Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1101Question →

An enterprise manages its application infrastructure across multiple AWS accounts within an AWS Organization. A central DevOps team uses AWS CloudFormation StackSets to deploy standard security tooling, which includes an Amazon EC2 Auto Scaling group and an associated launch template in each member account. Recently, local administrators in several member accounts have manually modified the launch templates and associated security groups to troubleshoot network connectivity, introducing configuration drift that violates compliance baselines. The enterprise needs to establish an automated, zero-touch solution to detect this drift and remediate the resources back to the template-defined state. The solution must support cross-account operations, use encrypted parameter storage, and follow the principle of least privilege. Which combination of actions should the Solutions Architect implement to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure an AWS Config organization rule using the cloudformation-stack-drift-detection-check managed rule. Configure an Amazon EventBridge rule in the organization's delegated administrator account to detect compliance changes and trigger an AWS Systems Manager Automation runbook that assumes a cross-account IAM role to remediate the drifted resource.; Create a Customer Managed Key (CMK) in AWS KMS in the central DevOps account, and configure its key policy to grant cross-account usage permissions to the IAM roles in the member accounts. Configure the cross-account IAM roles in the member accounts to trust the central DevOps account's Automation execution role.

Answer

To establish automated drift detection and remediation under least privilege: 1. Deploy an AWS Config organization rule using the cloudformation-stack-drift-detection-check managed rule, and trigger an AWS Systems Manager Automation runbook via EventBridge in the delegated administrator account. The runbook must assume cross-account IAM roles. 2. Use a Customer Managed Key (CMK) in the central account with cross-account access enabled in the key policy, as AWS-managed keys cannot be shared cross-account.
The correct architecture uses an AWS Config organization rule (using the cloudformation-stack-drift-detection-check managed rule) to monitor drift across all accounts in the organization. When drift occurs, EventBridge triggers AWS Systems Manager Automation. The automation runbook assumes a cross-account IAM role in the member account to perform remediation. To retrieve secure parameters cross-account, a Customer Managed Key (CMK) must be created in the central account, and its key policy must explicitly allow cross-account access, because AWS-managed keys cannot be shared cross-account.

Step-by-Step Solution

1
Configure centralized drift detection
AWS Config organization rule evaluates stack drift status across all member accounts.
Ensures drift is detected in a scalable, multi-account manner without requiring local configuration in each member account.
2
Set up the automation trigger and cross-account execution
An EventBridge rule matches non-compliant stack compliance state events and starts Systems Manager Automation, which assumes a trusted role in the drifted account.
Triggers the zero-touch remediation workflow automatically and securely.
3
Configure cross-account key sharing for parameter decryption
A Customer Managed Key is configured with a key policy allowing target roles to decrypt configurations.
AWS KMS AWS-managed keys cannot be modified or shared cross-account, necessitating a Customer Managed Key (CMK) for cross-account operational decryption.

Key Concept

Cross-account automated drift detection and remediation using AWS Config, EventBridge, Systems Manager, and KMS cross-account access policies.
Question 1102Question →

A SaaS provider has a multi-account AWS environment managed via AWS Organizations. Application data containing customer PII is stored in S3 buckets across multiple member accounts in a production Organization Unit (OU). A security audit demands the following improvements:

1. All data stored in these S3 buckets must be encrypted at rest using encryption keys where the lifecycle, rotation, and access policies can be managed by the customer.
2. Member accounts must deliver their S3 server access logs to a centralized S3 bucket located in a dedicated Security account.

Which two actions should the Solutions Architect take to meet these compliance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In each member account, create a Customer Managed KMS Key (CMK) and configure its key policy to grant usage permissions to local IAM roles. Configure the member S3 buckets to use this CMK for server-side encryption (SSE-KMS).; In the Security account, configure the centralized logging S3 bucket policy to allow the 'logging.s3.amazonaws.com' service principal to perform 's3:PutObject' actions, filtering by the specific source buckets and paths.

Answer

Create customer managed KMS keys in each member account and configure key policies to allow local IAM roles to access them for S3 server-side encryption. In the centralized logging Security account, configure the S3 bucket policy to allow the S3 logging service principal (logging.s3.amazonaws.com) to perform s3:PutObject actions.
To encrypt data with customer-manageable lifecycle and access, customer managed keys (CMKs) are required. Standard AWS-managed keys (like aws/s3) do not allow policy customization or cross-account access delegation. For S3 server access logging, the logs are delivered by the Amazon S3 service principal (logging.s3.amazonaws.com) rather than the member accounts' IAM principals. The centralized bucket's policy must therefore trust this service principal to write the log files.

Step-by-Step Solution

1
Evaluate key management options for S3 encryption at rest to meet customer control requirements.
Identify that Customer Managed Keys (CMKs) must be used since AWS-managed keys (aws/s3) do not allow policy customization or cross-account access.
AWS-managed keys are locked down and cannot be shared or modified, failing the requirement for customer-managed access policies.
2
Determine the proper principal for writing S3 server access logs to a centralized bucket.
Identify the Amazon S3 service principal (logging.s3.amazonaws.com) as the writer of access logs.
S3 server access logs are delivered by the service itself, meaning the bucket policy in the logging account must trust the service principal rather than individual IAM identities.
3
Draft and configure the S3 bucket policy for centralized logging and the KMS key policy for S3 encryption.
Configure a bucket policy allowing s3:PutObject for logging.s3.amazonaws.com and set S3 buckets to use CMK encryption.
This establishes a secure, compliant architecture with fully auditable and segregated encryption keys and log delivery routes.

Key Concept

Implementing secure encryption at rest using customer managed keys and establishing cross-account centralized S3 logging using service principals.
Question 1103Question →

An enterprise runs a critical content management system in a single VPC in the us-east-1 Region. The application tier consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The database tier uses an Amazon Aurora PostgreSQL DB cluster.

To meet a new compliance requirement, the enterprise needs to establish a multi-region disaster recovery (DR) solution in the us-west-2 Region. The solution must achieve a Recovery Point Objective (RPO) of 1 minute and a Recovery Time Objective (RTO) of 15 minutes.

Which TWO steps should the solutions architect take to meet these DR objectives?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2.; Deploy a duplicate application stack in us-west-2 and configure Route 53 Application Recovery Controller (ARC) routing controls to manage regional traffic failover.

Answer

To meet the disaster recovery objectives, the solutions architect must configure Amazon Aurora Global Database for cross-region database replication and utilize Route 53 Application Recovery Controller (ARC) routing controls for regional DNS failover.
To meet an RPO of 1 minute and an RTO of 15 minutes, the database replication must be continuous and near real-time. Amazon Aurora Global Database uses storage-based replication to replicate data to the secondary region (us-west-2) in less than a second, satisfying the RPO. For traffic routing, Route 53 Application Recovery Controller (ARC) routing controls provide deterministic failover capabilities that can change DNS routing within seconds, helping the overall stack achieve the 15-minute RTO.

Step-by-Step Solution

1
Set up Aurora Global Database replication.
Database changes are continuously replicated from us-east-1 to us-west-2 with sub-second replication latency.
Ensures the database tier meets the RPO of 1 minute.
2
Deploy standby application instances in us-west-2 and configure Route 53 ARC.
Traffic can be shifted to the recovery region instantly by toggling the ARC routing control states.
Provides reliable, deterministic failover that avoids DNS propagation delays, satisfying the 15-minute RTO.

Key Concept

Multi-region disaster recovery replication and deterministic DNS failover routing orchestration.
Question 1104Question →

An enterprise digital media platform runs its content management system (CMS) on AWS. The application tier runs on a fleet of Amazon EC2 `t3.large` instances in an Auto Scaling group behind an Application Load Balancer (ALB). The database tier uses an Amazon RDS for PostgreSQL DB instance. The CMS files and media assets are stored on an Amazon Elastic File System (Amazon EFS) file system configured with General Purpose performance mode and Bursting throughput mode.

During high-profile news release campaigns, users experience high latency and occasional timeouts. A review of Amazon CloudWatch metrics during these campaigns shows:
- The EC2 instances reach 100%100\% CPU utilization, and the `CPUCreditBalance` drops to 00.
- The EFS `BurstCreditBalance` drops to 00, and EFS throughput is throttled to approximately 2.5 MiB/s2.5\text{ MiB/s} due to the small size of the media storage (50 GiB50\text{ GiB}).
- The RDS DB instance shows high read latency, but CPU utilization is normal.

Which two actions should a Solutions Architect take to resolve these bottlenecks and optimize the performance of the compute and storage tiers?

Select all that apply

Show answer & explanation

Answer: Modify the Auto Scaling group launch template to use a non-burstable instance type, such as `c6i.large`, to ensure consistent compute performance.; Configure the Amazon EFS file system throughput mode to Elastic throughput to automatically scale throughput capacity based on workload activity.

Answer

Modify the Auto Scaling group launch template to use a non-burstable instance type, such as `c6i.large`, and configure the Amazon EFS file system throughput mode to Elastic throughput.
Transitioning the EC2 instances to a non-burstable instance type (like `c6i.large`) resolves the compute bottleneck by removing the dependency on CPU credits. Setting the EFS throughput mode to Elastic throughput resolves the storage bottleneck by allowing the file system to dynamically deliver the necessary IOPS and throughput regardless of the small 50 GiB50\text{ GiB} storage size.

Step-by-Step Solution

1
Analyze the compute tier performance metrics.
The CloudWatch metrics show 100%100\% CPU utilization and `CPUCreditBalance` dropping to 00 on the EC2 instances.
This indicates that the `t3.large` burstable instances have exhausted their CPU credits and are being throttled to their baseline performance, which causes latency. Moving to a non-burstable instance type like `c6i.large` guarantees consistent CPU performance.
2
Analyze the storage tier performance metrics.
The EFS `BurstCreditBalance` drops to 00 and throughput is restricted to 2.5 MiB/s2.5\text{ MiB/s} on a 50 GiB50\text{ GiB} file system.
In Bursting throughput mode, EFS baseline throughput scales linearly with the storage volume size (50 KiB/s50\text{ KiB/s} per GiB). With only 50 GiB50\text{ GiB} stored, the baseline is 2.5 MiB/s2.5\text{ MiB/s}. Switching to Elastic throughput allows the file system to scale up to dynamic throughput rates based on read/write load rather than stored volume size.
3
Evaluate the database and load balancer options.
RDS standby instances cannot accept read connections, and ALB pre-warming does not affect backend EC2 CPU credit metrics.
Eliminating invalid configurations ensures that read scaling is not attempted on passive RDS standby nodes and that the root cause of backend CPU throttling is directly addressed via compute adjustments.

Key Concept

Identifying CPU credit exhaustion in burstable EC2 instances and EFS throughput limitations on small datasets, and resolving them by transitioning to non-burstable compute instances and Elastic throughput mode.
Question 1105Question →

A SaaS provider is setting up a new multi-VPC environment in the eu-west-1 Region. The environment consists of two spoke VPCs: vpc-payment-prd and vpc-booking-prd. Both VPCs are deployed across two Availability Zones (eu-west-1a and eu-west-1b). The workloads in these spoke VPCs require highly available, outbound-only internet access to communicate with external payment APIs, while minimizing cross-Availability Zone data transfer charges. Additionally, the workloads must resolve private domain names hosted in a Route 53 Private Hosted Zone (PHZ) corp.internal managed in a central Shared Services account. The solutions architect decides to use an AWS Transit Gateway to connect the VPCs.

Which configuration should the solutions architect implement to meet these requirements?

Show answer & explanation

Answer: Deploy an AWS Transit Gateway and attach all three VPCs. In vpc-egress-shared, deploy one NAT Gateway in eu-west-1a and one NAT Gateway in eu-west-1b. Configure the Transit Gateway route table for the spoke VPC attachments to direct 0.0.0.0/0 traffic to the vpc-egress-shared attachment. Configure the route tables of the Transit Gateway subnets in vpc-egress-shared to route traffic to the NAT Gateway in the same Availability Zone. From the Shared Services account, associate the Private Hosted Zone corp.internal with both vpc-payment-prd and vpc-booking-prd.

Answer

Deploy an AWS Transit Gateway to connect the VPCs, use multi-AZ NAT Gateways in the egress VPC, direct traffic to the local NAT Gateway in each Availability Zone to minimize cross-AZ charges, and associate the Private Hosted Zone with both spoke VPCs directly.
The correct configuration uses AWS Transit Gateway to interconnect the spoke VPCs and the shared egress VPC. High availability is achieved by deploying a NAT Gateway in both Availability Zones (eu-west-1a and eu-west-1b) within the egress VPC. Since Transit Gateway preserves the Availability Zone of originating traffic, routing the Transit Gateway subnets' traffic to the local NAT Gateway in the same Availability Zone eliminates cross-Availability Zone data transfer charges. Lastly, to resolve records in the central Private Hosted Zone, the zone must be directly associated with both spoke VPCs from the Shared Services account.

Step-by-Step Solution

1
Deploy redundant NAT Gateways.
Create one NAT Gateway in the public subnet of eu-west-1a and another in the public subnet of eu-west-1b within the shared egress VPC.
This establishes high availability for internet egress and ensures there is a local NAT Gateway in each Availability Zone to avoid cross-AZ data transfer charges.
2
Establish Transit Gateway connections and configure AZ-aligned routing.
Attach vpc-payment-prd, vpc-booking-prd, and vpc-egress-shared to an AWS Transit Gateway. Route 0.0.0.0/0 from the spoke VPCs to the egress VPC attachment, and configure the Transit Gateway subnet route tables in the egress VPC to direct traffic to their local NAT Gateways.
Transit Gateway maintains the Availability Zone affinity of the originating traffic. Directing traffic to the local NAT Gateway in the egress VPC ensures that traffic does not cross Availability Zones, minimizing latency and data transfer costs.
3
Associate the Route 53 Private Hosted Zone across accounts.
From the Shared Services account, associate the corp.internal Private Hosted Zone with the VPC IDs of vpc-payment-prd and vpc-booking-prd.
Private Hosted Zones must be explicitly associated with each VPC that needs to resolve the private DNS records. DNS resolution is not transitive over Transit Gateway attachments.

Key Concept

Centralized egress networking with Transit Gateway, maintaining Availability Zone affinity for cost optimization, and cross-account Route 53 Private Hosted Zone association.
Estimated Time:2m 0s
Question 1106Question →

A company runs a microservices application across multiple AWS accounts managed under AWS Organizations. The application's compute resources consist entirely of AWS Fargate tasks and AWS Lambda functions. To reduce costs, the company wants to commit to a consistent amount of compute usage.

Which strategy should a solutions architect recommend to optimize the compute costs of this serverless architecture?

Show answer & explanation

Answer: Purchase Compute Savings Plans in the organization's management account.

Answer

Purchase Compute Savings Plans in the organization's management account.
Compute Savings Plans provide the most flexibility and automatically apply to compute usage across Amazon EC2, AWS Fargate, and AWS Lambda regardless of instance family, size, Availability Zone, region, or operating system. Purchasing them at the AWS Organizations management account level ensures the discounts are shared across all consolidated member accounts.

Step-by-Step Solution

1
Analyze the compute resources used in the scenario.
The workload consists entirely of AWS Fargate and AWS Lambda.
Understanding the resource types helps determine which optimization models are compatible.
2
Evaluate the eligibility of Savings Plans.
Compute Savings Plans cover EC2, Fargate, and Lambda, whereas EC2 Instance Savings Plans cover only EC2.
Selecting the correct type ensures the serverless compute usage receives the discounted rate.
3
Apply the multi-account context.
Purchasing Compute Savings Plans in the management account allows the benefits to apply to all member accounts automatically under AWS Organizations consolidated billing.
This maximizes utilization of the Savings Plan across the entire organization.

Key Concept

Compute Savings Plans for Serverless Workloads
Question 1107Question →

An enterprise runs a critical application on a fleet of Amazon EC2 instances across multiple member accounts in an AWS Organization. The application writes operational logs to `/var/log/myapp/app-[timestamp].log`. Every hour, a cron job rotates these logs, compressing the older logs into `/var/log/myapp/app-[timestamp].log.gz` within the same directory. The company wants to implement a centralized logging architecture to stream these logs to a central Amazon S3 bucket in a dedicated monitoring account. The Solutions Architect must ensure that the CloudWatch agent on the EC2 instances collects all log entries continuously without ingesting duplicate data from the compressed files, and the logs are securely forwarded to the central S3 bucket with the least privilege, avoiding cross-account IAM role assumption from the EC2 instances. Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the CloudWatch agent configuration file on the EC2 instances, set the `file_path` parameter to `/var/log/myapp/app-*.log` under the logs collection section.; In the monitoring account, create an Amazon Kinesis Data Firehose delivery stream and a CloudWatch Logs destination. Attach an IAM role to the destination allowing it to write to the Firehose stream, and apply a destination policy that permits `logs:PutSubscriptionFilter` for the AWS Organization. In the member accounts, create subscription filters that target the centralized Logs destination.

Answer

To implement the centralized logging architecture, the Solutions Architect should set the `file_path` parameter to `/var/log/myapp/app-*.log` in the CloudWatch agent configuration to prevent duplicate log ingestion of compressed archives, and set up a CloudWatch Logs destination and Kinesis Data Firehose stream in the central monitoring account, allowing member accounts to send logs using cross-account subscription filters.
Specifying the file path wildcard `/var/log/myapp/app-*.log` ensures that the CloudWatch agent only monitors active text log files and ignores the hourly rotated, compressed `.log.gz` files, preventing duplicate ingestion and binary processing. Additionally, creating a centralized CloudWatch Logs destination in the monitoring account linked to an Amazon Kinesis Data Firehose delivery stream allows member accounts to use native subscription filters to securely stream log events cross-account without needing cross-account IAM role assumptions from the EC2 instances.

Step-by-Step Solution

1
Configure the local CloudWatch agent log path with a wildcard pattern that explicitly targets only active log files.
The agent monitors files matching `/var/log/myapp/app-*.log` and ignores `/var/log/myapp/app-[timestamp].log.gz` files when they are rotated.
This prevents duplicate ingestion and corruption of logs caused by reading binary compressed files.
2
Set up a centralized ingestion pipeline in the monitoring account using a CloudWatch Logs destination linked to Kinesis Data Firehose.
A central endpoint is created that accepts log events cross-account and delivers them to the destination S3 bucket.
This establishes a secure, managed service integration that avoids EC2 instances needing direct cross-account write permissions.
3
Configure subscription filters in the member accounts targeting the centralized destination.
Logs are streamed automatically from member accounts to the central S3 bucket via the Kinesis Data Firehose pipeline.
This utilizes AWS native integration patterns to securely route log events across organizational accounts.

Key Concept

Improving Operational Excellence via Monitoring and Logging requires designing log collection agents to handle rotation events correctly and leveraging native cross-account streaming services like CloudWatch Logs destinations and Kinesis Data Firehose to centralize logs securely without cross-account IAM role assumptions.
Question 1108Question →

A financial analytics enterprise operates a hybrid transactional system. The on-premises transactional databases continuously replicate ledger data to a multi-region AWS environment containing VPCs in `us-east-1` (primary) and `us-west-2` (secondary). The hybrid network topology consists of a 10 Gbps AWS Direct Connect connection with a Transit Virtual Interface (VIF) terminated at a Direct Connect Gateway (DXGW). The DXGW is associated with an AWS Transit Gateway (TGW) in `us-east-1`, which is peered with a Transit Gateway in `us-west-2` to facilitate inter-region connectivity.

During peak transaction processing periods, the operations team identifies three critical issues:
1. Significant latency and packet drops occur when replicating transaction logs from the on-premises database to the Amazon RDS PostgreSQL databases in `us-west-2`. The replication traffic currently transits from on-premises to the `us-east-1` TGW, and then over the inter-region TGW peering connection.
2. The analytics engine VPCs in both AWS regions must resolve internal microservice endpoints hosted in a shared service VPC in `us-east-1` via a Route 53 Private Hosted Zone (PHZ) named `internal.analytics.local`. Currently, instances in `us-west-2` experience persistent name resolution failures.
3. For outbound compliance reporting traffic, the `us-east-1` VPC routes all internet-bound traffic through a single NAT Gateway located in a public subnet in Availability Zone `us-east-1a`. During periods of transient AZ degradation, instances in other AZs experience severe connectivity latency.

Which of the following actions should the Solutions Architect recommend to optimize the hybrid network performance, reduce latency, and resolve the connectivity and DNS resolution issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the on-premises routers and the AWS Direct Connect Transit Virtual Interface (VIF) to support a Maximum Transmission Unit (MTU) of 8500 bytes, ensuring the path matches the maximum MTU supported by AWS Transit Gateway to prevent packet fragmentation.; Associate the Route 53 Private Hosted Zone `internal.analytics.local` with the VPCs in both `us-east-1` and `us-west-2` regions to enable local DNS resolution, and deploy a dedicated NAT Gateway in each Availability Zone utilized by the `us-east-1` VPC to eliminate inter-AZ transit latency.

Answer

To optimize network performance, replication latency, and DNS resolution, the architect must configure the MTU to 8500 bytes on both the on-premises routers and the Transit VIF to match the maximum MTU supported by AWS Transit Gateway and prevent packet fragmentation. Additionally, the Private Hosted Zone must be associated with the VPCs in both regions to enable local DNS resolution, and a NAT Gateway must be deployed in each Availability Zone of the us-east-1 VPC to eliminate cross-AZ latency and single points of failure.
The correct solution addresses path MTU, DNS resolution, and local routing issues. First, configuring the MTU to 8500 bytes (Jumbo Frames) on the Direct Connect Transit VIF and on-premises routers aligns the network path with the maximum MTU supported by AWS Transit Gateway, which eliminates packet fragmentation and improves replication throughput. Second, associating the Private Hosted Zone with the VPCs in both regions ensures private DNS queries resolve natively within each VPC. Finally, deploying a NAT Gateway in each Availability Zone avoids inter-AZ network paths for internet-bound traffic, removing cross-AZ latency and providing resilience.

Step-by-Step Solution

1
Configure MTU size of 8500 bytes on the Direct Connect Transit Virtual Interface and on-premises routers.
Path MTU matches the AWS Transit Gateway maximum MTU for VPC/Direct Connect attachments.
This prevents IP packet fragmentation and the associated CPU overhead, eliminating replication latency spikes.
2
Associate the Route 53 Private Hosted Zone with the VPCs in both us-east-1 and us-west-2.
Instances in us-west-2 can resolve internal.analytics.local domain names locally.
Route 53 Private Hosted Zones must be explicitly associated with all VPCs that require local DNS resolution.
3
Deploy a NAT Gateway in each active Availability Zone of the us-east-1 VPC and update the respective route tables.
Outbound internet traffic stays within its local AZ.
This avoids cross-AZ transit latency, reduces data transfer costs, and prevents a single AZ outage from disabling outbound traffic for the entire VPC.

Key Concept

Path MTU alignment, multi-region Private Hosted Zone association, and Availability Zone-redundant NAT Gateway architectures.
Estimated Time:4m 0s
Question 1109Question →

An enterprise operates a delivery tracking application deployed across multiple AWS accounts managed under an AWS Organizations organization. The application is hosted on Amazon EC2 instances within Auto Scaling groups. The application writes operational logs locally to `/var/log/delivery/tracking.log`. The logs undergo hourly rotation, during which the active log file is renamed to `/var/log/delivery/tracking.log.YYYY-MM-DD-HH` and a new `tracking.log` is created.

The solutions architect must design a centralized, operationally excellent monitoring and logging architecture. The architecture must gather all application logs and deliver all AWS CloudTrail logs from all member accounts into a single Amazon S3 bucket located in a central security account.

Which combination of steps should the solutions architect take to meet these requirements while ensuring operational reliability and maintaining least-privilege security? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the S3 bucket policy in the central security account to grant `s3:PutObject` permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`), and use the `aws:PrincipalOrgID` condition key to restrict log delivery to only the accounts within the AWS Organization.; In the Unified CloudWatch Agent configuration file on the EC2 instances, define the log source with the `file_path` parameter set to `/var/log/delivery/tracking.log*` to ensure both the active log and the rotated log files are monitored and streamed.

Answer

The correct combination requires configuring the S3 bucket policy in the central security account to grant write access to the CloudTrail service principal restricted by the Organization ID, and setting the Unified CloudWatch Agent's file path parameter using a wildcard pattern to capture rotated logs.
The solution requires two actions: first, enabling cross-account CloudTrail log delivery securely by configuring the destination S3 bucket policy to allow the CloudTrail service principal while restricting access using the `aws:PrincipalOrgID` condition. Second, configuring the Unified CloudWatch Agent to monitor the application log directory using a wildcard pattern (`/var/log/delivery/tracking.log*`). This wildcard allows the agent to monitor both the active file and any rotated files during the transition window, preventing data loss without requiring service restarts.

Step-by-Step Solution

1
Configure the central S3 bucket policy for CloudTrail.
The bucket policy allows `cloudtrail.amazonaws.com` to perform `s3:PutObject` with a condition evaluating `aws:PrincipalOrgID` matching the organization's ID.
This establishes secure cross-account log delivery for all current and future accounts in the AWS Organization without manually updating bucket policies.
2
Configure the CloudWatch Agent configuration file on EC2 instances.
The `file_path` configuration under the log section uses the wildcard pattern `/var/log/delivery/tracking.log*`.
The wildcard ensures that when `tracking.log` is rotated to `tracking.log.YYYY-MM-DD-HH`, the agent continues tracking the renamed file until it reaches EOF and automatically starts tracking the newly created `tracking.log`.

Key Concept

Improving operational excellence involves implementing secure, automated, and resilient centralization of both infrastructure audit trails and application-level log streams across multi-account environments.
Question 1110Question →

A financial services organization has implemented a multi-account structure using AWS Organizations. The security team is auditing the existing architecture to enhance data protection and compliance. They want to centralize Amazon S3 bucket access logs and AWS CloudTrail logs from all member accounts into a single secure S3 bucket in a dedicated Security account. All logs must be encrypted at rest using Server-Side Encryption with AWS KMS (SSE-KMS). Member accounts must be prevented from disabling logging, modifying the central S3 bucket configuration, or deleting the KMS encryption keys. Which two actions should the solutions architect take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure the S3 bucket policy in the Security account to grant write permissions (s3:PutObject) to the AWS CloudTrail service principal, restricting access to the Organization by using the aws:PrincipalOrgID condition key.; Create a Customer Managed Key (CMK) in the Security account, configure its key policy to allow cross-account usage from the member accounts, and apply a Service Control Policy (SCP) at the Organization root to deny member accounts from performing kms:ScheduleKeyDeletion or kms:PutKeyPolicy on this key.

Answer

To meet the requirements, the solutions architect must configure the centralized S3 bucket policy in the Security account to grant write permissions to the CloudTrail service principal while restricting access to the organization using the organization ID condition. Additionally, a Customer Managed Key (CMK) must be created in the Security account with a cross-account key policy, and a Service Control Policy (SCP) must be applied to prevent member accounts from deleting or modifying the key.
To achieve compliance and security, the solutions architect must configure a bucket policy on the centralized S3 bucket in the Security account that explicitly allows the CloudTrail service principal to write logs, restricted to the organization using the aws:PrincipalOrgID condition. Since AWS-managed keys cannot be shared across accounts, a Customer Managed Key (CMK) must be created in the Security account with a key policy allowing member accounts to use it. A Service Control Policy (SCP) at the organization level is then used to prevent member accounts from modifying or deleting this key, satisfying the security requirements.

Step-by-Step Solution

1
Configure the central S3 bucket policy in the Security account.
Allows the CloudTrail service principal (cloudtrail.amazonaws.com) to call s3:PutObject with a condition limiting the source to the specific Organization ID using the aws:PrincipalOrgID key.
Ensures that all member accounts in the Organization can securely deliver their logs to the centralized bucket while blocking unauthorized accounts.
2
Create and configure a Customer Managed Key (CMK) in the Security account.
The CMK is configured with a key policy that grants kms:GenerateDataKey* and kms:Decrypt permissions to the member accounts' IAM roles or services.
AWS-managed keys (like aws/s3) cannot be shared across accounts or customized, so a Customer Managed Key is required to support cross-account log encryption.
3
Apply a Service Control Policy (SCP) at the Organization level.
Prevents member accounts from deleting the logging CMK or altering key policies, while allowing authorized log writing and reading functions.
Ensures compliance and protects data integrity by establishing administrative guardrails that member account administrators cannot bypass.

Key Concept

Implementing secure centralized logging across multiple AWS accounts using S3 bucket policies with organizational conditions, customer-managed KMS keys for cross-account encryption, and Service Control Policies as compliance guardrails.
Question 1111Question →

A media company is designing a new multi-VPC environment in the `us-west-2` Region using AWS Organizations. The architecture consists of a Shared Services VPC and two application spoke VPCs, spanning two Availability Zones. The company needs to provide highly resilient outbound internet traffic (0.0.0.0/00.0.0.0/0) access for the application servers in the spoke VPCs' private subnets. Additionally, the application servers must resolve domain names within a private hosted zone named `media.internal` which is defined in the Shared Services VPC. An AWS Transit Gateway is used to interconnect all VPCs. Which TWO actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet in each Availability Zone of the Shared Services VPC. Configure the spoke VPC route tables to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the Transit Gateway, which then forwards the traffic to the Shared Services VPC.; Associate the Route 53 Private Hosted Zone `media.internal` with both application spoke VPCs using cross-account or cross-VPC association APIs.

Answer

Deploy a NAT Gateway in a public subnet in each Availability Zone of the Shared Services VPC, routing spoke VPC internet egress traffic through the Transit Gateway to the Shared Services VPC, and associate the Route 53 Private Hosted Zone with the spoke VPCs.
Deploying redundant NAT Gateways across two Availability Zones ensures high availability for outbound traffic, while associating the Private Hosted Zone with the spoke VPCs enables native DNS resolution for `media.internal` across all accounts and VPCs in the environment.

Step-by-Step Solution

1
Configure highly available NAT Gateways in the Shared Services VPC.
Two NAT Gateways are deployed, one in each Availability Zone, providing redundant paths for egress traffic.
This setup prevents a single Availability Zone failure from disrupting outbound internet access for the entire network.
2
Configure Transit Gateway routing to direct egress traffic from the spoke VPCs to the Shared Services VPC.
The route tables of the spoke VPCs point outbound traffic (0.0.0.0/00.0.0.0/0) to the Transit Gateway, which routes it to the Shared Services VPC.
This centralizes egress traffic and utilizes the redundant NAT Gateways in the Shared Services VPC.
3
Associate the Route 53 Private Hosted Zone with the spoke VPCs.
The private hosted zone `media.internal` is associated with each spoke VPC.
This allows resources in the spoke VPCs to resolve DNS queries for `media.internal` using the default Route 53 Resolver IP address.

Key Concept

Designing resilient egress routing and cross-VPC DNS resolution in a multi-VPC architecture using AWS Transit Gateway and Route 53 Private Hosted Zones.
Estimated Time:2m 0s
Question 1112Question →

An enterprise is designing a secure, multi-VPC platform in the `us-west-2` Region. The architecture includes `vpc-app-prod` for private containerized workloads across two Availability Zones (`us-west-2a` and `us-west-2b`), and `vpc-shared-egress` for centralized internet egress inspection via AWS Network Firewall and NAT Gateways. An AWS Transit Gateway (`tgw-us-west-2`) interconnects the VPCs. In a separate AWS account, `vpc-mgmt-shared` hosts a Route 53 Private Hosted Zone (PHZ) named `corp.internal`.

The design must meet the following requirements:
- Outbound internet traffic from `vpc-app-prod` must be inspected by AWS Network Firewall in `vpc-shared-egress`.
- High availability must be maintained across Availability Zones for internet egress.
- Asymmetric routing through the stateful Network Firewall must be avoided.
- Workloads in `vpc-app-prod` must resolve names in `corp.internal` with minimum latency and without routing DNS traffic over the hybrid connection.

Which architecture satisfies these requirements?

Show answer & explanation

Answer: Deploy a NAT Gateway and an AWS Network Firewall endpoint in both `us-west-2a` and `us-west-2b` in `vpc-shared-egress`. Route outbound traffic from `vpc-app-prod` via `tgw-us-west-2` to `vpc-shared-egress`. Enable Appliance Mode on the Transit Gateway VPC attachment for `vpc-shared-egress` to ensure symmetric routing. Associate the corp.internal Private Hosted Zone with `vpc-app-prod`.

Answer

Deploy a NAT Gateway and an AWS Network Firewall endpoint in both `us-west-2a` and `us-west-2b` in `vpc-shared-egress`. Route outbound traffic from `vpc-app-prod` via `tgw-us-west-2` to `vpc-shared-egress`. Enable Appliance Mode on the Transit Gateway VPC attachment for `vpc-shared-egress` to ensure symmetric routing. Associate the corp.internal Private Hosted Zone with `vpc-app-prod`.
The correct solution deploys a NAT Gateway and an AWS Network Firewall endpoint in both Availability Zones in the egress VPC, routes outbound traffic via the Transit Gateway, enables Appliance Mode on the egress VPC attachment, and associates the Private Hosted Zone directly with the application VPC. This configuration ensures Availability Zone redundancy, prevents asymmetric routing issues with the stateful firewall, and provides low-latency DNS resolution.

Step-by-Step Solution

1
Deploy redundant NAT Gateways and AWS Network Firewall endpoints in each Availability Zone (us-west-2a and us-west-2b) within the egress VPC.
Eliminates single points of failure for outbound internet routing, ensuring high availability in case of a zone outage.
To satisfy the high availability constraint for internet egress.
2
Enable Appliance Mode on the AWS Transit Gateway VPC attachment for the egress VPC (vpc-shared-egress).
Forces Transit Gateway to direct both ingress and egress traffic for a given network flow through the same Availability Zone and firewall endpoint.
To prevent stateful security inspection failures caused by asymmetric routing across different Availability Zones.
3
Associate the Private Hosted Zone (PHZ) `corp.internal` from the management account with `vpc-app-prod`.
Enables private DNS resolution for application workloads in the production VPC directly through the Route 53 Resolver.
To resolve internal hostnames with minimum latency without sending DNS traffic over the hybrid connection.

Key Concept

Centralized egress security with symmetric routing and cross-account Private Hosted Zone association in a Transit Gateway architecture.
Question 1113Question →

A retail company is designing a new compliance-regulated transaction ingestion pipeline. The architecture utilizes two AWS accounts within the same AWS Organization: an Ingestion Account (account ID 111122223333) and an Analytics Account (account ID 444455556666). An application running on Amazon ECS tasks in the Ingestion Account must write transactional data directly to an Amazon S3 bucket in the Analytics Account. The security architecture mandates that all uploaded data must be encrypted at rest, and the Analytics Account must retain absolute ownership of all objects uploaded by the external Ingestion Account without requiring the use of S3 Access Control Lists (ACLs). Which TWO configurations must be implemented to establish this secure cross-account ingestion pipeline? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the Analytics Account, configure the S3 Object Ownership setting on the S3 bucket to Bucket owner enforced to disable ACLs and automatically transfer ownership of all uploaded objects.; In the Analytics Account, configure the S3 bucket default encryption to use a Customer Managed Key (CMK), and update its key policy to grant the ECS task role in the Ingestion Account permissions for kms:GenerateDataKey and kms:Decrypt.

Answer

In the Analytics Account, configure the S3 Object Ownership setting on the S3 bucket to Bucket owner enforced, and configure the S3 bucket default encryption to use a Customer Managed Key (CMK), updating its key policy to grant the ECS task role in the Ingestion Account permissions for kms:GenerateDataKey and kms:Decrypt.
The correct architecture requires configuring the destination S3 bucket's Object Ownership setting to Bucket owner enforced to eliminate the dependency on ACLs and automatically transfer ownership of files uploaded from the Ingestion Account. Additionally, the bucket must be configured with a Customer Managed KMS Key (CMK) whose key policy explicitly grants the ECS task role in the Ingestion Account permission to execute kms:GenerateDataKey and kms:Decrypt, which are required for cross-account S3 KMS uploads.

Step-by-Step Solution

1
Address the object ownership requirement by disabling ACLs.
Configure S3 Object Ownership to 'Bucket owner enforced' on the target bucket in the Analytics Account.
This configuration disables all ACLs on the bucket and ensures that any object uploaded by a cross-account identity is automatically owned by the bucket owner (Analytics Account) without needing explicit ACL permissions.
2
Evaluate KMS key type selection for cross-account S3 encryption.
Identify that a Customer Managed Key (CMK) must be used instead of an AWS-managed key.
AWS-managed KMS keys (like aws/s3) have fixed policies that cannot be modified to authorize cross-account access, whereas CMK policies can be explicitly customized.
3
Configure permissions on the selected Customer Managed Key.
Modify the CMK's key policy in the Analytics Account to grant the Ingestion Account's ECS task role permissions for kms:GenerateDataKey and kms:Decrypt.
When S3 encrypts objects using KMS keys during a cross-account PutObject, the uploading principal must be authorized by the KMS key policy to perform these actions.

Key Concept

Cross-account resource access control design using S3 Bucket Policies, Object Ownership, and Customer Managed KMS Keys.
Question 1114Question →

An IoT data processing application runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The instances ingest real-time sensor metrics and write raw telemetry logs to an attached Amazon EBS gp3 volume before compiling them. During periodic peak events, the application experiences severe write latencies and high CPU wait states on the EC2 instances, while CPU utilization remains under 40%. The current EBS gp3 configuration is at the default baseline performance of 3,000 IOPS and 125 MiB/s. Which of the following solutions will resolve the performance bottleneck in the most cost-effective manner?

Show answer & explanation

Answer: Increase the provisioned IOPS and throughput on the existing EBS gp3 volumes to match peak workload requirements.

Answer

Increase the provisioned IOPS and throughput on the existing EBS gp3 volumes to match peak workload requirements.
The combination of low CPU utilization and high CPU wait states indicates that the EC2 instances are blocked waiting for disk I/O operations to complete. Since gp3 volumes allow independent scaling of performance metrics, increasing the provisioned IOPS and throughput directly addresses this storage bottleneck without incurring the cost of provisioning additional storage capacity or launching unnecessary EC2 instances.

Step-by-Step Solution

1
Analyze the metrics provided to identify the bottleneck.
The CPU utilization is low (under 40%), but there are high CPU wait states and write latencies, which indicates that the application is I/O bound on the attached storage rather than compute-bound.
Before making changes, the exact cause of performance degradation must be isolated.
2
Evaluate the current storage configuration limits.
The EBS gp3 volume is at the default baseline (3,000 IOPS and 125 MiB/s), which is insufficient during peak events.
Understanding baseline limits allows you to scale metrics to meet peak demand.
3
Select the most cost-effective and direct optimization.
Increasing the provisioned IOPS and throughput on the gp3 volumes scales I/O performance dynamically without requiring larger instances or scaling up storage capacity.
This directly resolves the I/O bottleneck at the lowest cost.

Key Concept

EBS gp3 volumes support independent provisioning of storage capacity, IOPS, and throughput, allowing performance optimization without scaling storage size.
Question 1115Question →

An enterprise operates a transaction processing application in us-east-1 within AWS Account A. The database tier uses a Multi-AZ Amazon Aurora PostgreSQL DB cluster, and the application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The EC2 instances reside in private subnets and route outbound API validation traffic through a single NAT Gateway located in a single public subnet.

To enhance disaster recovery (DR) and reliability, the company plans to establish a warm standby DR environment in us-west-2 within AWS Account B. The target recovery time objective (RTO) is 10 minutes, and the recovery point objective (RPO) is 1 minute. The database tier will be replicated using Amazon Aurora Global Database. A Private Hosted Zone (PHZ) named corp.internal in Account A is used to map database connections to db.corp.internal.

Which TWO actions should the Solutions Architect take to configure the warm standby environment to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Authorize the association of the corp.internal Private Hosted Zone in Account A with the VPC in Account B using the Route 53 API or AWS CLI, and then associate the VPC in Account B with the Private Hosted Zone.; Deploy a NAT Gateway in each Availability Zone in the standby VPC in us-west-2, and configure the private subnet route tables to direct outbound traffic to the local NAT Gateway within the same Availability Zone.

Answer

To configure the standby environment for disaster recovery and reliability, the Solutions Architect must authorize the cross-account Private Hosted Zone association from Account A to Account B's VPC, and deploy redundant NAT Gateways across all Availability Zones in the standby region.
Authorizing the cross-account Private Hosted Zone association from Account A to Account B's standby VPC ensures correct, low-latency private DNS resolution of db.corp.internal in the standby region. Deploying a NAT Gateway in each Availability Zone in the standby VPC eliminates single points of failure for outbound third-party API traffic, meeting reliability objectives.

Step-by-Step Solution

1
Configure cross-account DNS resolution for the database endpoint.
Authorized the association of the corp.internal Private Hosted Zone from Account A using the AWS CLI command 'aws route53 create-vpc-association-authorization', and then accepted it in Account B using 'aws route53 associate-vpc-with-hosted-zone'.
This allows EC2 instances in Account B's VPC to resolve db.corp.internal to the database endpoints without introducing complex routing endpoints or split-horizon DNS conflicts.
2
Ensure egress high availability in the standby region.
Deployed a NAT Gateway in each public subnet across multiple Availability Zones in us-west-2, and updated the private subnet route tables to direct 0.0.0.0/0 traffic to the NAT Gateway in the respective zone.
This eliminates the single point of failure for outbound traffic, which is critical for making API validation calls during failover scenarios.

Key Concept

Establishing cross-account DNS resolution and multi-Availability Zone NAT Gateway redundancy to build a highly reliable multi-region disaster recovery environment.
Question 1116Question →

An enterprise is building a global media streaming platform in the eu-west-1 Region. The architecture is deployed across three VPCs:

- vpc-ingest: Houses public-facing Application Load Balancers (ALBs) that receive high-throughput video streams.
- vpc-processing: Contains transcoding worker nodes running in private subnets across two Availability Zones (eu-west-1a and eu-west-1b). The workers require outbound internet connectivity to fetch libraries, but must not accept inbound connections.
- vpc-shared: Contains central security tools and a Route 53 Private Hosted Zone (PHZ) named internal.media.platform that resolves internal service endpoints.

An AWS Transit Gateway (tgw-central) is deployed to interconnect all three VPCs. The enterprise wants to centralize all egress internet traffic from vpc-processing through vpc-shared to reduce NAT Gateway costs and centralize security inspections. The egress routing must be highly available and resilient to Availability Zone failures. Additionally, resources in all three VPCs must be able to resolve DNS queries for internal.media.platform.

Which combination of actions must the Solutions Architect perform to configure the network routing and DNS resolution to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In vpc-shared, deploy a public NAT Gateway in both eu-west-1a and eu-west-1b. Configure the route tables of the Transit Gateway attachment subnets in vpc-shared such that the default route 0.0.0.0/0 in eu-west-1a points to the NAT Gateway in eu-west-1a, and the default route 0.0.0.0/0 in eu-west-1b points to the NAT Gateway in eu-west-1b.; Authorize the association of the Private Hosted Zone internal.media.platform in the Shared Services AWS account with vpc-ingest and vpc-processing using the AWS CLI or Route 53 API, and then associate the zone from the respective spoke accounts.

Answer

Deploy a public NAT Gateway in both Availability Zones in vpc-shared and configure the route tables of the Transit Gateway attachment subnets to route traffic locally to each NAT Gateway. Additionally, authorize and associate the Private Hosted Zone with the spoke VPCs.
Deploying public NAT Gateways in both Availability Zones and pointing the respective Transit Gateway subnet route tables to the local NAT Gateway ensures that traffic remains within the same Availability Zone, eliminating cross-AZ dependencies and single points of failure. Associating the Route 53 Private Hosted Zone with the spoke VPCs via cross-account authorizations ensures that instances in all VPCs can natively resolve internal DNS records without incurring resolver endpoint costs.

Step-by-Step Solution

1
Configure centralized NAT Gateways in vpc-shared.
Two public NAT Gateways are created in eu-west-1a and eu-west-1b public subnets of vpc-shared.
This establishes redundant internet egress paths in each Availability Zone, removing single points of failure.
2
Configure Transit Gateway subnet routing in vpc-shared.
The route tables for the subnets containing the Transit Gateway elastic network interfaces (ENIs) are updated to point 0.0.0.0/0 to the local public NAT Gateway in the same Availability Zone.
This maintains AZ affinity and isolation, ensuring that traffic originating from an AZ in a spoke VPC remains in the same AZ when routed through Transit Gateway to the NAT Gateway.
3
Authorize and associate the Private Hosted Zone.
Create a VPC association authorization for vpc-ingest and vpc-processing in the Shared Services account, then run the associate command in the spoke accounts.
This allows instances in the spoke VPCs to query and resolve internal DNS hostnames in the private hosted zone.

Key Concept

Designing high-availability centralized egress architectures using AWS Transit Gateway and managing Route 53 Private Hosted Zones across multiple AWS accounts.
Question 1117Question →

An enterprise runs a media transcoding application on Amazon ECS tasks (AWS Fargate) in a multi-AZ VPC in the us-east-1 Region. The application uses an Amazon Aurora PostgreSQL database cluster for metadata storage. Internal microservices communicate within the VPC using private DNS names registered in a Route 53 Private Hosted Zone (PHZ).

To enhance reliability, a solutions architect must design a disaster recovery (DR) solution in the us-west-2 Region. The solution must achieve a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 2 minutes.

Which set of actions should the solutions architect take to meet these disaster recovery requirements?

Show answer & explanation

Answer: Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Pre-deploy the Amazon ECS service in us-west-2 with a minimum task count of 1. Associate the existing Route 53 Private Hosted Zone with the VPC in us-west-2, and configure Route 53 failover routing records with active health checks associated with the primary Application Load Balancer.

Answer

The correct strategy involves configuring Amazon Aurora Global Database, pre-deploying a warm standby Amazon ECS service in the secondary region, associating the Private Hosted Zone with both VPCs, and using Route 53 failover routing with active health checks.
The correct architecture leverages Amazon Aurora Global Database, which offers cross-region replication with an RPO of under 1 second, easily meeting the 2-minute RPO requirement. By pre-deploying the Amazon ECS service with a minimum task count of 1 in the standby region (warm standby), the system can handle initial traffic immediately, satisfying the 15-minute RTO requirement. Associating the Route 53 Private Hosted Zone with the VPCs in both regions enables seamless private DNS resolution for internal microservices when traffic fails over. Configuring Route 53 failover routing records with active health checks on the primary Application Load Balancer enables automated failover to the standby region if the primary region experiences an outage.

Step-by-Step Solution

1
Establish a database replication strategy between the primary region (us-east-1) and the secondary region (us-west-2).
Configure Amazon Aurora Global Database.
Aurora Global Database provides sub-second replication latency, satisfying the RPO requirement of less than 2 minutes.
2
Deploy the containerized application tier in the secondary region (us-west-2).
Configure the Amazon ECS service as a warm standby with a minimum task count of 1.
Having at least one running task pre-registered with the load balancer ensures instant traffic handling, meeting the RTO requirement of less than 15 minutes.
3
Enable private DNS resolution for the internal microservices in both VPCs.
Associate the Route 53 Private Hosted Zone with both the us-east-1 and us-west-2 VPCs.
Allows microservices in the secondary region to resolve private DNS names and communicate with each other after failover.
4
Configure DNS failover routing for the application endpoints.
Set up Route 53 failover routing records with active health checks linked to the primary Application Load Balancer.
Enables automatic failover to the secondary region if the primary region's Application Load Balancer becomes degraded.

Key Concept

Multi-region disaster recovery, database replication latency, and Private Hosted Zone cross-VPC association.
Estimated Time:2m 0s
Question 1118Question →

A financial service provider operates a real-time payment validation platform backed by an Amazon Aurora MySQL database cluster. During high-volume marketing campaigns, the platform experiences transaction failures due to database connection exhaustion and latency spikes, with database CPU utilization on the primary writer exceeding 90%90\%. The transaction validation workflow has two distinct database operations: user profile and ledger validation checks that require strong, up-to-date read-after-write consistency, and real-time audit logging combined with fraud-detection analytics queries that can tolerate eventual consistency of up to 10 seconds10\text{ seconds}. The database currently runs on a provisioned Multi-AZ deployment without any reader instances. A Solutions Architect must optimize the database layer to resolve connection and CPU bottlenecks, minimize response latency, and maintain high availability during traffic spikes. Which two actions should the Solutions Architect implement to achieve these goals? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Amazon RDS Proxy between the application layer and the Aurora MySQL DB cluster to pool database connections.; Modify the application configuration to route user profile and ledger validation queries to the Aurora primary cluster endpoint, and direct the fraud-detection analytics queries to the Aurora reader endpoint with Aurora Auto Scaling enabled.

Answer

Deploy Amazon RDS Proxy between the application layer and the Aurora MySQL DB cluster to pool database connections, and modify the application configuration to route user profile and ledger validation queries to the Aurora primary cluster endpoint, and direct the fraud-detection analytics queries to the Aurora reader endpoint with Aurora Auto Scaling enabled.
Deploying Amazon RDS Proxy allows the system to pool and share database connections, which prevents database connection exhaustion and reduces CPU utilization on the primary writer. Routing the user profile and ledger validation queries (which require strong consistency) to the primary writer cluster endpoint ensures read-after-write consistency, while offloading the eventual-consistency-tolerant fraud-detection queries to the Aurora reader endpoint (scaled automatically via Aurora Auto Scaling) resolves the CPU bottleneck and optimizes read performance.

Step-by-Step Solution

1
Address the database connection exhaustion and CPU spikes caused by connection overhead.
Implement Amazon RDS Proxy to pool and share database connections.
RDS Proxy reduces database CPU overhead by establishing a pool of reusable connections, eliminating the need to repeatedly open and close connections on the DB instances during traffic spikes.
2
Analyze the consistency requirements for the payment validation workflow.
Identify that user profile and ledger checks require strong read-after-write consistency, whereas fraud-detection analytics queries can tolerate up to 10 seconds of replication lag.
Queries requiring strong consistency must be routed to the writer endpoint (primary instance), while queries that can tolerate eventual consistency can be offloaded to readers.
3
Optimize the database cluster scaling to handle the offloaded read traffic.
Create Aurora Replicas (readers) and configure Aurora Auto Scaling based on metrics like CPU utilization.
Aurora Auto Scaling dynamically adjusts the number of reader instances to accommodate surge read traffic, ensuring high availability and cost optimization.
4
Evaluate and discard invalid architecture options.
Discard Memcached for replication, standby instances for reads, and DAX for relational databases.
Memcached does not support multi-AZ replication or failover; standby nodes in traditional Multi-AZ cannot serve read traffic; DAX is exclusive to DynamoDB.

Key Concept

Database connection pooling and read replica offloading with scaling adjustments based on query consistency requirements.
Question 1119Question →

A company is implementing a centralized logging strategy across its multi-account AWS environment managed by AWS Organizations. The security team has configured an organization trail to deliver log files from all member accounts to a centralized Amazon S3 bucket in a dedicated Security account. To comply with corporate data protection standards, all logs stored in the S3 bucket must be encrypted at rest using an AWS KMS key. Currently, CloudTrail is failing to deliver the log files to the S3 bucket. Which configuration will resolve this issue and meet the compliance requirements using the principle of least privilege?

Show answer & explanation

Answer: Create a Customer Managed Key (CMK) in the Security account. Configure the CMK's key policy to grant the AWS CloudTrail service principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey operations, restricted to the organization's trail ARN. Update the S3 bucket policy in the Security account to grant the CloudTrail service principal permissions to perform s3:PutObject and s3:GetBucketAcl using the aws:PrincipalOrgID condition, and set the S3 bucket's default encryption to use the CMK.

Answer

Create a Customer Managed Key (CMK) in the Security account, granting the AWS CloudTrail service principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey operations in the key policy. Configure the S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject and s3:GetBucketAcl actions with an organization condition, and configure S3 default encryption to use the CMK.
The correct solution involves creating a Customer Managed Key (CMK) in the Security account because AWS-managed keys cannot have their key policies modified and do not support cross-account sharing. The CMK's key policy must permit the CloudTrail service principal to perform key operations (kms:GenerateDataKey* and kms:DescribeKey) so it can encrypt the logs. Additionally, the S3 bucket policy must grant the CloudTrail service principal permissions to perform s3:PutObject and s3:GetBucketAcl using the aws:PrincipalOrgID condition to restrict access to only member accounts within the Organization.

Step-by-Step Solution

1
Analyze the log delivery path for an organization trail.
Identify that AWS CloudTrail acts as a service principal (cloudtrail.amazonaws.com) when delivering logs, not as individual member account IAM roles.
This establishes that permissions in S3 and KMS must target the CloudTrail service principal.
2
Evaluate the encryption requirements for cross-account log delivery.
Determine that AWS-managed KMS keys (like aws/s3) cannot be modified or shared cross-account, necessitating a Customer Managed Key (CMK).
Since member accounts are delivering logs to a centralized bucket in the Security account, a CMK in the Security account must be used and configured with a key policy allowing the CloudTrail service principal access.
3
Formulate the correct S3 bucket policy and KMS key policy permissions.
The S3 bucket policy must allow s3:PutObject for the CloudTrail principal with an OrgID condition, and the KMS key policy must allow kms:GenerateDataKey* for the CloudTrail principal.
This satisfies the least-privilege access model while enabling functional cross-account log encryption and delivery.

Key Concept

Cross-account log delivery with S3 and KMS key management requires a Customer Managed Key (CMK) because AWS-managed keys cannot be shared cross-account, and the S3 bucket policy and KMS key policy must explicitly authorize the CloudTrail service principal.
Question 1120Question →

A global financial conglomerate is designing a compliance-audited transaction archiving system. An application running on AWS Fargate in the Transaction Processing Account (111111111111) must write hourly transaction logs to an Amazon S3 bucket in a central Audit Account (222222222222). The compliance mandates require that:
1. All logs must be encrypted at rest using a customer managed key (CMK) in AWS KMS. The CMK must reside in the Audit Account.
2. The Fargate task role in the Transaction Processing Account must have the minimum necessary permissions to write the logs but must not be able to read or modify any logs in the S3 bucket.
3. The Audit Account must automatically own all uploaded logs, and all Access Control Lists (ACLs) must be disabled on the bucket.
4. The KMS key policy must enforce least privilege, allowing only the Fargate task role and the Audit Account's administrators to use the key.

Which of the following configurations meets these requirements?

Show answer & explanation

Answer: In the Audit Account, configure S3 Object Ownership to Bucket Owner Enforced on the destination bucket. Create a customer managed KMS key in the Audit Account and configure its key policy to grant the Fargate task role ARN in the Transaction Processing Account permissions for kms:GenerateDataKey and kms:Decrypt. In the Audit Account's S3 bucket policy, grant the Fargate task role ARN permission for s3:PutObject. In the Transaction Processing Account, attach an IAM policy to the Fargate task role allowing s3:PutObject on the Audit bucket and kms:GenerateDataKey and kms:Decrypt on the Audit Account's KMS key.

Answer

The correct configuration uses S3 Bucket Owner Enforced to disable ACLs and transfer ownership, uses a customer managed KMS key in the destination account with policy permissions explicitly granted to the cross-account role, and configures matching local IAM and bucket policies for the Fargate task role.
The correct configuration uses S3 Object Ownership set to Bucket Owner Enforced, which successfully disables ACLs and ensures that the Audit Account automatically owns all uploaded files. Since AWS-managed keys cannot be shared across accounts, a customer managed key is deployed in the Audit Account. The key policy is modified to grant the Fargate task role in the Transaction Processing Account permissions for kms:GenerateDataKey and kms:Decrypt (which are necessary to initiate and complete multipart S3 uploads). Matching IAM policies in the source account and S3 bucket policies in the destination account ensure the write-only trust relationship is authorized.

Step-by-Step Solution

1
Disable ACLs on the destination S3 bucket in the Audit Account.
Configure S3 Object Ownership to Bucket Owner Enforced. This automatically transfers ownership of all cross-account uploaded objects to the Audit Account and disables ACLs.
This satisfies the requirement to disable all ACLs and automatically assign ownership of all written objects to the Audit Account.
2
Create and configure a Customer Managed Key (CMK) in the Audit Account.
Create the KMS CMK. Modify its key policy to explicitly grant the Fargate task role ARN from the Transaction Processing Account permission to perform kms:GenerateDataKey and kms:Decrypt.
An AWS managed key (aws/s3) cannot be shared cross-account. The external role needs kms:GenerateDataKey and kms:Decrypt to write encrypted objects (including multipart uploads) to the bucket.
3
Configure the S3 bucket policy in the Audit Account.
Add a statement to the bucket policy granting the specific Fargate task role ARN permission for s3:PutObject.
This establishes the necessary trust boundary and allows cross-account write access strictly for the designated application role.
4
Configure the IAM policy of the Fargate task in the Transaction Processing Account.
Attach an IAM policy to the Fargate task role permitting s3:PutObject on the Audit S3 bucket and kms:GenerateDataKey/kms:Decrypt on the Audit Account KMS key ARN.
IAM permissions must exist in the source account to authorize outbound requests to external resources.

Key Concept

Cross-account security and compliance control design using S3 Object Ownership (Bucket Owner Enforced), Customer Managed KMS Keys, and explicit resource policies.
Estimated Time:3m 0s
PreviousPage 56 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin