Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1201Question →

A financial technology firm hosts its transaction processing workload in the us-east-1 Region across two VPCs: VPC-A and VPC-B. VPC-A hosts public-facing Application Load Balancers (ALBs) that receive incoming traffic and route it to containerized microservices in VPC-B via an AWS Transit Gateway. The microservices in VPC-B frequently query a third-party payment gateway over the internet, routing outbound traffic through the Transit Gateway to a single NAT Gateway located in VPC-A. During high-volume trading hours, transaction latency increases, and connection timeouts occur. Network logs indicate that the NAT Gateway in VPC-A is experiencing source port exhaustion. Additionally, microservices in VPC-A occasionally fail to resolve the private DNS names of the resources in VPC-B. Which combination of actions will resolve the latency issues and ensure successful DNS resolution across the VPCs?

Show answer & explanation

Answer: Deploy NAT Gateways in each Availability Zone of VPC-B, update the route tables in VPC-B to route outbound internet traffic locally through these NAT Gateways, and associate the Route 53 Private Hosted Zone of VPC-B with VPC-A.

Answer

Deploy NAT Gateways in each Availability Zone of VPC-B, update the route tables in VPC-B to route outbound internet traffic locally through these NAT Gateways, and associate the Route 53 Private Hosted Zone of VPC-B with VPC-A.
The correct option addresses both network latency and DNS resolution. By moving the NAT Gateways directly to VPC-B and deploying them in each Availability Zone, outbound internet traffic avoids the latency of routing through the Transit Gateway to VPC-A, and the multi-AZ deployment increases the source port pool, resolving NAT port exhaustion. Associating the Route 53 Private Hosted Zone of VPC-B with VPC-A ensures that microservices in VPC-A can resolve the private DNS names of VPC-B.

Step-by-Step Solution

1
Address the NAT Gateway port exhaustion and egress latency.
By deploying a NAT Gateway in each Availability Zone in VPC-B, the outbound traffic to the third-party payment gateway is routed locally and does not traverse the Transit Gateway to VPC-A, eliminating Transit Gateway transit latency. This also scales the source port capacity by distributing the outbound connections across multiple NAT Gateways.
Resolving port exhaustion and reducing transit hops directly targets the root causes of the latency spikes and connection timeouts.
2
Configure the DNS resolution across VPCs.
Associate the Amazon Route 53 Private Hosted Zone (PHZ) created for VPC-B with VPC-A.
This allows resources in VPC-A to query the VPC-B private hosted zone directly, resolving private DNS names without needing public DNS records.

Key Concept

Optimizing outbound network paths to reduce latency and configuring Route 53 Private Hosted Zone associations for cross-VPC DNS resolution.
Question 1202Question →

An international flight search and booking platform uses a Multi-AZ Amazon RDS for PostgreSQL DB instance to store flight schedules and seat availability. During peak vacation booking periods, the platform experiences significant read latency spikes and query timeouts on the primary database due to a high volume of flight search queries and connection exhaustion. The booking engine also requires a caching tier for flight search result packages. This cache must support sub-millisecond response times and provide high availability with automatic failover and cross-AZ data replication to prevent cache cold-starts in the event of a node failure. Which three actions should the Solutions Architect take to improve database and caching efficiency while meeting these requirements? (Select THREE.)

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon RDS Proxy instance between the application and the RDS DB instance to manage database connection pooling.; Deploy an Amazon ElastiCache for Redis cluster in Multi-AZ mode with replication enabled to cache search results.; Deploy one or more Amazon RDS for PostgreSQL read replicas and configure the application to route read-intensive flight search queries to the read replica endpoints.

Answer

Deploying an Amazon RDS Proxy instance, implementing an Amazon ElastiCache for Redis cluster with Multi-AZ replication, and routing read queries to Amazon RDS for PostgreSQL read replicas correctly addresses the connection exhaustion, cache availability, and database read latency requirements.
Deploying Amazon RDS Proxy resolves database connection exhaustion by establishing a pool of reusable connections to the Amazon RDS PostgreSQL instance. Using Amazon ElastiCache for Redis in Multi-AZ mode ensures that the cache layer is replicated across Availability Zones, preventing cold-starts during a failover. Finally, deploying RDS read replicas and routing read queries to them reduces load on the primary DB instance, solving the read latency spikes.

Step-by-Step Solution

1
Address database connection exhaustion by placing a proxy layer between the application and the database.
Amazon RDS Proxy pools database connections, preventing the CPU and memory spikes associated with establishing thousands of simultaneous connection attempts.
Peak traffic periods lead to connection pool exhaustion on the RDS instance, making database connection management critical.
2
Introduce a caching layer that meets the replication and high-availability criteria.
An Amazon ElastiCache for Redis cluster configured with Multi-AZ and replication provides sub-millisecond response times and maintains cache state during a failover.
ElastiCache for Memcached does not support replication or Multi-AZ automatic failover, which would cause cache cold-starts upon node failure.
3
Offload read queries from the primary writer node to horizontal scaling nodes.
RDS PostgreSQL read replicas handle flight search queries, leaving the primary writer node with sufficient capacity to process bookings.
Flight search is a read-heavy workload that can tolerate replication lag, making read replicas ideal for scaling search capacity.

Key Concept

Improving database performance and connection scalability using read replicas, connection pooling, and highly available caching layers.
Question 1203Question →

An enterprise operates a web application deployed on Amazon ECS tasks running on AWS Fargate in private subnets, fronted by an internet-facing Application Load Balancer (ALB). The application requires users to authenticate via SAML 2.0 with an external corporate identity provider (IdP). To improve security, the organization wants to offload the authentication process from the application layer to the ALB. Additionally, the application must be protected against SQL injection attacks and brute-force traffic spikes. Which of the following actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the Application Load Balancer HTTPS listener to authenticate users using an authenticate-oidc action integrated with an Amazon Cognito user pool that is federated with the external identity provider.; Associate an AWS WAF web ACL with the Application Load Balancer, and configure rate-limiting and SQL injection mitigation rules, ensuring they are placed at higher priority and evaluated before the default action.

Answer

The solutions architect should configure the Application Load Balancer HTTPS listener to authenticate users using an authenticate-oidc action integrated with an Amazon Cognito user pool, and associate an AWS WAF web ACL configured with rate-limiting and SQL injection rules evaluated at high priority.
Configuring the Application Load Balancer HTTPS listener to use the authenticate-oidc action with Amazon Cognito simplifies application logic by offloading authentication to the load balancer tier. Associating AWS WAF with the ALB and ordering SQL injection and rate-limiting rules at a higher priority ensures malicious requests are blocked before they are routed to the backend tasks.

Step-by-Step Solution

1
Determine the method for offloading user authentication to the load balancer tier.
Using the authenticate-oidc listener rule action on the Application Load Balancer linked to Amazon Cognito integrates with the external identity provider.
Allows authentication to occur at the network edge, relieving the backend container tasks of handling SAML token parsing.
2
Identify the threat protection mechanism and the correct rule configuration.
AWS WAF needs to be associated with the Application Load Balancer with SQL injection and rate-limiting rules.
Secures the application against malicious traffic and brute-force scraping attempts.
3
Analyze rule priority within the AWS WAF WebACL.
Configure blocking rules at higher priorities (lower numerical values) than any catch-all allow rule or default action.
Ensures that malicious traffic is matched and blocked before rule evaluation is terminated by an allow action.

Key Concept

Continuous security improvement by offloading authentication to the ALB with Cognito and placing blocking WebACL rules at high priority in AWS WAF.
Estimated Time:2m 0s
Question 1204Question →

A company is planning to migrate its on-premises customer relationship management (CRM) application to AWS. The application's backend database runs on Microsoft SQL Server. The primary goal of the migration is to eliminate the operational burden of database patching, backups, and OS-level maintenance. However, the company has strict timeline constraints and cannot modify the application's source code or change the database engine.

Which migration strategy should the company select for the database?

Show answer & explanation

Answer: Replatform

Answer

Replatform
Replatforming (often called 'tinker and shift') is the best choice because migrating the Microsoft SQL Server database to Amazon RDS for SQL Server allows the database engine to remain the same and requires no application code changes, while successfully offloading the operational tasks of patching, backups, and OS-level administration to AWS.

Step-by-Step Solution

1
Analyze the migration goals and constraints.
Goals: Eliminate operational burden of database patching, backups, and maintenance. Constraints: No modification of application source code, no database engine change.
Establishing clear requirements guides the selection of the correct migration strategy from the 7 Rs.
2
Evaluate the migration strategies against the constraints.
Rehosting on EC2 does not remove administrative overhead. Refactoring to Aurora requires database engine and application code changes. Replatforming to Amazon RDS for SQL Server maintains the engine, requires no application changes, and offloads operational overhead.
Comparing strategies ensures the selected path meets all requirements without violating constraints.
3
Select the optimal strategy.
Replatform is selected as it satisfies both the managed service goal and the zero-code-change constraint.
This strategy aligns perfectly with the 'tinker and shift' model of Replatforming.

Key Concept

Selecting the appropriate migration strategy (Replatforming vs. Rehosting vs. Refactoring) based on constraints like code change allowance and operational overhead reduction.
Question 1205Question →

A financial organization is designing a new global relational Online Transaction Processing (OLTP) application. The application will be deployed in a primary AWS Region (us-east-1) and must maintain a read-only reporting environment in a secondary AWS Region (us-west-2). The reporting environment must handle dynamic, high-load reporting queries and scale automatically. The disaster recovery KPIs require a Recovery Point Objective (RPO) of less than 1 second and a Recovery Time Objective (RTO) of less than 1 minute for a regional outage. All data at rest must be encrypted, and an audit team operating in a separate AWS account must be granted permissions to read and verify the encryption metadata. Which two database and storage configurations should the solutions architect select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and configure Aurora Auto Scaling for the reader instances in the secondary region.; Create a Customer Managed Key (CMK) in AWS KMS in the primary account, configure its key policy to delegate read permissions to the audit account's IAM principal, and encrypt the database clusters using this key.

Answer

Deploying an Amazon Aurora Global Database with a secondary cluster in us-west-2 using Aurora Auto Scaling for read replica scaling, combined with encrypting the database using a Customer Managed Key (CMK) in AWS KMS configured to allow cross-account access.
Deploying an Amazon Aurora Global Database provides sub-second replication latency (satisfying the RPO constraint) and permits rapid regional failovers under a minute (satisfying the RTO constraint). Additionally, Aurora reader instances can scale dynamically using Aurora Auto Scaling to support heavy query loads. Using a Customer Managed Key (CMK) allows customizing the key policy to delegate read permissions to the audit team's separate AWS account, which is impossible with AWS-managed keys.

Step-by-Step Solution

1
Analyze disaster recovery requirements.
The RPO < 1 second and RTO < 1 minute necessitate a highly resilient, cross-region replication architecture with minimal lag and rapid failover support, which points to Amazon Aurora Global Database rather than snapshot replication.
Traditional backup/restore and snapshot replication methods introduce significant delay, exceeding the RPO/RTO targets.
2
Address read scalability in the secondary region.
Identify that the secondary region's database must serve read traffic and scale dynamically. Aurora reader instances support Aurora Auto Scaling, whereas RDS Multi-AZ standbys cannot serve read queries.
RDS standby instances in Multi-AZ are purely passive failover targets, whereas Aurora replicas are active read endpoints.
3
Assess security and encryption key sharing restrictions.
Evaluate AWS KMS key types for cross-account delegation. Confirm that a Customer Managed Key (CMK) is required to configure a custom key policy that allows IAM principals in the audit account to access the key metadata.
AWS-managed KMS keys (like aws/rds) do not support modifications to their key policies and cannot be used for cross-account operations.

Key Concept

Selecting the optimal database replication architecture to meet strict RTO/RPO limits and configuring secure, cross-account encryption sharing.
Question 1206Question →

An enterprise is planning to migrate a legacy three-tier customer service application to AWS within a strict 3-month timeline. The application components and constraints are as follows:

* Presentation Tier: ASP.NET web application hosted on IIS on Windows Server 2012 R2. The company wants to minimize operating system licensing costs and administrative overhead by using containers, but the development team has no capacity to rewrite or modify the application code.
* Licensing Tier: A proprietary Windows service that requires a physical USB licensing dongle connected directly to the server. This service is scheduled to be retired in 12 months.
* Database Tier: A 2-TB2\text{-TB} Oracle Database Enterprise Edition. The business wants to migrate to Amazon Aurora PostgreSQL to eliminate licensing costs. The database contains over 150 PL/SQL packages and stored procedures that the application calls directly. The maximum allowed cutover downtime is 2 hours.

Which of the following migration strategies represent the most optimal alignment to the 7 Rs model for these tiers? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Refactor the database tier by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) to migrate the Oracle database to Amazon Aurora PostgreSQL.; Retain the licensing tier on-premises to support the hardware dependency until the service is decommissioned.

Answer

The correct strategies are to refactor the database tier by using the AWS Schema Conversion Tool and AWS DMS to migrate the Oracle database to Aurora PostgreSQL, and to retain the licensing tier on-premises due to physical hardware dependencies.
The database migration from Oracle to Aurora PostgreSQL is heterogeneous and requires extensive schema and application code adjustments to convert PL/SQL stored procedures, which represents a Refactoring strategy. The licensing service's dependency on a physical USB hardware dongle cannot be accommodated in AWS, and since it will be decommissioned within 12 months, retaining it on-premises is the most efficient and compliant strategy.

Step-by-Step Solution

1
Analyze the Presentation Tier constraints.
The legacy ASP.NET application needs containerization to minimize licensing/overhead, but has zero code modification capacity. This suggests a Replatform strategy (e.g., using AWS App2Container to run on ECS) rather than Refactoring.
Refactoring requires code changes, which violates the developer constraint.
2
Analyze the Licensing Tier constraints.
The licensing service requires a physical USB hardware dongle and will be decommissioned in 12 months. AWS does not support physical hardware dongle attachments.
Keeping the component on-premises (Retain) is the only viable path that respects the physical dependency and avoids wasted migration effort for a system nearing retirement.
3
Analyze the Database Tier constraints.
Migrating from Oracle to Aurora PostgreSQL is a heterogeneous database migration that requires converting 150+ PL/SQL packages/procedures and changing client code.
A database engine change requiring schema and application modifications constitutes a Refactoring migration path, not Replatforming.

Key Concept

Selecting the correct migration strategies (7 Rs) based on code modification limits, database schema conversion requirements, and hardware dependencies.
Estimated Time:3m 0s
Question 1207Question →

An enterprise hosts its retail application in a Production AWS account where sensitive customer transaction receipts are stored in an Amazon S3 bucket. The bucket is encrypted using a Customer Managed Key (CMK) in the Production account. To meet strict regulatory requirements, the security team mandates that these logs must be replicated using S3 Same-Region Replication (SRR) to a centralized archive S3 bucket in a separate Compliance AWS account. The archive bucket has S3 Object Lock enabled in compliance mode. The security policy dictates that the replicated objects must be encrypted at rest in the Compliance account using a KMS CMK owned by the Compliance account, and no AWS-managed keys may be used for cross-account operations. Which combination of configurations is required to successfully enable cross-account replication of these encrypted objects while adhering to the principle of least privilege?

Show answer & explanation

Answer: Update the destination KMS key policy in the Compliance account to grant the Production replication IAM role permissions for kms:GenerateDataKey and kms:Encrypt. Modify the destination S3 bucket policy to grant the replication role permissions for s3:ReplicateObject and s3:ReplicateTags. In the Production account, attach an IAM policy to the replication role allowing kms:Decrypt and kms:DescribeKey on the source KMS key, and kms:Encrypt and kms:GenerateDataKey on the destination KMS key.

Answer

Update the destination KMS key policy in the Compliance account to trust the replication IAM role, configure the destination S3 bucket policy to allow the replication role to write objects, and grant the replication IAM role the necessary KMS and S3 permissions in its IAM policy.
The correct configuration satisfies the requirement for cross-account S3 replication with KMS encryption. The source replication role must have decrypt permissions on the source KMS key, and encrypt permissions on the destination KMS key. Since this is a cross-account operation, trust must be established on the destination resources: the destination S3 bucket policy must allow the replication role to replicate objects, and the destination KMS key policy must explicitly allow the replication role to use the key.

Step-by-Step Solution

1
Configure permissions for the source KMS key.
The replication role is granted permission to decrypt objects in the source account.
Since the source S3 bucket is encrypted using a Customer Managed Key, the S3 replication service role must be able to decrypt the source objects before replicating them.
2
Configure the destination S3 bucket policy in the Compliance account.
The destination bucket policy allows the source replication role to replicate objects and tags.
For cross-account S3 operations, the destination resource policy (bucket policy) must explicitly authorize the external account's principal.
3
Configure the destination KMS key policy in the Compliance account.
The destination KMS CMK key policy allows the source replication role to execute kms:Encrypt and kms:GenerateDataKey.
Cross-account access to KMS keys is not governed by IAM policies alone; the key policy itself must trust the external principal to prevent access failures.

Key Concept

Cross-Account S3 Replication with KMS Encryption
Question 1208Question →

An enterprise runs a critical payment processing application across two AWS accounts within an AWS Organization. The database layer consists of an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 (Account A) and a secondary cluster in us-west-2 (Account A). The application compute tier runs on Amazon ECS Fargate inside a VPC in us-east-1 (Account B) and a VPC in us-west-2 (Account B). A shared Route 53 Private Hosted Zone (PHZ) named service.internal is hosted in a third Shared Services account (Account C) to resolve internal API endpoints. The business requires a disaster recovery (DR) solution with a Recovery Time Objective (RTO) of under 10 minutes and a Recovery Point Objective (RPO) of under 1 minute. During a simulated complete failure of the us-east-1 region, the operations team performs a manual failover by promoting the Aurora secondary cluster in us-west-2 and updating Route 53 Application Recovery Controller (Route 53 ARC) routing controls. However, the ECS tasks in us-west-2 fail to connect to the database or resolve other internal service endpoints. Additionally, outbound payment API calls fail whenever Availability Zone us-west-2a experiences a localized outage, even though the application tasks are running in multiple Availability Zones. Which combination of actions will resolve these issues and satisfy the disaster recovery requirements?

Show answer & explanation

Answer: Submit a VPC association authorization from the Shared Services account (Account C) for the us-west-2 VPC in Account B, and associate the Private Hosted Zone using the AWS CLI, SDK, or Console. Deploy a NAT Gateway in each Availability Zone utilized by the us-west-2 VPC, and configure the private route tables to route local outbound traffic through the NAT Gateway in the corresponding Availability Zone.

Answer

Submit a VPC association authorization from the Shared Services account (Account C) for the us-west-2 VPC in Account B, and associate the Private Hosted Zone. Deploy a NAT Gateway in each Availability Zone utilized by the us-west-2 VPC, and configure the private route tables to route local outbound traffic through the NAT Gateway in the corresponding Availability Zone.
The correct approach involves authorizing the cross-account association of the Route 53 Private Hosted Zone from the Shared Services account (Account C) to the Production VPC in us-west-2 (Account B). For outbound high availability, deploying a NAT Gateway in each Availability Zone ensures that a localized failure in one zone does not disrupt outbound connectivity for the entire VPC.

Step-by-Step Solution

1
Authorize cross-account VPC association for the Private Hosted Zone.
Allows Account B to associate its us-west-2 VPC with the Private Hosted Zone owned by Account C.
Route 53 Private Hosted Zones cannot be shared via AWS Resource Access Manager (RAM); they require VPC association authorization to link VPCs in different accounts.
2
Associate the us-west-2 VPC in Account B with the Private Hosted Zone.
EKS/ECS tasks in us-west-2 VPC can resolve internal DNS names under service.internal.
This establishes DNS resolution for internal microservice and database endpoints in the secondary region.
3
Deploy multiple NAT Gateways across Availability Zones in the us-west-2 VPC.
Outbound routing redundancy is established per Availability Zone.
Routing all Availability Zones to a single NAT Gateway introduces a single point of failure. Deploying one NAT Gateway per Availability Zone ensures that a localized AZ outage does not disrupt outbound internet access for the entire region.

Key Concept

Multi-region disaster recovery requires cross-account Route 53 Private Hosted Zone VPC association and zone-redundant NAT Gateways to avoid single points of failure.
Estimated Time:3m 0s
Question 1209Question →

An IoT company operates a real-time data ingestion pipeline on AWS. The pipeline uses an Auto Scaling group of Amazon EC2 instances to process incoming telemetry messages. The processed data is written to a shared Amazon EFS file system configured in Provisioned Throughput mode, while metadata is written to and queried from an Amazon Aurora MySQL database cluster.

During peak ingestion events, telemetry processing throughput degrades significantly. Performance monitoring shows that the EC2 instances spend a large percentage of CPU cycles in I/O wait states when writing to the shared file system. Additionally, read queries on the database cluster experience high latency due to replication lag on the read replicas.

Which architectural modifications should a Solutions Architect implement to resolve these performance bottlenecks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Modify the Amazon EFS file system throughput mode to Elastic throughput to dynamically scale storage throughput in response to write activity.; Configure Aurora Auto Scaling to dynamically scale the number of Aurora Replicas based on CPU utilization to distribute the read query workload.

Answer

The correct options are to modify the Amazon EFS file system throughput mode to Elastic throughput, and to configure Aurora Auto Scaling to dynamically scale the number of Aurora Replicas based on CPU utilization.
The correct options are to change the Amazon EFS throughput mode to Elastic throughput, and to configure Aurora Auto Scaling based on CPU utilization. Elastic throughput ensures that Amazon EFS automatically scales to meet the throughput demands of the instances during peak processing times, eliminating I/O wait states. Configuring Aurora Auto Scaling allows the database cluster to automatically add Aurora Replicas to handle peak read query volumes, which reduces replication lag and latency by distributing the read workload.

Step-by-Step Solution

1
Analyze the file system performance bottleneck where EC2 instances spend time in I/O wait states.
Identify that Provisioned Throughput on Amazon EFS is insufficient for peak write spikes, and transitioning to Elastic throughput will allow automatic scaling.
Elastic throughput dynamically adjusts to write traffic, ensuring tasks do not queue on storage I/O.
2
Analyze the database performance bottleneck where read queries suffer from replication lag on read replicas.
Determine that adding more replicas dynamically via Aurora Auto Scaling will distribute read queries, preventing any single replica from becoming overloaded and falling behind.
Aurora Auto Scaling automatically manages replica count based on target metrics like average CPU utilization.

Key Concept

Resolving storage and database performance bottlenecks by transitioning from static capacity provisioning to dynamic, auto-scaling resource models.
Question 1210Question →

An enterprise manages its multi-account environment using AWS Organizations. Application servers running in several member accounts write transaction audit files to local Amazon S3 buckets. To comply with new data retention regulations, the company must aggregate these audit files into a centralized Amazon S3 bucket in a dedicated Security account. The files must be encrypted at rest using a customer managed key (CMK) that is rotated annually. The Security account must have sole ownership of all aggregated objects, and the solution must enforce minimum privilege and minimize operational overhead. Which combination of actions will meet these compliance requirements?

Show answer & explanation

Answer: In the Security account, create an S3 bucket with S3 Object Ownership set to Bucket Owner Enforced. Create a customer managed KMS key in the Security account with rotation enabled, and configure its key policy to grant the organization's member accounts access to kms:GenerateDataKey and kms:Decrypt actions. In the Security account, configure the S3 bucket policy to allow s3:PutObject access to the organization's principal org ID (aws:PrincipalOrgID). In the member accounts, ensure the application IAM roles have permissions to use the Security account's KMS key and write to the Security account's S3 bucket.

Answer

The correct answer specifies creating a centralized S3 bucket in the Security account with S3 Object Ownership set to Bucket Owner Enforced, using a customer managed key (CMK) with rotation enabled whose key policy grants access to the member accounts, and configuring the S3 bucket policy with the aws:PrincipalOrgID condition to restrict access to the organization.
The correct option addresses all compliance requirements securely. Setting S3 Object Ownership to 'Bucket Owner Enforced' disables ACLs and automatically transfers ownership of all cross-account writes to the Security account. Using a customer managed KMS key is required since AWS managed keys (such as aws/s3) cannot be shared across accounts. The KMS key policy and S3 bucket policy in the Security account must explicitly delegate access to the member accounts (via the aws:PrincipalOrgID condition), and the local application roles must have permissions to utilize both the bucket and the key.

Step-by-Step Solution

1
Enforce Object Ownership in the Centralized S3 Bucket
Configured the S3 bucket's Object Ownership setting to 'Bucket Owner Enforced'.
This setting disables S3 ACLs and automatically transfers ownership of all newly uploaded objects to the bucket owner (the Security account), fulfilling the requirement that the Security account must have sole ownership without forcing clients to specify a bucket-owner-full-control ACL.
2
Configure the Customer Managed KMS Key for Cross-Account Access
Created a customer managed KMS key with automatic annual rotation, and added a statement in the key policy allowing member account IAM roles to perform kms:GenerateDataKey and kms:Decrypt.
AWS-managed KMS keys (like aws/s3) cannot be shared across accounts because their key policies are read-only. A customer managed KMS key is required to explicitly delegate cryptographic permissions to external AWS accounts.
3
Establish Bucket and IAM Policies with Minimum Privilege
Created an S3 bucket policy restricting s3:PutObject access to principals matching the organization's ID (aws:PrincipalOrgID). Updated the local IAM policies of the applications in the member accounts to allow s3:PutObject to the Security account's bucket and KMS actions on the Security account's CMK.
This ensures secure transmission, enforces encryption on upload, prevents unauthorized accounts from writing to the bucket, and provides local application roles with the necessary permissions to complete the write operations.

Key Concept

Cross-Account S3 Object Ownership and KMS Customer Managed Key Policy Management
Estimated Time:3m 0s
Question 1211Question →

A healthcare software provider is reviewing its centralized logging architecture in AWS. Currently, AWS CloudTrail logs from multiple member accounts in an AWS Organization are consolidated into an Amazon S3 bucket located in a dedicated Security account. The S3 bucket is configured with default encryption using the AWS managed key aws/s3.

To meet new regulatory compliance requirements, the solutions architect must enhance data protection. The requirements specify:
1. All log data must be encrypted at rest using a customer-managed key with automatic annual rotation.
2. Spoke accounts must be able to write their CloudTrail logs to the destination S3 bucket.
3. Cross-account access to the KMS key and S3 bucket must be restricted to the minimum required permissions.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a customer managed KMS key in the Security account with automatic key rotation enabled. Update the key policy to grant the AWS CloudTrail service principal permissions for the kms:GenerateDataKey* and kms:Decrypt actions, restricted using the aws:PrincipalOrgID condition.; Update the S3 bucket policy in the Security account to grant the AWS CloudTrail service principal permissions for the s3:PutObject and s3:GetBucketAcl actions, restricted using the aws:PrincipalOrgID condition.

Answer

Create a customer managed KMS key in the Security account with automatic rotation enabled, updating its policy to grant the CloudTrail service principal permissions to generate data keys and decrypt under the organization ID condition. Additionally, update the destination S3 bucket policy to allow the CloudTrail service principal to put objects and read bucket ACLs, restricted to the organization ID.
The correct combination implements a customer managed KMS key in the Security account with rotation enabled, allowing the customization of the key policy to authorize the AWS CloudTrail service principal. In addition, the S3 bucket policy must be updated to permit the CloudTrail service principal to write objects. Both policies must enforce organizational boundaries using the aws:PrincipalOrgID condition to restrict access to trusted member accounts.

Step-by-Step Solution

1
Establish Key Management Architecture
Create a Customer Managed Key (CMK) in the Security account with automatic annual rotation enabled.
AWS-managed keys (like aws/s3) cannot be shared across accounts or have their policies customized, making a customer-managed key necessary for cross-account CloudTrail encryption.
2
Configure Key Policy for Cross-Account Access
Grant the cloudtrail.amazonaws.com service principal permission to perform kms:GenerateDataKey* and kms:Decrypt, adding a condition matching the organization ID.
This allows the CloudTrail service running in the spoke accounts to generate data keys for encrypting logs before writing them to the destination S3 bucket, while preventing unauthorized accounts from utilizing the key.
3
Configure Destination S3 Bucket Policy
Modify the S3 bucket policy to allow cloudtrail.amazonaws.com to execute s3:PutObject and s3:GetBucketAcl actions, limited via the aws:PrincipalOrgID condition.
S3 bucket policies must explicitly trust the CloudTrail service principal from the organization accounts to enable secure, cross-account log delivery.

Key Concept

Centralized cross-account logging requires modifying both the target S3 bucket policy and a customer-managed KMS key policy to permit the CloudTrail service principal to write and encrypt objects, restricted by organizational boundaries.

Alternative Method

Instead of using aws:PrincipalOrgID, you can restrict the bucket and KMS key policies using conditions like aws:SourceArn to specify only particular trail ARNs, or aws:SourceAccount to specify individual member account IDs.
Estimated Time:3m 0s
Question 1212Question →

An enterprise is planning to migrate its legacy portfolio management suite to AWS. The suite contains the following workloads:

1. Web Portal: A Java 8 application running on Apache Tomcat on legacy SUSE Linux Enterprise Server 11. The operating system is unsupported, and the security team requires upgrading the OS to Amazon Linux 2023 during the migration. The application code must remain unchanged.
2. Risk Engine: A proprietary C++ binary compiled specifically for IBM AIX on IBM Power Systems. The source code is unavailable, and the vendor went out of business. The engine performs critical calculations and communicates with other components via TCP/IP.
3. Ledger Database: A self-managed 8 TB Oracle Database Enterprise Edition instance running on-premises, which relies heavily on advanced proprietary PL/SQL packages for compliance auditing. The enterprise wants to reduce operational and administrative database overhead but must maintain the existing auditing mechanisms. The maximum database cutover window is 1 hour.

Which combination of migration strategies represents the most appropriate path for these workloads according to the AWS 7 Rs framework?

Show answer & explanation

Answer: Replatform the Web Portal to Amazon Linux 2023; Retain the Risk Engine on-premises and establish hybrid connectivity; Replatform the Ledger Database to Amazon RDS for Oracle using AWS Database Migration Service (AWS DMS).

Answer

Replatform the Web Portal to Amazon Linux 2023; Retain the Risk Engine on-premises and establish hybrid connectivity; Replatform the Ledger Database to Amazon RDS for Oracle using AWS Database Migration Service (AWS DMS).
The correct solution correctly identifies the appropriate 7 Rs strategy for each workload component based on its constraints. For the Web Portal, upgrading the underlying operating system platform during migration without modifying the application code constitutes a Replatform strategy. For the Risk Engine, since the proprietary binary is compiled for the IBM AIX operating system on IBM Power Systems architecture and the source code is unavailable, it cannot be run on standard AWS x86 or ARM instances, nor can it be migrated using AWS Application Migration Service (MGN). Thus, it must be Retained on-premises with hybrid networking. For the Ledger Database, migrating from self-managed Oracle to Amazon RDS for Oracle represents a Replatform strategy because it shifts the administrative platform to a managed service while keeping the engine identical, preserving complex PL/SQL packages. Using AWS DMS enables replication and a cutover time of less than 1 hour.

Step-by-Step Solution

1
Analyze the Web Portal migration strategy.
Identify that upgrading the operating system platform from legacy SUSE Linux 11 to Amazon Linux 2023, while keeping application code unchanged, maps to a Replatform strategy.
Upgrading platform components (OS, runtime) during migration without altering application architecture is classified as Replatforming.
2
Analyze the Risk Engine migration compatibility.
Determine that because the engine is a compiled AIX binary for IBM Power Systems (non-x86/non-ARM architecture) and source code is unavailable, it cannot be run on AWS compute resources. It must be Retained on-premises.
AWS Application Migration Service (MGN) and EC2 do not support IBM AIX on Power Systems. Since recompilation is impossible, the workload must remain on-premises (Retain) with hybrid connectivity.
3
Analyze the Ledger Database requirements and select the appropriate 7 Rs strategy.
Determine that migrating the self-managed database to Amazon RDS for Oracle is a Replatform strategy that fulfills the managed service requirement. It retains Oracle features (PL/SQL packages) and meets the 1-hour downtime cutover window using AWS DMS.
Refactoring the database to Aurora PostgreSQL is too high-risk and time-consuming because of proprietary PL/SQL auditing requirements. Rehosting on EC2 fails to reduce administrative overhead. Replatforming to Amazon RDS for Oracle satisfies all constraints.

Key Concept

Workload assessment and strategy selection (7 Rs) based on OS/hardware architecture limits, proprietary software licensing, database engine dependencies, and operational SLA requirements.
Estimated Time:3m 0s
Question 1213Question →

A financial services company has a transaction auditing application hosted on Amazon EC2 instances across three Availability Zones in the us-east-1 Region. The instances are in private subnets and send audit logs to external regulatory endpoints via a single NAT Gateway located in the us-east-1a subnet. The application uses a multi-AZ Amazon RDS PostgreSQL database. The company is establishing a disaster recovery (DR) site in the us-west-2 Region with a target Recovery Time Objective (RTO) of 10 minutes and a Recovery Point Objective (RPO) of 1 minute.

During a recent local network impairment in us-east-1a, the auditing application lost outbound connectivity to the external regulatory endpoints across all Availability Zones. Additionally, during a DR simulation, automatic failover to the secondary region did not trigger when the primary region became degraded because the Route 53 DNS records lacked active health monitoring.

Which set of actions will resolve the outbound connectivity issue and ensure a reliable automated failover to the secondary region within the target RTO and RPO?

Show answer & explanation

Answer: Deploy a NAT Gateway in each of the three Availability Zones in the primary region, and update the private subnet route tables to direct outbound traffic through the local NAT Gateway. Configure an Amazon RDS cross-region read replica in the secondary region. Create Route 53 failover routing records pointing to the primary and secondary Application Load Balancers, and associate the primary record with a Route 53 health check configured to monitor the primary endpoint.

Answer

Deploy a NAT Gateway in each Availability Zone of the primary region to ensure local internet egress redundancy. Replicate the database using an Amazon RDS cross-region read replica to meet the 1-minute RPO, and configure Route 53 failover routing with a health check on the primary record to enable automated failover to the secondary region.
Deploying a NAT Gateway in each Availability Zone ensures high availability for outbound traffic. Using an Amazon RDS cross-region read replica supports a Recovery Point Objective (RPO) of under one minute due to near-real-time asynchronous replication. Associating the primary Route 53 failover record with an active health check enables automatic DNS failover to the disaster recovery region when the primary region is degraded.

Step-by-Step Solution

1
Analyze outbound internet connectivity requirements for the primary region.
Identify that relying on a single NAT Gateway in one Availability Zone (AZ) creates a single point of failure. To achieve high reliability, a NAT Gateway must be deployed in each AZ, with route tables updated to route local private subnet traffic through the local zone's NAT Gateway.
Ensures that an outage in one AZ does not disrupt outbound traffic originating from the other healthy AZs.
2
Evaluate the database replication strategy against RTO and RPO requirements.
A target RPO of 1 minute requires active database replication. An Amazon RDS cross-region read replica replicates data asynchronously, typically with a lag of seconds, satisfying the 1-minute RPO. Backup snapshot copying (hourly) is insufficient as it yields an RPO of 1 hour.
Determines the appropriate replication method to meet business continuity and data loss constraints.
3
Configure DNS routing and automated failover for disaster recovery.
Use Route 53 failover routing policy with a primary record pointing to the primary ALB and a secondary record pointing to the recovery region's ALB. Associate the primary record with a Route 53 health check.
Route 53 requires an active health check associated with the failover record to automatically detect a regional degradation and shift traffic to the recovery endpoint.

Key Concept

Deploying redundant NAT Gateways per Availability Zone prevents outbound single points of failure. Implementing cross-region read replicas satisfies low RPO requirements, and pairing Route 53 failover routing with active health checks enables automated multi-region disaster recovery failover.
Question 1214Question →

An enterprise uses AWS Organizations to manage its multi-account environment. The central IT security team must deploy and configure a third-party security agent on all Amazon EC2 instances, including hybrid managed instances, across multiple member accounts. The installation scripts and configuration files for the agent are stored in a centralized Amazon S3 bucket within a shared services account. The configuration must be enforced daily to remediate any manual modifications, and the configuration files must be encrypted at rest. Which combination of actions must a Solutions Architect take to implement this solution? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Encrypt the centralized S3 bucket using an AWS KMS Customer Managed Key (CMK). Configure the KMS key policy to grant cross-account decrypt permissions to the IAM instance profiles in the member accounts, and configure the S3 bucket policy to allow read access from the member accounts.; Use AWS CloudFormation StackSets to deploy an AWS Systems Manager (SSM) State Manager association to all member accounts. Configure the association to execute the AWS-RunRemoteScript document on a daily cron schedule to retrieve and run the installation script from the centralized S3 bucket.

Answer

The solutions architect must encrypt the centralized S3 bucket with an AWS KMS Customer Managed Key (CMK) and configure cross-account access on both the S3 bucket and KMS key policies, and then deploy local SSM State Manager associations to member accounts via CloudFormation StackSets to execute the installation script daily.
Automating multi-account configuration deployment and drift correction is best achieved by deploying local SSM State Manager associations to target accounts using CloudFormation StackSets. The association runs locally on a daily schedule to maintain compliance. When accessing configuration files from a central S3 bucket in another account, the bucket must be encrypted with a Customer Managed Key (CMK), and the key policy must grant decryption access to the external instance profiles. This is because default AWS-managed KMS keys do not support policy modifications and cannot be shared cross-account.

Step-by-Step Solution

1
Set up a KMS Customer Managed Key and configure permissions on the S3 bucket in the shared services account.
A CMK is created with a policy allowing decryption from member account roles, and the S3 bucket is configured to allow read access.
AWS-managed KMS keys do not support cross-account sharing, so a customer managed key is required to allow instances in other accounts to decrypt configuration files.
2
Configure the IAM instance profiles in the member accounts.
IAM roles attached to the EC2 and hybrid instances are granted read permissions to the S3 bucket and decrypt permissions to the CMK.
The instances need authorization to access and decrypt the files stored in the shared services account.
3
Create and deploy local State Manager associations in the member accounts.
CloudFormation StackSets deploy State Manager associations to all member accounts to run the installation script daily.
Running the script locally on a daily schedule remediates configuration drift on both EC2 and hybrid managed instances.

Key Concept

Cross-account configuration baseline automation using SSM State Manager, CloudFormation StackSets, and cross-account KMS CMK permissions.
Estimated Time:3m 0s
Question 1215Question →

A retail company manages its multi-account environment using AWS Organizations. The central DevOps account hosts a CI/CD pipeline using AWS CodePipeline to package applications and store the deployment artifacts in a central Amazon S3 bucket. The artifacts are encrypted using the default AWS-managed KMS key (aws/s3). An AWS CodeDeploy deployment group in a target production account retrieves these artifacts to update an Application Load Balancer-backed Auto Scaling group (ASG) of Amazon EC2 instances. Recently, deployments have been failing because target production accounts cannot decrypt and retrieve the deployment artifacts. Additionally, local engineers have manually modified target ASG configurations (such as desired capacity and launch templates), causing configuration drift from the source AWS CloudFormation templates. The company wants to automatically detect and remediate this drift while restoring the deployment pipeline functionality. Which combination of steps should a solutions architect implement to resolve the deployment failure and automate drift remediation?

Show answer & explanation

Answer: Configure the S3 bucket in the central DevOps account to use an AWS KMS Customer Managed Key (CMK). Update the CMK policy to grant the target production account's IAM execution role kms:Decrypt and kms:GenerateDataKey permissions, and grant read access via the S3 bucket policy. In the target account, use an AWS Config rule to monitor CloudFormation stack drift and configure an AWS Systems Manager Automation remediation action using the AWS-UpdateCloudFormationStack document to synchronize the resources with the template.

Answer

Configure the S3 bucket in the central DevOps account to use an AWS KMS Customer Managed Key (CMK) with appropriate cross-account permissions, and use AWS Config to trigger AWS Systems Manager Automation executing the AWS-UpdateCloudFormationStack document to resolve configuration drift.
The correct option addresses the cross-account decryption issue by replacing the AWS-managed KMS key with a Customer Managed Key (CMK) and updating the key policy to permit cross-account IAM access. It also handles drift remediation properly by using AWS Config to trigger Systems Manager Automation, which executes a CloudFormation stack update to align the actual resources with the template definition without bypassing CloudFormation control.

Step-by-Step Solution

1
Configure the S3 bucket in the central DevOps account to use an AWS KMS Customer Managed Key (CMK) instead of the default AWS-managed KMS key.
The S3 bucket uses a key whose policy can be modified to grant cross-account permissions.
AWS-managed keys (such as aws/s3) do not support policy modification and cannot be shared across AWS accounts.
2
Update the Customer Managed Key policy to grant target production account IAM roles kms:Decrypt and kms:GenerateDataKey permissions, and allow read access in the S3 bucket policy.
The target production account's IAM execution role can download and decrypt the deployment artifacts from S3.
Cross-account access to encrypted S3 resources requires both S3 bucket policy allowance and explicit KMS key policy permissions.
3
Deploy the cloudformation-stack-drift-detection-check AWS Config rule in the target account and configure Systems Manager Automation to execute AWS-UpdateCloudFormationStack when drift is detected.
Resource configuration drift is automatically detected and remediated by updating the CloudFormation stack to match the template.
Direct, out-of-band modifications to managed resources break the CloudFormation stack state. Remediation must go through the CloudFormation API to keep the stack in a consistent state.

Key Concept

Cross-account pipeline artifact sharing requires AWS KMS Customer Managed Keys (CMKs) to enable cross-account policies, and infrastructure configuration drift must be remediated through the deployment framework (AWS CloudFormation) rather than out-of-band API calls to maintain stack consistency.
Estimated Time:3m 0s
Question 1216Question →

A gaming company is running a multiplayer game platform on a fleet of Amazon EC2 instances across multiple AWS accounts within AWS Organizations. The game server application writes performance metrics and access logs to `/opt/gameserver/logs/server.log`, which is rotated and renamed to `/opt/gameserver/logs/server.log.timestamp` every hour. The company wants to centralize these application logs in Amazon CloudWatch Logs for real-time analysis. Additionally, they must store all CloudTrail logs from all member accounts in a single Amazon S3 bucket within a dedicated auditing account.

Which of the following actions should the Solutions Architect take to implement this monitoring and logging setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Install the Amazon CloudWatch agent on the EC2 instances and configure the log path in the agent configuration using a wildcard pattern such as '/opt/gameserver/logs/server.log*' to capture rotated files.; In the auditing account, update the S3 bucket policy to grant 's3:PutObject' permission to the CloudTrail service principal 'cloudtrail.amazonaws.com' with a condition that checks the 'aws:PrincipalOrgID' key against the organization ID.

Answer

Install the Amazon CloudWatch agent on the EC2 instances and configure the log path using a wildcard pattern such as '/opt/gameserver/logs/server.log*' to capture rotated files, and update the S3 bucket policy in the auditing account to grant 's3:PutObject' permission to the CloudTrail service principal with a condition checking 'aws:PrincipalOrgID' against the organization ID.
Configuring the Amazon CloudWatch agent log path with a wildcard pattern ensures that the agent monitors and ingests both active and rotated log files. To allow the CloudTrail service to write logs from all accounts in the organization to a central S3 bucket, the S3 bucket policy must grant 's3:PutObject' permission to the CloudTrail service principal ('cloudtrail.amazonaws.com') and enforce organization-wide boundaries using the 'aws:PrincipalOrgID' condition key.

Step-by-Step Solution

1
Address the log rotation monitoring requirement by configuring the CloudWatch agent on the EC2 instances.
Use a wildcard pattern like `/opt/gameserver/logs/server.log*` in the agent configuration file to ensure the agent picks up the active log file as well as rotated files.
A static path configuration fails when files are renamed during rotation, causing the agent to miss logs.
2
Address the centralized cross-account CloudTrail logging requirement by updating the destination S3 bucket policy.
Grant `s3:PutObject` permission to the `cloudtrail.amazonaws.com` service principal and add a condition checking `aws:PrincipalOrgID` matching the organization's ID.
This allows CloudTrail to write logs from all member accounts in the organization while preventing unauthorized writes from external accounts.

Key Concept

Centralizing multi-account application and governance logs using the CloudWatch agent and S3 bucket policies with AWS Organizations.
Question 1217Question →

A company is planning to migrate a legacy document processing application to AWS within a strict 6-month timeline. The application consists of three tiers:

1. A web tier running Apache HTTP Server on Red Hat Enterprise Linux 7 virtual machines.
2. A processing tier running a Java-based document parsing engine on IBM AIX servers. The engine utilizes a proprietary native C-shared library for file parsing and requires POSIX-compliant local filesystem access. The company cannot rewrite the core logic due to budget and time constraints.
3. A database tier running Oracle Database 19c on-premises, using proprietary Oracle Spatial features for document metadata geotagging. The company wants to eliminate commercial database licensing costs and is willing to convert the database schema and modify application SQL queries.

Which combination of migration strategies (7 Rs) represents the most appropriate and feasible migration path for this application?

Show answer & explanation

Answer: Rehost the web tier on Amazon EC2 using AWS Application Migration Service (MGN); Replatform the processing tier by recompiling the C-shared library and running the Java application on x86_64 Amazon Linux 2 EC2 instances; Refactor the database tier by converting the Oracle schema and migrating to Amazon Aurora PostgreSQL using the AWS Schema Conversion Tool (SCT) and AWS Database Migration Service (DMS).

Answer

Rehost the web tier on Amazon EC2 using AWS Application Migration Service (MGN); Replatform the processing tier by recompiling the C-shared library and running the Java application on x86_64 Amazon Linux 2 EC2 instances; Refactor the database tier by converting the Oracle schema and migrating to Amazon Aurora PostgreSQL using the AWS Schema Conversion Tool (SCT) and AWS Database Migration Service (DMS).
The correct strategy involves rehosting the web tier, replatforming the processing tier, and refactoring the database tier. Rehosting the web tier using AWS Application Migration Service (MGN) is the fastest way to migrate the RHEL 7 virtual machines within the 6-month timeline. The processing tier runs on IBM AIX, which uses the POWER architecture. Because AWS MGN only supports block-level replication for x86/x64 Windows and Linux, the workload cannot be rehosted directly. Replatforming is the correct choice here because the Java application and C-shared library must be ported and recompiled to run on x86_64 Amazon Linux 2 EC2 instances, preserving the local POSIX filesystem behavior without rewriting the core application logic. The database tier must be refactored because moving from Oracle Database to Amazon Aurora PostgreSQL is a heterogeneous database migration that requires schema conversion (using the AWS Schema Conversion Tool) and database query rewrites (specifically for the proprietary Oracle Spatial features to PostGIS), which constitutes a Refactor strategy.

Step-by-Step Solution

1
Analyze the web tier migration requirements.
The web tier runs on Red Hat Enterprise Linux 7, which is fully supported for block-level replication by AWS Application Migration Service (MGN), making Rehost the most efficient choice within the 6-month timeline.
Identifying the quickest, lowest-risk migration path for compatible virtual machines helps meet tight schedule constraints.
2
Evaluate migration options for the proprietary IBM AIX processing tier.
AWS MGN cannot be used because it does not support AIX (POWER architecture). Because the application cannot be rewritten due to budget, but must run on x86_64 EC2, we must recompile the native C-shared library and package the Java application for Linux. This is classified as a Replatform strategy.
Determining OS compatibility and matching it against workload constraints prevents infeasible migration pathways.
3
Assess the database tier migration path.
Moving from Oracle to Amazon Aurora PostgreSQL is a heterogeneous database engine migration. Because the application utilizes proprietary features (Oracle Spatial) that must be converted (e.g., to PostGIS) and SQL queries must be modified, this requires AWS SCT and DMS, which falls under the Refactor (Re-architect) migration strategy.
Distinguishing between a minor database migration (RDS Oracle - Replatform) and a complete database engine change with code modification (Refactor) ensures correct resource allocation and planning.

Key Concept

Assess and Select Migration Strategy (7 Rs)
Estimated Time:3m 0s
Question 1218Question →

A financial company is enhancing data protection and compliance by centralizing its application logs from multiple member accounts within an AWS Organization. The solution must store these logs in an Amazon S3 bucket within a centralized Security Audit account. The logs must be encrypted at rest using a KMS key, and member account administrators must be restricted from disabling or deleting the encryption keys. Which combination of actions should the solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Create a customer managed KMS key in the Security Audit account, and enable automatic key rotation. Configure the KMS key policy to permit the member accounts to use the key for encryption. Configure the S3 bucket policy in the Security Audit account to allow the member accounts to upload objects, specifying the AWS Organization ID as a condition. Configure the member accounts to write their logs to this S3 bucket using the customer managed KMS key. Apply a Service Control Policy (SCP) at the Organization root to deny kms:DisableKey and kms:ScheduleKeyDeletion actions.

Answer

Create a customer managed KMS key in the Security Audit account, enable automatic key rotation, and configure the KMS key policy and S3 bucket policy to allow cross-account access. Then, apply a Service Control Policy (SCP) to deny disabling or deleting keys.
To support cross-account access, a customer managed KMS key must be used because AWS managed keys cannot have their key policies modified. The Security Audit account's S3 bucket policy must explicitly permit the member accounts to upload objects (using condition keys like aws:PrincipalOrgID for organization-wide scope). In addition, key policies must explicitly grant the member accounts permissions to use the KMS key. To enforce key protection, a Service Control Policy (SCP) must be used to deny deletion and disabling actions, preventing member account administrators from tampering with the key.

Step-by-Step Solution

1
Select the correct key type for cross-account encryption.
Choose a Customer Managed Key (CMK) instead of an AWS managed key.
AWS managed KMS keys do not support policy modification and cannot be shared across accounts.
2
Configure the S3 bucket policy and KMS key policy for cross-account access.
The destination S3 bucket policy must allow s3:PutObject for cross-account principals, and the KMS key policy must grant permissions like kms:GenerateDataKey and kms:Decrypt.
Both S3 and KMS permissions must be properly configured to allow external accounts to write encrypted objects.
3
Apply a Service Control Policy (SCP) for key protection.
Attach an SCP at the Organization root or OU that denies kms:DisableKey and kms:ScheduleKeyDeletion.
SCPs act as organizational guardrails to prevent administrators in member accounts from deleting or disabling the encryption keys.

Key Concept

Cross-account KMS encryption, S3 bucket policies, and Service Control Policies (SCPs) acting as guardrails.
Estimated Time:2m 30s
Question 1219Question →

An enterprise has a critical microservices-based application running across two AWS accounts in an AWS Organization. The core architecture is as follows:

* An ingestion service runs in private subnets on Amazon ECS Fargate in VPC-A (`us-east-1`, Account 1).
* Outbound traffic from ECS tasks to external APIs passes through a single NAT Gateway located in the public subnet of Availability Zone `us-east-1a`.
* The service resolves internal domain names of dependency services in VPC-B (Account 2) using a Route 53 Private Hosted Zone (PHZ) created in Account 2.
* The state is persisted in an Amazon Aurora PostgreSQL Serverless v2 DB cluster in `us-east-1`.

The company needs to enhance the reliability and disaster recovery posture of the application to achieve a cross-region RTO of under 15 minutes and RPO of under 5 minutes to a standby region `us-west-2`. The solution must also eliminate single points of failure in the primary region's networking and ensure seamless DNS resolution of dependency services in VPC-B from the standby region.

Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a secondary Aurora PostgreSQL cluster in `us-west-2` and configure Amazon Aurora Global Database to replicate data from `us-east-1`. Modify the VPC configuration in `us-east-1` to deploy a NAT Gateway in each Availability Zone where ECS tasks run, updating the private subnet route tables to point to their local NAT Gateway.; Authorize the Route 53 Private Hosted Zone in Account 2 to be associated with the VPC in `us-west-2` (Account 1), and accept the association. Set up a Route 53 active-passive failover routing policy pointing to the Application Load Balancers in both regions, and associate the primary record with a custom Route 53 health check that monitors the health of the primary ingestion service.

Answer

Deploy a secondary Aurora PostgreSQL cluster in the standby region using Amazon Aurora Global Database, configure multi-AZ NAT Gateways in the primary region, associate the existing cross-account Route 53 Private Hosted Zone with the standby VPC, and set up a Route 53 active-passive failover routing policy with a custom health check.
The correct combination of actions addresses all requirements: (1) Aurora Global Database provides sub-second cross-region replication for RPO < 5 minutes and supports failover in minutes for RTO < 15 minutes. (2) Deploying a NAT Gateway per Availability Zone removes the networking single point of failure in the primary region. (3) Associating the existing cross-account Route 53 Private Hosted Zone ensures seamless DNS resolution of dependency services from the standby VPC. (4) An active-passive failover routing policy combined with a custom Route 53 health check ensures reliable redirection of traffic during a disaster.

Step-by-Step Solution

1
Address database replication to meet recovery objectives.
Configure Amazon Aurora Global Database with a primary cluster in the primary region and a secondary cluster in the standby region.
Aurora Global Database utilizes storage-level physical replication to achieve sub-second data replication (meeting the under 5-minute RPO requirement) and supports fast regional failovers (meeting the under 15-minute RTO requirement).
2
Eliminate networking single points of failure.
Deploy a NAT Gateway in each Availability Zone in the primary region and update the corresponding private subnet routing tables.
A single NAT Gateway in one Availability Zone is a single point of failure. If that zone goes down, all private subnets lose internet access. Deploying redundant NAT Gateways per zone ensures zone isolation and high availability.
3
Establish cross-account and cross-region internal DNS resolution.
Use the AWS CLI or SDK to authorize the VPC in the standby region to be associated with the Private Hosted Zone in the secondary account, then accept the association.
A Route 53 Private Hosted Zone must be associated with any VPC that needs to resolve its domain names. Authorizing and accepting cross-account VPC associations allows the standby VPC to reuse the existing hosted zone.
4
Configure active-passive failover routing.
Create a Route 53 failover record set and associate a custom health check monitoring application status with the primary record.
Without an explicit health check, Route 53 cannot detect backend application failures if the Application Load Balancer itself remains responsive, preventing automatic failover.

Key Concept

Multi-region disaster recovery coordination, database replication options, NAT Gateway redundancy, cross-account Route 53 private hosted zone associations, and health check-driven DNS failover.
Estimated Time:3m 0s
Question 1220Question →

A company is modernizing a legacy web application by migrating its API to Amazon API Gateway and AWS Lambda. The application's backend database is an Amazon RDS for MySQL DB instance. During testing, peak traffic causes the Lambda functions to exhaust the database's available connection pool, leading to connection timeout errors. Additionally, the solutions architect must ensure that the database credentials are secure and that the application is resilient to traffic spikes. Which TWO configurations should the solutions architect implement to resolve the connection scaling issues and prevent database overload? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create and configure an Amazon RDS Proxy between the Lambda functions and the RDS database instance to manage and pool connections.; Configure reserved concurrency on the Lambda functions to limit the maximum number of concurrent executions to a level the database can handle.

Answer

The correct configurations are to use Amazon RDS Proxy to pool database connections, and to configure reserved concurrency on the Lambda functions to limit the maximum concurrent executions.
The correct configurations are to use Amazon RDS Proxy to pool database connections and to set reserved concurrency limits on the Lambda functions. Amazon RDS Proxy pools and shares database connections, which prevents Lambda from exhausting the DB instance's connection limits during scaling. Configuring reserved concurrency prevents the Lambda functions from scaling beyond the database's capacity, which protects the database and ensures other functions in the account are not throttled due to concurrency exhaustion.

Step-by-Step Solution

1
Analyze the database connection scaling issue.
Identify that the ephemeral nature of AWS Lambda causes it to open new connections for each execution container, quickly exhausting the Amazon RDS database connection limit.
Understanding why the connection limit is being reached is necessary to select the appropriate scaling mitigation.
2
Evaluate solutions for connection pooling.
Determine that Amazon RDS Proxy sits between Lambda and the database to pool and reuse connections, keeping the number of database connections low.
RDS Proxy is the AWS recommended service for managing connection limits in serverless architectures.
3
Evaluate solutions to prevent backend database overload.
Determine that configuring reserved concurrency limits the maximum number of concurrent Lambda executions, thus capping the total concurrent connections.
Limiting concurrency prevents the Lambda functions from scaling beyond what the database can support, protecting the database from resource exhaustion.

Key Concept

AWS Lambda integrates with Amazon RDS Proxy to pool database connections, and uses reserved concurrency to prevent connection exhaustion and database resource overload.
PreviousPage 61 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin