All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A digital publishing company operates a real-time news portal on AWS. The web application runs on Amazon EC2 instances within an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The database tier uses an Amazon RDS for PostgreSQL Multi-AZ deployment.

During breaking news events, traffic instantly spikes from $500\text{ requests/sec}$ to over $80,000\text{ requests/sec}$ within $1\text{ minute}$ . The following table summarizes the metrics observed during these peak events:

Metric	Baseline Value	Peak Traffic Value (Spike)	Target Threshold
ALB Request Rate	$500\text{ requests/sec}$	$80,000\text{ requests/sec}$	$80,000\text{ requests/sec}$
ALB HTTP 502/504 Rate	$0\%$	$24\%$	$< 0.1\%$
EC2 Bootstrapping Time	N/A	$300\text{ seconds}$	$< 30\text{ seconds}$
RDS CPU Utilization (Primary)	$15\%$	$100\%$	$< 70\%$
RDS CPU Utilization (Standby)	$5\%$	$5\%$	N/A
DB Replication Lag	$0\text{ seconds}$	N/A	$< 5\text{ seconds}$

Which combination of actions should the solutions architect implement to optimize the compute, storage, and database layers to resolve these performance bottlenecks while meeting the target thresholds?

Request AWS Support to pre-warm the ALB for the scheduled flash traffic events. Configure an ASG Warm Pool with warm-started instances to reduce capacity delivery time. Create Amazon RDS PostgreSQL Read Replicas, configure an Application Auto Scaling policy for these replicas, and update the application to route read queries to the replica endpoints.

Request AWS Support to pre-warm the ALB for the scheduled flash traffic events. Configure the ASG to use a step scaling policy based on CPU utilization. Enable read routing to the RDS PostgreSQL Multi-AZ standby instance by modifying the DB connection string to point to the standby's endpoint.

Rely on the ALB's default automatic scaling to adapt to the traffic spike. Configure an ASG Warm Pool with stopped instances to minimize running costs. Create Amazon RDS PostgreSQL Read Replicas, and configure a single DNS CNAME record in Route 53 to load-balance read traffic across the primary and standby DB instances.

Request AWS Support to pre-warm the ALB for the scheduled flash traffic events. Increase the minimum capacity of the ASG permanently to handle the peak request rate. Configure the application to route read queries to the standby DB instance using the RDS cluster endpoint to automatically load-balance database queries.

Show answer & explanation

Answer: Request AWS Support to pre-warm the ALB for the scheduled flash traffic events. Configure an ASG Warm Pool with warm-started instances to reduce capacity delivery time. Create Amazon RDS PostgreSQL Read Replicas, configure an Application Auto Scaling policy for these replicas, and update the application to route read queries to the replica endpoints.

Answer

The correct solution involves requesting AWS Support to pre-warm the ALB to prevent initial connection drops, using an Auto Scaling Group Warm Pool with warm-started instances to bring initialization times under 30 seconds, and deploying RDS Read Replicas with Auto Scaling while routing read queries to the replica endpoints rather than attempting to query the passive Multi-AZ standby instance.

The correct answer provides a comprehensive optimization plan for all three layers. It addresses the load balancer bottleneck by pre-warming the ALB to handle the massive traffic surge. It resolves the EC2 provisioning lag by utilizing ASG Warm Pools, which keep instances pre-bootstrapped and ready to serve traffic in under 30 seconds. Finally, it addresses the database bottleneck by scaling reads using RDS Read Replicas, correctly identifying that the standard RDS Multi-AZ standby instance is passive and cannot serve read traffic.

Step-by-Step Solution

Address load balancer scaling limitations.

Request AWS Support to pre-warm the ALB before scheduled breaking news events.

Standard ALB auto-scaling is reactive and cannot scale fast enough to handle an instantaneous spike of 80,000 requests/sec, causing HTTP 502/504 errors.

Optimize compute tier initialization latency.

Implement an ASG Warm Pool with warm-started instances.

This bypasses the 300-second bootstrapping delay, allowing pre-initialized instances to join the active fleet in under 30 seconds during a scale-out event.

Resolve database CPU saturation.

Deploy RDS PostgreSQL Read Replicas, configure Application Auto Scaling, and point application read queries to the replica endpoints.

The primary DB instance CPU is saturated by read-heavy reporting queries. Deploying read replicas offloads this traffic. The standby instance in a standard RDS Multi-AZ deployment is strictly passive and cannot serve read traffic.

Key Concept

Optimizing multi-tier architectures for sudden traffic spikes requires proactive load balancer pre-warming, compute initialization acceleration (Warm Pools), and database read scaling via active read replicas instead of passive Multi-AZ standby instances.

Estimated Time:3m 0s

Question 1022Question →

A company is designing a new web application and needs to select the most appropriate AWS storage and database services. The application has the following two requirements:

1. Store user-uploaded profile pictures (average size 2 MB) in a highly durable, cost-effective storage tier that can scale to millions of objects.
2. Store session state data and user preferences with single-digit millisecond latency, requiring a database that automatically scales throughput based on application demand.

Which two of the following database and storage configurations should the Solutions Architect select to satisfy these requirements? (Select TWO.)

Select all that apply

Amazon S3 for storing the user-uploaded profile pictures

Amazon DynamoDB with auto-scaled read/write capacity for storing the session state and user preferences

Amazon Aurora PostgreSQL database where the standby replica in the Multi-AZ deployment is used to serve read queries for the session state data

Amazon DynamoDB with a Pilot Light disaster recovery strategy to secondary regions to support active-active read/write access with near-zero recovery time objective (RTO)

Amazon S3 with cross-account access for the profile pictures, utilizing the default AWS-managed KMS key (aws/s3) with a modified bucket policy to delegate permission to external accounts

Show answer & explanation

Answer: Amazon S3 for storing the user-uploaded profile pictures; Amazon DynamoDB with auto-scaled read/write capacity for storing the session state and user preferences

Answer

The correct configurations are to use Amazon S3 for storing the user-uploaded profile pictures and to use Amazon DynamoDB with auto-scaled read/write capacity for storing the session state and user preferences.

Storing profile pictures in Amazon S3 is the standard and most cost-effective solution for scalable object storage. Storing session state and user preferences in Amazon DynamoDB provides the required single-digit millisecond latency and can dynamically scale read and write capacity based on traffic.

Step-by-Step Solution

Analyze the storage requirement for profile pictures.

Profile pictures are large objects (average 2 MB) and require durable, cost-effective storage. Amazon S3 is the optimal service for object storage.

S3 is designed for high durability and scales automatically to millions of objects.

Analyze the database requirement for session state and user preferences.

The session data requires single-digit millisecond latency and auto-scaling capabilities. Amazon DynamoDB is a fully managed NoSQL key-value store that provides consistent single-digit millisecond response times and automatic throughput scaling.

DynamoDB is optimal for session storage and low-latency key-value access.

Evaluate the remaining options against the architectural constraints.

Aurora standby replicas in Multi-AZ are not readable, Pilot Light is not active-active, and AWS-managed KMS keys cannot be shared cross-account.

These options violate basic AWS service limitations and configurations.

Key Concept

Selecting appropriate AWS database and storage services based on performance, capacity, and architectural constraints.

Question 1023Question →

An enterprise runs a critical compliance application in the us-east-1 Region within a Production AWS account. The application tier consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The database tier uses an Amazon RDS for PostgreSQL DB instance. The enterprise wants to set up a disaster recovery (DR) solution in the us-west-2 Region with a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of 15 minutes. Outbound internet traffic in both regions must go through a centralized Network AWS account via AWS Transit Gateway. Which configuration meets the recovery objectives at the lowest cost while ensuring a highly reliable architecture?

Create an Amazon RDS for PostgreSQL cross-Region read replica in us-west-2. In the Network account, deploy redundant NAT Gateways across multiple Availability Zones in us-west-2 connected to the Transit Gateway. In the Production account, deploy a pilot light Auto Scaling group with a minimum capacity of 0 in us-west-2. During a failover event, use a script to promote the RDS replica to primary, scale up the Auto Scaling group, and update Route 53 DNS records.

Configure AWS Backup in the Production account to take daily snapshots of the RDS DB instance and copy them to us-west-2. In the Network account, deploy redundant NAT Gateways across multiple Availability Zones in us-west-2. In the Production account, pre-deploy the application infrastructure in us-west-2. During a failover event, restore the database from the copied snapshot and update Route 53 DNS records.

Create an Amazon RDS for PostgreSQL cross-Region read replica in us-west-2. In the Network account, deploy a single NAT Gateway in a single Availability Zone in us-west-2 to handle outbound internet traffic for the standby VPC. In the Production account, deploy a pilot light Auto Scaling group with a minimum capacity of 0 in us-west-2. During a failover event, promote the RDS replica, scale up the Auto Scaling group, and update Route 53 DNS records.

Create an Amazon RDS for PostgreSQL cross-Region read replica in us-west-2. In the Network account, deploy redundant NAT Gateways across multiple Availability Zones in us-west-2. Configure Amazon Route 53 active-passive failover routing with health checks. Rely on Route 53 to automatically promote the RDS read replica in us-west-2 to primary and scale the application instances when the primary endpoint is unhealthy.

Show answer & explanation

Answer: Create an Amazon RDS for PostgreSQL cross-Region read replica in us-west-2. In the Network account, deploy redundant NAT Gateways across multiple Availability Zones in us-west-2 connected to the Transit Gateway. In the Production account, deploy a pilot light Auto Scaling group with a minimum capacity of 0 in us-west-2. During a failover event, use a script to promote the RDS replica to primary, scale up the Auto Scaling group, and update Route 53 DNS records.

Answer

The correct configuration uses Amazon RDS cross-Region replication to meet the 15-minute RPO, a pilot light Auto Scaling group to minimize idle costs in the secondary region, and scripting to automate failover within the 30-minute RTO. Additionally, it ensures outbound network reliability by using redundant NAT Gateways across multiple Availability Zones in the Network account.

Step-by-Step Solution

Evaluate the RPO requirement of 15 minutes.

Determine that cross-Region read replication is required because daily backups have an RPO of 24 hours.

Asynchronous RDS cross-Region replication provides lag times typically under a few minutes, satisfying the 15-minute RPO.

Evaluate the RTO requirement of 30 minutes.

A pilot light deployment with automated scripting is selected to promote the database and scale instances.

Scripted promotion of the replica and scaling the Auto Scaling group from 0 can easily be completed within the 30-minute target.

Analyze outbound networking path reliability.

Redundant NAT Gateways must be deployed across multiple Availability Zones in the secondary Region.

A single NAT Gateway creates a single point of failure, violating the reliability requirements of the architecture.

Assess Route 53 automatic failover capabilities.

Identify that DNS routing changes are automatic, but database promotion and infrastructure scaling require custom automation.

Route 53 cannot perform application-level tasks like database promotion or Auto Scaling group modification.

Key Concept

Designing cost-effective, highly reliable multi-Region disaster recovery architectures utilizing pilot light patterns, RDS cross-Region replication, and redundant NAT Gateways.

Estimated Time:2m 0s

Question 1024Question →

A healthcare IoT company collects real-time patient telemetry data from medical devices located globally. The ingestion tier is deployed in the us-east-1 and eu-west-1 Regions behind internet-facing Application Load Balancers (ALBs). The devices upload data using HTTPS. Devices located in the Asia-Pacific region are experiencing high network latency and intermittent connection timeouts during uploads, resulting in telemetry data loss. A solutions architect must optimize the network performance and reduce ingestion latency for these global devices with minimal administrative overhead. Which of the following solutions should the solutions architect implement?

Submit a support ticket to AWS to pre-warm the ALBs in both Regions to handle the traffic volume and prevent connection timeouts.

Create an Amazon Route 53 Private Hosted Zone associated with the VPCs in both Regions, and configure latency-based routing policies to resolve the ALB endpoints using their internal IP addresses.

Deploy AWS Global Accelerator and register the internet-facing ALBs in both Regions as endpoints. Update the public DNS records in Amazon Route 53 to point to the anycast static IP addresses assigned to the accelerator.

Establish an AWS Transit Gateway in both Regions, configure inter-Region Transit Gateway peering, and update the routing tables to direct client traffic transitively through a centralized hub VPC.

Show answer & explanation

Answer: Deploy AWS Global Accelerator and register the internet-facing ALBs in both Regions as endpoints. Update the public DNS records in Amazon Route 53 to point to the anycast static IP addresses assigned to the accelerator.

Answer

Deploy AWS Global Accelerator, register the internet-facing Application Load Balancers in both Regions as endpoints, and update the public DNS records in Amazon Route 53 to point to the static Anycast IP addresses assigned to the accelerator.

The correct option proposes deploying AWS Global Accelerator. Global Accelerator provides static Anycast IP addresses that route traffic from client devices through the nearest AWS edge location and then across the AWS internal global network backbone to the nearest healthy Application Load Balancer. This bypasses the congested public internet, reduces packet loss, and significantly decreases latency and timeouts.

Step-by-Step Solution

Analyze the source of the issue

Identify that devices in the Asia-Pacific region are experiencing connection timeouts due to long and congested public internet paths to the ALBs in the United States and Europe.

Before selecting a solution, we must determine if the bottlenecks are caused by load balancer capacity limitations or geographical network latency.

Select a global network optimization service

Choose AWS Global Accelerator to route ingestion traffic over the private AWS global network backbone, avoiding the public internet.

AWS Global Accelerator assigns static Anycast IP addresses that route traffic through the closest AWS edge location, reducing network hops and latency.

Configure the endpoints and update routing

Register the ALBs as endpoints in the accelerator configuration and point the Route 53 DNS records to the accelerator's IP addresses.

This establishes a single entry point for all global devices and ensures that traffic is automatically routed to the closest healthy regional ALB.

Key Concept

Optimizing global client-to-application latency by routing traffic over the AWS global network backbone using AWS Global Accelerator.

Estimated Time:2m 0s

Question 1025Question →

A multinational retail corporation is designing a new hybrid networking architecture to connect its on-premises inventory systems with three newly created VPCs in the us-east-1 Region: vpc-checkout-prod, vpc-catalog-prod, and vpc-orders-prod. The on-premises data centers are connected to AWS via two active-passive 10 Gbps AWS Direct Connect connections terminating at different Direct Connect locations. The architecture requires that all three VPCs have low-latency, bidirectional communication with each other and can access the on-premises inventory systems. Additionally, workloads in the private subnets of all three VPCs must be able to download external software updates. The solution must ensure high availability for outbound traffic, prevent single points of failure, and minimize both operational complexity and NAT Gateway hourly costs. Which network architecture design meets these requirements?

Deploy an AWS Transit Gateway in the us-east-1 Region, and attach the three application VPCs. Connect the on-premises network to the Transit Gateway using a Direct Connect Gateway and a Transit Virtual Interface (Transit VIF). Create a centralized egress VPC with a NAT Gateway deployed in each of two Availability Zones, attach it to the Transit Gateway, and configure route tables to direct all outbound internet traffic from the application VPCs through the Transit Gateway to the egress VPC.

Deploy an AWS Transit Gateway in the us-east-1 Region, and attach the three application VPCs. Connect the on-premises network to the Transit Gateway using a Direct Connect Gateway and a Transit Virtual Interface (Transit VIF). To minimize NAT Gateway deployment costs, create a single NAT Gateway in one public subnet within vpc-checkout-prod, and configure the route tables of the other application VPCs to direct all internet-bound traffic to this NAT Gateway via the Transit Gateway.

Associate the three application VPCs directly with a Direct Connect Gateway using Private Virtual Interfaces (Private VIFs) on the Direct Connect connections. Configure the Direct Connect Gateway to route traffic between the application VPCs and to the on-premises data centers. Deploy a NAT Gateway in each Availability Zone of all three VPCs to handle high-availability internet egress.

Deploy an AWS Transit Gateway in the us-east-1 Region, and attach the three application VPCs. Connect the on-premises network to the Transit Gateway using a Direct Connect Gateway and a Transit Virtual Interface (Transit VIF). Centralize outbound internet egress by deploying a NAT Gateway in each Availability Zone of a shared egress VPC. Host a Route 53 Private Hosted Zone (PHZ) for internal service resolution in a central account, and associate it only with the egress VPC, relying on the Transit Gateway to route DNS queries from the application VPCs.

Show answer & explanation

Answer: Deploy an AWS Transit Gateway in the us-east-1 Region, and attach the three application VPCs. Connect the on-premises network to the Transit Gateway using a Direct Connect Gateway and a Transit Virtual Interface (Transit VIF). Create a centralized egress VPC with a NAT Gateway deployed in each of two Availability Zones, attach it to the Transit Gateway, and configure route tables to direct all outbound internet traffic from the application VPCs through the Transit Gateway to the egress VPC.

Answer

The correct design uses AWS Transit Gateway to establish a scalable hub-and-spoke topology that meets the low-latency inter-VPC and hybrid connectivity requirements. By utilizing a centralized egress VPC with redundant NAT Gateways deployed across two Availability Zones, the architecture maintains high availability for outbound traffic, avoids single points of failure, and cuts NAT Gateway idle hourly charges by reducing the required NAT Gateways from six (two per spoke VPC) to two.

Step-by-Step Solution

Select a hub-and-spoke connectivity model using AWS Transit Gateway.

Allows all three spoke VPCs to communicate with low latency and scales seamlessly.

Direct inter-VPC communication and hybrid connectivity are best managed centrally via Transit Gateway.

Connect the on-premises network using Direct Connect Gateway and a Transit VIF.

Establishes secure, high-throughput hybrid routing from the Transit Gateway to the on-premises infrastructure.

Transit VIF is required to associate a Direct Connect connection with an AWS Transit Gateway.

Implement a centralized egress architecture using a dedicated VPC.

Deploys two NAT Gateways (one per Availability Zone) in the egress VPC instead of six across all spokes.

Maintains high availability for outbound connections while drastically reducing NAT hourly baseline fees.

Key Concept

Centralized network topology using AWS Transit Gateway and high-availability egress design.

Question 1026Question →

An e-commerce enterprise is deploying a new high-throughput platform in the eu-west-1 Region. The architecture consists of a processing VPC (vpc-processing) and a database VPC (vpc-storage). The application servers in vpc-processing run in private subnets across three Availability Zones (eu-west-1a, eu-west-1b, and eu-west-1c). These servers must make high-volume API calls to a third-party SaaS provider over the internet, and privately resolve and access a database in vpc-storage using the private domain name db.internal. The design must minimize data transfer costs, prevent cross-Availability Zone dependencies for outbound traffic, and ensure high availability. Which configuration steps should the solutions architect perform to meet these requirements? (Select TWO.)

Select all that apply

Deploy a NAT Gateway in the public subnet of each Availability Zone (eu-west-1a, eu-west-1b, and eu-west-1c) within vpc-processing, and configure the route tables of the private subnets in each zone to route outbound internet traffic (0.0.0.0/0) through the local NAT Gateway in that same zone.

Associate the Route 53 Private Hosted Zone for db.internal with both vpc-processing and vpc-storage to allow instances in both VPCs to resolve the private database domain name directly.

Deploy a single NAT Gateway in the public subnet of eu-west-1a within vpc-processing to serve all outbound internet traffic from all three Availability Zones, reducing NAT Gateway hourly provisioned costs.

Configure an AWS Transit Gateway, attach both VPCs, and associate the db.internal Private Hosted Zone directly with the Transit Gateway to enable transitive DNS resolution across the attached networks.

Create the db.internal Private Hosted Zone in vpc-storage, and deploy Route 53 Resolver outbound endpoints in vpc-processing to forward DNS queries to the Route 53 Resolver inbound endpoints deployed in vpc-storage.

Show answer & explanation

Answer: Deploy a NAT Gateway in the public subnet of each Availability Zone (eu-west-1a, eu-west-1b, and eu-west-1c) within vpc-processing, and configure the route tables of the private subnets in each zone to route outbound internet traffic (0.0.0.0/0) through the local NAT Gateway in that same zone.; Associate the Route 53 Private Hosted Zone for db.internal with both vpc-processing and vpc-storage to allow instances in both VPCs to resolve the private database domain name directly.

Answer

Deploy a NAT Gateway in the public subnet of each Availability Zone (eu-west-1a, eu-west-1b, and eu-west-1c) within vpc-processing, routing private subnet traffic to the local NAT Gateway in that same zone, and associate the Route 53 Private Hosted Zone for db.internal with both vpc-processing and vpc-storage.

The correct architecture achieves high availability and lowest cost by deploying a NAT Gateway in each of the three Availability Zones to prevent cross-AZ data transfer fees, and by associating the Route 53 Private Hosted Zone directly with both VPCs to allow simple, cost-effective internal resolution.

Step-by-Step Solution

Analyze outbound internet routing requirements for vpc-processing.

To avoid cross-Availability Zone data transfer charges and eliminate a single point of failure, a separate NAT Gateway must be provisioned in each Availability Zone. The route tables of the private subnets in each zone must route 0.0.0.0/0 traffic to the NAT Gateway in the corresponding zone.

This guarantees Availability Zone independence and minimizes cross-AZ data transfer fees.

Analyze private DNS resolution requirements for db.internal.

A Route 53 Private Hosted Zone (PHZ) should be created for db.internal. This PHZ must then be associated with both vpc-processing and vpc-storage VPCs.

VPC association allows local DNS resolution to function natively in both VPCs, avoiding the cost, management overhead, and latency of Route 53 Resolver endpoints.

Key Concept

Multi-Availability Zone NAT Gateway redundancy and Route 53 Private Hosted Zone multi-VPC association.

Question 1027Question →

An enterprise hosts a high-throughput, latency-sensitive application across three Availability Zones in the us-west-2 Region. The application relies on external API endpoints for real-time payment processing and needs to resolve internal microservice endpoints hosted in a separate shared services VPC. The application is experiencing intermittent latency spikes and connection timeouts during peak hours. An audit reveals that all outbound traffic to the internet-facing payment gateway is routed through a single NAT Gateway in the primary Availability Zone, and internal microservice DNS queries are failing to resolve. Which of the following actions should the Solutions Architect take to optimize the network performance and resolve these latency and DNS issues? (Select TWO.)

Select all that apply

Deploy a NAT Gateway in each Availability Zone and update the route tables of the private subnets to point to the local NAT Gateway in their respective zones.

Associate the Route 53 Private Hosted Zone of the shared services VPC with the application VPC.

Consolidate all outbound routing by directing traffic from all private subnets across all Availability Zones to a single NAT Gateway located in the primary Availability Zone to avoid cross-AZ replication overhead.

Recreate the microservice DNS records in a new public Route 53 hosted zone and configure the application VPC DHCP options set to resolve queries via public DNS servers.

Submit a support ticket to AWS to pre-warm the Application Load Balancers (ALBs) to prevent TCP connection timeouts during outbound API calls.

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone and update the route tables of the private subnets to point to the local NAT Gateway in their respective zones.; Associate the Route 53 Private Hosted Zone of the shared services VPC with the application VPC.

Answer

Deploy a NAT Gateway in each Availability Zone and update the route tables of the private subnets to point to the local NAT Gateway in their respective zones; Associate the Route 53 Private Hosted Zone of the shared services VPC with the application VPC.

The correct architecture deploys a NAT Gateway in each Availability Zone so that outbound traffic to the payment gateway does not traverse Availability Zones, reducing latency and removing a single point of failure. Additionally, associating the Route 53 Private Hosted Zone of the shared services VPC with the application VPC allows the application instances to resolve internal microservice endpoints directly and successfully.

Step-by-Step Solution

Analyze the outbound traffic path to external APIs and identify the latency bottleneck.

The application routes all outbound internet traffic through a single NAT Gateway in one Availability Zone, resulting in cross-AZ network latency and a single point of failure.

To optimize outbound network latency and improve reliability, outbound traffic should remain within the local Availability Zone by deploying a NAT Gateway in each zone.

Analyze the DNS resolution failure for internal microservice endpoints.

The Route 53 Private Hosted Zone containing the microservice DNS records is in a shared services VPC and has not been associated with the application VPC.

Associating the Private Hosted Zone with the application VPC enables direct and successful resolution of internal endpoints.

Key Concept

Multi-AZ network path optimization and cross-account DNS resolution using Route 53 Private Hosted Zone association.

Question 1028Question →

An enterprise is designing a new multi-VPC architecture in the eu-west-1 Region. The design includes two application VPCs (vpc-hr-prod and vpc-finance-prod) and a central egress VPC (vpc-central-egress). The application VPCs do not have direct internet access. All VPCs are connected via a central AWS Transit Gateway. The application workloads are distributed across two Availability Zones for high availability.

The enterprise has the following requirements:
1. All outbound internet traffic from the application VPCs must route through the central egress VPC.
2. The egress configuration must remain highly available and resilient to Availability Zone outages.
3. Applications must resolve domain names within a private hosted zone named internal.globalcorp that is hosted in a centralized AWS Shared Services account.

Which networking architecture meets these requirements?

Deploy a single NAT Gateway in one Availability Zone in the central egress VPC to minimize idle costs. Route all outbound internet traffic from the application VPCs through this NAT Gateway via the Transit Gateway. Associate the central private hosted zone only with the central egress VPC.

Deploy a NAT Gateway in each of the two Availability Zones within the central egress VPC. Configure Transit Gateway route tables to route outbound internet traffic from the application VPCs to the egress VPC, distributing the traffic across the NAT Gateways in each zone. Authorize and associate the central private hosted zone with all three VPCs.

Deploy a NAT Gateway in each of the two Availability Zones within the central egress VPC. Connect the application VPCs to the egress VPC using a Direct Connect Gateway to enable transitive routing and resolve DNS queries. Create separate, identical private hosted zones in each VPC's account.

Deploy a NAT Gateway in each of the two Availability Zones within the central egress VPC. Configure Transit Gateway route tables to route outbound internet traffic from the application VPCs to the egress VPC. Create a Route 53 Resolver rule to forward DNS queries for internal.globalcorp to the egress VPC Transit Gateway interface, without associating the private hosted zone.

Show answer & explanation

Answer: Deploy a NAT Gateway in each of the two Availability Zones within the central egress VPC. Configure Transit Gateway route tables to route outbound internet traffic from the application VPCs to the egress VPC, distributing the traffic across the NAT Gateways in each zone. Authorize and associate the central private hosted zone with all three VPCs.

Answer

Deploy a NAT Gateway in each of the two Availability Zones within the central egress VPC, route outbound internet traffic to these NAT Gateways via the Transit Gateway, and authorize and associate the central private hosted zone with all three VPCs.

The correct architecture achieves high availability by utilizing redundant NAT Gateways across two Availability Zones in the egress VPC. It also satisfies the DNS requirement by associating the private hosted zone with all VPCs, which is required for cross-VPC and cross-account DNS resolution of private hosted zones.

Step-by-Step Solution

Evaluate the resiliency requirement for internet egress.

Identify that a NAT Gateway must be deployed in each Availability Zone of the central egress VPC to prevent a single Availability Zone outage from disrupting all outbound traffic.

Deploying a single NAT Gateway creates a single point of failure, violating the high availability requirement.

Configure Transit Gateway routing for egress.

Ensure Transit Gateway route tables direct outbound traffic (

0.0.0.0/0

) from the application VPCs to the central egress VPC.

This centralizes egress traffic and applies the NAT Gateway translation consistently.

Address cross-account DNS resolution requirements.

Associate the Route 53 private hosted zone with each VPC across both the Shared Services account and the application accounts.

VPCs cannot resolve records in a private hosted zone unless the zone is explicitly associated with them, even when connected via Transit Gateway.

Key Concept

Multi-AZ egress routing and cross-account Route 53 Private Hosted Zone association.

Estimated Time:2m 0s

Question 1029Question →

A retail company wants to improve the response time of its product catalog website, which is backed by an Amazon RDS for PostgreSQL database. The catalog data is read-heavy and does not change frequently, but the caching layer must be highly available, support data replication across multiple Availability Zones, and allow for automatic failover.

Which two actions should a solutions architect recommend to implement this caching layer? (Select TWO.)

Select all that apply

Deploy Amazon ElastiCache for Redis in a Multi-AZ replication group.

Modify the application code to read from the cache first, and query the RDS database only if there is a cache miss.

Deploy Amazon ElastiCache for Memcached with multi-node replication enabled.

Create an Amazon RDS PostgreSQL Read Replica and configure it in Multi-AZ mode to serve as the caching layer.

Deploy Amazon ElastiCache for Memcached and enable Multi-AZ with automatic failover.

Show answer & explanation

Answer: Deploy Amazon ElastiCache for Redis in a Multi-AZ replication group.; Modify the application code to read from the cache first, and query the RDS database only if there is a cache miss.

Answer

Deploying Amazon ElastiCache for Redis in a Multi-AZ replication group and modifying the application code to query the cache first before the database.

Deploying Amazon ElastiCache for Redis in a Multi-AZ replication group provides the required high availability, automatic failover, and data replication across Availability Zones. Modifying the application to check the cache first before querying the RDS database implements the cache-aside pattern, which effectively offloads read-heavy query traffic and reduces response times.

Step-by-Step Solution

Analyze the requirements for high availability, multi-AZ replication, and automatic failover in the caching tier.

Determine that Amazon ElastiCache for Redis supports these clustering and high availability requirements, whereas Memcached does not.

Memcached does not support multi-AZ replication or automatic failover.

Determine the application logic required to utilize the caching layer.

Implement the cache-aside pattern where the application reads from the cache first and falls back to RDS on a cache miss.

This reduces query latency and offloads read traffic from the primary RDS PostgreSQL database.

Key Concept

Improving database efficiency by introducing a highly available, memory-based caching layer with ElastiCache for Redis using a cache-aside pattern.

Question 1030Question →

A startup company has deployed its web application infrastructure using AWS CloudFormation. Over time, several team members have made manual adjustments to the security groups and EC2 instance configurations directly through the AWS Console, causing inconsistencies. Additionally, the company needs to ensure that a security agent is automatically installed and kept running on all EC2 instances.

Which TWO actions should the Solutions Architect take to detect these infrastructure changes and automate the software installation? (Select TWO.)

Select all that apply

Run drift detection on the CloudFormation stacks to identify resources that have diverged from the template configurations.

Create an AWS Systems Manager State Manager association to define and enforce the installation of the security agent on the instances.

Configure a CloudFormation stack policy to prevent direct console modifications of the resources by developers.

Attach a Service Control Policy (SCP) to the Organizational Unit (OU) that explicitly grants admin permissions to perform automatic configuration remediation.

Create a cross-account IAM role that uses an AWS-managed KMS key to decrypt configuration scripts during manual updates.

Show answer & explanation

Answer: Run drift detection on the CloudFormation stacks to identify resources that have diverged from the template configurations.; Create an AWS Systems Manager State Manager association to define and enforce the installation of the security agent on the instances.

Answer

Run drift detection on the CloudFormation stacks to identify resources that have diverged from the template configurations, and create an AWS Systems Manager State Manager association to define and enforce the installation of the security agent on the instances.

Running drift detection on AWS CloudFormation stacks allows developers and administrators to quickly identify resources whose properties have diverged from the template definition. Creating an AWS Systems Manager State Manager association ensures that EC2 instances stay configured with the necessary agents, preventing configuration drift on the OS level by periodically checking and enforcing the desired state.

Step-by-Step Solution

Address the requirement to detect manual out-of-band modifications to CloudFormation-managed resources.

Identify that AWS CloudFormation drift detection checks the stack's resources and reports modifications compared to the template.

This identifies configuration drift without requiring third-party monitoring.

Address the requirement to automate and enforce software agent installation on EC2 instances.

Identify that AWS Systems Manager State Manager continuously enforces the desired configuration state (such as installing software).

This maintains operational consistency and automatically remediates compliance on the instances.

Key Concept

Detecting out-of-band resource modifications using CloudFormation drift detection and enforcing instance configurations using Systems Manager State Manager.

Question 1031Question →

An application is hosted on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances are deployed in private subnets across two Availability Zones. The instances need to access the internet to download updates and call payment gateways. During peak trading hours, the company notices that if a single Availability Zone experiences an outage, outbound payment API calls fail. Additionally, during sudden spikes in user activity, the ASG launches too many instances before the recently launched instances finish bootstrapping, leading to increased costs. Which two actions should a Solutions Architect take to improve the fault tolerance and responsiveness of the application?

Select all that apply

Deploy a NAT Gateway in each Availability Zone and configure the route tables of each private subnet to route outbound traffic through its corresponding local NAT Gateway.

Increase the Auto Scaling group cooldown or warmup period to align with the instance bootstrapping duration, preventing the launch of additional instances until the previous ones are fully operational.

Deploy a single NAT Gateway in one Availability Zone's public subnet and configure all private subnet route tables to direct outbound traffic to this gateway.

Configure a very short Auto Scaling group cooldown period of

10

seconds to force the rapid launch of multiple instances as soon as any CPU threshold is breached.

Submit a support ticket to pre-warm the Application Load Balancer for all dynamic scaling events to prevent connection timeouts during sudden spikes.

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone and configure the route tables of each private subnet to route outbound traffic through its corresponding local NAT Gateway.; Increase the Auto Scaling group cooldown or warmup period to align with the instance bootstrapping duration, preventing the launch of additional instances until the previous ones are fully operational.

Answer

Deploy a NAT Gateway in each Availability Zone and route local private subnet traffic through them; also increase the Auto Scaling group cooldown or warmup period to match the instance bootstrapping duration.

Deploying a NAT Gateway in each Availability Zone ensures that outbound network connectivity remains functional even if an entire zone experiences an outage. Aligning the Auto Scaling group cooldown or warmup period with the duration of the instance bootstrapping process prevents over-provisioning by allowing recently launched instances to start reporting metrics before the group initiates further scaling actions.

Step-by-Step Solution

Ensure outbound connectivity is fault-tolerant by deploying a NAT Gateway in every Availability Zone used by the private subnets.

If an Availability Zone goes offline, the private subnets in the remaining zones still have local NAT Gateways to reach the payment gateways.

This eliminates the single point of failure associated with a single NAT Gateway configuration.

Analyze the instance boot and bootstrapping time, then adjust the Auto Scaling group's cooldown or warmup period accordingly.

The Auto Scaling group will pause after a scale-out event, allowing the new instances to boot, start serving traffic, and report metrics before determining if more instances are needed.

This prevents unnecessary instance launches and reduces costs during rapid scaling events.

Key Concept

Designing multi-AZ fault tolerance for outbound internet traffic and configuring Auto Scaling group cooldown limits to match application bootstrap times.

Question 1032Question →

An enterprise architecture includes a centralized logging bucket in Account A that collects data from multiple secondary AWS accounts within the same AWS Organization. The S3 bucket is configured with Server-Side Encryption using AWS KMS (SSE-KMS) with the default AWS-managed key (`aws/s3`). During a security audit, it is noted that while secondary accounts can write to the bucket, they cannot read or decrypt the objects they uploaded. Additionally, the security team requires the ability to rotate the encryption keys and enforce key rotation policies. Which configuration change will resolve the decryption issue and meet the compliance requirements?

Modify the key policy of the default AWS-managed key (`aws/s3`) to grant decrypt permissions to the cross-account IAM principals, and enable automatic annual key rotation.

Transition the S3 bucket encryption to a Customer Managed Key (CMK) in AWS KMS, configure the key policy to grant decrypt permissions to the cross-account IAM principals, and update the bucket policy to permit cross-account access.

Attach a Service Control Policy (SCP) at the Organizational Unit level that grants the `kms:Decrypt` action for the `aws/s3` key to the secondary accounts, overriding the key policy restrictions.

Update only the S3 bucket policy in Account A to delegate access to the cross-account principals, as S3 bucket policies automatically delegate permissions to KMS keys used for SSE-KMS without modifying the key policies.

Show answer & explanation

Answer: Transition the S3 bucket encryption to a Customer Managed Key (CMK) in AWS KMS, configure the key policy to grant decrypt permissions to the cross-account IAM principals, and update the bucket policy to permit cross-account access.

Answer

Transitioning to a Customer Managed Key (CMK) is required because AWS managed keys (such as `aws/s3`) do not support modifying their key policies to grant cross-account access. By using a CMK, the key owner can update the key policy to allow external accounts to perform decryption and encryption actions, while also satisfying the compliance requirement for key rotation.

Step-by-Step Solution

Identify the limitation of AWS-managed keys.

The default AWS-managed key `aws/s3` cannot be used because its key policy cannot be modified to grant cross-account access.

Security and compliance requirements dictate that cross-account IAM principals must be granted decrypt permissions, which is only possible with Customer Managed Keys.

Establish a Customer Managed Key (CMK) and define its key policy.

A new KMS Customer Managed Key is created with key rotation enabled, and the key policy is configured to allow the external AWS accounts access to `kms:Decrypt` and `kms:GenerateDataKey`.

This enables cross-account decrypt capabilities and meets the rotation policy compliance goal.

Configure the S3 Bucket Policy to align with the access requirements.

The S3 bucket policy in Account A is updated to permit cross-account uploads and access.

For cross-account access to KMS-encrypted S3 objects, permissions must be explicitly granted on both the S3 bucket policy and the KMS key policy.

Key Concept

Cross-account KMS authorization using Customer Managed Keys (CMKs) in S3 SSE-KMS configurations.

Estimated Time:2m 0s

Question 1033Question →

An enterprise runs a critical application on Amazon EC2 instances within member accounts of an AWS Organization. The application writes logs to `/var/log/app/production.log`. These logs are rotated hourly and renamed using the pattern `/var/log/app/production.log-YYYYMMDD-HH`. The enterprise needs to centralize these logs into a single Amazon S3 bucket in a dedicated security account for long-term compliance auditing. Additionally, the solution must support real-time alerting in Amazon CloudWatch for specific error codes, ensure no logs are lost during hourly rotation, and minimize the local disk footprint in the member accounts.

Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Configure the CloudWatch Agent on the EC2 instances to monitor the log path `/var/log/app/production.log*`. Implement a local log rotation utility to delete older rotated logs to free up disk space.

Configure a CloudWatch Logs subscription filter in each member account to stream logs to an Amazon Kinesis Data Firehose delivery stream in the same account. Grant the Firehose IAM role in each member account write permissions to the centralized S3 bucket, and configure the S3 bucket policy in the security account to permit these role ARNs.

Configure the CloudWatch Agent on the EC2 instances to monitor the static path `/var/log/app/production.log`. Rely on the CloudWatch Agent's auto-discovery feature to automatically track and stream renamed files after log rotation occurs.

Configure the CloudWatch Agent on the EC2 instances to write log files directly to the centralized Amazon S3 bucket, and configure an S3 bucket policy in the security account that grants write access to all EC2 instances within the AWS Organization.

Configure a local script on the EC2 instances to copy rotated log files directly to the centralized Amazon S3 bucket. Set up a lifecycle policy on the S3 bucket to transition the logs to S3 Glacier Deep Archive after 7 days.

Show answer & explanation

Answer: Configure the CloudWatch Agent on the EC2 instances to monitor the log path `/var/log/app/production.log*`. Implement a local log rotation utility to delete older rotated logs to free up disk space.; Configure a CloudWatch Logs subscription filter in each member account to stream logs to an Amazon Kinesis Data Firehose delivery stream in the same account. Grant the Firehose IAM role in each member account write permissions to the centralized S3 bucket, and configure the S3 bucket policy in the security account to permit these role ARNs.

Answer

To continuously collect logs during rotation and centralize them securely, the CloudWatch Agent must be configured with a wildcard pattern, and a CloudWatch Logs subscription filter must stream the logs to Kinesis Data Firehose to deliver them to the cross-account centralized S3 bucket.

Configuring the CloudWatch Agent with a wildcard path ensures that rotated logs are not missed. Using a subscription filter to stream logs to Kinesis Data Firehose allows for managed, secure delivery to a central S3 bucket in another account while maintaining logs in CloudWatch for real-time alerting.

Step-by-Step Solution

Address log rotation dynamic filenames.

Configure the CloudWatch Agent with the path `/var/log/app/production.log*`.

The wildcard ensures that when a file is rotated and renamed to `production.log-YYYYMMDD-HH`, the agent continues tracking and uploading any remaining or newly generated content in that file.

Enable real-time monitoring and alerting.

Ensure logs flow through CloudWatch Logs, enabling CloudWatch metric filters and alarms.

Real-time alerts for specific error codes require log data to reside within CloudWatch Logs to trigger alarms on matched patterns.

Centralize logs cross-account securely.

Set up a subscription filter in CloudWatch Logs pointing to Kinesis Data Firehose, and grant Firehose roles cross-account permission to write to the central S3 bucket.

Kinesis Data Firehose handles high-throughput compression and delivery to S3, while cross-account IAM permissions ensure secure delivery without using overly permissive wildcard policies.

Key Concept

Continuous log ingestion with CloudWatch Agent wildcard pathing combined with cross-account centralized S3 log shipping using CloudWatch subscription filters.

Question 1034Question →

An enterprise operates a critical online transaction processing (OLTP) application on AWS. The application is deployed in a primary AWS account in the `us-east-1` Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an internal Application Load Balancer (ALB) and an Amazon Aurora MySQL Global Database with the primary cluster in `us-east-1` and a secondary cluster in `us-west-2`. The enterprise's AWS Organization includes a centralized Network Account that manages a Route 53 Private Hosted Zone (PHZ) for the application's internal domain name. A separate Shared Services Account hosts supporting microservices in a separate VPC that must access the OLTP application via its internal domain name.

The Solutions Architect must enhance the reliability and disaster recovery (DR) of the existing architecture to meet a recovery time objective (RTO) of less than 15 minutes and a recovery point objective (RPO) of less than 1 minute. The design must support manual failover to `us-west-2` without causing a split-brain scenario or routing traffic to unhealthy endpoints.

Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure Amazon Route 53 Application Recovery Controller (ARC) routing controls and safety rules for the application endpoints. During a failover event, use ARC to redirect traffic to the secondary Region and initiate an unplanned failover on the Amazon Aurora Global Database to promote the cluster in `us-west-2`.

Create a VPC association authorization in the Network Account to authorize the association of the Private Hosted Zone (PHZ) with the Shared Services Account VPC. In the Shared Services Account, associate the VPC with the PHZ to enable correct resolution of the internal application endpoints.

Configure Route 53 active-passive failover routing policies pointing to the internal Application Load Balancers. Attach standard Route 53 health checks directly to the internal ALBs, and configure the health checks to automatically trigger a failover of the Amazon Aurora Global Database primary cluster when the primary ALB becomes unhealthy.

Implement a pilot light disaster recovery strategy in `us-west-2` by keeping the secondary Aurora DB cluster in a stopped state, and use AWS CloudFormation to dynamically deploy the Application Load Balancers and Auto Scaling groups only when a regional failover is initiated.

Share the Route 53 Private Hosted Zone from the Network Account to the Shared Services Account using AWS Resource Access Manager (RAM) to automatically associate the hosted zone with the Shared Services VPC, bypassing the manual cross-account authorization flow.

Show answer & explanation

Answer: Configure Amazon Route 53 Application Recovery Controller (ARC) routing controls and safety rules for the application endpoints. During a failover event, use ARC to redirect traffic to the secondary Region and initiate an unplanned failover on the Amazon Aurora Global Database to promote the cluster in `us-west-2`.; Create a VPC association authorization in the Network Account to authorize the association of the Private Hosted Zone (PHZ) with the Shared Services Account VPC. In the Shared Services Account, associate the VPC with the PHZ to enable correct resolution of the internal application endpoints.

Answer

Configure Amazon Route 53 Application Recovery Controller (ARC) routing controls and safety rules to manage failover traffic, promote the secondary Aurora cluster via an unplanned failover, and authorize/associate the cross-account Route 53 Private Hosted Zone with the Shared Services VPC.

The solution requires configuring Route 53 Application Recovery Controller (ARC) to safely shift client traffic to the secondary Region and executing an unplanned failover of the Aurora Global Database to promote the secondary cluster. It also requires establishing cross-account private DNS resolution by creating a VPC association authorization in the Network Account and associating the Shared Services VPC with the Private Hosted Zone.

Step-by-Step Solution

Configure DNS traffic shifting using Amazon Route 53 Application Recovery Controller (ARC) and initiate unplanned failover for the database.

The application traffic can be manually redirected to the recovery region in under a minute, and the secondary Aurora DB cluster is promoted to primary with data replication intact.

Using ARC routing controls allows precise, rapid traffic shifting. Promoting the Aurora Global Database secondary cluster via unplanned failover meets the strict RTO of under 15 minutes and RPO of under 1 minute.

Generate a VPC hosted zone association authorization from the Network Account for the VPC in the Shared Services Account.

The Shared Services Account VPC is authorized to associate with the Private Hosted Zone (PHZ) hosted in the Network Account.

Route 53 Private Hosted Zones are private by default and cannot be resolved by VPCs in other accounts without explicit cross-account authorization.

Associate the Shared Services VPC with the Private Hosted Zone from the Shared Services Account.

VPC resources in the Shared Services Account can now resolve the application's internal endpoints to the local internal ALBs in both regions.

Completing the association link ensures that DNS queries for the OLTP application are routed correctly to the active regional ALBs.

Key Concept

Multi-region and multi-account disaster recovery routing requires coordinating database promotion, traffic failover mechanisms, and cross-account Private Hosted Zone association.

Estimated Time:3m 0s

Question 1035Question →

A collaborative workspace platform operates a software-as-a-service (SaaS) application that relies on an Amazon RDS for PostgreSQL database. During peak hours of collaboration, the database experiences high CPU utilization consistently exceeding $90\%$ , resulting in application latency and timeouts.

An architectural audit reveals the following details:
* $60\%$ of the database load consists of read queries fetching static document access control lists (ACLs) and workspace folder layouts.
* $25\%$ of the database load consists of write-heavy operations that set and release short-lived document session locks. These session locks are highly dynamic but must be persisted and replicated to survive an Availability Zone outage without losing the state of active user sessions.
* $15\%$ of the load consists of transient database connections opened by short-lived AWS Fargate tasks, leading to the database frequently reaching its maximum connection limits.

Which combination of actions should the Solutions Architect take to improve database and caching efficiency, reduce primary CPU utilization, and prevent connection exhaustion? (Select THREE.)

Select all that apply

Configure Amazon ElastiCache for Redis with Multi-AZ replication and auto-failover enabled, and modify the application to store active session lock states in the cache.

Configure Amazon ElastiCache for Memcached to store active session lock states, and configure auto-discovery to handle node failure and replication.

Deploy an Amazon RDS Proxy instance between the AWS Fargate tasks and the PostgreSQL database, and configure the application to connect via the proxy.

Create an Amazon RDS Read Replica for the PostgreSQL database, and update the application logic to direct the read-heavy queries for static document ACLs and folder layouts to the read replica.

Configure the application to route read-heavy queries for static document ACLs and folder layouts to the standby instance of the RDS PostgreSQL Multi-AZ deployment.

Set up an AWS Database Migration Service (DMS) replication instance with a Change Data Capture (CDC) task to replicate tables to a secondary database for read queries, leaving the source database configuration unchanged.

Show answer & explanation

Answer: Configure Amazon ElastiCache for Redis with Multi-AZ replication and auto-failover enabled, and modify the application to store active session lock states in the cache.; Deploy an Amazon RDS Proxy instance between the AWS Fargate tasks and the PostgreSQL database, and configure the application to connect via the proxy.; Create an Amazon RDS Read Replica for the PostgreSQL database, and update the application logic to direct the read-heavy queries for static document ACLs and folder layouts to the read replica.

Answer

Configure Amazon ElastiCache for Redis with Multi-AZ, deploy an Amazon RDS Proxy instance, and create an Amazon RDS Read Replica to offload read-heavy queries.

The solution requires addressing three separate performance problems. First, 60% of the read load can be offloaded by using an Amazon RDS Read Replica to serve static document ACLs and folder structures. Second, the write-heavy transient session lock states can be moved to an Amazon ElastiCache for Redis cluster configured with Multi-AZ replication to ensure the session state is preserved during node failures. Third, Amazon RDS Proxy pools connections to prevent connection exhaustion from transient AWS Fargate tasks.

Step-by-Step Solution

Identify the read-heavy component of the database workload and offload it.

60% of the queries are read-heavy and fetch static ACLs and folder layouts. An Amazon RDS Read Replica can serve these queries, relieving CPU pressure on the primary writer node.

Offloading read traffic reduces load on the primary DB instance, which directly addresses the high CPU utilization bottleneck.

Address the write-heavy transient session lock states.

Session locks require write-heavy operations but must survive Availability Zone failures. Amazon ElastiCache for Redis with Multi-AZ replication provides the required persistence and sub-millisecond latencies, offloading write operations from PostgreSQL.

Caching transient but critical data with replication requirements needs a caching engine that supports durability and high availability features.

Mitigate connection spikes from transient application tasks.

Short-lived AWS Fargate tasks create connection churn. Deploying Amazon RDS Proxy pools and shares these connections, preventing database connection exhaustion.

RDS Proxy prevents CPU and memory exhaustion caused by creating and destroying thousands of database connections.

Key Concept

Optimizing database efficiency by offloading read traffic using replicas, caching transient but persistent data with ElastiCache for Redis, and pooling connections with RDS Proxy.

Question 1036Question →

An enterprise is designing a highly resilient multi-Region AWS network architecture for a new financial application. The workload is deployed in the $us-east-1$ and $us-west-2$ Regions across multiple spoke VPCs, including vpc-us-east-prod-1, vpc-us-east-prod-2, and vpc-us-west-prod-1. The architecture must satisfy the following requirements:
- Establish dedicated, high-speed private connections to an on-premises data center with automatic failover.
- Provide highly available outbound internet access for all application instances in the private subnets, resilient to Availability Zone (AZ) failures.
- Resolve hostnames in a Route 53 Private Hosted Zone (PHZ) named corp.internal (hosted in a central shared services account) across all spoke VPCs in both Regions.
- Enable secure inter-Region VPC communication.

Which of the following designs meets these requirements while minimizing single points of failure and adhering to AWS networking best practices?

Deploy tgw-us-east-1 and tgw-us-west-2, peer them, and attach the local spoke VPCs. Associate dxgw-global-prod with both Transit Gateways. In each spoke VPC, deploy a NAT Gateway in every Availability Zone. In the central shared services account, create a Route 53 inbound Resolver endpoint. In all spoke VPCs, configure Route 53 Resolver forwarding rules for corp.internal pointing to this inbound resolver endpoint, without associating the private hosted zone with the spoke VPCs.

Deploy tgw-us-east-1 and tgw-us-west-2, peer them, and attach the local spoke VPCs. Associate dxgw-global-prod with both Transit Gateways. To optimize costs while maintaining egress, deploy a single NAT Gateway in vpc-us-east-prod-1 and configure the Transit Gateway route tables to route all outbound internet traffic from vpc-us-east-prod-2 and vpc-us-west-prod-1 to this central NAT Gateway. Associate the Private Hosted Zone corp.internal with all spoke VPCs.

Deploy tgw-us-east-1 and tgw-us-west-2, peer them, and attach the local spoke VPCs. Associate dxgw-global-prod with both Transit Gateways. In each spoke VPC, deploy a NAT Gateway in every Availability Zone, routing outbound internet traffic to the local NAT Gateway. Submit a cross-account authorization to associate the Private Hosted Zone corp.internal from the shared services account directly with each spoke VPC. In the Transit Gateway route tables, configure local routing preferences to ensure primary traffic to on-premises uses the local Direct Connect connection, failing over to the peered Transit Gateway connection if needed.

Deploy tgw-us-east-1 and tgw-us-west-2 and attach the local spoke VPCs. Associate dxgw-global-prod with both Transit Gateways. Rely on the Direct Connect Gateway to route inter-Region traffic between the spoke VPCs in us-east-1 and us-west-2. In each spoke VPC, deploy a NAT Gateway in every Availability Zone for internet egress. Authorize and associate the Private Hosted Zone corp.internal with all spoke VPCs.

Show answer & explanation

Answer: Deploy tgw-us-east-1 and tgw-us-west-2, peer them, and attach the local spoke VPCs. Associate dxgw-global-prod with both Transit Gateways. In each spoke VPC, deploy a NAT Gateway in every Availability Zone, routing outbound internet traffic to the local NAT Gateway. Submit a cross-account authorization to associate the Private Hosted Zone corp.internal from the shared services account directly with each spoke VPC. In the Transit Gateway route tables, configure local routing preferences to ensure primary traffic to on-premises uses the local Direct Connect connection, failing over to the peered Transit Gateway connection if needed.

Answer

The correct design utilizes peered Transit Gateways in both Regions to facilitate secure inter-Region VPC communication. It attaches a single global Direct Connect Gateway to both Transit Gateways to provide private connectivity to the on-premises data center. For high availability of outbound internet access, NAT Gateways must be deployed in every Availability Zone of each spoke VPC, ensuring AZ failure doesn't disrupt egress traffic. For DNS resolution, a cross-account authorization and subsequent association of the Private Hosted Zone with the spoke VPCs is the native and correct way to resolve the private zone across multiple VPCs without introducing routing loops.

The correct option provides a highly available egress design by placing NAT Gateways in every Availability Zone of each spoke VPC. It properly routes inter-Region VPC traffic through peered Transit Gateways rather than assuming Direct Connect Gateway is transitive. Additionally, it natively and securely associates the Route 53 Private Hosted Zone across accounts/Regions using cross-account authorization instead of creating DNS forwarding loops.

Step-by-Step Solution

Analyze inter-Region VPC-to-VPC communication requirements.

Peering tgw-us-east-1 and tgw-us-west-2 is required because Direct Connect Gateways do not support transitive routing between attached Transit Gateways.

Ensure that communication between Regions does not rely on unsupported paths.

Evaluate high availability for outbound internet egress.

Each spoke VPC must have a NAT Gateway deployed in every Availability Zone where workloads reside, and route tables must map local private subnets to their respective local NAT Gateway.

Avoid single points of failure (SPOF) associated with deploying a single NAT Gateway in a single AZ.

Address multi-account Private Hosted Zone (PHZ) DNS resolution.

Submit a Route 53 Private Hosted Zone association authorization from the shared services account to the spoke accounts, and then associate the PHZ corp.internal with the spoke VPCs.

Avoid using Resolver endpoints for forwarding rules of the same zone back to another VPC, which can create loop issues and is an architectural anti-pattern.

Key Concept

Hybrid and multi-Region AWS network architecture design integrating Transit Gateway peering, Direct Connect Gateway limitations, NAT Gateway high availability, and cross-account Route 53 Private Hosted Zone associations.

Estimated Time:3m 0s

Question 1037Question →

A pharmaceutical company is launching a clinical trials data repository in AWS Account A, which is part of an AWS Organizations organization. An external research organization runs a data ingestion application on Amazon EC2 instances in AWS Account B, which is outside the company's AWS Organizations organization. The application uses the IAM role 'arn:aws:iam::222222222222:role/ResearchAppRole' to write raw patient telemetry files to an Amazon S3 bucket in Account A and read consolidated trial results. All data in the S3 bucket must be encrypted at rest using a customer managed key in AWS Key Management Service (AWS KMS). The company requires that the external role can upload and retrieve files but is strictly prohibited from deleting any files or modifying the bucket configuration. Which two configuration steps must the solutions architect implement in Account A to meet these security and encryption requirements? (Select TWO.)

Select all that apply

In Account A, configure the S3 bucket policy to allow the principal 'arn:aws:iam::222222222222:role/ResearchAppRole' to perform 's3:PutObject' and 's3:GetObject' actions.

In Account A, configure the key policy of the KMS customer managed key to allow the principal 'arn:aws:iam::222222222222:role/ResearchAppRole' to perform 'kms:GenerateDataKey' and 'kms:Decrypt' actions.

In Account A, encrypt the S3 bucket using the AWS-managed KMS key for Amazon S3 ('aws/s3'), and configure the bucket policy to allow access to the external role.

In Account A, attach a Service Control Policy (SCP) to the member account that explicitly grants the external role 'arn:aws:iam::222222222222:role/ResearchAppRole' permissions to perform 's3:PutObject' and 's3:GetObject'.

In Account A, configure the S3 bucket policy to trust the root account principal 'arn:aws:iam::222222222222:root' for all S3 actions, and configure the KMS key policy to allow access from all principals within the organization.

Show answer & explanation

Answer: In Account A, configure the S3 bucket policy to allow the principal 'arn:aws:iam::222222222222:role/ResearchAppRole' to perform 's3:PutObject' and 's3:GetObject' actions.; In Account A, configure the key policy of the KMS customer managed key to allow the principal 'arn:aws:iam::222222222222:role/ResearchAppRole' to perform 'kms:GenerateDataKey' and 'kms:Decrypt' actions.

Answer

In Account A, configure the S3 bucket policy to allow the principal 'arn:aws:iam::222222222222:role/ResearchAppRole' to perform 's3:PutObject' and 's3:GetObject' actions, and configure the key policy of the KMS customer managed key to allow the same principal to perform 'kms:GenerateDataKey' and 'kms:Decrypt' actions.

To set up secure cross-account read and write access to an S3 bucket encrypted with a customer managed key, the hosting account must configure both the bucket policy and the KMS key policy. The S3 bucket policy must allow the specific IAM role from the external account to perform 's3:PutObject' and 's3:GetObject'. Additionally, because the S3 bucket is encrypted with a KMS customer managed key, the KMS key policy must allow the external IAM role to perform 'kms:GenerateDataKey' (required to write encrypted objects) and 'kms:Decrypt' (required to read encrypted objects).

Step-by-Step Solution

Identify key requirements for cross-account S3 and KMS access.

The external principal is an IAM role in Account B, and the S3 bucket and KMS CMK are in Account A.

Understanding the boundary helps determine that cross-account access requires explicit resource-based policies in the hosting account (Account A).

Configure the S3 bucket policy in Account A.

The bucket policy must explicitly grant the IAM role 'arn:aws:iam::222222222222:role/ResearchAppRole' permissions for 's3:PutObject' and 's3:GetObject', without granting delete or write bucket configuration privileges.

S3 cross-account access requires the resource owner (Account A) to delegate access to the external identity.

Configure the KMS key policy in Account A.

The KMS customer managed key policy must grant the external IAM role permissions for 'kms:GenerateDataKey' and 'kms:Decrypt'.

Since the bucket is encrypted with a customer managed key, the external caller must have permissions to generate data keys for encryption (writes) and decrypt the objects (reads).

Verify encryption key constraints.

Confirm that an AWS managed key ('aws/s3') cannot be used since its policy cannot be modified to grant cross-account permissions.

AWS-managed KMS keys are restricted to the local account and cannot be delegated cross-account.

Key Concept

Cross-account resource access delegation using S3 bucket policies and KMS key policies for Customer Managed Keys.

Question 1038Question →

A retail corporation runs a transaction processing application on Amazon EC2 instances in an application AWS account. The application must archive transaction logs to an Amazon S3 bucket located in a centralized compliance AWS account. The compliance team requires that all logs are encrypted at rest using AWS Key Management Service (AWS KMS). The solutions architect configures default bucket encryption using the AWS-managed key for Amazon S3 (aws/s3). When the application tries to upload objects to the archive bucket, it receives access denied errors. How should the solutions architect resolve this issue to allow the application to archive logs securely?

Modify the key policy of the AWS-managed key aws/s3 in the compliance account to add the application's IAM role from the application account as a key user.

Create a Service Control Policy (SCP) in AWS Organizations that allows the kms:GenerateDataKey action for the application's IAM role, and attach it to the organizational unit containing both accounts.

Configure the S3 bucket in the compliance account to use a customer managed key. Update the customer managed key's policy in the compliance account to grant the application's IAM role permission to generate data keys.

Update the S3 bucket policy in the compliance account to delegate decryption and encryption permissions for the AWS-managed key aws/s3 to the application account's root principal.

Show answer & explanation

Answer: Configure the S3 bucket in the compliance account to use a customer managed key. Update the customer managed key's policy in the compliance account to grant the application's IAM role permission to generate data keys.

Answer

Configure the S3 bucket in the compliance account to use a customer managed key and update its key policy to grant the application's IAM role permission to generate data keys.

To resolve the cross-account encryption issue, the S3 bucket must use a Customer Managed Key (CMK) instead of the default AWS-managed key. Because key policies of AWS-managed keys cannot be altered, they cannot be shared across accounts. A customer managed key allows the destination account owner to edit the key policy, granting the application's IAM role in the source account the necessary permissions to generate data keys and encrypt objects during upload.

Step-by-Step Solution

Analyze the cause of the upload failure under cross-account S3 KMS encryption.

The application's IAM role lacks permission to use the KMS key defined for S3 default encryption.

By default, the bucket was configured with the AWS-managed key (aws/s3), which cannot be shared cross-account because its key policy cannot be modified.

Select the correct key type to allow cross-account access.

A Customer Managed Key (CMK) is created in the compliance account.

Customer managed keys allow policy modification, enabling the resource owner to grant usage permissions to identities in external AWS accounts.

Grant the application's IAM role the required KMS permissions.

The customer managed key policy is updated to allow the application's IAM role to perform kms:GenerateDataKey and kms:Decrypt.

When writing to an S3 bucket encrypted with SSE-KMS, the caller must have permission to generate data keys from the KMS key to encrypt the object.

Key Concept

Cross-account AWS KMS key policy delegation for Amazon S3 SSE-KMS encryption.

Question 1039Question →

An enterprise is building a centralized compliance monitoring platform. A scanning application runs on Amazon ECS tasks in a dedicated Security Operations account (Account ID: 111122223333). The ECS tasks are configured to use the task role arn:aws:iam::111122223333:role/SecurityScannerRole. The scanning application must retrieve and analyze configuration audit logs stored in an Amazon S3 bucket in a Production member account (Account ID: 444455556666). The audit logs are encrypted at rest using a Customer Managed Key (CMK) in AWS KMS located in Account ID 444455556666. A Service Control Policy (SCP) is applied at the root of the AWS Organization that allows S3 and KMS actions. Which combination of actions must the Solutions Architect take to enable the scanning application to access and decrypt the audit logs? (Select TWO.)

Select all that apply

In the Production member account, modify the S3 bucket policy to allow the SecurityScannerRole IAM role to perform the s3:GetObject and s3:ListBucket actions, and modify the KMS key policy of the CMK to grant the SecurityScannerRole IAM role permissions to perform the kms:Decrypt and kms:DescribeKey actions.

In the Security Operations account, attach an IAM policy to the SecurityScannerRole IAM role that grants permissions to perform the s3:GetObject and s3:ListBucket actions on the S3 bucket in the Production account, and the kms:Decrypt and kms:DescribeKey actions on the KMS CMK in the Production account.

In the Production member account, re-encrypt the logs using the default AWS-managed key for Amazon S3 (aws/s3) and modify the key policy of aws/s3 to delegate decrypt permissions to the Security Operations account.

In the organization's management account, attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Production account that explicitly grants the SecurityScannerRole IAM role permissions to perform the s3:GetObject and kms:Decrypt actions.

In the Production member account, configure the trust policy of the KMS CMK to trust the Security Operations account's SAML identity provider using the sts:AssumeRoleWithSAML action to authorize cross-account decryption requests.

Show answer & explanation

Answer: In the Production member account, modify the S3 bucket policy to allow the SecurityScannerRole IAM role to perform the s3:GetObject and s3:ListBucket actions, and modify the KMS key policy of the CMK to grant the SecurityScannerRole IAM role permissions to perform the kms:Decrypt and kms:DescribeKey actions.; In the Security Operations account, attach an IAM policy to the SecurityScannerRole IAM role that grants permissions to perform the s3:GetObject and s3:ListBucket actions on the S3 bucket in the Production account, and the kms:Decrypt and kms:DescribeKey actions on the KMS CMK in the Production account.

Answer

Configure the S3 bucket policy and KMS CMK key policy in the Production account to trust the SecurityScannerRole principal, and attach an IAM policy to the SecurityScannerRole in the Security Operations account allowing access to the external S3 bucket and KMS CMK resources.

To enable cross-account access to S3 objects encrypted with a Customer Managed Key (CMK), permissions must be allowed on both the caller side and the resource side. The option to configure the S3 bucket policy and the KMS key policy in the target Production account is correct because it establishes trust for the cross-account principal. The option to attach an IAM policy to the SecurityScannerRole in the Security Operations account is correct because it authorizes the role to make calls to external S3 and KMS resources.

Step-by-Step Solution

Examine resource-side encryption requirements

Identify that the S3 objects are encrypted with a Customer Managed Key (CMK) in the Production account, meaning both S3 bucket access and KMS decryption permission must be established.

When objects in S3 are encrypted with a CMK, cross-account access requires permissions for both the S3 APIs and the KMS decryption APIs.

Configure Production account resource policies

Add the SecurityScannerRole ARN to the S3 bucket policy (allowing s3:GetObject and s3:ListBucket) and to the KMS CMK key policy (allowing kms:Decrypt and kms:DescribeKey).

Since the caller is in another account, the target account's resource policies must explicitly trust the external IAM principal.

Configure Security Operations account IAM role policy

Attach an IAM policy to the SecurityScannerRole allowing s3:GetObject and s3:ListBucket on the external bucket, and kms:Decrypt and kms:DescribeKey on the external CMK.

An IAM role cannot interact with resources in external accounts unless its own account's IAM policy permits the cross-account call.

Key Concept

Cross-account access to encrypted S3 resources requires resource policies in the destination account (S3 bucket policy and KMS key policy) to trust the source principal, and the source principal's IAM policy to permit the external requests. AWS-managed keys cannot be shared cross-account.

Question 1040Question →

An enterprise operates a payment processing platform deployed on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in an AWS Organization. The application on each instance writes transaction and error logs to a local file path `/var/log/payment/app.log`. These logs are rotated hourly and renamed to `/var/log/payment/app.log.YYYY-MM-DD-HH` via a local cron job. The enterprise requires a centralized, secure logging solution to stream these logs to a single Amazon S3 bucket in a dedicated Security Account. The solution must ensure that no log entries are lost during log rotation, all log data is encrypted at rest using a customer managed key (CMK) in AWS KMS, and the architecture adheres to the principle of least privilege. Which two actions should the Solutions Architect take to satisfy these requirements? (Select TWO.)

Select all that apply

Configure the Unified CloudWatch Agent on the EC2 instances. In the agent configuration JSON file, specify `/var/log/payment/app.log*` in the `file_path` field under the `logs` section.

In the Security Account, create a cross-account CloudWatch Logs destination pointing to an Amazon Kinesis Data Firehose delivery stream that writes to the destination S3 bucket. In the member accounts, create CloudWatch Logs subscription filters that point to the Security Account's destination ARN.

Configure the Unified CloudWatch Agent on the EC2 instances. In the agent configuration JSON file, specify `/var/log/payment/app.log` in the `file_path` field under the `logs` section, as the agent automatically detects log rotation and follows the renamed files via inode tracking.

In each member account, create an Amazon Kinesis Data Firehose delivery stream that writes directly to the central S3 bucket in the Security Account. Encrypt the S3 bucket using the default AWS-managed key (`aws/s3`) and configure the S3 bucket policy to allow the member accounts' Firehose IAM roles to perform `s3:PutObject`.

In the Security Account, create an Amazon S3 bucket and configure its bucket policy to allow `s3:PutObject` and `kms:GenerateDataKey` permissions for the root principal of the AWS Organization. Configure the CloudWatch agent on the EC2 instances to write log data directly to the S3 bucket using custom log destinations.

Show answer & explanation

Answer: Configure the Unified CloudWatch Agent on the EC2 instances. In the agent configuration JSON file, specify `/var/log/payment/app.log*` in the `file_path` field under the `logs` section.; In the Security Account, create a cross-account CloudWatch Logs destination pointing to an Amazon Kinesis Data Firehose delivery stream that writes to the destination S3 bucket. In the member accounts, create CloudWatch Logs subscription filters that point to the Security Account's destination ARN.

Answer

Configure the Unified CloudWatch Agent to monitor the wildcard log path `/var/log/payment/app.log*`, and set up a cross-account CloudWatch Logs destination in the Security Account targeting Kinesis Data Firehose, with subscription filters in the member accounts streaming to it.

To satisfy the logging and operational requirements, the CloudWatch Agent must be configured with the wildcard pattern `/var/log/payment/app.log*`. This ensures that during hourly rotation, the agent continues tracking the renamed file until all entries are ingested, avoiding log loss. Centralizing the logs is best achieved by establishing a cross-account CloudWatch Logs destination in the Security Account, backed by Kinesis Data Firehose which writes to the S3 bucket. This pattern delegates cross-account log ingestion via CloudWatch service-to-service communication, simplifying IAM policy management. Because Kinesis Data Firehose runs in the Security Account, it writes to the local S3 bucket, ensuring the Security Account owns the objects and can use a Customer Managed Key (CMK) for encryption.

Step-by-Step Solution

Analyze log rotation behavior and configure the CloudWatch Agent path pattern.

The agent must be configured with a wildcard pattern (`/var/log/payment/app.log*`) to ensure that logs rotated and renamed hourly are fully read and ingested even after the active log file is renamed.

If only the static path `/var/log/payment/app.log` is used, the agent will instantly switch to the new empty file on rotation, potentially leaving unread data in the renamed file.

Determine the cross-account logging delivery architecture.

Create a centralized CloudWatch Logs destination in the Security Account that points to a local Kinesis Data Firehose stream, and configure subscription filters in the member accounts' log groups to stream to this destination.

This setup allows secure, scalable cross-account streaming of CloudWatch Logs to a central account without managing complex cross-account S3 bucket writes or cross-account KMS key policies for Kinesis Data Firehose.

Validate security requirements (KMS key policy and bucket policy).

Create a Customer Managed Key (CMK) in the Security Account, configure its policy to allow the Security Account's Firehose IAM role to generate data keys and decrypt, and grant the Firehose role permission to write to the central S3 bucket.

AWS-managed KMS keys (such as `aws/s3`) do not support policy modification and cannot be shared across accounts, meaning they cannot be used if member accounts directly write to S3, but by utilizing Firehose in the Security Account, a Customer Managed Key can be easily scoped to the local Firehose role.

Key Concept

Centralizing cross-account logs securely using CloudWatch Logs destinations, Kinesis Data Firehose, and proper CloudWatch Agent wildcard paths for rotated logs.

PreviousPage 52 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept