All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

An enterprise e-commerce application runs on a fleet of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application utilizes a Multi-AZ Amazon RDS for PostgreSQL database for transactional data. During a flash sale event, users experience slow page load times. Monitoring tools show that EC2 CPU utilization remains under $40\%$ , but the RDS database experiences high read latency and the read I/O operations per second (IOPS) capacity is exhausted. The read queries are non-blocking and can tolerate up to $10$ seconds of replication lag. Which of the following solutions is the most effective way to optimize the performance of this database tier?

Deploy Amazon RDS PostgreSQL Read Replicas, configure the application to route read queries to the replica endpoints, and upgrade the primary database storage from gp2 to gp3 with higher provisioned IOPS.

Enable read access on the existing Multi-AZ standby instance, and configure the application to distribute read queries between the primary DB instance and the standby DB instance.

Contact AWS Support to pre-warm the Application Load Balancer to handle the peak request rate, and configure the database connection pool on the EC2 instances to use a larger maximum connection limit.

Modify the EC2 Auto Scaling group configuration to reduce the cooldown period to

10

seconds, allowing the EC2 instances to scale out rapidly and distribute the database query load across more nodes.

Show answer & explanation

Answer: Deploy Amazon RDS PostgreSQL Read Replicas, configure the application to route read queries to the replica endpoints, and upgrade the primary database storage from gp2 to gp3 with higher provisioned IOPS.

Answer

The correct solution optimizes the database performance by utilizing Read Replicas to offload read queries, which is viable due to the application's tolerance for replication lag. Additionally, upgrading the database storage to gp3 enables provisioning higher IOPS independently of storage size, resolving the database storage I/O bottleneck.

Step-by-Step Solution

Analyze the metrics and identify the bottleneck.

EC2 CPU is low (under

40\%

), but the database tier is experiencing read I/O exhaustion and high latency.

This determines that the optimization efforts must target the database storage and read capability rather than the compute scaling of the web tier.

Select the correct mechanism for scaling database reads.

Determine that Amazon RDS Read Replicas are needed to handle read query routing since the application can tolerate replication lag.

Standard RDS Multi-AZ standby instances cannot serve read traffic, making read replicas the correct approach for horizontal scaling.

Optimize database storage I/O performance.

Upgrade the primary database storage to gp3 and provision higher IOPS.

gp3 volumes allow independent scaling of IOPS and throughput, removing the I/O capacity bottleneck cost-effectively.

Key Concept

Scaling read capacity with RDS Read Replicas and optimizing storage I/O using gp3 storage volumes.

Question 1042Question →

An enterprise operates a financial transaction auditing application deployed on a fleet of Amazon EC2 instances. The application writes security-sensitive transaction logs to `/var/log/audit/transactions.log`. A local utility rotates these logs hourly by renaming the active log file to `transactions.log.YYYY-MM-DD-HH` and creating a new empty `transactions.log` file. The Unified CloudWatch Agent is installed on each EC2 instance and is configured to stream these logs to a central Amazon CloudWatch Logs log group in the application account.

A subscription filter on the CloudWatch log group forwards all incoming log events to an Amazon Kinesis Data Firehose delivery stream. This stream is responsible for delivering the logs to an Amazon S3 bucket located in a centralized Logging AWS account for long-term retention and compliance audits.

During a post-deployment verification phase, the solutions architect identifies two distinct operational issues:
1. Log ingestion from the EC2 instances halts within the first hour of log rotation and does not resume automatically.
2. The Kinesis Data Firehose delivery stream fails to write any records to the centralized S3 bucket in the Logging account.

Which combination of actions will resolve both issues while adhering to the principle of least privilege?

Modify the Unified CloudWatch Agent configuration file on the EC2 instances to use the static path `/var/log/audit/transactions.log`, and configure a cron job to restart the agent service immediately after each hourly log rotation. In the Logging AWS account, modify the Amazon S3 bucket policy to grant `s3:PutObject` permissions to the IAM role assumed by the Kinesis Data Firehose delivery stream, without using a canned ACL.

Update the Unified CloudWatch Agent configuration file on the EC2 instances to set the `file_path` parameter to `/var/log/audit/transactions.log*`. In the Logging AWS account, modify the destination Amazon S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the root principal of the application account (`arn:aws:iam::Application-Account-ID:root`), allowing Kinesis Data Firehose to write to the bucket by inheriting these permissions.

Update the Unified CloudWatch Agent configuration file on the EC2 instances to set the `file_path` parameter to `/var/log/audit/transactions.log*`. In the Logging AWS account, modify the destination Amazon S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the specific IAM role assumed by the Kinesis Data Firehose delivery stream, and configure the Kinesis Data Firehose stream to write objects using the `bucket-owner-full-control` canned ACL.

Modify the Unified CloudWatch Agent configuration file on the EC2 instances to use the static path `/var/log/audit/transactions.log`. In the Logging AWS account, configure the destination Amazon S3 bucket policy to grant the AWS service principal `firehose.amazonaws.com` permissions to perform `s3:PutObject` operations on the bucket without specifying any IAM role or account condition.

Show answer & explanation

Answer: Update the Unified CloudWatch Agent configuration file on the EC2 instances to set the `file_path` parameter to `/var/log/audit/transactions.log*`. In the Logging AWS account, modify the destination Amazon S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the specific IAM role assumed by the Kinesis Data Firehose delivery stream, and configure the Kinesis Data Firehose stream to write objects using the `bucket-owner-full-control` canned ACL.

Answer

Use a wildcard path in the CloudWatch Agent configuration to monitor rotated log files, grant S3 permissions to the specific Kinesis Data Firehose IAM role in the bucket policy, and configure the stream with the bucket-owner-full-control canned ACL.

The correct solution uses a wildcard pattern in the CloudWatch Agent configuration to monitor rotated log files natively. For cross-account S3 delivery, Kinesis Data Firehose must assume an IAM role that is explicitly granted permissions in the destination S3 bucket policy. The bucket policy must allow both the `s3:PutObject` and `s3:PutObjectAcl` actions. Additionally, Kinesis Data Firehose must be configured with the `bucket-owner-full-control` canned ACL so that the destination Logging account becomes the owner of the written log files.

Step-by-Step Solution

Update the CloudWatch Agent's configuration file on the EC2 instances.

The `file_path` parameter is set to `/var/log/audit/transactions.log*` instead of a static path.

This allows the agent to continuously monitor the active file and recognize rotated log files (e.g., `transactions.log.2026-07-16-11`) without requiring a service restart.

Configure cross-account permissions on the Logging account's S3 bucket policy.

A policy is attached to the bucket that explicitly allows the `s3:PutObject` and `s3:PutObjectAcl` actions for the Kinesis Data Firehose IAM role ARN from the application account.

Kinesis Data Firehose uses its configured IAM role to write to the destination S3 bucket. The bucket policy must explicitly trust this role to authorize the cross-account write.

Enable the `bucket-owner-full-control` canned ACL on the Kinesis Data Firehose stream configuration.

Firehose writes objects with metadata specifying that the bucket owner has full control.

Without this ACL, the application account remains the owner of the uploaded log objects, preventing the destination logging account from viewing or managing them.

Key Concept

Implementing robust cross-account log aggregation with Kinesis Data Firehose and managing CloudWatch agent configuration for rotated log files.

Question 1043Question →

A global advertising technology (ad-tech) company runs a real-time bidding platform that stores user profile segments in Amazon DynamoDB. During high-traffic campaigns, the DynamoDB tables experience significant read throttling despite having DynamoDB Auto Scaling enabled. The application requires sub-millisecond response times for segment lookups to meet bidding window SLA limits. The architecture team wants to introduce a caching layer to cache the lookups. The cached user profile data must be replicated across three Availability Zones to prevent cache stampedes in case of a zone failure, support active data persistence to survive cache node restarts, and allow the application to execute atomic updates on list-based segment identifiers within the cache. Which caching strategy should the solutions architect implement to address these requirements?

Implement Amazon ElastiCache for Memcached with nodes distributed across three Availability Zones, enabling automatic failover and configuring regular snapshots of the cache nodes to Amazon S3 for data persistence.

Implement Amazon ElastiCache for Redis with cluster mode enabled, deploying replication groups across three Availability Zones with automatic failover, and utilizing Append Only File (AOF) persistence.

Implement Amazon ElastiCache for Memcached with a multi-node cluster, configuring Auto-Discovery to handle node additions and utilizing an application-managed background process to persist cached segments to DynamoDB.

Implement Amazon ElastiCache for Memcached and configure an AWS Lambda function triggered by Amazon EventBridge to periodically dump and backup the in-memory cache data to an Amazon S3 bucket.

Show answer & explanation

Answer: Implement Amazon ElastiCache for Redis with cluster mode enabled, deploying replication groups across three Availability Zones with automatic failover, and utilizing Append Only File (AOF) persistence.

Answer

Implementing Amazon ElastiCache for Redis with cluster mode enabled meets all constraints. Redis supports multi-AZ replication with automatic failover, ensuring high availability and preventing cache stampedes. It also supports Append Only File (AOF) persistence to preserve cache state across restarts, and natively provides atomic operations on list-based segment identifiers.

Step-by-Step Solution

Analyze the technical requirements: sub-millisecond response times, Multi-AZ replication across three Availability Zones, active data persistence, and support for atomic list operations.

Identify that the solution requires a caching engine that supports advanced data structures (lists), high availability (Multi-AZ with automatic failover), and persistence mechanisms.

This narrows down the caching engine choices between ElastiCache for Memcached, ElastiCache for Redis, and DynamoDB Accelerator (DAX).

Evaluate Amazon ElastiCache for Memcached against the requirements.

Memcached is ruled out because it does not support data replication, automatic failover, persistence (snapshots/AOF), or native complex data structures like lists.

Choosing Memcached would fail the replication, persistence, and atomic list updates requirements.

Evaluate Amazon ElastiCache for Redis against the requirements.

Redis supports cluster mode enabled (which allows replication across multiple AZs and automatic failover), Append Only File (AOF) persistence for node restarts, and native list data types with atomic operations (e.g., LPUSH, RPUSH).

This matches all business and technical requirements perfectly.

Key Concept

Selecting the appropriate caching engine (Redis vs. Memcached) based on replication, persistence, and data structure requirements.

Estimated Time:3m 0s

Question 1044Question →

A healthcare provider hosts an application that stores sensitive patient records in an Amazon S3 bucket. An internal security audit reveals that the bucket does not have encryption at rest enabled and that objects can be deleted without additional verification. The security team requires that all stored data must be encrypted and that any permanent deletion of objects must require multi-factor authentication. Which of the following configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Configure default S3 server-side encryption on the bucket using a customer-managed key in AWS Key Management Service (AWS KMS).

Enable S3 Versioning on the bucket and configure MFA Delete using the AWS CLI or API with AWS account root user credentials.

Configure default encryption using the AWS-managed KMS key (aws/s3) and modify its key policy to delegate custom key rotation permissions to IAM administrators.

Implement a Service Control Policy (SCP) at the root level of the AWS Organization that grants S3 MFA delete configuration permissions to all administrative IAM users.

Apply an S3 bucket policy that permits public read access while restricting the s3:DeleteObject action to users who authenticate with an MFA-enabled IAM session.

Show answer & explanation

Answer: Configure default S3 server-side encryption on the bucket using a customer-managed key in AWS Key Management Service (AWS KMS).; Enable S3 Versioning on the bucket and configure MFA Delete using the AWS CLI or API with AWS account root user credentials.

Answer

Configure default S3 server-side encryption on the bucket using a customer-managed key in AWS Key Management Service (AWS KMS), and enable S3 Versioning on the bucket and configure MFA Delete using the AWS CLI or API with AWS account root user credentials.

Enabling server-side encryption with a Customer Managed Key ensures that data is protected at rest while allowing administrative control over the key. Enabling versioning with MFA Delete ensures that deletion of versions requires multi-factor authentication, which can only be configured using root account credentials.

Step-by-Step Solution

Select a customer-managed key in AWS KMS to enforce encryption at rest.

This provides standard default encryption capability while allowing policy customization and administrative control.

AWS-managed keys cannot be customized or shared dynamically if cross-account access is needed, unlike customer-managed keys.

Enable S3 Versioning and configure MFA Delete using AWS CLI/API.

MFA Delete requires multi-factor authentication verification to permanently delete object versions.

This directly fulfills the compliance requirement to prevent accidental or unauthorized object deletion.

Key Concept

To enhance S3 data protection, use AWS KMS customer-managed keys for flexible encryption management, and configure MFA Delete combined with S3 Versioning using root credentials to prevent unauthorized data loss.

Question 1045Question →

An enterprise is designing a highly available, multi-account network architecture in the `us-east-1` Region. The architecture consists of one Shared Services VPC in Account A and three spoke application VPCs in Account B. An AWS Transit Gateway in Account A is used to interconnect all VPCs. The spoke VPCs require private DNS resolution of the `corp.internal` domain, which is managed in a Route 53 Private Hosted Zone in Account A. Additionally, all spoke VPCs must route outbound internet traffic through a centralized set of NAT Gateways in the Shared Services VPC. Spoke-to-spoke network communication must be blocked, but spoke-to-shared communication must be allowed. The design must be resilient to Availability Zone outages and minimize operational overhead.

Which TWO steps should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure the spoke VPCs to route all DNS traffic on port

53

directly to the Transit Gateway IP address, which will automatically forward the queries to the Shared Services VPC without any Route 53 Private Hosted Zone association or Route 53 Resolver endpoints.

In the Shared Services VPC, deploy a NAT Gateway in a public subnet in each Availability Zone. In the private subnets hosting the Transit Gateway attachments, create Availability Zone-specific route tables that route

0.0.0.0/0

traffic to the NAT Gateway located in the corresponding Availability Zone.

To minimize costs, deploy a single NAT Gateway in a public subnet of one Availability Zone in the Shared Services VPC, and configure all private subnet route tables across all Availability Zones to route outbound traffic to this single NAT Gateway.

In Account A, authorize the association of the spoke VPCs with the `corp.internal` Private Hosted Zone. In Account B, associate each spoke VPC with the `corp.internal` Private Hosted Zone using the AWS CLI or Route 53 API.

Associate all spoke VPCs and the Shared Services VPC with a single Transit Gateway route table, and attach an AWS network security group directly to the Transit Gateway resource to block spoke-to-spoke traffic while permitting spoke-to-shared traffic.

Show answer & explanation

Answer: In the Shared Services VPC, deploy a NAT Gateway in a public subnet in each Availability Zone. In the private subnets hosting the Transit Gateway attachments, create Availability Zone-specific route tables that route $0.0.0.0/0$ traffic to the NAT Gateway located in the corresponding Availability Zone.; In Account A, authorize the association of the spoke VPCs with the `corp.internal` Private Hosted Zone. In Account B, associate each spoke VPC with the `corp.internal` Private Hosted Zone using the AWS CLI or Route 53 API.

Answer

Deploy a NAT Gateway in each Availability Zone in the Shared Services VPC with AZ-specific routing, and perform a cross-account association of the spoke VPCs to the Private Hosted Zone using Route 53 association authorizations.

Deploying a NAT Gateway in each Availability Zone with AZ-specific routing in the Shared Services VPC prevents a single zone outage from causing a total egress failure. Authorizing and accepting cross-account Private Hosted Zone associations allows spoke VPCs in Account B to query the shared hosted zone in Account A directly and securely without the cost and latency of Resolver endpoints.

Step-by-Step Solution

Configure cross-account Route 53 Private Hosted Zone association by running the AWS CLI command to authorize association from the owner account (Account A) to the spoke VPCs (Account B).

The spoke VPCs are authorized to associate with the hosted zone.

Allows Account B to link its spoke VPCs to Account A's hosted zone.

Associate each spoke VPC in Account B with the Private Hosted Zone using the associate-vpc-with-hosted-zone command in Account B.

The spoke VPCs can now resolve the corp.internal domain privately.

Enables local Route 53 DNS resolvers in the spoke VPCs to query the shared zone.

Deploy one NAT Gateway per Availability Zone in the public subnets of the Shared Services VPC.

Multi-AZ redundant NAT Gateways are created.

Prevents a single AZ failure from disrupting outbound internet access for all VPCs.

Configure separate route tables for each Transit Gateway attachment subnet in the Shared Services VPC, routing default traffic (0.0.0.0/0) to the local NAT Gateway in the same Availability Zone.

Outbound internet traffic is routed redundantly with AZ affinity.

Maintains Availability Zone isolation and prevents cross-AZ dependency.

Key Concept

Cross-account DNS association and multi-AZ NAT Gateway routing redundancy in Transit Gateway architectures

Question 1046Question →

A digital advertising platform operates a latency-critical ad bidding application across two VPCs in the `us-east-1` Region: `AdBiddingVPC` and `AdAnalyticsVPC`. The bidding engine running on Amazon EC2 instances in `AdBiddingVPC` needs to write real-time transactional logs to an Amazon Aurora PostgreSQL database cluster in `AdAnalyticsVPC` with a latency of less than $2\text{ ms}$ . Currently, the VPCs are connected using an AWS Transit Gateway. The database endpoint is hosted in a Route 53 Private Hosted Zone (PHZ) that is associated only with `AdAnalyticsVPC`. The bidding engine is currently experiencing latency spikes of over $15\text{ ms}$ and database connection timeouts. Network analysis shows that database DNS queries from the bidding engine resolve to a public IP address, causing the traffic to route out through a NAT Gateway in `AdBiddingVPC` and back in via the public internet. Which of the following optimization strategies should the Solutions Architect implement? (Select TWO.)

Select all that apply

Create a VPC Peering connection between AdBiddingVPC and AdAnalyticsVPC, and update the route tables to route database traffic directly through the peering connection.

Associate the Route 53 Private Hosted Zone containing the database DNS records with AdBiddingVPC.

Establish an AWS Transit Gateway peering connection between AdBiddingVPC and AdAnalyticsVPC to bypass the public internet.

Configure a secondary NAT Gateway in a different Availability Zone within AdBiddingVPC, and route the database traffic through it to the public database endpoint.

Deploy an Application Load Balancer in AdAnalyticsVPC in front of the database cluster, and request AWS Support to pre-warm the load balancer to handle peak bidding volumes.

Show answer & explanation

Answer: Create a VPC Peering connection between AdBiddingVPC and AdAnalyticsVPC, and update the route tables to route database traffic directly through the peering connection.; Associate the Route 53 Private Hosted Zone containing the database DNS records with AdBiddingVPC.

Answer

Establish a VPC Peering connection between the two VPCs to route database traffic directly, and associate the Route 53 Private Hosted Zone containing the database DNS records with the bidding VPC.

Establishing a VPC Peering connection provides a direct, high-bandwidth connection between the bidding VPC and the database VPC, satisfying the latency constraint of less than

2\text{ ms}

. Associating the Route 53 Private Hosted Zone with the bidding VPC allows the bidding instances to resolve the database's endpoint to its private IP addresses, ensuring that database traffic uses the peering connection rather than routing over the public internet through a NAT Gateway.

Step-by-Step Solution

Identify the cause of the database latency and connection timeouts.

The Route 53 Private Hosted Zone (PHZ) is only associated with the database VPC, causing the bidding VPC's DNS queries to resolve to the database's public IP address. This forces the bidding traffic out of the NAT Gateway to the public internet.

Resolving to public IP addresses prevents the traffic from staying within the AWS private network, introducing significant round-trip time (RTT) and packet loss.

Establish private DNS resolution for the bidding VPC.

Associate the database's Route 53 Private Hosted Zone with the bidding VPC.

This association ensures that the bidding engine resolves the database hostname to its private IP addresses instead of public IP addresses.

Optimize the inter-VPC network pathway for sub-millisecond latency.

Create a VPC Peering connection between the bidding VPC and the database VPC, and update the VPC route tables.

VPC Peering provides the lowest possible latency path between VPCs in the same region, bypassing the Transit Gateway processing hop and avoiding bandwidth charges.

Key Concept

Optimizing network latency and routing path efficiency between VPCs using VPC Peering and private DNS zone associations.

Question 1047Question →

An international energy conglomerate operates a real-time smart grid telemetry platform. The core processing systems run on Amazon EC2 instances in a VPC in the us-west-2 (Oregon) Region. Real-time data is sent from a centralized control center in Oslo, Norway, which is connected to AWS via a 10 Gbps AWS Direct Connect connection terminating at an AWS Direct Connect partner location in Europe. Currently, the Oslo control center accesses a staging VPC in the eu-west-1 (Ireland) Region via a Private Virtual Interface (VIF) connected to a Virtual Private Gateway (VGW). To transmit telemetry data to us-west-2, the traffic is routed from Oslo to the staging VPC in eu-west-1 over the Direct Connect link, and then forwarded to us-west-2 using an inter-region VPC Peering connection. Latency spikes and significant throughput degradation are causing telemetry data packet drops. Furthermore, on-premises systems in Oslo cannot resolve the private DNS names of the us-west-2 compute nodes, which are defined in a Route 53 Private Hosted Zone (PHZ) associated with the us-west-2 VPC. Which combination of actions should a solutions architect implement to minimize replication latency, maximize throughput, and resolve on-premises DNS queries for the private hosted zone?

Provision a Transit Virtual Interface (VIF) on the Direct Connect connection and connect it to a Direct Connect Gateway. Associate the Direct Connect Gateway with an AWS Transit Gateway in us-west-2, and attach the us-west-2 VPC to the Transit Gateway. Create Route 53 Resolver Inbound Endpoints in the us-west-2 VPC, and configure the on-premises DNS servers to conditionally forward queries for the internal domain to the Inbound Endpoint IP addresses.

Establish a Direct Connect Gateway and associate it directly with the Virtual Private Gateways (VGWs) in both eu-west-1 and us-west-2. Configure the on-premises router to route traffic destined for us-west-2 by forwarding it to the eu-west-1 VPC via the Direct Connect Gateway, allowing the Direct Connect Gateway to route the transit traffic to us-west-2. Configure Route 53 Resolver Inbound Endpoints in eu-west-1 to handle the on-premises DNS queries.

Provision a Transit Virtual Interface (VIF) on the Direct Connect connection and connect it to a Direct Connect Gateway. Associate the Direct Connect Gateway with an AWS Transit Gateway in us-west-2, and attach the us-west-2 VPC to the Transit Gateway. Create Route 53 Resolver Inbound Endpoints in the eu-west-1 VPC, and configure the on-premises DNS servers to conditionally forward queries for the internal domain to the eu-west-1 Inbound Endpoint IP addresses.

Deploy a single NAT Gateway in a single Availability Zone within the eu-west-1 VPC. Set up an AWS Site-to-Site VPN from the Oslo control center over the public internet terminating on the NAT Gateway, routing all us-west-2 traffic through it. Associate the Route 53 Private Hosted Zone in us-west-2 with the eu-west-1 VPC, and deploy Route 53 Resolver Inbound Endpoints in the eu-west-1 VPC.

Show answer & explanation

Answer: Provision a Transit Virtual Interface (VIF) on the Direct Connect connection and connect it to a Direct Connect Gateway. Associate the Direct Connect Gateway with an AWS Transit Gateway in us-west-2, and attach the us-west-2 VPC to the Transit Gateway. Create Route 53 Resolver Inbound Endpoints in the us-west-2 VPC, and configure the on-premises DNS servers to conditionally forward queries for the internal domain to the Inbound Endpoint IP addresses.

Answer

Establish a direct path to the us-west-2 Region by provisioning a Transit Virtual Interface (VIF) on the Direct Connect connection, connecting it to a Direct Connect Gateway, and associating it with an AWS Transit Gateway in us-west-2. Then, create Route 53 Resolver Inbound Endpoints in the us-west-2 VPC and configure the on-premises DNS servers to forward domain queries to those endpoints.

The correct option establishes a direct, non-transitive route to the us-west-2 Region using a Transit Virtual Interface (VIF) connected to a Direct Connect Gateway, which is associated with an AWS Transit Gateway in us-west-2. This bypasses the eu-west-1 hop and avoids the transitive routing limitations of VPC Peering. Creating Route 53 Resolver Inbound Endpoints in the us-west-2 VPC (where the Private Hosted Zone is associated) and forwarding on-premises DNS queries to these endpoints allows successful DNS resolution of private records from Oslo.

Step-by-Step Solution

Analyze the existing network topology and identify the cause of latency and replication failure.

The current path attempts to route traffic from the Oslo control center to eu-west-1 via a Direct Connect Private VIF, and then to us-west-2 using an inter-region VPC Peering connection. Because AWS VPC Peering does not support transitive routing (traffic entering a VPC from a VPN or Direct Connect cannot be routed across a VPC peering connection to another VPC), this traffic path fails, resulting in packet drops and fallback to high-latency public routes.

Understanding the transit limitations of VPC Peering is essential to design an optimized, direct routing path.

Select the optimal connectivity model to establish a direct, high-throughput, low-latency path to us-west-2.

Create a Transit VIF on the Direct Connect connection, connect it to a Direct Connect Gateway (DXGW), and associate the DXGW with an AWS Transit Gateway in the us-west-2 Region. Attach the us-west-2 VPC to this Transit Gateway.

This allows Oslo to bypass the staging VPC in eu-west-1 and directly access us-west-2 resources over the AWS global network backbone, maximizing throughput and reducing latency.

Design the hybrid DNS resolution architecture to allow on-premises systems to resolve private hosted zone domain names.

Deploy Route 53 Resolver Inbound Endpoints in the us-west-2 VPC. Since the Route 53 Private Hosted Zone (PHZ) is associated with the us-west-2 VPC, any queries arriving at these endpoints will be resolved against the PHZ.

Route 53 PHZs cannot be queried directly from on-premises over a hybrid connection without using Route 53 Resolver Inbound Endpoints.

Configure on-premises DNS forwarding.

Configure the on-premises DNS servers in Oslo to conditionally forward DNS queries for the internal domain name space to the IP addresses of the Route 53 Resolver Inbound Endpoints in us-west-2.

This ensures that internal name resolution queries are routed over the Direct Connect link to AWS, resolving successfully.

Key Concept

Transitive routing limitations of AWS VPC Peering/Direct Connect Gateway and hybrid DNS resolution using Route 53 Resolver Inbound Endpoints.

Estimated Time:3m 0s

Question 1048Question →

An online transaction processing (OLTP) system for financial ledger tracking requires a database strategy that achieves read latencies under 10 milliseconds and a near-zero Recovery Point Objective (RPO). The database workload is read-heavy with unpredictable traffic spikes. Which database architecture satisfies these criteria while dynamically scaling read capacity?

Deploy an Amazon RDS for MySQL database in a Multi-AZ deployment, and configure the client applications to direct read queries to the standby replica in the secondary Availability Zone during traffic spikes.

Deploy an Amazon Aurora MySQL DB cluster with Aurora Auto Scaling configured for Aurora Replicas to dynamically scale read capacity based on CPU utilization.

Deploy a single-node Amazon RDS for MySQL database and configure an AWS Backup plan to restore the database to another Availability Zone with an RTO of 15 minutes when a failure occurs.

Deploy an Amazon Aurora MySQL DB cluster and configure cross-account replica scaling by using the default AWS-managed KMS key (aws/rds) to share the underlying database storage volume with standby reader instances in a separate AWS account.

Show answer & explanation

Answer: Deploy an Amazon Aurora MySQL DB cluster with Aurora Auto Scaling configured for Aurora Replicas to dynamically scale read capacity based on CPU utilization.

Answer

Deploy an Amazon Aurora MySQL DB cluster with Aurora Auto Scaling configured for Aurora Replicas to dynamically scale read capacity based on CPU utilization.

The correct architecture uses an Amazon Aurora cluster with Aurora Replicas and Aurora Auto Scaling. Aurora Replicas share the same underlying storage volume as the primary instance, meaning replication lag is minimal (usually under 100 milliseconds) and reads are served with sub-10ms latency. Aurora Auto Scaling can dynamically add replicas in response to spikes in CPU utilization or connections, ensuring read capacity scales horizontally.

Step-by-Step Solution

Analyze the workload requirements: OLTP workload, low-latency reads (under 10 milliseconds), dynamic read scaling, and near-zero RPO (high availability).

Identified that the solution must support active read scaling and synchronous replication/low-latency reads.

This establishes the baseline requirements for selecting the appropriate storage/database service.

Evaluate the database engines that support horizontal read scaling and low-latency replication.

Amazon Aurora provides low-latency replica promotion (near-zero RPO) and supports up to 15 Aurora Replicas with sub-10ms replication lag that can serve read traffic.

This filters out standard Amazon RDS configurations where standby instances do not serve read traffic or do not scale dynamically.

Select the scaling mechanism that automatically responds to unpredictable read spikes.

Aurora Auto Scaling automatically adds or removes reader replicas based on metrics like average CPU utilization or average connections.

This fulfills the operational requirement for dynamic write/read scaling.

Key Concept

Amazon Aurora replication and auto-scaling capabilities for read-heavy workloads

Question 1049Question →

A financial services company is launching a secure transactional platform across two AWS accounts. An application running on Amazon ECS tasks in the Trading Account (Account ID: `123456789012`) under the IAM Role `TradingEngineRole` must write historical transaction logs to an Amazon S3 bucket located in the Audit Account (Account ID: `987654321098`). The logs must be encrypted at rest using an AWS KMS key managed by the Audit team in the Audit Account. The key policy must strictly limit access to only the `TradingEngineRole` and cannot use a wildcard (`*`) principal. Which configuration will successfully allow the application to write the encrypted logs to the S3 bucket in the Audit Account while meeting all security requirements?

Create a Customer Managed Key (CMK) in the Audit Account. Configure the KMS key policy to grant the `TradingEngineRole` ARN permissions for the `kms:GenerateDataKey` and `kms:Decrypt` actions. Configure the S3 bucket policy in the Audit Account to grant `s3:PutObject` permissions to the `TradingEngineRole` ARN. Configure the local IAM policy for the `TradingEngineRole` in the Trading Account to grant permissions for both the S3 bucket ARN and the KMS key ARN.

Use the default AWS-managed KMS key for S3 (`aws/s3`) in the Audit Account. Configure the S3 bucket policy in the Audit Account to grant `s3:PutObject` permissions to the `TradingEngineRole` ARN. Configure the local IAM policy for the `TradingEngineRole` in the Trading Account to grant `kms:GenerateDataKey` permissions for the AWS-managed key ARN and `s3:PutObject` permissions for the S3 bucket.

Create a Customer Managed Key (CMK) in the Audit Account. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Trading Account that explicitly grants the `TradingEngineRole` ARN the `kms:GenerateDataKey` and `kms:Decrypt` permissions. Configure the S3 bucket policy in the Audit Account to grant `s3:PutObject` permissions to the `TradingEngineRole` ARN. Rely on the SCP to delegate the KMS permissions without configuring a local IAM policy in the Trading Account.

Create a Customer Managed Key (CMK) in the Audit Account. Configure the KMS key policy to grant the `TradingEngineRole` ARN permissions for the `kms:GenerateDataKey` and `kms:Decrypt` actions. Configure the local IAM policy for the `TradingEngineRole` in the Trading Account to grant permissions for both the S3 bucket ARN and the KMS key ARN. Do not configure an S3 bucket policy on the Audit Account's S3 bucket, assuming that because both accounts belong to the same AWS Organization, the IAM policy is sufficient to write to the bucket.

Show answer & explanation

Answer: Create a Customer Managed Key (CMK) in the Audit Account. Configure the KMS key policy to grant the `TradingEngineRole` ARN permissions for the `kms:GenerateDataKey` and `kms:Decrypt` actions. Configure the S3 bucket policy in the Audit Account to grant `s3:PutObject` permissions to the `TradingEngineRole` ARN. Configure the local IAM policy for the `TradingEngineRole` in the Trading Account to grant permissions for both the S3 bucket ARN and the KMS key ARN.

Answer

The correct answer provides the necessary configuration for a successful cross-account encrypted upload to S3. Because the KMS key and the S3 bucket reside in the Audit Account while the writing application runs in the Trading Account, three layers of authorization are needed: the identity-based IAM policy in the Trading Account must allow access to the external resources; the KMS key policy must trust the Trading Account's IAM role; and the S3 bucket policy must trust the same IAM role. Additionally, a Customer Managed Key (CMK) is required because AWS-managed keys cannot be shared across account boundaries.

Step-by-Step Solution

Determine the type of KMS key required for cross-account S3 encryption.

Identify that a Customer Managed Key (CMK) is required because AWS-managed keys (like `aws/s3`) cannot have their key policies edited to allow access from external accounts.

AWS-managed keys have fixed key policies that cannot be modified for cross-account access.

Configure the key policy for the Customer Managed Key in the Audit Account.

Explicitly grant `kms:GenerateDataKey` and `kms:Decrypt` permissions to the specific IAM Role ARN (`arn:aws:iam::123456789012:role/TradingEngineRole`).

Cross-account KMS access requires the key policy to explicitly authorize the foreign IAM principal.

Configure the S3 bucket policy in the Audit Account.

Add a bucket policy statement allowing `s3:PutObject` with the principal set to the `TradingEngineRole` ARN.

For cross-account S3 access, the resource-based policy must explicitly authorize the external principal.

Configure the IAM policy for the role in the Trading Account.

Create a policy allowing `s3:PutObject` on the target S3 bucket ARN and `kms:GenerateDataKey` + `kms:Decrypt` on the KMS key ARN, and attach it to the `TradingEngineRole`.

Both the target resource policies (key policy and bucket policy) and the caller's identity-based policy (IAM policy) must allow the actions for cross-account access to succeed.

Key Concept

Cross-account access to S3 with KMS encryption requires explicit authorization on both the resource policies (S3 bucket policy and KMS key policy) and the identity-based policy (IAM policy) using a Customer Managed Key.

Question 1050Question →

A company is centralizing its Amazon S3 data access logs from multiple member AWS accounts into a single S3 bucket located in a dedicated security account. The security team must encrypt the centralized logs at rest using SSE-KMS to comply with internal data protection standards. The solutions architect needs to configure the encryption so that member accounts can successfully write their encrypted logs to the destination S3 bucket.

Which configuration will meet these requirements?

Create a customer managed KMS key in the security account, and configure its key policy to grant the member accounts permissions to generate data keys and decrypt.

Use the default AWS-managed KMS key for Amazon S3 (aws/s3) in the security account, and update its key policy to grant cross-account permissions to the member accounts.

Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the member accounts that grants them explicit access to the default AWS-managed S3 KMS key (aws/s3) in the security account.

Configure the S3 bucket policy in the security account to delegate KMS decryption and data key generation permissions directly to the member accounts without using a KMS key policy.

Show answer & explanation

Answer: Create a customer managed KMS key in the security account, and configure its key policy to grant the member accounts permissions to generate data keys and decrypt.

Answer

Create a customer managed KMS key in the security account, and configure its key policy to grant the member accounts permissions to generate data keys and decrypt.

To support cross-account SSE-KMS encryption for S3, a customer managed key is required because AWS-managed keys (such as aws/s3) cannot be shared across accounts. The key policy of the customer managed key must explicitly delegate access to the member accounts, allowing them to perform kms:GenerateDataKey and kms:Decrypt operations.

Step-by-Step Solution

Determine the type of KMS key needed for cross-account S3 write access.

A customer managed KMS key is selected because AWS-managed keys (such as aws/s3) cannot be shared across different AWS accounts or have their policies modified.

AWS security boundaries restrict AWS-managed KMS keys to local account usage only.

Configure the KMS key policy in the central security account.

The key policy is updated to allow member account IAM principals to call kms:GenerateDataKey and kms:Decrypt.

S3 requires both permissions to encrypt new objects upon upload and decrypt them during access or validation.

Key Concept

Cross-account KMS key sharing and policy delegation limitations

Estimated Time:1m 0s

Question 1051Question →

An enterprise is designing a new multi-account AWS environment in the us-east-1 Region. The design features a Central Services VPC (vpc-shared-services) and two application VPCs (vpc-app-a and vpc-app-b), all interconnected via an AWS Transit Gateway (tgw-central). A Route 53 Private Hosted Zone (PHZ) named corp.internal is created in vpc-shared-services. Workloads in all VPCs must be able to resolve DNS queries for corp.internal. Furthermore, workloads in the private subnets of vpc-app-a and vpc-app-b require highly available outbound internet access, while minimizing NAT Gateway deployment costs across the architecture. Which two actions should the Solutions Architect take to design a solution that meets these requirements? (Select TWO.)

Select all that apply

Associate the Route 53 Private Hosted Zone corp.internal with vpc-app-a and vpc-app-b using cross-account association authorizations.

Deploy one NAT Gateway in each of the two Availability Zones within the public subnets of vpc-shared-services, and route all internet-bound traffic from the spoke VPCs to the Transit Gateway.

Deploy a single NAT Gateway in one public subnet of vpc-shared-services to centralize internet egress and minimize NAT Gateway hourly fees.

Rely on AWS Transit Gateway's default routing behavior to automatically resolve DNS queries for corp.internal across all attached VPCs without associating the Private Hosted Zone.

Configure the Transit Gateway to perform transitive routing by pointing the default route (0.0.0.0/0) in the spoke VPCs directly to the Internet Gateway attached to vpc-shared-services.

Show answer & explanation

Answer: Associate the Route 53 Private Hosted Zone corp.internal with vpc-app-a and vpc-app-b using cross-account association authorizations.; Deploy one NAT Gateway in each of the two Availability Zones within the public subnets of vpc-shared-services, and route all internet-bound traffic from the spoke VPCs to the Transit Gateway.

Answer

Associate the Route 53 Private Hosted Zone corp.internal with the application VPCs, and deploy redundant NAT Gateways across two Availability Zones in the central services VPC to route all internet-bound traffic from the spoke VPCs.

The correct solution involves associating the Private Hosted Zone with the application VPCs using cross-account authorizations, which allows them to resolve the internal domain. It also implements highly available egress by deploying NAT Gateways in multiple Availability Zones in the central VPC and routing spoke internet traffic through them via Transit Gateway, achieving redundancy while keeping NAT Gateway costs lower than deploying them in all VPCs.

Step-by-Step Solution

Enable cross-account DNS resolution for the Private Hosted Zone.

Authorize the association of the corp.internal Private Hosted Zone in the shared services account with the application VPCs, then associate them.

This allows instances in the application VPCs to resolve internal DNS records hosted in the central VPC.

Implement a highly available egress routing architecture in the shared services VPC.

Deploy a NAT Gateway in each public subnet across two Availability Zones, and update the private route tables of the central VPC to point to their respective NAT Gateways.

This removes single points of failure for egress traffic at the Availability Zone level.

Configure spoke VPC and Transit Gateway routing.

Point the 0.0.0.0/0 route in the spoke VPC subnets to the Transit Gateway, and configure the Transit Gateway route tables to forward internet-bound traffic to the shared services VPC.

This routes all internet egress traffic centrally through the redundant NAT Gateways, reducing cost compared to deploying NAT Gateways in every VPC.

Key Concept

Centralized, highly available internet egress combined with cross-account Route 53 Private Hosted Zone association.

Question 1052Question →

An enterprise operates a multi-account, multi-region architecture on AWS to support its core application. Account A (Production) hosts the primary application resources in the us-east-1 Region inside VPC-Prod, and the disaster recovery resources in the us-west-2 Region inside VPC-DR. The database layer is an Amazon Aurora PostgreSQL Global Database, with the primary cluster in us-east-1 and a secondary cluster in us-west-2.

Account B (Shared Services) hosts a Route 53 Private Hosted Zone (PHZ) named internal.production.local that contains critical service discovery records. The application in VPC-Prod relies on these records.

During a disaster recovery drill, the Solutions Architect identifies the following issues:
1. Microservices running in VPC-DR fail to resolve the service endpoints in internal.production.local during failover tests.
2. Outbound data replication and synchronization traffic from VPC-Prod to the secondary Region in us-west-2 is routed through a single NAT Gateway located in Availability Zone us-east-1a, posing a single point of failure.

The company requires a solution that minimizes replication failure risk, maintains a target recovery time objective (RTO) of 15 minutes, and resolves the cross-account DNS resolution issues.

Which TWO actions should the Solutions Architect take to address these requirements?

Select all that apply

In Account B, authorize the VPC association of the private hosted zone internal.production.local with VPC-DR in Account A using the Route 53 API. In Account A, associate VPC-DR with the private hosted zone.

In Account A, deploy a NAT Gateway in each Availability Zone of VPC-Prod, and configure the route tables of the private subnets in each Availability Zone to direct outbound replication traffic to the local NAT Gateway in that same Availability Zone.

In Account B, configure a Route 53 Resolver outbound endpoint and a forwarding rule for the domain internal.production.local targeting the inbound endpoints of VPC-DR in Account A.

In Account A, configure the VPC route tables in VPC-Prod to route outbound traffic through a single NAT Gateway in us-east-1a, and configure a Route 53 health check that triggers an AWS Lambda function to update the route tables to point to a backup NAT Gateway in us-east-1b upon failure.

Configure AWS Backup to take continuous snapshots of the Aurora Global Database, and in the event of an outage, restore the database from the latest snapshot into VPC-DR using a Pilot Light recovery pattern.

Show answer & explanation

Answer: In Account B, authorize the VPC association of the private hosted zone internal.production.local with VPC-DR in Account A using the Route 53 API. In Account A, associate VPC-DR with the private hosted zone.; In Account A, deploy a NAT Gateway in each Availability Zone of VPC-Prod, and configure the route tables of the private subnets in each Availability Zone to direct outbound replication traffic to the local NAT Gateway in that same Availability Zone.

Answer

Associate the private hosted zone cross-account and deploy redundant NAT Gateways in each Availability Zone.

To resolve the cross-account DNS resolution issue, the private hosted zone in Account B must be associated with the recovery VPC (VPC-DR) in Account A. In AWS Route 53, cross-account association requires the hosted zone owner (Account B) to authorize the association using the Route 53 API or AWS CLI. Once authorized, the VPC owner (Account A) must complete the association. To eliminate the single point of failure for outbound replication and synchronization traffic, a NAT Gateway should be deployed in each Availability Zone where resources reside. Routing traffic from private subnets to a local NAT Gateway in the same Availability Zone ensures high availability and resilience against an Availability Zone outage.

Step-by-Step Solution

Identify the mechanism for sharing the private hosted zone (PHZ) across accounts.

Recognize that Route 53 private hosted zones require cross-account association authorization from the owner account (Account B) and then acceptance/association from the consumer account (Account A).

This resolves the DNS resolution issue for resources in VPC-DR during disaster recovery without introducing the complexity of Route 53 Resolver endpoints.

Address the single point of failure in the outbound replication path.

Deploy a NAT Gateway in each Availability Zone of VPC-Prod and update the corresponding route tables.

This ensures that traffic from private subnets in different Availability Zones flows through local NAT Gateways, maintaining high availability and preventing an AZ outage from breaking replication.

Evaluate database disaster recovery options against RTO/RPO requirements.

Determine that promoting the secondary cluster of the Aurora Global Database is the proper path for low-latency failovers, while backup restoration methods are too slow for the 15-minute RTO.

Aligns the DR strategy with the existing Aurora Global Database architecture to meet recovery objectives.

Key Concept

Multi-Region reliability requires eliminating single points of failure in the network path (redundant NAT Gateways) and ensuring correct cross-account service discovery configuration (Route 53 Private Hosted Zone cross-account association) to meet low Recovery Time Objectives (RTO).

Question 1053Question →

An enterprise operates a real-time analytics platform on AWS. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The EC2 instances process transaction payloads, download supporting assets from an Amazon EBS gp3 volume, write raw transaction logs to an Amazon S3 bucket encrypted with an AWS KMS Customer Managed Key (CMK), and write transactional records to an Amazon Aurora PostgreSQL database. During weekly flash sales, traffic abruptly spikes from 100 requests per second to over 50,000 requests per second within one minute. During these spikes, the platform experiences the following issues: the ALB drops incoming requests with 502 Bad Gateway and 504 Gateway Timeout errors; the EC2 instances experience high CPU utilization and high disk queue lengths; the Aurora database writer instance experiences CPU exhaustion, and the single reader instance experiences significant replication lag; the application logs show multiple S3 '503 SlowDown' errors and KMS 'ThrottlingException' errors. Which of the following combinations of actions will resolve these performance bottlenecks? (Select TWO.)

Select all that apply

Request ELB pre-warming from AWS Support prior to the scheduled flash events, and configure Amazon S3 Bucket Keys on the destination S3 bucket to reduce KMS cryptographic requests.

Update the EC2 launch template to use EBS-optimized compute-optimized instance types with increased gp3 IOPS and throughput, and implement Aurora Auto Scaling to dynamically add reader replicas.

Configure Application Load Balancer target tracking scaling policies based on RequestCountPerTarget to allow the load balancer to scale out automatically to handle the flash traffic spikes.

Configure the Application Load Balancer to direct database read queries to the Amazon Aurora Multi-AZ standby instance to reduce CPU utilization on the primary writer instance.

Enable EBS Multi-Attach on the gp3 volumes to share the assets folder across the EC2 instances, and create multiple KMS customer managed keys to rotate requests.

Show answer & explanation

Answer: Request ELB pre-warming from AWS Support prior to the scheduled flash events, and configure Amazon S3 Bucket Keys on the destination S3 bucket to reduce KMS cryptographic requests.; Update the EC2 launch template to use EBS-optimized compute-optimized instance types with increased gp3 IOPS and throughput, and implement Aurora Auto Scaling to dynamically add reader replicas.

Answer

Request ELB pre-warming and enable Amazon S3 Bucket Keys, while upgrading the EC2 instances to compute-optimized types with optimized gp3 storage and configuring Aurora Auto Scaling for reader replicas.

The correct combination involves requesting ELB pre-warming and enabling S3 Bucket Keys, as well as upgrading the EC2 instances to compute-optimized types with optimized gp3 storage and configuring Aurora Auto Scaling. ELB pre-warming prepares the ALB for the instantaneous flash traffic spike that normal scaling cannot match. S3 Bucket Keys drastically reduce KMS API request volumes, mitigating KMS throttling. Upgrading the EC2 instances to EBS-optimized compute instances with higher gp3 IOPS/throughput addresses compute and storage bottlenecks. Aurora Auto Scaling dynamically scales reader replicas to handle read query load and prevent replication lag.

Step-by-Step Solution

Address the immediate ALB drop rate during extreme flash spikes.

Request ELB pre-warming from AWS Support to scale the ALB nodes ahead of the scheduled event.

Standard ALB auto-scaling is reactive and cannot scale from 100 to 50,000 requests per second within a single minute, resulting in dropped requests.

Resolve S3 503 SlowDown and KMS ThrottlingException errors.

Configure Amazon S3 Bucket Keys on the destination bucket.

S3 Bucket Keys reduce the KMS API request volume by up to 99% by using a bucket-level key to derive unique keys instead of calling KMS for every individual write request.

Mitigate high CPU utilization and EBS disk queue lengths on the EC2 instances.

Upgrade EC2 instances to EBS-optimized compute-optimized instance types with increased gp3 IOPS and throughput in the launch template.

Compute-optimized instances provide the CPU power needed for ingestion and payload processing, while EBS-optimized profiles combined with provisioned IOPS/throughput prevent storage bottlenecks.

Solve Aurora database writer CPU exhaustion and reader replication lag.

Implement Aurora Auto Scaling based on CPU utilization to dynamically scale Aurora Replicas.

Aurora Replicas are active read endpoints. Dynamically adding replica instances distributes the read load away from the primary writer, preventing CPU exhaustion and reducing reader replication lag.

Key Concept

Identifying and mitigating compute, storage, and API bottlenecks during high-volume, rapid-scale traffic events on AWS.

Question 1054Question →

An enterprise operates a high-transaction e-commerce application deployed on Amazon EC2 instances in an Auto Scaling group. The application writes operational logs to `/var/log/ecommerce/transactions.log`. These logs are rotated hourly and renamed with a timestamp suffix, such as `/var/log/ecommerce/transactions.log.2026-07-16-11`. The Solutions Architect needs to implement a solution to collect these logs, ensure no data loss during rotation, and centralize them in an Amazon S3 bucket in a dedicated logging account within the AWS Organization. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure the CloudWatch agent on the EC2 instances using a configuration file that specifies the log file path as `/var/log/ecommerce/transactions.log*` to monitor both the active and rotated files.

Configure the CloudWatch agent on the EC2 instances using a configuration file that specifies the log file path statically as `/var/log/ecommerce/transactions.log` and schedule a cron job to restart the agent service hourly after rotation.

Create an Amazon Kinesis Data Firehose delivery stream in the application account to write logs to the centralized Amazon S3 bucket, and configure the destination S3 bucket policy in the logging account to grant `s3:PutObject` permissions to the Firehose IAM role ARN.

Configure the CloudWatch agent to write logs directly to the centralized Amazon S3 bucket in the logging account, and update the destination S3 bucket policy to allow the `cloudwatch.amazonaws.com` service principal to write objects.

Set up a cross-account IAM role in the application account that the logging account can assume to pull logs directly from the EC2 instance ephemeral storage using AWS Systems Manager Run Command.

Show answer & explanation

Answer: Configure the CloudWatch agent on the EC2 instances using a configuration file that specifies the log file path as `/var/log/ecommerce/transactions.log*` to monitor both the active and rotated files.; Create an Amazon Kinesis Data Firehose delivery stream in the application account to write logs to the centralized Amazon S3 bucket, and configure the destination S3 bucket policy in the logging account to grant `s3:PutObject` permissions to the Firehose IAM role ARN.

Answer

The correct configuration involves using a wildcard pattern (`/var/log/ecommerce/transactions.log*`) in the CloudWatch agent configuration to track rotated files, and creating a Kinesis Data Firehose delivery stream in the application account with a destination S3 bucket policy in the logging account that grants write permissions to the Firehose IAM role ARN.

The correct solution involves configuring the CloudWatch agent with a wildcard path (`/var/log/ecommerce/transactions.log*`) to ensure the agent monitors both the active file and any rotated log files containing timestamp suffixes. Additionally, setting up a Kinesis Data Firehose delivery stream in the source account that writes to the centralized S3 bucket in the logging account, while granting `s3:PutObject` permissions to the Firehose IAM role ARN in the destination bucket policy, ensures secure cross-account delivery.

Step-by-Step Solution

Configure the CloudWatch agent log file path.

Use a wildcard path `/var/log/ecommerce/transactions.log*` in the agent configuration.

This allows the CloudWatch agent to continue reading from rotated files that have been renamed with timestamp suffixes, ensuring no log data is lost during rotation.

Set up cross-account log delivery.

Deploy an Amazon Kinesis Data Firehose delivery stream in the source account that targets the S3 bucket in the logging account.

Firehose handles streaming data ingestion and delivers it reliably to S3. To allow cross-account delivery, the target S3 bucket policy must explicitly permit the source Firehose IAM role to write objects.

Key Concept

Continuous log ingestion with rotation handling and secure cross-account log centralization.

Question 1055Question →

An enterprise manages its application infrastructure using AWS CloudFormation StackSets deployed across multiple member accounts in an AWS Organization. A developer manually modified the configuration of an Amazon EC2 instance and its associated security groups in a member account to troubleshoot a production issue. When the administrator runs a StackSet update to deploy a new version of the infrastructure, the update fails and rolls back in that specific member account because of this configuration drift. Additionally, the StackSet template must fetch and decrypt a database password stored in a central Amazon S3 bucket in the administrator account during deployment. Which combination of steps should the Solutions Architect take to resolve the update failure, automate configuration enforcement, and securely handle parameter decryption?

Run drift detection on the StackSet to identify the drifted resources, manually update the drifted configurations to match the template or import the changes, and then re-run the StackSet update. Implement AWS Systems Manager State Manager to continuously enforce the configuration. Use the default AWS-managed KMS key (aws/s3) in the administrator account to encrypt the password, and configure the key policy to allow the member accounts' execution roles to decrypt it.

Run drift detection on the StackSet to identify the drifted resources, manually update the drifted configurations to match the template or import the changes, and then re-run the StackSet update. Implement AWS Systems Manager State Manager to continuously enforce the configuration. Use a Customer Managed Key in the administrator account, and attach a Service Control Policy (SCP) to the member accounts' Organizational Unit that grants decrypt permissions for this key.

Run drift detection on the StackSet to identify the drifted resources, manually update the drifted configurations to match the template or import the changes, and then re-run the StackSet update. Implement AWS Systems Manager State Manager to continuously enforce the configuration. Use a Customer Managed Key in the administrator account with a key policy that allows the member accounts' execution roles to decrypt the password.

Force the StackSet update using the override flag to automatically overwrite all out-of-band console changes and align them with the template. Implement AWS Systems Manager State Manager to continuously enforce the configuration. Use a Customer Managed Key in the administrator account with a key policy that allows the member accounts' execution roles to decrypt the password.

Show answer & explanation

Answer: Run drift detection on the StackSet to identify the drifted resources, manually update the drifted configurations to match the template or import the changes, and then re-run the StackSet update. Implement AWS Systems Manager State Manager to continuously enforce the configuration. Use a Customer Managed Key in the administrator account with a key policy that allows the member accounts' execution roles to decrypt the password.

Answer

The correct answer is the option that involves running drift detection, manually aligning configuration or importing changes to allow the stack update to succeed, using AWS Systems Manager State Manager for configuration enforcement, and configuring a Customer Managed Key (CMK) in the administrator account with cross-account access permissions in its key policy.

The correct answer correctly addresses all three aspects of the scenario. First, resolving configuration drift requires running drift detection and manually or programmatically updating the drifted configurations to match the template before retrying the update. Second, using AWS Systems Manager State Manager ensures ongoing configuration compliance. Third, cross-account access to encrypted parameters requires a Customer Managed Key (CMK) in the central account with a key policy explicitly granting cross-account decrypt permissions to the member account roles.

Step-by-Step Solution

Detect and resolve the configuration drift in the member account.

The local drifted resources are aligned with the CloudFormation template state, preventing update conflicts.

Out-of-band modifications cause stack updates to fail or roll back due to property mismatches.

Implement AWS Systems Manager State Manager to enforce configurations.

The EC2 instances and security groups are regularly audited and brought back to the desired state automatically.

This automates configuration management and prevents future manual configuration drift.

Configure a Customer Managed Key (CMK) in the administrator account for the S3 bucket's data decryption.

The member accounts' execution roles can successfully assume permissions to decrypt the database password using the cross-account KMS key policy.

Only Customer Managed Keys support key policy modification to delegate cross-account decryption access, which is required here.

Key Concept

Configuration drift remediation in CloudFormation StackSets combined with secure cross-account KMS decryption and configuration enforcement.

Alternative Method

Instead of manual remediation before the StackSet update, you can use AWS Config auto-remediation with Systems Manager Automation to dynamically align the drifted security group configuration, then execute the StackSet update.

Estimated Time:3m 0s

Question 1056Question →

A company runs a batch processing worker fleet of Amazon EC2 instances managed by an Auto Scaling group. The worker instances require $6$ minutes to complete their initialization and setup scripts before they are ready to process messages from an Amazon SQS queue. The current scaling policy uses a default cooldown period of $3$ minutes. During sudden message volume increases, the Auto Scaling group repeatedly launches unnecessary additional instances before the newly created instances can begin processing messages. Which change should a Solutions Architect implement to optimize the scaling behavior and prevent over-provisioning?

Increase the default cooldown period of the Auto Scaling group to at least

6

minutes to match the initialization time of the instances.

Decrease the default cooldown period of the Auto Scaling group to

1

minute to allow scaling metrics to stabilize faster.

Submit a request to AWS Support to pre-warm the fronting Application Load Balancer to absorb the sudden demand spike.

Deploy a single NAT Gateway in a public subnet to accelerate the retrieval of setup dependencies for the instances.

Show answer & explanation

Answer: Increase the default cooldown period of the Auto Scaling group to at least $6$ minutes to match the initialization time of the instances.

Answer

Increase the default cooldown period of the Auto Scaling group to at least

6

minutes to match the initialization time of the instances.

The correct option correctly identifies that the cooldown period must be at least as long as the initialization time of

6

minutes. This ensures that the Auto Scaling group does not launch additional instances in response to outdated scaling metrics while the newly launched instances are still bootstrapping.

Step-by-Step Solution

Analyze the instance bootstrapping and initialization time relative to the scaling cooldown period.

Instances require

6

minutes to initialize, while the current cooldown period is set to

3

minutes.

This shows that the cooldown period is shorter than the bootstrapping time, which is the root cause of the redundant scale-out events.

Determine the required cooldown adjustment to prevent premature scaling actions.

The cooldown period must be set to at least

6

minutes.

By ensuring the cooldown period is equal to or greater than the

6

-minute initialization time, the Auto Scaling group will not launch additional instances until the currently launching instances have started processing SQS messages and influenced the metrics.

Key Concept

Auto Scaling Cooldown Configuration

Estimated Time:1m 0s

Question 1057Question →

A media company is establishing a new environment in the ap-northeast-1 Region, consisting of two spoke VPCs (vpc-media-ingest and vpc-media-process) across two Availability Zones, and a shared services VPC (vpc-shared-core). The spoke VPCs require outbound-only internet connectivity for updates. They also need to resolve internal DNS names in a Route 53 Private Hosted Zone (media.internal) created in the shared services VPC. An AWS Transit Gateway is deployed to interconnect all three VPCs. Which configuration should the solutions architect implement to satisfy these requirements while ensuring high availability for outbound traffic?

Deploy a single NAT Gateway in one Availability Zone of the shared services VPC. In the spoke VPC route tables, point the default route to the Transit Gateway. In the Route 53 console, associate the Private Hosted Zone with the shared services VPC and both spoke VPCs.

Deploy one NAT Gateway in each Availability Zone of the shared services VPC. In the spoke VPC route tables, point the default route to the Transit Gateway. Associate the Private Hosted Zone only with the shared services VPC, relying on Transit Gateway routing to automatically resolve DNS queries from the spoke VPCs.

Deploy one NAT Gateway in each Availability Zone of the shared services VPC. In the spoke VPC route tables, point the default route to the Transit Gateway. In the Route 53 console, associate the Private Hosted Zone with the shared services VPC and both spoke VPCs.

Attach the spoke VPCs directly to a Direct Connect Gateway to enable transitive spoke-to-spoke network routing and shared internet egress via the shared services VPC, and associate the Private Hosted Zone with all VPCs.

Show answer & explanation

Answer: Deploy one NAT Gateway in each Availability Zone of the shared services VPC. In the spoke VPC route tables, point the default route to the Transit Gateway. In the Route 53 console, associate the Private Hosted Zone with the shared services VPC and both spoke VPCs.

Answer

Deploy one NAT Gateway in each Availability Zone of the shared services VPC, point the spoke VPC route tables default route to the Transit Gateway, and associate the Route 53 Private Hosted Zone with the shared services VPC and both spoke VPCs.

Deploying one NAT Gateway per Availability Zone in the shared services VPC ensures Availability Zone redundancy for outbound internet traffic. Associating the Route 53 Private Hosted Zone with all VPCs enables name resolution across the entire environment because Private Hosted Zones are not transitively resolvable across VPC associations via Transit Gateway alone. This design fully achieves high availability and correct DNS resolution.

Step-by-Step Solution

Deploy redundant NAT Gateways across Availability Zones in the shared services VPC.

High availability for outbound internet traffic is established, eliminating single points of failure.

Ensures that outbound connectivity remains operational even during an Availability Zone outage.

Associate the Route 53 Private Hosted Zone with the shared services VPC and both spoke VPCs.

Private DNS resolution for domain names under the zone is enabled for all VPCs.

Route 53 Private Hosted Zones require explicit association with each VPC that needs to resolve its resource records.

Configure the spoke VPC route tables to point outbound traffic to the Transit Gateway, and configure Transit Gateway route tables to forward that traffic to the shared services VPC.

Egress traffic from the spoke VPCs is routed to the internet through the redundant NAT Gateways.

Transit Gateway acts as the central hub to aggregate and route traffic between spoke VPCs and the shared services egress path.

Key Concept

Designing highly available centralized egress architectures and configuring cross-VPC DNS resolution using Route 53 Private Hosted Zones.

Question 1058Question →

A solutions architect is designing a document management platform. The platform must handle two storage needs: a cost-effective object storage system for storing millions of PDF files (averaging $2\text{ MB}$ to $5\text{ MB}$ in size), and a NoSQL database for metadata lookups (such as document ID, owner, and creation date) with key performance indicators of sub- $10\text{ ms}$ retrieval latency. The entire architecture must scale automatically to accommodate highly variable traffic volumes. Which two AWS storage and database configurations should the solutions architect implement to satisfy these requirements? (Select TWO.)

Select all that apply

Amazon Simple Storage Service (Amazon S3) Standard storage class to store the PDF documents.

Amazon DynamoDB with auto-scaling enabled to store and query the document metadata.

Amazon Aurora MySQL with read replicas configured for manual scaling to handle sudden metadata search spikes.

Amazon Elastic File System (Amazon EFS) with daily cross-region backup replication to achieve near-zero Recovery Time Objective (RTO) for document retrieval.

Amazon S3 bucket for documents with cross-account replication encrypted using the default AWS-managed KMS key (aws/s3).

Show answer & explanation

Answer: Amazon Simple Storage Service (Amazon S3) Standard storage class to store the PDF documents.; Amazon DynamoDB with auto-scaling enabled to store and query the document metadata.

Answer

The solutions architect should combine Amazon Simple Storage Service (Amazon S3) Standard storage class to store the PDF documents, and Amazon DynamoDB with auto-scaling enabled to store and query the document metadata.

Storing unstructured PDF files in Amazon S3 is highly cost-effective and provides the required durability. Pairing it with Amazon DynamoDB for metadata enables fast, low-latency, key-value lookups while utilizing auto-scaling to match fluctuating demand without manual intervention.

Step-by-Step Solution

Evaluate the workload type and size characteristics for the document files.

Amazon S3 Standard is selected as the object storage tier.

PDF files are unstructured objects. Amazon S3 is designed specifically for object storage, offering infinite scale and high durability at a low cost for files of this size.

Evaluate the database and performance requirements for the metadata lookup queries.

Amazon DynamoDB with auto-scaling is selected as the NoSQL database.

DynamoDB supports simple key-value lookups (such as document ID, owner, and creation date) with consistent, sub-10 millisecond latency and scales capacity automatically.

Key Concept

Selecting appropriate storage and database services based on data structure (object vs. key-value metadata), latency requirements, and automatic scaling capabilities.

Question 1059Question →

A financial services provider hosts a latency-critical trading platform in the us-east-1 Region. The architecture consists of a high-throughput compute cluster in VPC-A that queries a key-value database cluster in VPC-B. Both VPCs are connected via an AWS Transit Gateway. The database cluster utilizes a Route 53 Private Hosted Zone (PHZ) for internal endpoint resolution, which is currently associated only with VPC-B. Compute instances in VPC-A must also communicate with the internet for market data feeds, routing all outbound traffic through a single NAT Gateway located in VPC-A's public subnet.

The platform is experiencing performance bottlenecks. Inter-VPC database traffic is capped at 5 Gbps per flow, and DNS resolution failures occur frequently during market open. Furthermore, outbound internet connectivity is vulnerable to Availability Zone outages.

Which two changes should a solutions architect implement to optimize network throughput, reduce latency, and improve availability? (Select TWO.)

Select all that apply

Associate the Route 53 Private Hosted Zone with VPC-A to resolve database endpoints locally, and deploy a NAT Gateway in each Availability Zone where the compute instances are located.

Establish an AWS Direct Connect connection with a Direct Connect Gateway, and configure transitive routing between VPC-A and VPC-B through the Direct Connect Gateway to bypass Transit Gateway latency.

Request an AWS Support ticket to pre-warm the existing NAT Gateway to increase the packet processing limits and eliminate TCP flow bottlenecks during peak traffic.

Associate the Route 53 Private Hosted Zone with the Transit Gateway subnet to allow transitive DNS resolution, and route all egress traffic through the Transit Gateway to a centralized internet gateway in VPC-B.

Show answer & explanation

Answer: Establish a VPC Peering connection directly between VPC-A and VPC-B, configure the VPC route tables to route database traffic over the peering connection, and ensure MTU is configured for Jumbo Frames (9001 bytes) on both sides.; Associate the Route 53 Private Hosted Zone with VPC-A to resolve database endpoints locally, and deploy a NAT Gateway in each Availability Zone where the compute instances are located.

Answer

Establish a VPC Peering connection directly between VPC-A and VPC-B, configure the VPC route tables to route database traffic over the peering connection, and ensure MTU is configured for Jumbo Frames (9001 bytes) on both sides; and associate the Route 53 Private Hosted Zone with VPC-A to resolve database endpoints locally, and deploy a NAT Gateway in each Availability Zone where the compute instances are located.

To optimize inter-VPC latency and throughput, establishing a VPC Peering connection directly between VPC-A and VPC-B bypasses the Transit Gateway's intermediate hop and allows the use of Jumbo Frames (MTU 9001) for high-performance network paths. To fix DNS resolution, the Route 53 Private Hosted Zone must be associated directly with VPC-A. High availability and localized routing for internet egress are achieved by deploying a NAT Gateway in each Availability Zone.

Step-by-Step Solution

Analyze the inter-VPC latency and throughput constraints.

Identified that AWS Transit Gateway introduces an extra processing hop compared to direct VPC Peering. Single-flow TCP bandwidth over Transit Gateway is capped at 10 Gbps, and default paths may not exploit Jumbo Frames.

VPC Peering provides direct, single-hop communication with support for Jumbo Frames (9001 MTU) within the same region, reducing latency and throughput constraints.

Address the DNS resolution failures for VPC-A.

Determined that the Route 53 Private Hosted Zone (PHZ) created in the database account must be explicitly associated with VPC-A.

By default, a PHZ is only queryable by resources in the associated VPCs. Cross-account or cross-VPC association is required for VPC-A to resolve endpoints hosted in the PHZ.

Resolve the egress network resiliency bottleneck.

Deploying a NAT Gateway in each Availability Zone where the compute resources are hosted, and updating the subnet routing tables.

A single NAT Gateway creates a single point of failure if its Availability Zone goes down. Utilizing an AZ-specific NAT Gateway guarantees localized fault tolerance and high availability.

Key Concept

Optimizing network performance involves bypassing unnecessary network hops using VPC Peering, enabling Jumbo Frames (MTU 9001) for internal high-throughput paths, and resolving DNS and egress paths natively and redundantly within each VPC and Availability Zone.

Question 1060Question →

An enterprise runs a fleet of Amazon EC2 instances in multiple production AWS accounts. The instances host a telemetry processing application that writes logs to `/var/log/telemetry/telemetry.log`. These logs undergo hourly rotation and are renamed with a timestamp suffix (for example, `/var/log/telemetry/telemetry.log.20260716-11`). The company wants to centralize these logs in an Amazon S3 bucket inside a dedicated monitoring account, ensure no log messages are lost during rotation, and support real-time alerting for application errors. Which two actions should a solutions architect take to implement this architecture under the principle of least privilege? (Select two.)

Select all that apply

Configure the AWS Unified CloudWatch Agent on the EC2 instances using the wildcard pattern `/var/log/telemetry/telemetry.log*` in the agent configuration file to stream the logs to CloudWatch Logs.

In the monitoring account, create an Amazon Kinesis Data Firehose delivery stream that writes to the S3 bucket, and create a CloudWatch Logs destination pointing to this stream. Grant cross-account write permissions to the production accounts, and create CloudWatch Logs subscription filters in the production accounts to stream logs to this destination.

Configure the AWS Unified CloudWatch Agent on the EC2 instances using the static file path `/var/log/telemetry/telemetry.log` and rely on the agent's built-in file tracking to automatically detect and follow rotated timestamped files.

Configure the S3 bucket policy in the monitoring account with an Allow statement for the principal '*' without any conditions, and set up a cron job on the EC2 instances to copy the rotated logs directly to the S3 bucket using the AWS CLI.

Configure the AWS Unified CloudWatch Agent on the EC2 instances to stream log data directly to the centralized Amazon S3 bucket in the monitoring account using an IAM role with S3 write permissions.

Show answer & explanation

Answer: Configure the AWS Unified CloudWatch Agent on the EC2 instances using the wildcard pattern `/var/log/telemetry/telemetry.log*` in the agent configuration file to stream the logs to CloudWatch Logs.; In the monitoring account, create an Amazon Kinesis Data Firehose delivery stream that writes to the S3 bucket, and create a CloudWatch Logs destination pointing to this stream. Grant cross-account write permissions to the production accounts, and create CloudWatch Logs subscription filters in the production accounts to stream logs to this destination.

Answer

To achieve operational excellence, configure the CloudWatch agent on the EC2 instances to monitor log files using a wildcard pattern such as `/var/log/telemetry/telemetry.log*` to avoid log loss during rotation. In addition, set up a cross-account CloudWatch Logs destination in the monitoring account that routes incoming streams to Kinesis Data Firehose and ultimately to the S3 bucket, and create subscription filters in the production accounts to forward the log groups to this centralized destination.

The correct approach is to use a wildcard pattern `/var/log/telemetry/telemetry.log*` in the CloudWatch agent configuration, which allows it to successfully capture files renamed during hourly rotation. For secure and real-time cross-account centralization, a CloudWatch Logs destination in the monitoring account must be paired with Kinesis Data Firehose and production-account subscription filters, adhering to least-privilege policies.

Step-by-Step Solution

Configure the CloudWatch agent on the production EC2 instances to watch the telemetry log directory using wildcards.

The agent tracks both the active log file and any rotated files that match the wildcard pattern, preventing log data from being skipped during rotation.

Log rotation by renaming files breaks standard file trackers if they are only configured with static names.

Establish a centralized log streaming target in the monitoring account.

A Kinesis Data Firehose delivery stream is configured to batch and write log data to the central Amazon S3 bucket, and a CloudWatch Logs destination is created to ingest events.

This sets up the ingestion endpoint in the monitoring account with appropriate cross-account policies.

Configure subscription filters in the production accounts to send log events to the monitoring account's destination.

Logs are automatically streamed in near real-time from the local CloudWatch Log groups to the monitoring account.

This links the local log groups in production accounts to the centralized destination.

Key Concept

Handling rotated logs with the CloudWatch Agent via wildcard paths and centralizing cross-account logs using CloudWatch Logs destinations and Kinesis Data Firehose.

PreviousPage 53 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution