444455556666

), update the S3 bucket policy to grant the IAM role in Account A (

111122223333

) permissions to perform the s3:PutObject action.

In the Security Account (

777788889999

), configure the AWS managed KMS key for Amazon S3 (aws/s3) key policy to grant cross-account permissions to the IAM role in Account A (

111122223333

In the Analytics Account (

444455556666

), modify the S3 bucket policy to grant the IAM role in Account A (

111122223333

) permissions to perform the kms:GenerateDataKey and kms:Decrypt actions on the KMS key in the Security Account (

777788889999

Attach a Service Control Policy (SCP) at the Organization root that grants Account A (

111122223333

) permissions to perform the kms:GenerateDataKey action on the KMS key in the Security Account (

777788889999

Show answer & explanation

Answer: In the Security Account ( $777788889999$ ), update the KMS Customer Managed Key policy to grant the IAM role in Account A ( $111122223333$ ) permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.; In the Analytics Account ( $444455556666$ ), update the S3 bucket policy to grant the IAM role in Account A ( $111122223333$ ) permissions to perform the s3:PutObject action.

Answer

The correct configuration requires updating the KMS Customer Managed Key policy in the Security Account to grant the Account A IAM role access to generate data keys and decrypt objects, and updating the S3 bucket policy in the Analytics Account to allow the Account A IAM role to write objects to the bucket.

The correct configuration combines updating the KMS Customer Managed Key policy in the Security Account to grant key access to the IAM role in Account A, and updating the S3 bucket policy in the Analytics Account to permit write access to the same role. This successfully establishes the trust path required for cross-account S3 uploads under KMS encryption.

Step-by-Step Solution

Configure cross-account S3 permissions

The S3 bucket policy in the Analytics Account is updated to permit s3:PutObject for the IAM role in Account A.

Because the S3 bucket is owned by a different account (Analytics Account), the bucket policy must explicitly grant write permissions to the external principal.

Configure cross-account KMS permissions

The KMS Customer Managed Key policy in the Security Account is updated to allow the IAM role in Account A to call kms:GenerateDataKey and kms:Decrypt.

Since the KMS key resides in the Security Account, the key policy must delegate access to the external role so that it can encrypt and decrypt objects written to S3.

Configure local IAM permissions in Account A

The application IAM role in Account A is updated with policies allowing s3:PutObject on the target bucket and KMS actions on the key ARN.

The principal in Account A requires explicit local IAM permissions for both the S3 bucket and the KMS key to initiate the write operation.

Key Concept

Cross-account security controls combining S3 bucket policies and KMS key policies with Customer Managed Keys.

Estimated Time:3m 0s

Question 997Question →

A global SaaS platform hosts its ingestion service in a VPC in the $us-west-2$ Region and its reporting dashboard in a VPC in the $us-east-1$ Region. The ingestion service runs behind an internal Application Load Balancer (ALB) and is associated with a Route 53 Private Hosted Zone (PHZ) `ingest.local`. Currently, the two VPCs are connected via AWS Transit Gateway peering across the regions. The reporting dashboard makes millions of query requests daily to the ingestion service, resulting in high latency and significant inter-region data transfer charges due to Transit Gateway processing fees. The reporting dashboard must resolve the private DNS names of the ingestion service and connect securely over the AWS network with the lowest possible latency and cost. Which combination of actions should a Solutions Architect implement to optimize the network performance and reduce costs? (Select TWO.)

Select all that apply

Establish an inter-region VPC Peering connection directly between the reporting VPC in us-east-1 and the ingestion VPC in us-west-2, and update the route tables to route the traffic across the peering connection.

Associate the Route 53 Private Hosted Zone ingest.local with the reporting VPC in us-east-1, ensuring the reporting dashboard resolves queries directly to the private IP addresses of the ingestion ALB.

Associate the Private Hosted Zone ingest.local with the Transit Gateway in us-west-2 to automatically enable DNS resolution for all peered VPCs across both regions.

Create a Direct Connect Gateway and establish an IPSec VPN over a Transit VIF to route the inter-VPC traffic transitively through the customer's on-premises network data center.

Deploy a single NAT Gateway in the reporting VPC in us-east-1, configure the route tables to route all ingestion traffic through this NAT Gateway to the public IP addresses of the ingestion ALB, and request AWS Support to pre-warm the ALB.

Show answer & explanation

Answer: Establish an inter-region VPC Peering connection directly between the reporting VPC in us-east-1 and the ingestion VPC in us-west-2, and update the route tables to route the traffic across the peering connection.; Associate the Route 53 Private Hosted Zone ingest.local with the reporting VPC in us-east-1, ensuring the reporting dashboard resolves queries directly to the private IP addresses of the ingestion ALB.

Answer

Establish an inter-region VPC Peering connection directly between the reporting VPC and the ingestion VPC, and associate the Route 53 Private Hosted Zone with the reporting VPC.

Establishing a direct inter-region VPC Peering connection provides the shortest network path (lowest latency) over the AWS backbone and avoids Transit Gateway processing fees. Associating the Route 53 Private Hosted Zone with the reporting VPC in the secondary region ensures that private DNS resolution functions correctly, directing traffic to the private IP addresses of the ingestion Application Load Balancer.

Step-by-Step Solution

Analyze the current traffic path and overhead.

The current path traverses AWS Transit Gateway peering, which introduces additional processing hops and data processing charges in each region, increasing latency and cost.

Identifying the root cause of high latency and cost allows for direct path optimization.

Select a direct network routing option.

Establishing an inter-region VPC Peering connection provides a direct, horizontal communication path over the AWS backbone with no Transit Gateway processing overhead.

Direct VPC Peering offers the lowest possible latency and eliminates Transit Gateway-specific data processing costs.

Configure DNS resolution for cross-region private communication.

Associate the Private Hosted Zone (PHZ) ingest.local with the reporting VPC in us-east-1.

Route 53 Private Hosted Zones must be associated with any VPC that needs to resolve its private records, allowing the reporting dashboard to resolve the ingestion ALB's private IP addresses.

Key Concept

Optimizing latency and costs for inter-region VPC communications using direct VPC Peering and cross-region Private Hosted Zone associations.

Question 998Question →

An enterprise runs a high-performance batch analytics system on AWS. The ingestion tier uses an Application Load Balancer (ALB) to distribute incoming files to a fleet of memory-optimized Amazon EC2 instances in an Auto Scaling group (ASG). These instances download raw datasets from Amazon S3, process them, and write intermediate results to attached $1\text{ TB}$ `gp3` Amazon EBS volumes. The processed metadata is then written to an Amazon RDS for PostgreSQL database, which replicates to a read replica to serve real-time dashboard queries.

During the weekly batch run, the Solutions Architect identifies the following issues:
* The EC2 instances experience significant disk I/O wait times. The `gp3` volumes are configured with the default $3,000\text{ IOPS}$ and $125\text{ MB/s}$ throughput, but CloudWatch metrics show `VolumeThroughput` regularly hitting its limit.
* The RDS PostgreSQL database experiences high replication lag on the read replica, which impacts dashboard query accuracy.
* The incoming request volume spikes instantly at the start of the batch run, causing HTTP $503$ errors at the ALB before the EC2 fleet can scale out to handle the load.

Which two actions should the Solutions Architect take to resolve these bottlenecks and optimize system performance? (Choose two.)

Select all that apply

Modify the EBS `gp3` volume configurations to increase the provisioned throughput to

1,000\text{ MB/s}

and scale the provisioned IOPS.

Contact AWS Support to pre-warm the Application Load Balancer prior to the scheduled batch initiation windows.

Configure the real-time dashboard queries to target the secondary standby database instance in the RDS Multi-AZ deployment to offload read operations.

Configure the Auto Scaling group scaling policy with a cooldown period of

10\text{ seconds}

to accelerate instance deployment when spikes occur.

Deploy an Amazon ElastiCache for Memcached cluster with multi-AZ replication enabled to cache database query results and reduce replica load.

Show answer & explanation

Answer: Modify the EBS `gp3` volume configurations to increase the provisioned throughput to $1,000\text{ MB/s}$ and scale the provisioned IOPS.; Contact AWS Support to pre-warm the Application Load Balancer prior to the scheduled batch initiation windows.

Answer

To optimize the system, the EBS gp3 volume throughput should be scaled to 1,000 MB/s, and AWS Support should be contacted to pre-warm the Application Load Balancer before the batch run.

Increasing the provisioned throughput of the gp3 volumes to 1,000 MB/s directly resolves the storage bottleneck, as the default throughput of 125 MB/s is the limiting factor for the batch workload. Contacting AWS Support to pre-warm the Application Load Balancer ensures that the ALB is pre-scaled to handle the sudden, massive spikes in incoming traffic at the start of the batch run, preventing HTTP 503 errors.

Step-by-Step Solution

Analyze the EBS I/O bottleneck.

Identify that the default 125 MB/s throughput on the gp3 volumes is being saturated by the batch writes.

gp3 volumes default to 3,000 IOPS and 125 MB/s throughput, but they can be scaled up to 1,000 MB/s throughput independently of capacity.

Address the immediate request drops at the ALB.

Determine that the instant traffic spikes exceed the ALB's automatic scaling rate, resulting in HTTP 503 errors.

Pre-warming the ALB by contacting AWS Support ensures pre-allocated capacity is ready before the batch run begins.

Evaluate the database replication and scaling configuration.

Confirm that Multi-AZ standby instances do not accept read traffic, and decreasing Auto Scaling cooldowns below the bootstrap duration creates resource churn.

Ensures that incorrect scaling and standby utilization patterns are avoided.

Key Concept

Optimizing compute scaling limits, EBS gp3 performance configurations, and handling flash traffic on Application Load Balancers.

Question 999Question →

A financial services company hosts a latency-sensitive trading application on Amazon EC2 instances across two Availability Zones in a VPC in the `us-east-1` Region. The application requires high-throughput, low-latency connectivity to an on-premises database server via an established AWS Direct Connect connection. The application also needs to access external financial market data feeds on the internet, and resolve internal service endpoints in a shared services VPC within the same region using an Amazon Route 53 Private Hosted Zone.

During peak trading hours, the application experiences latency spikes when querying the on-premises database, and instances in the secondary Availability Zone fail to reach the internet when the primary Availability Zone experiences issues. Additionally, instances in the application VPC are unable to resolve the internal endpoints of the shared services VPC.

Which architecture optimization strategy will resolve the latency and connectivity issues while maintaining high availability?

Enable jumbo frames by configuring the MTU to

9001

on the AWS Direct Connect private virtual interface and the EC2 instances; deploy a NAT Gateway in each Availability Zone public subnet and update the private subnet route tables; and associate the shared services Route 53 Private Hosted Zone with the application VPC.

Enable jumbo frames by configuring the MTU to

9001

on the AWS Direct Connect private virtual interface and the EC2 instances; deploy a NAT Gateway in each Availability Zone public subnet; and rely on VPC peering between the VPCs to automatically resolve the shared services DNS endpoints without associating the Private Hosted Zone with the application VPC.

Enable jumbo frames by configuring the MTU to

9001

on the AWS Direct Connect private virtual interface and the EC2 instances; deploy a single NAT Gateway in the public subnet of the primary Availability Zone and route outbound internet traffic from both Availability Zones to this NAT Gateway; and associate the shared services Route 53 Private Hosted Zone with the application VPC.

Configure transitive VPC-to-VPC routing through the AWS Direct Connect Gateway to enable communication between the application VPC and the shared services VPC; deploy a NAT Gateway in each Availability Zone public subnet; and associate the shared services Route 53 Private Hosted Zone with the application VPC.

Show answer & explanation

Answer: Enable jumbo frames by configuring the MTU to $9001$ on the AWS Direct Connect private virtual interface and the EC2 instances; deploy a NAT Gateway in each Availability Zone public subnet and update the private subnet route tables; and associate the shared services Route 53 Private Hosted Zone with the application VPC.

Answer

Enable jumbo frames by configuring the MTU to

9001

The correct strategy optimizes database latency by enabling jumbo frames (

9001

MTU) on both the Direct Connect Private VIF and the EC2 instances. This reduces the number of packets sent and CPU utilization on both ends. High availability and latency optimization for outbound internet traffic are achieved by deploying redundant NAT Gateways across both Availability Zones. Finally, private DNS resolution is enabled by associating the Route 53 Private Hosted Zone with the application VPC.

Step-by-Step Solution

Configure the Maximum Transmission Unit (MTU) to

9001

on both the AWS Direct Connect Private Virtual Interface (Private VIF) and the Amazon EC2 instances.

Network packets can carry up to

9000

bytes of payload instead of the standard

1500

bytes, which reduces packet encapsulation overhead, lowers CPU utilization, and improves database query latency and throughput.

The database queries over the Direct Connect connection are suffering from latency spikes and performance limitations due to packet fragmentation and high packet-per-second processing limits.

Deploy a NAT Gateway in the public subnet of each Availability Zone (AZ) and update the private subnet route tables to direct internet-bound traffic (

0.0.0.0/0

) to the local NAT Gateway in the same AZ.

Outbound internet traffic is routed locally within each AZ, avoiding cross-AZ traffic charges and latency, and ensuring that an outage in one AZ does not affect internet connectivity for instances in the other AZ.

The previous configuration used a non-redundant NAT Gateway, causing internet connectivity failure for instances in secondary AZs when the primary AZ experienced issues.

Associate the Route 53 Private Hosted Zone (PHZ) from the shared services VPC with the application VPC.

EC2 instances in the application VPC can now successfully resolve the internal endpoints hosted in the shared services VPC.

Route 53 Private Hosted Zones are private by default and are only resolvable within the VPCs they are explicitly associated with.

Key Concept

Optimizing hybrid and inter-VPC network performance and latency involves choosing correct MTU settings, ensuring local AZ resource redundancy for outbound traffic, and properly associating Route 53 Private Hosted Zones across VPC boundaries.

Question 1000Question →

An enterprise operates a microservices-based application running on Amazon EC2 instances across multiple member accounts in an AWS Organization. The application logs are stored locally on the instances in `/var/log/app/application.log` and undergo hourly rotation, renaming the files with a timestamp suffix (for example, `/var/log/app/application.log.2026-07-16-11`). A Solutions Architect must design a centralized logging solution to stream these logs in near real-time to an Amazon S3 bucket in a central security account. The solution must ensure that log collection is continuous and unaffected by file rotation, and it must follow the principle of least privilege, avoiding cross-account IAM role assumptions from EC2 instances where resource-based policies can be used instead. Which two actions should the Solutions Architect take to implement this solution?

Select all that apply

Configure the CloudWatch agent on the EC2 instances using a wildcard path configuration, such as `/var/log/app/application.log*`, to monitor the log directory, and stream the logs to a local log group in each member account's Amazon CloudWatch Logs.

In the central security account, update the S3 bucket policy to allow `s3:PutObject` and `s3:PutObjectAcl` permissions, specifying the Kinesis Data Firehose delivery stream IAM roles from each member account as the principals. In each member account, create a Kinesis Data Firehose delivery stream targeting the central S3 bucket, and set up a CloudWatch Logs subscription filter to forward the logs to the local delivery stream.

Configure the CloudWatch agent on the EC2 instances with a static file path configuration pointing directly to `/var/log/app/application.log`, relying on the agent's default file-tracking behavior to automatically track rotated log descriptors.

Configure the CloudWatch agent on the EC2 instances to stream logs directly to an Amazon Kinesis Data Firehose delivery stream in the central account. Update the destination S3 bucket policy to grant write access using a wildcard principal with a condition limiting access to the AWS Organization ID using the `aws:PrincipalOrgID` key.

Create a cross-account IAM role in the central security account that has permissions to write to CloudWatch Logs. Configure the CloudWatch agent on the EC2 instances in each member account to assume this cross-account role and write the log streams directly to a centralized log group.

Show answer & explanation

Answer: Configure the CloudWatch agent on the EC2 instances using a wildcard path configuration, such as `/var/log/app/application.log*`, to monitor the log directory, and stream the logs to a local log group in each member account's Amazon CloudWatch Logs.; In the central security account, update the S3 bucket policy to allow `s3:PutObject` and `s3:PutObjectAcl` permissions, specifying the Kinesis Data Firehose delivery stream IAM roles from each member account as the principals. In each member account, create a Kinesis Data Firehose delivery stream targeting the central S3 bucket, and set up a CloudWatch Logs subscription filter to forward the logs to the local delivery stream.

Answer

Configure the CloudWatch agent on the EC2 instances using a wildcard path configuration to monitor and stream logs to a local log group in each member account, and update the central S3 bucket policy to allow s3:PutObject and s3:PutObjectAcl permissions to Kinesis Data Firehose delivery stream roles in each member account.

The Solutions Architect must configure the CloudWatch agent with a wildcard path pattern to ensure that the agent continues to monitor both the active log file and any rotated logs containing timestamps in their names. To centralize the logs with least privilege, logs should be published locally to CloudWatch Logs in each member account first. Then, subscription filters can stream the logs to Kinesis Data Firehose. Since Kinesis Data Firehose does not support writing across accounts natively without permissions on both ends, the destination S3 bucket policy in the central account must explicitly grant write permissions to the IAM role of each member account's Firehose stream. This prevents the EC2 instances from needing to assume cross-account roles.

Step-by-Step Solution

Configure the CloudWatch agent log path.

The agent configuration uses a wildcard suffix to monitor files.

This ensures the agent tracks new log entries even after files are rotated and renamed with a timestamp suffix.

Create local CloudWatch Log groups and stream logs.

Logs are sent to local CloudWatch Log groups in each member account.

This decouples local collection from cross-account transmission and allows local processing or retention.

Configure cross-account log streaming using Kinesis Data Firehose.

Logs are forwarded from local log groups via subscription filters to Kinesis Data Firehose, which writes to the central S3 bucket.

This provides a highly scalable, near real-time streaming pipeline without requiring EC2 instances to assume cross-account IAM roles directly.

Configure the S3 bucket policy in the central account.

The S3 bucket policy grants write access to the IAM roles of the Firehose delivery streams in each member account.

This satisfies least-privilege security requirements and allows cross-account delivery without open access or complex role switching on the client side.

Key Concept

Continuous, robust log ingestion during rotation and cross-account centralization using resource-based policies.

Estimated Time:3m 0s

PreviousPage 50 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution