All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A company is reviewing the security configuration of an existing hybrid application. The application runs on physical servers in an on-premises data center and connects to AWS over an AWS Direct Connect connection. Currently, the on-premises servers retrieve database credentials from AWS Secrets Manager and upload backup files to an Amazon S3 bucket. Authentication is handled using long-term IAM user access keys stored locally in configuration files, and all API calls traverse the public internet. A Solutions Architect must strengthen the security posture by implementing passwordless authentication for the servers and ensuring that all network traffic to AWS services remains private and does not traverse the public internet.

Which two actions should the Solutions Architect take to meet these requirements?

Select all that apply

Configure AWS IAM Roles Anywhere by establishing a trust anchor with the on-premises Private Certificate Authority (CA) and creating a role profile, and install the IAM Roles Anywhere credential helper on the on-premises servers to exchange X.509 certificates for short-lived IAM session credentials.

Create Interface VPC Endpoints for Amazon S3 and AWS Secrets Manager in the VPC, and configure Route 53 Resolver inbound endpoints to allow the on-premises DNS servers to resolve the AWS service endpoints to the private IP addresses of the interface endpoints.

Configure AWS IAM Identity Center and set up a SAML 2.0 federated trust relationship, and run a scheduled cron job on the on-premises servers to execute the aws sso login command non-interactively using saved user credentials to retrieve temporary credentials daily.

Create Gateway VPC Endpoints for Amazon S3 and AWS Secrets Manager in the VPC, and update the on-premises route tables to route all traffic for these services directly to the Gateway Endpoint IP addresses over a Private Virtual Interface.

Enable AWS KMS encryption for the Secrets Manager secrets using the default AWS managed key (aws/secretsmanager), and modify the KMS key policy to delegate decryption permissions to the IAM entities representing the on-premises servers.

Show answer & explanation

Answer: Configure AWS IAM Roles Anywhere by establishing a trust anchor with the on-premises Private Certificate Authority (CA) and creating a role profile, and install the IAM Roles Anywhere credential helper on the on-premises servers to exchange X.509 certificates for short-lived IAM session credentials.; Create Interface VPC Endpoints for Amazon S3 and AWS Secrets Manager in the VPC, and configure Route 53 Resolver inbound endpoints to allow the on-premises DNS servers to resolve the AWS service endpoints to the private IP addresses of the interface endpoints.

Answer

The correct actions are to configure AWS IAM Roles Anywhere with a trust anchor pointing to the on-premises Private CA and install the credential helper on the servers, and to create Interface VPC Endpoints for Amazon S3 and AWS Secrets Manager combined with Route 53 Resolver inbound endpoints.

Establishing a trust anchor using AWS IAM Roles Anywhere enables secure certificate-based authentication for on-premises systems, removing the risks associated with long-term IAM access keys. Furthermore, deploying Interface VPC Endpoints for S3 and Secrets Manager coupled with Route 53 Resolver inbound endpoints guarantees that all API requests route privately over the AWS Direct Connect path, satisfying the requirements for private network paths.

Step-by-Step Solution

Configure AWS IAM Roles Anywhere with a trust anchor pointing to the on-premises Private CA and map it to a role profile.

On-premises servers can exchange their X.509 digital certificates for short-lived, temporary IAM credentials.

This removes the need for storing long-term IAM access keys on on-premises physical hardware, satisfying the passwordless requirement.

Create Interface VPC Endpoints for both Amazon S3 and AWS Secrets Manager inside the target VPC.

Elastic Network Interfaces (ENIs) with private IP addresses are provisioned in the VPC subnets for S3 and Secrets Manager.

Interface VPC Endpoints (AWS PrivateLink) allow network traffic to traverse AWS Direct Connect privately from on-premises environments.

Deploy Route 53 Resolver inbound endpoints and configure the on-premises DNS forwarding rules.

DNS requests for S3 and Secrets Manager from the on-premises servers are forwarded to the inbound endpoints, resolving to the private interface endpoint IPs.

This ensures DNS resolution resolves the services to the private IPs instead of public IP addresses, maintaining a private network path.

Key Concept

Securing hybrid architectures by establishing passwordless identity verification using AWS IAM Roles Anywhere and setting up private network connectivity via Interface VPC Endpoints and Route 53 Resolver inbound endpoints.

Estimated Time:3m 0s

Question 1322Question →

An enterprise is strengthening the security posture of an existing data processing platform. The platform runs on Amazon EC2 instances in a private subnet of VPC-A in Account A. The instances must read large, sensitive datasets from an Amazon S3 bucket in Account B. The S3 bucket is encrypted using an AWS Key Management Service (AWS KMS) customer managed key (CMK) in Account B.

The security architect must enforce the following security requirements:
1. All data transit between VPC-A and the S3 bucket must stay within the AWS network and must not traverse the public internet.
2. The S3 bucket must only accept requests that originate from the specific VPC endpoint created in VPC-A for S3.
3. Access to the S3 bucket and the KMS key must be granted based on the principle of least privilege to the EC2 instances' IAM role in Account A.

Which combination of configurations will meet these security requirements?

In VPC-A, deploy an S3 Interface Endpoint with Private DNS enabled. Attach an endpoint policy to it that allows the IAM role in Account A to perform s3:GetObject on the bucket in Account B. In Account A, attach an IAM policy to the EC2 instances' role allowing s3:GetObject on the bucket in Account B and kms:Decrypt on the CMK in Account B. In Account B, configure the KMS key policy of the CMK to allow the IAM role in Account A to perform kms:Decrypt. Configure the S3 bucket policy to allow the IAM role in Account A to perform s3:GetObject only when the request condition aws:sourceVpce matches the ID of the S3 Interface Endpoint.

In VPC-A, deploy an S3 Interface Endpoint with Private DNS enabled. Attach an endpoint policy to it that allows the IAM role in Account A to perform s3:GetObject on the bucket in Account B. In Account A, attach an IAM policy to the EC2 instances' role allowing s3:GetObject on the bucket in Account B. In Account B, configure the S3 bucket default encryption to use the AWS managed key (aws/s3). Update the key policy of aws/s3 to allow the IAM role in Account A to perform kms:Decrypt. Configure the S3 bucket policy to allow the IAM role in Account A to perform s3:GetObject only when the request condition aws:sourceVpce matches the ID of the S3 Interface Endpoint.

Create a Service Control Policy (SCP) at the AWS Organizations root that explicitly allows the IAM role in Account A to perform s3:GetObject on the bucket in Account B and kms:Decrypt on the KMS key in Account B. In VPC-A, deploy an S3 Gateway Endpoint and associate it with the route tables of the private subnets. In Account B, configure the S3 bucket policy to allow the IAM role in Account A to perform s3:GetObject only when the request condition aws:sourceVpc matches the VPC ID of VPC-A.

In VPC-A, deploy an S3 Interface Endpoint and disable Private DNS. Create a Route 53 Private Hosted Zone for s3.us-east-1.amazonaws.com in Account B, associate it with VPC-A, and create an Alias record pointing to the DNS name of the VPC endpoint. In Account A, attach an IAM policy to the EC2 instances' role allowing s3:GetObject on the bucket in Account B and kms:Decrypt on the CMK in Account B. In Account B, configure the KMS key policy of the CMK to allow the S3 VPC Endpoint service principal (vpce.amazonaws.com) to perform kms:Decrypt. Configure the S3 bucket policy to allow the IAM role in Account A to perform s3:GetObject only when the request condition aws:sourceVpce matches the ID of the S3 Interface Endpoint.

Show answer & explanation

Answer: In VPC-A, deploy an S3 Interface Endpoint with Private DNS enabled. Attach an endpoint policy to it that allows the IAM role in Account A to perform s3:GetObject on the bucket in Account B. In Account A, attach an IAM policy to the EC2 instances' role allowing s3:GetObject on the bucket in Account B and kms:Decrypt on the CMK in Account B. In Account B, configure the KMS key policy of the CMK to allow the IAM role in Account A to perform kms:Decrypt. Configure the S3 bucket policy to allow the IAM role in Account A to perform s3:GetObject only when the request condition aws:sourceVpce matches the ID of the S3 Interface Endpoint.

Answer

Deploy an S3 Interface Endpoint with Private DNS enabled, and configure the local IAM policy, the target S3 bucket policy (conditioned on the VPC endpoint using aws:sourceVpce), the custom KMS key policy to trust the cross-account role, and the endpoint policy to allow access.

The correct configuration uses an S3 Interface Endpoint with Private DNS enabled to keep traffic internal. Cross-account access to KMS-encrypted objects requires a Customer Managed Key (CMK) because its key policy can be modified to grant the external IAM role decryption rights. The local IAM policy must allow the access, the S3 endpoint policy must permit the S3 actions, and the S3 bucket policy must restrict access to the specific VPC endpoint using the aws:sourceVpce condition to enforce that all traffic goes through the private endpoint.

Step-by-Step Solution

Analyze key configuration constraints for cross-account S3 access with KMS encryption.

Identify that the default AWS managed key (aws/s3) cannot be used for cross-account decryption because its key policy is immutable. A Customer Managed Key (CMK) in the destination account must be configured.

AWS-managed KMS keys do not support policy modifications, which are mandatory to trust an IAM principal from a different AWS account.

Determine the correct network routing and access control configuration.

Deploy an S3 Interface Endpoint (PrivateLink) with Private DNS enabled to ensure requests route privately within the AWS network. Apply an S3 bucket policy restricting requests to the specific VPC endpoint using the aws:sourceVpce condition.

This configuration satisfies the requirements to bypass the public internet and restrict S3 access strictly to the VPC endpoint rather than just the VPC ID.

Establish cross-account trust and authorization paths for both S3 and KMS.

Add decryption permissions to the IAM role in the source account, and update the KMS key policy in the target account to explicitly allow the source IAM role to decrypt. Update the S3 endpoint policy to allow the IAM role to access the target bucket.

For cross-account access, the IAM policy in the source account must authorize the action, and the resource policies (S3 bucket and KMS key policies) in the destination account must explicitly trust and authorize the source IAM principal.

Key Concept

Cross-account S3 and KMS access security via VPC endpoints using Customer Managed Keys.

Question 1323Question →

An enterprise wants to improve the security posture of an existing application running on Amazon EC2 instances in a private subnet of VPC A (Account A). The application needs to securely upload objects to an Amazon S3 bucket located in Account B. The objects in the S3 bucket must be encrypted at rest, and the encryption key must be managed securely with cross-account access. The network path to the S3 bucket must not traverse the public internet. Which two actions should the Solutions Architect take to meet these security requirements?

Select all that apply

Create a Customer Managed Key (CMK) in Account B, and configure its key policy to grant the EC2 IAM role in Account A permissions to perform KMS cryptographic operations.

Create an Amazon S3 Interface VPC Endpoint in VPC A, and update the S3 bucket policy in Account B to restrict access to requests originating from that specific VPC endpoint ID.

Configure default S3 bucket encryption in Account B using the AWS-managed KMS key for S3, and update its key policy to allow cross-account access for the IAM role in Account A.

Attach a Service Control Policy (SCP) to the Organizational Unit containing Account B to explicitly allow the EC2 IAM role in Account A to access the bucket, removing the need for a local IAM policy.

Create a Route 53 Private Hosted Zone in Account B for the S3 service, associate it with the VPC in Account A, and configure Route 53 Resolver rules to route S3 traffic.

Show answer & explanation

Answer: Create a Customer Managed Key (CMK) in Account B, and configure its key policy to grant the EC2 IAM role in Account A permissions to perform KMS cryptographic operations.; Create an Amazon S3 Interface VPC Endpoint in VPC A, and update the S3 bucket policy in Account B to restrict access to requests originating from that specific VPC endpoint ID.

Answer

To meet the requirements, the Solutions Architect must create a Customer Managed Key in Account B and grant cross-account permissions to the EC2 IAM role in Account A, and create an Amazon S3 Interface VPC Endpoint in VPC A while restricting Account B's bucket policy to requests originating from that VPC endpoint.

Creating a Customer Managed Key in Account B allows you to modify the key policy to permit the IAM role from Account A to perform cryptographic operations. Combining this with an Amazon S3 Interface VPC Endpoint in VPC A and restricting the bucket policy in Account B to that endpoint ID ensures that traffic remains private and only flows through the designated endpoint.

Step-by-Step Solution

Select the correct encryption key type.

Use a Customer Managed Key (CMK) in Account B instead of an AWS-managed key.

AWS-managed keys (like aws/s3) cannot have their policies modified and therefore do not support cross-account access.

Configure the key policy for cross-account access.

Add a statement to the CMK key policy in Account B that allows the EC2 IAM role in Account A to use the key.

Cross-account KMS access requires permissions on both the KMS key policy (key owner) and the IAM policy (user owner).

Configure private network connectivity to S3.

Provision an Amazon S3 Interface VPC Endpoint in VPC A.

This establishes a private network path via AWS PrivateLink so that traffic does not traverse the public internet.

Enforce the private path in the bucket policy.

Modify the S3 bucket policy in Account B to deny requests that do not specify the correct VPC endpoint ID in the condition block.

This guarantees that all write operations must traverse the interface endpoint, preventing access from unauthorized public or private networks.

Key Concept

Cross-account KMS and S3 private connectivity using VPC endpoints.

Estimated Time:2m 0s

Question 1324Question →

A financial institution is designing a new global OLTP platform to process trades across a primary region ( $us-east-1$ ) and a secondary recovery region ( $eu-west-1$ ). The architecture must support database writes with a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Microsecond-latency read caching is required locally in both regions. Security compliance dictates that all data at rest must be encrypted using customer-managed keys (CMKs) to enable cross-account access for centralized auditing. Additionally, the system must dynamically scale read capacity in the secondary region during sudden traffic spikes without manual intervention. Which two actions should the solutions architect take to meet these database and storage requirements?

Select all that apply

Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region, encrypting both clusters with region-specific KMS Customer Managed Keys, and configure Aurora Auto Scaling on Replicas in the secondary region.

Deploy an Amazon ElastiCache for Redis Global Datastore with the primary cluster in the primary region and a secondary cluster in the secondary region to provide local microsecond-latency caching.

Deploy an Amazon Aurora PostgreSQL Global Database using the default AWS-managed KMS key (aws/rds) to encrypt the clusters, and create a cross-account IAM policy to grant key access to the centralized auditing account.

Configure Amazon RDS PostgreSQL Multi-AZ standby instances in the secondary region to serve as the read-scaling endpoints during traffic spikes by modifying the DB parameter group.

Deploy Amazon ElastiCache for Memcached in a multi-region cluster configuration to cache query results with global data replication.

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region, encrypting both clusters with region-specific KMS Customer Managed Keys, and configure Aurora Auto Scaling on Replicas in the secondary region.; Deploy an Amazon ElastiCache for Redis Global Datastore with the primary cluster in the primary region and a secondary cluster in the secondary region to provide local microsecond-latency caching.

Answer

Deploy an Amazon Aurora PostgreSQL Global Database using region-specific Customer Managed Keys (CMKs) with Auto Scaling configured on the secondary replicas, and deploy an Amazon ElastiCache for Redis Global Datastore for multi-region microsecond read caching.

The correct architecture requires a combination of Amazon Aurora PostgreSQL Global Database (using Customer Managed Keys for cross-account compliance and Aurora Replicas for dynamic read scaling) and Amazon ElastiCache for Redis Global Datastore (for local microsecond-latency caching across regions). This setup meets all performance, HA/DR, security, and scalability requirements.

Step-by-Step Solution

Select the database engine that meets the global transaction and recovery constraints.

Amazon Aurora Global Database is chosen because it replicates data with a typical latency of less than 1 second, fulfilling the RPO (< 5 seconds) and RTO (< 1 minute) parameters.

Standard multi-region RDS read replicas do not offer the same low-latency replication or rapid failover capabilities as Aurora Global Databases.

Determine the correct KMS encryption key type for cross-account compliance.

Customer Managed Keys (CMKs) must be configured in each region for the Aurora cluster.

AWS-managed KMS keys cannot have their key policies edited, preventing cross-account access delegation to the security/audit account.

Establish the global caching layer.

Amazon ElastiCache for Redis Global Datastore is deployed across both regions.

ElastiCache for Redis supports cross-region replication and provides local, microsecond-latency reads, whereas Memcached lacks replication and global datastore functionality.

Configure scaling policies for the database read tier.

Aurora Auto Scaling is enabled on the Replicas in the secondary region.

This automatically scales the number of Aurora Replicas up or down based on CPU utilization or average connections, whereas Multi-AZ standby instances cannot serve read traffic or scale dynamically.

Key Concept

Designing multi-region database and storage architectures with strict RTO/RPO limits, microsecond caching requirements, custom encryption key policies, and dynamic read scaling.

Question 1325Question →

An enterprise is planning to migrate its core billing and reporting platform to AWS. The platform consists of three main components:

1. A legacy financial reporting application that runs on an on-premises IBM AIX server. The application is licensed via a CPU-ID node-lock mechanism and is scheduled to be decommissioned in 10 months when a new SaaS-based reporting service is launched.
2. A monolithic billing web application written in Java and running on Apache Tomcat on Windows Server 2016. To minimize operating system licensing costs and administrative overhead, the enterprise wants to run this workload on a managed container platform without altering the application's Java source code.
3. A Microsoft SQL Server database containing transactional billing data. The enterprise wants to migrate this database to Amazon Aurora PostgreSQL to avoid database licensing fees. Preliminary analysis with the AWS Schema Conversion Tool (SCT) indicates that all stored procedures must be rewritten to match PostgreSQL syntax. The migration must be completed within a maximum scheduled downtime window of 2 hours.

Which of the following migration paths represent the correct classifications for these components under the 7 Rs migration framework? (Select TWO.)

Select all that apply

Retain the legacy financial reporting application on-premises.

Replatform the billing web application by containerizing it to run on Amazon ECS with AWS Fargate.

Replatform the transactional database by migrating Microsoft SQL Server to Amazon Aurora PostgreSQL.

Rehost the legacy financial reporting application on Amazon EC2 Dedicated Hosts.

Refactor the billing web application by rewriting its functionality as AWS Lambda functions.

Show answer & explanation

Answer: Retain the legacy financial reporting application on-premises.; Replatform the billing web application by containerizing it to run on Amazon ECS with AWS Fargate.

Answer

The correct strategies are to retain the legacy financial reporting application on-premises and to replatform the billing web application by containerizing it to run on Amazon ECS with AWS Fargate.

Retaining the legacy financial reporting application on-premises is correct because the system is on IBM AIX (which cannot be easily rehosted on EC2) and is being decommissioned in 10 months, making a migration project wasteful. Replatforming the billing web application by containerizing it for Amazon ECS with AWS Fargate is correct because it avoids Windows OS licensing fees and reduces administration through Fargate without requiring Java code modifications.

Step-by-Step Solution

Assess the legacy financial reporting application against migration constraints.

Since the application runs on IBM AIX (which is not natively supported on EC2), is locked to CPU-ID licensing, and is scheduled to be retired in 10 months, migrating it is unviable.

This establishes that the correct migration strategy is to Retain the workload on-premises to avoid wasted migration effort.

Assess the billing web application against the architectural goals.

The application needs to run on a managed container service to minimize overhead and OS licensing costs, without modifying the source code. Moving from Tomcat/Windows to Tomcat/Linux containers on ECS/Fargate fits this description.

This qualifies as a Replatform strategy, optimizing the environment without modifying core code.

Assess the transactional database migration path.

The target engine is Aurora PostgreSQL, which differs from the source SQL Server database and requires stored procedure rewrites.

A database engine migration requiring database-level code and schema modifications is a Refactor strategy, which excludes the option that classifies it as Replatform.

Key Concept

Selecting the correct migration strategy (7 Rs) by aligning application constraints, operating system compatibility, licensing, and retirement timelines with migration costs and effort.

Question 1326Question →

A solutions architect is migrating an on-premises Microsoft SQL Server database to Amazon RDS for PostgreSQL using the AWS Schema Conversion Tool (SCT) and the AWS Database Migration Service (DMS). The migration strategy requires minimal downtime, so the architect configures a DMS replication task with full load and ongoing replication (Change Data Capture). The full load phase completes successfully, and all initial data is copied to the target database. However, the task immediately fails and halts when attempting to replicate subsequent transactional updates. What is the most likely cause of this replication failure?

The target Amazon RDS for PostgreSQL database parameter group does not have the rds.logical_replication parameter set to 1.

The AWS Schema Conversion Tool (SCT) agent has not been deployed on the target database instance to dynamically convert the incoming T-SQL transaction logs into PL/pgSQL during the replication phase.

The source Microsoft SQL Server database does not have MS-CDC or MS-Replication enabled, and the SQL Server Agent is not running on the source host.

The DMS replication task target endpoint has supplemental logging enabled, preventing PostgreSQL from writing incoming changes to its Write-Ahead Log (WAL).

Show answer & explanation

Answer: The source Microsoft SQL Server database does not have MS-CDC or MS-Replication enabled, and the SQL Server Agent is not running on the source host.

Answer

The source Microsoft SQL Server database does not have MS-CDC or MS-Replication enabled, and the SQL Server Agent is not running on the source host.

The correct answer is that the source Microsoft SQL Server database does not have MS-CDC or MS-Replication enabled, or the SQL Server Agent service is not running. AWS DMS requires these source-side database configurations to parse transaction logs and capture ongoing changes. Because the full load phase completed successfully, basic network connectivity and table structures are verified, leaving the lack of CDC setup on the source as the primary cause of the replication failure.

Step-by-Step Solution

Analyze the migration failure phase.

The full load phase completed successfully, meaning network connectivity, credentials, and initial schema application are correct, but the ongoing replication (CDC) phase failed immediately.

This isolates the issue specifically to AWS DMS's ability to read changes from the source database transaction logs.

Identify the source database requirements for AWS DMS Change Data Capture (CDC).

For Microsoft SQL Server sources, AWS DMS requires either MS-CDC (Change Data Capture) or MS-Replication to be enabled, and the SQL Server Agent service must be active to track and log transactional changes.

Without these configurations, SQL Server does not log the transaction changes in a format that AWS DMS can consume, causing the CDC phase to fail.

Key Concept

AWS DMS requires source-specific logging configurations (such as MS-CDC for SQL Server, binlogs for MySQL, or supplemental logging for Oracle) to support ongoing replication (Change Data Capture).

Estimated Time:2m 0s

Question 1327Question →

An enterprise manages two AWS accounts within an organization in AWS Organizations with consolidated billing enabled:

- Account A runs a microservices application utilizing AWS Fargate tasks and AWS Lambda functions to process bursty, unpredictable customer requests. It also runs a production Amazon RDS for MySQL database. The database CPU utilization averages $12\%$ over a $30\text{-day}$ period, while its database buffer pool usage remains constant at $85\%$ .
- Account B runs a legacy backend service on a steady-state fleet of Amazon EC2 `m6i.2xlarge` instances ( $8\text{ vCPUs}$ , $32\text{ GiB}$ memory) in an Auto Scaling group across three Availability Zones. Average CPU utilization is $38\%$ and memory utilization is $28\%$ . Outbound traffic for these instances is routed through a single NAT Gateway in one Availability Zone to minimize gateway hour costs.

The enterprise wants to optimize its resource costs and sizing while maintaining strict high availability, application performance, and minimizing operational overhead.

Which two recommendations should a solutions architect make to achieve these goals?

Select all that apply

Purchase Compute Savings Plans in the AWS Organizations management account to automatically apply discounts to the EC2 instances, Fargate tasks, and Lambda functions across all member accounts.

Modify the EC2 Auto Scaling group launch template in Account B to use `m6i.xlarge` instances (

4\text{ vCPUs}

16\text{ GiB}

memory), and adjust the scaling policies based on CPU utilization.

Purchase EC2 Instance Savings Plans at the management account level to cover the EC2 instances, and count on them to automatically apply to the Fargate tasks and Lambda functions in Account A.

Use AWS Resource Access Manager (RAM) to share the Savings Plans purchased in the management account with Account A and Account B to enable discount sharing across the organization.

Retain the single NAT Gateway routing configuration in Account B to minimize NAT Gateway hourly fees, as routing outbound traffic across Availability Zones to a single gateway is the most cost-optimal high-availability design.

Show answer & explanation

Answer: Purchase Compute Savings Plans in the AWS Organizations management account to automatically apply discounts to the EC2 instances, Fargate tasks, and Lambda functions across all member accounts.; Modify the EC2 Auto Scaling group launch template in Account B to use `m6i.xlarge` instances ( $4\text{ vCPUs}$ , $16\text{ GiB}$ memory), and adjust the scaling policies based on CPU utilization.

Answer

The correct recommendations are to purchase Compute Savings Plans in the management account and to modify the EC2 Auto Scaling group launch template to use smaller instances.

Purchasing Compute Savings Plans in the AWS Organizations management account ensures that discounts are applied to EC2, Fargate, and Lambda workloads across all member accounts through consolidated billing. Modifying the EC2 Auto Scaling group to use `m6i.xlarge` instances is an appropriate right-sizing action because it halves the allocated compute and memory, which fits within the current underutilized metrics (

38\%

CPU and

28\\%

memory) without affecting performance.

Step-by-Step Solution

Analyze the compute requirements of both accounts and identify the correct Savings Plan type.

Account A uses Fargate and Lambda, while Account B uses EC2. Since EC2 Instance Savings Plans do not apply to Fargate and Lambda, Compute Savings Plans must be purchased to cover all three resource types.

Compute Savings Plans provide the broadest applicability, covering EC2, Fargate, and Lambda across all member accounts under consolidated billing.

Analyze the utilization metrics of the EC2 instances in Account B to identify right-sizing opportunities.

The current instances are `m6i.2xlarge` (

8\text{ vCPUs}

32\text{ GiB}

) with

38\%

CPU and

28\\%

memory utilization. Downsizing to `m6i.xlarge` (

4\text{ vCPUs}

16\text{ GiB}

) will double the utilization metrics to approximately

76\%

CPU and

56\\%

memory.

This right-sizing action is safe, keeps resources within safe utilization thresholds, and cuts instance costs by

50\%

Evaluate the database metrics for sizing optimization.

The RDS for MySQL database has low CPU utilization (

12\%

) but high buffer pool usage (

85\%

, indicating high memory cache utilization). Downsizing it would reduce memory, causing cache misses and disk read bottlenecks.

The database should not be downsized, as its performance depends on the current memory size to cache active data.

Evaluate network configuration against the high availability constraint.

Relying on a single NAT Gateway across three Availability Zones introduces a single point of failure. Redundant NAT Gateways must be deployed in each Availability Zone to maintain strict high availability.

Strict high availability requirements override the cost savings of having only one NAT Gateway.

Key Concept

Cost optimization in a multi-account environment requires selecting the right type of Savings Plan to cover heterogeneous compute resources and right-sizing underutilized instances without degrading performance or violating high availability constraints.

Question 1328Question →

A logistics company utilizes a multi-account structure under AWS Organizations. Application workloads in various member accounts write sensitive delivery receipt logs to a centralized Amazon S3 bucket located in a dedicated Security account. The S3 bucket currently relies on Amazon S3 managed keys (SSE-S3) for default encryption. To comply with new industry regulations, the company must enforce encryption of all logs at rest using a customer-managed KMS key that is automatically rotated. Additionally, member accounts must only be permitted to encrypt objects during upload and must not have permission to decrypt the logs once written. What is the most secure configuration that achieves these requirements?

Create a customer-managed KMS key in the Security account and enable annual rotation. Update the KMS key policy to grant the member account IAM roles permissions for kms:GenerateDataKey and kms:DescribeKey only. Configure the centralized S3 bucket to use this KMS key for default encryption. Apply a Service Control Policy (SCP) to the member accounts that denies the s3:PutEncryptionConfiguration permission and blocks S3 uploads that do not use SSE-KMS encryption.

Configure the S3 bucket to use the AWS-managed KMS key for Amazon S3 (aws/s3) in the Security account. Authorize cross-account access by configuring an IAM policy in the member accounts that grants permissions for kms:GenerateDataKey on the Security account's AWS-managed key, and enforce SSE-KMS via an SCP.

Create a customer-managed KMS key in the Security account. Apply a Service Control Policy (SCP) to the member accounts that grants cross-account permissions for kms:GenerateDataKey and kms:DescribeKey on the Security account's KMS key, while denying kms:Decrypt. Configure the S3 bucket default encryption to use this KMS key.

Create a customer-managed KMS key in the Security account. Update the S3 bucket policy in the Security account to grant kms:GenerateDataKey and kms:DescribeKey permissions to the member account IAM roles. Configure the S3 bucket default encryption to use this KMS key, and apply an SCP to prevent member accounts from changing S3 default encryption settings.

Show answer & explanation

Answer: Create a customer-managed KMS key in the Security account and enable annual rotation. Update the KMS key policy to grant the member account IAM roles permissions for kms:GenerateDataKey and kms:DescribeKey only. Configure the centralized S3 bucket to use this KMS key for default encryption. Apply a Service Control Policy (SCP) to the member accounts that denies the s3:PutEncryptionConfiguration permission and blocks S3 uploads that do not use SSE-KMS encryption.

Answer

The correct option correctly leverages a customer-managed KMS key in the Security account, which allows key policies to be adjusted for cross-account access. Since the logs must only be written (encrypted) by the member accounts, granting them only kms:GenerateDataKey and kms:DescribeKey prevents them from decrypting the files once they are uploaded. Furthermore, using a Service Control Policy (SCP) at the Organization level ensures that individual account administrators cannot alter S3 bucket encryption configurations.

Step-by-Step Solution

Configure AWS KMS Key in Security Account

A Customer Managed Key (CMK) is created with automatic annual rotation enabled. The key policy is modified to allow the member account's IAM roles the ability to use the key for encryption (kms:GenerateDataKey and kms:DescribeKey) but not decryption.

AWS-managed keys cannot be shared across accounts, meaning a Customer Managed Key is required. Restricting decryption permissions enforces the security constraint.

Configure Centralized S3 Bucket Default Encryption

The target S3 bucket's default encryption is updated to use the newly created customer-managed KMS key.

This guarantees that any log files written to the bucket are automatically encrypted at rest using the specified compliance key.

Deploy Service Control Policy (SCP) Guardrails

An SCP is attached to the member accounts restricting s3:PutEncryptionConfiguration and enforcing SSE-KMS headers on uploads.

This prevents local administrators in member accounts from bypassing the compliance policy or changing default encryption settings on the S3 bucket.

Key Concept

Cross-account AWS KMS key sharing paired with S3 bucket default encryption and Service Control Policy guardrails.

Estimated Time:2m 30s

Question 1329Question →

An enterprise is designing a new multi-VPC AWS environment in the `us-west-2` Region. The architecture includes a shared services VPC (`vpc-shared-services`), two workload VPCs (`vpc-prod-app` and `vpc-stage-app`), and a centralized egress VPC (`vpc-egress`). The workloads are deployed across two Availability Zones. An AWS Transit Gateway (`tgw-core`) interconnects all VPCs. The enterprise must meet the following requirements:
1. Allow resources in all VPCs to resolve on-premises DNS hostnames ending in `.corp.internal`.
2. Allow on-premises servers to resolve AWS resources in a Route 53 Private Hosted Zone (PHZ) named `aws.corp.internal` that contains records for resources in the workload VPCs.
3. Provide outbound internet access for private subnets in the workload VPCs while minimizing NAT Gateway costs and maintaining High Availability (HA) across both Availability Zones.

Which configuration satisfies these requirements?

Deploy Route 53 Resolver Inbound and Outbound Endpoints in `vpc-shared-services` across two Availability Zones. Create a Resolver rule to forward `.corp.internal` queries to on-premises DNS servers. Associate the resolver rule and the `aws.corp.internal` Private Hosted Zone only with `vpc-shared-services`, relying on the Transit Gateway (`tgw-core`) to transitively forward Route 53 DNS queries from the workload VPCs. In `vpc-egress`, deploy one NAT Gateway in each of the two Availability Zones to handle outbound internet traffic.

Deploy Route 53 Resolver Inbound and Outbound Endpoints in `vpc-shared-services` across two Availability Zones. Create a Resolver rule to forward `.corp.internal` queries to on-premises DNS servers, and associate the rule and the `aws.corp.internal` Private Hosted Zone with all three workload and shared services VPCs. In `vpc-egress`, deploy a single NAT Gateway in one Availability Zone to minimize AWS resource costs, and update the Transit Gateway route tables to route all outbound internet traffic from both Availability Zones to this single NAT Gateway.

Deploy Route 53 Resolver Inbound and Outbound Endpoints in `vpc-shared-services` across two Availability Zones. Create a Resolver rule to forward `.corp.internal` queries to on-premises DNS servers, and associate the rule and the `aws.corp.internal` Private Hosted Zone with all three workload and shared services VPCs. In `vpc-egress`, deploy one NAT Gateway in each of the two Availability Zones. Configure the Transit Gateway route tables to route outbound internet traffic from the workload VPCs to `vpc-egress`, forwarding the traffic to the NAT Gateway in the same Availability Zone.

Deploy Route 53 Resolver Inbound and Outbound Endpoints in `vpc-shared-services` across two Availability Zones. Create a Resolver rule to forward `.corp.internal` queries to on-premises DNS servers, and associate the rule and the `aws.corp.internal` Private Hosted Zone with all three workload and shared services VPCs. Attach the workload VPCs and `vpc-egress` directly to an AWS Direct Connect Gateway (`dxgw-core`) using Virtual Private Gateways, and configure the Direct Connect Gateway to route outbound internet traffic transitively to the NAT Gateways in `vpc-egress` without using `tgw-core`.

Show answer & explanation

Answer: Deploy Route 53 Resolver Inbound and Outbound Endpoints in `vpc-shared-services` across two Availability Zones. Create a Resolver rule to forward `.corp.internal` queries to on-premises DNS servers, and associate the rule and the `aws.corp.internal` Private Hosted Zone with all three workload and shared services VPCs. In `vpc-egress`, deploy one NAT Gateway in each of the two Availability Zones. Configure the Transit Gateway route tables to route outbound internet traffic from the workload VPCs to `vpc-egress`, forwarding the traffic to the NAT Gateway in the same Availability Zone.

Answer

Deploy Route 53 Resolver Inbound and Outbound Endpoints across two Availability Zones in the shared services VPC, associate the private hosted zone and resolver rule with all VPCs, and deploy one NAT Gateway per Availability Zone in the centralized egress VPC using the Transit Gateway for cross-VPC routing.

The correct configuration deploys Route 53 Resolver inbound and outbound endpoints across two Availability Zones to ensure high availability and eliminate EC2 management overhead. Private Hosted Zones must be associated with every VPC from which DNS resolution is required because DNS queries to the Route 53 Resolver IP (

169.254.169.253

) are resolved locally within each VPC. For internet egress, deploying one NAT Gateway in each of the two Availability Zones in the centralized egress VPC maintains high availability and leverages Transit Gateway for cross-VPC routing.

Step-by-Step Solution

Configure bidirectional hybrid DNS resolution

Deploy Route 53 Resolver Inbound and Outbound Endpoints across two Availability Zones in `vpc-shared-services`, and associate the `aws.corp.internal` Private Hosted Zone with all three VPCs.

Enables DNS query exchange between the on-premises environment and AWS, and ensures that the workload VPCs can resolve the private hosted zone locally, since Route 53 DNS queries to the resolver IP (

169.254.169.253

) cannot be transitively routed.

Design high-availability centralized egress

Deploy one NAT Gateway in each of the two Availability Zones within the centralized egress VPC (`vpc-egress`). Configure Route Tables on the Transit Gateway (`tgw-core`) to forward outbound internet traffic from the workload VPCs to the egress VPC.

Provides a highly available path for outbound internet traffic across two Availability Zones while centralizing NAT Gateways to minimize costs, compared to deploying separate NAT Gateways in every workload VPC.

Key Concept

Multi-VPC hybrid routing, Route 53 Resolver endpoints, Private Hosted Zone association, and high-availability centralized egress design.

Estimated Time:2m 0s

Question 1330Question →

A healthcare enterprise is designing a multi-account AWS environment in the us-east-1 Region. The architecture contains three application VPCs: a management VPC (vpc-mgt-prod) in Account A, a portal VPC (vpc-portal-prod) in Account B, and a secure data-processing VPC (vpc-data-prod) in Account C. The enterprise has established a $10\text{ Gbps}$ AWS Direct Connect connection to its on-premises network via a Direct Connect Gateway (dxgw-hybrid-core).

The network design must adhere to the following requirements:
- Instances in vpc-portal-prod and vpc-data-prod must resolve domain names under a Private Hosted Zone (PHZ) named corp.internal hosted in Account A.
- All outbound internet traffic from vpc-portal-prod and vpc-data-prod must pass through a centralized egress VPC (vpc-egress-prod) that has security monitoring tools.
- Direct VPC-to-VPC communication between vpc-portal-prod and vpc-data-prod must be prevented for compliance reasons.
- The solution must be highly available and minimize operational complexity.

Which TWO actions should the Solutions Architect take to meet these requirements?

Select all that apply

Associate the corp.internal Private Hosted Zone in Account A with vpc-portal-prod and vpc-data-prod by creating VPC association authorizations in Account A and executing the associations in Accounts B and C.

Deploy an AWS Transit Gateway (tgw-global-core) and create two Transit Gateway route tables. Associate vpc-portal-prod and vpc-data-prod with a spoke route table that has a default route (

0.0.0.0/0

) pointing to the vpc-egress-prod attachment, and do not propagate spoke routes to each other.

In vpc-egress-prod, deploy a single NAT Gateway in one public subnet, and configure the route tables of the private subnets in all Availability Zones to point their default route (

0.0.0.0/0

) to this NAT Gateway.

Configure a single Transit Gateway route table associated with all VPC attachments, and enable route propagation across all VPCs to rely on the Direct Connect Gateway (dxgw-hybrid-core) to filter and block transitive traffic between the spokes.

Deploy Route 53 Resolver inbound endpoints in Account A and outbound endpoints in Accounts B and C, then create forwarding rules in Accounts B and C to route all DNS queries for corp.internal to the inbound endpoints.

Show answer & explanation

Answer: Associate the corp.internal Private Hosted Zone in Account A with vpc-portal-prod and vpc-data-prod by creating VPC association authorizations in Account A and executing the associations in Accounts B and C.; Deploy an AWS Transit Gateway (tgw-global-core) and create two Transit Gateway route tables. Associate vpc-portal-prod and vpc-data-prod with a spoke route table that has a default route ( $0.0.0.0/0$ ) pointing to the vpc-egress-prod attachment, and do not propagate spoke routes to each other.

Answer

The Solutions Architect should associate the corp.internal Private Hosted Zone in Account A with vpc-portal-prod and vpc-data-prod via cross-account VPC association authorizations, and deploy an AWS Transit Gateway with two Transit Gateway route tables where vpc-portal-prod and vpc-data-prod are associated with a spoke route table that directs default outbound traffic to the egress VPC without propagating spoke routes to each other.

The correct options implement a highly available, secure, and cost-effective multi-account architecture. Using cross-account VPC association authorizations allows spoke VPCs to natively resolve the private hosted zone without resolver endpoint costs. Isolating the spokes using Transit Gateway route tables with a default route to the egress VPC prevents spoke-to-spoke traffic while centralizing egress.

Step-by-Step Solution

Address DNS resolution requirements across multiple accounts natively and cost-effectively.

Associate the private hosted zone corp.internal in Account A with vpc-portal-prod (Account B) and vpc-data-prod (Account C) using VPC association authorizations and accepting them in the respective spoke accounts.

This avoids the cost, latency, and management overhead of deploying Route 53 Resolver endpoints and forwarding rules for same-Region resolution.

Design the network segmentation and routing topology using AWS Transit Gateway.

Create a Transit Gateway with two distinct route tables: one for the spokes (vpc-portal-prod and vpc-data-prod) and one for the hub/egress VPC (vpc-egress-prod).

This segregation allows custom routing behavior for different VPC attachments.

Enforce VPC-to-VPC isolation and centralize outbound traffic.

Associate the spoke VPC attachments with the spoke Transit Gateway route table. In this table, configure a default route (

0.0.0.0/0

) pointing to the egress VPC attachment and do not enable route propagation between the two spoke VPCs.

This setup prevents direct routing between the portal and data VPCs, forcing internet-bound traffic through the firewall and NAT Gateways in the egress VPC.

Key Concept

Multi-account hybrid networking design including Transit Gateway isolation, cross-account Route 53 Private Hosted Zone association, and highly available centralized egress.

Question 1331Question →

An online ticketing platform manages a high-volume event booking application on AWS. The application tier connects to an Amazon Aurora PostgreSQL DB cluster with one primary (writer) instance and one Aurora Replica (reader) instance. During flash sales, the platform experiences database latency spikes and connection failures, resulting in dropped bookings. An analysis reveals that the application exhausts the database's maximum connection limit due to a lack of connection pooling. Additionally, database read performance degrades under heavy concurrent searches for the same event catalog, and active user session states are lost during application node scaling. Which two actions should a Solutions Architect recommend to resolve these issues while maintaining high availability and session persistence? (Select TWO.)

Select all that apply

Deploy an Amazon RDS Proxy instance between the application and the Aurora PostgreSQL cluster, and update the application connection strings to use the proxy endpoint.

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and replication enabled, and configure the application to store user session data and cache event catalog read queries.

Deploy an Amazon ElastiCache for Memcached cluster, and configure the application to cache the event catalog and store user session data using Memcached's native replication features.

Migrate the Aurora PostgreSQL cluster to an Amazon RDS PostgreSQL DB instance with Multi-AZ enabled, and configure the application to distribute read-only queries to the Multi-AZ standby replica.

Configure an Amazon ElastiCache for Memcached cluster to act as the primary database cache, and configure the database client to periodically write snapshots of the cache data to Amazon S3 for persistence.

Show answer & explanation

Answer: Deploy an Amazon RDS Proxy instance between the application and the Aurora PostgreSQL cluster, and update the application connection strings to use the proxy endpoint.; Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and replication enabled, and configure the application to store user session data and cache event catalog read queries.

Answer

Implementing database connection pooling with Amazon RDS Proxy addresses the connection limit exhaustion, and deploying a Multi-AZ Amazon ElastiCache for Redis cluster provides high-availability session persistence and catalog read caching.

Deploying Amazon RDS Proxy introduces database connection pooling, which resolves the connection limits exhaustion on PostgreSQL without application-side connection pool configuration. Deploying ElastiCache for Redis with Multi-AZ replication ensures user session persistence across application scaling events and offloads catalog read requests from the primary database cluster.

Step-by-Step Solution

Analyze connection pooling requirements.

Identify that connection timeouts are caused by application nodes exceeding the PostgreSQL database's max_connections limit.

Resolving connection exhaustion requires a proxy layer that pools database connections.

Evaluate Amazon RDS Proxy vs. alternatives.

Determine that Amazon RDS Proxy dynamically pools connections, decreases CPU usage on the database, and handles database failovers transparently without modifying target database engine logic.

RDS Proxy natively supports Aurora PostgreSQL and integrates directly to handle connection pooling.

Compare caching engines (Redis vs. Memcached) for session storage and HA.

Identify that user sessions require persistence and high availability. Choose Redis because it supports data replication, Multi-AZ automatic failover, and persistent snapshotting, whereas Memcached is purely in-memory and lacks replication.

Selecting Redis prevents session loss during scaling and cache node outages.

Key Concept

Improving database efficiency requires addressing scaling limitations at both the connection tier (using RDS Proxy for connection pooling) and the read/state tier (using Amazon ElastiCache for Redis for persistent replication and query caching).

Question 1332Question →

An enterprise is planning to migrate its customer service portal application portfolio to AWS. The portfolio consists of the following components:

1. A web tier running Node.js on custom Linux VMs. The company wants to move this to a containerized managed service like AWS Fargate to eliminate operating system patching and administration without changing the code.
2. A database tier running PostgreSQL on-premises. The company wants to migrate to Amazon RDS for PostgreSQL to benefit from managed backups and scaling while keeping the exact same database engine.
3. A historical reporting module that was recently discovered to be obsolete, as its features have been fully absorbed by the core application database.
4. A legacy customer relationship management (CRM) application that will be replaced by a new third-party cloud-based software-as-a-service (SaaS) solution.

Which of the following migration strategy mappings correctly align the components with the 7 Rs framework? (Select TWO.)

Select all that apply

Replatform the Node.js web tier by containerizing the workload and deploying it to AWS Fargate.

Retire the historical reporting module by decommissioning it before or during the migration.

Refactor the database tier by migrating the PostgreSQL database to Amazon RDS for PostgreSQL.

Rehost the legacy CRM application by transitioning users to the new cloud-based SaaS solution.

Retain the Node.js web tier by hosting it on Amazon EC2 instances to maintain operating system access.

Show answer & explanation

Answer: Replatform the Node.js web tier by containerizing the workload and deploying it to AWS Fargate.; Retire the historical reporting module by decommissioning it before or during the migration.

Answer

Replatforming the Node.js web tier to AWS Fargate and retiring the obsolete historical reporting module.

Containerizing the web tier and running it on AWS Fargate is a Replatform strategy because it optimizes the platform by eliminating OS management without modifying the application code. Decommissioning the obsolete historical reporting module is a Retire strategy, as the component is no longer needed.

Step-by-Step Solution

Analyze the migration requirements for the Node.js web tier.

The web tier needs to move to a containerized managed service (AWS Fargate) to reduce OS administration without changing the code.

This matches the Replatform (lift-tinker-and-shift) migration strategy.

Analyze the migration requirements for the database tier.

The PostgreSQL database is moving to a managed PostgreSQL service (Amazon RDS) without changing the database engine.

This is also a Replatform strategy, not a Refactor or Rehost strategy.

Analyze the requirements for the historical reporting module and CRM application.

The reporting module is obsolete (Retire) and the CRM is being replaced by a SaaS solution (Repurchase).

Correctly identifying these yields Retire and Repurchase respectively.

Key Concept

Identifying and mapping on-premises workloads to the correct AWS 7 Rs migration strategies (Rehost, Replatform, Repurchase, Refactor, Retain, Retire, Relocate) based on business and technical constraints.

Question 1333Question →

An enterprise utilizes a multi-account AWS environment managed via AWS Organizations. A central DevOps team maintains a continuous delivery pipeline in a Tooling account using AWS CodePipeline. The pipeline orchestrates the deployment of a microservices application to Amazon ECS (Fargate) in a separate Production account. The pipeline packages deployment artifacts and writes them to an Amazon S3 bucket in the Tooling account, encrypted using the default AWS-managed KMS key (aws/s3).

During a release, the CodePipeline execution fails at the CodeDeploy stage in the Production account with an Access Denied error when trying to retrieve the deployment package from the Tooling account's S3 bucket. A solutions architect must resolve this issue while maintaining the automated deployment process and enforcing the principle of least privilege.

Which of the following actions should the solutions architect take to resolve the deployment failure?

Create a customer managed key (CMK) in the Tooling account. Configure the S3 bucket to use this CMK for encryption. Update the CMK key policy in the Tooling account to grant kms:Decrypt and kms:GenerateDataKey permissions to the IAM role assumed by CodeDeploy in the Production account. Configure the S3 bucket policy to allow read access from the Production account's CodeDeploy role.

Modify the key policy of the existing AWS-managed KMS key (aws/s3) in the Tooling account to grant cross-account kms:Decrypt and kms:GenerateDataKey permissions to the IAM role assumed by CodeDeploy in the Production account. Attach an IAM policy to the CodeDeploy role in the Production account permitting read access to the S3 bucket.

Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Production account that explicitly permits kms:Decrypt and kms:GenerateDataKey on the Tooling account's S3 bucket and default AWS-managed key (aws/s3) for the CodeDeploy IAM role.

Instruct an operator to manually download the deployment artifacts from the Tooling account S3 bucket, upload them to a local S3 bucket in the Production account, and manually update the CloudFormation stack in the Production account. Then, modify the pipeline to bypass artifact retrieval by disabling CloudFormation drift detection.

Show answer & explanation

Answer: Create a customer managed key (CMK) in the Tooling account. Configure the S3 bucket to use this CMK for encryption. Update the CMK key policy in the Tooling account to grant kms:Decrypt and kms:GenerateDataKey permissions to the IAM role assumed by CodeDeploy in the Production account. Configure the S3 bucket policy to allow read access from the Production account's CodeDeploy role.

Answer

Create a customer managed key (CMK) in the Tooling account, use it for encrypting the S3 bucket, and grant cross-account decrypt permissions in the CMK policy and S3 bucket policy to the target account's CodeDeploy role.

The correct answer is correct because cross-account access to S3 objects encrypted with KMS requires a Customer Managed Key (CMK). AWS-managed keys (like aws/s3) cannot be shared across accounts because their key policies are managed by AWS and cannot be modified. Additionally, cross-account access requires explicit permission in both the KMS key policy and the S3 bucket policy, alongside the IAM permissions attached to the role in the destination account.

Step-by-Step Solution

Identify the cause of the cross-account S3 and KMS decryption failure.

AWS-managed keys (such as the default aws/s3 key) cannot be shared across accounts because their key policies cannot be customized to grant access to external principals.

This is a fundamental security limitation of AWS-managed KMS keys.

Replace the encryption mechanism with a Customer Managed Key (CMK).

Create a new CMK in the Tooling account, configure S3 to use it, and update the CMK policy to trust the Production account's IAM role for decryption.

CMKs allow custom key policies, enabling multi-account access control.

Configure S3 bucket policy and destination IAM permissions.

Update the Tooling account S3 bucket policy to allow read access to the Production account's CodeDeploy role, and ensure the Production role has permissions to read the S3 bucket and decrypt using the Tooling account's KMS CMK.

Cross-account access requires authorization on both the resource (S3 bucket policy) and the key (KMS key policy), as well as the client identity (IAM policy).

Key Concept

Cross-account resource access with KMS encryption requires Customer Managed Keys (CMKs) and matching resource/identity policies.

Estimated Time:2m 30s

Question 1334Question →

An enterprise manages a fleet of Amazon EC2 instances in an Auto Scaling group (ASG) deployed via AWS CloudFormation. Security policies require that all instances maintain a specific software configuration baseline, including a running logging agent, and that any unauthorized manual configuration changes on the instances be automatically remediated. Systems Manager Agent (SSM Agent) is installed on all instances. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Create an AWS Systems Manager State Manager association using an SSM document that defines the desired configuration baseline, targeting the EC2 instances using resource tags.

Configure the State Manager association to run on a recurring schedule to automatically reapply the document's configuration, which remediates any local configuration drift.

Incorporate a custom script into the AWS CloudFormation template using cfn-init, and execute a scheduled hourly stack update to identify and remediate internal OS-level modifications.

Deliver the Systems Manager execution logs to a centralized S3 bucket in a separate security account, encrypting the logs using the default AWS-managed KMS key (aws/s3) of the security account.

Create a Service Control Policy (SCP) at the root of the AWS Organization to grant the necessary Systems Manager permissions to the EC2 instances in all member accounts.

Show answer & explanation

Answer: Create an AWS Systems Manager State Manager association using an SSM document that defines the desired configuration baseline, targeting the EC2 instances using resource tags.; Configure the State Manager association to run on a recurring schedule to automatically reapply the document's configuration, which remediates any local configuration drift.

Answer

To automatically detect and remediate OS-level configuration changes, a Systems Manager State Manager association must be created with an SSM document defining the baseline, targeting instances via tags. The association should be configured on a recurring schedule to enforce the configuration and remediate drift.

Automating OS-level configuration management and drift remediation is best accomplished with AWS Systems Manager State Manager. By defining the configuration baseline inside an SSM document and creating a State Manager association targeting the instances by resource tags, the configuration is applied systematically. Setting the association to execute on a recurring schedule ensures that any configuration changes introduced by manual operations are automatically overwritten and corrected back to the desired baseline.

Step-by-Step Solution

Define the target configuration baseline.

An SSM document (such as a Command document or a Policy document) is created, outlining the software installation steps and services that must be running.

This establishes the declarative state that Systems Manager will enforce on the instances.

Target the instances and create the association.

A State Manager association is created, targeting the EC2 instances via resource tags (e.g., Environment=Production).

This links the SSM document to the specific subset of instances that must comply with the configuration baseline.

Schedule automatic enforcement.

The association is scheduled to run on a recurring cron or rate expression (e.g., every 30 minutes).

Periodic execution allows the SSM Agent on the instances to check the current state against the document and automatically reapply configurations if manual changes have caused drift.

Key Concept

Automated drift remediation at the OS level using AWS Systems Manager State Manager

Estimated Time:2m 0s

Question 1335Question →

A company is planning to migrate an on-premises MySQL database to an Amazon Aurora MySQL DB cluster using AWS Database Migration Service (DMS). The company requires the database to remain online during the migration, with all ongoing transactional changes continuously replicated to the target database. Which configuration must be enabled on the source database to meet this requirement?

Enable Multi-AZ replication on the target Amazon Aurora MySQL cluster.

Enable binary logging (binlog) in ROW format on the source MySQL database.

Run the AWS Schema Conversion Tool (SCT) to generate a database migration assessment report.

Configure the DMS task to use the 'Migrate existing data' (full-load) migration type only.

Show answer & explanation

Answer: Enable binary logging (binlog) in ROW format on the source MySQL database.

Answer

Enable binary logging (binlog) in ROW format on the source MySQL database.

To perform ongoing replication (Change Data Capture) from a MySQL database, AWS DMS must read the source database's binary logs. Therefore, enabling binary logging (binlog) in ROW format on the source MySQL database is a mandatory prerequisite.

Step-by-Step Solution

Identify the migration type and requirements.

The target migration is homogeneous (MySQL to Aurora MySQL) and requires continuous replication (Change Data Capture) to minimize downtime.

Understanding the migration pattern helps determine if schema conversion is needed and which replication settings are mandatory.

Determine the source database prerequisites for AWS DMS Change Data Capture (CDC).

AWS DMS requires access to the source database engine's transaction log (the binary log for MySQL) to read ongoing changes.

Without transaction log access, DMS cannot identify which records have changed since the initial full load began.

Select the correct option that satisfies the log requirements.

Enabling binary logging in ROW format on the source MySQL database enables DMS to capture and replicate row-level changes.

This is a mandatory configuration step for MySQL source databases when using AWS DMS for continuous replication.

Key Concept

AWS DMS Change Data Capture (CDC) prerequisites for MySQL source databases.

Question 1336Question →

An enterprise is improving the security posture of an existing web portal hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team attaches an AWS WAF WebACL to the ALB with the following requirements:
1. Block all requests containing SQL injection (SQLi) patterns.
2. Limit requests from any single IP address to a maximum of 2,000 requests per 5 minutes.
3. Allow an external partner's automated testing suite, which originates from a specific static IP range, to bypass the rate limit.

The WebACL is initially configured with the following rules:
- Priority 10: A rule matching the partner's IP address range with an action of Allow.
- Priority 20: An AWS Managed Rules SQL database rule group with an action of Block.
- Priority 30: A custom rate-based rule set to Block requests exceeding 2,000 per 5 minutes.
- Default Action: Allow.

During a penetration test, the partner successfully performs a SQL injection attack against the portal.

Which configuration change should the security team implement to resolve this vulnerability while meeting all requirements?

Reorder the WebACL rules so that the SQL database rule group is evaluated at Priority 10, the partner's IP match rule (with an Allow action) is evaluated at Priority 20, and the rate-based rule (with a Block action) is evaluated at Priority 30.

Change the action of the partner's IP match rule at Priority 10 to Count, while keeping the SQL database rule group at Priority 20 and the rate-based rule at Priority 30.

Reorder the WebACL rules so that the rate-based rule is evaluated at Priority 10, the partner's IP match rule (with an Allow action) is evaluated at Priority 20, and the SQL database rule group is evaluated at Priority 30.

Implement a Service Control Policy (SCP) at the AWS Organizations root to block SQL injection payloads at the Organization level, and remove the SQL database rule group from the WebACL.

Show answer & explanation

Answer: Reorder the WebACL rules so that the SQL database rule group is evaluated at Priority 10, the partner's IP match rule (with an Allow action) is evaluated at Priority 20, and the rate-based rule (with a Block action) is evaluated at Priority 30.

Answer

Evaluating the SQL database rule group first ensures all requests are inspected for SQL injection. If a request is safe and originates from the partner's IP, the second rule matches and allows the traffic, terminating further evaluation and successfully bypassing the rate limit. All other traffic falls through to the rate-based rule.

Step-by-Step Solution

Analyze the execution flow of AWS WAF WebACL rules and the behavior of the Allow action.

AWS WAF rules are evaluated in priority order (lowest number first). A matching rule with a terminating action like Allow or Block stops further rule evaluation.

Understanding terminating actions is crucial to identifying why the SQLi vulnerability was bypassed for the partner's IP.

Determine the necessary ordering to prevent security bypasses while honoring exemptions.

The SQL injection protection rule must be evaluated before the partner's Allow rule. This ensures that any SQLi payloads are blocked first, regardless of the client IP.

This guarantees that no request can bypass the critical SQLi inspection.

Verify the position of the rate-limiting rule.

Place the rate-limiting rule after the partner's Allow rule. Legitimate traffic from the partner matches the Allow rule and terminates evaluation, avoiding the rate limit, while all other traffic falls through to the rate limit.

This satisfies the requirement to allow the partner to bypass the rate limit without exposing the application to SQLi from that partner.

Key Concept

AWS WAF WebACL rule evaluation priority and terminating actions for strengthening application security posture.

Question 1337Question →

An enterprise is planning to migrate its commercial underwriting application portfolio to AWS. A solutions architect is performing the initial portfolio assessment to determine the appropriate migration strategy (7 Rs) for the following application components:

1. Transactional Database: Runs on IBM Db2. The target is Amazon Aurora PostgreSQL to eliminate commercial licensing costs. This migration requires comprehensive schema conversion and modifications to SQL queries and stored procedures within the application code to handle database engine differences.
2. Web Portal Tier: Runs on IBM WebSphere Application Server on AIX. The business wants to containerize the application to run on Amazon ECS on AWS Fargate to reduce OS licensing costs, without modifying any underlying Java application code.
3. Legacy Archival System: Runs on a legacy version of Windows Server. The software requires a physical USB security dongle plugged into the host server to function. The vendor is out of business, and no virtual or software-based licensing option exists.
4. Internal Reporting Database: Runs on Microsoft SQL Server 2019 on Windows Server 2019. It has low utilization, and the company wants to move it to a managed database service on AWS with minimal administrative effort while maintaining the exact same database engine.

Which migration strategies should the solutions architect select for these components? (Select TWO.)

Select all that apply

Migrate the transactional database from IBM Db2 to Amazon Aurora PostgreSQL using a Refactoring (Re-architecting) strategy.

Retain the legacy archival system on-premises.

Migrate the transactional database from IBM Db2 to Amazon Aurora PostgreSQL using a Replatforming strategy.

Rehost the legacy archival system by importing the Windows Server virtual machine into Amazon EC2.

Rehost the Web Portal Tier directly to Amazon ECS on AWS Fargate.

Show answer & explanation

Answer: Migrate the transactional database from IBM Db2 to Amazon Aurora PostgreSQL using a Refactoring (Re-architecting) strategy.; Retain the legacy archival system on-premises.

Answer

The correct strategies are migrating the Db2 database to Aurora PostgreSQL using a Refactoring strategy, and retaining the legacy archival system on-premises.

The transactional database migration from IBM Db2 to Amazon Aurora PostgreSQL is a heterogeneous database migration requiring schema conversion (using tools like AWS SCT) and code modifications to adapt to the PostgreSQL dialect, which qualifies as Refactoring (Re-architecting). The legacy archival system cannot be migrated to AWS because it relies on a physical USB security dongle, a hardware dependency that is not supported in the AWS cloud environment. Therefore, it must be retained on-premises.

Step-by-Step Solution

Analyze the IBM Db2 to Amazon Aurora PostgreSQL migration requirements.

Identified a database engine change (heterogeneous migration) requiring schema conversion and SQL code rewrites.

A migration that changes the database engine and requires rewriting application code or database schemas is classified as Refactoring (or Re-architecting), not Replatforming.

Evaluate the legacy archival system constraints regarding the physical USB security dongle.

Determined that physical USB hardware cannot be attached to Amazon EC2 and the software vendor is out of business.

Due to hard physical dependencies that cannot be replicated or modified, the system cannot run on AWS and must be Retained on-premises.

Evaluate the Web Portal Tier migration path from IBM WebSphere on AIX to Amazon ECS on AWS Fargate.

Classified this as Replatforming rather than Rehosting because it involves OS/architecture transition (AIX to Linux) and containerization.

Rehosting involves lifting and shifting VMs without modification. Containerizing a VM workload to run on Fargate constitutes Replatforming.

Synthesize the findings to select the correct migration strategy mappings.

Matched the Db2 migration to Refactoring and the legacy system to Retain.

These strategies align with AWS Migration Evaluator and Cloud Migration Factory patterns based on the technical and business constraints.

Key Concept

Selecting appropriate migration strategies (7 Rs) based on system architecture, operating systems, and hardware constraints.

Estimated Time:3m 0s

Question 1338Question →

A logistics company is planning to migrate its core operations platform to AWS. The platform consists of the following three components:

1. A proprietary supply chain planning application running on a local Linux server. The code is highly optimized and cannot be altered, but it requires specific kernel parameters. The company plans to use AWS Application Migration Service (MGN) to move the application and its operating system directly to Amazon EC2.
2. A transactional database running on IBM DB2. To eliminate licensing costs, the company intends to migrate this database to Amazon Aurora PostgreSQL. This will require converting the schema and stored procedures using the AWS Schema Conversion Tool (SCT) and modifying the application's query logic.
3. A third-party legacy customer ticketing system that has reached its end of life. The company has decided to discontinue the system and move its users to a cloud-native software-as-a-service (SaaS) ticketing platform.

Which of the following represents the most appropriate migration strategy (7 Rs) for each component?

Supply chain system: Replatform; Transactional database: Refactor; Ticketing system: Retire

Supply chain system: Rehost; Transactional database: Replatform; Ticketing system: Repurchase

Supply chain system: Rehost; Transactional database: Refactor; Ticketing system: Repurchase

Supply chain system: Rehost; Transactional database: Replatform; Ticketing system: Retire

Show answer & explanation

Answer: Supply chain system: Rehost; Transactional database: Refactor; Ticketing system: Repurchase

Answer

The correct migration path is Rehost for the supply chain system, Refactor for the transactional database, and Repurchase for the ticketing system.

The correct strategy maps the block-level lift-and-shift of the supply chain system to Rehost, the database engine conversion (DB2 to Aurora PostgreSQL with code modification) to Refactor, and the transition to a cloud-native SaaS ticketing system to Repurchase.

Step-by-Step Solution

Analyze the supply chain application migration strategy.

The application and OS are copied as-is using block-level replication (AWS MGN) onto EC2 instances. This represents a lift-and-shift or Rehost strategy.

Rehosting does not modify the application, OS, or architecture.

Analyze the database migration strategy.

Migrating from IBM DB2 to Amazon Aurora PostgreSQL requires schema conversion, stored procedure rewrites, and application query modifications. This represents a Refactor/Re-architect strategy.

Changing database engines and rewriting application code to support the new engine exceeds Replatforming and constitutes Refactoring.

Analyze the legacy ticketing system migration strategy.

Moving users from a discontinued legacy platform to a SaaS ticketing solution represents a Repurchase strategy.

Transitioning to a third-party software-as-a-service model is classified as Repurchasing.

Key Concept

Selecting migration strategies among the 7 Rs requires mapping specific business requirements and technical constraints to migration paths, notably distinguishing between Rehosting (as-is), Replatforming (runtime optimizations without code changes), Refactoring (engine/code changes), and Repurchasing (transitioning to SaaS).

Question 1339Question →

An enterprise is strengthening the security of an existing document management system. The system components are distributed as follows:
- On-premises servers in a corporate data center connect to AWS via an AWS Direct Connect connection to an AWS Transit Gateway.
- An application tier runs on Amazon EC2 instances in VPC A (Account A).
- A centralized Amazon S3 bucket containing sensitive PDF files is located in Account B and is encrypted with an AWS KMS key.

Currently, the on-premises servers communicate with the application tier in VPC A via public IP addresses. The application tier accesses the S3 bucket in Account B over the public internet using IAM user access keys stored locally on the EC2 instances.

The solutions architect must implement a security improvement plan that satisfies the following requirements:
- All network traffic between the corporate data center, VPC A, and the S3 bucket must remain within the private network.
- The application tier in VPC A must access the S3 bucket without using long-lived credentials.
- The S3 bucket must only accept requests originating from VPC A or the corporate data center.
- The KMS key must support cross-account access for the application tier in VPC A.

Which combination of actions will meet these requirements in the most secure and operationally efficient manner?

Attach an IAM role to the EC2 instances in VPC A. Create a Gateway VPC Endpoint for Amazon S3 in VPC A. Configure Transit Gateway routing to allow the corporate data center to route S3 traffic through the Gateway VPC Endpoint. Encrypt the S3 bucket in Account B using the default AWS managed S3 key (aws/s3). Update the S3 bucket policy in Account B to permit access from the EC2 IAM role, restricted by a condition matching the Gateway VPC Endpoint ID.

Attach an IAM role to the EC2 instances in VPC A. Create an Interface VPC Endpoint for Amazon S3 in VPC A. Configure Transit Gateway routing and on-premises DNS to direct S3 traffic through the Interface VPC Endpoint. Encrypt the S3 bucket in Account B using an AWS KMS customer managed key. Attach a Service Control Policy (SCP) to the Organization root that explicitly grants S3 and KMS permissions to the EC2 IAM role, bypassing the need for an S3 bucket policy or key policy update in Account B.

Attach an IAM role to the EC2 instances in VPC A. Create an Interface VPC Endpoint for Amazon S3 in VPC A. Configure Transit Gateway routing and on-premises DNS to direct S3 traffic through the Interface VPC Endpoint. Encrypt the S3 bucket in Account B using an AWS KMS customer managed key. Update the key policy in Account B and the IAM policy in Account A to allow the EC2 IAM role to perform cryptographic operations. Update the S3 bucket policy in Account B to permit access from the EC2 IAM role, restricted by a condition matching the Interface VPC Endpoint ID.

Configure a federated IAM role for the EC2 instances in VPC A, but configure the trust policy using the SAML provider as the principal without specifying the EC2 service principal. Create an Interface VPC Endpoint for Amazon S3 in VPC A. Route S3 traffic over the public internet to bypass Direct Connect capacity limits. Encrypt the S3 bucket in Account B using an AWS KMS customer managed key, and update the S3 bucket policy to allow access from the federated role restricted by the source IP range of VPC A.

Show answer & explanation

Answer: Attach an IAM role to the EC2 instances in VPC A. Create an Interface VPC Endpoint for Amazon S3 in VPC A. Configure Transit Gateway routing and on-premises DNS to direct S3 traffic through the Interface VPC Endpoint. Encrypt the S3 bucket in Account B using an AWS KMS customer managed key. Update the key policy in Account B and the IAM policy in Account A to allow the EC2 IAM role to perform cryptographic operations. Update the S3 bucket policy in Account B to permit access from the EC2 IAM role, restricted by a condition matching the Interface VPC Endpoint ID.

Answer

The correct solution involves attaching an IAM role to the EC2 instances in VPC A, creating an Interface VPC Endpoint for Amazon S3 in VPC A, routing S3 traffic through this endpoint from both VPC A and the corporate data center over the Transit Gateway, encrypting the S3 bucket with a customer managed key, and updating both the S3 bucket policy and KMS key policy to permit cross-account access from the EC2 IAM role, restricted by the S3 Interface VPC Endpoint ID.

The correct solution resolves the security requirements by replacing long-lived credentials with an IAM role (instance profile) attached to the EC2 instances. It routes all S3 traffic privately using an Interface VPC Endpoint (PrivateLink) in VPC A. Unlike Gateway VPC Endpoints, Interface VPC Endpoints support routing from on-premises environments over Direct Connect and Transit Gateway. To support cross-account access, a Customer Managed Key (CMK) is used because AWS-managed keys (aws/s3) cannot be shared across accounts. Finally, the S3 bucket policy in Account B permits access to the IAM role in Account A only when the request originates from the S3 Interface VPC Endpoint, securing both VPC A and on-premises traffic.

Step-by-Step Solution

Configure identity-based access without long-lived credentials

Attach an IAM role (instance profile) to the EC2 instances in VPC A, allowing them to make API calls to S3 and KMS.

This removes the requirement for storing hardcoded, long-lived AWS access keys on the EC2 instances.

Establish a private network path for S3 access from both environments

Create an Interface VPC Endpoint (PrivateLink) for S3 in VPC A. Configure corporate DNS and Transit Gateway routing to direct S3 requests from both VPC A and on-premises to this endpoint.

Interface VPC Endpoints are assigned private IPs from the VPC subnet, making them accessible from on-premises via Direct Connect, unlike Gateway VPC Endpoints.

Enable cross-account encryption key access

Use an AWS KMS customer managed key (CMK) to encrypt the S3 bucket in Account B. Modify the key policy to grant the Account A EC2 IAM role permissions for decrypting and generating data keys.

AWS-managed keys (aws/s3) cannot be shared cross-account because their policies are immutable. A customer managed key must be used for cross-account KMS operations.

Enforce bucket access boundaries and authorization

Apply a bucket policy to the S3 bucket in Account B that permits access to the EC2 IAM role in Account A only when the request originates from the specified Interface VPC Endpoint ID (using the aws:sourceVpce condition).

This guarantees that access is limited to authorized compute resources in VPC A and on-premises servers routing through that specific endpoint.

Key Concept

Strengthening cross-account and hybrid access security requires combining IAM roles, customer managed KMS keys, Interface VPC Endpoints for transitive routing, and bucket policies using condition keys (aws:sourceVpce).

Question 1340Question →

A company plans to transition their self-managed Oracle database to Amazon Aurora PostgreSQL-Compatible Edition. The database schemas have already been converted and applied to the target database. A Solutions Architect sets up an AWS Database Migration Service (AWS DMS) task configured for full load and ongoing replication (CDC). The full load phase completes successfully, but the task halts immediately when transitioning to the replication phase. Which two configuration steps must be performed on the source database to support ongoing replication? (Select two.)

Select all that apply

Ensure that the source database is configured to run in ARCHIVELOG mode.

Enable minimal supplemental logging and table-level supplemental logging on the source database.

Enable supplemental logging on the target database tables.

Configure the target database to write changes to local write-ahead logs (WAL) before applying them.

Configure the AWS DMS source endpoint with extra connection attributes to disable the reading of online redo logs.

Show answer & explanation

Answer: Ensure that the source database is configured to run in ARCHIVELOG mode.; Enable minimal supplemental logging and table-level supplemental logging on the source database.

Answer

To support ongoing replication (CDC) from a source Oracle database, you must configure the source database to run in ARCHIVELOG mode and enable minimal supplemental logging and table-level supplemental logging on it.

To perform ongoing replication (CDC) from an Oracle source database, AWS DMS must read the transaction logs. This requires the source database to be in ARCHIVELOG mode so that transaction log files are archived and accessible. Additionally, supplemental logging must be enabled on the source database so that it writes sufficient column data to the redo logs for DMS to reconstruct the database changes.

Step-by-Step Solution

Analyze the point of failure in the AWS DMS task.

The task succeeded during the full load phase but halted immediately when transitioning to ongoing replication (CDC).

This indicates that the source database is not generating or preserving the transaction logs in a format that AWS DMS can capture and read.

Determine the source database requirements for AWS DMS CDC.

For Oracle sources, AWS DMS requires the database to run in ARCHIVELOG mode to preserve redo logs.

ARCHIVELOG mode ensures that logs are archived and not immediately overwritten, allowing AWS DMS to capture changes that occurred since the migration started.

Verify database supplemental logging requirements.

Enable minimal supplemental logging at the database level and table-level supplemental logging.

By default, Oracle does not write enough database change information to the logs. Supplemental logging ensures that full column updates are written to the redo logs, which is required for DMS to reconstruct changes.

Key Concept

Configuring the source database transaction logs (ARCHIVELOG mode and supplemental logging) is mandatory for AWS DMS Change Data Capture (CDC) replication to succeed.

PreviousPage 67 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept