Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1301Question →

A financial services enterprise is planning to migrate its core application portfolio to AWS. The portfolio consists of three key components:

1. A monolithic Java application running on Apache Tomcat. The application code cannot be modified due to a strict 3-month migration window and a lack of Java development resources. However, the company wants to minimize server administration overhead on AWS.
2. A backend transactional database running on Oracle Database EE. To reduce ongoing operational expenditures, the executive leadership has mandated the complete elimination of proprietary database licensing costs. The migration team has been allocated a separate 9-month timeframe to perform comprehensive schema conversions and rewrite database-interacting application queries.
3. A legacy COBOL reporting system running on an aging mainframe. Due to compliance requirements, the historical ledger data must remain accessible once a year. The source code is lost, and the system cannot be simulated or migrated to the cloud.

Which combination of migration strategies under the 7 Rs framework should the solutions architect recommend to meet all requirements?

Show answer & explanation

Answer: Replatform the Java application to Amazon ECS on AWS Fargate; Refactor the Oracle database by converting the schema and migrating to Amazon Aurora PostgreSQL; Retain the legacy COBOL reporting system on-premises.

Answer

Replatform the Java application to Amazon ECS on AWS Fargate; Refactor the Oracle database by converting the schema and migrating to Amazon Aurora PostgreSQL; Retain the legacy COBOL reporting system on-premises.
The correct strategy combination aligns each application tier with its timeline and business constraints. The Java/Tomcat application is containerized and hosted on a serverless container platform (Amazon ECS on Fargate) without changes to the application code, which qualifies as Replatforming. The Oracle database is migrated to an open-source compatible engine (Amazon Aurora PostgreSQL), which requires schema conversion and query modifications, making this a Refactoring (or Re-architecting) strategy. The legacy COBOL mainframe system cannot be migrated or simulated due to compliance and technical constraints, so it must be kept in its current state on-premises, which represents Retaining.

Step-by-Step Solution

1
Analyze the constraints and goals of the Java/Tomcat tier.
The application must be migrated within 3 months, code cannot be changed, and management overhead must be minimized. Containerizing it and running on ECS Fargate without code modifications represents a Replatform strategy.
This yields cloud benefits (reduced management) without the time and resource investment of a code rewrite.
2
Analyze the database tier requirements and constraints.
Proprietary licensing costs must be eliminated, and a 9-month timeline is given for schema conversion and query rewrites. Migrating from Oracle to Amazon Aurora PostgreSQL requires schema conversion and query refactoring, representing a Refactoring (Re-architecting) strategy.
Engine changes require significant modification of database-interacting code and schemas, which falls under Refactoring.
3
Analyze the mainframe reporting tier requirements.
The system cannot be simulated or migrated, source code is lost, and it must remain accessible once a year for compliance. Keeping it on-premises represents a Retain strategy.
When an application cannot be migrated to the cloud and must remain active, Retain is the appropriate 7 Rs strategy.

Key Concept

Selecting the correct 7 Rs migration strategy (Rehost, Replatform, Refactor, Retain, Retire, Relocate, Repurchase) based on technical, timeline, and financial constraints.
Question 1302Question →

An e-commerce company hosts its transaction processing workload in the us-east-1 Region. The compute layer consists of Amazon ECS tasks running on AWS Fargate behind an Application Load Balancer (ALB). The data layer uses an Amazon Aurora PostgreSQL database. Currently, all outbound internet traffic from the private subnets is routed through a single NAT Gateway in one Availability Zone.

To enhance reliability and prepare for disaster recovery, the company wants to implement a multi-region strategy in the us-west-2 Region. The design must achieve a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 5 minutes.

Which configuration represents the most reliable and cost-effective solution that meets these requirements?

Show answer & explanation

Answer: Convert the database to an Amazon Aurora Global Database with a secondary cluster in us-west-2. Deploy the ECS service in us-west-2 with the desired task count set to 1. In both Regions, provision a NAT Gateway in each Availability Zone. Use AWS Route 53 Application Recovery Controller (ARC) routing controls to manage failover between the Application Load Balancers in both Regions.

Answer

Convert the database to an Amazon Aurora Global Database with a secondary cluster in us-west-2. Deploy the ECS service in us-west-2 with the desired task count set to 1. In both Regions, provision a NAT Gateway in each Availability Zone. Use AWS Route 53 Application Recovery Controller (ARC) routing controls to manage failover between the Application Load Balancers in both Regions.
The correct option addresses all the design constraints. An Amazon Aurora Global Database provides sub-second cross-region replication to us-west-2, satisfying the 5-minute RPO. Having the ECS service running with at least one task verifies deployment health and allows standard scaling policies to meet the 15-minute RTO. Redundant NAT Gateways ensure high availability within each region. AWS Route 53 ARC routing controls provide reliable, deterministic multi-region failover management.

Step-by-Step Solution

1
Select a replication strategy for the database layer that achieves an RPO of less than 5 minutes.
Amazon Aurora Global Database provides millisecond-level cross-region replication, easily satisfying the 5-minute RPO requirement.
Traditional backup restore methods (like hourly snapshots) have an RPO that is too high.
2
Ensure the compute layer can be restored within the 15-minute RTO.
ECS tasks can be scaled up quickly from a warm standby configuration (minimum 1 task) within minutes.
Running a minimal set of tasks verifies service health in the secondary region and allows fast auto-scaling during failover.
3
Eliminate single points of failure in the egress network path.
NAT Gateways are deployed in each Availability Zone in both regions.
A single NAT Gateway per region is a single point of failure that violates reliability best practices.
4
Implement a reliable cross-region failover mechanism.
AWS Route 53 Application Recovery Controller (ARC) is configured with routing controls to orchestrate failover.
Route 53 ARC routing controls allow deterministic and safe failover alignment across the data and application tiers.

Key Concept

Disaster recovery strategy selection (RTO/RPO), multi-AZ network redundancy, and automated multi-region failover.
Question 1303Question →

A systems administrator is setting up the target AWS environment for an infrastructure migration using AWS Application Migration Service (MGN). The administrator needs to configure the network settings in the replication template. Which of the following network configuration settings are required to allow the replication servers in the staging area to successfully receive replicated data from the source servers and communicate with the service? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A security group assigned to the replication servers that permits incoming traffic on TCP port 1500 from the source agents.; Outbound network connectivity from the replication servers in the staging subnet to the MGN service endpoints over TCP port 443.

Answer

To successfully set up AWS Application Migration Service (MGN) staging area networking, the replication servers must be allowed to receive incoming data traffic from the source servers over TCP port 1500, and they must have outbound network connectivity to the MGN API endpoints over TCP port 443.
The correct configurations are allowing incoming traffic on TCP port 1500 to the replication servers and allowing outbound TCP port 443 from the staging area to MGN service endpoints. The replication agent on the source machine establishes a connection to the replication server in the staging area over port 1500 to stream data blocks. Additionally, replication servers must be able to communicate with the MGN control plane via HTTPS (port 443) to report replication progress and receive instructions.

Step-by-Step Solution

1
Configure the security groups in the staging area to allow inbound TCP traffic on port 1500 from the source servers where the replication agent is installed.
Inbound data replication path is established.
Allows replication servers to receive data blocks streamed by the source agents.
2
Configure the subnet routing and firewalls in the staging area to permit outbound HTTPS traffic (TCP port 443) from the replication servers to the regional MGN endpoints.
Outbound control plane communication path is established.
Allows replication servers to communicate status updates and receive orchestration instructions from the MGN service.

Key Concept

AWS Application Migration Service (MGN) replication architecture relies on replication servers in a staging area. These servers require inbound data replication over TCP port 1500 from the source agents, and outbound control plane communication over TCP port 443 to the MGN service endpoints.
Question 1304Question →

A digital banking application hosts its core processing engine on Amazon ECS tasks inside a private subnet of VPC-A in Account A. The application must retrieve daily financial statements from an Amazon S3 bucket in Account B. The S3 bucket is encrypted using SSE-KMS.

To comply with new security mandates, a solutions architect must implement the following changes:
1. Ensure all S3 data transfer is routed privately through an S3 Interface VPC Endpoint (vpce-s3-interface) in VPC-A, and all KMS decryption requests route privately through a KMS Interface VPC Endpoint (vpce-kms) in VPC-A.
2. Restrict access to the S3 bucket and the KMS key so that they only accept requests originating from their respective VPC endpoints in VPC-A.
3. Prevent any IAM identity in the organization from modifying or deleting the S3 bucket policy, with the sole exception of a break-glass IAM role (AdminRole) in Account B.

Which combination of actions will meet these requirements?

Show answer & explanation

Answer: Configure the S3 bucket to use a Customer Managed Key (CMK) in Account B for encryption. Update the S3 bucket policy to allow the ECS task IAM role in Account A to read objects, restricted by a condition for vpce-s3-interface. Update the KMS CMK key policy in Account B to allow the ECS task role to perform kms:Decrypt and kms:GenerateDataKey, restricted by a condition for vpce-kms. Attach an SCP to the OU containing Account B that denies s3:PutBucketPolicy and s3:DeleteBucketPolicy on the bucket, using a condition that excludes the AdminRole from the Deny effect.

Answer

Configure the S3 bucket to use a Customer Managed Key (CMK) in Account B, configure S3 and KMS Interface VPC Endpoints in VPC-A, restrict policy conditions to their respective VPC endpoints, and attach an SCP with a condition that excludes the AdminRole from the Deny effect.
The correct configuration uses a Customer Managed Key (CMK) in Account B, because the default AWS-managed KMS key cannot have its key policy modified to grant cross-account permissions. It separates traffic across two distinct interface endpoints (S3 and KMS) in VPC-A and locks them down via specific endpoint ID checks. Finally, it uses an SCP containing a condition to exclude the AdminRole from the Deny effect, preventing other roles from tampering with the bucket policy while maintaining break-glass administrative access.

Step-by-Step Solution

1
Determine the appropriate KMS key type for cross-account access.
Identify that a Customer Managed Key (CMK) must be used in Account B, as the default AWS-managed key policy cannot be modified to grant access to the cross-account role in Account A.
AWS-managed keys do not allow modification of their key policies to trust external accounts.
2
Configure network isolation for S3 and KMS data planes.
Utilize S3 and KMS Interface VPC Endpoints in VPC-A, and restrict access in the S3 bucket policy and KMS key policy to requests originating from these respective VPC endpoints using the aws:sourceVpce condition key.
This ensures that all data access and decryption requests are bound to the authorized VPC endpoints.
3
Formulate the Service Control Policy (SCP) to prevent unauthorized policy modification while allowing break-glass access.
Deploy an SCP with a Deny effect on s3:PutBucketPolicy and s3:DeleteBucketPolicy with a condition that excludes the specific AdminRole in Account B.
SCPs act as permission guards; an unconditional deny would block even local administrators, whereas a conditional deny preserves administrative access for the designated role.
4
Configure DNS resolution for private endpoints across accounts.
Ensure that any private hosted zones used for cross-account endpoint resolution are explicitly associated with VPC-A.
Private Hosted Zones must be associated with a VPC to allow DNS queries originating from that VPC to resolve successfully.

Key Concept

Strengthening cross-account access, network isolation with interface VPC endpoints, and governance with Service Control Policies.
Question 1305Question →

An enterprise is designing a multi-region database solution. The primary database is located in `vpc-primary` in `us-east-1` across two Availability Zones, and its read replica is in `vpc-replica` in `us-west-2` across two Availability Zones. A corporate datacenter requires private access to both VPCs over an existing 10 Gbps AWS Direct Connect connection terminated at a Direct Connect Gateway (DXGW). The replication traffic between the databases must be highly performant and use the AWS private backbone. Additionally, database instances in both VPCs require highly available outbound internet access for security patching. A Route 53 Private Hosted Zone (PHZ) named `databases.internal` must be resolvable from both VPCs and from the corporate datacenter. Which network architecture meets these requirements with the lowest latency and highest availability?

Show answer & explanation

Answer: Deploy AWS Transit Gateway in both regions, peer them for database replication, and associate the DXGW with both Transit Gateways to provide datacenter access. In each VPC, deploy a NAT Gateway in each Availability Zone for patching. Associate the Private Hosted Zone with both VPCs, and deploy Route 53 Resolver Inbound Endpoints in the VPCs to handle DNS queries from the corporate datacenter.

Answer

The architecture deploying Transit Gateways in both regions, peered together, with the Direct Connect Gateway associated to both Transit Gateways, along with multi-AZ NAT Gateways in each VPC and the Private Hosted Zone associated with both VPCs.
Peering the Transit Gateways enables direct, low-latency, and high-performance inter-region replication over the AWS private backbone. Associating the Direct Connect Gateway with both Transit Gateways allows the on-premises datacenter to access both VPCs without routing traffic transitively through the peering connection, which is not supported. Deploying NAT Gateways in every Availability Zone ensures high availability for outbound patching. Associating the Route 53 Private Hosted Zone with both VPCs and creating Inbound Endpoints allows seamless DNS resolution from both VPCs and the on-premises network.

Step-by-Step Solution

1
Configure hybrid connectivity routing
Associate the Direct Connect Gateway with Transit Gateways in both us-east-1 and us-west-2 to allow direct communication from the datacenter to each VPC without violating transitive routing constraints.
AWS Transit Gateway peering does not support transitive routing from attached Direct Connect Gateways. Therefore, the DXGW must be associated with the Transit Gateways in both regions to enable on-premises access to both VPCs.
2
Configure inter-region database replication paths
Establish a Transit Gateway peering connection between the primary and replica Transit Gateways, and update the route tables to route database replication traffic over this peering connection.
This routes the database traffic over the AWS global network infrastructure, providing the lowest latency and highest throughput for replication.
3
Design highly available internet egress
Deploy a NAT Gateway in each Availability Zone where the databases are deployed in both vpc-primary and vpc-replica, updating the private route tables to route 0.0.0.0/0 to the local NAT Gateway in the same zone.
This configuration avoids cross-AZ dependencies and prevents a single NAT Gateway failure from disabling outbound patching capability for the database instances.
4
Implement DNS resolution architecture
Associate the single Route 53 Private Hosted Zone with both vpc-primary and vpc-replica. Deploy Route 53 Resolver Inbound Endpoints in the VPCs and configure the corporate DNS server to forward queries for databases.internal to these endpoint IP addresses.
Associating the Private Hosted Zone with both VPCs ensures that database instances in both regions can resolve the private endpoints. Route 53 Inbound Endpoints allow the corporate datacenter to resolve the hosted zone records via the Direct Connect connection.

Key Concept

Designing multi-region hybrid networks using AWS Transit Gateway peering, Direct Connect Gateway associations, Route 53 Private Hosted Zone multi-VPC sharing, and high-availability NAT architectures.
Question 1306Question →

A gaming company hosts a multiplayer online game where active game lobby states, player statistics, and match queues are stored in an Amazon RDS for PostgreSQL DB instance. During peak hours, the database experiences CPU exhaustion and high read latencies due to a massive volume of read queries retrieving game lobby lists and player leaderboard data. To resolve this performance bottleneck, a solutions architect needs to introduce a caching layer. The caching solution must support automatic failover across multiple Availability Zones to ensure high availability, persist cache data to survive node restarts, and support complex data types like sorted sets to efficiently manage the leaderboards. Which architecture should the solutions architect implement to meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled, and configure the application to read from the cache.

Answer

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled, and configure the application to read from the cache.
Deploying an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled meets all requirements. Redis natively supports sorted sets (zsets) to rank player performance, data persistence to disk to survive restarts, and Multi-AZ replication to ensure high availability with automated failover.

Step-by-Step Solution

1
Analyze the technical requirements of the caching layer.
The requirements dictate support for Multi-AZ automatic failover, data persistence to survive node restarts, and advanced data structures (sorted sets) for leaderboard data.
This establishes the evaluation criteria for comparing AWS database and caching options.
2
Evaluate Amazon ElastiCache engines against the requirements.
ElastiCache for Redis supports replication, Multi-AZ automatic failover, persistence, and complex data structures. ElastiCache for Memcached only supports simple key-value pairs without replication or persistence.
This eliminates Memcached as a viable solution.
3
Evaluate RDS Multi-AZ standby features.
RDS standby instances in a Multi-AZ deployment are passive and cannot serve read traffic.
This eliminates options attempting to route queries to the standby instance.
4
Assess the high availability configuration options for Redis.
An ElastiCache for Redis replication group with Multi-AZ and automatic failover enabled meets the high availability and performance targets with the lowest operational overhead.
This ensures automated failover without manual snapshot restoration processes.

Key Concept

Selecting the appropriate ElastiCache engine and configuration based on requirements for replication, persistence, and data structure support.
Question 1307Question →

A biotechnology company has a multi-account AWS environment managed under AWS Organizations. Genomic sequencing applications run on Amazon EC2 instances across multiple member accounts. The application writes log files to a local directory `/var/log/sequencer/`. To manage disk space, the application rotates logs hourly, creating new files with timestamp suffixes (for example, `sequencer_20260716-11.log`). A Solutions Architect needs to design a centralized logging solution to collect these application logs and AWS CloudTrail logs from all member accounts into a single Amazon S3 bucket in a dedicated Security account. The architecture must stream application logs in real time and minimize operational overhead.

Which solution should the Solutions Architect implement to meet these requirements?

Show answer & explanation

Answer: Configure the CloudWatch agent on the EC2 instances with the `file_path` parameter set to `/var/log/sequencer/sequencer_*.log` to stream logs to Amazon CloudWatch Logs. Use CloudWatch Logs subscription filters to send the log events to a centralized Amazon Kinesis Data Firehose delivery stream that writes to the Security account S3 bucket. Create an organization trail in AWS CloudTrail that delivers log files directly to the Security account S3 bucket, ensuring the bucket policy grants `s3:PutObject` permissions to the CloudTrail service principal with a condition checking for the Organization ID.

Answer

Configure the CloudWatch agent with a wildcard path (`/var/log/sequencer/sequencer_*.log`) to track rotated logs in real time, stream them using CloudWatch subscription filters and Kinesis Data Firehose to the Security account's S3 bucket, and configure an organization trail in CloudTrail with a bucket policy that grants access to the CloudTrail service principal restricted by the Organization ID.
The correct solution uses a wildcard pattern in the CloudWatch agent configuration (`sequencer_*.log`) which natively detects and monitors newly created timestamped log files as they are rotated, ensuring real-time log ingestion without custom scripts. It also uses CloudWatch subscription filters to stream these logs to Kinesis Data Firehose for centralization, and leverages an AWS CloudTrail organization trail with the correct S3 bucket policy allowing the CloudTrail service principal to write to the centralized bucket using the Organization ID condition, minimizing operational overhead.

Step-by-Step Solution

1
Configure the CloudWatch agent using wildcard patterns for rotated logs.
The agent dynamically detects and streams newly generated log files without requiring manual symlinks or file copying.
Ensures operational excellence by avoiding missing log data during rotation.
2
Set up Kinesis Data Firehose with CloudWatch Logs subscription filters.
Log events are streamed in real time from member accounts to the central S3 bucket in the Security account.
Provides an automated, scalable streaming pipeline for cross-account log centralization.
3
Configure an Organization-wide CloudTrail and verify the Security account's S3 bucket policy.
All AWS API logs are delivered to the central S3 bucket with write permissions granted to the `cloudtrail.amazonaws.com` service principal and restricted by Organization ID.
Secures cross-account log delivery and simplifies configuration across the Organization.

Key Concept

Centralized multi-account logging for applications and CloudTrail with optimal CloudWatch agent configuration for rotated log files.
Question 1308Question →

A media streaming company is designing a globally distributed user profiling and watch-history platform. The database must sustain high-volume OLTP write operations with sub-10 millisecond latency. The platform must be deployed across two AWS Regions (us-east-1 and us-west-2). A centralized security account (SecurityAcct) requires cross-account read access to audit the database encryption keys and metadata. The system must achieve a Recovery Point Objective (RPO) of less than 1 second and a Recovery Time Objective (RTO) of less than 5 minutes. Additionally, read workloads are highly dynamic and experience sudden, unpredictable surges. Which database and storage design meets these requirements while minimizing management overhead?

Show answer & explanation

Answer: Deploy Amazon DynamoDB Global Tables across us-east-1 and us-west-2. Configure DynamoDB Auto Scaling for both read and write capacity units to handle dynamic surges. Use a Customer Managed Key (CMK) in AWS KMS in each region, and update the key policies to grant decryption and metadata permissions to the audit role in the centralized security account.

Answer

Deploy Amazon DynamoDB Global Tables across us-east-1 and us-west-2, using DynamoDB Auto Scaling and Customer Managed Keys (CMKs) with key policies updated to delegate cross-account access to the centralized security account.
The correct answer configuration utilizes Amazon DynamoDB Global Tables, which provides fully managed active-active replication across multiple regions with sub-second RPO and extremely low RTO. DynamoDB Auto Scaling automatically adjusts capacity to handle traffic surges. Additionally, using Customer Managed Keys (CMKs) allows for the editing of key policies to delegate access to the centralized security account, which is impossible with default AWS managed KMS keys.

Step-by-Step Solution

1
Evaluate the database tier requirements for OLTP writes, multi-region replication, and sub-10 millisecond latencies.
Amazon DynamoDB is selected due to its ability to handle high-throughput NoSQL write traffic with single-digit millisecond latency. DynamoDB Global Tables provide active-active cross-region replication that achieves sub-second RPO and sub-minute RTO.
This satisfies the performance, latency, and disaster recovery (RTO/RPO) requirements.
2
Analyze how to scale the database for sudden, dynamic surges in read workload.
DynamoDB Auto Scaling dynamically adjusts read and write capacity units (RCUs and WCUs) based on specified utilization percentages.
This addresses the dynamic and unpredictable read surges without manual intervention or over-provisioning.
3
Determine the encryption key management strategy for cross-account security auditing.
Create a Customer Managed Key (CMK) in AWS KMS in each destination region, and configure the key policies to explicitly grant access to the auditing IAM role in the centralized security account.
AWS managed KMS keys (e.g., aws/dynamodb) do not allow policy modification and cannot be shared cross-account, necessitating the use of Customer Managed Keys.

Key Concept

Multi-region NoSQL database architecture utilizing DynamoDB Global Tables with Customer Managed KMS Keys for secure cross-account auditing and Auto Scaling for elastic performance.
Question 1309Question →

A company is strengthening the security posture of an existing data archiving application. The application runs on Amazon EC2 instances within a private subnet in Account A. The application must write archive files to an Amazon S3 bucket located in Account B. The S3 bucket is encrypted using a Customer Managed Key (CMK) in Account B. The security team requires that all network traffic to Amazon S3 and AWS KMS remains within the AWS private network, and that the application's IAM role in Account A is the only entity allowed to write to the S3 bucket and use the KMS key. Which combination of actions must a Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account A's VPC, create a Gateway VPC endpoint for Amazon S3 and an Interface VPC endpoint for AWS KMS. Configure the VPC route tables in Account A to route S3 traffic through the Gateway VPC endpoint.; Configure the S3 bucket policy in Account B to allow the s3:PutObject action from the application's IAM role ARN in Account A. Configure the KMS key policy in Account B to allow kms:GenerateDataKey and kms:Decrypt actions for the application's IAM role ARN.

Answer

To establish secure, private cross-account connectivity, the Solutions Architect must deploy a Gateway VPC endpoint for S3 and an Interface VPC endpoint for KMS in Account A. In Account B, the S3 bucket policy and the Customer Managed Key (CMK) policy must be configured to grant access to the application's cross-account IAM role.
Establishing a secure cross-account connection to a KMS-encrypted S3 bucket over private networks requires configuring endpoints for both services in the client VPC. S3 uses a Gateway VPC endpoint, while KMS requires an Interface VPC endpoint because cryptographic data key generation and decryption calls are made directly to KMS endpoints. Additionally, because the resource resides in a different account, the S3 bucket policy and the KMS customer managed key policy in the destination account must explicitly permit actions from the client IAM role ARN.

Step-by-Step Solution

1
Deploy network endpoints in the consumer VPC.
Gateway VPC Endpoint for S3 and Interface VPC Endpoint (PrivateLink) for KMS are created in Account A's VPC.
Since the bucket uses SSE-KMS, the application must perform KMS API calls (GenerateDataKey and Decrypt) in addition to S3 calls. KMS traffic cannot route through the S3 Gateway endpoint and requires a separate Interface endpoint.
2
Establish resource-based cross-account access.
The S3 bucket policy and KMS key policy in Account B are updated with statements targeting the application role in Account A.
IAM policies in Account A alone cannot grant access to resources in Account B. Resource policies in the hosting account must explicitly trust the external IAM entity.

Key Concept

Cross-account access to KMS-encrypted S3 buckets over private endpoints
Question 1310Question →

A SaaS provider has an existing multi-account AWS environment managed under AWS Organizations. Member accounts upload sensitive compliance logs to a centralized Amazon S3 bucket located in a dedicated Security account. Currently, the S3 bucket is configured with default encryption using the AWS-managed KMS key (`aws/s3`). To meet new regulatory standards, the company must enhance data protection by using a customer managed key with annual rotation enabled, enforcing this encryption mechanism across all uploads, and ensuring that access to the key is properly delegated. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a customer managed KMS key in the Security account, configure its key policy to allow the member accounts' IAM roles `kms:GenerateDataKey*` and `kms:Decrypt` permissions, and enable annual automatic key rotation.; Apply a Service Control Policy (SCP) to the member accounts' Organizational Units (OUs) that denies `s3:PutObject` requests unless they use `aws:kms` encryption and specify the ARN of the customer managed KMS key.

Answer

The correct actions are: (1) Creating a customer managed KMS key in the Security account, configuring its key policy to trust the member accounts, and enabling annual automatic key rotation. (2) Applying a Service Control Policy (SCP) that denies `s3:PutObject` requests unless they specify the customer managed KMS key.
To satisfy the regulatory requirements, a customer managed KMS key must be created in the Security account because AWS-managed keys cannot be shared across accounts. Enabling key rotation ensures annual key updates. To enforce this, a Service Control Policy (SCP) should be applied to the member accounts' OUs to deny any `s3:PutObject` requests that do not use the specified KMS key, establishing a strong compliance guardrail.

Step-by-Step Solution

1
Identify the type of KMS key that supports cross-account access and automatic rotation.
AWS-managed keys (`aws/s3`) cannot be shared across accounts. A customer managed KMS key must be created in the Security account.
Customer managed KMS keys allow modifying the key policy to delegate cross-account access and support automatic rotation.
2
Configure permissions for member accounts to write encrypted objects.
The customer managed KMS key's key policy in the Security account must explicitly delegate access to the member accounts.
Cross-account access to KMS keys requires explicit delegation in the key policy as S3 bucket policies do not automatically delegate KMS permissions.
3
Enforce the compliance encryption standard across the organization.
Apply a Service Control Policy (SCP) to the member OUs that denies `s3:PutObject` unless the specific customer managed KMS key is used.
SCPs act as guardrails, allowing centralized enforcement of encryption standards across all member accounts without granting direct access.

Key Concept

Cross-account access delegation with KMS, S3 bucket policies, and SCP guardrails in AWS Organizations.
Estimated Time:3m 0s
Question 1311Question →

A global logistics company is preparing for a major system integration that will connect a new partner's fleet of 100,000100,000 delivery vehicles. The integration will launch on a specific date and will result in an immediate, one-time 20×20\times increase in telemetry traffic at exactly 09:00 UTC. The existing telemetry processing service runs on Amazon EC2 instances inside an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances reside in private subnets across two Availability Zones (AZ-A and AZ-B) and retrieve reference metadata from external APIs via a single NAT Gateway located in AZ-A. The EC2 instances require a 55-minute bootstrapping period to pull configuration files and warm up application caches before they can successfully process requests. Under the current scaling configuration, when CPU utilization spikes, the ASG launches instances but does not wait for the bootstrapping to complete before launching more, resulting in severe over-provisioning. Additionally, the architecture must ensure that a failure of a single Availability Zone or NAT Gateway does not disrupt outbound connectivity for the EC2 instances. Which three actions should the Solutions Architect take to prepare the architecture for the launch and resolve these reliability issues?

Select all that apply

Show answer & explanation

Answer: Create a NAT Gateway in AZ-B, and configure the route table of the private subnets in AZ-B to route outbound internet traffic through this new gateway.; Update the Auto Scaling group scaling policy to include a default instance warmup of 300300 seconds.; Submit a request to AWS Support to pre-warm the Application Load Balancer to the expected request rate and concurrent connection levels prior to the launch time.

Answer

To resolve these issues, the Solutions Architect should create a NAT Gateway in AZ-B and update the route table for AZ-B's private subnets, configure the Auto Scaling group scaling policy to include a default instance warmup of 300300 seconds, and submit a request to AWS Support to pre-warm the Application Load Balancer.
The correct options address the three specific requirements: establishing AZ-specific NAT Gateways to avoid a single point of failure for outbound traffic, configuring an instance warmup period of 300300 seconds to match the bootstrapping duration and prevent over-provisioning, and requesting ALB pre-warming from AWS Support to handle the sudden, massive traffic spike.

Step-by-Step Solution

1
Address the single point of failure for outbound internet traffic by creating a second NAT Gateway in AZ-B and updating the routing of the private subnets in AZ-B to point to this new NAT Gateway, leaving the route tables in AZ-A untouched.
Each Availability Zone has independent outbound internet routing, eliminating cross-AZ dependencies and single points of failure.
Outbound traffic from private subnets needs to be resilient to AZ failures, which requires localized NAT Gateways per AZ.
2
Resolve the scaling policy over-provisioning by modifying the ASG settings to include a default instance warmup of 300300 seconds.
The ASG will pause scaling actions for 300300 seconds after launching an instance, allowing it to bootstrap fully before the group evaluates metrics again.
This prevents the scaling metric from continuously triggering scale-out actions while newly launched instances are still bootstrapping.
3
Ensure the Application Load Balancer can handle the instantaneous 20×20\times traffic surge by submitting a pre-warming request ticket to AWS Support.
AWS will pre-allocate sufficient capacity for the ALB in advance of the scheduled launch.
Standard ALB auto-scaling is reactive and cannot keep pace with an instantaneous, massive flash traffic spike.

Key Concept

To achieve high availability and handle sudden traffic spikes, Solution Architects must design multi-AZ redundant NAT configurations, utilize ELB pre-warming for anticipated massive surges, and tune Auto Scaling group warmup/cooldown intervals to match instance bootstrapping times.
Question 1312Question →

A financial services company manages a multi-account environment within an organization in AWS Organizations. The consolidated billing feature is enabled. The compute and data workloads are distributed as follows:

* Account A (Production): Runs a customer-facing web application on Amazon ECS using AWS Fargate across 33 Availability Zones. This account incurs a steady compute charge of $12,000 USD\$12,000\text{ USD} per month. Next month, a large-scale batch processing ETL pipeline will be migrated to run on AWS Lambda in this account, with an estimated cost of $5,000 USD\$5,000\text{ USD} per month.
* Account B (Analytics): Runs a cluster of Amazon EC2 c6g.xlarge instances (Linux) for continuous data analysis. This fleet runs 24/724/7 with a highly predictable load, costing $9,000 USD\$9,000\text{ USD} per month.

The ECS tasks in Account A require outbound internet access to communicate with external payment processing APIs. This traffic is currently routed through 33 NAT Gateways (one in each Availability Zone) and is highly critical, requiring strict high availability. The batch processing workload in Account A also requires internet access but can tolerate up to 44 hours of downtime during a failure. A review of the billing data reveals that a significant portion of Account A's NAT Gateway charges is due to transferring large datasets to Amazon S3 and Amazon DynamoDB.

Which combination of actions will optimize resource costs most effectively while maintaining the required availability constraints? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Purchase a Compute Savings Plan in the organization's management account to cover the AWS Fargate tasks, EC2 instances, and future Lambda functions across both member accounts.; Deploy Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB in Account A's VPC, and update the routing tables to route traffic to these services through the endpoints instead of the NAT Gateways.

Answer

The solutions architect should purchase a Compute Savings Plan in the organization's management account and deploy Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB in Account A's VPC.
Purchasing a Compute Savings Plan at the AWS Organizations management account level allows the discount to be shared across consolidated billing member accounts, automatically covering EC2, Fargate, and Lambda workloads. In addition, deploying Gateway VPC endpoints for S3 and DynamoDB routes data traffic directly to these services, bypassing the NAT Gateways and eliminating data processing charges without reducing the availability of the internet route for the critical payment APIs.

Step-by-Step Solution

1
Analyze compute resource requirements across both accounts.
Identify that the compute footprint spans Amazon ECS Fargate (Account A), AWS Lambda (upcoming in Account A), and Amazon EC2 c6g (Account B).
Choosing a savings model requires mapping the different compute architectures and their baseline costs.
2
Evaluate Savings Plan types against the compute resource footprint.
Select a Compute Savings Plan because it applies to EC2, Fargate, and Lambda. Reject EC2 Instance Savings Plans because they do not cover Fargate or Lambda.
Ensures that the optimization strategy covers all eligible compute services across both member accounts.
3
Determine the purchasing account for the Savings Plan within AWS Organizations.
Recommend purchasing the plan in the organization's management account.
Allows consolidated billing to distribute the discount benefit across all member accounts automatically.
4
Analyze NAT Gateway data transfer and design a network optimization strategy.
Identify that S3 and DynamoDB data transfer goes through NAT Gateways. Deploy Gateway VPC endpoints for S3 and DynamoDB to route this traffic directly and eliminate data processing fees.
Bypasses NAT Gateways for AWS service traffic, saving data processing costs at no extra charge.
5
Verify compliance with the high-availability requirements.
Retain the three NAT Gateways for the critical payment gateway subnets to avoid a single point of failure.
Consolidating all outbound traffic to a single NAT Gateway would violate the strict high-availability constraint for the customer portal.

Key Concept

Evaluating Savings Plans coverage and optimizing network traffic via VPC endpoints to balance cost reductions with application availability constraints.
Question 1313Question →

An enterprise runs a high-throughput, memory-intensive backend application across multiple member accounts in AWS Organizations. The primary production compute environment in the main application account consists of:
- An Auto Scaling Group (ASG) of Amazon EC2 instances launched across 33 Availability Zones using `m6g.2xlarge` instances (88 vCPUs, 3232 GiB RAM). Performance metrics show an average CPU utilization of 25%25\% (peaking at 40%40\%) and an average memory utilization of 75%75\% (peaking at 85%85\%).
- Multiple microservices running on AWS Fargate tasks.
- An API routing layer using AWS Lambda.

All software is compiled specifically for the ARM64 architecture, and the application must maintain high availability across all 33 Availability Zones with zero downtime. The company wants to optimize compute costs. Which of the following is the most cost-effective and architecturally sound strategy?

Show answer & explanation

Answer: Modify the EC2 launch template to use `r6g.xlarge` instances (44 vCPUs, 3232 GiB RAM) to match the memory requirements without risking out-of-memory errors, and purchase a Compute Savings Plan in the AWS Organizations management account.

Answer

Modify the EC2 launch template to use `r6g.xlarge` instances (44 vCPUs, 3232 GiB RAM) to match the memory requirements without risking out-of-memory errors, and purchase a Compute Savings Plan in the AWS Organizations management account.
The correct answer optimizes compute costs by switching to the memory-optimized `r6g.xlarge` instance type, which matches the resource utilization profile (3.23.2 vCPUs peak, 27.227.2 GiB RAM peak) without causing out-of-memory errors. The Compute Savings Plan is the correct vehicle because it dynamically applies discounts to EC2, Fargate, and Lambda across the entire Organization structure.

Step-by-Step Solution

1
Analyze EC2 resource utilization metrics to identify constraints.
Peak CPU demand is 40%40\% of 88 vCPUs = 3.23.2 vCPUs. Peak memory demand is 85%85\% of 3232 GiB = 27.227.2 GiB.
Determines the minimum vCPU and memory thresholds required to avoid application performance degradation or out-of-memory failures.
2
Evaluate target instance types for right-sizing.
`r6g.xlarge` provides 44 vCPUs (covering the 3.23.2 vCPUs peak) and 3232 GiB RAM (covering the 27.227.2 GiB peak), whereas `m6g.xlarge` only provides 1616 GiB RAM and would crash.
Allows downsizing compute capacity to match actual workload demands while respecting memory constraints.
3
Select the appropriate Savings Plan type for the multi-account heterogeneous workload.
A Compute Savings Plan covers EC2, Fargate, and Lambda across all accounts in the AWS Organization when purchased from the management account.
Ensures that all components of the containerized, serverless, and virtual machine architecture receive discount coverage, unlike EC2 Instance Savings Plans.

Key Concept

Memory-constrained right-sizing and Compute Savings Plans application in multi-account environments
Estimated Time:3m 0s
Question 1314Question →

An enterprise is strengthening its network security posture across a multi-account AWS environment. The infrastructure consists of an on-premises datacenter connected via AWS Direct Connect to an AWS Transit Gateway. Multiple VPCs (Production, Development, and Shared Services) are attached to the Transit Gateway. The enterprise has a Route 53 Private Hosted Zone (PHZ) for `aws.corp.internal` created in the Shared Services account and associated with the Shared Services VPC. The security team requires that all VPCs must be able to resolve `aws.corp.internal` and on-premises resources must also resolve `aws.corp.internal`. Additionally, all VPCs must resolve the on-premises domain `onprem.corp.internal`. How should the Solutions Architect configure the DNS architecture to meet these requirements securely?

Show answer & explanation

Answer: In the Shared Services VPC, create a Route 53 Resolver Inbound Endpoint and a Route 53 Resolver Outbound Endpoint. Associate the `aws.corp.internal` PHZ with all VPCs in the organization. Create a Route 53 Resolver forwarding rule for `onprem.corp.internal` pointing to the on-premises DNS servers, associate this rule with all VPCs in the organization, and configure the on-premises DNS servers to forward queries for `aws.corp.internal` to the Inbound Endpoint IP addresses.

Answer

In the Shared Services VPC, create a Route 53 Resolver Inbound Endpoint and a Route 53 Resolver Outbound Endpoint. Associate the `aws.corp.internal` PHZ with all VPCs in the organization. Create a Route 53 Resolver forwarding rule for `onprem.corp.internal` pointing to the on-premises DNS servers, associate this rule with all VPCs in the organization, and configure the on-premises DNS servers to forward queries for `aws.corp.internal` to the Inbound Endpoint IP addresses.
The correct solution uses Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC to bridge DNS resolution between AWS and on-premises networks. By associating the Private Hosted Zone with all consuming VPCs, queries within AWS resolve locally. The Resolver forwarding rule for the on-premises domain is shared and associated with all VPCs, ensuring outbound DNS requests reach the on-premises DNS servers. On-premises DNS servers forward queries for the AWS domain to the Inbound Endpoint IPs.

Step-by-Step Solution

1
Associate the Route 53 Private Hosted Zone (`aws.corp.internal`) with the Production, Development, and Shared Services VPCs.
Enables local resolution of the hosted zone inside each AWS VPC via the standard VPC resolver.
Route 53 Hosted Zones are only queryable from VPCs that are explicitly associated with them.
2
Create a Route 53 Resolver Inbound Endpoint in the Shared Services VPC.
Provides static IP addresses inside the VPC that can receive DNS queries from on-premises over Direct Connect.
Allows on-premises DNS forwarders to query AWS Private Hosted Zones.
3
Create a Route 53 Resolver Outbound Endpoint in the Shared Services VPC and a Resolver Forwarding Rule for `onprem.corp.internal`.
Enables forwarding DNS queries targeted at the on-premises domain to the on-premises DNS server IPs.
Allows resource instances inside AWS VPCs to resolve on-premises hostnames.
4
Associate the Resolver Forwarding Rule with all the VPCs in the organization.
Ensures that queries from any VPC for `onprem.corp.internal` are sent through the Outbound Endpoint.
Enables consistent cross-premises name resolution across the entire multi-account network.

Key Concept

Hybrid DNS resolution and multi-VPC Private Hosted Zone association.
Question 1315Question →

A logistics company manages a multi-account environment using AWS Organizations. The central Operations team must enforce a security patch compliance baseline across all Amazon EC2 instances in all member accounts. The patches must be installed during weekly maintenance windows using AWS Systems Manager Patch Manager. The Operations team wants to:

1. Aggregate patch compliance data from all member accounts into a central Amazon S3 bucket in a Security account.
2. Automate the quarantine of any EC2 instance that is flagged as non-compliant by changing its attached security group.
3. Secure the S3 bucket using encryption with a Customer Managed Key (CMK) stored in the Security account, while preventing local administrators in member accounts from altering the Patch Manager configuration.

Which combination of actions will meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create an AWS Systems Manager Resource Data Sync in each member account to aggregate compliance and inventory data into the central Amazon S3 bucket. Configure the KMS Customer Managed Key (CMK) policy in the Security account to grant kms:GenerateDataKey* and kms:Decrypt permissions to the member account IAM roles.; Deploy an AWS Config organizational rule to evaluate patch compliance across all accounts. Associate the rule with an AWS Systems Manager Automation runbook that removes existing security groups and applies a restrictive quarantine security group to instances identified as non-compliant.

Answer

The correct combination of actions is to configure Systems Manager Resource Data Sync using a Customer Managed Key (CMK) in the Security account with cross-account access, and deploy an AWS Config organizational rule associated with an Systems Manager Automation runbook for quarantine remediation.
The solution requires configuring Systems Manager Resource Data Sync in member accounts, which aggregates compliance information into a centralized S3 bucket. Because cross-account access is required, a KMS Customer Managed Key (CMK) must be configured in the Security account with a key policy allowing access to the member accounts. To automate quarantining non-compliant instances, an AWS Config organizational rule evaluates patch compliance and uses an SSM Automation runbook as remediation to replace the instance's security groups with a quarantine security group.

Step-by-Step Solution

1
Set up centralized data aggregation using Systems Manager Resource Data Sync.
Aggregated patch compliance and inventory data are sent from member accounts to a central S3 bucket.
Resource Data Sync is the native mechanism to aggregate Systems Manager compliance data from multiple accounts into a single S3 bucket.
2
Configure a KMS Customer Managed Key (CMK) for cross-account S3 encryption.
Member accounts can successfully write encrypted inventory files to the central S3 bucket.
AWS-managed KMS keys cannot be shared cross-account, so a CMK is required with key policy permissions granted to the member accounts.
3
Deploy an AWS Config organizational rule with an SSM Automation remediation target.
Non-compliant instances are detected and automatically isolated using a quarantine security group.
AWS Config evaluates compliance and natively supports triggering SSM Automation runbooks to modify security groups on non-compliant resources.

Key Concept

Multi-account configuration management, patch compliance aggregation, and automated remediation using AWS Systems Manager and AWS Config.
Question 1316Question →

An enterprise is planning to migrate a critical media management platform to AWS within a tight 3-month timeline. The platform consists of the following components:

1. DRM Licensing Engine: Runs on Windows Server 2012 R2. It uses a proprietary hardware-bound licensing mechanism requiring specific kernel-level driver access and physical motherboard signatures that cannot be virtualized or emulated on cloud hypervisors.
2. Video Encoding System: A resource-intensive custom C++ application that processes raw video streams using GPU acceleration. The enterprise plans to modernize this to a serverless architecture using AWS Elemental MediaConvert and AWS Lambda in the future, but current resource constraints prevent any code changes or refactoring during the 3-month migration phase.
3. Metadata Catalog: Runs on a highly customized on-premises Microsoft SQL Server database. It utilizes proprietary SQL Server Common Language Runtime (CLR) integration and extensive SQL Server Integration Services (SSIS) packages for data processing. The business wants to migrate this catalog to Amazon Aurora PostgreSQL to eliminate commercial licensing costs and reduce administrative overhead, which requires complete schema conversion and rewriting of the CLR/SSIS logic.
4. Web Frontend: A stateless Node.js application running on Ubuntu VMs. The enterprise wants to migrate this component to AWS to minimize operating system management overhead, but they must keep the application code unchanged.

Which combination of migration strategies represents the most appropriate path for each component to meet the enterprise's requirements and timeline?

Show answer & explanation

Answer: Retain the DRM Licensing Engine on-premises; Rehost the Video Encoding System to GPU-enabled Amazon EC2 instances; Refactor the Metadata Catalog by converting the database engine to Amazon Aurora PostgreSQL, converting the schema, and rewriting CLR and SSIS logic; Replatform the Web Frontend by containerizing it to run on Amazon ECS with AWS Fargate.

Answer

Retain the DRM Licensing Engine on-premises; Rehost the Video Encoding System to GPU-enabled Amazon EC2 instances; Refactor the Metadata Catalog by converting the database engine to Amazon Aurora PostgreSQL, converting the schema, and rewriting CLR and SSIS logic; Replatform the Web Frontend by containerizing it to run on Amazon ECS with AWS Fargate.
The correct strategy matches the technical constraints. The DRM Licensing Engine must be retained because its hardware-bound license cannot be virtualized. The Video Encoding System must be rehosted due to the 3-month window and lack of development resources. The Metadata Catalog requires database engine conversion and code rewrite (CLR/SSIS), classifying it as Refactor. The Web Frontend can be containerized and run on Fargate, which is Replatform.

Step-by-Step Solution

1
Analyze the DRM Licensing Engine constraints.
The DRM licensing engine requires physical hardware bindings (motherboard signatures) and kernel-level drivers that are incompatible with cloud virtualization or emulation, meaning it cannot be migrated to AWS.
Since the DRM system cannot run on AWS, the only viable option is to keep it on-premises, which maps to the Retain migration strategy.
2
Evaluate the Video Encoding System requirements and limitations.
Although a future serverless refactoring is desired, the immediate migration must be completed within 3 months with zero code changes or refactoring.
The system must be migrated as-is to GPU-enabled Amazon EC2 instances using the Rehost (lift-and-shift) strategy to meet the strict timeline constraint.
3
Determine the strategy for migrating the Metadata Catalog from SQL Server to Aurora PostgreSQL.
Migrating from SQL Server to Aurora PostgreSQL represents a heterogeneous database migration. This requires schema conversion and rewriting database logic (CLR and SSIS packages) to run on PostgreSQL.
Because this migration involves changing the database engine and making application/database code modifications, it represents the Refactor (Re-architect) strategy, not Replatforming.
4
Select the migration path for the Web Frontend.
The web frontend is a stateless Node.js application. Operating system management overhead can be minimized by containerizing the application and hosting it on Amazon ECS with AWS Fargate.
Because containerization optimizes the deployment model without changing the application's core code or architecture, this represents the Replatform (lift, tinker, and shift) strategy.

Key Concept

Selecting and distinguishing the AWS 7 Rs migration strategies (Retain, Rehost, Replatform, Refactor) based on technical dependencies, business goals, and timeline constraints.

Alternative Method

Utilize AWS Migration Evaluator or Cloud Migration Factory patterns to evaluate target dependencies. Hardware-bound licensing dependencies are a classic trigger for the Retain strategy, and heterogeneous database migrations involving engine switches and stored procedure/library rewrites are classified as Refactor/Re-architect.
Estimated Time:3m 0s
Question 1317Question →

A logistics company is planning to migrate its core application workload portfolio to AWS. The portfolio includes the following systems:

- A custom Python web application built on Django that runs on an on-premises Linux server. The deployment team wants to migrate the application to AWS Elastic Beanstalk to reduce server management overhead without making any modifications to the core Django application code.
- A PostgreSQL 11 database instance running on a self-managed Windows Server virtual machine. The database stores shipping transaction records. The company wants to migrate this database to Amazon Aurora PostgreSQL-Compatible Edition to leverage automated backups and scaling while keeping the schema intact.
- An on-premises proprietary customer relationship management (CRM) platform. The company has decided to replace this system entirely by migrating user records to a subscription-based SaaS CRM platform.

Which combination of migration strategies represents the correct alignment with the AWS 7 Rs framework for these workloads?

Show answer & explanation

Answer: Python web application: Replatform; Transaction database: Replatform; CRM platform: Repurchase

Answer

The correct strategy is to use Replatform for the Python web application, Replatform for the transaction database, and Repurchase for the customer relationship management (CRM) platform.
The correct option correctly maps each application to the appropriate migration strategy. Moving the Django web application to AWS Elastic Beanstalk involves minor operational changes without code modification, which is a Replatform strategy. Similarly, migrating the PostgreSQL database to Amazon Aurora PostgreSQL is a Replatform strategy since it leverages a managed service while preserving the engine compatibility and schema. Finally, switching the proprietary CRM platform to a SaaS version is a Repurchase strategy, which matches the AWS 7 Rs definitions.

Step-by-Step Solution

1
Analyze the migration path for the Django web application.
Identified as Replatform.
Deploying the on-premises Django application to a managed platform like AWS Elastic Beanstalk without changing the application's core source code constitutes Replatforming (often called 'lift, tinker, and shift').
2
Analyze the migration path for the transaction database.
Identified as Replatform.
Moving the database from a self-managed virtual machine to a managed database service (Amazon Aurora PostgreSQL-Compatible Edition) without rewriting schemas or query code represents a Replatform strategy.
3
Analyze the migration path for the CRM platform.
Identified as Repurchase.
Decommissioning a proprietary, custom on-premises platform to purchase a license for a new commercial SaaS CRM platform represents a Repurchase strategy (often called 'drop and shop').

Key Concept

Identifying AWS 7 Rs migration strategies (specifically Replatform, Refactor, and Repurchase) based on technical, code, and operational constraints.
Estimated Time:1m 30s
Question 1318Question →

A smart home utility provider manages a platform on AWS where millions of smart meters report current power usage telemetry every 15 seconds. The telemetry updates are processed by an auto-scaled fleet of containerized ingestion microservices and written to an Amazon RDS for PostgreSQL DB instance. A customer-facing dashboard application displays real-time consumption statistics for users, resulting in high read queries.

During peak evening hours, the RDS DB instance experiences CPU utilization spikes up to 98% and database connection limits are frequently reached, leading to dropped telemetry writes and dashboard timeout errors. The dashboard requires the absolute latest consumption state with low latency, and this state must survive any infrastructure failover events.

Which of the following database and caching strategies should a Solutions Architect implement to improve database efficiency and resolve these performance issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Amazon RDS Proxy between the ingestion microservices and the RDS DB instance to pool and reuse database connections, minimizing the CPU overhead of connection management.; Implement an Amazon ElastiCache for Redis cluster with Multi-AZ replication and automatic failover enabled to store and serve the latest state of each meter, offloading the dashboard read queries.

Answer

The correct strategies are to deploy Amazon RDS Proxy to pool database connections, and implement an Amazon ElastiCache for Redis cluster with Multi-AZ replication to offload read queries.
Deploying Amazon RDS Proxy resolves the database connection limits and high CPU overhead by pooling connections. Implementing an Amazon ElastiCache for Redis cluster with Multi-AZ replication offloads the read traffic from the primary database while satisfying the requirement that cached data must survive Availability Zone failovers.

Step-by-Step Solution

1
Analyze the cause of the database connection exhaustion and high CPU utilization.
PostgreSQL processes connections using a process-per-connection model, which consumes significant CPU and memory when thousands of microservices connect concurrently.
Understanding the connection overhead helps identify that connection pooling is needed.
2
Evaluate the use of Amazon RDS Proxy for connection management.
RDS Proxy pools and shares connections, shielding the database from connection spikes and reducing CPU overhead.
RDS Proxy solves the connection limit issue without requiring changes to database scaling.
3
Address the high read volume from the dashboard using a cache.
By placing an in-memory cache in front of the database, the dashboard queries can bypass the database entirely for state retrieval.
Caching reduces read CPU load and improves dashboard query response times.
4
Select the correct caching engine based on high availability and durability requirements.
Amazon ElastiCache for Redis supports replication, Multi-AZ failover, and persistence, ensuring cached state survives infrastructure outages. Memcached does not support these features.
Choosing Redis satisfies the constraint that the latest state must survive failover events.

Key Concept

Connection pooling with Amazon RDS Proxy and high-availability caching with Amazon ElastiCache for Redis are key techniques for optimizing performance, scalability, and efficiency in database-driven architectures on AWS.
Estimated Time:3m 0s
Question 1319Question →

A financial transaction processing platform runs in the us-west-2 Region. The architecture consists of Amazon EC2 instances in private subnets that route outbound internet traffic through a single NAT Gateway in a public subnet to communicate with external payment gateways. The backend database is a single-region Amazon Aurora PostgreSQL Serverless v2 database cluster. Internal microservices resolve dependencies using a Route 53 Private Hosted Zone (PHZ) associated with the primary VPC.

The solutions architect must enhance the reliability of the current architecture and establish a disaster recovery (DR) solution in the us-east-1 Region with a target Recovery Time Objective (RTO) of 15 minutes and Recovery Point Objective (RPO) of 1 minute.

Which combination of steps should the solutions architect recommend to meet these objectives? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Convert the database cluster to an Amazon Aurora Global Database with a secondary cluster in the secondary Region, and use Amazon Route 53 Application Recovery Controller (Route 53 ARC) routing controls to initiate failover and promote the secondary cluster.; Deploy a NAT Gateway in each Availability Zone in the primary VPC, and update the route tables of each private subnet to direct outbound internet traffic to the local NAT Gateway in its respective zone.

Answer

The correct steps are to convert the database cluster to an Aurora Global Database with a secondary cluster in the secondary Region while utilizing Route 53 Application Recovery Controller for failover, and to deploy a NAT Gateway in each Availability Zone in the primary VPC for high availability.
To meet the 1-minute RPO, a replication mechanism with sub-second or near-zero latency is required. Converting the Aurora database to an Aurora Global Database provides sub-second cross-region replication. Combined with Route 53 ARC, it allows for failover coordination under 15 minutes RTO. Additionally, deploying a NAT Gateway in each Availability Zone in the primary VPC eliminates the single point of failure in the outbound internet access path, enhancing the reliability of the existing workload.

Step-by-Step Solution

1
Analyze the disaster recovery target parameters (RTO of 15 minutes and RPO of 1 minute).
Identify that data replication must be near-continuous, and restoration from periodic backups is insufficient.
An RPO of 1 minute requires sub-minute data replication capabilities, which are natively supported by Amazon Aurora Global Databases.
2
Evaluate the database replication and failover design.
Establish Aurora Global Database replication to the secondary Region and configure Route 53 ARC to orchestrate failover.
Route 53 ARC routing controls ensure reliable, automated or manual failover within the 15-minute RTO constraint.
3
Analyze the primary region outbound networking design.
Replace the single NAT Gateway with multi-AZ NAT Gateways, updating private subnet routing tables to use local gateways.
This eliminates a single point of failure in the outbound connection path, which is critical for enhancing overall application reliability.

Key Concept

Disaster Recovery pattern alignment based on RTO/RPO requirements, and enhancing single-region reliability by eliminating single points of failure in outbound network paths.
Question 1320Question →

An enterprise wants to improve the network and identity security posture for an existing multi-account architecture. Account A hosts an application running on Amazon EC2 instances in a private subnet within VPC-A. The application needs to communicate with a proprietary web service hosted in Account B behind an internal Application Load Balancer (ALB) in VPC-B. VPC-A and VPC-B are interconnected using AWS Transit Gateway. The application also needs to communicate with a public third-party REST API at api.partner.corp.

A solutions architect must meet the following security requirements:
- Prevent DNS tunneling exfiltration and restrict DNS resolution in VPC-A to only the internal domain of Account B (*.internal.corp) and the partner domain (api.partner.corp).
- Restrict network traffic between VPC-A and VPC-B such that only the EC2 instances in VPC-A can access the internal ALB in VPC-B, preventing any transitive traffic from other VPCs connected to the Transit Gateway.
- Enforce that the EC2 instances in VPC-A can only call the external partner API, blocking all other outbound HTTP/HTTPS internet traffic from VPC-A.

Which of the following actions should the Solutions Architect take to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a Route 53 Resolver DNS Firewall rule group with a rule to allow domain names matching *.internal.corp and api.partner.corp, followed by a rule to block all other domains, and associate this rule group with VPC-A. Implement an AWS Network Firewall firewall in VPC-A and route outbound internet traffic through it, configuring a stateful rule group that allows HTTP/HTTPS traffic targeting api.partner.corp while blocking all other outbound destinations.; In the security group attached to the internal ALB in VPC-B, allow inbound traffic only from the specific private IP addresses of the EC2 instances in VPC-A. In the Transit Gateway route tables, associate the VPC-A attachment with a route table containing a route to VPC-B, and associate the VPC-B attachment with a route table that contains a route to VPC-A but has no routes or propagation configurations to other VPCs.

Answer

Configure a Route 53 Resolver DNS Firewall rule group to allow only specific domains and drop all others, while routing outbound HTTP/HTTPS traffic through AWS Network Firewall configured to permit api.partner.corp. Simultaneously, limit Transit Gateway routing propagation and restrict VPC-B's ALB security group to allow inbound traffic only from the EC2 instances in VPC-A.
To satisfy the requirements, the solutions architect must configure a Route 53 Resolver DNS Firewall rule group to allow only specific domains (*.internal.corp and api.partner.corp) and block all others, which blocks DNS exfiltration and tunneling. To filter egress web traffic, AWS Network Firewall must be used to inspect HTTP/HTTPS traffic to the partner API. For network isolation, Transit Gateway route tables must be configured to allow direct routing between VPC-A and VPC-B without propagating routes to other VPCs, and the target ALB's security group must explicitly whitelist the source EC2 instances' private IPs.

Step-by-Step Solution

1
Implement Route 53 Resolver DNS Firewall in VPC-A.
DNS queries from VPC-A are restricted to the allowed domains (*.internal.corp and api.partner.corp), preventing DNS tunneling or exfiltration to unauthorized domains.
DNS Firewall evaluates DNS queries originating from the VPC and blocks queries to unapproved domains.
2
Deploy AWS Network Firewall in VPC-A and route outbound internet traffic through it.
Only HTTP/HTTPS traffic targeting api.partner.corp is allowed to egress VPC-A, while all other outbound internet traffic is blocked.
Network Firewall provides stateful domain list filtering for HTTP/HTTPS protocols, which cannot be achieved with security groups alone.
3
Configure Transit Gateway routing and update the destination ALB's security groups.
VPC-A and VPC-B can communicate with each other, but transitive routing from or to other VPCs is prevented. Only the private IPs of the application EC2 instances in VPC-A can access the internal ALB in VPC-B.
By isolating Transit Gateway route tables and locking down the ALB security group, network access is restricted to the minimum required path, preventing unauthorized lateral movement.

Key Concept

Continuous security improvement through DNS query filtering, outbound web inspection, and strict routing segregation.
PreviousPage 66 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin