All practice questions

An enterprise operates a citizen portal application using a multi-tier microservices architecture in the us-east-1 Region. The web tier consists of Amazon ECS tasks running on AWS Fargate behind an Application Load Balancer (ALB). The application logic runs on AWS Lambda behind Amazon API Gateway. The data tier utilizes Amazon DynamoDB. The entire environment is provisioned using AWS CloudFormation. To enhance the disaster recovery (DR) posture, the enterprise wants to establish a warm standby architecture in the us-west-2 Region with a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

An enterprise is designing a new multi-VPC architecture in the `us-west-2` Region. The architecture contains:
- `vpc-logistics-core` ($10.120.0.0/16$) hosting critical backend applications across two Availability Zones.
- `vpc-egress-shared` ($192.168.0.0/22$) serving as a centralized egress VPC with NAT Gateways.
- A centralized Route 53 Private Hosted Zone (PHZ) `logistics.aws.internal` hosted in a separate shared services account.

All spoke VPCs connect to `vpc-egress-shared` using an AWS Transit Gateway (`tgw-global-transit`). The solution must provide highly available outbound internet connectivity, prevent any direct network communication between spoke VPCs, and enable private DNS resolution of names within `logistics.aws.internal` for all instances in the spoke VPCs.

Which TWO configurations must a Solutions Architect implement to meet these requirements?

An enterprise is planning to migrate a two-tier customer portal application to AWS. The web tier consists of an ASP.NET Core application running on Windows Server IIS that requires no modifications and must be migrated within a two-week window. The database tier runs on an on-premises Microsoft SQL Server database. To eliminate licensing costs and reduce administrative overhead, the enterprise wants to migrate the database to Amazon Aurora PostgreSQL. This migration will require database schema conversion and modifications to the application's data access layer. Which TWO migration strategies should the solutions architect select for this migration? (Select TWO.)

A digital document management and e-signature platform uses an Amazon RDS for PostgreSQL DB instance to track active user signing sessions, signer verification states, and document metadata. During peak business hours at the end of the fiscal quarter, the database CPU utilization exceeds $92\%$ due to a surge in read-heavy queries verifying session tokens and user permissions. The application requires session data to be highly available, replicate across multiple Availability Zones to prevent data loss during failovers, and maintain sub-millisecond retrieval times. The solutions architect must optimize the database layer to resolve the performance bottleneck while meeting these availability and persistence requirements.

Which of the following database and caching strategies should the solutions architect implement?

A company wants to migrate its on-premises self-hosted PostgreSQL database to Amazon RDS for PostgreSQL to eliminate the administrative overhead of patching and backups. The migration must be completed with no changes to the application code or the database engine. Which migration strategy under the 7 Rs framework represents this path?

A logistics company is planning to migrate its fleet management system to AWS. The system consists of the following components:

1. A web application running on Red Hat Enterprise Linux (RHEL) virtual machines. The migration must be completed quickly with zero modification to the application code.
2. A commercial Oracle database containing transactional data. The company wants to migrate this workload to Amazon Aurora PostgreSQL to eliminate license costs and take advantage of serverless scaling, which will require schema conversion and rewriting stored procedures.
3. A legacy dispatch scheduling console running on an unsupported custom UNIX operating system. The console is tied to proprietary local serial-port hardware and cannot be virtualized or moved to the cloud.

Which combination of migration strategies from the 7 Rs framework should the company select for these components?

A company is designing the network architecture for a new AWS deployment in the `us-west-2` Region. The deployment consists of three VPCs: `vpc-app-prod`, `vpc-app-test`, and `vpc-shared-services`. An on-premises data center is connected to AWS via an AWS Direct Connect connection. The networking requirements are:
1. Enable routing between the on-premises data center and all three VPCs.
2. Enable direct routing between `vpc-app-prod` and `vpc-shared-services`.
3. Provide redundant outbound internet connectivity for resources in private subnets across multiple Availability Zones in `vpc-app-prod` and `vpc-app-test`.
4. Allow both the on-premises servers and resources in all three VPCs to resolve DNS hostnames within a Route 53 Private Hosted Zone (PHZ) named `cloud.internal`.

Which of the following designs meets these requirements with the least operational overhead?

An enterprise web application is hosted on Amazon EC2 instances in private subnets across three Availability Zones ($AZ-A$, $AZ-B$, and $AZ-C$). The instances are managed by an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The instances execute a complex bootstrap script that downloads dependencies from external repositories, taking approximately $8$ minutes to become fully operational. Outbound internet traffic is routed through a single NAT Gateway located in $AZ-A$.

The company is preparing for a scheduled marketing campaign that will generate a massive, instantaneous $10\times$ surge in traffic. Historically, during similar events, the ALB dropped initial requests, and the ASG launched far more instances than needed, leading to unnecessary costs.

Which TWO actions should the Solutions Architect implement to improve the system's fault tolerance and optimize its scaling behavior for the campaign?

A logistics company is designing a real-time supply chain tracking platform. The platform must ingest high-volume IoT telemetry data from millions of active sensors (write-intensive NoSQL workload, up to $100,000$ writes per second) and store historical device logs for regulatory audits (cold object storage, up to $50\text{ TB}$ monthly). The tracking data must be queryable by device ID with sub-$10$ millisecond latency for the latest $30$ days. Historical logs must be retained for $7$ years, encrypted with a key controlled by the security team in a centralized security account, and must be cost-optimized with a retrieval time of under $5$ hours for audits. The disaster recovery requirements dictate an RTO of under $15$ minutes and an RPO of under $1$ minute for the real-time tracking data. Which of the following database and storage strategies meets these requirements with the lowest cost and complexity?

A company hosts a high-traffic gaming platform on AWS. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The session data and player profiles are stored in an Amazon RDS for PostgreSQL database. During scheduled weekend tournament events, the platform experiences an instantaneous 10x spike in traffic. During these events, users encounter high latency and connection timeouts. Monitoring reveals that the ALB is dropping connections with HTTP 502 errors due to the sudden surge, and the RDS database experiences high read latency under the heavy query load. Which combination of actions should a solutions architect take to optimize the compute and storage performance of the architecture for these events?

An automotive company operates an IoT connected vehicle platform that transmits real-time telemetry data, location records, and vehicle diagnostic logs from vehicles to an Amazon S3 bucket in a Production AWS account. Due to new industry compliance mandates, the company must enhance data protection and auditability for this platform.

The solutions architect must implement a security solution that satisfies the following requirements:
- All telemetry data written to the S3 bucket must be encrypted at rest using an AWS KMS key that is rotated annually.
- Key management must be strictly segregated: the security team in a separate Central Security AWS account must control the KMS key and its policy, while the application in the Production account must only be granted permission to encrypt and decrypt the telemetry files.
- Access to the telemetry files must be audited. Any unauthorized access attempts must trigger an immediate notification.
- The telemetry data must remain completely immutable and protected against deletion or modification by any user, including the root user, for a retention period of 7 years.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

An enterprise is designing a new multi-account architecture in the `ap-northeast-1` region. The architecture contains:

* An application VPC (`vpc-tokyo-app`, CIDR $10.200.0.0/16$) spanning two Availability Zones (`ap-northeast-1a` and `ap-northeast-1c`).
* A shared services VPC (`vpc-tokyo-shared`, CIDR $10.210.0.0/16$) spanning `ap-northeast-1a` and `ap-northeast-1c`, which hosts a centralized Route 53 Private Hosted Zone (PHZ) named `corp.internal`.
* An on-premises datacenter connected via a $10\text{ Gbps}$ AWS Direct Connect (DX) connection terminating at a Direct Connect Gateway (DXGW).

The requirements are:
1. All spoke VPCs must route outbound internet traffic through centralized NAT Gateways in `vpc-tokyo-shared`.
2. The network architecture must be highly resilient against Availability Zone failures.
3. Resources in both `vpc-tokyo-app` and the on-premises datacenter must be able to resolve DNS queries for `corp.internal`.
4. Route propagation must be automated to minimize administrative routing overhead.

Which of the following designs best meets these requirements?

An enterprise is setting up a new production workload in a newly created VPC named `vpc-billing-prod` within the `eu-central-1` region. The application runs across private subnets in three Availability Zones. The application must interact with:

1. An on-premises database via an existing AWS Site-to-Site VPN connection.
2. Amazon S3 to store large transaction logs.
3. A shared DNS domain (`internal.corp`) hosted on a Route 53 Private Hosted Zone (PHZ) in a separate AWS account managed by the network team.
4. The public internet to retrieve software updates.

To meet business requirements, the architecture must be highly available, avoid single points of failure, and minimize data transfer and operational costs.

Which TWO configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

A global SaaS platform hosts its consumer-facing application on Amazon EC2 instances in private subnets across two AWS Regions: us-east-1 and eu-west-1. The application uses Application Load Balancers (ALBs) to distribute traffic. Users in Asia and South America are experiencing high latency and connection timeouts during peak utilization hours. Additionally, the internal microservices in both regions need to resolve each other's DNS queries securely and with minimal latency. An upcoming marketing event is expected to increase traffic by 10 times the current peak within a few minutes. Which two actions should the solutions architect recommend to optimize network performance and reduce latency? (Select two.)

A company has an existing application that stores sensitive customer documents in an Amazon S3 bucket within a production AWS account. The S3 bucket is currently encrypted using the AWS-managed KMS key (aws/s3). To meet new regulatory compliance requirements, a security audit determines that:

- The encryption key must be rotated automatically on an annual basis, and the security team must have the ability to explicitly edit its key policy.
- A compliance audit team operating from a separate, dedicated audit AWS account must be able to read the encrypted documents directly from the S3 bucket.

Which combination of actions will meet these requirements? (Select TWO.)

An enterprise is planning to migrate its on-premises inventory management system to AWS. The system consists of three distinct components:

1. A Java-based web application running on Apache Tomcat. The development team wants to avoid modifying the application code but wishes to eliminate operating system maintenance by hosting it on AWS Fargate.
2. A backend Oracle Database Enterprise Edition 19c that requires high licensing fees. The enterprise wants to eliminate these license costs by migrating to Amazon Aurora PostgreSQL.
3. A legacy reporting system running on a Solaris UNIX server that utilizes a physical hardware key (USB dongle) for license validation. The vendor software does not support x86-64 virtualization, and the software contract is active for another three years.

Which of the following migration strategies represent the correct alignment under the AWS 7 Rs framework for these components? (Select TWO)

A logistics company has an existing application that stores customer delivery signatures and shipping manifests in an Amazon S3 bucket. The bucket is currently configured with Server-Side Encryption with Amazon S3 managed keys (SSE-S3). Due to new regulatory compliance mandates, the company must enhance its data protection posture by meeting the following requirements:
- All data must be encrypted using a key that supports automatic annual rotation.
- Detailed audit logs of all encryption and decryption operations must be centralized in a dedicated security monitoring AWS account.
- The system must minimize the volume of KMS API requests to avoid throttling errors during peak hours when a high volume of documents are uploaded.
- Any attempt to upload objects using incorrect encryption configurations or without encryption must be blocked.

Which combination of actions should the Solutions Architect implement to meet these requirements with the least operational overhead?

A medical technology company operates a critical patient telemetry application running on Amazon EC2 instances in an Auto Scaling group across multiple AWS member accounts. The application writes log data to `/var/log/telemetry/active.log`. Due to high write volume, these log files are rotated and renamed hourly to `/var/log/telemetry/active.log.YYYY-MM-DD-HH` using a local utility. The company needs to centralize these application logs into a single Amazon S3 bucket located in a dedicated monitoring account for long-term retention and security analysis. The solution must ensure that logs are continuously delivered even immediately after rotation, must support encryption at rest in the destination bucket using a customer-managed key, and must scale efficiently with minimum administrative overhead. Which solutions architecture meets these requirements?

A luxury watch retailer hosts its online storefront on AWS, using an Amazon Aurora MySQL database cluster with one writer and two reader instances to manage product cataloging and real-time inventory reservations. During high-traffic product releases, customers experience transaction failures, and the database writer node experiences 100% CPU utilization, leading to database connection timeouts and application-level thread exhaustion. An analysis shows that the bottleneck is caused by high-concurrency database connections and frequent read-modify-write operations on the inventory table. The retailer requires a solution that guarantees sub-millisecond read latency for inventory status, maintains transactional persistence for reservations, and scales automatically to handle connection spikes while maintaining high availability. Which two of the following architectural changes should the Solutions Architect implement to resolve the performance bottlenecks?

A solutions architect is migrating an on-premises physical server to AWS using AWS Application Migration Service (MGN). The replication traffic is configured to travel over a Site-to-Site VPN connection directly into the staging area subnet of the target VPC. The AWS Replication Agent has been successfully installed on the source server, but the replication status shows as disconnected, and data transfer cannot begin. Which of the following configuration changes will resolve the replication connectivity issue?