Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1361Question →

A solutions architect is planning to migrate an on-premises Oracle database to an Amazon Aurora MySQL-Compatible Edition DB cluster. The migration must support a heterogeneous schema conversion and continuous replication using Change Data Capture (CDC) to minimize application downtime during the cutover.

Which of the following actions are required to successfully convert the schema and configure the replication process? (Select two.)

Select all that apply

Show answer & explanation

Answer: Use the AWS Schema Conversion Tool (SCT) to convert the source database schema, tables, and views to the Aurora MySQL format, and apply the schema to the target database.; Enable supplemental logging on the source Oracle database and configure the replication task in AWS DMS to capture ongoing changes.

Answer

The correct actions are using the AWS Schema Conversion Tool (SCT) to convert and apply the schema to the target database, and enabling supplemental logging on the source Oracle database to support Change Data Capture (CDC).
To perform a heterogeneous migration from Oracle to Aurora MySQL with minimal downtime, the solutions architect must first use the AWS Schema Conversion Tool (SCT) to convert the database schema and apply it to the target database. To capture ongoing changes, supplemental logging must be enabled on the source Oracle database so that AWS DMS can read the redo logs during the CDC phase.

Step-by-Step Solution

1
Analyze the source database and convert the schema.
The Oracle schema is successfully converted into MySQL-compatible DDL using AWS SCT and applied to the target Aurora MySQL DB cluster.
Heterogeneous database migrations require schema conversion before data migration because target and source SQL dialects and datatypes differ.
2
Prepare the source Oracle database for Change Data Capture (CDC).
Supplemental logging is enabled on the Oracle source database.
AWS DMS requires supplemental logging on the Oracle source to access the change data in the redo logs during continuous replication.
3
Configure and run the AWS DMS task.
A DMS task is created and executed with full load and CDC replication enabled.
This allows initial data load and continuous replication to run until the cutover window, minimizing downtime.

Key Concept

Heterogeneous database migration involves using AWS SCT for schema conversion and AWS DMS for data replication, which requires configuring source-specific prerequisites like supplemental logging for ongoing replication (CDC).
Question 1362Question →

A financial services company hosts an investment tracking application on AWS. The application's transaction ledger is stored on an Amazon Aurora MySQL database cluster with one writer and two reader instances. During end-of-month reporting cycles, read queries on the ledger spike significantly, causing CPU utilization on the reader instances to reach 100%, resulting in query timeouts. Additionally, the application requires a caching layer to store session state tokens and transient calculations. The cached data must be replicated across multiple Availability Zones to ensure high availability, and must survive potential cache node failures. Which combination of database and caching optimization strategies should the solutions architect implement to address the performance degradation and satisfy the durability and scaling requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Amazon RDS Proxy for the Aurora cluster, and configure the application to direct read-intensive ledger queries to the proxy's read-only endpoint.; Implement Amazon ElastiCache for Redis to store session state tokens, configuring Multi-AZ with automatic failover.

Answer

Deploy Amazon RDS Proxy for the Aurora cluster, configuring the application to direct read queries to the proxy's read-only endpoint, and implement Amazon ElastiCache for Redis with Multi-AZ and automatic failover for session caching.
Deploying Amazon RDS Proxy with the read-only endpoint allows the application to handle connection spikes gracefully while routing read-intensive queries to the reader replicas. Amazon ElastiCache for Redis with Multi-AZ enabled provides the replication and automatic failover needed to ensure that cached session tokens survive node failures.

Step-by-Step Solution

1
Analyze the database read performance issue.
The reader instances are hitting 100% CPU utilization due to a spike in read queries during reporting cycles, indicating a need for better connection pooling and traffic distribution.
Identifying the bottleneck ensures that the routing solution specifically targets read workloads without affecting the primary writer instance.
2
Evaluate the database routing and connection pooling options.
Deploying Amazon RDS Proxy and using its read-only endpoint pool will manage connection surges and distribute reads to Aurora Replicas.
RDS Proxy reduces database overhead from connection churn and handles read scaling transparently.
3
Analyze the caching durability and high availability requirements.
Session state and calculations must survive node failures and replicate across Availability Zones.
This requirement determines the choice of caching engine and configuration parameters.
4
Select the appropriate caching engine.
Amazon ElastiCache for Redis is selected because it supports Multi-AZ replication and failover, whereas Memcached lacks replication capabilities.
Redis satisfies the high availability and persistence requirements, while Memcached would lose data upon node failure.

Key Concept

Optimizing read scaling in Aurora using RDS Proxy, and ensuring high-availability caching with ElastiCache for Redis.
Estimated Time:3m 0s
Question 1363Question →

An enterprise is designing a new transactional ledger and reporting system. The workload requires a relational database (OLTP) that supports ACID transactions. The system must meet an RTO of less than 11 minute and an RPO of less than 55 seconds across a primary region (us−east−1us-east-1) and a secondary region (us−west−2us-west-2). Additionally, a separate reporting workload must run read-only queries against the database and scale dynamically to handle unpredictable spikes. Finally, database backups must be shared with a separate security audit account, where auditors must be able to decrypt and inspect the backups using Customer Managed Keys (CMKs) in AWS KMS.

Which two options should the solutions architect select to implement a database and storage strategy that meets these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary cluster in us−east−1us-east-1 and a secondary cluster in us−west−2us-west-2. Configure Aurora Auto Scaling for the Aurora Replicas in both regions to scale reader instances horizontally based on CPU utilization.; Encrypt the Aurora database clusters using Customer Managed Keys (CMKs) in AWS KMS. Create a custom cluster snapshot, share it with the audit account, and configure the KMS key policy in the primary account to allow the audit account's IAM principal to use the CMK for decryption.

Answer

Configure Amazon Aurora Global Database with horizontal auto scaling for reader instances, and encrypt the clusters with AWS KMS Customer Managed Keys (CMKs), sharing custom snapshots and modifying the key policy to delegate cross-account access.
The correct strategy combines Amazon Aurora Global Database for high availability, low-latency cross-region replication, and horizontally scaling read-replicas, with AWS KMS Customer Managed Keys (CMKs) for encrypted snapshot sharing. Aurora Global Database supports cross-region replication with an RPO under 55 seconds and an RTO under 11 minute via managed failover. Using CMKs is required because cross-account snapshot sharing is not supported with AWS-managed keys (`aws/rds`), and the KMS key policy must be updated to delegate decrypt permissions to the audit account.

Step-by-Step Solution

1
Analyze HA/DR requirements to select the database replication strategy.
Determine that an active-passive cross-region architecture using Amazon Aurora Global Database is necessary to meet the RTO of less than 11 minute and RPO of less than 55 seconds.
Standard backup restoration patterns cannot meet the strict recovery time objective.
2
Evaluate read-scaling strategies for the reporting tier.
Configure Aurora Auto Scaling to dynamically spin up and down reader instances based on CPU utilization.
RDS standby instances in Multi-AZ are passive and cannot serve read queries, necessitating Aurora reader scaling.
3
Determine the encryption and sharing configuration for cross-account snapshot access.
Encrypt database volumes using a Customer Managed Key (CMK), share a custom snapshot, and update the KMS key policy to permit the audit account's role to decrypt.
AWS-managed KMS keys do not allow policy modification and cannot be used for cross-account sharing.

Key Concept

Designing multi-region, highly available database topologies with horizontal read scaling and secure cross-account KMS key sharing.
Question 1364Question →

A global gaming enterprise is launching a new multiplayer gaming platform in AWS. The architecture is deployed across multiple AWS accounts in the us-east-1 region and utilizes an AWS Transit Gateway (tgw-central) to interconnect VPCs. The setup includes a Shared Services VPC (vpc-shared-prod), a centralized Egress VPC (vpc-egress-prod), and three spoke application VPCs (vpc-game-auth, vpc-game-match, and vpc-game-profile). The spoke VPCs require resolution of private DNS records in a Route 53 Private Hosted Zone (game.internal) created in the Shared Services VPC. Furthermore, an on-premises data center connected to AWS via a Direct Connect Gateway linked to the Transit Gateway needs to resolve records in game.internal. To satisfy security compliance, all outbound internet traffic from the spoke VPCs must be routed through AWS Network Firewall and NAT Gateways in vpc-egress-prod, and the architecture must remain fully resilient against Availability Zone outages. Which combination of actions should the solutions architect take to satisfy these networking and DNS requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate the Route 53 Private Hosted Zone game.internal with each of the spoke VPCs (vpc-game-auth, vpc-game-match, and vpc-game-profile). Deploy Route 53 Resolver Inbound Endpoints in vpc-shared-prod across at least two Availability Zones, and configure the on-premises DNS servers to conditionally forward DNS queries for game.internal to these inbound endpoint IP addresses.; Deploy AWS Network Firewall endpoints and NAT Gateways in vpc-egress-prod across multiple Availability Zones. Configure the route tables in the private subnets of vpc-egress-prod to route traffic to the Network Firewall endpoints, and configure the public subnet route tables to route traffic to their local, zone-specific NAT Gateways.

Answer

To meet the requirements, the solutions architect must associate the Private Hosted Zone with all spoke VPCs and deploy Route 53 Resolver Inbound Endpoints across multiple Availability Zones in the Shared Services VPC, forwarding on-premises DNS queries to them. Additionally, the architect must deploy AWS Network Firewall endpoints and NAT Gateways across multiple Availability Zones in the Egress VPC, configuring route tables to route outbound traffic through zone-specific NAT Gateways.
To satisfy the DNS requirements, the Private Hosted Zone must be associated with the spoke VPCs so they can query it locally. Deploying Route 53 Resolver Inbound Endpoints in the Shared Services VPC across multiple Availability Zones ensures highly available resolution of private domains from the on-premises data center. To satisfy the egress requirements with high availability, NAT Gateways and AWS Network Firewall endpoints must be deployed in multiple Availability Zones within the egress VPC, and subnets must route traffic through their local, zone-specific endpoints to eliminate single points of failure.

Step-by-Step Solution

1
Associate the Route 53 Private Hosted Zone game.internal with each of the spoke VPCs (vpc-game-auth, vpc-game-match, and vpc-game-profile).
DNS queries for game.internal originating from within the spoke VPCs can be resolved by the local Route 53 Resolver.
Route 53 Private Hosted Zones are only queryable from VPCs that have been explicitly associated with them.
2
Deploy Route 53 Resolver Inbound Endpoints in vpc-shared-prod across at least two Availability Zones and configure on-premises DNS conditional forwarding.
On-premises DNS servers can resolve game.internal queries by forwarding them to the inbound endpoint IP addresses.
This establishes hybrid DNS resolution, allowing on-premises clients to query the AWS-hosted Private Hosted Zone.
3
Deploy AWS Network Firewall endpoints and NAT Gateways across multiple Availability Zones in vpc-egress-prod.
Outbound egress traffic is filtered and routed via zone-redundant NAT Gateways.
Ensures high availability and prevents an Availability Zone failure from causing an outage for outbound traffic across all spoke VPCs.

Key Concept

Designing a resilient, secure hybrid network architecture with centralized egress routing and multi-VPC Route 53 Private Hosted Zone DNS resolution.
Question 1365Question →

A financial services firm runs a legacy application on Amazon EC2 instances in VPC-A under Account 1. The application must retrieve daily audit logs from an Amazon S3 bucket in VPC-B under Account 2, which is currently encrypted using the default AWS-managed S3 key (aws/s3). Currently, this access uses long-lived IAM user access keys, and traffic goes over the public internet. Additionally, the application must resolve private DNS endpoints hosted in a Route 53 Private Hosted Zone (PHZ) in Account 2. The solutions architect needs to remediate these issues by eliminating long-lived credentials, routing all S3 traffic over the AWS internal network, enabling cross-account private DNS resolution, and ensuring that all S3 data is securely accessed with custom encryption keys. Which two of the following actions should the solutions architect perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a VPC association authorization from Account 2 to authorize VPC-A in Account 1 to associate with the Route 53 Private Hosted Zone, and then associate VPC-A with the Private Hosted Zone from Account 1.; Re-encrypt the S3 bucket using a Customer Managed Key (CMK) in Account 2. Configure the CMK's key policy and the S3 bucket policy to grant read access to the EC2 instance profile role in Account 1, and configure a Gateway VPC Endpoint for S3 in VPC-A.

Answer

The solutions architect should associate the Private Hosted Zone with VPC-A using the VPC association authorization workflow, and re-encrypt the S3 bucket using a Customer Managed Key (CMK) while granting permissions to the EC2 instances' role and configuring a Gateway VPC Endpoint.
To resolve private hosted zones across accounts, a VPC association authorization must be created in the owner account and then accepted/executed in the target VPC's account. For secure cross-account S3 access, a Customer Managed Key (CMK) is required because AWS-managed key policies cannot be modified to grant permissions to external accounts. Configuring a Gateway VPC Endpoint for S3 in the client VPC ensures all traffic remains within the AWS global network, and assigning an EC2 instance profile role replaces static, long-lived credentials with secure, temporary credentials.

Step-by-Step Solution

1
Submit a VPC association authorization from Account 2 for VPC-A, then associate VPC-A with the Route 53 Private Hosted Zone in Account 1.
VPC-A can resolve the private DNS endpoints hosted in Account 2.
Route 53 Private Hosted Zones cannot be shared via AWS Resource Access Manager and must be associated across accounts using the authorization workflow.
2
Re-encrypt the S3 bucket in Account 2 using a Customer Managed Key (CMK) instead of the default AWS-managed key.
A key policy is created that can be edited to support cross-account access.
AWS-managed key policies cannot be modified, which makes them unusable for cross-account S3 access.
3
Configure the KMS CMK key policy and the S3 bucket policy to allow access to the EC2 instance profile role from Account 1.
The application instances can access and decrypt S3 objects without long-lived credentials.
This establishes access control using temporary credentials provided by the EC2 instance profile.
4
Configure a Gateway VPC Endpoint for S3 in the route tables of VPC-A.
Traffic to S3 from VPC-A is routed privately via the AWS network.
This satisfies the requirement to prevent S3 data transit over the public internet.

Key Concept

Cross-account secure resource access and private DNS resolution in multi-account AWS environments.
Question 1366Question →

An enterprise is planning to migrate its inventory planning system to AWS within a tight three-week timeline. The system consists of three components:

1. A Java-based web application layer running on physical Linux servers that requires no code changes.
2. A backend Oracle database running on physical hardware with extensive proprietary PL/SQL stored procedures. The enterprise wants to eliminate commercial database licensing costs by migrating to a fully managed PostgreSQL engine.
3. A legacy audit utility that requires a physical USB licensing dongle attached to local hardware, which is only executed once per year for compliance auditing.

Which of the following migration strategies represent the most appropriate migration paths for these components based on the 7 Rs framework? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Rehost the Java-based web application layer to Amazon EC2 instances to meet the migration timeline.; Refactor the backend Oracle database by converting the schema and stored procedures to Amazon Aurora PostgreSQL.

Answer

The correct strategies are to rehost the Java-based web application layer to Amazon EC2 and refactor the backend Oracle database by converting the schema and stored procedures to Amazon Aurora PostgreSQL.
Rehosting the Java web application is the correct strategy because it meets the urgent three-week migration window without requiring code changes. Refactoring the database is correct because migrating from Oracle to Aurora PostgreSQL requires schema conversion and rewriting stored procedures, which alters the application code and database architecture.

Step-by-Step Solution

1
Analyze the web application tier constraints.
The web application tier requires no code changes and has a tight three-week migration timeline.
Rehosting (lift-and-shift) is the fastest migration method and is appropriate when no code changes are needed and time is limited.
2
Analyze the database tier requirements and modifications.
The database needs to change engines (Oracle to PostgreSQL) and has extensive proprietary PL/SQL stored procedures that must be converted.
Changing the database engine and converting database code/stored procedures is a Refactor (Re-architect) migration strategy, not a Replatform.
3
Analyze the legacy audit utility constraints.
The utility requires a physical USB licensing dongle and is rarely used (once per year).
AWS EC2 and Fargate do not support physical USB device attachments. Because of this hardware licensing dependency and low usage, the utility should be Retained on-premises.

Key Concept

Selecting the correct migration strategy (Rehost, Replatform, Refactor, Retain) based on application constraints, licensing, and database dependencies.
Question 1367Question →

An enterprise is improving the security posture of an existing internal administration portal hosted in a Shared Services VPC. The application runs on Amazon EC2 instances behind an internal Application Load Balancer (ALB). Users access the portal from the on-premises network via an AWS Transit Gateway connected to an AWS Direct Connect gateway. Remote administrators must also access the portal, authenticating via an external OpenID Connect (OIDC) identity provider. The security team wants to prevent DNS exfiltration from the EC2 instances and ensure that remote administrator access is restricted to corporate-approved devices. Which of the following actions should the Solutions Architect recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate a Route 53 Resolver DNS Firewall rule group with the Shared Services VPC to block DNS queries for known exfiltration domains and non-approved external domains.; Configure the internal ALB listener rule to authenticate remote administrators directly using OIDC with the external IdP, and configure the backend application to validate the authentication tokens and device claims.

Answer

Associate a Route 53 Resolver DNS Firewall rule group with the Shared Services VPC to block DNS queries for known exfiltration domains, and configure the internal ALB listener rule to authenticate remote administrators directly using OIDC with the external IdP while verifying device claims in the application.
The correct actions are to associate a Route 53 Resolver DNS Firewall rule group with the Shared Services VPC to block DNS exfiltration and configure the Application Load Balancer (ALB) to perform OIDC authentication for remote administrators, passing the verified claims to the backend application. Route 53 Resolver DNS Firewall filters outbound DNS queries to block unauthorized domains, satisfying the network security requirement. ALB OIDC integration offloads federated authentication securely, allowing the application to enforce device compliance by checking the ID token claims.

Step-by-Step Solution

1
Analyze the network layer requirement to prevent DNS-based data exfiltration from the private EC2 instances in the Shared Services VPC.
Route 53 Resolver DNS Firewall provides a native way to monitor and filter outbound DNS queries for VPC resources.
By blocking queries for non-approved or malicious domains, you prevent exfiltration channels that rely on DNS tunneling.
2
Evaluate the identity and access management requirements for remote administrators using OIDC.
ALB natively supports OIDC user authentication.
Offloading OIDC authentication to the ALB simplifies implementation, while verifying device claims in the application ensures only approved devices access the admin tool.
3
Identify and eliminate invalid configuration patterns from the other options.
Eliminate the option referencing SCP granting access, the option referencing invalid AWS WAF rule ordering, and the option referencing cross-account AWS-managed KMS key delegation.
SCPs cannot grant permissions, WAF rules evaluate sequentially (matching early allows bypasses blocks), and AWS-managed KMS key policies cannot be modified for cross-account delegation.

Key Concept

Strengthening network and identity security using Route 53 Resolver DNS Firewall, Application Load Balancer OIDC integration, and avoiding common misconfigurations in AWS SCPs, AWS WAF rule priorities, and KMS key types.
Question 1368Question →

A financial technology firm operates an algorithmic trading data collection service on Amazon EC2 instances in an Auto Scaling group (ASG) across three Availability Zones. The instances reside in private subnets and send real-time market telemetry to external API endpoints. The instances require a 6-minute bootstrapping process to download and compile trading configurations before they can begin collecting data. Every day at 09:30 UTC, when markets open, telemetry traffic surges by 400% in under 1 minute, causing the Application Load Balancer (ALB) to return HTTP 503 errors for the first 10 minutes. During this surge, the ASG launches excessive instances that end up idle and inflate costs. Furthermore, a failure in Availability Zone A disrupts all outbound telemetry from instances in other zones. Which two actions should a solutions architect take to resolve these issues and optimize scalability and fault tolerance? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a NAT Gateway in each of the three Availability Zones, and configure the route tables of the private subnets in each zone to route internet-bound traffic through the local NAT Gateway in that specific zone.; Change the Auto Scaling group scaling policy to target tracking, and set the instance warmup period to 420 seconds to ensure the system waits for new instances to complete bootstrapping before launching more.

Answer

To resolve these issues, deploy a NAT Gateway in each of the three Availability Zones with localized route tables, and change the Auto Scaling group scaling policy to target tracking with an instance warmup period set to 420 seconds.
Deploying a NAT Gateway in each Availability Zone provides high availability and fault tolerance for outbound internet-bound traffic, removing the single point of failure associated with a single NAT Gateway. In addition, setting the Auto Scaling group instance warmup period to 420 seconds (which is longer than the 6-minute bootstrapping time) ensures that the scaling policy does not continuously launch unnecessary instances during the boot phase, as it allows the newly launched instances to begin processing requests and lower the average metric before another scaling decision is made.

Step-by-Step Solution

1
Address the single point of failure in outbound traffic routing.
Deploying a dedicated NAT Gateway in each of the three Availability Zones and pointing each private subnet's route table to its local NAT Gateway ensures that an outage in one zone does not impact outbound telemetry from the remaining active zones.
This establishes Availability Zone independence and high availability for outbound traffic.
2
Address the instance over-provisioning and scaling latency during bootstrapping.
Transition to a target tracking policy and configure the instance warmup to 420 seconds (7 minutes).
Since the bootstrapping process takes 6 minutes (360 seconds), the warmup period must be longer than this boot duration. This tells the Auto Scaling group to wait until the new instances are fully operational and contributing metrics before evaluating if additional instances are required, preventing excessive scale-out.

Key Concept

Configuring Multi-AZ NAT Gateways for fault tolerance and optimizing Auto Scaling group warmup periods to match instance bootstrapping times to prevent metric lag issues.
Question 1369Question →

A company hosts a web application on AWS ECS Fargate behind an Application Load Balancer (ALB). The security team wants to strengthen the network security posture of this existing application by implementing AWS WAF. The solution must meet the following requirements:
1. Immediately block traffic from known malicious IP addresses.
2. Protect the application against SQL injection (SQLi) attacks.
3. Rate-limit general client requests to 120 requests per minute.
4. Allow a specific business partner's static IP range to bypass the rate limit, while ensuring their traffic is still inspected for SQLi.

Which of the following configuration strategies for the AWS WAF Web ACL rules meets these security requirements?

Show answer & explanation

Answer: Configure the Web ACL with Priority 1: SQLi block rule (Block action), Priority 2: Malicious IP block rule (Block action), Priority 3: Partner IP rule (Allow action), Priority 4: Rate-limiting rule (Block action), and Default Action: Allow.

Answer

Configure the Web ACL with Priority 1: SQLi block rule (Block action), Priority 2: Malicious IP block rule (Block action), Priority 3: Partner IP rule (Allow action), Priority 4: Rate-limiting rule (Block action), and Default Action: Allow.
The correct strategy places the SQLi block and malicious IP block rules at the highest priorities (Priority 1 and 2), followed by the partner IP allow rule (Priority 3), and finally the rate-limiting rule (Priority 4). Since AWS WAF evaluates rules sequentially, a partner request is first inspected for SQLi. If it is safe, it matches the partner IP rule, which has a terminating Allow action. This stops evaluation, allowing the request and ensuring it bypasses the rate-limiting rule at Priority 4. For general clients, they pass the partner rule and are successfully evaluated by the rate-limiting rule.

Step-by-Step Solution

1
Identify the order of evaluation for AWS WAF rules.
AWS WAF processes rules sequentially starting from the lowest priority number (Priority 1).
Understanding rule precedence is critical because matching a rule with a terminating action (like Allow or Block) stops further rule evaluation.
2
Determine the placement of block rules versus allow rules.
SQLi block and malicious IP block must be evaluated before the partner allow rule.
If the partner rule is evaluated first, legitimate partner traffic containing malicious SQLi payloads would be allowed without inspection due to the terminating Allow action.
3
Determine the placement of the rate-limiting rule relative to the partner rule.
The rate-limiting rule must be evaluated after the partner allow rule.
A terminating Allow action for the partner IP stops evaluation, preventing it from hitting the subsequent rate-limiting rule, while general clients continue to be evaluated.

Key Concept

AWS WAF rule evaluation order and action behaviors
Estimated Time:1m 30s
Question 1370Question →

An enterprise has consolidated billing enabled under AWS Organizations with 33 active AWS accounts:

* Account A (Web Application): Hosts an API on Amazon ECS on AWS Fargate. The tasks run in private subnets across 33 Availability Zones. The tasks download large application packages from Amazon S3 and pull container images from Amazon ECR. A single NAT Gateway is used in a public subnet to provide outbound internet access for the tasks to communicate with ECS, ECR, S3, and CloudWatch. No other outbound internet access is required.
* Account B (Data Processing): Runs a monthly batch-processing application on a fleet of Amazon EC2 `r6i.xlarge` instances (32 GiB32\text{ GiB} RAM). CPU utilization averages 10%10\% and memory utilization averages 15%15\% for most of the month. However, during the 48-hour48\text{-hour} monthly run, memory utilization peaks at 82%82\% (approximately 26 GiB26\text{ GiB}) while CPU utilization reaches 45%45\%.
* Account C (Data Ingestion): Uses AWS Lambda functions to process streaming data and write it to Amazon DynamoDB.

The enterprise wants to minimize total AWS costs across all accounts. The architecture must remain highly available, support the performance requirements of the monthly batch processing without operational failures, and minimize operational overhead.

Which TWO actions should the Solutions Architect recommend to optimize resources and reduce costs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account A, deploy a VPC Gateway Endpoint for Amazon S3 and VPC Interface Endpoints for Amazon ECS, Amazon ECR, and Amazon CloudWatch in the VPC. Configure the Fargate tasks to use these endpoints, and delete the NAT Gateway.; Purchase a Compute Savings Plan at the AWS Organizations management account level. In Account B, implement an automated script to stop the EC2 instances, change their type to `r6i.large` (16 GiB16\text{ GiB} RAM) during off-peak periods, and resize them back to `r6i.xlarge` (32 GiB32\text{ GiB} RAM) only for the 48-hour48\text{-hour} monthly batch-processing window.

Answer

Deploy Gateway and Interface VPC Endpoints in Account A to replace the NAT Gateway, and purchase a Compute Savings Plan while dynamically resizing Account B's EC2 instances between `r6i.large` and `r6i.xlarge` to accommodate the monthly batch peak.
Replacing the NAT Gateway with VPC endpoints (Gateway for S3, Interface for ECS, ECR, and CloudWatch) eliminates the NAT Gateway hourly and data processing fees for Account A since the Fargate tasks do not require external internet access. Purchasing a Compute Savings Plan at the management account level applies discounts across Fargate, Lambda, and EC2 workloads in all accounts. In Account B, resizing the EC2 instances to `r6i.large` during off-peak times and resizing them to `r6i.xlarge` during the 48-hour48\text{-hour} batch window ensures that the peak memory requirement of 26 GiB26\text{ GiB} is met without paying for overprovisioned resources for the rest of the month.

Step-by-Step Solution

1
Analyze Account A workloads and network costs.
Fargate tasks communicate only with AWS services (S3, ECR, ECS, CloudWatch). NAT Gateway costs can be eliminated by replacing them with a Gateway VPC Endpoint for S3 (which is free) and Interface VPC Endpoints (AWS PrivateLink) for ECS, ECR, and CloudWatch.
This eliminates NAT Gateway hourly charges and data processing fees ($0.045 per GB) which are typically high for container image pulls and package downloads.
2
Analyze Account B workloads and sizing.
The EC2 instances average low utilization (10%10\% CPU, 15%15\% memory) but peak at 82%82\% memory (approx. 26 GiB26\text{ GiB}) during a 48-hour48\text{-hour} window. Resizing the instances to `r6i.large` (16 GiB16\text{ GiB}) during off-peak times and resizing them to `r6i.xlarge` (32 GiB32\text{ GiB}) during the batch run meets the requirements without causing out-of-memory failures.
If they were permanently resized to a smaller size like `r6i.large` or a burstable type like `t3.xlarge` (16 GiB16\text{ GiB}), the batch job would fail due to insufficient memory during the peak run.
3
Determine the appropriate Savings Plan type and scope.
A Compute Savings Plan purchased at the management account level provides the highest flexibility, covering EC2, Fargate, and Lambda across all member accounts.
EC2 Instance Savings Plans are limited to EC2 and do not cover Fargate or Lambda workloads. Consolidating the purchase at the management account level allows the discount to apply to all accounts under the consolidated billing organization.

Key Concept

Multi-account cost optimization utilizing Compute Savings Plans, dynamic EC2 right-sizing based on peak memory demands, and replacing NAT Gateways with VPC Endpoints for AWS services.
Question 1371Question →

An online booking system runs in a production AWS account under an AWS Organizations organization. The application uploads travel reservation documents containing personally identifiable information (PII) to an Amazon S3 bucket located in a separate dedicated compliance AWS account. The security team must ensure that all uploaded documents are encrypted at rest using a customer managed key (CMK) managed within the compliance account. The solution must enforce this encryption requirement for all uploads and allow the application to write to the bucket with minimal administrative overhead. Which combination of configurations will meet these requirements?

Show answer & explanation

Answer: In the compliance account, create a KMS CMK and update its key policy to allow the production account's IAM role to perform kms:GenerateDataKey and kms:Decrypt operations. Configure the S3 bucket policy to deny s3:PutObject requests that do not specify aws:kms as the encryption type and do not specify the compliance account's CMK ARN. In the production account, attach an IAM policy to the application's IAM role allowing s3:PutObject on the compliance S3 bucket, and kms:GenerateDataKey and kms:Decrypt on the compliance account's CMK.

Answer

In the compliance account, create a KMS CMK and update its key policy to allow the production account's IAM role to perform kms:GenerateDataKey and kms:Decrypt operations. Configure the S3 bucket policy to deny s3:PutObject requests that do not specify aws:kms as the encryption type and do not specify the compliance account's CMK ARN. In the production account, attach an IAM policy to the application's IAM role allowing s3:PutObject on the compliance S3 bucket, and kms:GenerateDataKey and kms:Decrypt on the compliance account's CMK.
The correct option outlines the proper cross-account security setup for S3 and KMS. A Customer Managed Key must be used because its key policy can be modified to trust external accounts. Permissions must be explicitly declared on both the KMS key policy (in the destination account) and the IAM policy (in the source account) for the upload to succeed. The S3 bucket policy then acts as a compliance guardrail by denying uploads that do not specify the correct KMS key.

Step-by-Step Solution

1
Configure the cross-account KMS Key Policy in the destination account.
The KMS Customer Managed Key (CMK) policy in the compliance account is updated to allow the IAM role of the application in the production account to perform kms:GenerateDataKey and kms:Decrypt.
Since AWS managed KMS keys cannot be shared across accounts, a Customer Managed Key must be used, and its policy must explicitly grant cross-account permissions.
2
Configure the S3 Bucket Policy in the destination account to enforce encryption compliance.
The bucket policy denies any s3:PutObject request that does not include the x-amz-server-side-encryption header set to aws:kms or does not target the specific CMK ARN.
This enforces data compliance at the bucket boundary, preventing unencrypted uploads or uploads encrypted with arbitrary keys.
3
Configure IAM policies in the source production account.
The production account's IAM role is updated to allow s3:PutObject on the destination bucket and kms:GenerateDataKey and kms:Decrypt on the compliance account's CMK.
For cross-account access, permissions must be granted on both sides: the resource policies (S3 bucket policy and KMS key policy) and the caller's IAM policy.

Key Concept

Cross-account S3 bucket uploads with AWS KMS encryption require explicit permissions on both the S3 bucket and the KMS key policy, which can only be achieved using Customer Managed Keys (CMKs) and not AWS managed keys.
Question 1372Question →

A company wants to transfer 100 TB100\text{ TB} of data from its on-premises Network Attached Storage (NAS) to Amazon S3. The company has a 20 Mbps20\text{ Mbps} internet connection that is currently at 80%80\% utilization. The migration must be completed within 14 days. Security requirements mandate that all data must be encrypted at rest during transit and in Amazon S3 using a customer managed key. Which two options should the solutions architect select to perform this transfer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Order an AWS Snowball Edge Storage Optimized device to copy the data locally and ship it to AWS.; Configure the AWS Snowball Edge job using a customer managed AWS KMS key for encryption.

Answer

Order an AWS Snowball Edge Storage Optimized device to copy the data locally and ship it to AWS, and configure the AWS Snowball Edge job using a customer managed AWS KMS key for encryption.
The correct options are to order an AWS Snowball Edge Storage Optimized device to physically transport the data and to configure the job using a customer managed key. With a 100 TB100\text{ TB} dataset and a highly constrained network link, physical transfer via Snowball is required to complete the migration within the 14-day limit. Additionally, the compliance mandate for a customer managed key requires specifying a Customer Managed Key (CMK) during the job creation rather than using the default AWS managed key.

Step-by-Step Solution

1
Calculate the network transfer time.
100 TB100\text{ TB} of data over 20 Mbps20\text{ Mbps} of bandwidth (with only 4 Mbps4\text{ Mbps} available) will take more than a year to transfer. Therefore, an offline transfer using AWS Snowball Edge is required to meet the 14-day migration window.
To determine whether online or offline transfer is appropriate based on the network bandwidth and migration timeline constraints.
2
Select the correct encryption key type.
The security policy mandates a customer managed key. An AWS managed key like `aws/s3` cannot satisfy this custom security requirement because its policy cannot be modified. A customer managed key must be specified during the creation of the Snowball Edge job.
To satisfy security and compliance constraints requiring customer-controlled keys.

Key Concept

Determining physical vs. network data transfer mechanisms based on bandwidth constraints, and applying KMS customer managed keys for compliance.
Question 1373Question →

A company operates a critical customer portal on AWS. The primary environment runs in the us-west-2 Region and consists of an Application Load Balancer (ALB) directing traffic to Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The instances require internet access for external payment API calls, which is currently routed through a single NAT Gateway in one public subnet. The application uses a Route 53 Private Hosted Zone (PHZ) for internal service discovery. The database layer is an Amazon Aurora PostgreSQL Global Database with a primary cluster in us-west-2 and a read-only secondary cluster in us-east-1.

The company wants to enhance disaster recovery (DR) by implementing an active-passive cross-region strategy with a target recovery time objective (RTO) of 20 minutes and a recovery point objective (RPO) of 5 minutes. During a DR simulation, the operations team observes that outbound payment calls fail if the Availability Zone containing the NAT Gateway goes down, and internal service names do not resolve in the secondary Region after a manual failover.

Which combination of actions should a solutions architect recommend to resolve these issues and meet the DR objectives?

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone in us-west-2 and update the private subnet route tables. Associate the existing Route 53 Private Hosted Zone with the VPC in us-east-1. Configure Route 53 failover routing records for the public domain, associating the primary record with a Route 53 health check that monitors the primary ALB. In a disaster scenario, fail over the Amazon Aurora Global Database to us-east-1.

Answer

Deploy a NAT Gateway in each Availability Zone in the primary region, associate the existing Private Hosted Zone with the secondary VPC, configure Route 53 failover records with a primary health check, and fail over the Amazon Aurora Global Database.
The correct option correctly addresses all three identified resilience and DR issues: it provides high availability for outbound traffic by deploying a NAT Gateway per Availability Zone, ensures consistent internal service name resolution by associating the existing Private Hosted Zone with the secondary VPC, establishes automatic DNS redirection by using Route 53 failover routing with a health check, and preserves data consistency within RPO/RTO limits by utilizing Aurora Global Database failover capabilities.

Step-by-Step Solution

1
Ensure high availability for outbound traffic by deploying a NAT Gateway in each Availability Zone in us-west-2 and adjusting the private subnet route tables.
Outbound connectivity to the external payment API is resilient to Availability Zone outages.
Eliminating a single NAT Gateway removes a single point of failure for the application servers when accessing external endpoints.
2
Associate the existing Route 53 Private Hosted Zone with the secondary Region's VPC in us-east-1.
Internal DNS records are successfully resolved within the secondary VPC during a disaster recovery event.
Route 53 Private Hosted Zones must be explicitly associated with any VPCs that need to resolve the internal domain names.
3
Configure Route 53 failover routing for the public domain and create a Route 53 health check targeting the primary Application Load Balancer.
DNS requests are automatically routed to the secondary Region if the primary Region's endpoint becomes degraded.
Active-passive failover requires Route 53 health checks to detect primary endpoint failures and redirect traffic.
4
Initiate a failover of the Amazon Aurora Global Database to the us-east-1 cluster.
The secondary cluster is promoted to primary, allowing read/write operations to resume with minimal data loss.
Aurora Global Database replication is highly efficient, allowing promote/failover actions that meet strict RTO (20 minutes) and RPO (5 minutes) targets.

Key Concept

Disaster recovery failover coordination, multi-AZ outbound path redundancy, Private Hosted Zone VPC association, and global database promotion.
Estimated Time:2m 0s
Question 1374Question →

A digital telehealth platform retrieves patient medical histories from an Amazon RDS for PostgreSQL database. During peak consulting hours, database CPU utilization frequently exceeds 85%, primarily due to repetitive read queries retrieving static medical reports. The platform requires a caching layer to offload these read queries. The cache must support replication to prevent cold-start latency in case of a node failure, and it must offer automatic failover across multiple Availability Zones to ensure high availability. Which caching strategy should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster in a Multi-AZ replication group to cache the patient history query results.

Answer

Deploy an Amazon ElastiCache for Redis cluster in a Multi-AZ replication group to cache the patient history query results.
Deploying Amazon ElastiCache for Redis in a Multi-AZ replication group fulfills the performance and high availability requirements. Redis supports primary-replica replication and automatic failover. If the primary node fails, a replica is automatically promoted, ensuring the cache remains populated and preventing latency spikes due to database cold-starts.

Step-by-Step Solution

1
Analyze the application caching and high availability requirements.
The target caching solution must support data replication (to prevent cold-starts on node failure) and automatic failover across multiple Availability Zones.
This establishes the technical criteria needed to filter out incompatible caching engines and services.
2
Compare ElastiCache engines (Redis vs. Memcached) against the requirements.
Redis supports replication and Multi-AZ failover, whereas Memcached operates on non-replicated partitioned nodes and lacks automatic failover.
Memcached is eliminated because a node failure would cause data loss, leading to a cache cold-start and database load spikes.
3
Evaluate the suitability of RDS Proxy and DynamoDB Accelerator (DAX).
RDS Proxy does not cache SQL query results, and DAX is incompatible with relational databases like RDS for PostgreSQL.
This eliminates options that are architecturally incorrect or unsupported for PostgreSQL databases.

Key Concept

Selecting the correct caching engine (Redis vs. Memcached) based on replication, high availability, and database compatibility requirements.
Estimated Time:1m 30s
Question 1375Question →

An enterprise manages a multi-account environment within an organization in AWS Organizations. The consolidated billing feature is enabled.

- Account A runs a containerized batch-processing application on Amazon ECS with AWS Fargate, alongside short-lived webhook handlers running on AWS Lambda.
- Account B runs a set of high-availability backend APIs on Amazon EC2 m6i.xlarge\text{m6i.xlarge} instances (44 vCPUs, 16 GB16\text{ GB} memory) deployed across three Availability Zones. Average CPU utilization is consistently under 25%25\%, and memory utilization is under 30%30\%. The instances require at least 50 GB50\text{ GB} of local NVMe SSD storage for caching.
- Outbound internet traffic for both accounts currently flows through three NAT Gateways (one per Availability Zone) in each VPC.

The enterprise wants to optimize resource costs across both accounts while ensuring high availability for all workloads and outbound traffic paths with minimal operational effort.

Which TWO recommendations should the solutions architect make to achieve these goals? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account B, change the EC2 instance type from m6i.xlarge to m6id.large to match the actual CPU and memory utilization while retaining the required local NVMe SSD storage.; Purchase Compute Savings Plans in the management account of the organization to cover Fargate, Lambda, and EC2 compute costs across both member accounts.

Answer

The correct recommendations are to right-size the EC2 instances in Account B to m6id.large and purchase Compute Savings Plans in the organization's management account.
Right-sizing the EC2 instances in Account B from m6i.xlarge to m6id.large successfully aligns the instance capacity with the actual resource consumption (which requires less than 1 vCPU and 4.8 GB memory) while retaining the critical local NVMe SSD storage requirement. Additionally, purchasing Compute Savings Plans in the organization's management account provides the necessary flexibility to automatically apply discounts across Fargate, Lambda, and EC2 instances across both member accounts.

Step-by-Step Solution

1
Analyze resource utilization and constraints in Account B.
Peak utilization is under 1 vCPU1\text{ vCPU} (25%25\% of 44 vCPUs) and under 4.8 GB4.8\text{ GB} of RAM (30%30\% of 16 GB16\text{ GB}). A storage capacity of at least 50 GB50\text{ GB} of local NVMe SSD is required.
This establishes that the instances can be safely downsized to a smaller instance type within the same family that includes local NVMe storage (represented by the 'd' suffix).
2
Select the correct target instance type.
The m6id.large instance provides 22 vCPUs, 8 GB8\text{ GB} of RAM, and a 59 GB59\text{ GB} NVMe SSD.
It matches the resource limits and NVMe storage requirements without changing processor architectures, keeping operational effort low.
3
Determine the optimal Savings Plan type for a multi-account environment containing Fargate, Lambda, and EC2.
Compute Savings Plans are selected.
Compute Savings Plans apply globally across all accounts and cover EC2, Fargate, and Lambda, whereas EC2 Instance Savings Plans are limited to EC2 instances.
4
Evaluate and reject options that violate high availability or sharing constraints.
Reject NAT Gateway consolidation and invalid RAM configurations.
Reducing NAT Gateways creates a single point of failure, violating the high availability constraint. Subnet sharing to external accounts via RAM will fail without explicitly enabling sharing outside the organization.

Key Concept

Optimizing multi-account compute spend using Compute Savings Plans to cover mixed compute architectures (EC2, Fargate, Lambda) while right-sizing EC2 instances using historical metrics without losing critical hardware capabilities like local NVMe SSD storage.
Question 1376Question →

A global retail company runs a containerized microservices application on Amazon ECS (with Amazon EC2 launch type) across a multi-account environment managed by AWS Organizations. The EC2 container instances are configured and maintained using AWS Systems Manager (SSM) State Manager associations. Recently, local SRE teams in the spoke accounts have been manually modifying the SSM State Manager associations and direct EC2 configurations to troubleshoot issues, leading to widespread compliance violations and deployment failures due to configuration drift. The Solutions Architect must implement a strategy to automate drift remediation for these associations and prevent unauthorized local modifications. Which strategy should the Solutions Architect implement to meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Deploy an AWS Config organization conformance pack containing the ssm-association-compliance-status rule. Associate an AWS Systems Manager Automation runbook as the remediation target to automatically update the association back to its defined state when non-compliance is detected. Implement a Service Control Policy (SCP) at the organizational unit (OU) level that denies ssm:UpdateAssociation and ssm:DeleteAssociation actions, unless the calling principal is the central CloudFormation administration IAM role.

Answer

Deploying an AWS Config organization conformance pack containing the ssm-association-compliance-status rule, associating an AWS Systems Manager Automation runbook as the remediation target, and implementing a Service Control Policy (SCP) at the OU level that denies modification of SSM associations unless the principal is the central CloudFormation administration IAM role.
The correct strategy combines automated drift detection using AWS Config conformance packs, automated self-healing remediation via SSM Automation runbooks, and preventive controls via SCPs with specific exceptions for the central deployment role. This ensures compliance without breaking automated pipelines or causing service disruptions.

Step-by-Step Solution

1
Configure drift detection and centralized monitoring.
Create an AWS Config organization conformance pack with the ssm-association-compliance-status rule to detect when SSM State Manager associations are modified locally in spoke accounts.
AWS Config provides a standardized way to continuously evaluate configurations and trigger automated actions upon non-compliance.
2
Establish automated remediation.
Associate an AWS Systems Manager Automation runbook that executes the association update back to compliance once AWS Config reports a non-compliant state.
This automatically corrects manual drift in spoke accounts without requiring manual SRE intervention.
3
Enforce preventive governance controls using Service Control Policies.
Apply an SCP denying ssm:UpdateAssociation and ssm:DeleteAssociation to the OUs, adding a StringNotEquals condition for the Arn of the central deployment/administration IAM role.
This prevents local administrators from introducing drift while ensuring that the central automation pipelines can still perform authorized updates.

Key Concept

Continuous drift detection, automated remediation using AWS Config and Systems Manager Automation, and Organization-level governance via Service Control Policies.
Estimated Time:2m 30s
Question 1377Question →

A digital publishing company operates a high-traffic news website with a global audience. The website's user session state and personalized content recommendations are managed by an Amazon RDS for MySQL database. During major breaking news events, the website experiences massive traffic spikes, leading to high CPU utilization and database connection exhaustion on the RDS database due to a massive volume of session read and write operations. The company wants to optimize the database performance and reduce latency by offloading the session management to an in-memory caching tier. The session data must meet the following requirements:
- Retrieve and update session data with sub-millisecond latency.
- Scale horizontally to handle sudden traffic spikes.
- Support data persistence and backup/restore capabilities to recover user session state in the event of an outage.
- Support replication across multiple Availability Zones with automatic failover to maintain high availability.

Which solution should a solutions architect recommend to meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Migrate the session state management to an Amazon ElastiCache for Redis cluster with Multi-AZ enabled and automatic failover, and configure automatic backups to Amazon S3.

Answer

Migrate the session state management to an Amazon ElastiCache for Redis cluster with Multi-AZ enabled and automatic failover, and configure automatic backups to Amazon S3.
Migrating the session state to Amazon ElastiCache for Redis is the optimal solution because Redis natively supports sub-millisecond key-value operations, horizontal scaling, Multi-AZ replication with automatic failover, and snapshot backups to Amazon S3 to satisfy the data persistence requirement.

Step-by-Step Solution

1
Analyze the application requirements: sub-millisecond response times, horizontal scalability, high availability via multi-AZ replication, automatic failover, and data persistence/backups.
Determine that an in-memory caching layer is required to offload transient read/write session workloads from Amazon RDS for MySQL.
Relational databases are not designed to scale cost-effectively under extremely high-volume, transient session read/write loads.
2
Compare the features of Amazon ElastiCache for Redis and Amazon ElastiCache for Memcached.
Select Redis because it natively supports Multi-AZ replication, automatic failover, snapshot backups, and data persistence, whereas Memcached does not support these features.
Memcached is designed for simple, non-persistent, partitioned caching and cannot meet high availability or data recovery requirements natively.
3
Evaluate alternative database scaling strategies, such as RDS Multi-AZ standby read offloading or cross-region pilot light DR.
Rule out the RDS standby instance since it does not accept read connections, and rule out the cross-region pilot light because it lacks real-time synchronization and low-latency access.
Only RDS Read Replicas or Aurora Replicas can handle read queries; standby instances are passive. Pilot light architectures cannot maintain real-time user session state across regions within the required latency threshold.

Key Concept

Selecting the correct in-memory caching engine (Redis vs. Memcached) based on replication, high availability, and persistence requirements.
Estimated Time:2m 0s
Question 1378Question →

A logistics company runs an on-demand delivery platform. The backend API layer runs on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate and connects to an Amazon Aurora PostgreSQL database cluster. During peak morning dispatch periods, database CPU utilization exceeds 95%95\% and the application experiences connection exhaustion, leading to degraded query response times. Application analysis reveals a high volume of read queries for delivery driver session states and route calculations. The application requires that driver session states be cached with sub-millisecond latency. Furthermore, the cache must survive node restarts and support replication across multiple Availability Zones to maintain high availability. Additionally, the database connections must be managed efficiently to handle high connection spikes from the containerized tasks.

Which of the following actions should a Solutions Architect recommend to improve database and caching efficiency? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster with replication and automatic failover enabled to cache the session states.; Implement Amazon RDS Proxy to manage connection pooling and reduce CPU overhead on the database cluster.

Answer

Deploy an Amazon ElastiCache for Redis cluster with replication and automatic failover enabled to cache the session states, and implement Amazon RDS Proxy to manage connection pooling and reduce CPU overhead on the database cluster.
Deploying Amazon ElastiCache for Redis fulfills the requirements for low latency, cross-AZ replication, and persistence to survive node restarts. Implementing Amazon RDS Proxy effectively pools and manages connection handshakes between the scaling containerized tasks and the Aurora PostgreSQL cluster, reducing connection exhaustion and database CPU utilization.

Step-by-Step Solution

1
Evaluate the caching requirements for session states.
Identify that the cache requires sub-millisecond latency, replication across multiple Availability Zones, and persistence to survive node restarts.
This rules out Amazon ElastiCache for Memcached, which does not support replication, automatic failover, or persistence features.
2
Address the connection exhaustion and high CPU utilization on the database.
Determine that containerized Fargate tasks frequently opening and closing connections cause CPU spikes and pool exhaustion.
Implementing Amazon RDS Proxy pools connections, reducing CPU usage and resolving connection exhaustion.

Key Concept

Selecting the appropriate caching engine (Redis vs. Memcached) based on persistence/replication requirements, and resolving database connection overhead using Amazon RDS Proxy.
Estimated Time:2m 0s
Question 1379Question →

An enterprise is executing a large-scale migration of its core portfolio to AWS and wants to select the appropriate migration strategies based on the 7 Rs framework. The portfolio contains the following applications:

1. Application 1: A customer billing portal built on a custom Java framework running on Apache Tomcat. The development team has no capacity for code modifications. The enterprise wants to eliminate OS-level patching, configuration management, and server provisioning, and prefers a managed containerized platform like AWS Fargate.
2. Application 2: A risk-analytics engine that uses an on-premises Oracle Database Enterprise Edition. The enterprise wants to migrate the database to Amazon Aurora PostgreSQL to eliminate expensive licensing costs. This will require database schema conversion and application code modifications.
3. Application 3: A legacy inventory forecasting tool running on a specialized IBM AIX Unix server. The software vendor is out of business, the source code is lost, and the software cannot run on x86-64 architecture. The system must remain accessible for regulatory reporting for another 18 months.
4. Application 4: An on-premises enterprise resource planning (ERP) system that has a direct, modern, cloud-based Software-as-a-Service (SaaS) equivalent from the same vendor. The firm has decided to adopt the SaaS version.

Which of the following combinations of migration strategies represent the most appropriate migration paths based on these requirements and constraints? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Application 1 should be migrated using the Replatform strategy by deploying the Java application to Amazon ECS on AWS Fargate; Application 2 should be migrated using the Refactor (Re-architect) strategy by converting the database schema and rewriting code to use Amazon Aurora PostgreSQL.; Application 3 should be migrated using the Retain strategy on-premises; Application 4 should be migrated using the Repurchase strategy by transitioning to the vendor's SaaS offering.

Answer

Application 1 should be Replatformed to Amazon ECS on AWS Fargate, Application 2 should be Refactored to Amazon Aurora PostgreSQL, Application 3 must be Retained on-premises, and Application 4 should be Repurchased as a SaaS model.
The correct strategy mappings are: Application 1 is Replatformed because it moves to AWS Fargate without code changes to eliminate OS patching; Application 2 is Refactored because changing the database engine from Oracle to Aurora PostgreSQL requires schema and code modifications; Application 3 is Retained because IBM AIX cannot run on AWS and the source code is lost; and Application 4 is Repurchased because it transitions to a SaaS platform.

Step-by-Step Solution

1
Analyze Application 1 constraints and goals.
The application runs Java/Tomcat, code changes are not possible, but the enterprise wants to eliminate OS management and server provisioning using a managed container platform.
This matches the Replatform strategy (specifically migrating to ECS/Fargate) which avoids code changes but optimizes the platform layer.
2
Analyze Application 2 migration requirements.
The target is Aurora PostgreSQL from an on-premises Oracle database, which requires schema conversion and application modifications.
Changing the database engine from proprietary to open-source requires rewriting code and converting schemas, which constitutes a Refactor (Re-architect) strategy.
3
Analyze Application 3 technical and business constraints.
The application runs on IBM AIX (non-x86/ARM Power architecture), source code is lost (cannot compile/rewrite), and it has a regulatory retention requirement of 18 months.
Because it cannot run on AWS and must remain online, the only viable option is the Retain strategy.
4
Analyze Application 4 migration goals.
The firm is migrating an ERP to a cloud-based SaaS offering from the same vendor.
Moving from a self-hosted product to a SaaS model represents the Repurchase (drop and shop) strategy.

Key Concept

Selecting migration strategies using the 7 Rs framework based on application dependencies, target environments, operational constraints, and business goals.

Alternative Method

Use the AWS Cloud Adoption Framework (CAF) and AWS Migration Evaluator to categorize workloads based on total cost of ownership (TCO) and migration effort before mapping to the 7 Rs.
Estimated Time:3m 0s
Question 1380Question →

A financial service provider is designing a new cloud infrastructure on AWS for a transaction processing system. The architecture requires three spoke VPCs (`vpc-payment-prod`, `vpc-ledger-prod`, and `vpc-fraud-prod`) in the `eu-west-1` region to communicate with each other securely, resolve internal domain names, and route outbound internet traffic for third-party API validation. The design must be highly resilient against Availability Zone failures, minimize administrative overhead, and support a centralized DNS configuration. The development team has created a Route 53 Private Hosted Zone (PHZ) named `corp.internal` in a central network services account. Which of the following networking and connectivity designs meets these requirements?

Show answer & explanation

Answer: Deploy an AWS Transit Gateway to interconnect the three spoke VPCs and a central egress VPC. In the central egress VPC, deploy a NAT Gateway in each utilized Availability Zone. Route outbound internet traffic from the spoke VPCs through the Transit Gateway to the central egress VPC's NAT Gateways. Authorize and associate the `corp.internal` Route 53 Private Hosted Zone with the three spoke VPCs and the central egress VPC.

Answer

Deploy an AWS Transit Gateway to interconnect the three spoke VPCs and a central egress VPC, deploy a NAT Gateway in each utilized Availability Zone in the egress VPC, and authorize/associate the Private Hosted Zone with all spoke VPCs and the egress VPC.
The correct design uses an AWS Transit Gateway to interconnect the spoke VPCs and the central egress VPC. For high availability, NAT Gateways must be deployed in each utilized Availability Zone within the egress VPC. To ensure name resolution for the custom domain, the Private Hosted Zone must be associated with every VPC where resolution is required.

Step-by-Step Solution

1
Analyze inter-VPC connectivity and outbound routing requirements.
Identify that AWS Transit Gateway is the correct mechanism for interconnecting the payment, ledger, and fraud VPCs and routing outbound traffic through a central egress VPC.
Direct Connect Gateway does not support transitive VPC-to-VPC routing, and full-mesh VPC peering has higher routing table administrative overhead.
2
Address high availability requirements for the outbound egress traffic.
Configure a NAT Gateway in each utilized Availability Zone of the central egress VPC.
A single NAT Gateway creates a single point of failure, meaning an outage in its Availability Zone would drop all internet-bound traffic from all spoke VPCs.
3
Address DNS resolution requirements for the centralized Private Hosted Zone.
Authorize and associate the Private Hosted Zone 'corp.internal' with the payment, ledger, fraud, and egress VPCs.
Without explicit association, DNS queries for the custom domain name will fail within the spoke VPCs because Route 53 Private Hosted Zones do not resolve transitively across Transit Gateway attachments.

Key Concept

Multi-VPC hybrid routing with Transit Gateway, redundant AZ-level NAT Gateway configuration, and cross-account Route 53 Private Hosted Zone association.
PreviousPage 69 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin