All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A multinational energy conglomerate is planning to decommission its on-premises data center and migrate its smart grid monitoring and billing platform to AWS. The platform consists of $4$ distinct components:

1. Web Dashboard: An application that runs on Apache HTTP Server on Red Hat Enterprise Linux (RHEL) $6.8$ . Corporate security policies require all cloud-deployed workloads to run on a hardened RHEL $8$ or RHEL $9$ image. The static HTML/JS assets and configuration can be deployed to the new OS version without code changes.
2. Telemetry Ingestion Worker: A Python daemon that processes incoming queue messages. It currently runs on a single virtual machine. The architecture team wants to run this daemon as a containerized task using Amazon ECS on AWS Fargate to eliminate server management.
3. Billing Database: An Oracle Database $19c$ Enterprise Edition with extensive PL/SQL stored procedures and spatial indexes. The business wants to migrate this database to Amazon Aurora PostgreSQL to eliminate Oracle licensing costs. A dedicated migration team is allocated to convert the schema and rewrite the stored procedures.
4. Legacy Field Device Link: A proprietary C-based utility that communicates with legacy field RTUs via a physical dial-up serial modem connected to an on-premises PCI card. The proprietary protocol cannot be emulated or routed over IP networks, and the manufacturer has ceased support.

Which combination of migration strategies ( $7$ Rs) represents the most appropriate path for each component to meet the company's requirements?

Rehost the Web Dashboard; Refactor the Telemetry Ingestion Worker; Refactor the Billing Database; Retain the Legacy Field Device Link.

Replatform the Web Dashboard; Replatform the Telemetry Ingestion Worker; Refactor the Billing Database; Retain the Legacy Field Device Link.

Replatform the Web Dashboard; Replatform the Telemetry Ingestion Worker; Replatform the Billing Database; Retire the Legacy Field Device Link.

Refactor the Web Dashboard; Replatform the Telemetry Ingestion Worker; Rehost the Billing Database; Rehost the Legacy Field Device Link.

Show answer & explanation

Answer: Replatform the Web Dashboard; Replatform the Telemetry Ingestion Worker; Refactor the Billing Database; Retain the Legacy Field Device Link.

Answer

Replatform the Web Dashboard; Replatform the Telemetry Ingestion Worker; Refactor the Billing Database; Retain the Legacy Field Device Link.

The correct strategy combination is Replatform the Web Dashboard, Replatform the Telemetry Ingestion Worker, Refactor the Billing Database, and Retain the Legacy Field Device Link. The Web Dashboard requires upgrading the operating system from RHEL 6.8 to a supported version (RHEL 8/9) without changing application code, which constitutes a Replatform strategy. The Telemetry Ingestion Worker is packaged into a container and moved to AWS Fargate to reduce management overhead, representing a Replatform strategy. The Billing Database undergoes a heterogeneous migration from Oracle to Amazon Aurora PostgreSQL, requiring schema conversion and PL/SQL code rewrite, which is classified as a Refactor (Re-architect) strategy. The Legacy Field Device Link relies on physical hardware (a dial-up modem connected to a PCI card) that cannot be emulated or virtualized on AWS, meaning it must be Retained on-premises.

Step-by-Step Solution

Analyze the Web Dashboard component requirements.

The Web Dashboard runs on an unsupported OS (RHEL 6.8) and must run on a hardened RHEL 8/9 image without code changes.

Since the OS is upgraded but the application code is not rewritten, this falls under a Replatform strategy rather than a simple Rehost or Refactor.

Analyze the Telemetry Ingestion Worker requirements.

The worker daemon is containerized and deployed to Amazon ECS on AWS Fargate to reduce administrative overhead without modifying the application code.

Moving a workload to a managed/serverless container runtime (like Fargate) without changing its core architecture is classified as a Replatform strategy.

Analyze the Billing Database requirements.

The database engine is migrated from Oracle to Amazon Aurora PostgreSQL, requiring schema conversion and PL/SQL code rewrite.

Heterogeneous database migrations that involve schema conversions and application code/SQL adjustments are classified as Refactor (Re-architect) due to the architectural and code modifications required.

Analyze the Legacy Field Device Link requirements.

The link depends on physical dial-up modem hardware connected to a PCI card, and the protocol cannot be emulated or routed over IP networks.

Since standard cloud infrastructure cannot emulate or connect physical PCI modem hardware, and the application cannot be modified, this component must be kept on-premises, which is a Retain strategy.

Key Concept

Selecting the correct migration strategies from the 7 Rs framework based on application constraints, OS support lifecycle, target engine compatibility, and physical hardware dependencies.

Question 1282Question →

An organization has a document archiving application running on Amazon EC2 instances that uploads sensitive financial records to an Amazon S3 bucket. Currently, the data is encrypted using Amazon S3 managed encryption keys (SSE-S3). To comply with new regulatory requirements, the organization must enforce server-side encryption using an AWS Key Management Service (AWS KMS) customer managed key with key rotation enabled. Additionally, any upload requests that do not specify the correct customer managed key must be rejected. Which combination of actions will meet these compliance requirements with the least operational overhead?

Create an AWS KMS customer managed key and enable automatic key rotation. Configure the S3 bucket's default encryption to use the customer managed key. Apply an S3 bucket policy that denies the s3:PutObject action if the s3:x-amz-server-side-encryption header is not set to aws:kms, or if the s3:x-amz-server-side-encryption-aws-kms-key-id header does not specify the Amazon Resource Name (ARN) of the customer managed key.

Configure the S3 bucket's default encryption to use the default AWS-managed KMS key (aws/s3). Access the AWS KMS console to enable automatic annual key rotation and modify the key policy of the AWS-managed KMS key to restrict usage permissions only to the EC2 application instance's IAM role.

Create an AWS KMS customer managed key and enable automatic key rotation. Create an AWS Organizations Service Control Policy (SCP) that denies s3:PutObject unless the customer managed key is specified, and attach it to the member account's Organizational Unit (OU) to grant the application instances the required KMS permissions without modifying their local IAM policies.

Create an AWS KMS customer managed key and enable automatic key rotation. Apply an S3 bucket policy that permits global cross-account uploads by setting the Principal to wildcard (*), but omit explicit principal constraints or KMS key validation, relying on the application's client-side configuration to specify the correct key ARN.

Show answer & explanation

Answer: Create an AWS KMS customer managed key and enable automatic key rotation. Configure the S3 bucket's default encryption to use the customer managed key. Apply an S3 bucket policy that denies the s3:PutObject action if the s3:x-amz-server-side-encryption header is not set to aws:kms, or if the s3:x-amz-server-side-encryption-aws-kms-key-id header does not specify the Amazon Resource Name (ARN) of the customer managed key.

Answer

Create an AWS KMS customer managed key and enable automatic key rotation, update the default encryption of the S3 bucket to use this key, and implement an S3 bucket policy that denies s3:PutObject requests unless they specify the correct customer managed key via headers.

The correct option correctly details setting up a customer managed key with rotation enabled, using it as the default S3 bucket encryption mechanism, and implementing a bucket policy that checks headers to enforce the specific customer managed key. This enforces data protection controls at the bucket level.

Step-by-Step Solution

Provision an AWS KMS customer managed key and enable key rotation.

A dedicated KMS key is created that automatically rotates its key material annually, satisfying compliance constraints.

Customer managed keys allow custom policies and cross-account access configuration, unlike AWS-managed keys.

Set the S3 bucket default encryption to use the newly created customer managed key.

Unencrypted objects uploaded without explicit headers will default to using this customer managed key.

Provides a default baseline security configuration for the bucket.

Attach a bucket policy that denies s3:PutObject if the server-side encryption headers do not match aws:kms or the target KMS key ARN.

Any uploads attempting to write objects using SSE-S3 or an incorrect KMS key are explicitly blocked at the bucket level.

Enforces strict compliance requirements directly on the storage resource.

Key Concept

Enforcing SSE-KMS encryption on Amazon S3 buckets using customer managed keys and bucket policies to satisfy security compliance standards.

Question 1283Question →

A company has an existing e-commerce web application fronted by an Application Load Balancer (ALB). The application has recently experienced distributed SQL injection (SQLi) attacks. To strengthen the network security posture, the company deploys an AWS WAF Web ACL associated with the ALB. The architect must configure the Web ACL to block known malicious IP addresses, block SQLi patterns, and allow all other normal web traffic. Additionally, the configuration must allow all requests from a trusted external inventory system's static IP range, bypassing SQLi inspection to prevent false positives. Which configuration should the architect implement to meet these requirements?

Configure the Web ACL with a default action of Allow. Create a rule at Priority 1 to block known malicious IPs, a rule at Priority 2 to allow the trusted external IP range, and a rule at Priority 3 to block SQLi patterns.

Configure the Web ACL with a default action of Allow. Create a rule at Priority 1 to block SQLi patterns, a rule at Priority 2 to block known malicious IPs, and a rule at Priority 3 to allow the trusted external IP range.

Configure the Web ACL with a default action of Block. Create a rule at Priority 1 to allow the trusted external IP range, a rule at Priority 2 to block known malicious IPs, and a rule at Priority 3 to block SQLi patterns.

Configure the Web ACL with a default action of Allow. Create a rule at Priority 1 to block known malicious IPs, a rule at Priority 2 to block SQLi patterns, and a rule at Priority 3 to allow the trusted external IP range.

Show answer & explanation

Answer: Configure the Web ACL with a default action of Allow. Create a rule at Priority 1 to block known malicious IPs, a rule at Priority 2 to allow the trusted external IP range, and a rule at Priority 3 to block SQLi patterns.

Answer

Evaluating rules in AWS WAF occurs in order of priority (from lowest numerical value to highest). Once a rule matches a request with a terminating action (like Allow or Block), the evaluation of subsequent rules stops. By placing the rule to block known malicious IPs at Priority 1, we ensure malicious traffic is blocked immediately. Placing the rule to allow the trusted external IP range at Priority 2 ensures that requests from this range terminate evaluation with an Allow action, thereby bypassing the SQLi block rule at Priority 3. Finally, setting the default action to Allow ensures that all other traffic not matching the block rules is permitted.

Step-by-Step Solution

Analyze WAF rule evaluation mechanics.

AWS WAF evaluates rules in priority order (lowest number first). Terminating actions (Allow/Block) stop further evaluation.

To design the correct priority list, we must know how traffic matches rules and terminates.

Order the requirements to prevent false positives and block malicious traffic.

First, block known bad actors (malicious IPs). Second, allow the trusted partner IP range to bypass further checks. Third, inspect remaining traffic for SQLi and block matches.

This ensures trusted traffic never reaches the SQLi inspection rule, while malicious traffic is dropped first.

Determine the default Web ACL action.

Set the default action to Allow to let normal traffic through after it passes the blocklist and SQLi filters.

An Allow default action permits all traffic that is not explicitly blocked or allowed early.

Key Concept

AWS WAF Rule Priority and Evaluation Logic

Question 1284Question →

A media streaming company has an existing logging pipeline that aggregates user viewing history logs from application servers running in multiple member accounts within AWS Organizations. These logs are stored in a centralized Amazon S3 bucket in a dedicated compliance archive account. A solutions architect must enhance the data protection and compliance posture of this pipeline. The compliance requirements mandate:

- All logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS with annual rotation.
- Access to encrypt and decrypt the logs must be strictly controlled and audited.
- The configuration must minimize the KMS API request costs associated with the high volume of write operations.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create a customer-managed KMS key in the compliance archive account. Update the key policy to grant key generation permissions to the IAM principals in the member accounts, and enable S3 Bucket Keys on the destination S3 bucket.

Update the S3 bucket policy in the compliance archive account to deny any write requests that do not specify server-side encryption with AWS KMS (SSE-KMS) and do not use the ARN of the compliance archive account's customer-managed KMS key.

Use the AWS-managed KMS key in the compliance archive account to encrypt the objects, and update its key policy to allow cross-account access from the member accounts.

Create a customer-managed KMS key in each member account, configure cross-account access to the archive S3 bucket, and rely on the S3 bucket's default encryption configuration using the member accounts' KMS keys.

Apply a Service Control Policy (SCP) at the root of the AWS Organization that grants key generation and decryption access to the compliance archive S3 bucket for all member accounts, eliminating the need to update individual KMS key policies.

Show answer & explanation

Answer: Create a customer-managed KMS key in the compliance archive account. Update the key policy to grant key generation permissions to the IAM principals in the member accounts, and enable S3 Bucket Keys on the destination S3 bucket.; Update the S3 bucket policy in the compliance archive account to deny any write requests that do not specify server-side encryption with AWS KMS (SSE-KMS) and do not use the ARN of the compliance archive account's customer-managed KMS key.

Answer

The correct actions are: creating a customer-managed KMS key in the compliance archive account, enabling S3 Bucket Keys on the destination S3 bucket, and updating the S3 bucket policy to deny uploads that do not use the compliance archive account's customer-managed KMS key.

The correct solution involves creating a customer-managed KMS key in the compliance archive account and granting access to the member accounts. This meets compliance and cross-account requirements. To minimize costs, S3 Bucket Keys should be enabled to cache data keys and reduce KMS API requests. Finally, the S3 bucket policy should be updated with a Deny statement to block any uploads that do not use the customer-managed key.

Step-by-Step Solution

Determine the appropriate type of key to support cross-account access.

A customer-managed KMS key must be selected because AWS-managed keys cannot be shared or have their key policies modified for cross-account access.

To comply with the requirement that the compliance key can be used across member accounts.

Address the requirement to minimize KMS API request costs under a high write volume.

Enable Amazon S3 Bucket Keys on the destination S3 bucket.

S3 Bucket Keys decrease the traffic from Amazon S3 to AWS KMS by caching bucket-level keys, thereby reducing the number of GenerateDataKey calls and associated costs.

Configure S3 bucket policy enforcement to ensure data protection compliance.

Apply a bucket policy that denies any s3:PutObject requests unless they include the SSE-KMS header and target the compliance archive account's KMS key.

This acts as a guardrail to ensure that only properly encrypted objects are stored in the bucket.

Key Concept

Enhancing S3 data protection using centralized customer-managed KMS keys, cross-account policies, and S3 Bucket Keys for cost optimization.

Estimated Time:3m 0s

Question 1285Question →

An enterprise is planning to migrate its legacy portfolio management platform to AWS within a strict 6-month timeline. The platform consists of two main components:

1. Core Database: An Oracle Database running on IBM AIX (Power architecture) that utilizes proprietary stored procedures. Schema conversion and database engine migration to an open-source engine (such as Amazon Aurora) is estimated to take 18 months of code refactoring and validation.
2. Document Archiving Service: A legacy archival subsystem running on Windows Server 2008 R2. The vendor has gone out of business, the installation media and source code are lost, and the application requires direct attachment to a physical local SCSI tape library for writing backups.

Which two migration strategies should the solutions architect select for these components to meet the project constraints? (Select two.)

Select all that apply

Replatform the Core Database by migrating it to Amazon RDS for Oracle.

Retain the Document Archiving Service on-premises while establishing secure hybrid connectivity to the AWS cloud environment.

Refactor the Core Database by converting the database engine to Amazon Aurora PostgreSQL using the AWS Schema Conversion Tool (SCT).

Rehost the Core Database by using AWS Application Migration Service (MGN) to replicate the IBM AIX physical servers directly to Amazon EC2 instances.

Rehost the Document Archiving Service by using AWS Application Migration Service (MGN) to replicate the Windows Server VM to Amazon EC2 and map the physical tape library over a site-to-site VPN.

Show answer & explanation

Answer: Replatform the Core Database by migrating it to Amazon RDS for Oracle.; Retain the Document Archiving Service on-premises while establishing secure hybrid connectivity to the AWS cloud environment.

Answer

The solutions architect should choose to replatform the core database by migrating to Amazon RDS for Oracle, and retain the document archiving service on-premises.

Replatforming the core database to Amazon RDS for Oracle allows the database engine to remain unchanged, meeting the 6-month migration window while resolving the platform incompatibility of IBM AIX by moving to x86-based RDS. Retaining the document archiving service on-premises is necessary because the physical SCSI tape library dependency cannot be replicated in the cloud, and the loss of installation media and source code prevents any redeployment or refactoring.

Step-by-Step Solution

Analyze the database requirements and constraints.

The database runs on IBM AIX, which is not natively supported on AWS. Re-architecting the database engine to an open-source alternative (Refactoring) takes 18 months, exceeding the 6-month migration limit. Replatforming to Amazon RDS for Oracle keeps the database engine but changes the underlying platform from AIX to Linux.

This determines the viable 7 Rs strategy for the database within the timeline constraint.

Analyze the document archiving service requirements and constraints.

The archival service relies on local physical tape libraries, and has no installation media or source code for redeployment. It cannot be replicated to the cloud due to physical hardware dependencies, which makes Rehosting or Replatforming impossible. Thus, it must be Retained on-premises.

This determines the viable 7 Rs strategy for the legacy service based on physical dependencies.

Key Concept

Selecting migration strategies (7 Rs) based on platform compatibility, physical hardware dependencies, and project timeline constraints.

Question 1286Question →

A financial services company hosts a web application on Amazon ECS Fargate tasks behind an internet-facing Application Load Balancer (ALB). The application's administrative endpoints under the path `/admin/*` are currently protected by basic authentication. The security team mandates that the identity and network security of these endpoints must be strengthened. The `/admin/*` portal must be restricted to authenticated corporate employees who connect exclusively from the corporate office's public IP CIDR range ( $203.0.113.0/24$ ). In addition, audit logs stored in an Amazon S3 bucket must be encrypted using a key that can be shared with a security audit role in a separate AWS audit account. Which two actions should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Configure an AWS WAF WebACL rule that matches the path `/admin/*` and blocks all requests that do not originate from the IP set containing the corporate CIDR range

203.0.113.0/24

, and assign this rule the highest evaluation priority in the WebACL.

Modify the ALB listener rules to authenticate users requesting `/admin/*` using an Amazon Cognito user pool federated with the company's corporate identity provider, and route authenticated sessions to the ECS target group.

Add an AWS WAF WebACL rule that allows requests targeting `/admin/*` from the corporate IP set, and position it at the lowest evaluation priority after the default action of allow.

Configure default encryption on the S3 bucket using an AWS-managed KMS key (`aws/s3`), and delegate cross-account permissions by updating the default key policy to trust the security audit role in the external AWS account.

Attach a Service Control Policy (SCP) to the member account's Organizational Unit (OU) that explicitly permits administrative access to `/admin/*` paths for the `AdminAccess` role, which automatically grants local permissions to federated users without needing local IAM policies.

Show answer & explanation

Answer: Configure an AWS WAF WebACL rule that matches the path `/admin/*` and blocks all requests that do not originate from the IP set containing the corporate CIDR range $203.0.113.0/24$ , and assign this rule the highest evaluation priority in the WebACL.; Modify the ALB listener rules to authenticate users requesting `/admin/*` using an Amazon Cognito user pool federated with the company's corporate identity provider, and route authenticated sessions to the ECS target group.

Answer

Configure an AWS WAF WebACL rule that blocks non-corporate IPs at the highest priority, and configure ALB listener rules to authenticate users via Amazon Cognito.

The correct strategy combines network and identity security controls. The WAF WebACL rule blocks all requests targeting `/admin/*` that do not originate from the corporate IP CIDR range, and must be evaluated first to prevent access from unauthorized networks. The ALB listener rule redirects legitimate traffic targeting `/admin/*` to Amazon Cognito for corporate identity federation, ensuring only authenticated employees can access the ECS tasks. To address S3 sharing, using a Customer Managed Key (CMK) allows policy edits for cross-account roles.

Step-by-Step Solution

Add an AWS WAF rule that targets `/admin/*` and evaluates the request source IP.

Requests from unauthorized IPs are blocked at the edge.

This establishes a robust perimeter security control by dropping traffic early in the WebACL priority list before it reaches the backend.

Implement Amazon Cognito authentication on the ALB listener rule for the `/admin/*` path.

Users are required to sign in via the corporate identity provider before the ALB forwards the request to ECS.

Integrating ALB with Cognito federated authentication offloads identity verification to the corporate provider securely.

Use a Customer Managed KMS key (CMK) for the S3 bucket encryption instead of the AWS-managed key.

The key policy can be updated to trust the external audit role.

AWS-managed keys do not support policy modification. Cross-account access requires a CMK with a customized key policy.

Key Concept

Continuous security improvement of network perimeter and authentication boundaries on AWS.

Question 1287Question →

An enterprise is designing a new multi-VPC environment in the `us-east-1` Region. The architecture includes three spoke VPCs (`vpc-app`, `vpc-db`, and `vpc-web`) connected via an AWS Transit Gateway (`tgw-core`). All spoke VPCs require outbound internet access to download software updates and must resolve domain names hosted in a private hosted zone (PHZ) named `corp.internal` created in a shared services VPC (`vpc-shared`). The design must satisfy the following constraints:

1. Outbound internet traffic must be inspected centrally using AWS Network Firewall before exiting via NAT Gateways.
2. The architecture must remain resilient to a single Availability Zone (AZ) failure without dropping traffic in other AZs.
3. Network latency and data transfer costs for accessing Amazon S3 from `vpc-db` must be minimized.
4. Spoke VPCs must resolve DNS queries for `corp.internal` efficiently.

Which of the following actions should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy a centralized egress VPC containing AWS Network Firewall endpoints and NAT Gateways across two Availability Zones, and enable Transit Gateway appliance mode on the egress VPC attachment.

Create an Amazon S3 Gateway VPC endpoint in the private subnets of the database VPC, and associate the private hosted zone with the application, database, and web VPCs.

Deploy a single, centralized NAT Gateway in one Availability Zone of the egress VPC to optimize NAT Gateway idle costs for all spoke VPCs.

Configure a Route 53 Resolver outbound endpoint in the shared services VPC to forward all resolution queries for the private hosted zone from the spoke VPCs.

Configure a Direct Connect Gateway with a Transit VIF to establish transitive routing between the spoke VPCs and the egress VPC, bypassing the Transit Gateway.

Show answer & explanation

Answer: Deploy a centralized egress VPC containing AWS Network Firewall endpoints and NAT Gateways across two Availability Zones, and enable Transit Gateway appliance mode on the egress VPC attachment.; Create an Amazon S3 Gateway VPC endpoint in the private subnets of the database VPC, and associate the private hosted zone with the application, database, and web VPCs.

Answer

The correct options are deploying a centralized egress VPC containing AWS Network Firewall endpoints and NAT Gateways across two Availability Zones with Transit Gateway appliance mode enabled, and creating an Amazon S3 Gateway VPC endpoint in the database VPC while associating the private hosted zone with the spoke VPCs.

To design a resilient egress infrastructure with centralized inspection, firewall endpoints and NAT Gateways must be placed in multiple Availability Zones. Enabling Transit Gateway appliance mode is essential because Transit Gateway normally routes traffic using hash algorithms that can lead to asymmetric pathing, which breaks stateful firewalls. For optimizing cost and latency to S3, a Gateway VPC endpoint is ideal because it does not carry the hourly or data processing fees associated with interface endpoints or Transit Gateway data paths. Lastly, associating the Private Hosted Zone with all spoke VPCs enables native, secure, and low-latency DNS resolution within those environments.

Step-by-Step Solution

Ensure high availability for egress traffic

NAT Gateways and Network Firewall endpoints are deployed across multiple Availability Zones in the egress VPC.

This guarantees that an outage in one Availability Zone does not impact egress operations in other zones.

Maintain stateful traffic symmetry through Network Firewall

Transit Gateway appliance mode is enabled on the egress VPC attachment.

Appliance mode ensures that both the request and response network flows for a given session pass through the same network interface in the egress VPC, preventing stateful firewalls from dropping the traffic.

Optimize S3 connectivity costs and latency

Create a Gateway VPC endpoint for Amazon S3 in the database VPC.

Gateway VPC endpoints redirect S3-destined traffic directly over the AWS network, bypassing Transit Gateway and NAT Gateway data processing charges.

Enable cross-account and cross-VPC private DNS resolution

Associate the Route 53 Private Hosted Zone with the application, database, and web VPCs.

Private Hosted Zones must be associated with VPCs to allow Route 53 to resolve queries for the defined domain within those VPCs.

Key Concept

Multi-VPC hybrid routing design using Transit Gateway appliance mode for centralized firewalls, combined with cost-optimized VPC endpoints and cross-VPC private DNS resolution.

Question 1288Question →

An enterprise hosts a critical client-facing web application in the us-east-1 Region. The compute tier consists of a Java application running on Amazon EC2 instances inside private subnets, managed by an Auto Scaling group behind an Application Load Balancer (ALB). The storage tier consists of an Amazon RDS for PostgreSQL database in a Single-AZ deployment, and shared files are stored on an Amazon Elastic File System (Amazon EFS) file system. Outbound integrations for the application currently rely on a single NAT Gateway in us-east-1.

The enterprise wants to implement a disaster recovery (DR) solution in the us-west-2 Region using a warm standby strategy. The solution must achieve a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of 5 minutes. Additionally, the solutions architect must improve the reliability of outbound internet connections within the primary region to prevent single-point-of-failure events.

Which of the following combinations of actions should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy a NAT Gateway in each Availability Zone in the primary region's VPC, and configure the private subnet route tables to direct outbound traffic to the local NAT Gateway.

Enable Amazon EFS replication from us-east-1 to us-west-2, and provision an Amazon RDS for PostgreSQL cross-region read replica in us-west-2.

Implement daily AWS Backup copy jobs to replicate RDS and EFS snapshots from us-east-1 to us-west-2, and script a recovery process using AWS Lambda.

Associate the Route 53 private hosted zone used for internal service resolution with the us-east-1 VPC, but delay associating it with the us-west-2 VPC until a failover event is initiated.

Retain the single NAT Gateway in us-east-1 and add a backup route pointing directly to the Internet Gateway in the private subnet route tables to handle outbound failover.

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone in the primary region's VPC, and configure the private subnet route tables to direct outbound traffic to the local NAT Gateway.; Enable Amazon EFS replication from us-east-1 to us-west-2, and provision an Amazon RDS for PostgreSQL cross-region read replica in us-west-2.

Answer

To meet the RTO and RPO requirements, the solutions architect must use Amazon EFS replication and a cross-region read replica for Amazon RDS. To eliminate the single point of failure for outbound internet traffic in the primary region, a NAT Gateway must be deployed in each Availability Zone.

Deploying a NAT Gateway in each Availability Zone ensures that an outage affecting one zone does not disrupt outbound internet connectivity for the remaining zones. Utilizing Amazon EFS replication and configuring an Amazon RDS cross-region read replica establishes continuous, low-latency replication that meets the recovery point objective of 5 minutes.

Step-by-Step Solution

Analyze primary region outbound reliability requirements.

Determine that deploying a single NAT Gateway introduces a single point of failure.

Designing for high availability requires deploying one NAT Gateway per Availability Zone to isolate failures.

Evaluate replication options for the storage and database tiers to achieve a 5-minute RPO.

Identify EFS replication and RDS cross-region read replicas as active replication mechanisms.

Asynchronous continuous replication satisfies the RPO requirement, whereas daily snapshot copies do not.

Verify dependency configurations such as Route 53 Private Hosted Zone associations.

Confirm that Private Hosted Zones must be pre-associated with both VPCs.

Pre-associating VPCs ensures seamless internal DNS resolution immediately upon disaster recovery failover.

Key Concept

Disaster Recovery implementation (RTO/RPO targets) and regional outbound connectivity high availability.

Estimated Time:3m 0s

Question 1289Question →

A digital subscription platform hosts a video-on-demand service. The media catalog database runs on an Amazon RDS for MySQL Multi-AZ DB instance. During popular show releases, the database experiences CPU utilization spikes up to 95% and application servers report database connection timeouts due to a massive surge in read-heavy traffic. The catalog metadata is highly static and updated only once per day. A Solutions Architect must optimize the database layer to reduce latency, prevent connection exhaustion on the database, and ensure that the caching layer is highly available and resilient to node failures. Which two actions should the Solutions Architect take to achieve these objectives? (Select two.)

Select all that apply

Deploy an Amazon ElastiCache for Redis cluster with replication enabled to cache database queries for the media catalog.

Deploy Amazon RDS Proxy between the application servers and the Amazon RDS DB instance to pool database connections.

Configure the application servers to direct read queries to the standby DB instance of the Multi-AZ deployment.

Deploy an Amazon ElastiCache for Memcached cluster and configure Auto Discovery to handle replication and failover across multiple Availability Zones.

Deploy an Amazon ElastiCache for Memcached cluster with a write-through strategy to persist cache updates to the RDS database.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster with replication enabled to cache database queries for the media catalog.; Deploy Amazon RDS Proxy between the application servers and the Amazon RDS DB instance to pool database connections.

Answer

The correct actions are deploying an Amazon ElastiCache for Redis cluster with replication enabled to cache database queries, and deploying Amazon RDS Proxy to pool database connections.

Deploying an Amazon ElastiCache for Redis cluster with replication enabled provides a highly available, replicated cache that offloads static catalog reads from the database. Deploying Amazon RDS Proxy handles connection pooling, preventing connection exhaustion and timeouts during traffic spikes.

Step-by-Step Solution

Analyze the database workload and bottleneck.

The media catalog data is highly static and read-heavy, making it an ideal candidate for caching to reduce database CPU load.

Offloading frequent reads from the database to an in-memory cache directly resolves database CPU spikes.

Evaluate high availability requirements for the cache.

Amazon ElastiCache for Redis with replication is selected over Memcached.

The caching tier must be highly available and resilient to node failures. ElastiCache for Redis supports replication and automatic failover, whereas Memcached does not.

Address database connection exhaustion.

Amazon RDS Proxy is introduced between the application servers and the RDS DB instance.

RDS Proxy pools database connections, preventing connection exhaustion and timeouts when application servers scale out during spikes.

Key Concept

Optimizing database performance using ElastiCache for Redis for high-availability caching, and managing connection pooling using Amazon RDS Proxy.

Question 1290Question →

During a planned migration to AWS, an administrator installs the AWS Application Migration Service (MGN) agent on a source server. Although the installation succeeds, the replication status remains in a disconnected state because replication data traffic is blocked. Which network configuration must be applied to resolve this connectivity issue?

Configure the local firewall and target security groups to permit traffic on TCP port 1500 to the replication servers in the staging area.

Associate a private hosted zone in Amazon Route 53 with the staging VPC to resolve the hostnames of the replication servers.

Configure a Direct Connect gateway to handle transitive routing between the source network and multiple VPCs via AWS Transit Gateway.

Route outbound replication traffic through a single NAT Gateway deployed in one Availability Zone of the staging VPC.

Show answer & explanation

Answer: Configure the local firewall and target security groups to permit traffic on TCP port 1500 to the replication servers in the staging area.

Answer

Configure the local firewall and target security groups to permit traffic on TCP port 1500 to the replication servers in the staging area.

The correct option addresses the direct requirement of AWS Application Migration Service (MGN), which is that the replication agent installed on the source server requires outbound access over TCP port 1500 to transmit data blocks to the replication servers in the staging area subnet.

Step-by-Step Solution

Identify the network protocol and port required by the AWS Application Migration Service (MGN) replication agent for data replication.

The MGN replication agent requires outbound communication over TCP port 1500.

Data replication blocks are transmitted from the source server to replication servers over TCP port 1500.

Check the local firewall on the source server and target security groups in the AWS staging area VPC.

Confirm that TCP port 1500 is allowed outbound from the source server and inbound to the replication servers.

If TCP port 1500 is blocked along the path, replication cannot initiate even if the agent is installed successfully.

Key Concept

AWS Application Migration Service replication network requirements

Question 1291Question →

An enterprise is planning to migrate its on-premises customer management and billing systems to AWS. A solutions architect has completed the application discovery phase and identified the following workload components:

* Core Billing Database: A legacy Oracle Database. The business wants to migrate this database to Amazon Aurora PostgreSQL to eliminate licensing fees and leverage cloud-native database features. This migration will require a complete schema rewrite and application-level SQL query changes.
* Web Frontend: A legacy Java application running on Apache Tomcat. The development team wants to avoid managing operating systems and virtual machine patching. They plan to package the existing application into a Docker container and host it on a managed container orchestration platform.
* Legacy Inventory System: A legacy client-server desktop application that relies on a specialized physical USB license key (hardware dongle) plugged directly into the physical host. The vendor is out of business, and the software cannot be virtualized or run without the physical dongle.

Which combination of migration strategies should the solutions architect recommend for these systems? (Select THREE.)

Select all that apply

Refactor the Core Billing Database by converting the Oracle schema and rewriting application-level SQL queries to migrate to Amazon Aurora PostgreSQL.

Replatform the Web Frontend by packaging the Java application into a Docker container and deploying it to Amazon ECS with AWS Fargate.

Retain the Legacy Inventory System on-premises because of the physical hardware dongle dependency.

Replatform the Core Billing Database by performing a direct lift-and-shift of the Oracle schema to Amazon Aurora PostgreSQL without application changes.

Rehost the Web Frontend by using AWS Application Migration Service (MGN) to deploy the VM directly into Amazon ECS tasks.

Retire the Legacy Inventory System by decommissioning the application on-premises and hosting the client-server logic on AWS Lambda.

Show answer & explanation

Answer: Refactor the Core Billing Database by converting the Oracle schema and rewriting application-level SQL queries to migrate to Amazon Aurora PostgreSQL.; Replatform the Web Frontend by packaging the Java application into a Docker container and deploying it to Amazon ECS with AWS Fargate.; Retain the Legacy Inventory System on-premises because of the physical hardware dongle dependency.

Answer

The correct migration strategies are: Refactoring the Core Billing Database (converting Oracle to Aurora PostgreSQL), Replatforming the Web Frontend (containerizing Tomcat to ECS/Fargate), and Retaining the Legacy Inventory System on-premises due to the hardware dongle dependency.

The correct strategies are Refactoring the database tier, Replatforming the web tier, and Retaining the inventory tier. Migrating from Oracle to Amazon Aurora PostgreSQL is a heterogeneous database migration that requires schema conversion and query changes, which is classified as Refactoring (or Re-architecting). Containerizing the Java application on Tomcat to run on Amazon ECS with AWS Fargate changes the platform configuration without altering the application code, which represents Replatforming. The inventory system has a hard dependency on a physical USB hardware dongle plugged into the host, making it impossible to virtualize or host in the cloud; therefore, this system must be Retained on-premises.

Step-by-Step Solution

Analyze the migration requirements for the Core Billing Database.

Identified a heterogeneous migration from Oracle to Amazon Aurora PostgreSQL requiring schema conversion and code modifications.

Determining whether a migration involves changing the database engine is critical, as engine changes require schema conversions (Refactoring/Re-architecting) rather than a simple platform optimization (Replatforming) or block-level copy (Rehosting).

Analyze the migration requirements for the Web Frontend.

Identified a shift from VM-based Tomcat to containerized ECS/Fargate without modifying the core application code.

Transitioning to a managed container service without application code modifications aligns with the Replatforming strategy (also known as lift-tinker-and-shift).

Analyze the constraints of the Legacy Inventory System.

Identified a hard dependency on a physical USB hardware dongle that cannot be virtualized or migrated to the cloud.

Applications that rely on physical hardware keys, unsupported legacy OS versions, or proprietary hardware that cannot be virtualized must be Retained on-premises.

Key Concept

Selecting the appropriate migration strategy from the 7 Rs framework based on workload constraints, database engine compatibility, containerization goals, and physical hardware dependencies.

Question 1292Question →

A logistics company runs a real-time fleet tracking platform on AWS. The application uses an Amazon RDS for PostgreSQL Multi-AZ DB instance to store active delivery vehicle telemetry (current coordinates, speed, and status) and historical trip logs. During high-demand delivery windows, the platform experiences significant write latency because of lock contention on the database, while dispatchers report that dashboard queries for active vehicle locations take several seconds to load. The database CPU utilization routinely spikes to 95%. A solutions architect must optimize the database and caching layer. The new solution must achieve sub-millisecond read latency for active vehicle queries, scale to handle high-frequency telemetry writes, reduce database connection overhead, and guarantee high availability with replication for the cached telemetry data. Which two actions should the solutions architect take to resolve the bottlenecks? (Select TWO.)

Select all that apply

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled to cache the latest active vehicle coordinates, serving dashboard reads directly from the cache.

Deploy an Amazon ElastiCache for Memcached cluster to store active vehicle locations, configuring replication to a standby node in another Availability Zone.

Implement Amazon RDS Proxy between the application servers and the PostgreSQL database, and create an RDS Read Replica to offload dispatcher dashboard reads from the primary DB instance.

Configure the application to route dispatcher dashboard read queries directly to the Multi-AZ standby instance of the RDS for PostgreSQL DB instance to offload the primary writer.

Deploy Amazon DynamoDB Accelerator (DAX) directly in front of the RDS for PostgreSQL DB instance to cache SQL queries and write telemetry updates using a write-through strategy.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled to cache the latest active vehicle coordinates, serving dashboard reads directly from the cache.; Implement Amazon RDS Proxy between the application servers and the PostgreSQL database, and create an RDS Read Replica to offload dispatcher dashboard reads from the primary DB instance.

Answer

Deploying an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled, and implementing Amazon RDS Proxy with an RDS Read Replica.

Deploying an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled provides the required sub-millisecond read latency for the active vehicle coordinates while ensuring high availability. Implementing Amazon RDS Proxy solves connection overhead during high-frequency telemetry write spikes, and adding an RDS Read Replica offloads the dispatcher dashboard queries from the primary database instance to eliminate read-write contention.

Step-by-Step Solution

Analyze the database performance bottlenecks to separate read-heavy dashboard queries from write-heavy telemetry updates.

Identified read-write contention on the primary RDS instance and high CPU usage due to dashboard reads.

Helps design a decoupled read/write scaling strategy.

Evaluate caching requirements for the active vehicle telemetry data.

Selected Amazon ElastiCache for Redis because it supports sub-millisecond latencies, replication, and multi-AZ failover, whereas Memcached lacks replication.

Ensures caching high availability and low-latency access.

Deploy Amazon RDS Proxy to sit between the application and the RDS DB instance.

Reduces connection pooling overhead on the primary instance during peak log upload bursts.

Maintains database stability under sudden connection spikes.

Create an Amazon RDS Read Replica and route dashboard read queries to it.

Offloads complex queries from the primary instance to the read replica, avoiding lock contention.

Allows scaling read and write operations independently.

Key Concept

Database and cache efficiency improvements by offloading read queries to replicas and caching active data using Redis instead of Memcached, combined with RDS Proxy connection pooling.

Question 1293Question →

An organization is establishing a new payment and inventory processing system in the `us-west-2` Region. The architecture contains a payment VPC (`vpc-payments-prd`) and an inventory VPC (`vpc-inventory-prd`). Hybrid connectivity to the on-premises database servers is established using an AWS Direct Connect connection. To support local service discovery, the organization hosts a Route 53 Private Hosted Zone (PHZ) named `service.internal` inside a central shared-services AWS account. Workloads in both VPCs must be able to communicate with each other, connect to the on-premises database, and resolve DNS queries for `service.internal`. Which networking design meets these requirements while ensuring high availability and minimal routing complexity?

Attach both `vpc-payments-prd` and `vpc-inventory-prd`, along with the AWS Direct Connect Gateway, to an AWS Transit Gateway. Configure Transit Gateway route tables to allow VPC-to-VPC and VPC-to-on-premises traffic. Perform cross-account authorization and associate the Route 53 Private Hosted Zone `service.internal` directly with both `vpc-payments-prd` and `vpc-inventory-prd`.

Attach both `vpc-payments-prd` and `vpc-inventory-prd` directly to the AWS Direct Connect Gateway. Use the Direct Connect Gateway's built-in routing to forward traffic between the VPCs and the on-premises network. Associate the Route 53 Private Hosted Zone `service.internal` directly with the Direct Connect Gateway.

Attach both `vpc-payments-prd` and `vpc-inventory-prd`, along with the AWS Direct Connect Gateway, to an AWS Transit Gateway. Configure Transit Gateway routing for network connectivity. Associate the Route 53 Private Hosted Zone `service.internal` with the AWS Transit Gateway to enable DNS resolution across all attached VPCs.

Attach both `vpc-payments-prd` and `vpc-inventory-prd`, along with the AWS Direct Connect Gateway, to an AWS Transit Gateway. Deploy a single NAT Gateway in `vpc-payments-prd` to route all outbound hybrid and cross-VPC traffic. Associate the Route 53 Private Hosted Zone `service.internal` directly with both VPCs.

Show answer & explanation

Answer: Attach both `vpc-payments-prd` and `vpc-inventory-prd`, along with the AWS Direct Connect Gateway, to an AWS Transit Gateway. Configure Transit Gateway route tables to allow VPC-to-VPC and VPC-to-on-premises traffic. Perform cross-account authorization and associate the Route 53 Private Hosted Zone `service.internal` directly with both `vpc-payments-prd` and `vpc-inventory-prd`.

Answer

Attach both VPCs and the Direct Connect Gateway to an AWS Transit Gateway to enable routing, and perform cross-account authorization and association of the Route 53 Private Hosted Zone with both VPCs.

The correct architecture uses AWS Transit Gateway to act as a cloud router, enabling communication between the two VPCs and the on-premises data center via the Direct Connect Gateway. Additionally, Route 53 Private Hosted Zones must be associated with each VPC that needs to resolve the namespace. Since the hosted zone is in a centralized shared services account, cross-account association authorizations must be created to associate the zone with the payment and inventory VPCs.

Step-by-Step Solution

Deploy an AWS Transit Gateway and attach both VPCs and the AWS Direct Connect Gateway to it.

Enables transitive routing between the two spoke VPCs and the on-premises network.

Direct Connect Gateway does not support transitive routing, meaning spoke VPCs cannot communicate with each other through it. An AWS Transit Gateway is required to facilitate VPC-to-VPC and hybrid traffic.

Configure the Transit Gateway route tables to propagate routes from the VPCs and the Direct Connect Gateway.

Establishes network-level connectivity between all resources.

Proper route table configuration ensures that traffic is correctly routed between the on-premises CIDR ranges and the spoke VPC CIDRs.

Authorize and associate the Route 53 Private Hosted Zone with both VPCs from the central account.

Enables DNS resolution for the `service.internal` namespace in both VPCs.

Private Hosted Zones must be associated with each VPC individually. Because the zone resides in a different AWS account, a cross-account authorization must be created first before the association can be established.

Key Concept

AWS Transit Gateway for hybrid transitive routing and cross-account Route 53 Private Hosted Zone associations.

Estimated Time:2m 0s

Question 1294Question →

An international logistics enterprise is designing a high-throughput, low-latency package tracking and telemetry pipeline. The system must ingest over $1.5\text{ million}$ small, unstructured JSON telemetry updates per second (NoSQL write-heavy workload) with ingestion latency under $10\text{ ms}$ . The database tier must span a primary region (`us-east-1`) and a disaster recovery region (`us-west-2`).

The design must meet the following constraints:
- Telemetry queries for the active tracking dashboard must resolve with sub-millisecond latency (microsecond range) for the most recent status of any package.
- Historical telemetry must be archived to an Amazon S3 bucket in a dedicated compliance AWS account within $24\text{ hours}$ and retained for $7\text{ years}$ .
- RPO must be less than $1\text{ second}$ and RTO must be less than $1\text{ minute}$ for both the data store and ingestion layers.
- Data transferred to the compliance account must be encrypted at rest using KMS Customer Managed Keys (CMKs) to support cross-account access.
- Minimize administrative overhead and avoid provisioning self-managed EC2 instances.

Which TWO options should the solutions architect select to design the database and storage strategy to satisfy these requirements? (Select TWO.)

Select all that apply

Configure Amazon DynamoDB Global Tables spanning `us-east-1` and `us-west-2` with write-capacity auto-scaling to ingest vehicle telemetry, and enable DynamoDB Accelerator (DAX) clusters in both regions to serve dashboard queries. Use DynamoDB Streams to trigger AWS Lambda functions to batch and write data to the compliance account's S3 bucket.

Deploy Amazon RDS for PostgreSQL in a Multi-AZ configuration in `us-east-1` with read replicas in `us-west-2` to handle read traffic. Assumes that the Multi-AZ standby instances can dynamically scale query loads to achieve sub-millisecond latencies during peak hours.

Create an S3 bucket in the compliance account with a bucket policy permitting cross-account write actions from the primary account's Lambda execution role. Configure the S3 bucket to encrypt objects using a Customer Managed Key (CMK) created in the compliance account, with a key policy granting the primary account's role permissions for `kms:GenerateDataKey` and `kms:Decrypt`.

Create an S3 bucket in the compliance account, and configure cross-account S3 Replication from the primary account's S3 bucket. Encrypt the destination bucket using the default AWS managed key (`aws/s3`) in the compliance account to simplify key management and minimize administrative overhead.

Deploy Amazon ElastiCache for Memcached with Multi-AZ replication enabled across both regions to cache query results for the tracking dashboard. Configure Memcached snapshots to be written directly to the primary S3 bucket and replication rules to copy them to the compliance account.

Show answer & explanation

Answer: Configure Amazon DynamoDB Global Tables spanning `us-east-1` and `us-west-2` with write-capacity auto-scaling to ingest vehicle telemetry, and enable DynamoDB Accelerator (DAX) clusters in both regions to serve dashboard queries. Use DynamoDB Streams to trigger AWS Lambda functions to batch and write data to the compliance account's S3 bucket.; Create an S3 bucket in the compliance account with a bucket policy permitting cross-account write actions from the primary account's Lambda execution role. Configure the S3 bucket to encrypt objects using a Customer Managed Key (CMK) created in the compliance account, with a key policy granting the primary account's role permissions for `kms:GenerateDataKey` and `kms:Decrypt`.

Answer

The correct architecture uses Amazon DynamoDB Global Tables with DynamoDB Accelerator (DAX) clusters in both regions to meet the latency, RPO, and RTO constraints. It uses DynamoDB Streams and AWS Lambda to write data to the compliance account. The destination compliance S3 bucket must utilize a Customer Managed Key (CMK) in the compliance account, with its key policy configured to allow the primary account's Lambda execution role to perform `kms:GenerateDataKey` and `kms:Decrypt` operations.

The correct strategy combines Amazon DynamoDB Global Tables with DynamoDB Accelerator (DAX) to provide the required scale, RPO, and RTO, while ensuring microsecond read query times. Writing to the compliance account S3 bucket requires using a customer-managed KMS key in the compliance account, with a custom key policy granting access to the primary account's write principal, as AWS-managed keys cannot be shared cross-account.

Step-by-Step Solution

Analyze the ingestion volume and latency constraints to select the primary database engine.

Select Amazon DynamoDB Global Tables instead of relational databases like RDS PostgreSQL.

DynamoDB easily handles millions of unstructured write operations per second with single-digit millisecond latency. Global Tables replicate writes cross-region within sub-second intervals, meeting the RPO of less than 1 second, whereas RDS PostgreSQL requires complex scaling for this volume.

Select the appropriate caching mechanism to support microsecond-latency dashboard queries.

Enable DynamoDB Accelerator (DAX) clusters in both active regions.

DAX is an in-memory cache purpose-built for DynamoDB that reduces query latencies to microseconds, whereas ElastiCache for Memcached lacks built-in integration, replication, and persistence features required for this scenario.

Formulate the cross-account archiving pipeline to Amazon S3.

Enable DynamoDB Streams to capture changes and trigger AWS Lambda functions to batch and write files to S3.

This serverless design minimizes administrative overhead and eliminates the need to provision or manage EC2 instances for data transfer.

Select the encryption strategy using Customer Managed Keys (CMKs) to secure cross-account S3 uploads.

Create a Customer Managed Key (CMK) in the compliance account and configure its key policy to allow access to the primary account's Lambda execution role.

AWS-managed KMS keys do not support policy modifications for cross-account access. Only customer-managed keys (CMKs) allow editing key policies to permit cross-account usage.

Key Concept

Designing highly scalable, multi-region database and cross-account secure storage pipelines using DynamoDB Global Tables, DAX, serverless processing, and KMS customer-managed key policies.

Question 1295Question →

A media streaming provider operates an on-demand video transcoding platform. The media processing API runs on Amazon EC2 instances inside an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The instances are deployed across two Availability Zones (AZ-A and AZ-B) in private subnets. The application instances require a bootstrapping script that takes approximately $8$ minutes to pull Docker images and initialize transcoding engines.

During a highly advertised live sporting event, a sudden influx of transcoding requests caused:
1. The ALB to drop connection requests with HTTP $502$ and $504$ errors during the first $10$ minutes of the surge.
2. The ASG to over-provision by launching hundreds of unnecessary instances because the CPU utilization metric remained elevated while the initial batch of instances was still bootstrapping.
3. Complete failure of outbound API callbacks to external payment gateways when AZ-A suffered a localized power disruption, as both private subnets routed internet-bound traffic through a single NAT Gateway in AZ-A.

Which combination of architectural improvements should the Solutions Architect implement to resolve these issues?

Configure the ALB with an Elastic IP address to handle the sudden capacity increase. Set the ASG target tracking policy's estimated instance warmup to

300

seconds. Deploy a NAT Gateway in the public subnet of each Availability Zone, and configure the private route tables to route all outbound traffic through the primary NAT Gateway in AZ-A unless it becomes unavailable.

Request AWS Support to pre-warm the ALB to the expected capacity prior to the event. Configure target tracking scaling policies on the ASG with the estimated instance warmup set to

540

seconds. Deploy a NAT Gateway in the public subnet of each Availability Zone, and update the route tables of the private subnets to direct outbound traffic to the local NAT Gateway in their respective zones.

Request AWS Support to pre-warm the ALB to the expected capacity prior to the event. Configure target tracking scaling policies on the ASG with the estimated instance warmup set to

300

seconds. Deploy a single NAT Gateway in the public subnet of AZ-A, and configure the route tables of both private subnets to route outbound traffic through this single gateway.

Rely on the ALB's automatic scaling mechanism to adapt to the traffic surge. Configure target tracking scaling policies on the ASG with the estimated instance warmup set to

540

seconds. Deploy a single NAT Gateway in the public subnet of AZ-B, and configure the route tables of both private subnets to route outbound traffic through this single gateway.

Show answer & explanation

Answer: Request AWS Support to pre-warm the ALB to the expected capacity prior to the event. Configure target tracking scaling policies on the ASG with the estimated instance warmup set to $540$ seconds. Deploy a NAT Gateway in the public subnet of each Availability Zone, and update the route tables of the private subnets to direct outbound traffic to the local NAT Gateway in their respective zones.

Answer

The correct solution is to pre-warm the Application Load Balancer (ALB) before the event, configure the Auto Scaling Group's estimated instance warmup to

540

seconds to cover the

8

-minute bootstrapping process, and deploy a NAT Gateway in both Availability Zones with local route table configurations.

The correct solution resolves the load balancing capacity issue by pre-warming the load balancer before the scheduled sporting event, prevents auto-scaling over-provisioning by setting the estimated instance warmup time to

540

seconds (which is longer than the

8

-minute bootstrapping time), and ensures high availability for outbound traffic by deploying a NAT Gateway in each Availability Zone with local routing.

Step-by-Step Solution

Address the initial load balancer connection failures by pre-provisioning capacity.

Pre-warming the Application Load Balancer (ALB) ensures that it has sufficient capacity partitioned before the event, avoiding HTTP

502

and

504

errors during sudden surges.

Standard ELB auto-scaling is reactive and cannot scale rapidly enough to absorb massive, instantaneous surges in request rates.

Configure the scaling policy metrics to accommodate instance bootstrap lag.

Setting the estimated instance warmup parameter in the target tracking policy to

540

seconds (greater than the

8

-minute or

480

-second bootstrap time) delays metric aggregation for newly launched instances.

This prevents the Auto Scaling Group from launching additional, redundant instances while the initial batch is still preparing to accept traffic.

Ensure outbound connectivity redundancy across Availability Zones.

Deploying a NAT Gateway in the public subnet of both Availability Zones and pointing the local private subnet route tables to their respective local NAT Gateways provides zone-independent outbound routing.

If outbound traffic routes through a single NAT Gateway, any outage affecting that gateway's Availability Zone will break internet connectivity for all private subnets across the entire architecture.

Key Concept

Continuous optimization of scaling dynamics and fault-tolerant routing configurations in multi-AZ environments.

Question 1296Question →

A solutions architect is planning to migrate an on-premises Oracle database to an Amazon Aurora PostgreSQL database. The migration must minimize downtime and convert database code such as stored procedures. Which of the following actions are required to convert the database schema and perform the migration with ongoing replication? (Select TWO.)

Select all that apply

Use the AWS Schema Conversion Tool (SCT) to convert the database schema, stored procedures, and functions to PostgreSQL-compatible formats.

Enable supplemental logging on the source Oracle database to allow AWS Database Migration Service (DMS) to read the redo logs for Change Data Capture (CDC).

Start the AWS Database Migration Service (DMS) replication task with Change Data Capture (CDC) enabled without configuring supplemental logging or archiving on the source Oracle database.

Use AWS Application Migration Service (MGN) to automatically convert the Oracle database engine to PostgreSQL and replicate the underlying blocks.

Configure AWS Resource Access Manager (RAM) to share the on-premises physical disk storage containing Oracle data files with the target database.

Show answer & explanation

Answer: Use the AWS Schema Conversion Tool (SCT) to convert the database schema, stored procedures, and functions to PostgreSQL-compatible formats.; Enable supplemental logging on the source Oracle database to allow AWS Database Migration Service (DMS) to read the redo logs for Change Data Capture (CDC).

Answer

Use the AWS Schema Conversion Tool (SCT) to convert the database schema, stored procedures, and functions, and enable supplemental logging on the source Oracle database.

To migrate from Oracle to Aurora PostgreSQL (a heterogeneous migration), the schema and code must be converted using the AWS Schema Conversion Tool (SCT). Furthermore, to perform ongoing replication (Change Data Capture), supplemental logging must be enabled on the source Oracle database so AWS DMS can successfully capture and replicate transaction changes from the redo logs.

Step-by-Step Solution

Convert the schema and code for the heterogeneous migration.

Use AWS SCT to translate Oracle-specific schemas and stored procedures to PostgreSQL-compatible formats.

Since the source and target database engines are different (Oracle to PostgreSQL), standard migration tools cannot automatically convert database code without schema conversion.

Configure the source database for replication.

Enable supplemental logging on the source Oracle database.

AWS DMS needs supplemental logging enabled on Oracle to extract data change information from the redo logs during the Change Data Capture (CDC) phase.

Key Concept

Heterogeneous database migration using AWS SCT and AWS DMS with Change Data Capture.

Question 1297Question →

An enterprise operates a critical e-commerce platform on Amazon EC2 instances managed by an Auto Scaling group in a production AWS account. The application writes transaction and system logs to `/var/log/app/service.log`. These logs undergo hourly rotation, where the active log file is renamed to `/var/log/app/service.log.YYYY-MM-DD-HH` and a new empty log file is created. The company wants to implement a near real-time monitoring and centralization solution. They need to monitor these logs in CloudWatch Logs for real-time error rate alerting and also store the logs in a centralized Amazon S3 bucket located in a separate security AWS account for long-term audit compliance. Which two configurations should a solutions architect implement to meet these requirements?

Select all that apply

Install the CloudWatch agent on the EC2 instances. Configure the agent configuration file with the `file_path` parameter set to `/var/log/app/service.log*` to ensure that both the active log file and any rotated files are continuously monitored and sent to CloudWatch Logs.

Install the CloudWatch agent on the EC2 instances. Configure the agent configuration file with the `file_path` parameter set to the static path `/var/log/app/service.log` to track the active log file, relying on the agent to automatically follow the file descriptor across hourly rotations.

In the security account, configure the S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the specific IAM role ARN used by the Kinesis Data Firehose delivery stream in the production account. In the production account, configure a CloudWatch Logs subscription filter to stream the log group to Kinesis Data Firehose, which delivers them to the security account's S3 bucket.

In the security account, configure the S3 bucket policy to grant `s3:PutObject` permissions to the `logs.amazonaws.com` service principal, and configure a CloudWatch Logs subscription filter in the production account to stream logs directly to the security account's S3 bucket.

In the production account, configure the CloudWatch agent to write logs directly to the security account's S3 bucket by configuring the `s3_delivery` block in the agent's configuration file, and attach a Service Control Policy (SCP) to the production account that grants `s3:PutObject` access to the security account's S3 bucket.

Show answer & explanation

Answer: Install the CloudWatch agent on the EC2 instances. Configure the agent configuration file with the `file_path` parameter set to `/var/log/app/service.log*` to ensure that both the active log file and any rotated files are continuously monitored and sent to CloudWatch Logs.; In the security account, configure the S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the specific IAM role ARN used by the Kinesis Data Firehose delivery stream in the production account. In the production account, configure a CloudWatch Logs subscription filter to stream the log group to Kinesis Data Firehose, which delivers them to the security account's S3 bucket.

Answer

Install the CloudWatch agent on the EC2 instances with a wildcard file path (`/var/log/app/service.log*`) to handle log rotation, and configure a CloudWatch Logs subscription filter in the production account to stream logs to a Kinesis Data Firehose delivery stream, which writes to the security account's S3 bucket using an S3 bucket policy that permits the Firehose IAM role.

The correct solution involves configuring the CloudWatch agent to monitor application logs using a wildcard path to ensure rotated log files are not missed, and then streaming those logs cross-account to the security account's S3 bucket using a CloudWatch Logs subscription filter pointing to Kinesis Data Firehose, with a bucket policy that explicitly permits the Firehose IAM role to write to the bucket.

Step-by-Step Solution

Configure the CloudWatch agent on the EC2 instances to track rotated logs using wildcards.

By using the wildcard pattern `/var/log/app/service.log*`, the CloudWatch agent successfully monitors the active log file and any recently rotated log files without losing data during hourly rotations.

Static paths do not track renamed files after rotation, resulting in log loss.

Set up a CloudWatch Logs subscription filter in the production account to forward logs to Kinesis Data Firehose.

Real-time logs are streamed continuously from the CloudWatch Logs log group to the Kinesis Data Firehose delivery stream.

CloudWatch Logs subscription filters cannot write directly to S3 and require an intermediate streaming service like Kinesis Data Firehose.

Configure the cross-account S3 bucket policy in the security account to trust the Firehose IAM role.

The Kinesis Data Firehose stream in the production account is authorized to write logs into the security account's S3 bucket.

Cross-account S3 access must be explicitly allowed by the bucket policy for the writer's IAM role, as default ACLs are insufficient and disabled by default.

Key Concept

Continuous application log monitoring using the CloudWatch agent with log rotation handling, combined with real-time cross-account log centralization to S3 via CloudWatch subscription filters and Kinesis Data Firehose.

Question 1298Question →

An enterprise manages a multi-account AWS environment under a single organization in AWS Organizations with consolidated billing. The architecture includes the following workloads running 24/7:

Workload	Current Configuration	CloudWatch CPU Utilization	CloudWatch Memory Utilization
ECS Fargate Tasks (Account A)	$30$ tasks across $3$ AZs; $2$ vCPU, $8\text{ GB}$ RAM per task	Average: $28\%$ , Peak: $48\%$	Average: $35\%$ , Peak: $55\%$
EC2 Instances (Account B)	$10$ instances of `m6i.xlarge` ( $4$ vCPU, $16\text{ GB}$ RAM) in an ASG across $2$ AZs	Average: $22\%$ , Peak: $40\%$	Average: $30\%$ , Peak: $45\%$
AWS Lambda (Account A)	$20\text{ million}$ requests/month; $1024\text{ MB}$ memory, $800\text{ ms}$ avg duration	N/A	N/A

Outbound traffic to the internet from the Fargate tasks in Account A is routed through a dedicated NAT Gateway in each of the $3$ Availability Zones. The company requires maximum cost optimization across all compute and network resources while maintaining high availability with no single points of failure, and ensuring that no workloads experience performance degradation or out-of-memory errors under peak loads.

Which of the following strategies should a Solutions Architect recommend to achieve the most cost-effective architecture?

Right-size the ECS Fargate tasks in Account A to

1

vCPU and

5\text{ GB}

RAM. Right-size the EC2 instances in Account B to `m6i.large`. Maintain the

3

NAT Gateways in Account A. Purchase a single Compute Savings Plan at the AWS Organizations management account level.

Right-size the ECS Fargate tasks in Account A to

1

vCPU and

5\text{ GB}

RAM. Right-size the EC2 instances in Account B to `m6i.large`. Decommission two NAT Gateways in Account A and route all outbound traffic through a single NAT Gateway in one Availability Zone. Purchase a single Compute Savings Plan at the AWS Organizations management account level.

Right-size the ECS Fargate tasks in Account A to

1

vCPU and

5\text{ GB}

RAM. Right-size the EC2 instances in Account B to `m6i.large`. Maintain the

3

NAT Gateways in Account A. Purchase an EC2 Instance Savings Plan for the `m6i` family at the AWS Organizations management account level to cover the EC2 instances, and purchase a Compute Savings Plan in member Account A to cover the Fargate and Lambda workloads.

Right-size the ECS Fargate tasks in Account A to

1

vCPU and

5\text{ GB}

RAM. Right-size the EC2 instances in Account B to `m6i.large`. Share the NAT Gateways in Account B's VPC with Account A's VPC using AWS Resource Access Manager (RAM) to eliminate NAT Gateway hourly charges in Account A. Purchase a single Compute Savings Plan at the AWS Organizations management account level.

Show answer & explanation

Answer: Right-size the ECS Fargate tasks in Account A to $1$ vCPU and $5\text{ GB}$ RAM. Right-size the EC2 instances in Account B to `m6i.large`. Maintain the $3$ NAT Gateways in Account A. Purchase a single Compute Savings Plan at the AWS Organizations management account level.

Answer

Right-size the ECS Fargate tasks in Account A to

1

vCPU and

5\text{ GB}

RAM. Right-size the EC2 instances in Account B to `m6i.large`. Maintain the

3

NAT Gateways in Account A. Purchase a single Compute Savings Plan at the AWS Organizations management account level.

The correct strategy combines precise right-sizing with organizational-level financial planning. Sizing the Fargate tasks to

1\text{ vCPU}

and

5\text{ GB}

RAM meets the peak memory requirement of

4.4\text{ GB}

, preventing OOM crashes, while `m6i.large` matches the

7.2\text{ GB}

peak memory of the EC2 instances. Buying a Compute Savings Plan at the AWS Organizations management level covers Fargate, Lambda, and EC2 workloads across all accounts and ensures flexibility. Keeping

3

NAT Gateways ensures high availability without cross-AZ data transfer charges.

Step-by-Step Solution

Calculate peak resource requirements for the ECS Fargate tasks in Account A.

Peak CPU is

48\%

2\text{ vCPU} = 0.96\text{ vCPU}

. Peak memory is

55\%

8\text{ GB} = 4.4\text{ GB}

Sizing must support peak utilization to prevent performance degradation or out-of-memory (OOM) crashes.

1\text{ vCPU}

and

5\text{ GB}

RAM is the smallest standard Fargate configuration that safely covers both peak CPU and memory. Sizing to

4\text{ GB}

RAM would result in OOM errors.

Calculate peak resource requirements for the EC2 instances in Account B.

Peak CPU is

40\%

4\text{ vCPU} = 1.6\text{ vCPU}

. Peak memory is

45\%

16\text{ GB} = 7.2\text{ GB}

Sizing must support peak utilization. The `m6i.large` instance type offers

2\text{ vCPU}

and

8\text{ GB}

RAM, which satisfies these peak requirements cost-effectively.

Evaluate the networking configuration to maintain high availability and prevent single points of failure.

Retain

3

NAT Gateways in Account A across

3

Availability Zones.

Deleting NAT Gateways to route cross-AZ introduces a single point of failure and cross-AZ data transfer fees. NAT Gateways cannot be shared directly across accounts or VPCs using AWS Resource Access Manager (RAM).

Determine the optimal Savings Plan strategy for compute resources across the organization.

Purchase a Compute Savings Plan at the AWS Organizations management account level.

Compute Savings Plans cover EC2, Fargate, and Lambda. Purchasing at the management account level ensures consolidated billing benefits where unused commitment is shared dynamically across all member accounts.

Key Concept

Multi-account cost optimization requires a combination of precise performance-based right-sizing (ensuring headroom for peak utilization without OOM), high-availability networking design, and selecting Compute Savings Plans at the AWS Organizations management level for dynamic sharing.

Question 1299Question →

An enterprise is planning to migrate a legacy document management platform to AWS. The system consists of three tiers:
1. An IIS web application tier hosting the portal on Windows Server. Due to a datacenter lease expiration, this tier must be migrated to AWS within a strict 3-month window with minimal changes and less than 2 hours of transition downtime.
2. An Oracle Database Enterprise Edition database tier containing complex PL/SQL packages. The enterprise wants to eliminate commercial database license costs, minimize long-term administrative overhead, and migrate to Amazon Aurora PostgreSQL-Compatible Edition.
3. A legacy document archival tool that requires a physical, proprietary PCIe cryptographic hardware card connected to the server chassis for decrypting historical archives. The hardware vendor does not support virtualization or cloud environments.

Which of the following migration strategies represent the correct mapping of the 7 Rs framework for these components? (Select TWO.)

Select all that apply

Rehost the IIS web application tier to Amazon EC2 using AWS Application Migration Service (MGN), and Retain the legacy document archival tool on-premises.

Refactor the database tier from Oracle to Amazon Aurora PostgreSQL-Compatible Edition by using the AWS Schema Conversion Tool (SCT) and AWS Database Migration Service (DMS).

Replatform the database tier by converting the Oracle database to Amazon Aurora PostgreSQL-Compatible Edition using the AWS Schema Conversion Tool (SCT).

Replatform the legacy document archival tool by moving it to an Amazon EC2 Dedicated Host and utilizing AWS CloudHSM to virtualize the PCIe cryptographic hardware.

Refactor the IIS web application tier by rewriting the application to run on AWS Lambda to ensure maximum scalability prior to migration.

Show answer & explanation

Answer: Rehost the IIS web application tier to Amazon EC2 using AWS Application Migration Service (MGN), and Retain the legacy document archival tool on-premises.; Refactor the database tier from Oracle to Amazon Aurora PostgreSQL-Compatible Edition by using the AWS Schema Conversion Tool (SCT) and AWS Database Migration Service (DMS).

Answer

The correct strategy mappings are: (1) Rehost the IIS web application tier using AWS Application Migration Service (MGN) and Retain the legacy document archival tool on-premises, and (2) Refactor the database tier from Oracle to Amazon Aurora PostgreSQL-Compatible Edition by using the AWS Schema Conversion Tool (SCT) and AWS Database Migration Service (DMS).

The correct choices identify that migrating the web application to Amazon EC2 with minimal modifications under a tight timeline is a Rehost strategy, while keeping the legacy hardware-dependent archival tool on-premises is a Retain strategy. Additionally, converting the database from Oracle to Aurora PostgreSQL represents a Refactor strategy because changing database engines requires converting database schemas and rewriting stored procedures.

Step-by-Step Solution

Analyze the requirements and constraints of the web application tier.

The web application tier requires migration within a strict 3-month window with minimal modifications.

Because of the tight schedule and minimal change requirements, Rehost (using block-level migration tools like AWS MGN) is the correct strategy.

Analyze the requirements and constraints of the database tier.

The database needs to migrate from Oracle to Amazon Aurora PostgreSQL to optimize licensing costs.

Migrating to a completely different database engine requires schema translation and code modification, which constitutes a Refactor (Re-architect) migration path.

Analyze the requirements and constraints of the legacy document archival tool.

The archival tool relies on a physical PCIe cryptographic card that cannot be virtualized or operated in AWS.

Since the physical hardware dependency cannot be migrated or replicated in the cloud, this component must be Retained on-premises.

Key Concept

Selecting migration strategies under the 7 Rs framework based on application dependencies, target engine changes, and migration schedule constraints.

Question 1300Question →

A financial services firm runs a real-time card payment validation service. The platform performs verification checks against a database containing merchant validation rules, risk profiles, and transaction velocity limits. The database is hosted on a write-heavy Amazon RDS for PostgreSQL DB instance. During high-volume shopping events, validation read latency spikes to over $150$ milliseconds due to read contention, causing payment timeouts. The architecture requires a caching layer to reduce read latency to sub-millisecond levels. The validation data is highly dynamic, requiring key-value replication across Availability Zones, automated failover, and the ability to persist the cached data structures to disk to support rapid recovery. Which architecture should a solutions architect recommend to optimize the database performance and meet these caching requirements?

Deploy an Amazon ElastiCache for Memcached cluster with multiple nodes spanning across multiple Availability Zones, and configure the validation service to use it as a read-through cache.

Configure the RDS PostgreSQL Multi-AZ DB instance to direct validation read traffic to the standby DB instance in the secondary Availability Zone, and enable pg_transport for caching.

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ enabled and replication groups, and configure the validation service to query the cache before the database.

Deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache the PostgreSQL queries, and update the application code to use the DAX client for read operations.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ enabled and replication groups, and configure the validation service to query the cache before the database.

Answer

Deploying an Amazon ElastiCache for Redis cluster with Multi-AZ enabled and replication groups, and configuring the validation service to query the cache before the database.

Deploying an Amazon ElastiCache for Redis cluster with Multi-AZ and replication groups satisfies all requirements. Redis supports data persistence, multi-AZ replication, and automated failover, which are necessary for the rapid recovery of the validation data.

Step-by-Step Solution

Analyze the validation service requirements.

The target solution must deliver sub-millisecond read latency, support key-value caching, replicate across Availability Zones, provide automated failover, and support data persistence for rapid recovery.

This establishes the technical constraints for selecting the database optimization and caching pattern.

Evaluate ElastiCache engine options against the constraints.

Amazon ElastiCache for Redis supports replication, Multi-AZ with automatic failover, and data persistence (AOF and RDB backups). Amazon ElastiCache for Memcached does not support persistence, replication, or automatic failover.

This rules out Memcached-based solutions due to lack of replication and durability.

Evaluate RDS database tier capabilities.

RDS PostgreSQL standby instances in Multi-AZ deployments are passive and cannot serve read traffic. Offloading read queries requires either an external cache or RDS Read Replicas.

This rules out attempting to route queries directly to the RDS standby DB instance.

Evaluate DynamoDB Accelerator compatibility.

DynamoDB Accelerator (DAX) is designed exclusively for Amazon DynamoDB and cannot front an RDS PostgreSQL instance.

This rules out DAX as a valid caching option for this relational database configuration.

Key Concept

Improving Database and Caching Efficiency

Estimated Time:3m 0s

PreviousPage 65 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept