All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A utility company operates a critical smart grid telemetry application across two accounts in an AWS Organization: a Network account and a Workload account. The application currently runs in a single active Region (us-west-2). In the Workload account, the application tier consists of Amazon ECS tasks running on AWS Fargate in private subnets, fronted by an internal Application Load Balancer (ALB). The database tier runs on an Amazon Aurora PostgreSQL database cluster. The Workload VPC is connected to a central VPC in the Network account via an AWS Transit Gateway. Internal DNS resolution for grid.utility.internal is managed via a Route 53 Private Hosted Zone (PHZ) in the Network account, associated with the Network VPC.

The company needs to establish a Warm Standby disaster recovery (DR) solution in a secondary Region (us-east-1). The DR solution must support a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes.

Which architectural modification will meet these requirements while ensuring reliable failover and DNS resolution?

Configure hourly AWS Backup copy jobs to replicate Aurora snapshots from the active Region to the standby Region. Deploy the ECS cluster and Fargate task definitions in the standby Region with a desired capacity of zero. Associate the standby VPC with the Route 53 Private Hosted Zone using a cross-account IAM role. Deploy a single NAT Gateway in the standby VPC's public subnet to save costs. During failover, restore the database from the latest snapshot, scale up the ECS tasks, and manually update the Route 53 Private Hosted Zone records.

Promote the database to an Amazon Aurora Global Database with the primary cluster in the active Region and a secondary cluster in the standby Region. Pre-deploy the ECS tasks at a minimal scale in the standby Region's VPC. Connect the standby VPC to the Transit Gateway, relying on Transit Gateway's transitive routing to resolve DNS queries via the existing association in the Network account without creating a new VPC association for the Private Hosted Zone. Deploy a NAT Gateway in each Availability Zone of the standby VPC. Configure Route 53 active-passive failover routing records pointing to the primary and secondary Application Load Balancers.

Promote the database to an Amazon Aurora Global Database with the primary cluster in the active Region and a secondary cluster in the standby Region. Pre-deploy the ECS tasks at a minimal scale in the standby Region's VPC. Submit a VPC association authorization from the Network account for the standby VPC, and associate the standby VPC with the Route 53 Private Hosted Zone from the Workload account. Deploy a NAT Gateway in each Availability Zone of the standby VPC. Configure Route 53 Application Recovery Controller (ARC) routing controls to orchestrate failover, using Route 53 health checks associated with the routing controls to manage traffic redirection.

Promote the database to an Amazon Aurora Global Database with the primary cluster in the active Region and a secondary cluster in the standby Region. Pre-deploy the ECS tasks at a minimal scale in the standby Region's VPC. Submit a VPC association authorization from the Network account for the standby VPC, and associate the standby VPC with the Route 53 Private Hosted Zone from the Workload account. Deploy a NAT Gateway in each Availability Zone of the standby VPC. Configure Route 53 failover records with Evaluate Target Health set to false and without Route 53 health checks, relying on AWS Transit Gateway route propagation to automatically redirect user traffic when the active Region becomes unreachable.

Show answer & explanation

Answer: Promote the database to an Amazon Aurora Global Database with the primary cluster in the active Region and a secondary cluster in the standby Region. Pre-deploy the ECS tasks at a minimal scale in the standby Region's VPC. Submit a VPC association authorization from the Network account for the standby VPC, and associate the standby VPC with the Route 53 Private Hosted Zone from the Workload account. Deploy a NAT Gateway in each Availability Zone of the standby VPC. Configure Route 53 Application Recovery Controller (ARC) routing controls to orchestrate failover, using Route 53 health checks associated with the routing controls to manage traffic redirection.

Answer

The correct recommendation is to promote the database to an Amazon Aurora Global Database, pre-deploy ECS tasks at a minimal scale in the standby Region, authorize and associate the standby VPC with the Route 53 Private Hosted Zone cross-account, deploy redundant NAT Gateways per Availability Zone, and use Route 53 Application Recovery Controller (ARC) routing controls to orchestrate failover.

The correct recommendation ensures that all constraints of the multi-account, multi-region environment are met. Using Amazon Aurora Global Database keeps replication lag under a second, meeting the 5-minute RPO. The Warm Standby pattern with ECS Fargate tasks running at a minimal scale allows the application to scale up within the 15-minute RTO. Authorizing and associating the standby VPC cross-account ensures that ECS tasks in the standby Region can resolve grid.utility.internal. NAT Gateways in each Availability Zone ensure outbound connectivity is highly available, avoiding single points of failure. Finally, Route 53 ARC routing controls provide safe, deterministic failover management.

Step-by-Step Solution

Implement low-latency database replication across Regions.

Amazon Aurora Global Database provides physical, storage-based replication with latency typically under 1 second.

This satisfies the strict 5-minute Recovery Point Objective (RPO) constraint.

Configure the standby application tier compute resources.

Pre-deploying ECS tasks at a minimal scale ensures a Warm Standby is ready to accept traffic and can be scaled out in minutes.

This enables meeting the 15-minute Recovery Time Objective (RTO) constraint.

Establish secure cross-account internal DNS resolution.

Authorize the standby VPC association from the Network account containing the Private Hosted Zone (PHZ), then associate it from the Workload account.

VPCs must be explicitly associated with a Route 53 Private Hosted Zone to resolve its records; this cannot be done transitively over AWS Transit Gateway.

Ensure egress redundancy in the standby Region.

Deploy a NAT Gateway in each Availability Zone of the standby VPC.

This prevents a single NAT Gateway failure from disabling outbound connectivity for the entire application tier in the standby Region.

Configure the global routing failover mechanism.

Implement Route 53 Application Recovery Controller (ARC) routing controls linked to Route 53 health checks.

This provides a highly reliable failover controller that can execute coordinated failovers across Regions without relying on local resource health check loops.

Key Concept

Multi-region disaster recovery planning requires coordinating storage replication (RPO), compute readiness (RTO), cross-account Private Hosted Zone DNS associations, and robust health-checked routing failovers.

Question 1142Question →

A company manages a multi-account environment using AWS Organizations. The application architecture spans several member accounts, utilizing Amazon EC2 instances in an Auto Scaling group, containerized microservices on AWS Fargate, and serverless background tasks running on AWS Lambda. To reduce compute costs, the solutions architect needs to recommend a Savings Plan to be purchased in the organization's management account. The plan must offer maximum flexibility to automatically apply to EC2, Fargate, and Lambda across all member accounts without requiring manual allocation. Which Savings Plan should the solutions architect recommend?

Compute Savings Plans, because they automatically apply to EC2 instances, AWS Fargate, and AWS Lambda usage across all accounts in the organization, regardless of instance family, region, or operating system.

EC2 Instance Savings Plans, because they offer the deepest discounts and automatically apply to EC2, Fargate, and Lambda usage across the entire organization.

Compute Savings Plans, but the plans must be shared manually with each member account using AWS Resource Access Manager (RAM) to allow sharing across the organization.

EC2 Instance Savings Plans, combined with deploying a centralized NAT Gateway in a single Availability Zone to route all outbound Fargate and Lambda traffic through it to consolidate network costs.

Show answer & explanation

Answer: Compute Savings Plans, because they automatically apply to EC2 instances, AWS Fargate, and AWS Lambda usage across all accounts in the organization, regardless of instance family, region, or operating system.

Answer

Compute Savings Plans offer the greatest flexibility by automatically applying to EC2, Fargate, and Lambda usage across all accounts in an AWS Organization, regardless of instance family, size, region, or operating system, with no manual allocation required.

Step-by-Step Solution

Analyze the compute services utilized in the multi-account architecture.

The architecture utilizes a combination of Amazon EC2, AWS Fargate, and AWS Lambda.

Identifying all compute services is critical to selecting a Savings Plan type that covers all of them.

Evaluate the coverage of the different Savings Plan types.

Compute Savings Plans cover EC2, Fargate, and Lambda, whereas EC2 Instance Savings Plans only cover EC2.

This comparison determines which plan can cover the diverse compute resources in the environment.

Determine how Savings Plans are shared and managed in a multi-account environment.

Savings Plans purchased at the management account automatically apply across all member accounts in the AWS Organization without using AWS Resource Access Manager.

Understanding organizational sharing ensures the proposed solution requires minimal administrative overhead.

Key Concept

Compute Savings Plans provide the flexibility needed to cover heterogeneous compute resources (EC2, Fargate, Lambda) automatically across all accounts in an AWS Organization.

Question 1143Question →

A retail corporation is designing a new multi-account AWS environment in the us-west-2 Region. The architecture contains three spoke VPCs named vpc-prod-spoke, vpc-dev-spoke, and vpc-test-spoke, along with a central shared services VPC named vpc-shared-services. The spoke VPCs require outbound internet access to download software updates and must resolve internal domain names hosted in a Route 53 Private Hosted Zone (PHZ) named corp.internal that is managed within vpc-shared-services. The solution must be highly resilient across multiple Availability Zones, minimize configuration complexity, and prevent transitive routing limitations. Which architecture meets these requirements?

Establish an AWS Transit Gateway named tgw-central and attach vpc-prod-spoke, vpc-dev-spoke, vpc-test-spoke, and vpc-shared-services. In vpc-shared-services, deploy redundant NAT Gateways across two Availability Zones. Route outbound traffic (

0.0.0.0/0

) from the spoke VPCs to tgw-central, which directs it to the NAT Gateways in vpc-shared-services. Associate the corp.internal Route 53 Private Hosted Zone with all four VPCs.

Establish an AWS Transit Gateway named tgw-central and attach vpc-prod-spoke, vpc-dev-spoke, vpc-test-spoke, and vpc-shared-services. In vpc-shared-services, deploy a single NAT Gateway in a single Availability Zone. Route outbound traffic (

0.0.0.0/0

) from the spoke VPCs to tgw-central, which directs it to the single NAT Gateway in vpc-shared-services. Associate the corp.internal Route 53 Private Hosted Zone with all four VPCs.

0.0.0.0/0

) from the spoke VPCs to tgw-central, which directs it to the NAT Gateways in vpc-shared-services. Associate the corp.internal Route 53 Private Hosted Zone only with vpc-shared-services, relying on Transit Gateway to route DNS queries transitively from the spoke VPCs.

Establish VPC Peering connections between each spoke VPC and vpc-shared-services. In vpc-shared-services, deploy redundant NAT Gateways across two Availability Zones. Route outbound traffic (

0.0.0.0/0

) from the spoke VPCs transitively through the VPC Peering connections to the NAT Gateways in vpc-shared-services. Associate the corp.internal Route 53 Private Hosted Zone with all four VPCs.

Show answer & explanation

Answer: Establish an AWS Transit Gateway named tgw-central and attach vpc-prod-spoke, vpc-dev-spoke, vpc-test-spoke, and vpc-shared-services. In vpc-shared-services, deploy redundant NAT Gateways across two Availability Zones. Route outbound traffic ( $0.0.0.0/0$ ) from the spoke VPCs to tgw-central, which directs it to the NAT Gateways in vpc-shared-services. Associate the corp.internal Route 53 Private Hosted Zone with all four VPCs.

Answer

Establish an AWS Transit Gateway named tgw-central and attach all four VPCs. Deploy redundant NAT Gateways in two Availability Zones in the shared services VPC to route outbound traffic, and associate the Private Hosted Zone with all four VPCs.

The correct solution uses AWS Transit Gateway to interconnect the VPCs and direct outbound traffic to the central shared services VPC. Redundant NAT Gateways deployed across two Availability Zones guarantee that outbound connectivity is highly available and resilient to AZ failures. Associating the Route 53 Private Hosted Zone with all four VPCs ensures that resources in all VPCs can resolve the internal domain names.

Step-by-Step Solution

Configure AWS Transit Gateway attachments for all spoke VPCs and the shared services VPC.

Establishes a hub-and-spoke topology allowing VPC-to-VPC and egress connectivity.

Provides a scalable, non-transitive route path to route traffic from spokes to the central egress VPC.

Deploy redundant NAT Gateways in different Availability Zones within the public subnets of the shared services VPC.

Ensures that if an Availability Zone fails, outbound traffic can still route through the NAT Gateway in the remaining Availability Zone.

Meets the high resiliency requirement for outbound traffic egress.

Associate the Route 53 Private Hosted Zone with all VPCs (vpc-prod-spoke, vpc-dev-spoke, vpc-test-spoke, and vpc-shared-services).

Enables resources in all four VPCs to resolve queries for the corp.internal domain.

Route 53 PHZ resolution is local to associated VPCs and cannot be routed transitively via Transit Gateway.

Key Concept

Multi-VPC architecture utilizing AWS Transit Gateway for centralized egress with redundant NAT Gateways, combined with cross-account Route 53 Private Hosted Zone association.

Question 1144Question →

A gaming company has a telemetry platform deployed across two AWS accounts: Account A holds the primary application tier (Application Load Balancer (ALB) and Amazon EC2 instances in us-east-1) and Account B holds the disaster recovery warm standby tier (ALB and EC2 instances in us-west-2). The database layer is an Amazon Aurora Global Database spanning both Regions. The company's private internal network resolution uses a Route 53 Private Hosted Zone (PHZ) hosted in Account A.

During a simulated outage of the us-east-1 Region, internal services in Account B were unable to resolve the database and application endpoints, and Route 53 failed to automatically redirect internal client traffic to the secondary ALB. Additionally, the Solutions Architect must ensure outbound traffic from the secondary application tier in us-west-2 has redundant paths to the internet to prevent single-AZ failures from blocking replication or telemetry collection.

Which TWO steps should the Solutions Architect take to resolve these issues and ensure reliable multi-region failover? (Select TWO.)

Select all that apply

Associate the Private Hosted Zone in Account A with the VPC in Account B. Authorize the cross-account association from Account A, and then associate the VPC in Account B using the AWS CLI or SDK.

Configure Route 53 failover routing records for the Application Load Balancer endpoints within the Private Hosted Zone. Associate the primary record with a Route 53 health check that monitors the primary application, and enable Evaluate Target Health.

Create a duplicate Route 53 Private Hosted Zone with the exact same domain name in Account B, associate it with the VPC in Account B, and configure duplicate DNS records pointing to the local resources in us-west-2.

Configure the Route 53 failover records using a 0-second TTL and remove all health check associations to allow clients to query the secondary ALB immediately upon connection timeout.

Deploy a single NAT Gateway in a public subnet of the us-west-2 VPC, and configure the route tables of all private subnets to point to it, optimizing cost during warm standby mode.

Show answer & explanation

Answer: Associate the Private Hosted Zone in Account A with the VPC in Account B. Authorize the cross-account association from Account A, and then associate the VPC in Account B using the AWS CLI or SDK.; Configure Route 53 failover routing records for the Application Load Balancer endpoints within the Private Hosted Zone. Associate the primary record with a Route 53 health check that monitors the primary application, and enable Evaluate Target Health.

Answer

Authorize and associate the Private Hosted Zone from Account A with the VPC in Account B, and configure Route 53 failover routing records for the Application Load Balancers with active health checks.

The correct actions involve configuring cross-account Private Hosted Zone association to allow the secondary VPC to resolve database and application endpoints, and configuring Route 53 failover routing with active health checks or Evaluate Target Health to automatically redirect traffic. Because Private Hosted Zones are isolated to the associated VPCs, the VPC in Account B must be associated with the Private Hosted Zone in Account A to perform lookup queries. Furthermore, Route 53 relies on health checks to determine the state of the primary endpoint; without health checks, DNS queries remain directed to the primary region even during an outage.

Step-by-Step Solution

Authorize cross-account association of the Private Hosted Zone.

Allows Account B to associate its VPC with Account A's Private Hosted Zone.

Solves the internal DNS name resolution issue in the warm standby VPC during failover.

Configure Route 53 failover records with health checks.

Enables automatic traffic redirection during primary Region degradation.

Ensures RTO targets are met by automatically failing over DNS queries to the secondary ALB.

Key Concept

Disaster recovery failover routing and cross-account DNS resolution in multi-region environments.

Question 1145Question →

A financial services company manages its infrastructure across multiple AWS accounts within an AWS Organization. A central operations account is used to deploy and manage a standardized baseline of VPC security groups across all member accounts using AWS CloudFormation StackSets. The templates are stored in an Amazon S3 bucket in the operations account, which is encrypted using an AWS KMS key. The security policy requires that any manual modifications to these managed security groups in the member accounts must be automatically detected and remediated within one hour. Additionally, updates to the security group baseline templates must be rolled out incrementally; if a deployment fails in any single member account, the rollout must stop immediately and the affected account must be rolled back, without impacting other compliant accounts. Which combination of actions will meet these requirements in the most secure and automated manner?

Encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to allow cross-account access for the member accounts. Deploy the AWS Config managed rule 'cloudformation-stack-drift-detection-check' across all member accounts using an organization conformance pack. In the operations account, configure an Amazon EventBridge rule that triggers on compliance status change events from an AWS Config aggregator. Set the rule target to an AWS Systems Manager Automation document that executes the 'UpdateStackInstances' API with deployment targeting parameters set to the specific drifted account and region. During template updates, set the StackSet deployment preferences FailureToleranceCount to 0 and MaxConcurrentCount to 1.

Encrypt the S3 bucket using the default AWS-managed key for Amazon S3 (aws/s3). Deploy the AWS Config managed rule 'cloudformation-stack-drift-detection-check' in each member account. Configure an Amazon EventBridge rule in each member account that triggers a local AWS Lambda function to delete the drifted security groups and recreate them via the AWS CLI. During template updates, configure the StackSet deployment preferences to use an AWS CodeDeploy linear canary deployment strategy with dynamic rollback alarms.

Encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to allow cross-account access. Attach a Service Control Policy (SCP) to the root of the AWS Organization that denies the 'ec2:AuthorizeSecurityGroupIngress' and 'ec2:RevokeSecurityGroupIngress' actions for all IAM roles except for the CloudFormation service-linked role. Use an AWS Config rule to monitor the configuration. During template updates, deploy the StackSets with a FailureToleranceCount of 0 and a MaxConcurrentCount of 100% to ensure simultaneous updates and rapid validation.

Encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to allow cross-account access. Configure AWS CloudFormation drift detection at the StackSet level and set up an AWS Systems Manager State Manager association to trigger drift detection daily. If drift is detected, configure the automation to run the 'DeleteStackInstances' API for the drifted account and region, followed by 'CreateStackInstances' to recreate them. During template updates, set the StackSet deployment preferences FailureToleranceCount to 5 and MaxConcurrentCount to 1.

Show answer & explanation

Answer: Encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to allow cross-account access for the member accounts. Deploy the AWS Config managed rule 'cloudformation-stack-drift-detection-check' across all member accounts using an organization conformance pack. In the operations account, configure an Amazon EventBridge rule that triggers on compliance status change events from an AWS Config aggregator. Set the rule target to an AWS Systems Manager Automation document that executes the 'UpdateStackInstances' API with deployment targeting parameters set to the specific drifted account and region. During template updates, set the StackSet deployment preferences FailureToleranceCount to 0 and MaxConcurrentCount to 1.

Answer

Encrypt the S3 template bucket using a KMS Customer Managed Key with cross-account access. Use AWS Config Conformance Packs to deploy stack drift detection rules. Aggregate compliance events using an AWS Config aggregator, and use an EventBridge rule to trigger an AWS Systems Manager Automation document that runs the UpdateStackInstances API. Set the StackSet deployment preferences FailureToleranceCount to 0 and MaxConcurrentCount to 1.

The correct solution uses a Customer Managed Key (CMK) with appropriate key policies to allow cross-account access, which is a prerequisite for cross-account S3 template reading. Auto-remediation is accomplished via AWS Config drift detection rules deployed through conformance packs, which centralize drift alerts via an aggregator. Amazon EventBridge catches these events and triggers a Systems Manager Automation run of the UpdateStackInstances API, which safely reconciles the drift. Setting FailureToleranceCount to 0 and MaxConcurrentCount to 1 guarantees that updates are applied sequentially and halt immediately upon a single failure, ensuring safe deployments.

Step-by-Step Solution

Configure a KMS Customer Managed Key (CMK) with a key policy allowing cross-account decryption for member account roles.

Member accounts can successfully read and decrypt CloudFormation templates stored in the centralized Amazon S3 bucket.

AWS-managed KMS keys (like aws/s3) cannot be shared cross-account, so a Customer Managed Key is required.

Deploy the 'cloudformation-stack-drift-detection-check' managed rule to all member accounts using an AWS Config Organization Conformance Pack.

AWS Config automatically monitors CloudFormation stacks in all member accounts for configuration drift.

This detects manual changes to the security groups managed by CloudFormation within the required time window.

Set up an AWS Config aggregator in the central operations account, and configure an Amazon EventBridge rule that triggers on compliance change events.

Events indicating a stack has transitioned to a NON_COMPLIANT state are captured centrally.

Centralizing events allows a unified automation point for remediation across the organization.

Direct the EventBridge rule to target an SSM Automation document that executes the 'UpdateStackInstances' API with targeting parameters for the drifted account and region.

CloudFormation automatically updates the specific stack instance, overwriting manual drift and restoring the configuration baseline.

This automates the remediation back to the template state without deleting the resources or disrupting their associations.

For template updates, configure StackSet deployment preferences with FailureToleranceCount set to 0 and MaxConcurrentCount set to 1.

Updates are deployed to one account at a time. If any single deployment fails, the entire operation halts immediately.

This prevents failed updates from cascading to other accounts and meets the strict rollback requirement.

Key Concept

Multi-account configuration drift detection, cross-account KMS resource access, and safe AWS CloudFormation StackSets deployment policies.

Estimated Time:3m 0s

Question 1146Question →

A company needs to migrate $80\text{ TB}$ of data from an on-premises SMB file share to Amazon S3. The company has a $1\text{ Gbps}$ internet connection, but production traffic limits the available bandwidth for the migration to $50\text{ Mbps}$ . The migration must be completed within $10\text{ days}$ while minimizing overall transfer time. Once the bulk data is migrated, the company wants to continuously sync daily incremental changes over the network. Which two actions should the company take to meet these requirements?

Select all that apply

Order an AWS Snowball Edge Storage Optimized device to perform the initial bulk data transfer.

Deploy an AWS DataSync agent on-premises to sync incremental updates over the network after the bulk data is imported.

Use AWS DataSync to copy the entire dataset directly over the available network connection within the 10-day window.

Set up AWS Transfer for SFTP to perform the initial bulk data migration over the network.

Use an AWS Snowball Edge device configured with the default AWS-managed KMS key for Amazon S3 (aws/s3) to encrypt the bulk data.

Show answer & explanation

Answer: Order an AWS Snowball Edge Storage Optimized device to perform the initial bulk data transfer.; Deploy an AWS DataSync agent on-premises to sync incremental updates over the network after the bulk data is imported.

Answer

The company should order an AWS Snowball Edge Storage Optimized device to perform the initial bulk data transfer, and deploy an AWS DataSync agent on-premises to sync incremental updates over the network.

The correct actions are ordering an AWS Snowball Edge Storage Optimized device and deploying an AWS DataSync agent. Transferring

80\text{ TB}

over a

50\text{ Mbps}

network connection would take around

148\text{ days}

, which is too slow for the

10\text{ days}

requirement. Shipping the data using a Snowball Edge Storage Optimized device solves the bulk migration constraint. AWS DataSync is then used to sync daily incremental changes over the network.

Step-by-Step Solution

Calculate the total transfer time over the network using the available bandwidth.

The time to transfer

80\text{ TB}

(

6.4 \times 10^{14}\text{ bits}

) at

50\text{ Mbps}

is approximately

1.28 \times 10^7\text{ seconds}

, which is roughly

148\text{ days}

This identifies whether the online transfer window of

10\text{ days}

can be met.

Select the physical migration method for bulk data.

An AWS Snowball Edge Storage Optimized device is chosen for bulk transfer.

Shipping the device takes only a few days, enabling completion of the

80\text{ TB}

bulk migration within the

10\text{ days}

window.

Select the method for continuous daily synchronization.

An AWS DataSync agent is deployed on-premises to sync incremental updates over the network.

DataSync is optimized for network transfers and handles daily incremental updates efficiently without exceeding the

50\text{ Mbps}

bandwidth limit.

Key Concept

Large-Scale Data Transfer using Snow Family, DataSync, and Transfer Family

Question 1147Question →

A ride-hailing company operates its dispatch system on AWS, tracking real-time driver coordinates and matching them with passengers. The platform currently uses a single multi-AZ Amazon RDS for PostgreSQL database instance to store and update active driver coordinates and trip states. During peak hours, driver mobile applications update their GPS coordinates every 3 seconds, causing the database CPU utilization to exceed 90%. Simultaneously, passenger applications run frequent read-heavy geospatial queries to locate nearby drivers, resulting in query timeouts. The company needs an architectural improvement that reduces database CPU utilization, provides sub-millisecond latency for location queries, and guarantees high availability and zero data loss for active session states in the event of an infrastructure failure. Which database and caching strategy should a solutions architect implement to resolve these performance issues?

Deploy an Amazon RDS Proxy in front of the PostgreSQL database instance to manage connection pooling, and deploy an RDS Read Replica in a separate Availability Zone. Configure passenger applications to run geospatial queries against the read replica, and route driver coordinate updates to the primary DB instance via the RDS Proxy.

Migrate transient driver coordinate tracking and matchmaking queries to an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled. Use Redis geospatial commands to index coordinates and query nearby drivers. Configure the application to write only completed trip records and persistent transactional logs to the Amazon RDS PostgreSQL database.

Migrate transient driver coordinate tracking to an Amazon ElastiCache for Memcached cluster. Modify the passenger application to retrieve raw coordinates from Memcached and compute geospatial proximity locally on client devices. Periodically write batch updates of driver coordinates from the Memcached cluster back to the Amazon RDS PostgreSQL database.

Migrate driver coordinate data to an Amazon DynamoDB table and deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache read requests. Configure the matchmaking service to perform geospatial queries against DAX using the DynamoDB Geo Library, writing coordinate updates directly to the DynamoDB table.

Show answer & explanation

Answer: Migrate transient driver coordinate tracking and matchmaking queries to an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled. Use Redis geospatial commands to index coordinates and query nearby drivers. Configure the application to write only completed trip records and persistent transactional logs to the Amazon RDS PostgreSQL database.

Answer

Migrate transient driver coordinate tracking and matchmaking queries to an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled, utilizing Redis geospatial commands for location queries, and writing only persistent transactional records to the Amazon RDS PostgreSQL database.

Deploying an Amazon ElastiCache for Redis cluster is the optimal solution. It offloads transient, high-velocity coordinate updates and geospatial queries from the relational database to an in-memory data store. Redis geospatial data structures allow sub-millisecond spatial indexing and matchmaking queries, and Multi-AZ replication ensures high availability and durability of the session data.

Step-by-Step Solution

Analyze the bottleneck and data requirements.

Identify that the primary issue is the write-heavy updates (every 3 seconds per driver) combined with read-heavy geospatial queries on transient data (driver coordinates) causing CPU exhaustion on RDS PostgreSQL.

Determining whether the data is transient or persistent dictates whether it belongs in a relational database or a caching/in-memory tier.

Evaluate caching and in-memory options for geospatial operations.

Determine that Amazon ElastiCache for Redis natively supports geospatial indexing and querying with sub-millisecond latency.

Using native cache engine features minimizes application complexity and meets performance requirements.

Assess high availability and reliability requirements.

Rule out Memcached because it does not support replication, Multi-AZ failover, or persistence. Select ElastiCache for Redis with Multi-AZ replication to ensure zero data loss and high availability.

Session states and driver coordinates must be highly available and resilient to node failures.

Formulate the database offloading strategy.

Redirect high-frequency updates and queries to Redis, and write only transactional, persistent data (like completed trips) to RDS PostgreSQL.

Offloading transient, high-velocity writes from the relational database resolves the CPU bottleneck on the RDS instance.

Key Concept

Offloading high-velocity geospatial writes and transient session data to ElastiCache for Redis to resolve relational database CPU bottlenecks while maintaining high availability.

Question 1148Question →

An enterprise operates a legacy monolithic application deployed on a fleet of Amazon EC2 instances across multiple member accounts in an AWS Organizations organization. The application writes log events to a local file at `/var/log/app/app.log`. A local cron utility rotates these logs hourly, renaming the active file to `/var/log/app/app.log.YYYY-MM-DD-HH` and compressing it. A solutions architect needs to design a centralized logging solution to stream these logs to a central Amazon S3 bucket in a dedicated logging account for audit compliance and near-real-time security analysis. Which combination of steps should the solutions architect take to implement this solution? (Choose two.)

Select all that apply

Configure the Amazon CloudWatch agent on the EC2 instances with the log file path set to `/var/log/app/app.log*` in the agent configuration JSON to ensure all active and rotated log files are tracked.

Configure a Kinesis Data Firehose delivery stream in each application account to deliver logs to the central S3 bucket, and update the central S3 bucket policy to explicitly grant `s3:PutObject` permissions to the IAM role ARN of each cross-account delivery stream.

Configure the Amazon CloudWatch agent on the EC2 instances with the log file path set strictly to `/var/log/app/app.log`, relying on the agent to automatically follow file descriptor changes and detect the rotated files.

Configure the central S3 bucket policy to grant `s3:PutObject` access to the Kinesis Data Firehose service principal (`firehose.amazonaws.com`) without specifying the individual cross-account IAM role ARNs.

Configure the EC2 instances to write logs directly to a local S3 bucket in each account, and configure S3 Cross-Region Replication (CRR) to replicate the log objects to the central S3 bucket in the logging account.

Show answer & explanation

Answer: Configure the Amazon CloudWatch agent on the EC2 instances with the log file path set to `/var/log/app/app.log*` in the agent configuration JSON to ensure all active and rotated log files are tracked.; Configure a Kinesis Data Firehose delivery stream in each application account to deliver logs to the central S3 bucket, and update the central S3 bucket policy to explicitly grant `s3:PutObject` permissions to the IAM role ARN of each cross-account delivery stream.

Answer

Configure the CloudWatch agent with the wildcard file path `/var/log/app/app.log*` to capture rotated logs, and configure a Kinesis Data Firehose stream in each account to deliver logs to the central S3 bucket with an S3 bucket policy explicitly granting write permissions to the Firehose IAM roles.

To ensure reliable log streaming and central archiving, the solutions architect must configure the CloudWatch agent with a wildcard pattern (e.g., `/var/log/app/app.log*`) to monitor files across rotations. In addition, the central S3 bucket policy must explicitly grant `s3:PutObject` access to the specific IAM roles assumed by the Kinesis Data Firehose streams in each member account to allow cross-account log delivery.

Step-by-Step Solution

Configure the CloudWatch agent on the EC2 instances to tail the application logs.

Logs are successfully captured by the agent, even when files are renamed during hourly rotation, because of the wildcard pattern `/var/log/app/app.log*`.

Without the wildcard pattern, the agent would lose track of log files after they are rotated and renamed.

Set up cross-account delivery using Kinesis Data Firehose and an S3 bucket policy.

Firehose delivery streams in the member accounts successfully write the log data into the centralized S3 bucket.

The central S3 bucket policy explicitly permits the IAM roles assumed by the Firehose streams in the member accounts to execute the `s3:PutObject` API call.

Key Concept

Configuring the CloudWatch agent with wildcards to handle log rotation, and setting up cross-account S3 bucket policies for Kinesis Data Firehose log delivery.

Estimated Time:3m 0s

Question 1149Question →

An organization plans to host a lightweight inventory management service classified as an Online Transaction Processing (OLTP) workload. The service uses a relational database and requires low read latency as its key performance indicator during sudden, unpredictable query spikes, while keeping database costs low during idle periods.

Which database and storage strategy meets these requirements with the minimum operational overhead?

Use Amazon RDS for MySQL in a Multi-AZ configuration and direct read traffic to the standby DB instance.

Use Amazon Aurora MySQL and enable Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on average CPU utilization.

Use Amazon RDS for MySQL and create a cross-Region Read Replica using AWS-managed KMS keys for cross-account log replication.

Use Amazon Aurora MySQL with a Pilot Light disaster recovery strategy to scale out read nodes during peak traffic hours.

Show answer & explanation

Answer: Use Amazon Aurora MySQL and enable Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on average CPU utilization.

Answer

Use Amazon Aurora MySQL and enable Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on average CPU utilization.

The correct strategy uses Amazon Aurora MySQL with Aurora Auto Scaling. Aurora Replicas share the same storage volume as the primary instance, allowing them to scale out quickly with minimal replication lag. Aurora Auto Scaling automates the addition and removal of these replicas based on load (such as CPU utilization), minimizing operational overhead while keeping costs optimized during idle periods.

Step-by-Step Solution

Analyze the workload requirements: relational database for an OLTP workload, low read latency during unpredictable spikes, cost minimization during idle periods, and minimal operational overhead.

Identify that the solution must support automatic scaling of read capacity.

Sudden, unpredictable traffic spikes cannot be efficiently handled with manual intervention or scheduled scaling.

Evaluate the read-scaling capabilities of AWS database services.

Amazon Aurora Replicas support auto-scaling, whereas Amazon RDS Multi-AZ standby instances are passive and cannot serve read traffic.

This rules out standard RDS Multi-AZ configurations for scaling read queries.

Select the strategy that offers automatic scale-in/scale-out of read replicas with minimal latency and replication overhead.

Amazon Aurora MySQL with Aurora Auto Scaling is selected.

Aurora Replicas use a shared storage volume, reducing replication lag compared to standard RDS read replicas, and Aurora Auto Scaling handles the provisioning automatically.

Key Concept

Relational read capacity scaling using Amazon Aurora Replicas and Aurora Auto Scaling.

Estimated Time:1m 0s

Question 1150Question →

A logistics company collects real-time vehicle telemetry data using a custom logging framework running on a fleet of Amazon EC2 instances in an Auto Scaling group. The logging framework rotates the log files hourly, renaming them using the pattern `/var/log/telemetry/telemetry-YYYY-MM-DD-hh.log`. The operations team wants to stream these logs to Amazon CloudWatch Logs using the CloudWatch agent, and then use Amazon Kinesis Data Firehose to deliver them to a centralized Amazon S3 bucket in a dedicated security account. Currently, logs are not appearing in the central S3 bucket after the first hour of EC2 instance launch. Which two actions should the solutions architect take to resolve the logging delivery failures and ensure operational excellence? (Select TWO.)

Select all that apply

Specify the log file path as `/var/log/telemetry/telemetry-*.log` in the CloudWatch agent configuration file to ensure the agent monitors and tracks the rotated log files.

Update the S3 bucket policy in the centralized security account to allow `s3:PutObject` permissions for the IAM role assumed by the Kinesis Data Firehose delivery stream in the application account.

Specify the static path `/var/log/telemetry/telemetry-current.log` in the CloudWatch agent configuration and configure a cron job to restart the CloudWatch agent daemon every hour.

Attach a Service Control Policy (SCP) to the application account's Organizational Unit (OU) that grants `s3:PutObject` access to the centralized S3 bucket for all resources in the account.

Configure the destination S3 bucket to encrypt objects using the default AWS-managed KMS key (`aws/s3`) and grant the Kinesis Data Firehose IAM role permission to use this key for cross-account writes.

Show answer & explanation

Answer: Specify the log file path as `/var/log/telemetry/telemetry-*.log` in the CloudWatch agent configuration file to ensure the agent monitors and tracks the rotated log files.; Update the S3 bucket policy in the centralized security account to allow `s3:PutObject` permissions for the IAM role assumed by the Kinesis Data Firehose delivery stream in the application account.

Answer

To resolve these issues, the solutions architect must configure the CloudWatch agent with a wildcard path (`/var/log/telemetry/telemetry-*.log`) to handle hourly rotated files, and update the S3 bucket policy in the centralized security account to allow `s3:PutObject` for the Kinesis Data Firehose IAM role.

The correct configurations involve using a wildcard pattern in the CloudWatch agent configuration file so that it tracks newly rotated files dynamically, and updating the destination S3 bucket policy to permit cross-account writes from the Kinesis Data Firehose IAM role.

Step-by-Step Solution

Diagnose the log file path tracking mechanism.

Determine that static file configurations fail to capture logs after files are rotated and renamed.

To ensure continuous log collection after files undergo rotation.

Configure wildcard matching in the CloudWatch agent.

Apply `/var/log/telemetry/telemetry-*.log` to the file path configuration of the CloudWatch agent.

Wildcards allow the agent's file reader to seamlessly track new files matching the pattern without needing agent restarts.

Establish cross-account S3 bucket write permissions.

Modify the target S3 bucket policy in the security account to explicitly allow the Firehose IAM role from the application account to write files.

Cross-account object delivery requires an explicit S3 bucket policy permission in the destination account because default IAM permissions do not traverse account boundaries.

Key Concept

Continuous operational logging requires handling dynamic log rotation paths on hosts and configuring explicit resource-based policies for secure cross-account log delivery.

Question 1151Question →

A company needs to migrate two components of an application to AWS:

1. A front-end web server running on virtual machines that must be migrated quickly to meet a datacenter exit deadline, without modifying the operating system or application code.
2. A backend database currently running on an on-premises Oracle Database. The company wants to migrate this to Amazon Aurora PostgreSQL to save on licensing costs and modernize the database layer.

Which migration strategies from the 7 Rs framework should the company select for these two components? (Select TWO.)

Select all that apply

Rehost for the front-end web server

Refactor for the backend database

Replatform for the backend database

Rehost for the backend database

Replatform for the front-end web server

Show answer & explanation

Answer: Rehost for the front-end web server; Refactor for the backend database

Answer

The correct strategies are Rehost for the front-end web server and Refactor for the backend database.

Rehosting is correct for the front-end web server because the virtual machines must be migrated quickly to meet a datacenter exit deadline without any modification to the operating system or application code. Refactoring is correct for the backend database because migrating from an on-premises Oracle database to Amazon Aurora PostgreSQL to eliminate licensing costs requires database schema conversion and code modifications, which constitutes a Refactor strategy.

Step-by-Step Solution

Analyze the requirements for the front-end web server.

The requirement is to migrate virtual machines quickly to meet a datacenter exit deadline without modifying the operating system or application code, which corresponds to Rehosting (lift-and-shift).

Identifying the correct strategy for the web tier based on the constraint of making no modifications.

Analyze the requirements for the backend database.

The requirement is to migrate from an on-premises Oracle database to Amazon Aurora PostgreSQL to eliminate licensing costs. Switching database engines requires database schema conversion, application SQL modification, and testing.

Identifying the correct strategy for the database tier based on the engine change constraint.

Match the database requirements to the 7 Rs framework.

An engine switch from Oracle to PostgreSQL represents a database migration with schema conversion, which constitutes a Refactor (re-architect) strategy.

Differentiating Refactoring from Replatforming in database migrations.

Key Concept

Distinguishing between Rehost, Replatform, and Refactor migration strategies based on workload requirements and engine changes.

Question 1152Question →

A financial services company is enhancing data protection and compliance across its multi-account AWS environment managed via AWS Organizations. A solutions architect must design a centralized logging solution to consolidate AWS CloudTrail logs from all member accounts into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a custom key with automatic rotation, and the solution must guarantee that the logs cannot be tampered with or deleted by unauthorized administrators in the member accounts. Which of the following actions should the solutions architect take to implement this securely? (Select TWO.)

Select all that apply

In the Security account, create an Amazon S3 bucket and a Customer Managed Key (CMK). Configure the KMS key policy to grant the AWS CloudTrail service principal permission to perform kms:GenerateDataKey* and kms:Decrypt operations, and restrict access using the aws:SourceArn condition pointing to the organization's management account trail.

Configure the S3 bucket policy in the Security account to grant s3:GetBucketAcl and s3:PutObject permissions to the AWS CloudTrail service principal, using the aws:SourceArn condition to restrict writes to the organization's trail. Enable log file integrity validation on the trail.

Encrypt the S3 bucket in the Security account using the default AWS-managed key for Amazon S3 (aws/s3). Configure the key policy of aws/s3 to allow the CloudTrail service principal and member account IAM roles to perform encryption and decryption operations.

Create a Service Control Policy (SCP) at the root level of AWS Organizations that explicitly allows the CloudTrail service principal to access the S3 bucket and KMS keys across all accounts, thereby bypassing local key policy and bucket policy requirements for member accounts.

Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to * with a condition specifying aws:PrincipalOrgID matching the organization's ID. This allows all member account IAM entities to write logs directly to the bucket without needing service principal permissions.

Show answer & explanation

Answer: In the Security account, create an Amazon S3 bucket and a Customer Managed Key (CMK). Configure the KMS key policy to grant the AWS CloudTrail service principal permission to perform kms:GenerateDataKey* and kms:Decrypt operations, and restrict access using the aws:SourceArn condition pointing to the organization's management account trail.; Configure the S3 bucket policy in the Security account to grant s3:GetBucketAcl and s3:PutObject permissions to the AWS CloudTrail service principal, using the aws:SourceArn condition to restrict writes to the organization's trail. Enable log file integrity validation on the trail.

Answer

Configure a Customer Managed Key (CMK) in the Security account with a key policy allowing CloudTrail permissions, restricted by aws:SourceArn, and configure the Security account's S3 bucket policy to permit CloudTrail's service principal to write logs using the same organization-focused resource restriction while enabling log file integrity validation.

Creating a Customer Managed Key (CMK) allows customizing the key policy to support cross-account service principal permissions. The CloudTrail service principal requires kms:GenerateDataKey* and kms:Decrypt permissions to write and validate encrypted logs. The S3 bucket policy must grant s3:GetBucketAcl and s3:PutObject permissions to the CloudTrail service principal, with security reinforced using the aws:SourceArn condition to limit log delivery to the specific organization-level trail.

Step-by-Step Solution

Identify the key management requirements for cross-account S3 encryption.

Determine that a Customer Managed Key (CMK) is required because AWS-managed keys (aws/s3) do not allow policy modifications to grant cross-account or service-specific permissions.

This eliminates options proposing AWS-managed keys.

Verify the permission model for AWS CloudTrail log delivery to S3.

Establish that CloudTrail uses the service principal 'cloudtrail.amazonaws.com' to write logs, requiring explicit permissions in both the S3 bucket policy and the KMS key policy.

This invalidates options using IAM-based organizational constraints like aws:PrincipalOrgID for bucket writes.

Evaluate the role of AWS Organizations guardrails versus resource-based policies.

Determine that Service Control Policies (SCPs) are filters and do not grant permissions or override the need for proper key policies or S3 bucket policies.

This ensures the correct configuration includes both a customized KMS key policy and a matching S3 bucket policy.

Key Concept

Centralized, secure cross-account logging requires custom KMS keys (CMKs) and service principal permissions under resource-based policies to ensure proper encryption and integrity validation.

Question 1153Question →

A company is planning to migrate its legacy on-premises Oracle database to an Amazon Aurora MySQL-Compatible Edition DB cluster. The database contains critical transaction tables, and the migration must minimize downtime by using continuous replication. The database size is $50\text{ TB}$ , and the network connection between the on-premises data center and AWS is a $50\text{ Mbps}$ VPN link. Which two of the following actions must the solutions architect perform to convert the schema and replicate the data successfully?

Select all that apply

Use the AWS Schema Conversion Tool (SCT) to generate an assessment report, convert the Oracle database schema, and apply the converted schema to the target Aurora MySQL DB cluster.

Enable supplemental logging on the source Oracle database for the tables being replicated, and configure the AWS DMS replication task to perform a full load followed by ongoing replication (Change Data Capture).

Classify the migration as a replatforming strategy and deploy the AWS Application Migration Service (MGN) agent on the source database host to replicate the server block-by-block directly into Amazon RDS.

Configure the AWS DMS replication task to capture ongoing changes using default settings without modifying source database logging, allowing DMS to parse standard Oracle redo logs directly.

Replicate the initial full load of the

50\text{ TB}

database directly over the existing

50\text{ Mbps}

site-to-site VPN connection using AWS DMS to save costs.

Show answer & explanation

Answer: Use the AWS Schema Conversion Tool (SCT) to generate an assessment report, convert the Oracle database schema, and apply the converted schema to the target Aurora MySQL DB cluster.; Enable supplemental logging on the source Oracle database for the tables being replicated, and configure the AWS DMS replication task to perform a full load followed by ongoing replication (Change Data Capture).

Answer

Use the AWS Schema Conversion Tool (SCT) to convert the schema, and enable supplemental logging on the source Oracle database while setting up an AWS DMS task for full load and Change Data Capture (CDC).

For a heterogeneous database migration (Oracle to Aurora MySQL), the database schema must be converted using the AWS Schema Conversion Tool (SCT) because the source and target database engines use different SQL dialects and structures. To support ongoing replication (Change Data Capture) and minimize downtime, the source database must be configured to provide transaction logs with sufficient detail. For an Oracle source database, this requires enabling supplemental logging so that AWS DMS can capture row-level changes from the redo logs.

Step-by-Step Solution

Perform schema analysis and conversion using the AWS Schema Conversion Tool (SCT).

Oracle-specific database objects (such as tables, indexes, views, stored procedures, and triggers) are converted into MySQL-compatible equivalents, and the schema is applied to the target Aurora MySQL DB cluster.

SCT is required for heterogeneous migrations to automatically translate SQL dialects and schema structures before data migration starts.

Configure database-level logging and supplemental logging on the source Oracle database.

The source database writes supplemental details to the redo logs for all columns in the replicated tables.

AWS DMS requires supplemental logging to reconstruct the SQL statements for ongoing Change Data Capture (CDC) replication.

Create and execute an AWS DMS replication task configured for full load and Change Data Capture (CDC).

The initial data is copied to the target Aurora MySQL cluster, and subsequent changes are streamed continuously with minimal lag.

This minimizes the migration downtime by keeping the target database synchronized with the source until the cutover window.

Key Concept

Heterogeneous database migration and schema conversion using SCT and DMS with CDC

Question 1154Question →

An enterprise operates a payment processing application in the us-east-1 Region. The application runs on Amazon ECS tasks (AWS Fargate) behind an Application Load Balancer (ALB). The database tier consists of an Amazon Aurora PostgreSQL cluster. Outbound transactions to external payment gateways are routed through a single NAT Gateway in us-east-1. The company needs to design a disaster recovery (DR) solution in the us-west-2 Region. The solution must achieve a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 1 minute, while also eliminating single points of failure for outbound external traffic. Which combination of actions should the Solutions Architect take to enhance reliability and meet the disaster recovery objectives? (Select TWO.)

Select all that apply

Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Use AWS Route 53 Application Recovery Controller (ARC) routing controls to manage the failover of the database and application traffic.

Configure AWS Backup to take hourly cross-region snapshots of the Aurora PostgreSQL database to us-west-2, and use AWS CloudFormation to provision the ECS resources in the secondary region during a failover event.

Deploy NAT Gateways in all occupied Availability Zones within both the us-east-1 and us-west-2 VPCs, and update private subnet route tables to use the zone-specific NAT Gateway for outbound traffic.

Create a Route 53 Private Hosted Zone (PHZ) in the primary account for internal microservice DNS resolution, and rely on cross-region VPC peering to automatically resolve these private domains from the secondary region without associating the PHZ with the us-west-2 VPC.

Deploy a duplicate application stack in us-west-2 and configure Route 53 active-passive failover routing records pointing directly to the ALBs without associating health checks, relying on manual DNS record modifications during an outage.

Show answer & explanation

Answer: Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Use AWS Route 53 Application Recovery Controller (ARC) routing controls to manage the failover of the database and application traffic.; Deploy NAT Gateways in all occupied Availability Zones within both the us-east-1 and us-west-2 VPCs, and update private subnet route tables to use the zone-specific NAT Gateway for outbound traffic.

Answer

Configure Amazon Aurora Global Database with a secondary cluster in us-west-2 and use AWS Route 53 ARC to manage failover, while deploying multi-AZ NAT Gateways in both regions to eliminate outbound single points of failure.

The correct architecture integrates Amazon Aurora Global Database to achieve low-latency replication that satisfies the sub-minute RPO, paired with AWS Route 53 Application Recovery Controller (ARC) to automate failover and satisfy the sub-15-minute RTO. Additionally, deploying multiple NAT Gateways ensures outbound connectivity remains highly reliable by removing single-AZ network egress dependency.

Step-by-Step Solution

Address the Database RPO and RTO requirements.

Migrate the database to Amazon Aurora Global Database to enable cross-region replication with a typical latency of less than 1 second, meeting the RPO of less than 1 minute.

Standard cross-region snapshots or backups cannot guarantee data loss limits of under 1 minute.

Establish the multi-region DNS routing and failover orchestration.

Utilize AWS Route 53 Application Recovery Controller (ARC) routing controls to monitor and orchestrate regional failover within minutes.

Route 53 ARC provides the coordination mechanism required to keep failover operations within the 15-minute RTO without manual DNS edits.

Eliminate single points of failure for outbound payment gateway traffic.

Deploy NAT Gateways in all occupied Availability Zones in both the source and destination VPCs, updating routing tables accordingly.

A single NAT Gateway per VPC is a single point of failure; multi-AZ NAT Gateway deployments ensure high availability for outbound traffic.

Key Concept

Multi-region disaster recovery coordination and elimination of single points of network egress failures.

Estimated Time:2m 30s

Question 1155Question →

An organization has a fleet of EC2 instances running in a private subnet in `us-east-1` that downloads $50\text{ TB}$ of data monthly from Amazon S3 buckets located in the same Region. Currently, all outbound internet traffic, including the S3 traffic, flows through a NAT Gateway. In addition, the organization stores $100\text{ TB}$ of raw application logs in an Amazon S3 Standard bucket. Analysis of log access patterns shows these logs are rarely accessed after $30$ days, but they must be retained for $1$ year for compliance audits.

Which combination of actions should the Solutions Architect take to reduce both storage and data transfer costs in the most cost-effective manner? (Select TWO.)

Select all that apply

Create an S3 Lifecycle policy to transition the application logs to Amazon S3 Glacier Flexible Retrieval after

30

days.

Provision a Gateway VPC Endpoint for Amazon S3 and update the private subnet's route table to direct S3 traffic through the endpoint.

Provision an Interface VPC Endpoint for Amazon S3 and configure the private subnet's route table to direct S3 traffic through the endpoint.

Order an AWS Snowcone device monthly to archive the logs, and transfer them physically to an offsite location.

Purchase an EC2 Instance Savings Plan to offset the NAT Gateway data processing charges.

Show answer & explanation

Answer: Create an S3 Lifecycle policy to transition the application logs to Amazon S3 Glacier Flexible Retrieval after $30$ days.; Provision a Gateway VPC Endpoint for Amazon S3 and update the private subnet's route table to direct S3 traffic through the endpoint.

Answer

The correct actions are to create an S3 Lifecycle policy to transition the application logs to Amazon S3 Glacier Flexible Retrieval after 30 days, and to provision a Gateway VPC Endpoint for Amazon S3 and update the private subnet's route table.

Transitioning logs to Amazon S3 Glacier Flexible Retrieval after

30

days is the most cost-effective storage strategy for compliance data that is rarely accessed. Provisioning a Gateway VPC Endpoint for Amazon S3 is the optimal way to bypass NAT Gateway data processing fees for same-Region S3 traffic without incurring new costs.

Step-by-Step Solution

Analyze the storage cost optimization requirement.

The application logs are

100\text{ TB}

in size, stored in S3 Standard, and rarely accessed after

30

days but must be kept for

1

year. Transitioning them to S3 Glacier Flexible Retrieval after

30

days dramatically reduces the storage price per GB.

S3 Standard is expensive for long-term retention of infrequently accessed log files. S3 Glacier Flexible Retrieval provides a much cheaper storage tier suitable for compliance logs.

Analyze the data transfer cost optimization requirement.

The EC2 instances download

50\text{ TB}

of data monthly from Amazon S3 in the same Region via a NAT Gateway. NAT Gateway charges a data processing fee of

2,250

USD per month (

50,000\text{ GB} \times \$0.045/\text{GB}

Using a NAT Gateway for same-Region S3 traffic is an unnecessary expense because S3 traffic can be routed privately within the AWS network.

Select the most cost-effective private routing mechanism.

A Gateway VPC Endpoint for S3 is chosen. It is free of charge and does not incur any hourly or data processing fees, unlike an Interface VPC Endpoint.

Gateway VPC Endpoints are the optimal choice for same-region S3 access from a VPC as they eliminate NAT Gateway data processing costs for free.

Key Concept

Optimizing storage costs via S3 Lifecycle policies and eliminating data transfer costs using Gateway VPC Endpoints for S3.

Estimated Time:1m 30s

Question 1156Question →

A retail enterprise operates a high-throughput transaction processing application deployed on a fleet of Amazon EC2 instances across 50 member accounts. The accounts are managed under a single organization in AWS Organizations. The application logs transaction events locally to `/var/log/transactions/app.log`. The files undergo hourly rotation by `logrotate` and are renamed to `/var/log/transactions/app.log-YYYYMMDD-HH`.

A Solutions Architect must design a centralized, near-real-time logging solution to aggregate these application logs into a single Amazon S3 bucket in a dedicated logging account. The solution must minimize log duplication, ensure no logs are lost during rotation, and avoid the administrative overhead of deploying streaming infrastructure in every member account.

Which two configurations should the Solutions Architect implement to meet these requirements?

Select all that apply

Configure the CloudWatch agent on the EC2 instances to monitor the exact log file path `/var/log/transactions/app.log` without using wildcards in the configuration.

In the central logging account, create a Kinesis Data Firehose delivery stream and a CloudWatch Logs destination. Configure the destination policy to permit the `logs:PutSubscriptionFilter` action for the AWS Organization using the `aws:PrincipalOrgID` condition, and create subscription filters in the member accounts targeting this destination.

Configure the CloudWatch agent on the EC2 instances to monitor the wildcard log path `/var/log/transactions/app.log*` to ensure that rotated log files are captured during the rotation window.

In the central logging account, configure the S3 bucket policy to grant `s3:PutObject` permissions to a wildcard principal (`*`) restricted by the `aws:PrincipalOrgID` condition. In each member account, configure the CloudWatch agent to write logs directly to the central S3 bucket.

Deploy a Kinesis Data Firehose delivery stream in each member account. In the central logging account, configure the S3 bucket policy to grant `s3:PutObject` access to the principal `"arn:aws:iam::*:role/FirehoseDeliveryRole"` to allow all member accounts to deliver logs.

Show answer & explanation

Answer: Configure the CloudWatch agent on the EC2 instances to monitor the exact log file path `/var/log/transactions/app.log` without using wildcards in the configuration.; In the central logging account, create a Kinesis Data Firehose delivery stream and a CloudWatch Logs destination. Configure the destination policy to permit the `logs:PutSubscriptionFilter` action for the AWS Organization using the `aws:PrincipalOrgID` condition, and create subscription filters in the member accounts targeting this destination.

Answer

Configure the CloudWatch agent on the EC2 instances to monitor the exact log file path without using wildcards, and set up a Kinesis Data Firehose delivery stream and a CloudWatch Logs destination in the central logging account with a policy restricted by the organization ID, while configuring subscription filters in the member accounts.

To ensure operational excellence and avoid duplicate log ingestion during rotation, the CloudWatch agent must be configured with the exact active file path. Because the agent tracks log files via their underlying file descriptors, it automatically handles log rotation without re-reading renamed files. For scalable cross-account centralization, using a centralized CloudWatch Logs destination and Kinesis Data Firehose stream in the logging account avoids deploying streaming resources in every member account. Restricting access using the `aws:PrincipalOrgID` condition secures cross-account log delivery to the central destination while conforming to the principle of least privilege.

Step-by-Step Solution

Configure the CloudWatch agent's file monitoring path.

Set the agent's `file_path` to `/var/log/transactions/app.log` without wildcards.

This enables the agent to track the active file via its inode/file descriptor. When logrotate rotates the file, the agent continues tracking the active file, avoiding re-reading rotated files and preventing duplication.

Set up centralized streaming infrastructure in the logging account.

Create a Kinesis Data Firehose delivery stream writing to the central S3 bucket, and create a CloudWatch Logs destination pointing to this stream.

This establishes a central logging entry point, eliminating the need to deploy and manage Kinesis Data Firehose delivery streams in all 50 member accounts.

Configure cross-account permissions and subscription filters.

Apply a destination policy using `PutDestinationPolicy` with the `aws:PrincipalOrgID` condition. Create subscription filters in the member accounts targeting the destination ARN.

This securely grants member accounts permission to stream log events to the central destination in real-time under the principle of least privilege.

Key Concept

CloudWatch Agent log rotation tracking and cross-account log centralization using CloudWatch Logs subscription filters and Kinesis Data Firehose.

Question 1157Question →

A digital media platform hosts a live-streaming transcoding application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances are deployed across three Availability Zones ( $AZ-A$ , $AZ-B$ , and $AZ-C$ ) in private subnets. Outbound connectivity to external video ingestion APIs is routed through a single NAT Gateway located in $AZ-A$ .

During scheduled major sporting events, traffic spikes instantly from $500$ to $80,000$ requests per second. During these events, two major failures occur:
1. The ALB drops initial connections with HTTP $502$ and $503$ errors.
2. The ASG launches a large number of instances that remain in a pending state while downloading and compiling transcoding binaries (which takes $7$ minutes). Because the average CPU utilization remains high during this startup window, the ASG continuously launches more instances than required, causing a severe cost overrun.

The company requires a solution that eliminates connection drops, prevents over-provisioning during scale-out, and ensures that outbound connectivity is resilient to an Availability Zone outage. Which solution meets these requirements with the lowest operational overhead?

Configure an Amazon CloudFront distribution in front of the ALB to cache dynamic transcoding requests. Increase the ASG's default cooldown period to

480

seconds and configure a step scaling policy based on CPU utilization. Deploy a NAT Gateway in each of the three Availability Zones, and update the route table of each private subnet to route outbound traffic through its local NAT Gateway.

Request AWS Support to pre-warm the ALB based on the expected traffic profile. Configure a lifecycle hook for the ASG to keep instances in the `Pending:Wait` state while compiling binaries, and complete the lifecycle action once healthy. Configure a target tracking scaling policy with an `EstimatedInstanceWarmup` of

120

seconds. Deploy a single NAT Gateway in

AZ-B

, and update the route tables of private subnets in

AZ-A

and

AZ-C

to use the NAT Gateway in

AZ-B

as a backup if

AZ-A

fails.

480

seconds. Deploy a NAT Gateway in each of the three Availability Zones, and update the route table of each private subnet to route outbound traffic through its local NAT Gateway.

480

seconds. Update the route tables of all private subnets to route outbound traffic through a Transit Gateway connected to a central VPC containing a single NAT Gateway in

AZ-A

Show answer & explanation

Answer: Request AWS Support to pre-warm the ALB based on the expected traffic profile. Configure a lifecycle hook for the ASG to keep instances in the `Pending:Wait` state while compiling binaries, and complete the lifecycle action once healthy. Configure a target tracking scaling policy with an `EstimatedInstanceWarmup` of $480$ seconds. Deploy a NAT Gateway in each of the three Availability Zones, and update the route table of each private subnet to route outbound traffic through its local NAT Gateway.

Answer

Request AWS Support to pre-warm the ALB, configure an ASG lifecycle hook to wait for instance initialization, set the target tracking EstimatedInstanceWarmup to 480 seconds, and deploy local NAT Gateways across all three Availability Zones.

The correct option addresses all three issues in the architectural scenario. First, requesting AWS Support to pre-warm the ALB ensures that the load balancer can handle the massive burst of traffic without dropping connections. Second, using an ASG lifecycle hook allows instances to complete their

7

-minute binary compilation before receiving traffic, and setting `EstimatedInstanceWarmup` to

480

seconds (

8

minutes) ensures the target tracking policy does not include these initializing instances in metric evaluations, preventing over-provisioning. Finally, deploying a NAT Gateway in each Availability Zone removes the single point of failure for outbound traffic.

Step-by-Step Solution

Request Application Load Balancer pre-warming from AWS Support.

Ensures the ALB has pre-provisioned capacity to handle the sudden burst of traffic from

500

80,000

requests per second.

Prevents HTTP 502/503 errors caused by the ALB's normal scaling lag when hit with an instantaneous flash traffic spike.

Configure an ASG lifecycle hook and set the scaling policy's EstimatedInstanceWarmup parameter.

Pauses the scaling state transition until bootstrapping completes, and instructs target tracking to exclude launching instances from metric evaluations for

480

seconds.

Ensures that newly launched instances are not included in the metrics used for scaling decisions until they are fully initialized, preventing rapid over-provisioning and cost overruns during the

7

-minute startup window.

Deploy a dedicated NAT Gateway in each of the three Availability Zones.

Outbound traffic from each AZ's private subnet is routed through a local NAT Gateway.

Eliminates the single point of failure in

AZ-A

, ensuring that an outage in one AZ does not impact outbound connectivity for instances in the remaining healthy zones.

Key Concept

Auto Scaling Group scaling policies and warmup configurations combined with load balancer pre-warming and multi-AZ NAT gateway redundancy.

Question 1158Question →

An enterprise is designing a multi-account AWS environment in the `us-east-1` Region. The architecture requires connecting a production workload VPC (`vpc-secure-compute`) in Account 1 with a shared services VPC (`vpc-shared-services`) in Account 2, and a centralized egress security VPC (`vpc-egress-security`) in Account 3.

The networking requirements are as follows:
- Workloads in `vpc-secure-compute` are deployed across two Availability Zones (`us-east-1a` and `us-east-1b`).
- Workloads in `vpc-secure-compute` must access a Private Hosted Zone (PHZ) named `internal.services` hosted in Account 2.
- All outbound internet traffic from `vpc-secure-compute` must be routed through `vpc-egress-security`, where it is inspected by stateful virtual firewall appliances behind an AWS Gateway Load Balancer (GWLB).
- Traffic from `vpc-secure-compute` to `vpc-shared-services` must bypass the firewall appliances and route directly.
- The network must be highly available and resilient to Availability Zone failures, with no risk of asymmetric routing or single points of failure.
- A Transit Gateway (`tgw-central`) in Account 4 is shared with all accounts.

Which TWO actions should the solutions architect perform to meet these requirements?

Select all that apply

In Account 2, submit an association authorization for the `internal.services` private hosted zone to `vpc-secure-compute` using the AWS CLI or SDK. In Account 1, associate `vpc-secure-compute` with the private hosted zone.

Enable Appliance Mode on the Transit Gateway VPC attachment for `vpc-egress-security` using the AWS CLI or Console to ensure that bidirectional stateful traffic is consistently routed through the same Availability Zone.

In the route tables of `vpc-secure-compute`, direct all outbound internet traffic (

0.0.0.0/0

) to a single NAT Gateway deployed in the `us-east-1a` subnet of `vpc-egress-security` to minimize data processing costs.

Associate all VPC attachments with a single default Transit Gateway route table, and add static routes directing

0.0.0.0/0

to the `vpc-egress-security` attachment and `vpc-shared-services` CIDR to the `vpc-shared-services` attachment.

In Account 2, create a Route 53 Resolver outbound endpoint in `vpc-shared-services`. In Account 1, create an inbound endpoint in `vpc-secure-compute`. Create a resolver rule in Account 1 to forward queries for `internal.services` to the inbound endpoint.

Show answer & explanation

Answer: In Account 2, submit an association authorization for the `internal.services` private hosted zone to `vpc-secure-compute` using the AWS CLI or SDK. In Account 1, associate `vpc-secure-compute` with the private hosted zone.; Enable Appliance Mode on the Transit Gateway VPC attachment for `vpc-egress-security` using the AWS CLI or Console to ensure that bidirectional stateful traffic is consistently routed through the same Availability Zone.

Answer

The correct actions are to authorize and associate the Route 53 Private Hosted Zone across accounts (Account 2 to Account 1) and to enable Transit Gateway Appliance Mode on the egress/security VPC attachment.

To resolve DNS queries for `internal.services` in `vpc-secure-compute` (Account 1) using the PHZ in Account 2, the Solutions Architect must perform a cross-account PHZ association. This is done by authorizing the association in Account 2 and completing the association in Account 1. To inspect outbound internet traffic using stateful virtual firewalls in a central security VPC, Transit Gateway Appliance Mode must be enabled on the TGW VPC attachment for the security VPC. This ensures that the Transit Gateway sends both source-to-destination and return traffic of a flow to the same Network Interface (ENI) in the same Availability Zone, preventing stateful firewalls from dropping asymmetric traffic.

Step-by-Step Solution

Establish cross-account private DNS resolution by authorizing the private hosted zone association.

The private hosted zone `internal.services` in Account 2 is authorized to associate with `vpc-secure-compute` in Account 1.

AWS Route 53 requires explicit cross-account authorization before a Private Hosted Zone can be associated with a VPC in a different AWS account.

Associate the authorized VPC with the private hosted zone from the VPC owner's account.

`vpc-secure-compute` is associated with `internal.services`, allowing DNS queries to resolve natively.

Once authorized, the VPC owner must accept/complete the association so that local Route 53 Resolver can resolve names in the hosted zone.

Configure Transit Gateway Appliance Mode on the `vpc-egress-security` attachment.

Transit Gateway routes bidirectional flows through the same Availability Zone in the security VPC.

Stateful firewalls behind a Gateway Load Balancer require symmetric flow routing. Enabling Appliance Mode prevents asymmetric routing where ingress and egress traffic traverse different firewalls.

Key Concept

Design of highly available and secure hybrid multi-account routing and DNS architectures using Transit Gateway Appliance Mode and cross-account Route 53 Private Hosted Zone associations.

Question 1159Question →

A startup is designing a new web application that allows users to upload profile pictures and view their user profile details. The profile photos are unstructured files up to $5\text{ MB}$ in size, and the profile details consist of structured, schema-flexible data. The application requires a storage and database strategy that is highly available, cost-effective, and automatically scales to handle highly variable read traffic. Which two database and storage configurations should the solutions architect choose to meet these requirements?

Select all that apply

Store user profile photos in Amazon S3 and serve them via Amazon CloudFront.

Store user profile details in Amazon DynamoDB with on-demand capacity mode.

Deploy Amazon RDS for MySQL in a Multi-AZ configuration, and configure the web application to query the standby instance directly to scale read performance.

Use Amazon ElastiCache for Memcached to store user session data that requires persistent, multi-Availability Zone replication.

Encrypt the S3 bucket containing public profile photos using an AWS-managed KMS key (aws/s3) and modify its key policy to allow cross-account access.

Show answer & explanation

Answer: Store user profile photos in Amazon S3 and serve them via Amazon CloudFront.; Store user profile details in Amazon DynamoDB with on-demand capacity mode.

Answer

Store user profile photos in Amazon S3 and serve them via Amazon CloudFront, and store user profile details in Amazon DynamoDB with on-demand capacity mode.

Storing unstructured images in Amazon S3 combined with Amazon CloudFront provides highly available, low-latency, and cost-effective object delivery. Storing key-value user profile details in Amazon DynamoDB with on-demand capacity mode ensures that the database scales automatically with traffic fluctuations without manual provisioning.

Step-by-Step Solution

Analyze the storage requirements for unstructured user profile photos.

Identify that files up to

5\text{ MB}

are unstructured object data, making Amazon S3 the optimal and most cost-effective service, especially when combined with Amazon CloudFront for low-latency distribution.

Amazon S3 provides durable, scale-out object storage designed for unstructured content like images.

Analyze the database requirements for structured, variable-demand profile details.

Identify that schema-flexible key-value data with highly variable workloads maps directly to Amazon DynamoDB using on-demand capacity mode.

DynamoDB scales seamlessly and on-demand mode eliminates the need to pre-provision capacity, which fits variable traffic patterns.

Evaluate the architectural validity of the remaining options.

Rule out options that attempt to query RDS Multi-AZ standbys, use Memcached for persistent replication, or modify AWS-managed KMS key policies.

RDS standby instances do not accept traffic, Memcached lacks persistence/replication, and AWS-managed KMS key policies cannot be modified.

Key Concept

Selecting the optimal database and storage services based on unstructured object vs. structured key-value data patterns, while understanding scaling limits of standbys, caching engines, and KMS keys.

Estimated Time:1m 30s

Question 1160Question →

An enterprise is designing a new multi-VPC application in the eu-west-1 Region. The architecture consists of two spoke VPCs (vpc-app-prod and vpc-db-prod) and a centralized egress VPC (vpc-egress-prod). All VPCs are deployed across three Availability Zones. Outbound internet traffic from the spoke VPCs must be securely routed through the egress VPC. Additionally, instances in the spoke VPCs must resolve private DNS names hosted in a Route 53 Private Hosted Zone (PHZ) named corp.internal, which is managed in a separate Shared Services AWS account. The solution must ensure high availability across all Availability Zones.

Which of the following configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy one NAT Gateway in each of the three Availability Zones within the public subnets of the centralized egress VPC. Configure the spoke VPC route tables to route all 0.0.0.0/0 traffic to the Transit Gateway, and configure the Transit Gateway route tables to route egress traffic to the egress VPC.

Create a VPC association authorization for the Route 53 Private Hosted Zone corp.internal in the Shared Services account for both spoke VPCs. Accept the association for each spoke VPC from their respective accounts to allow local resolution of the private DNS names.

Deploy a single NAT Gateway in one Availability Zone in the public subnet of the centralized egress VPC to handle all outbound traffic from the spoke VPCs, routing traffic from all Availability Zones in the spoke VPCs to this single NAT Gateway to minimize running costs.

Configure a Route 53 Resolver outbound endpoint in the spoke VPCs with rules to forward queries for corp.internal to the Route 53 Resolver inbound endpoint in the Shared Services VPC, rather than associating the Private Hosted Zone with the spoke VPCs.

Connect the spoke VPCs and the egress VPC to a Direct Connect Gateway to handle transitive routing between the VPCs, bypassing the need for an AWS Transit Gateway to establish interconnectivity.

Show answer & explanation

Answer: Deploy one NAT Gateway in each of the three Availability Zones within the public subnets of the centralized egress VPC. Configure the spoke VPC route tables to route all 0.0.0.0/0 traffic to the Transit Gateway, and configure the Transit Gateway route tables to route egress traffic to the egress VPC.; Create a VPC association authorization for the Route 53 Private Hosted Zone corp.internal in the Shared Services account for both spoke VPCs. Accept the association for each spoke VPC from their respective accounts to allow local resolution of the private DNS names.

Answer

Deploy one NAT Gateway in each of the three Availability Zones within the public subnets of the centralized egress VPC, and create a VPC association authorization for the Route 53 Private Hosted Zone corp.internal in the Shared Services account for both spoke VPCs, accepting the association for each spoke VPC from their respective accounts.

The correct architecture requires deploying a NAT Gateway in each of the three Availability Zones within the public subnets of the centralized egress VPC to ensure egress high availability, satisfying the requirement to survive an Availability Zone outage. It also requires creating a VPC association authorization for the Route 53 Private Hosted Zone corp.internal in the Shared Services account for both spoke VPCs and accepting the association from the spoke accounts, allowing cross-account DNS resolution.

Step-by-Step Solution

Ensure high availability for egress traffic by deploying a NAT Gateway in each of the three Availability Zones in vpc-egress-prod, rather than relying on a single NAT Gateway.

Egress path is resilient to an Availability Zone outage.

Deploying NAT Gateways across multiple Availability Zones prevents a single point of failure for outbound traffic.

Associate the Route 53 Private Hosted Zone corp.internal from the Shared Services account with vpc-app-prod and vpc-db-prod using cross-account VPC association.

Spoke VPCs can resolve private DNS records within corp.internal locally.

A Private Hosted Zone must be associated with any VPC that requires DNS resolution for its domain, even if the VPC is in a different AWS account.

Configure the Transit Gateway and spoke VPC route tables to forward outbound internet traffic (0.0.0.0/0) to the centralized egress VPC.

Outbound traffic is successfully routed through the resilient egress path.

Centralizing egress through a Transit Gateway simplifies routing and control, while distributing the NAT Gateways ensures high availability.

Key Concept

Designing resilient egress architecture with multi-AZ NAT Gateways and setting up cross-account Route 53 Private Hosted Zone VPC associations.

PreviousPage 58 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept