All practice questions

An enterprise is designing a new multi-VPC networking environment on AWS. The environment consists of a central egress VPC (`vpc-egress-prod`) and two application spoke VPCs (`vpc-app-a` and `vpc-app-b`) across two Availability Zones in the `us-east-1` Region. An AWS Transit Gateway is deployed to interconnect all VPCs.

The application spoke VPCs host workloads that require:
1. Highly available outbound internet connectivity to download software patches.
2. Private DNS resolution for a domain named `corp.internal`, which is managed via a Route 53 Private Hosted Zone (PHZ) in a shared services AWS account.

Which of the following actions should the solutions architect take to meet these requirements with high availability and minimal operational overhead? (Select TWO.)

A corporate e-learning platform uses an Amazon RDS for PostgreSQL database to manage course metadata and track real-time user progress. During peak hours, the database experiences high CPU utilization due to frequent read queries for course catalogs and write-heavy updates for user session progress. A solutions architect must implement a caching layer to offload the read traffic and temporarily store session data. The session data requires high availability with automatic failover across Availability Zones, persistence to prevent progress loss, and support for sorting user leaderboard scores. Which caching strategy should the solutions architect implement to meet these requirements with minimal latency?

A manufacturing enterprise is planning to migrate its legacy Enterprise Resource Planning (ERP) platform and associated satellite services to AWS. The migration must be completed within a strict six-month window, and the solutions architect must minimize ongoing administrative overhead. The application portfolio contains the following workloads:

1. Core ERP Web Tier: A Python Django application hosted on Ubuntu virtual machines. The web tier must be migrated with no modifications to its core business logic, but the enterprise wants to eliminate server management and operating system patching.
2. ERP Database: An on-premises Oracle Database instance using proprietary PL/SQL packages. The enterprise wants to eliminate licensing costs by migrating to Amazon Aurora PostgreSQL and has allocated a dedicated database engineering team to convert the schema and rewrite database code.
3. Legacy Shipping Integration: A Windows-based service running on Windows Server 2012. The application has no active vendor support, and the source code is unavailable. The system must be migrated as-is with a downtime window of less than one hour.
4. Warehouse Inventory Sync Service: A local synchronization utility that interfaces directly with physical Programmable Logic Controller (PLC) hardware via dedicated physical serial ports in the warehouse.

Which combination of migration strategies represents the most appropriate 7 Rs path for each workload component based on these requirements and constraints?

A financial services company is designing a high-volume, multi-region Online Transaction Processing (OLTP) application. The primary database cluster will be deployed in the 'us-east-1' region, and a disaster recovery (DR) database cluster must be maintained in the 'us-west-2' region. The business requirements specify a Recovery Time Objective (RTO) of under 2 minutes and a Recovery Point Objective (RPO) of under 5 seconds for the database tier. Additionally, security compliance mandates that all data must be encrypted at rest using encryption keys managed in a centralized security account. An audit team in a separate AWS account needs to run read-only compliance queries against a copy of the database in the 'eu-west-1' region every 24 hours.

Which database and storage strategy meets these requirements with the lowest recovery time and operational overhead?

A logistics enterprise is establishing a new platform across multiple AWS accounts in the eu-central-1 Region. The architecture requires three production spoke VPCs (vpc-delivery-prod, vpc-warehouse-prod, and vpc-tracking-prod) to communicate with one another for real-time inventory updates. Additionally, these spoke VPCs must connect to the corporate on-premises network via a 10 Gbps AWS Direct Connect connection. The enterprise also requires secure, highly available outbound internet access for all spokes to download software patches, and name resolution for a private DNS zone (corp.internal) hosted in a central shared services account. Which architecture should a solutions architect recommend to satisfy these requirements while preventing single points of failure and minimizing administrative overhead?

An enterprise runs a multi-tenant SaaS application across multiple member accounts in an AWS Organization with consolidated billing enabled. The application architecture consists of:

* A stateless web tier hosted on Amazon ECS on AWS Fargate across three Availability Zones (AZs) that scales dynamically based on request traffic.
* A legacy queue-processing worker tier running 24/7 on a fleet of $100$ `c6i.2xlarge` EC2 instances ($8$ vCPUs, $16$ GiB RAM) across three AZs. The application is compiled for x86 architecture and cannot be ported to Graviton due to legacy dependency constraints.
* A batch processing tier utilizing AWS Lambda functions triggered by objects uploaded to Amazon S3.
* Network infrastructure where outbound internet traffic, including data transferred to Amazon S3 and Amazon DynamoDB, is routed through a NAT Gateway in each AZ.

AWS Compute Optimizer and Amazon CloudWatch metrics for the worker tier over the last 30 days show:

* Average CPU utilization is $15\%$, with a maximum peak of $28\%$.
* Average memory utilization is $72\%$, with a maximum peak of $84\%$.

The Solutions Architect must optimize the infrastructure costs over a 3-year period. The solution must minimize operational management overhead, maintain the high availability SLA across three AZs, and deliver the highest cost savings.

Which combination of actions should the Solutions Architect recommend?

A software-as-a-service (SaaS) company hosts a multi-tenant talent management platform on AWS. The application backend runs on AWS Fargate containers behind an Application Load Balancer, and uses an Amazon Aurora Serverless v2 PostgreSQL DB cluster as its primary database. During the annual performance review cycle, the platform experiences a massive, predictable surge in read traffic (exceeding $100,000$ queries per second) as users retrieve employee competency profiles. This traffic spike causes the Aurora Serverless v2 DB cluster to scale up to its maximum capacity, resulting in high database CPU utilization (above $90\%$), increased latency, and significantly higher operational costs. The profiles are updated infrequently but must be retrieved with sub-millisecond latency. The solutions architect must implement a caching solution that is highly available, supports automatic failover, and protects the database from cache-stampede issues if a cache node fails.

Which strategy should the solutions architect implement to resolve these issues?

An organization is planning to migrate a self-managed Oracle database running on Amazon EC2 to an Amazon RDS for PostgreSQL DB instance. The migration must involve converting the database schema (including stored procedures) and replicating data with minimal downtime.

Which of the following actions should the organization perform to accomplish this database migration? (Select TWO.)

A real-estate listing portal uses an Amazon RDS for MySQL database to manage property listings and user-saved search preferences. During peak marketing campaigns, users experience high latency when searching for listings due to read-heavy query volumes. Furthermore, the user-saved search preference feature, which requires session state persistence and multi-AZ replication to prevent data loss, is causing write bottlenecks on the primary database instance. Which two actions should the Solutions Architect take to address these performance issues? (Select TWO.)

A digital ticketing company hosts its high-demand event registration application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances run in private subnets across $3$ Availability Zones. The application requires outbound internet access to interact with external payment processors. Outbound traffic is currently routed through a single NAT Gateway in the first Availability Zone to minimize cost.

During major ticket release events, traffic surges from a baseline of $2,000$ requests per minute to over $100,000$ requests per minute in less than $2$ minutes. During these spikes, users encounter frequent $502\text{ Bad Gateway}$ and $504\text{ Gateway Timeout}$ errors. System logs show the ALB is dropping connections because backend EC2 instances are overwhelmed, and new instances take $5$ minutes to bootstrap and become healthy. Additionally, a recent localized outage in the first Availability Zone disrupted payment processing for all healthy instances in the remaining zones.

Which combination of actions will address the scaling delays and the outbound network single point of failure while minimizing compute expenses during idle periods?

A financial technology startup has a decentralized application environment where multiple development teams manage separate AWS accounts. The startup stores transaction ledger exports in an Amazon S3 bucket located in a centralized auditing account. To meet strict regulatory standards, the compliance team requires that all ledger exports be encrypted at rest using a customer-managed KMS key that undergoes annual rotation. The keys must be controlled centrally, but write permissions must be delegated to the application roles in the member accounts, while preventing any account from disabling the key or modifying the key policy.

Which combination of actions will meet these compliance requirements? (Select TWO.)

A DevOps engineer is configuring a multi-account CI/CD pipeline using AWS Organizations. The pipeline is hosted in a Shared Services account and uses AWS CodePipeline to deploy resources into a Production account using AWS CloudFormation. The pipeline stores its build artifacts in an Amazon S3 bucket in the Shared Services account. The S3 bucket is encrypted using the default AWS-managed KMS key (aws/s3). During the deployment stage, the CloudFormation execution role in the Production account attempts to retrieve the build artifacts but fails with an Access Denied error. Which of the following actions will resolve this deployment failure?

An enterprise manages a multi-account AWS environment under an organization in AWS Organizations with consolidated billing enabled. The environment comprises the following workloads:

* Account A (Web Portal): Runs a critical web application $24/7$ on Amazon EC2 `m6i.large` instances ($2\text{ vCPUs}$, $8\text{ GiB}$ memory) behind an Application Load Balancer. CloudWatch metrics indicate that average CPU utilization is consistently below $15\%$, and peak memory utilization never exceeds $3.2\text{ GiB}$.
* Account B (Video Processing): Runs dynamic video transcoding jobs on AWS Fargate (configured with task allocations equivalent to `c6g.large`) and triggers AWS Lambda functions for metadata extraction. This workload is highly variable and spikey.
* Account C (Analytics): Runs an Amazon RDS for PostgreSQL database instance (`db.r6g.xlarge`, $4\text{ vCPUs}$, $32\text{ GiB}$ memory) with an average CPU utilization of $8\%$, and freeable memory consistently around $26\text{ GiB}$. It also runs several Amazon EC2 `r6g.xlarge` instances for ad-hoc business intelligence reporting, which are active only on weekdays from 9:00 AM to 5:00 PM.

Currently, both Account A and Account B route all outbound traffic to public Amazon S3 and DynamoDB endpoints through a single NAT Gateway deployed in a single Availability Zone (AZ) within their respective VPCs to minimize hourly fees.

The company wants to optimize costs across all accounts while maintaining high availability (HA) for all workloads and minimizing operational overhead. Which of the following solutions represents the most cost-effective and architecturally sound optimization strategy?

A media broadcasting company is planning to migrate its regional digital asset archiving and distribution portfolio to AWS. The portfolio consists of the following components:

1. A web ingest API tier running on custom-compiled Linux binaries that requires low-latency processing and has no source code or build pipeline documentation available.
2. A metadata database running on Microsoft SQL Server 2019 Enterprise Edition on Windows Server 2016, utilizing proprietary CLR (Common Language Runtime) integrations, which must remain on SQL Server due to vendor compliance, but needs to eliminate OS-level licensing and management overhead.
3. A cold-storage legacy tape-archiving daemon that integrates with local physical storage area networks (SAN) via proprietary Fibre Channel protocol, which must remain on-premises due to compliance and hardware dependency.

The migration must be completed within a strict three-month timeline, and the company requires minimal operational overhead for database management.

Which two of the following migration strategies correctly align with these requirements?

A logistics firm is organizing its cloud footprint using AWS Organizations. The security team requires that all member accounts under the Dev-Sandbox Organizational Unit (OU) be blocked from launching Amazon Redshift clusters to control costs. However, developers in these sandbox accounts must retain full administrative privileges for all other AWS services to test new features. The solution must be managed centrally and minimize administrative overhead. Which strategy should a solutions architect recommend to meet these requirements with the least operational overhead?

A financial services firm utilizes AWS Organizations to manage a multi-account environment. A central tooling account hosts an AWS CodePipeline that deploys infrastructure updates using AWS CloudFormation StackSets to multiple member accounts. Security audits have highlighted two major issues:

1. When the pipeline runs, member accounts fail to retrieve the CloudFormation template artifacts from the central Amazon S3 bucket in the tooling account because the bucket is encrypted using an AWS Key Management Service (AWS KMS) key.
2. Developers are making manual modifications (such as changing security group rules and EC2 instance types) directly in the member accounts, resulting in configuration drift that is not captured by the central templates.

Which of the following actions should a Solutions Architect implement to resolve the cross-account pipeline failures and establish automated drift detection? (Select TWO.)

A company is designing a new multi-AZ workload in the us-east-1 Region. The architecture consists of application servers deployed in private subnets across two Availability Zones (us-east-1a and us-east-1b) within a single VPC (vpc-app). These servers must securely initiate outbound connections to the internet to download software updates. The design must ensure that the workload remains resilient to Availability Zone outages and that an issue in one Availability Zone does not disrupt outbound connectivity for servers in the other zone. Which of the following networking designs should a solutions architect recommend to meet these requirements?

An enterprise is planning to migrate its core media management and delivery platform to AWS within a strict 6-month timeline. The platform consists of four distinct components:

1. A Transcoding Engine running on-premises Windows Server VMs. It relies on custom GPU-accelerated libraries requiring specific OS kernel modifications. To meet the deadline, it must be migrated with no changes to the OS environment or application code.
2. A User Profiles Database running on self-managed PostgreSQL instances. The enterprise wants to eliminate the administrative overhead of OS patching and backup management but must keep the PostgreSQL database engine without modifying the application code or schema.
3. A Legacy Licensing Server that uses a physical USB hardware security dongle connected directly to an on-premises host. The software vendor does not support network-based or virtual licensing mechanisms.
4. A Metadata Catalog running on a commercial Oracle Database. The enterprise wants to eliminate licensing costs and modernize the database tier. The migration team has verified that the schema and application SQL queries can be converted to Amazon Aurora PostgreSQL using the AWS Schema Conversion Tool (SCT), and has allocated development resources to rewrite the incompatible application code.

Which combination of migration strategies represents the most appropriate alignment with the AWS 7 Rs framework for these components?

A company needs to migrate $450\text{ TB}$ of archived media files from its on-premises Network Attached Storage (NAS) to Amazon S3. The company has a dedicated outbound internet connection of $50\text{ Mbps}$ that is shared with other business operations, and the migration must be completed within 30 days. Which migration method should a solutions architect recommend to transfer this data to Amazon S3 within the required timeline?

A logistics tracking company hosts its core API services in the us-east-1 Region. The system consists of an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances across three Availability Zones. The EC2 instances process coordinates and call external mapping services via a single NAT Gateway located in a single public subnet. The backend database is an Amazon Aurora PostgreSQL DB cluster. To enhance reliability and design a disaster recovery (DR) solution, the company is targeting the us-west-2 Region. The business requires a recovery time objective (RTO) of $15$ minutes and a recovery point objective (RPO) of $5$ minutes. The network architecture in us-east-1 must also be made resilient to Availability Zone outages. Which combination of actions should a Solutions Architect recommend to satisfy these requirements? (Select TWO.)