Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1261Question →

A healthcare company runs a compliant web service on Amazon EC2 instances inside an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The instances must apply specific configuration baselines via an AWS Systems Manager (SSM) State Manager association before serving production traffic. During rapid scale-out events, instances are registered with the ALB target group and begin receiving client traffic before the SSM State Manager association has completed execution, resulting in intermittent compliance auditing failures. A solutions architect must design a fully automated remediation strategy that prevents instances from serving traffic until they are compliant, while minimizing operational overhead. Which strategy should the solutions architect implement?

Show answer & explanation

Answer: Create a launch lifecycle hook in the Auto Scaling group. Configure an Amazon EventBridge rule that detects the lifecycle transition and triggers an AWS Systems Manager Automation workbook. The workbook executes the State Manager association on the target instance and completes the lifecycle action with a CONTINUE status upon successful execution.

Answer

Create a launch lifecycle hook in the Auto Scaling group, trigger an AWS Systems Manager Automation workbook via Amazon EventBridge to apply the State Manager association, and complete the lifecycle action upon success.
The correct approach uses an Auto Scaling lifecycle hook to pause the instance launch state. By triggering an AWS Systems Manager Automation workbook via Amazon EventBridge, the workbook can invoke the State Manager association, verify configuration compliance on the target instance, and then programmatically complete the lifecycle action. This ensures the instance only receives traffic after it is fully configured.

Step-by-Step Solution

1
Configure an Auto Scaling launch lifecycle hook.
Newly launched instances are paused in the 'Pending:Wait' state and are prevented from completing registration with the ALB target group.
This guarantees that production traffic is not routed to the instance until the hook is completed.
2
Configure Amazon EventBridge to detect the lifecycle transition.
An EventBridge rule matches the lifecycle transition event and targets an AWS Systems Manager Automation workbook.
This automates the execution of the remediation script without requiring manual intervention.
3
Implement the SSM Automation workbook to execute the association and send the completion signal.
The workbook executes the configuration association on the specific instance ID and calls the CompleteLifecycleAction API with the 'CONTINUE' result upon success.
This allows the instance to resume launch and join the ALB target group only after the configuration baseline has been fully applied.

Key Concept

Auto Scaling Lifecycle Hooks and AWS Systems Manager Integration
Question 1262Question →

An enterprise runs a distributed supply chain application across multiple AWS accounts in an AWS Organization. The compute layer consists of Amazon ECS tasks running on AWS Fargate inside private subnets across two Availability Zones (AZs) in the us-east-1 Region. The tasks communicate with a single-AZ Amazon Aurora PostgreSQL Serverless v2 database cluster. A single NAT Gateway in a public subnet in us-east-1 handles all outbound internet traffic from the private subnets. The database DNS name is resolved using a Route 53 Private Hosted Zone (PHZ) created in a shared services AWS account.

The enterprise wants to optimize the application's architecture to enhance reliability and establish a Disaster Recovery (DR) strategy in the us-west-2 Region. The DR target requires a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 1 minute.

Which combination of actions will enhance the platform's reliability and meet the disaster recovery requirements while aligning with AWS best practices?

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone of the primary VPC and update route tables. Set up an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Authorize and associate the shared Route 53 Private Hosted Zone with the VPCs in both regions and accounts. Use Route 53 Application Recovery Controller (ARC) routing controls to orchestrate failover to the secondary region.

Answer

Deploying a NAT Gateway in each Availability Zone of the primary VPC, setting up an Aurora PostgreSQL Global Database, associating the shared Route 53 Private Hosted Zone across both accounts and regions, and using Route 53 Application Recovery Controller (ARC) routing controls to manage failover.
The correct solution addresses the network SPOF by introducing Multi-AZ NAT Gateways, achieves the required RPO and RTO using Aurora Global Database, resolves the cross-account DNS issue by properly associating the Private Hosted Zone using cross-account VPC association, and implements deterministic multi-region failover through Route 53 Application Recovery Controller (ARC) routing controls.

Step-by-Step Solution

1
Address the NAT Gateway single point of failure (SPOF) in the primary region.
A NAT Gateway is deployed in the public subnet of each Availability Zone, and private subnet route tables are updated to point to the local NAT Gateway in their respective Availability Zones.
This prevents an outage in a single Availability Zone from disabling internet access for ECS tasks in other Availability Zones.
2
Configure cross-region database replication to meet low RTO and RPO requirements.
An Aurora PostgreSQL Global Database is configured with the primary cluster in us-east-1 and a secondary cluster in us-west-2.
Aurora Global Database offers sub-second replication lag, meeting the RPO of under 1 minute, and can be promoted to a primary cluster in less than a minute, meeting the RTO of under 15 minutes.
3
Establish secure cross-account and cross-region DNS resolution for the database endpoint.
Create a VPC association authorization from the shared services account for the consumer VPCs in us-east-1 and us-west-2, then associate the VPCs with the Private Hosted Zone.
This allows ECS tasks in both regions and accounts to resolve the database domain name correctly without creating duplicate zones.
4
Configure failover routing mechanism using Route 53 ARC.
Route 53 Application Recovery Controller (ARC) routing controls are implemented to manage the failover state.
ARC routing controls provide highly available, deterministic failover controls that do not rely on standard Route 53 data-plane health checks (which cannot monitor private DB endpoints directly) and prevent split-brain scenarios.

Key Concept

Disaster recovery orchestration, high availability network design, and cross-account DNS resolution in multi-region environments.
Estimated Time:3m 0s
Question 1263Question →

A logistics enterprise is upgrading the security posture of an internal tracking application deployed in a multi-account environment. The core application runs on Amazon ECS inside private subnets of a production VPC (VPC-A) in Account-1, fronted by an internal Application Load Balancer (ALB). The DNS for the application is managed in a Route 53 Private Hosted Zone (PHZ) in Account-1. To meet new compliance requirements, the Solutions Architect must configure the following:
1. Allow consumer services running in a development VPC (VPC-B) in Account-2 to resolve the application's domain name. VPC-A and VPC-B are connected via an AWS Transit Gateway.
2. Allow consumer services in Account-2 to write application logs directly to an Amazon S3 bucket in Account-1, ensuring all data is encrypted at rest using AWS KMS.
3. Deploy an AWS WAF Web ACL on the ALB that blocks SQL injection (SQLi) attacks from all sources, while exempting a partner's whitelisted CIDR range from rate-limiting rules that apply to general traffic.
Which combination of actions represents the most secure and operationally viable configuration to meet these requirements?

Show answer & explanation

Answer: In Account-1, authorize the association of VPC-B with the PHZ, then associate VPC-B with the PHZ in Account-2. Create a Customer Managed Key (CMK) in Account-1, configure its key policy to allow access from the Account-2 IAM role, and encrypt the S3 bucket with it. Update the S3 bucket policy to trust the Account-2 IAM role. Configure the WAF Web ACL with the SQLi block rule set to priority 10, followed by the partner IP allow rule at priority 20, and the general rate-limiting rule at priority 30.

Answer

In Account-1, authorize the association of VPC-B with the PHZ, then associate VPC-B with the PHZ in Account-2. Create a Customer Managed Key (CMK) in Account-1, configure its key policy to allow access from the Account-2 IAM role, and encrypt the S3 bucket with it. Update the S3 bucket policy to trust the Account-2 IAM role. Configure the WAF Web ACL with the SQLi block rule set to priority 10, followed by the partner IP allow rule at priority 20, and the general rate-limiting rule at priority 30.
The correct solution accurately addresses all constraints. First, cross-account Route 53 Private Hosted Zone (PHZ) association is authorized from Account-1 and accepted from Account-2, enabling VPC-B to natively resolve the private domain name. Second, a Customer Managed Key (CMK) is used in Account-1 because the default AWS managed key cannot be configured to allow cross-account access. Third, the SQLi block rule is placed at a higher priority than the partner allow rule to ensure all incoming requests are inspected for payloads before any IP-based bypass rules are evaluated.

Step-by-Step Solution

1
Authorize and associate the Private Hosted Zone cross-account.
VPC-B in Account-2 resolves the application's domain name natively.
Cross-account PHZ association is the standard, most cost-effective method to allow resource resolution across VPCs in different accounts connected via Transit Gateway.
2
Create a Customer Managed Key (CMK) and configure S3 bucket policies.
The Account-2 IAM role successfully encrypts and writes logs to the S3 bucket in Account-1.
AWS managed KMS keys (aws/s3) cannot be shared across accounts because their key policies cannot be modified. A CMK must be used with a policy explicitly allowing the Account-2 principal.
3
Set the WAF Web ACL rule evaluation order, prioritizing SQLi detection.
SQLi payloads are blocked from all sources, and only non-malicious traffic from the partner IP bypasses rate limiting.
Rules in AWS WAF are evaluated sequentially based on priority. Placing the partner IP allow rule before the SQLi block rule would cause SQLi payloads from the partner range to bypass the block filter.

Key Concept

Strengthening identity and access via cross-account KMS CMK policies, private DNS sharing via cross-account Route 53 PHZ associations, and securing edge networks using AWS WAF rule ordering.
Question 1264Question →

An enterprise is planning to migrate a three-tier customer portal to AWS as part of a datacenter exit project that must be completed within a strict 6-month window. The architecture and business requirements are as follows:

* Presentation Layer: A stateless Java application running on Apache Tomcat. The operations team wants to eliminate operating system patching and VM management overhead without modifying the application code.
* Database Layer: A Microsoft SQL Server database with high licensing costs. The enterprise wants to migrate to Amazon Aurora PostgreSQL. A preliminary assessment shows that converting the database schema and rewriting complex T-SQL stored procedures will take at least 9 months. The migration must limit the database downtime window to less than 2 hours during the final cutover.
* Reporting Tier: A legacy third-party reporting tool running on Solaris that cannot be virtualized on x86-64 hardware, but must remain available for regulatory compliance audits for another year.

Which combination of migration strategies is the most appropriate to meet the timeline, satisfy the technical constraints, and align with the 7 Rs framework?

Show answer & explanation

Answer: Presentation Layer: Replatform to Amazon ECS on AWS Fargate.
Database Layer: Replatform to Amazon RDS for SQL Server, deferring the Refactor to Amazon Aurora PostgreSQL to a post-migration phase.
Reporting Tier: Retain the legacy tool on-premises or in a co-location facility.

Answer

Presentation Layer: Replatform to Amazon ECS on AWS Fargate. Database Layer: Replatform to Amazon RDS for SQL Server, deferring the Refactor to Amazon Aurora PostgreSQL to a post-migration phase. Reporting Tier: Retain the legacy tool on-premises or in a co-location facility.
Replatforming the presentation layer to Amazon ECS on AWS Fargate satisfies the requirement to eliminate operating system patching and VM management overhead without changing application code. For the database layer, moving from Microsoft SQL Server to Amazon Aurora PostgreSQL is a heterogeneous database migration, which is classified as Refactoring (Re-architecting). Since this refactoring effort is estimated to take 9 months, it cannot be completed within the 6-month migration window. Replatforming the database to Amazon RDS for SQL Server allows the enterprise to meet the 6-month timeline, while deferring the Refactoring phase to a later time. The legacy reporting tool runs on Solaris and cannot be virtualized on standard x86-64 cloud hardware, making Retain the correct strategy.

Step-by-Step Solution

1
Analyze the database migration requirements and timeline constraints.
Identify that moving from Microsoft SQL Server to Amazon Aurora PostgreSQL is a heterogeneous database migration, which represents a Refactoring (Re-architecting) strategy. Since it takes 9 months, it cannot fit into the 6-month datacenter exit window. Therefore, the database must be Replatformed to Amazon RDS for SQL Server initially, deferring the Refactor phase.
To ensure the migration meets the strict datacenter exit timeline.
2
Evaluate the presentation layer operational and code requirements.
Determine that the presentation layer can be containerized and run on Amazon ECS on AWS Fargate. This aligns with the Replatforming strategy.
Fargate removes the server management and OS patching overhead without requiring application code changes.
3
Assess the compatibility of the legacy reporting tool.
Determine that the tool runs on Solaris and has no x86-64 equivalent, meaning it cannot be hosted directly on standard Amazon EC2 instances. Thus, it must be Retained on-premises or in a co-location facility.
To keep the historical compliance data accessible without unsupported platform emulation.

Key Concept

Distinguishing between Replatforming and Refactoring within the 7 Rs framework under strict timeline and platform compatibility constraints.
Question 1265Question →

An international shipping organization is preparing to migrate its legacy container tracking system to AWS. The project must be completed within a strict three-month timeline before their on-premises data center lease expires.

The web tier consists of a monolithic Java application running on Apache Tomcat. The operations team wants to eliminate host-level operating system administration by moving to containerized tasks, but the development team has no capacity to modify the application codebase.

The database tier is powered by a Microsoft SQL Server database. The infrastructure team wants to eliminate operating system patching overhead and simplify license management, but they cannot convert the database engine or schema within the given timeline.

Finally, a legacy reporting service requires a specialized physical hardware security key plugged directly into a local server. This service is slated for decommissioning in nine months, and no budget is allocated for its modification.

Which combination of migration strategies should the solutions architect select to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Replatform the web tier by containerizing the Tomcat application for Amazon ECS on AWS Fargate, and replatform the database tier to Amazon RDS for SQL Server.; Retain the legacy reporting service on-premises until it is decommissioned.

Answer

The correct strategies are to replatform the web tier to Amazon ECS on AWS Fargate and the database tier to Amazon RDS for SQL Server, and to retain the legacy reporting service on-premises.
The correct strategy combines replatforming the web and database tiers with retaining the legacy reporting service on-premises. Replatforming the Tomcat server to Amazon ECS on AWS Fargate eliminates OS administration without requiring codebase changes. Replatforming SQL Server to Amazon RDS for SQL Server eliminates OS patching and simplifies licensing while maintaining the same database engine and schema to meet the 3-month timeline. Retaining the legacy reporting service on-premises is necessary due to the physical security key dependency and its upcoming retirement, avoiding wasted migration effort.

Step-by-Step Solution

1
Analyze the requirements and constraints of the web tier.
The web tier needs to run with minimal host-level OS administration without modifying the application code. Packaging the Tomcat application into a container running on Amazon ECS on AWS Fargate is a Replatform strategy that meets these constraints.
Rehosting on EC2 would leave OS administration overhead, whereas refactoring (rewriting to serverless) would require code changes.
2
Analyze the requirements and constraints of the database tier.
The database needs OS patching removed and licensing simplified, but the database engine and schema must not change due to a tight 3-month timeline. Migrating SQL Server to Amazon RDS for SQL Server is a Replatform strategy that fits these parameters.
Refactoring to Amazon Aurora PostgreSQL requires schema conversion and testing, which cannot be completed in 3 months.
3
Analyze the requirements and constraints of the legacy reporting service.
The service requires a physical USB security key and is scheduled for decommissioning in 9 months with zero budget. The Retain strategy is the only viable path.
Rehosting to EC2 is blocked by the physical key requirement, and any migration effort violates the zero-budget constraint.

Key Concept

Selecting migration strategies (7 Rs) based on timeline, workload dependency, licensing, and operational constraints.
Question 1266Question →

An enterprise operates a multi-account structure in AWS Organizations. An existing application in several member accounts stores sensitive compliance reports in Amazon S3 buckets. Currently, these S3 buckets are encrypted at rest using the AWS-managed KMS key (aws/s3). To meet new regulatory compliance requirements, a centralized auditing application running under an IAM role in a separate Security account must perform periodic read-only audits of these S3 buckets.

Which strategy should a solutions architect implement to enhance data protection and allow the auditing application to access the encrypted data?

Show answer & explanation

Answer: Replace the S3 bucket default encryption with Customer Managed Keys (CMKs) created in each member account. Configure the key policies of these CMKs to grant the security auditing IAM role permission to perform decrypt operations.

Answer

Replace the S3 bucket default encryption with Customer Managed Keys (CMKs) in each member account, and update their key policies to grant the security auditing IAM role decrypt permissions.
The correct strategy is to use Customer Managed Keys (CMKs) in each member account and configure their key policies to grant decrypt permissions to the auditing IAM role. AWS-managed keys (such as aws/s3) do not support key policy modifications and cannot be shared across different accounts, meaning that any solution relying on the default aws/s3 key will fail. By using CMKs, the key owners in the member accounts can delegate KMS decrypt capabilities to the external IAM role in the Security account, which when paired with a matching IAM policy on the auditing role, enables secure cross-account access.

Step-by-Step Solution

1
Identify the key management constraints of AWS-managed KMS keys.
AWS-managed keys (like aws/s3) cannot be shared across accounts because their key policies cannot be modified.
This establishes that the default aws/s3 key cannot support cross-account access for the Security auditing role.
2
Create Customer Managed Keys (CMKs) in each member account.
CMKs are provisioned in the member accounts to replace the default encryption.
CMKs allow administrators to customize key policies to grant cross-account permissions.
3
Modify CMK key policies and auditing role IAM policies.
The CMK key policy allows kms:Decrypt to the Security auditing role ARN, and the auditing role's IAM policy allows kms:Decrypt on the CMK ARNs.
Cross-account KMS access requires explicit permission in both the key policy (trust provider) and the IAM policy (trust consumer).

Key Concept

Cross-account AWS KMS access controls and key type limitations
Question 1267Question →

A smart agriculture enterprise operates a telemetry data processing application on Amazon EC2 instances in an Auto Scaling group. The application writes system and sensor processing logs to `/var/log/telemetry/gateway.log`. The application rotates logs hourly, renaming the historical logs to `/var/log/telemetry/gateway.log.YYYY-MM-DD-HH`. The company's operations team has installed the CloudWatch agent on the instances, but notices that logs generated after the hourly rotation are not being sent to Amazon CloudWatch Logs.

Additionally, the enterprise wants to centralize AWS CloudTrail logs from all member accounts in their AWS Organization into a single Amazon S3 bucket located in a dedicated Security account.

Which of the following actions should the Solutions Architect take to resolve these logging issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the CloudWatch agent configuration file on the EC2 instances, setting the `file_path` parameter to `/var/log/telemetry/gateway.log*` to capture both the active log file and the rotated log files.; Configure the S3 bucket policy in the Security account to grant `s3:PutObject` permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`), using the `aws:PrincipalOrgID` condition key to restrict write access to the organization.

Answer

The correct solutions are to update the CloudWatch agent configuration file on the EC2 instances to use the wildcard path `/var/log/telemetry/gateway.log*` to match both active and rotated files, and to configure the S3 bucket policy in the Security account to grant `s3:PutObject` permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`) restricted by the `aws:PrincipalOrgID` condition key.
The Solutions Architect must configure the CloudWatch agent with a wildcard pattern (`/var/log/telemetry/gateway.log*`) to ensure the agent monitors both the active log file and any newly renamed files after rotation. In addition, the central S3 bucket policy must allow `s3:PutObject` actions for the CloudTrail service principal (`cloudtrail.amazonaws.com`) and restrict it to the organization's accounts using the `aws:PrincipalOrgID` condition.

Step-by-Step Solution

1
Use a wildcard pattern in the CloudWatch agent configuration.
The agent can track and tail both `/var/log/telemetry/gateway.log` and the hourly renamed log files.
A static path configuration causes the agent to lose track of the log file after rotation, whereas wildcards allow the agent to continuously monitor rotated files.
2
Configure the destination S3 bucket policy to trust the CloudTrail service principal.
CloudTrail can deliver logs from all accounts within the organization to the central bucket.
CloudTrail uses its own service principal (`cloudtrail.amazonaws.com`) to write logs to S3, and the `aws:PrincipalOrgID` condition key ensures only logs from accounts belonging to the organization are allowed.

Key Concept

Improving operational excellence by properly configuring log collection paths for rotated logs in the CloudWatch Agent, and configuring S3 bucket policies to allow secure cross-account log delivery for AWS CloudTrail.
Question 1268Question →

An enterprise is designing a new multi-VPC application environment in the `ap-southeast-2` region. The environment consists of three VPCs: `vpc-shared-services`, `vpc-payments-prod`, and `vpc-orders-prod`. The payments and orders workloads must communicate with a shared PostgreSQL database cluster in `vpc-shared-services` and resolve its database endpoint using a Route 53 Private Hosted Zone (PHZ) named `db.prod.internal`. All three VPCs require outbound internet access to download software patches, but the enterprise wants to minimize ongoing NAT Gateway hourly charges and Transit Gateway data transfer fees while ensuring high availability. Which network architecture design meets these requirements?

Show answer & explanation

Answer: Deploy an AWS Transit Gateway named `tgw-regional` and attach all three VPCs. Associate the Route 53 PHZ `db.prod.internal` directly with `vpc-shared-services`, `vpc-payments-prod`, and `vpc-orders-prod` to enable local DNS resolution within each VPC. Centralize outbound internet traffic by deploying redundant NAT Gateways (one per Availability Zone) in the public subnets of `vpc-shared-services`, and route all outbound internet traffic from the private subnets of `vpc-payments-prod` and `vpc-orders-prod` through `tgw-regional` to the centralized NAT Gateways.

Answer

Deploy an AWS Transit Gateway to interconnect the VPCs, associate the Route 53 Private Hosted Zone directly with all three VPCs to enable free, local DNS resolution, and centralize outbound internet egress via redundant NAT Gateways in the shared services VPC.
The correct design uses AWS Transit Gateway to enable VPC communication and associates the Route 53 Private Hosted Zone with all three VPCs. Direct association allows local Route 53 resolvers to resolve DNS queries at no additional cost and with minimal latency. Centralizing internet egress through redundant NAT Gateways in the shared services VPC balances cost and reliability, avoiding the charges of six NAT Gateways while preventing a single-AZ failure from disrupting internet access.

Step-by-Step Solution

1
Analyze DNS resolution requirements for the multi-VPC architecture.
Determine that associating the Route 53 Private Hosted Zone directly with all target VPCs (shared services, payments, and orders) allows Route 53 Resolvers to answer queries locally within each VPC.
This avoids the latency, Transit Gateway data transfer costs, and additional endpoint charges associated with setting up Inbound/Outbound Route 53 Resolver Endpoints.
2
Evaluate the routing design for VPC-to-VPC communication.
Identify that AWS Transit Gateway is the correct resource to connect the three VPCs and enable secure routing between payments/orders and the shared database.
Direct Connect Gateway does not support transitive routing between VPCs, rendering options relying on it for inter-VPC traffic invalid.
3
Compare outbound internet connectivity strategies under cost and high availability constraints.
Centralizing egress through redundant NAT Gateways (one per Availability Zone) in the shared services VPC achieves high availability and avoids single-AZ failure while keeping hourly NAT Gateway costs lower than deploying them in all VPCs.
A single NAT Gateway fails the high availability constraint, while NAT Gateways in all VPCs fail the cost minimization constraint.

Key Concept

Multi-VPC DNS resolution via Private Hosted Zone association and centralized internet egress routing with high availability.
Question 1269Question →

A healthcare provider has a multi-account AWS environment managed under AWS Organizations. An existing application in several member accounts uploads medical imaging data to a centralized Amazon S3 bucket in a dedicated compliance account. The S3 bucket currently uses the default AWS-managed KMS key (aws/s3) for server-side encryption. A security audit requires the provider to implement cross-account access so that authorized IAM roles in the member accounts can retrieve and decrypt the objects. Additionally, the solution must adhere to the principle of least privilege. Which configuration change should the solutions architect implement to meet these requirements?

Show answer & explanation

Answer: Create a customer-managed KMS key in the compliance account and configure the S3 bucket to use it. Update the KMS key policy to grant the member accounts' IAM roles permissions to perform kms:Decrypt and kms:GenerateDataKey. Update the S3 bucket policy in the compliance account to allow the member accounts' IAM roles to perform s3:PutObject and s3:GetObject.

Answer

Create a customer-managed KMS key in the compliance account and configure the S3 bucket to use it. Update the KMS key policy to grant the member accounts' IAM roles permissions to perform kms:Decrypt and kms:GenerateDataKey. Update the S3 bucket policy in the compliance account to allow the member accounts' IAM roles to perform s3:PutObject and s3:GetObject.
The correct configuration establishes a customer-managed key (CMK) in the compliance account. Unlike AWS-managed keys, CMKs allow key policies to be modified, enabling the compliance account to delegate decryption and data key generation permissions to member account IAM roles. Additionally, it configures the destination S3 bucket policy to grant read/write access to the cross-account roles, completing the required authorization loop for cross-account S3 operations.

Step-by-Step Solution

1
Evaluate the key type configuration.
Identify that the default AWS-managed KMS key (aws/s3) cannot be shared across accounts because its key policy cannot be modified.
AWS-managed keys have fixed key policies that prevent cross-account delegation.
2
Transition to a customer-managed key (CMK).
Create a customer-managed key in the compliance account and configure the S3 bucket to use it.
Customer-managed keys support policy customization, enabling the owner account to delegate access to other accounts.
3
Update the key policy and bucket policy.
Update the CMK policy to allow cross-account IAM roles the kms:Decrypt and kms:GenerateDataKey actions, and update the S3 bucket policy to allow s3:GetObject and s3:PutObject actions.
Cross-account access to encrypted S3 resources requires explicit permissions in both the resource policy (S3 bucket policy), the key policy (KMS key policy), and the caller's IAM policies.

Key Concept

Cross-Account Access to S3 and KMS CMKs
Estimated Time:2m 30s
Question 1270Question →

A gaming company hosts a backend platform for real-time multiplayer tournaments on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer. The ASG is distributed across two Availability Zones: us-east-1a and us-east-1b. The instances reside in private subnets, and all outbound traffic is routed through a single NAT Gateway located in us-east-1a.

The instances require approximately 6 minutes6\text{ minutes} to download a 4 GB4\text{ GB} asset bundle, extract game assets, and complete custom bootstrapping before passing health checks. The company experiences two challenges:
1. During scheduled tournaments, load increases instantly. The ASG initiates scaling, but connection drops occur during the first 10 minutes10\text{ minutes} of the event. Because the default cooldown is set to 180 seconds180\text{ seconds}, the ASG continuously launches unnecessary instances while the first batch is still bootstrapping, which dramatically increases operational costs.
2. During an outage in us-east-1a, the NAT Gateway became unavailable, causing backend instances in us-east-1b to fail outbound calls to a third-party analytics API, rendering the entire game offline.

Which combination of actions will resolve these scaling and reliability issues while minimizing costs and maintaining fault tolerance? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon EC2 Auto Scaling warm pool for the ASG with instances kept in the Stopped state, and set the instance warmup value of the target tracking scaling policy to 420 seconds420\text{ seconds}.; Deploy a new NAT Gateway in us-east-1b, and configure the route table for the private subnets in us-east-1b to route external traffic (0.0.0.0/00.0.0.0/0) through this new NAT Gateway.

Answer

The correct actions are to configure an Amazon EC2 Auto Scaling warm pool for the ASG with instances in the Stopped state while setting the instance warmup value of the scaling policy to 420 seconds420\text{ seconds}, and to deploy a new NAT Gateway in us-east-1b while routing external traffic from the us-east-1b private subnets through it.
Configuring an EC2 Auto Scaling warm pool with instances in the Stopped state ensures that pre-bootstrapped instances can be quickly started to handle traffic spikes, bypassing the 6 minutes6\text{ minutes} bootstrapping delay. Setting the scaling policy's instance warmup to 420 seconds420\text{ seconds} (which is greater than the 360 second360\text{ second} boot time) prevents premature secondary scaling actions. Deploying a NAT Gateway in us-east-1b and configuring local subnet route tables ensures that an outage in us-east-1a does not interrupt outbound traffic from us-east-1b.

Step-by-Step Solution

1
Analyze the bootstrapping latency and scaling behavior.
Identify that the 6 minutes6\text{ minutes} bootstrapping delay causes connection drops during instant spikes, while the 180 second180\text{ second} cooldown causes redundant instance launches because the cooldown is shorter than the bootstrap time.
To mitigate this, pre-initialized instances in a warm pool and a scaling policy warmup period greater than the bootstrap time (420 seconds>360 seconds420\text{ seconds} > 360\text{ seconds}) are needed.
2
Analyze the fault tolerance requirements for outbound internet traffic.
Determine that routing all traffic through a single NAT Gateway in us-east-1a creates a single point of failure.
Deploying a NAT Gateway in us-east-1b and configuring its route table prevents cross-AZ dependency, ensuring outbound connectivity remains active for us-east-1b during an outage in us-east-1a.
3
Evaluate the architectural options to select the correct pair.
Select the combination of a warm pool with Stopped instances and a high warmup value, alongside a secondary NAT Gateway deployed in the separate Availability Zone.
This combination addresses both the application startup performance and the network infrastructure fault tolerance requirements.

Key Concept

Auto Scaling Warm Pools, Scaling Warmup Alignment, and Multi-AZ NAT Gateway Redundancy
Question 1271Question →

A company plans to migrate its on-premises VMware vSphere environment to VMware Cloud on AWS. The migration must meet the following requirements:

- A group of critical database virtual machines (VMs) must be migrated with zero application downtime to satisfy a strict recovery time objective (RTO=0RTO = 0).
- A group of legacy development VMs will be powered off and migrated during a scheduled weekend maintenance window.

Which VMware HCX migration methods should the solutions architect select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: VMware HCX vMotion to migrate the critical database VMs with zero application downtime; VMware HCX Cold Migration to migrate the legacy development VMs that are powered off

Answer

The solutions architect should select VMware HCX vMotion to migrate the live critical database virtual machines with zero downtime, and VMware HCX Cold Migration to migrate the powered-off legacy development virtual machines.
VMware HCX vMotion satisfies the zero-downtime requirement for critical database VMs by performing a live migration. VMware HCX Cold Migration is the correct tool for moving powered-off legacy VMs over the network to VMware Cloud on AWS.

Step-by-Step Solution

1
Identify the migration destination and core toolset.
The target is VMware Cloud on AWS, meaning VMware HCX is the native and primary tool suite for this hybrid migration.
This eliminates non-VMware migration tools like AWS Application Migration Service (MGN) and AWS DataSync which do not target VMware Cloud on AWS SDDCs directly.
2
Evaluate the downtime constraint for the critical database VMs.
The critical database VMs require RTO=0RTO = 0 (zero downtime). VMware HCX vMotion performs live VM migrations without interruption.
HCX Bulk Migration requires a reboot to complete the switchover, which violates the zero downtime requirement.
3
Evaluate the migration options for the powered-off VMs.
The legacy development VMs can be powered off. VMware HCX Cold Migration is the standard, efficient method to move inactive VMs.
Cold Migration does not require live sync resources and is ideal for offline workloads.

Key Concept

Selecting the appropriate VMware HCX migration type based on application downtime tolerance and VM power state.
Question 1272Question →

An enterprise operates a critical order-processing application in the us-east-1 Region. The application layer runs on Amazon EC2 instances distributed across three Availability Zones (AZs) in private subnets. Outbound API validation requests are routed through a single NAT Gateway located in the us-east-1a public subnet. The database layer uses an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. A Route 53 Private Hosted Zone (PHZ) is used for internal microservice resolution. The company requires a disaster recovery strategy with a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. During a recent outage in us-east-1a, outbound API validation failed for the entire application, and DNS failover did not execute correctly. Which set of actions should the Solutions Architect recommend to meet the reliability and disaster recovery requirements?

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone in us-east-1 and update the private subnet route tables. Implement an active-passive multi-region strategy by deploying warm standby EC2 instances in us-west-2, and associate the Route 53 Private Hosted Zone with the VPC in us-west-2. Use Route 53 Application Recovery Controller (ARC) routing controls and application-level health checks to orchestrate failover, promoting the Aurora secondary cluster to primary.

Answer

Deploy a NAT Gateway in each Availability Zone in us-east-1, configure a warm standby pattern in us-west-2, associate the Route 53 Private Hosted Zone with the secondary VPC, and orchestrate the failover using Route 53 Application Recovery Controller (ARC) and manual/scripted Aurora cluster promotion.
The correct solution addresses all aspects of the scenario. First, it establishes NAT Gateway redundancy by deploying a NAT Gateway per Availability Zone in the primary region. Second, it implements a warm standby strategy in the secondary region to guarantee a 15-minute RTO. Third, it associates the Route 53 Private Hosted Zone with the secondary VPC so internal DNS resolution remains functional after failover. Fourth, it uses Route 53 Application Recovery Controller (ARC) routing controls and application-level health checks to orchestrate failover, along with promoting the secondary Aurora cluster to primary.

Step-by-Step Solution

1
Ensure AZ-level networking redundancy in the primary region
Deploy a NAT Gateway in each of the public subnets in us-east-1 (us-east-1a, us-east-1b, us-east-1c) and configure the private subnet route tables to send internet-bound traffic to their local AZ's NAT Gateway.
This removes the single point of failure where an outage in a single Availability Zone (us-east-1a) disrupts internet access for the application servers running in the other Availability Zones.
2
Establish the secondary region application and database tier configurations
Deploy a warm standby environment in us-west-2 with application instances and configure the Aurora Global Database replication to the secondary cluster.
Warm standby satisfies the 15-minute RTO requirements, and Aurora Global Database replication maintains an RPO of under 1 minute.
3
Configure internal DNS resolution for the secondary region VPC
Associate the existing Route 53 Private Hosted Zone (PHZ) with the VPC in us-west-2.
Private Hosted Zones are not automatically shared across VPCs. Without this association, internal service names will fail to resolve in us-west-2 after failover.
4
Orchestrate multi-region failover and health checking
Set up Route 53 Application Recovery Controller (ARC) routing controls and application-level health checks that evaluate dependency endpoints. Write automation to promote the secondary Aurora cluster during a failover event.
Route 53 ARC controls allow for safe, coordinated manual or automated traffic shifting without relying solely on simple instance pings, and Aurora Global Database requires manual promotion of the secondary cluster to write mode.

Key Concept

Multi-region disaster recovery, NAT Gateway redundancy, Route 53 Private Hosted Zone association, and Aurora Global Database failover orchestration.
Question 1273Question →

A digital banking startup is designing a new multi-region, multi-tenant core ledger system. The system consists of two primary data tiers:

1. Ledger Database: A relational Online Transaction Processing (OLTP) workload requiring sub-20 ms20\text{ ms} write latencies and the ability to dynamically scale read operations to handle heavy, unpredictable reporting queries during fiscal closing. In the primary AWS Region, the database must maintain an RPO of 00 and an RTO of less than 30 seconds30\text{ seconds}. For cross-region disaster recovery, the database must achieve an RPO of less than 1 minute1\text{ minute} and an RTO of less than 15 minutes15\text{ minutes}.
2. Transaction Artifacts: An object storage tier hosting signed PDF transaction records. Artifacts are generated by containerized applications running in developer accounts and uploaded to a central Amazon S3 bucket in a dedicated Archive account. All artifacts must be encrypted at rest. The Archive account security team must retain administrative control over the encryption keys, but must grant the developer accounts the ability to encrypt artifacts during the upload process.

Which storage and database architecture meets these requirements with the lowest operational complexity?

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL Global Database. In the primary region, configure Aurora Replicas with Auto Scaling to scale read capacity. Replicate data asynchronously to the secondary region. In the Archive account, create the Amazon S3 bucket and a Customer Managed Key (CMK) in AWS KMS. Configure the key policy to allow the developer accounts' IAM roles permissions to use the key, and configure the S3 bucket policy to allow cross-account write access requiring key encryption.

Answer

Deploy an Amazon Aurora PostgreSQL Global Database with Aurora Replicas and Auto Scaling for read scaling, and use a Customer Managed Key in AWS KMS to encrypt the cross-account Amazon S3 uploads.
The correct design uses Amazon Aurora PostgreSQL Global Database because it satisfies the primary region requirements (RPO of 0, RTO under 30 seconds via storage replication) and cross-region requirements (RPO under 1 minute, RTO under 15 minutes via Global Database promotion). Furthermore, a Customer Managed Key (CMK) is used for S3 bucket encryption in the Archive account because it can be shared with developer accounts by updating its key policy, allowing cross-account uploads.

Step-by-Step Solution

1
Analyze database HA and read-scaling requirements in the primary region.
Amazon Aurora replicates data across three Availability Zones at the storage level, which guarantees an RPO of 0 and failover to a replica in under 30 seconds (RTO). Read capacity is horizontally scalable using Aurora Replicas.
This guarantees that local database failover meets the strict RPO and RTO constraints while supporting auto-scaled read capacity.
2
Analyze database cross-region disaster recovery requirements.
Amazon Aurora Global Database uses dedicated storage-level replication with lag typically under 1 second (meeting the RPO of less than 1 minute) and can be promoted to write mode in less than 15 minutes (meeting the RTO).
Asynchronous logical or snapshot-based solutions fail to meet the tight RPO and RTO constraints of this scenario.
3
Analyze artifact storage encryption and cross-account access rules.
Cross-account access to KMS-encrypted S3 buckets requires a Customer Managed Key (CMK) because AWS-managed keys (like aws/s3) cannot have their policies modified to delegate access to other accounts.
Only Customer Managed Keys can be shared across account boundaries via key policies.

Key Concept

Multi-region database replication and cross-account S3 key delegation in AWS
Question 1274Question →

An enterprise financial services company runs a payment settlement application on a fleet of Amazon EC2 instances. The application writes transaction events to `/var/log/settlement/transactions.log`. An hourly cron job rotates the log file by renaming the current file to `/var/log/settlement/transactions.log.YYYY-MM-DD-HH` and creating a new empty `/var/log/settlement/transactions.log` file. A solutions architect is configuring the unified Amazon CloudWatch agent on these instances to publish the log data to CloudWatch Logs. Which configuration approach should the solutions architect use to ensure all log entries are collected reliably across rotations without duplicating or missing log events?

Show answer & explanation

Answer: Configure the CloudWatch agent log file path to `/var/log/settlement/transactions.log`. The agent will automatically track the file descriptor or inode to process the rotated file to completion, and then open the newly created active log file.

Answer

Configure the CloudWatch agent log file path to the active log file `/var/log/settlement/transactions.log`. The agent will automatically track the file descriptor or inode to process the rotated file to completion, and then open the newly created active log file.
The correct configuration is to point the CloudWatch agent to the active log file path. The CloudWatch agent keeps an open file handle (tracking the inode) of the file it is reading. When the log rotation system renames the file, the agent continues reading from the renamed file via its open file handle until it reaches the end of the file (EOF). Concurrently, the agent detects that a new file has been created at the configured path and opens it to begin reading new log entries. This built-in behavior ensures seamless log collection without duplication or missing events.

Step-by-Step Solution

1
Analyze the log rotation mechanism and the capabilities of the unified Amazon CloudWatch agent.
The application writes to a static path, which is rotated to a timestamped path hourly. The CloudWatch agent tracks monitored files using file handles/inodes.
Understanding how the agent tracks file state determines whether wildcards or static paths should be used to avoid missing or duplicating log entries.
2
Evaluate the static path configuration.
By specifying the active log path `/var/log/settlement/transactions.log`, the agent monitors the active file. When rotated (renamed), the agent maintains the file handle to finish reading the renamed file, then opens the new file with the original name.
This is the native, recommended behavior of the CloudWatch agent for rotated log files.
3
Evaluate the wildcard path configuration.
Using `/var/log/settlement/transactions.log*` matches both the active file and all rotated files, causing the agent to discover the rotated files as new files and re-ingest them.
This results in log duplication and unnecessary data ingestion costs, making it incorrect.

Key Concept

The unified Amazon CloudWatch agent tracks active log files by their file descriptors/inodes, allowing it to handle standard log rotation automatically without needing wildcards or service restarts.
Question 1275Question →

An enterprise is auditing its AWS environment to strengthen network and identity security for a data processing application. The application runs on Amazon EC2 instances in a private subnet within VPC A (Account A) and reads and writes sensitive objects in an Amazon S3 bucket located in Account B. VPC A is connected to a shared services VPC in Account B via an AWS Transit Gateway. Currently, the EC2 instances access the S3 bucket via an S3 Gateway Endpoint in VPC A. The S3 bucket is encrypted using the default AWS managed key (aws/s3). The current S3 bucket policy allows read and write access to the IAM role attached to the EC2 instances. The security architect must implement a solution to restrict S3 bucket access so that it is only reachable from VPC A, prevent the application from accessing any S3 buckets other than the designated one in Account B, and enforce encryption with a key that supports cross-account access. What is the most secure and operationally efficient configuration to meet these requirements?

Show answer & explanation

Answer: Configure a Customer Managed Key (CMK) in Account B for S3 bucket encryption, and update its key policy to allow the application's IAM role in Account A to perform kms:Decrypt and kms:GenerateDataKey operations. Update the VPC A S3 Gateway Endpoint policy to permit s3:GetObject and s3:PutObject only for the Account B bucket. In Account B, configure the S3 bucket policy to allow access from the IAM role in Account A, with a condition restricting access to the Gateway Endpoint ID (aws:sourceVpce) of VPC A.

Answer

Configure a Customer Managed Key (CMK) in Account B, updating its key policy for cross-account access, update the VPC A S3 Gateway Endpoint policy to permit traffic only to the Account B bucket, and restrict the S3 bucket policy to the Gateway Endpoint ID (aws:sourceVpce).
The correct solution involves configuring a Customer Managed Key (CMK) in Account B, updating its key policy to allow the IAM role in Account A access to perform cryptographic operations, restricting the Gateway Endpoint policy in VPC A to target only the Account B bucket, and configuring the S3 bucket policy in Account B to restrict access to the specific VPC A S3 Gateway Endpoint ID.

Step-by-Step Solution

1
Transition S3 encryption from the default AWS managed key to a Customer Managed Key (CMK) in Account B.
Enables the ability to modify the KMS key policy to permit cross-account IAM role access.
AWS managed keys do not support policy modification and cannot be accessed across different AWS accounts.
2
Modify the S3 Gateway Endpoint policy in VPC A to restrict allowed resources to the specific bucket in Account B.
Prevents unauthorized data exfiltration or access to other S3 buckets from the EC2 instances in VPC A.
Endpoint policies control the destinations reachable through the VPC endpoint.
3
Update the S3 bucket policy in Account B to allow access from VPC A's IAM role under the condition that the request passes through the VPC A S3 Gateway Endpoint.
Ensures all data access is restricted to the specific VPC A Gateway Endpoint via the aws:sourceVpce condition.
This locks down S3 network access to the designated private network path.

Key Concept

Cross-account S3 access, custom KMS key delegation, and VPC endpoint policy containment.
Question 1276Question →

An enterprise manages a multi-account environment on AWS. Account A hosts an application running on Amazon EC2 instances within a private subnet. This application must write sensitive logs and data to an Amazon S3 bucket located in Account B. The S3 bucket is encrypted using a Customer Managed Key (CMK) stored in Account B. To strengthen identity, access, and network security for this data transfer path, a solutions architect must enforce strict network isolation ensuring that data only traverses AWS private networks, and verify that only authorized IAM roles in Account A can write to the bucket and decrypt the objects. Service Control Policies (SCPs) must be utilized to maintain these guardrails. Which combination of actions will securely achieve this objective? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the key policy of the Customer Managed Key in Account B to grant the IAM role in Account A permission to perform the kms:Decrypt and kms:GenerateDataKey actions, and attach an IAM policy to the role in Account A allowing these same actions on the key ARN.; Configure a Gateway VPC endpoint for Amazon S3 in Account A's VPC. Modify the S3 bucket policy in Account B to deny access to all principals unless the request originates from this specific VPC endpoint ID using the aws:sourceVpce condition.

Answer

The correct options are configuring the S3 VPC endpoint combined with a deny-based bucket policy restricting access to that VPC endpoint, and setting up cross-account permissions on the Customer Managed Key (CMK) in the destination account while granting corresponding IAM permissions in the source account.
The correct solution involves two main aspects: private network routing and cross-account cryptographic access. Enforcing private routing is achieved by deploying a Gateway VPC endpoint and enforcing it via the S3 bucket policy using the 'aws:sourceVpce' condition. Cryptographic access is established by using a Customer Managed Key (CMK) and creating a trust path where the KMS key policy in the destination account explicitly delegates access to the identity in the source account, which is matched by a corresponding IAM permission in the source account.

Step-by-Step Solution

1
Establish network isolation using VPC endpoints.
A Gateway VPC endpoint is configured in the source VPC to route S3 traffic over the AWS internal network.
This prevents data from traversing the public internet and establishes a private path for S3 access.
2
Apply resource-level network restrictions.
The S3 bucket policy in Account B is updated with a condition that blocks all traffic unless the source VPC endpoint matches the configured VPC endpoint ID.
This ensures that traffic from outside the designated private VPC endpoint is strictly denied, maintaining network isolation.
3
Configure cross-account KMS permissions.
The key policy in Account B is updated to delegate decryption capabilities to Account A, and Account A's IAM role is given permissions to invoke the KMS key.
Because the S3 bucket is encrypted using a Customer Managed Key, cross-account access requires explicit IAM permissions in the source account and key policy permissions in the destination account.

Key Concept

Strengthening Identity, Access, and Network Security
Question 1277Question →

An enterprise operates a multi-account environment governed by AWS Organizations. Log files containing sensitive operational records are collected from all member accounts and consolidated into a centralized Amazon S3 bucket located in a dedicated Security account. The S3 bucket is currently encrypted using the default AWS-managed KMS key (aws/s3). A solutions architect must design a solution that enhances data protection and meets the following compliance requirements:
- All log objects must be encrypted at rest using a key that supports automatic annual rotation.
- The security audit team in the Security account must be able to decrypt and analyze the logs, but member accounts must be blocked from decrypting logs once they have been written.
- Member accounts must be prevented from deleting the S3 logging bucket, deleting any log objects, or modifying the bucket policy, even if users in those accounts have administrative privileges.

Which two actions should the solutions architect take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a Customer Managed Key (CMK) in the Security account, enable automatic key rotation, and configure a key policy that allows member accounts to use the kms:GenerateDataKey action while restricting the kms:Decrypt action to the security audit team.; Create and attach a Service Control Policy (SCP) to the AWS Organizations root that denies s3:DeleteBucket, s3:DeleteObject, and s3:PutBucketPolicy on the logging S3 bucket resources for all member accounts.

Answer

Create a Customer Managed Key (CMK) in the Security account with a key policy that allows member accounts to use the key generation action while restricting decryption to the security audit team, and enable automatic key rotation. Create and attach a Service Control Policy (SCP) to the AWS Organizations root that denies deletion of the S3 logging bucket, deletion of any log objects, and modifications to the bucket policy for all member accounts.
To satisfy the requirements, the solutions architect must use a Customer Managed Key because AWS-managed keys cannot be shared across accounts or have customized key policies. The CMK must allow member accounts to write logs (kms:GenerateDataKey) but deny them decryption capability, which is reserved for the security audit team. Furthermore, a Service Control Policy attached to the Organization root is the only mechanism that can restrict actions like bucket and object deletion for all member accounts, overriding even administrative privileges within those accounts.

Step-by-Step Solution

1
Address KMS key requirements by creating a Customer Managed Key in the Security account.
This key can have its key policy modified to allow cross-account usage and supports automatic annual rotation, unlike AWS-managed keys.
Regulatory compliance requires automatic rotation and cross-account access control, which is only supported via Customer Managed Keys.
2
Configure the key policy for the Customer Managed Key to restrict access to only what is necessary.
Member accounts are granted the kms:GenerateDataKey permission to perform uploads, while only the security audit team is granted kms:Decrypt.
This implements the principle of least privilege, preventing member accounts from reading logs once they are written.
3
Apply a Service Control Policy (SCP) at the AWS Organizations root targeting member accounts.
The SCP denies s3:DeleteBucket, s3:DeleteObject, and s3:PutBucketPolicy actions on the centralized logging bucket resources.
SCPs act as permission guardrails, preventing even administrative users in member accounts from deleting logs or altering the logging configuration.

Key Concept

Delegating least-privilege cross-account access using Customer Managed Keys (CMKs) and securing compliance logs using Service Control Policies (SCPs) in AWS Organizations.
Question 1278Question →

An enterprise has an existing AWS Organizations structure where member accounts upload sensitive daily transaction logs to a centralized Amazon S3 bucket in a dedicated Logging account. Currently, the bucket uses Amazon S3 managed encryption keys (SSE-S3). To comply with a new security standard, a solutions architect must improve the data protection controls. The requirements are:

* All logs stored in the bucket must be encrypted using an AWS KMS customer managed key (CMK) managed by the Logging account.
* The member accounts must be able to write to the bucket and encrypt the objects using this KMS key.
* The Logging account must have full ownership and administrative control over all uploaded objects.
* All unencrypted uploads and uploads not using the specified KMS key must be blocked.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure S3 Object Ownership to 'Bucket owner enforced' on the destination bucket, and add a bucket policy statement that denies s3:PutObject uploads if the s3:x-amz-server-side-encryption header is not set to aws:kms or if the s3:x-amz-server-side-encryption-aws-kms-key-id header does not specify the customer managed key's ARN.; Configure the customer managed key's policy in the Logging account to allow the member accounts' IAM roles to perform kms:GenerateDataKey and kms:Decrypt operations.

Answer

Configure S3 Object Ownership to 'Bucket owner enforced' on the destination bucket, and add a bucket policy statement that denies uploads if the encryption headers do not specify server-side encryption with AWS KMS using the customer managed key's ARN. In addition, configure the customer managed key's policy in the Logging account to allow the member accounts' IAM roles to perform kms:GenerateDataKey and kms:Decrypt operations.
To allow member accounts to write to a centralized bucket in the Logging account and encrypt objects using a customer managed key (CMK), the key policy of the CMK in the Logging account must explicitly delegate permission to the external member accounts (or roles within them) to perform kms:GenerateDataKey and kms:Decrypt. Additionally, to enforce bucket owner ownership of all objects uploaded from external accounts, the S3 Object Ownership setting must be configured to 'Bucket owner enforced' (which disables ACLs and automatically transfers ownership of uploaded objects to the bucket owner). Finally, the S3 bucket policy must contain a deny statement that blocks any upload (s3:PutObject) that does not use aws:kms encryption or does not specify the ARN of the customer managed key.

Step-by-Step Solution

1
Ensure the Logging account maintains full ownership of all uploaded objects.
Configure S3 Object Ownership with the 'Bucket owner enforced' setting to disable ACLs.
This guarantees that any object uploaded cross-account is automatically owned by the Logging account, preventing permission fragmentation.
2
Configure cross-account key permissions on the customer managed key (CMK).
Modify the KMS CMK key policy in the Logging account to allow the member accounts' IAM principals to perform kms:GenerateDataKey and kms:Decrypt.
KMS keys require explicit delegation in their key policy for cross-account access, as IAM policies in the caller accounts cannot grant access to keys in external accounts.
3
Enforce compliant encryption at the bucket level.
Add a deny statement in the S3 bucket policy for s3:PutObject requests that lack the s3:x-amz-server-side-encryption condition matching 'aws:kms' or the s3:x-amz-server-side-encryption-aws-kms-key-id condition matching the specific CMK ARN.
This blocks non-compliant uploads (e.g., unencrypted, SSE-S3, or using an incorrect key).

Key Concept

Cross-account S3 security, KMS key policies, S3 Object Ownership, and encryption compliance enforcement.
Estimated Time:3m 0s
Question 1279Question →

A company is migrating its on-premises servers to AWS using AWS Application Migration Service (MGN) over a Site-to-Site VPN. The target environment includes a staging area VPC and a target VPC. The migrated servers in the target VPC must resolve internal DNS names hosted in a Route 53 private hosted zone within a shared services VPC. Which two configurations are required to ensure successful data replication and proper name resolution?

Select all that apply

Show answer & explanation

Answer: Allow outbound TCP port 1500 traffic from the on-premises source servers to the replication servers in the staging area VPC.; Associate the private hosted zone in the shared services VPC with the target VPC after the migration.

Answer

Allow outbound TCP port 1500 traffic from the on-premises source servers to the replication servers in the staging area VPC, and associate the private hosted zone in the shared services VPC with the target VPC after the migration.
Data replication with AWS Application Migration Service requires the on-premises source servers to establish outbound connections to the replication servers in AWS on TCP port 1500. Additionally, Route 53 Private Hosted Zones require explicit association with any VPC that needs to resolve records within that zone.

Step-by-Step Solution

1
Determine MGN replication connectivity requirements.
Confirm that source servers require outbound TCP port 1500 connectivity to the staging area VPC in AWS.
This port is used by the AWS replication agent to securely transmit replicated data blocks.
2
Analyze Route 53 private hosted zone (PHZ) resolution requirements.
Confirm that the PHZ must be associated with the target VPC.
Route 53 private hosted zones require explicit VPC association to resolve queries originating from resources within those VPCs.

Key Concept

AWS MGN network port requirements and Route 53 Private Hosted Zone associations.
Question 1280Question →

A solutions architect is using AWS Database Migration Service (DMS) to migrate an on-premises MySQL database to Amazon Aurora MySQL. The architect configures a replication task with both full load and continuous replication (Change Data Capture) enabled. The full load phase completes successfully, and all existing data is copied to the target database. However, subsequent insert and update transactions performed on the on-premises database are not replicated, and the task status stalls. Which of the following is the most likely cause of this behavior?

Show answer & explanation

Answer: Binary logging (binlog) was not enabled on the source MySQL database prior to starting the replication task.

Answer

Binary logging (binlog) was not enabled on the source MySQL database prior to starting the replication task.
The correct answer is that binary logging (binlog) was not enabled on the source MySQL database. AWS Database Migration Service (DMS) uses the source database transaction logs (binary logs in MySQL) to capture and replicate ongoing transactions (CDC). Without binary logging enabled on the source, DMS has no way to track changes after the full load phase completes, resulting in a stalled or failed task.

Step-by-Step Solution

1
Analyze the migration type and requirements.
The migration is homogeneous (MySQL to Aurora MySQL) and requires continuous replication (Change Data Capture).
This establishes that AWS DMS needs access to the source transaction engine logs to capture changes after the full load completes.
2
Identify the data source requirements for Change Data Capture (CDC) in AWS DMS.
For MySQL databases, DMS reads the binary logs (binlogs) to identify ongoing updates.
If binlogs are disabled, the task will succeed during the initial full load (which queries tables directly) but will fail to read transactions during the replication phase.
3
Evaluate the distractors based on the migration scenario.
Identify that other options describe port configurations for different services, incorrect RDS configurations, or unnecessary tool requirements.
This confirms that lack of source binlog configuration is the correct explanation for the stalled replication.

Key Concept

Continuous replication (CDC) using AWS DMS requires database-specific log configurations (such as binary logging for MySQL or supplemental logging for Oracle) to capture real-time changes.
PreviousPage 64 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin