Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1381Question →

An organization needs to migrate 800 TB800\text{ TB} of data from an on-premises Network File System (NFS) share to Amazon S3 within a strict 10-day window. The organization has a 1 Gbps1\text{ Gbps} internet connection, of which only 300 Mbps300\text{ Mbps} can be dedicated to this data transfer to avoid impacting production traffic. The data must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) to comply with internal security policies. Which of the following is the most efficient and compliant method to complete this transfer?

Show answer & explanation

Answer: Order multiple AWS Snowball Edge Storage Optimized devices to copy the data offline, selecting a customer managed KMS key (CMK) to encrypt the data during the job creation.

Answer

Order multiple AWS Snowball Edge Storage Optimized devices to copy the data offline, selecting a customer managed KMS key (CMK) to encrypt the data during the job creation.
Using AWS Snowball Edge Storage Optimized devices is the most efficient method because transferring 800 TB800\text{ TB} of data over a 300 Mbps300\text{ Mbps} network link would take over 240 days, failing the 10-day time constraint. Additionally, Snowball Edge jobs require a customer managed KMS key (CMK) for encryption because AWS managed keys (like `aws/s3`) cannot be used to encrypt Snowball Edge jobs.

Step-by-Step Solution

1
Calculate the transfer time for the online migration option.
At 300 Mbps300\text{ Mbps}, transferring 800 TB800\text{ TB} takes ≈246 days\approx 246\text{ days}, which exceeds the 10-day limit.
To determine whether an online or offline transfer method is required to meet the timeline.
2
Identify the appropriate physical device configuration and encryption constraint.
AWS Snowball Edge is selected, which requires a customer managed KMS key for data encryption.
To meet both the physical shipment timeline and security policy requirements.

Key Concept

Selecting data transfer mechanisms based on bandwidth constraints and key management policies.
Estimated Time:1m 30s
Question 1382Question →

An enterprise has a multi-account AWS environment managed under AWS Organizations. Developers access resources in the member accounts by federating through AWS IAM Identity Center. A security audit of the existing setup reveals that developers can log in from any internet-facing location and perform actions. Additionally, some developers have accidentally disabled Amazon GuardDuty and Amazon Security Hub in their respective sandbox accounts.

The security team wants to implement a solution that:
1. Restricts all developer API operations to only be allowed when originating from the corporate office public IP range 203.0.113.0/24203.0.113.0/24.
2. Ensures that AWS services can still perform actions on behalf of the developers (such as AWS CloudFormation deploying resources or Auto Scaling launching instances).
3. Prevents any IAM user or role in the member accounts from disabling GuardDuty or Security Hub.

Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Attach a Service Control Policy (SCP) to the organization's root. In the SCP, implement a Deny rule for all actions with a condition that denies access if the source IP is not in 203.0.113.0/24203.0.113.0/24 and the request is not made by an AWS service on behalf of the user. In the same SCP, include a Deny rule for actions matching guardduty:Delete*, guardduty:Disassociate*, guardduty:Update*, securityhub:Delete*, and securityhub:Disable*.

Answer

The correct solution is to attach a Service Control Policy (SCP) to the organization's root that implements a Deny rule for all actions with a condition denying access if the source IP is not in the corporate range and the request is not made via an AWS service (using the aws:ViaAWSService context key), and also includes a Deny rule for GuardDuty and Security Hub modification actions.
The correct solution attaches an SCP to the root of the organization to centrally manage security boundaries. By using a Deny statement with a NotIpAddress condition for the corporate CIDR range alongside a condition checking if aws:ViaAWSService is false, it ensures that direct user requests must originate from the corporate network, while legitimate AWS service-to-service operations triggered by users are permitted. Explicitly denying GuardDuty and Security Hub deletion/disabling actions in the same SCP ensures that no principal in the member accounts can turn off these monitoring services.

Step-by-Step Solution

1
Select the correct policy mechanism for global enforcement.
Identify that Service Control Policies (SCPs) are required to enforce boundaries across all member accounts in the organization, overriding local administrator actions.
SCPs apply to all IAM users and roles in member accounts, including the root user, ensuring consistent governance.
2
Configure the IP restriction logic while avoiding disruption to AWS services.
Use a Deny policy with a condition block that checks if the source IP is not in the corporate range, combined with a condition that checks if the request is NOT made via an AWS service.
AWS services frequently call other services on behalf of users (e.g., CloudFormation creating an EC2 instance). These calls originate from AWS IP space, not the corporate network, so they must be exempted using the aws:ViaAWSService context key.
3
Enforce protection for GuardDuty and Security Hub.
Add explicit Deny statements for deletion and disabling actions of GuardDuty and Security Hub in the SCP.
A Deny statement in an SCP cannot be overridden by any Allow policy within the member accounts, preventing accidental or malicious configuration changes.

Key Concept

Enforcing network boundaries globally across an AWS Organization using SCPs while preserving AWS service integrations with the aws:ViaAWSService context key.
Question 1383Question →

An enterprise manages an AWS Organization with consolidated billing. The environment consists of three member accounts with the following workloads:

* Account A (Web Application): A production web application running on Amazon EC2 instances in an Auto Scaling Group across 33 Availability Zones. The instances are currently c6i.xlargec6i.xlarge (44 vCPUs, 88 GiB RAM). Metrics indicate average CPU utilization is 12%12\% and peak memory utilization is 3.53.5 GiB.
* Account B (APIs): A containerized payment API workload running on AWS Fargate.
* Account C (Data Processing): An event-driven data pipeline using AWS Lambda.

To optimize outgoing internet traffic costs, the company wants to consolidate their NAT Gateway configuration, as each account currently has its own NAT Gateways deployed across 33 Availability Zones. The solution must maintain high availability, maximize discount coverage for all compute workloads, and minimize administrative effort.

Which strategy should the Solutions Architect recommend to optimize resource costs and sizing while meeting these requirements?

Show answer & explanation

Answer: In Account A, update the Auto Scaling Group launch template to use c6i.largec6i.large instances. In the AWS Organizations management account, purchase a Compute Savings Plan to cover compute costs across all accounts. Deploy redundant NAT Gateways across 33 Availability Zones in a centralized VPC, share the private subnets with the member accounts using AWS Resource Access Manager (RAM), and configure the member account route tables to direct outbound internet traffic through the shared subnets.

Answer

The correct strategy is to resize the EC2 instances to c6i.largec6i.large, purchase a Compute Savings Plan in the management account to cover the EC2, Fargate, and Lambda workloads, and consolidate outbound traffic by deploying redundant NAT Gateways in a centralized VPC and sharing those subnets via AWS Resource Access Manager (RAM).
The correct option correctly addresses all constraints. Sizing down the EC2 instances to c6i.largec6i.large aligns resource capacity with actual utilization (since peak memory is 3.53.5 GiB and average CPU is very low). A Compute Savings Plan is the only Savings Plan type that covers EC2, Fargate, and Lambda across all member accounts under consolidated billing. Finally, sharing subnets containing redundant NAT Gateways via AWS RAM is the supported method to consolidate NAT Gateway costs while maintaining high availability across multiple Availability Zones.

Step-by-Step Solution

1
Determine the right-sizing target for the EC2 instances in Account A.
The current instances are c6i.xlargec6i.xlarge (44 vCPUs, 88 GiB RAM) with average CPU utilization of 12%12\% (requiring less than 0.50.5 vCPUs on average) and a peak memory of 3.53.5 GiB. Sizing down to c6i.largec6i.large (22 vCPUs, 44 GiB RAM) meets both requirements safely while reducing resource waste.
Right-sizing should always precede purchasing Savings Plans to avoid over-committing to unnecessary capacity.
2
Evaluate the compute types across the multi-account organization to determine the most cost-effective Savings Plan type.
The workloads span EC2 instances (Account A), AWS Fargate tasks (Account B), and AWS Lambda functions (Account C). Only a Compute Savings Plan applies discount coverage to all three compute types across the organization's consolidated billing.
EC2 Instance Savings Plans do not apply to serverless workloads (Fargate and Lambda) and would leave Accounts B and C without coverage.
3
Select a highly available and cost-optimized outbound routing strategy for the member accounts.
Deploy redundant NAT Gateways across 33 Availability Zones in a centralized VPC, share the subnets via AWS Resource Access Manager (RAM), and route outbound traffic from the member VPCs through these subnets.
This consolidates NAT Gateway costs while maintaining high availability across Availability Zones without attempting unsupported direct sharing of NAT Gateway resources via RAM.

Key Concept

Compute cost optimization requires a combination of instance right-sizing and choosing the correct Savings Plan type based on workload variety, while network cost optimization must preserve high availability.

Alternative Method

Use AWS Compute Optimizer to automatically analyze historical utilization metrics and recommend the optimal instance types for the Auto Scaling Group, ensuring that CPU and memory headroom are preserved while minimizing costs.
Estimated Time:2m 0s
Question 1384Question →

A financial services firm is launching a high-frequency trading analytics platform in the `eu-west-1` region across three VPCs: `vpc-trading-prod`, `vpc-marketdata-prod`, and `vpc-shared-mgmt`. The architecture has the following requirements:

1. All private resources must resolve internal service endpoints under the private domain `trading.local` which is managed in the `vpc-shared-mgmt` account.
2. The trading and market data applications require highly resilient, multi-AZ outbound connectivity to retrieve external financial feeds, ensuring that an outage in one Availability Zone does not impact egress in other zones.
3. Network latency between the VPCs must be minimized for inter-service communication.

Which two configurations should the solutions architect implement to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate the Route 53 Private Hosted Zone for `trading.local` with `vpc-trading-prod`, `vpc-marketdata-prod`, and `vpc-shared-mgmt` to allow direct DNS resolution in all VPCs.; Deploy a NAT Gateway in each active Availability Zone within `vpc-trading-prod` and `vpc-marketdata-prod` public subnets, and configure the private route tables to route default traffic to the local NAT Gateway in the same zone.

Answer

Associate the Route 53 Private Hosted Zone for `trading.local` with all three VPCs, and deploy a NAT Gateway in each active Availability Zone within `vpc-trading-prod` and `vpc-marketdata-prod` public subnets.
Directly associating the Route 53 Private Hosted Zone with all target VPCs provides a native, low-latency, and cost-effective DNS resolution without requiring Resolver endpoints. Furthermore, deploying a NAT Gateway in each active Availability Zone for the production VPCs ensures that outbound traffic remains resilient to a single zone outage.

Step-by-Step Solution

1
Analyze the DNS resolution requirement for the private domain `trading.local` across multiple VPCs in the same region.
Identify that a Route 53 Private Hosted Zone (PHZ) can be associated with multiple VPCs across different accounts, providing a simple, cost-effective, and native DNS resolution mechanism.
This avoids the complexity and cost of deploying Route 53 Resolver endpoints for intra-region cross-VPC DNS resolution.
2
Evaluate the egress internet connectivity requirements for the private workloads.
Determine that deploying a NAT Gateway in each Availability Zone in both production VPCs satisfies the high-resiliency constraint.
Deploying a single NAT Gateway or routing egress traffic through a centralized gateway in another VPC would introduce a single point of failure, violating the multi-AZ resilience requirement.

Key Concept

Designing highly resilient multi-VPC networking topologies on AWS, focusing on redundant NAT Gateways for internet egress and Route 53 Private Hosted Zone sharing across multiple VPCs.
Question 1385Question →

An enterprise manages a multi-account environment using AWS Organizations. The security team uses AWS CloudFormation StackSets to deploy baseline IAM roles and security groups to all member accounts from a central administrator account. Recently, security audits revealed that local administrators in member accounts have manually modified these baseline resources, creating configuration drift and security vulnerabilities. A solutions architect must implement an automated governance solution that detects configuration drift on these baseline resources and automatically remediates it. The solution must prevent local administrators from disabling or bypassing the remediation controls.

Which two actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy an AWS Config organizational rule using the cloudformation-stack-drift-detection-check managed rule to identify drifted stacks. Associate the rule with an AWS Systems Manager Automation document that executes a remediation script using a custom execution role to update the drifted resources back to their defined template states.; Create a Service Control Policy (SCP) at the Organization root that denies member account principals the ability to delete or modify AWS Config configurations, Systems Manager associations, and the deployed baseline resources, unless the action is performed by the StackSet execution role.

Answer

Deploy an AWS Config organizational rule with Systems Manager Automation for remediation, and create a Service Control Policy at the Organization root to deny member account modifications to the configuration tools and baseline resources unless performed by the StackSet execution role.
The correct solution involves using AWS Config organizational rules to detect drift via the cloudformation-stack-drift-detection-check rule and remediation via Systems Manager Automation. This provides the continuous compliance check and remediation action. Additionally, attaching an SCP at the Organization root prevents local administrators from disabling AWS Config, Systems Manager, or deleting the baseline resources, while permitting the StackSet execution role to update them.

Step-by-Step Solution

1
Configure AWS Config organizational rules to detect drift.
Uses the cloudformation-stack-drift-detection-check managed rule to identify drifted resources across all member accounts automatically.
Ensures that manual modifications to CloudFormation-managed resources are flagged continuously.
2
Set up automated remediation using AWS Systems Manager.
Triggers an SSM Automation document to remediate the drifted configuration.
Allows automatic alignment of the resources back to their baseline template configurations without manual intervention.
3
Establish permission guards using Service Control Policies (SCPs).
Denies unauthorized deletion or modification of governance tools and baseline resources, allowing updates only by the StackSet execution role.
Prevents local administrators from disabling the monitoring and remediation configuration, ensuring compliance enforcement.

Key Concept

Multi-account configuration management, drift detection, and automated remediation using CloudFormation, AWS Config, Systems Manager, and Service Control Policies.
Question 1386Question →

An enterprise runs a large-scale data analytics platform on AWS. The central data lake is hosted in an Amazon S3 bucket in the `us-west-2` Region, containing 150 TB150\text{ TB} of data that changes or grows by approximately 10 TB10\text{ TB} each month. A processing cluster runs on Amazon EKS nodes located in private subnets across 33 Availability Zones in the `us-east-1` Region. The cluster executes batch analysis jobs every day, reading a total of 300 TB300\text{ TB} of data monthly from the `us-west-2` bucket. Currently, the EKS nodes access the S3 bucket via local NAT Gateways in each Availability Zone. The company needs to optimize the architecture to achieve the lowest possible total cost for S3 storage and data transfer without introducing a single point of failure or violating high availability standards. Which solution meets these requirements most cost-effectively?

Show answer & explanation

Answer: Configure S3 Cross-Region Replication (CRR) from the `us-west-2` bucket to a new S3 bucket in `us-east-1`. Create an S3 Gateway VPC Endpoint in the `us-east-1` VPC. Configure the EKS applications to read from the replicated local bucket in `us-east-1`.

Answer

Configure Amazon S3 Cross-Region Replication to copy the data from the source Region to the destination Region, and access it locally via an S3 Gateway VPC Endpoint.
Replicating the dataset to the local Region via Cross-Region Replication (CRR) requires paying a one-time data transfer cost for only the new or modified data (10 TB/month10\text{ TB/month}) and local S3 storage costs for the 150 TB150\text{ TB}. The EKS workloads can then read the 300 TB300\text{ TB} of data over a local S3 Gateway VPC Endpoint, which is highly available and carries no data processing or hourly charges. This reduces the total cost to around $3,635/month\$3,635/\text{month}, which is the most cost-effective and highly available solution.

Step-by-Step Solution

1
Calculate the current cost of routing cross-Region traffic to S3 over NAT Gateways.
Monthly cost is approximately 19,968,consistingofcross−RegionS3datatransferout(19,968, consisting of cross-Region S3 data transfer out ( 300\text{ TB} \times 1024 \text{ GB/TB} \times \0.02/GB=$6,1440.02/\text{GB} = \$6,144) and NAT Gateway processing (300 TB×1024 GB/TB×$0.045/GB=$13,824300\text{ TB} \times 1024 \text{ GB/TB} \times \$0.045/\text{GB} = \$13,824).
Establishing a baseline cost helps evaluate the savings of alternative architectures.
2
Evaluate S3 Cross-Region Replication (CRR) data transfer and storage costs.
Replicating the monthly 10 TB10\text{ TB} delta costs 10×1024 GB×$0.02/GB=$204.8010 \times 1024 \text{ GB} \times \$0.02/\text{GB} = \$204.80. Storing the 150 TB150\text{ TB} dataset in S3 Standard in `us-east-1` costs approximately 50 TB×1024 GB/TB×$0.023/GB+100 TB×1024 GB/TB×$0.022/GB=$3,430.40/month50\text{ TB} \times 1024 \text{ GB/TB} \times \$0.023/\text{GB} + 100\text{ TB} \times 1024 \text{ GB/TB} \times \$0.022/\text{GB} = \$3,430.40/\text{month}.
Replication transfers data once, enabling all subsequent reads to happen locally.
3
Add an S3 Gateway VPC Endpoint in the EKS VPC.
Enables the EKS nodes to read the 300 TB300\text{ TB} of data locally from the replicated bucket in `us-east-1` for 0/GB0/\text{GB} data transfer and data processing fees.
VPC Gateway Endpoints provide free, highly available access to S3 within the same Region.
4
Sum the total cost of the replication-based solution and compare to the baseline.
Total cost is $3,635.20/month\$3,635.20/\text{month} (greater than 80%80\% savings compared to the baseline of $19,968/month\$19,968/\text{month}).
Confirms this approach is the most cost-effective while maintaining high availability.

Key Concept

Optimizing cross-Region storage costs by using S3 Cross-Region Replication (CRR) to localize read-heavy traffic and leveraging free Gateway VPC Endpoints within the same Region.
Question 1387Question →

A logistics company runs a distributed fleet management system across an AWS Organization with consolidated billing. The system is split into two AWS member accounts: Account A (Ingestion) runs a dynamic processing workload on Amazon EC2 m6i.xlarge instances (average CPU utilization 25%25\%, peak 40%40\%, memory usage consistently under 30%30\%) and AWS Lambda functions for real-time telemetry processing. Account B (Analytics) hosts a cluster of Amazon ECS tasks running on AWS Fargate that processes reports. Outbound traffic to the internet and AWS services from Account A is routed through redundant NAT Gateways deployed across three Availability Zones. The company plans to optimize compute costs over a 3-year3\text{-year} term. Performance must not be compromised, and no application downtime is permitted. Which optimization strategy will achieve the highest cost reduction while satisfying these requirements?

Show answer & explanation

Answer: Right-size the EC2 instances in Account A to m6i.large. Purchase a 3-year3\text{-year} Compute Savings Plan in the organization's management account to cover the right-sized EC2 instances, ECS Fargate tasks, and Lambda functions across both accounts. Maintain the redundant NAT Gateways.

Answer

Right-size the EC2 instances in Account A to m6i.large, purchase a 3-year Compute Savings Plan in the organization's management account to cover the EC2 instances, ECS Fargate tasks, and Lambda functions across both accounts, and maintain the redundant NAT Gateways.
The correct strategy combines right-sizing the m6i.xlarge instances to m6i.large (since the peak workload of 1.6 vCPUs1.6\text{ vCPUs} and 4.8 GiB4.8\text{ GiB} of RAM easily fits within a large instance's 2 vCPUs2\text{ vCPUs} and 8 GiB8\text{ GiB} capacity) with purchasing a Compute Savings Plan in the management account. The Compute Savings Plan is the only plan type that applies to EC2, Fargate, and Lambda workloads across different member accounts. Retaining the redundant NAT Gateways is necessary to avoid introducing a single point of failure for outbound traffic.

Step-by-Step Solution

1
Analyze the EC2 CPU and memory usage to right-size the instances.
The current m6i.xlarge instances have 4 vCPUs4\text{ vCPUs} and 16 GiB16\text{ GiB} of RAM. Peak CPU is 40%40\% (equivalent to 1.6 vCPUs1.6\text{ vCPUs}) and memory is consistently under 30%30\% (under 4.8 GiB4.8\text{ GiB}). Downsizing to m6i.large (2 vCPUs2\text{ vCPUs} and 8 GiB8\text{ GiB} of RAM) safely accommodates the peak CPU and memory demands.
Ensures that the instances are not over-provisioned while keeping performance within safe boundaries.
2
Select the correct Savings Plan type for the mixed compute environment.
Compute Savings Plans cover EC2, AWS Fargate, and AWS Lambda workloads across all accounts under consolidated billing. EC2 Instance Savings Plans do not cover Fargate or Lambda.
Allows the company to apply discounts to all three compute types (EC2, Fargate, and Lambda) across both member accounts.
3
Verify high-availability constraints for outbound network components.
Consolidating the three NAT Gateways into a single NAT Gateway in one AZ would introduce a single point of failure (SPOF) for outbound connectivity, which violates the requirement for zero application downtime. The redundant NAT Gateways must remain.
Ensures the architecture meets the high availability and zero-downtime SLA constraints.

Key Concept

Compute sizing optimization, Compute Savings Plans coverage, and high-availability architecture constraints.
Question 1388Question →

A company is migrating a production MySQL database running on an on-premises physical server to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration must be completed with minimal downtime. A Solutions Architect plans to use the AWS Schema Conversion Tool (AWS SCT) and the AWS Database Migration Service (AWS DMS) with Change Data Capture (CDC). Which of the following actions must the Solutions Architect perform to ensure a successful migration with ongoing replication? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Run the AWS Schema Conversion Tool (AWS SCT) to convert the MySQL database schema to PostgreSQL, apply the generated schema DDL to the target Aurora DB cluster, and then initiate the AWS DMS replication task.; Enable binary logging on the source MySQL database, configure the binlog format to ROW, set the binlog retention period to at least 24 hours, and restart the database service before starting the AWS DMS task.

Answer

The Solutions Architect must run the AWS Schema Conversion Tool (AWS SCT) to convert the MySQL database schema to PostgreSQL, apply the schema to the target Aurora DB cluster, and enable binary logging on the source MySQL database with the ROW format and adequate binlog retention before starting the AWS DMS task.
For a successful heterogeneous database migration with minimal downtime, the target schema must first be created. The AWS Schema Conversion Tool (AWS SCT) is used to convert the source schema (MySQL) to the target schema (PostgreSQL) and apply it. For ongoing replication (CDC) to function, the source MySQL database must have binary logging enabled with a format of ROW, as AWS DMS reads these binary logs to replicate changes to the target database.

Step-by-Step Solution

1
Perform schema conversion using AWS SCT.
The target Aurora PostgreSQL DB cluster schema is created with converted tables, indexes, stored procedures, and views.
AWS DMS does not perform heterogeneous schema conversion automatically; it only migrates data and creates basic tables.
2
Configure binary logging on the source MySQL database.
The source database writes change logs in ROW format with sufficient retention (e.g., 24 hours) for AWS DMS to read.
Change Data Capture (CDC) requires binary logging to be enabled on the source MySQL engine to capture ongoing updates.
3
Create and run the AWS DMS task in full load and CDC mode.
Data is migrated to Aurora PostgreSQL and kept in sync via ongoing replication with minimal downtime.
The combination of SCT schema application and DMS CDC replication achieves a near-zero downtime heterogeneous database migration.

Key Concept

Heterogeneous database migration requires schema conversion using AWS SCT first, followed by data replication using AWS DMS. Ongoing replication (CDC) requires appropriate transaction log configurations (like binary logging for MySQL or supplemental logging for Oracle) on the source database.
Question 1389Question →

A financial services firm manages application hosting environments across multiple member accounts in AWS Organizations. The baseline EC2 instance configurations, security group rules, and IAM roles are deployed and managed using AWS CloudFormation StackSets from a centralized tooling account.

Recently, local administrators have made manual, out-of-band modifications to security group rules and instance settings in the target accounts, causing configuration drift. Additionally, the centralized pipeline in the tooling account is unable to complete deployments because the target accounts cannot read the deployment artifacts stored in an Amazon S3 bucket, which is currently encrypted using the default AWS-managed S3 key (aws/s3).

Which combination of actions should a Solutions Architect take to remediate the configuration drift and resolve the cross-account deployment failures? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a Customer Managed Key (CMK) in the tooling account to encrypt the S3 artifact bucket, and update the CMK key policy to allow the CloudFormation execution roles in the target member accounts to perform decryption operations.; Deploy an AWS Config rule to monitor the resources for configuration changes, and set up an AWS Systems Manager Automation runbook as a remediation action to automatically revert unauthorized changes.

Answer

The correct actions are to encrypt the S3 artifact bucket with a Customer Managed Key (CMK) and grant cross-account decryption access in its key policy, and to deploy AWS Config rules combined with an AWS Systems Manager Automation runbook to automatically detect and revert unauthorized resource changes.
The correct solution resolves the cross-account S3 access error by replacing the default AWS-managed KMS key (aws/s3) with a Customer Managed Key (CMK), whose key policy can be updated to delegate read permissions to the CloudFormation execution roles in the target member accounts. Additionally, the configuration drift is automatically remediated by deploying AWS Config rules that evaluate the compliance of target resources and trigger an AWS Systems Manager Automation runbook to revert manual configurations back to the desired baseline state.

Step-by-Step Solution

1
Analyze the cross-account KMS decryption failure.
Identify that the default AWS-managed KMS key (aws/s3) cannot be shared across accounts because its key policy cannot be modified.
AWS-managed keys are restricted to the local account and cannot be delegated to external entities or other accounts in the organization.
2
Resolve cross-account S3 bucket access.
Configure a Customer Managed Key (CMK) in the tooling account and update its policy to allow decryption access to the CloudFormation execution roles in the target member accounts.
Customer Managed Keys allow modification of their key policies to grant cross-account permissions.
3
Design drift detection and remediation.
Deploy an AWS Config rule to monitor target resources for configuration changes, and set up an AWS Systems Manager Automation runbook to automatically revert any detected changes.
AWS Config rules can detect resource compliance state changes and trigger remediation actions via Systems Manager Automation, enforcing continuous baseline configurations without manual intervention.

Key Concept

Automating configuration management, drift detection and remediation using AWS Config and Systems Manager, and enabling cross-account deployment pipeline access using Customer Managed Keys (CMKs) in AWS Key Management Service (KMS).
Question 1390Question →

A company runs a high-volume containerized application on AWS Fargate in a dedicated VPC within a member account of an AWS Organization. The application also uses AWS Lambda for background processing and Amazon Aurora PostgreSQL Serverless v2 for the database. Analysis of the organization's monthly bill reveals that AWS Fargate, AWS Lambda, and NAT Gateway data processing charges represent the highest cost factors. The NAT Gateway data processing costs are elevated because Fargate tasks in private subnets regularly download large container images from Amazon ECR and make frequent API requests to Amazon S3 and Amazon DynamoDB. The company has consolidated billing enabled across all accounts in the AWS Organization. Which two actions should a Solutions Architect recommend to optimize resource costs while maintaining high availability and requiring minimal operational effort? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Purchase Compute Savings Plans at the AWS Organizations management account level to cover the Fargate and Lambda compute usage across all member accounts.; Create Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and Interface VPC endpoints for Amazon ECR in the application VPC.

Answer

Purchase Compute Savings Plans at the AWS Organizations management account level, and create Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and Interface VPC endpoints for Amazon ECR in the application VPC.
Purchasing Compute Savings Plans at the AWS Organizations management account level provides the maximum flexibility and automatically applies discounts to eligible compute usage, including AWS Fargate and AWS Lambda, across all member accounts. Establishing Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, alongside Interface VPC endpoints for Amazon ECR, directs traffic to these services through private AWS routing, completely bypassing the NAT Gateway and eliminating associated NAT Gateway data processing charges.

Step-by-Step Solution

1
Evaluate the compute options to optimize Fargate and Lambda workloads.
Select Compute Savings Plans rather than EC2 Instance Savings Plans because Compute Savings Plans apply automatically to Fargate and Lambda compute hours.
EC2 Instance Savings Plans are limited to EC2 instances and do not apply to Fargate or Lambda.
2
Determine the purchasing account scope for the savings plans.
Purchase Compute Savings Plans at the management account level of the AWS Organization.
This allows unused savings plan capacity to be shared across all member accounts under consolidated billing, maximizing utilization and savings.
3
Identify the high-bandwidth traffic routing paths through the NAT Gateway.
Configure Gateway VPC endpoints for S3 and DynamoDB, and Interface VPC endpoints for ECR in the VPC hosting Fargate tasks.
Traffic to these services bypasses the NAT Gateway and routes directly within the AWS network, which eliminates NAT Gateway data processing charges while keeping redundancy.

Key Concept

Compute cost optimization requires aligning the appropriate Savings Plan type (Compute vs EC2 Instance) with the compute services (Fargate/Lambda). Network cost optimization involves using VPC endpoints to route high-volume traffic to AWS services privately, bypassing NAT Gateways.
Question 1391Question →

An enterprise hosts an internal web application on Amazon EC2 instances behind an internal Application Load Balancer (ALB) inside a VPC. Corporate users access the application through an AWS Site-to-Site VPN connection. The security team wants to improve the network security posture by deploying AWS WAF on the internal ALB. The requirements are:

1. Block all requests containing SQL injection (SQLi) patterns.
2. Restrict all other access to the corporate network public CIDR block (203.0.113.0/24203.0.113.0/24).

The security team configures an AWS WAF WebACL with the following rules:
- Rule A (Priority 10): A custom rule with an Allow action for source IP addresses in 203.0.113.0/24203.0.113.0/24.
- Rule B (Priority 20): An AWS Managed Rules SQL database rule set with a Block action.
- Default Action: Block.

During a security audit, simulated SQLi attacks originating from the corporate network successfully reach the EC2 instances. Which of the following modifications should the security team perform to remediate this vulnerability and meet the requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Increase the priority value of Rule A so that it is evaluated after Rule B (e.g., set Rule A to Priority 30).; Modify Rule A to block traffic that does not originate from 203.0.113.0/24203.0.113.0/24, set its priority to 30, and change the WebACL default action to Allow.

Answer

To remediate the vulnerability, increase the priority value of Rule A so that it is evaluated after Rule B, or modify Rule A to block traffic that does not originate from the corporate network CIDR block, set its priority to 30, and change the WebACL default action to Allow.
AWS WAF evaluates rules in order of priority, starting from the lowest number. If a rule matches with an Allow or Block action, evaluation terminates. In the initial configuration, Rule A (Priority 10, Allow corporate IP) matches first for all traffic from the corporate IP, including SQLi attacks, preventing Rule B (Priority 20, SQLi Block) from ever being evaluated. To remediate this, evaluating Rule B (SQLi Block) first at a higher priority (lower priority number) than Rule A ensures SQLi payloads are blocked first. Legitimate corporate traffic then falls through to Rule A where it is allowed, while other traffic falls through to the default Block action. Alternatively, configuring Rule A to block traffic not originating from the corporate IP at a lower priority than Rule B, and changing the default action to Allow, ensures SQLi is blocked first by Rule B. Then, external traffic is blocked by Rule A, and legitimate corporate traffic safely falls through to the default Allow action.

Step-by-Step Solution

1
Analyze the rule evaluation order of AWS WAF.
AWS WAF processes rules sequentially starting from the lowest priority value. If a request matches a rule with an Allow or Block action, processing stops immediately.
This helps determine why the SQLi attacks from the corporate IP are bypassing Rule B (priority 20) by matching Rule A (priority 10, Allow) first.
2
Evaluate the impact of changing rule priorities to block malicious traffic first.
By moving Rule A to a lower priority (higher priority number, e.g., 30) than Rule B (priority 20), SQLi checks are performed first. Malicious requests are blocked by Rule B, while clean requests from the corporate IP fall through to Rule A and are allowed.
This addresses the primary vulnerability while still allowing legitimate corporate traffic.
3
Evaluate an alternative logic path using block rules and default actions.
If Rule A is modified to block traffic NOT originating from the corporate IP (at Priority 30) and the default action is set to Allow, Rule B (Priority 20) still blocks SQLi first. Then, Rule A blocks non-corporate traffic, and clean corporate traffic falls through to the default Allow action.
This satisfies the requirements by using negative matching (blocking non-corporate traffic) and an Allow default action.

Key Concept

AWS WAF Rule Evaluation Order and Action Behaviors
Estimated Time:2m 0s
Question 1392Question →

An enterprise is planning to migrate its core financial auditing platform to AWS within a strict six-month timeline. The workload consists of three primary components:

1. A web frontend running Apache Tomcat on Windows Server 2012 R2. The operating system has reached End-of-Support (EOS). To comply with corporate security standards, the OS must be upgraded to Windows Server 2022 during the migration, but the application code itself will not be modified.
2. A transactional database running on Microsoft SQL Server 2016. To eliminate commercial licensing costs, the enterprise wants to migrate this database to Amazon Aurora PostgreSQL, which will require converting the database schema and rewriting legacy stored procedures.
3. A legacy reporting system that requires a physical hardware security module (HSM) with proprietary on-premises API integrations that cannot be virtualized or replicated in the cloud, but must remain operational for auditing purposes.

Which combination of migration strategies represents the most appropriate alignment with the AWS 7 Rs framework for these components?

Show answer & explanation

Answer: Replatform the web frontend to upgrade the operating system; Refactor the transactional database to Aurora PostgreSQL; Retain the legacy reporting system on-premises.

Answer

Replatform the web frontend to upgrade the operating system; Refactor the transactional database to Aurora PostgreSQL; Retain the legacy reporting system on-premises.
The correct strategy is to replatform the web frontend to upgrade the operating system, refactor the database to Aurora PostgreSQL, and retain the legacy reporting system on-premises. Replatforming allows the operating system upgrade to meet compliance without changing the application code. Refactoring is required for the database because changing the database engine from Microsoft SQL Server to Amazon Aurora PostgreSQL involves schema conversion and rewriting stored procedures. Retaining the legacy reporting system is necessary because its dependency on physical on-premises hardware security modules prevents cloud virtualization.

Step-by-Step Solution

1
Analyze the migration requirements for the web frontend tier.
The web frontend requires an operating system upgrade from Windows Server 2012 R2 to Windows Server 2022 during migration, with no application code changes.
Upgrading the OS runtime or platform environment without changing the core application architecture constitutes a Replatform strategy.
2
Analyze the migration requirements for the database tier.
The transactional database requires changing the engine from SQL Server to Aurora PostgreSQL and rewriting legacy stored procedures.
Changing the database engine and modifying the schema/stored procedures requires code-level modifications, which is classified as a Refactor (Re-architect) strategy.
3
Analyze the migration requirements for the legacy reporting system.
The system has direct dependencies on physical hardware security modules that cannot be virtualized, and it must remain active for auditing.
Since the component cannot be moved to the cloud and must remain active, it falls under the Retain strategy.
4
Synthesize the individual component strategies into a unified migration plan.
The final plan is: Replatform the frontend, Refactor the database, and Retain the legacy reporting system.
This combination correctly matches all the operational and technical constraints within the AWS 7 Rs framework.

Key Concept

Selecting appropriate migration strategies (7 Rs) based on workload requirements, dependencies, and code change scopes.
Estimated Time:2m 0s
Question 1393Question →

A digital logistics provider is transitioning a production Microsoft SQL Server database hosted on an on-premises physical cluster to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. A database administrator has successfully completed schema conversion using the AWS Schema Conversion Tool (SCT) and applied the DDL scripts to the target Aurora DB cluster. The administrator then sets up an AWS Database Migration Service (DMS) replication task configured with a task type of 'Full load and ongoing replication'. The full load phase completes successfully, copying all baseline tables to Aurora. However, the task fails immediately upon transitioning to the Change Data Capture (CDC) phase. Which of the following actions is required to resolve this failure and ensure ongoing replication?

Show answer & explanation

Answer: Configure Change Data Capture (MS-CDC) on the source SQL Server database and all migrated tables, and verify the DMS source endpoint user has the appropriate sysadmin or db_owner privileges.

Answer

Configure Change Data Capture (MS-CDC) on the source SQL Server database and all migrated tables, and verify the DMS source endpoint user has the appropriate sysadmin or db_owner privileges.
For AWS DMS to perform ongoing Change Data Capture (CDC) from SQL Server, Change Data Capture (MS-CDC) or MS-Replication must be configured on the source database and tables. The database user configured in the DMS source endpoint also requires administrative privileges, such as sysadmin or db_owner roles, to access the transaction log files and CDC tables.

Step-by-Step Solution

1
Analyze the AWS DMS replication task status to verify if baseline data copied successfully but failed when transitioning to Change Data Capture (CDC).
Confirming the task fails immediately after full load points to a missing source-side transactional logging configuration.
Ongoing replication requires the source database engine to track transactional updates in a format AWS DMS can read.
2
Enable Change Data Capture (MS-CDC) on the source Microsoft SQL Server database and each individual table being replicated.
The SQL Server database starts logging insert, update, and delete transactions in internal change tables.
AWS DMS requires these CDC logs to identify and apply ongoing changes to the target database.
3
Verify and grant the necessary permissions (sysadmin or db_owner database roles) to the user account configured in the AWS DMS source endpoint.
The DMS task receives authorization to query the transaction logs and MS-CDC tables.
Without these permissions, the source database will deny access, causing the replication task to fail.

Key Concept

AWS DMS requires source-side transactional logging configuration (such as MS-CDC for SQL Server) and appropriate database permissions to execute Change Data Capture (CDC) replication.
Estimated Time:2m 0s
Question 1394Question →

A digital content provider is designing a new subscription management platform to handle global membership renewals and payments. The platform's workload type is a relational Online Transaction Processing (OLTP) database. The database must sustain high-volume transactional writes in the primary region (us-east-1), scale to handle up to 100,000 read requests per second globally, and support a disaster recovery strategy with a Recovery Point Objective (RPO) of less than 1 second and a Recovery Time Objective (RTO) of less than 1 minute in a secondary region (us-west-2). All database storage at rest must be encrypted using a customer managed key (CMK) owned by a centralized security account to comply with regulatory auditing requirements.

Which two database and encryption configurations should the Solutions Architect select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Create Aurora Replicas in both regions and configure Aurora Auto Scaling to dynamically scale read capacity based on CPU utilization.; In the centralized security account, create an AWS KMS multi-Region customer managed key (CMK) with a key policy that allows the database service roles in both the primary and secondary regions to perform cryptographic operations. Replicate the CMK from us-east-1 to us-west-2 and configure the database clusters to use these keys.

Answer

Configuring an Amazon Aurora PostgreSQL Global Database with Aurora Replicas and Aurora Auto Scaling, along with utilizing an AWS KMS multi-Region customer managed key (CMK) from the centralized security account replicated to the secondary region.
To meet the low-latency global read scaling (100,000 reads/sec) and near-zero RPO/RTO disaster recovery requirements, the architect must choose Amazon Aurora Global Database, which offers cross-Region physical replication with lag typically under 1 second and dynamic read scaling via Aurora Replicas and Aurora Auto Scaling. For central security management, configuring a multi-Region AWS KMS customer managed key (CMK) in the central security account and replicating it to the secondary region enables cross-account, cross-Region encryption of the database cluster with consistent key material.

Step-by-Step Solution

1
Evaluate the read scaling and database replication requirements for OLTP workload.
Identify that Amazon Aurora Global Database satisfies the cross-region performance, providing RPO under 1 second and RTO under 1 minute, while enabling reader instances in the secondary region to handle global read workloads.
Standard RDS Multi-AZ deployments do not support read traffic on standby instances, and snapshot replication is too slow to meet the RPO/RTO constraints.
2
Assess the encryption and centralized key management requirements.
Determine that a multi-Region Customer Managed Key (CMK) owned by the central security account should be used, with its key policy allowing access to the database service roles.
AWS-managed keys (e.g., aws/rds) cannot have their policies modified for cross-account access, and separate single-Region customer managed keys require re-encryption or complex configuration for global clusters.

Key Concept

Architecting multi-region relational databases using Amazon Aurora Global Database for low RTO/RPO disaster recovery and global read scaling, integrated with AWS KMS multi-Region customer managed keys for centralized cross-account encryption.
Question 1395Question →

A company is planning to migrate a customer portal application to AWS. The web tier consists of a Python Django application running on Windows Server VMs, which the company wants to containerize and run on AWS Fargate to eliminate operating system licensing and management overhead. The database tier runs on Microsoft SQL Server. To eliminate commercial database licensing costs, the company decides to migrate the database to Amazon Aurora MySQL. This migration will require rewriting multiple database-level stored procedures and modifying the application's data access layer.

Which migration strategies from the 7 Rs framework should the Solutions Architect select for the web tier and the database tier?

Show answer & explanation

Answer: Replatform for the web tier, and Refactor for the database tier

Answer

Replatform for the web tier, and Refactor for the database tier
The correct answer is the option that matches Replatform for the web tier and Refactor for the database tier. Moving the web tier to containers on AWS Fargate is a Replatform strategy because it changes the hosting platform to a managed environment without major structural changes to the application logic. The database tier migration involves a heterogeneous shift from SQL Server to Aurora MySQL, requiring schema conversion and substantial code modifications to stored procedures and the application's data access layer, which classifies it as a Refactor (Re-architect) strategy.

Step-by-Step Solution

1
Analyze the web tier migration strategy.
The web tier is being containerized and moved to AWS Fargate (a managed container service) to eliminate OS-level management, without modifying the core application architecture. This represents a Replatform strategy.
Replatforming involves making minor optimizations to run on cloud-managed services without changing the core architecture.
2
Analyze the database tier migration strategy.
The database is being migrated from SQL Server to Aurora MySQL, which requires converting database schemas, converting T-SQL to MySQL, rewriting stored procedures, and updating application database client code. This represents a Refactor (or Re-architect) strategy.
Refactoring is required when a heterogeneous migration introduces database engine changes that necessitate application code modifications.

Key Concept

Selecting migration strategies using the 7 Rs framework based on application change requirements.
Estimated Time:1m 30s
Question 1396Question →

A financial services organization is planning to migrate its loan processing system to AWS. The system is composed of three main components:

* A transaction database running on Oracle Database on-premises. To reduce licensing costs, the organization wants to migrate this database to Amazon Aurora PostgreSQL, which will require converting schemas and rewriting database stored procedures.
* A web portal running on JBoss EAP on physical servers. The organization wants to package the portal into a container image and run it on Amazon ECS using AWS Fargate to reduce operational overhead, without making any modifications to the application code.
* A legacy document archival tool that integrates with a physical on-premises Hardware Security Module (HSM) appliance. Due to compliance and physical hardware dependencies, this tool must remain in the on-premises data center and communicate with AWS via AWS Direct Connect.

Which of the following identifies the most appropriate migration strategies for these three components?

Show answer & explanation

Answer: Refactor the database, replatform the web portal, and retain the archival tool.

Answer

Refactor the database, replatform the web portal, and retain the archival tool.
The correct option correctly identifies the migration paths: migrating from Oracle to Aurora PostgreSQL requires schema conversion and rewrite of database code, which is Refactoring. Containerizing the Java portal to run on Amazon ECS/Fargate without code modifications is Replatforming. Keeping the archival tool on-premises due to physical HSM dependencies is Retaining.

Step-by-Step Solution

1
Analyze the database migration requirements.
Migrating from Oracle to Amazon Aurora PostgreSQL requires schema translation and stored procedure rewriting.
Changing the core engine and modifying schemas or code is classified as a Refactor (or Re-architect) migration strategy.
2
Analyze the web portal migration requirements.
Packaging the Java-based portal into a container to run on Amazon ECS on AWS Fargate without changing the application code.
Deploying an existing application to a managed platform or container runtime without altering core application architecture is classified as a Replatform strategy.
3
Analyze the legacy archival tool requirements.
The tool cannot be migrated due to hardware dependency on a physical on-premises HSM and must continue running on-premises.
Keeping a workload in its source environment due to migration barriers or lack of business case for moving is classified as a Retain strategy.

Key Concept

Selecting the correct AWS migration strategy (7 Rs) based on architectural constraints, application changes, and hardware dependencies.
Question 1397Question →

An enterprise telemetry analytics SaaS provider runs its data ingestion service on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances process high-velocity telemetry logs from client sites across three Availability Zones. The instances utilize a bootstrap script that downloads configuration files and initializes local caching, which takes approximately 8 minutes to complete before they can accept traffic. The provider recently suffered an outage during an unannounced marketing campaign by one of its enterprise clients, which caused an immediate, massive surge in HTTP traffic. During this surge, the ALB returned 503 Service Unavailable errors. The ASG scale-out policy triggered multiple times, but launched dozens of unnecessary instances that remained idle once the traffic surge subsided. Additionally, outbound database connection attempts from instances in two of the Availability Zones failed because the route tables pointed to a single NAT Gateway located in the third Availability Zone, which became resource-constrained and crashed. Which configuration should a solutions architect implement to resolve these issues?

Show answer & explanation

Answer: Establish a NAT Gateway within each Availability Zone and configure the route tables for each private subnet to route outbound traffic through its local gateway. Update the Auto Scaling group to use a target tracking scaling policy with the instance warmup time set to 540 seconds. Coordinate with clients to obtain advance notice of promotional events and request AWS Support to pre-warm the Application Load Balancer.

Answer

Establish a NAT Gateway within each Availability Zone and configure the route tables for each private subnet to route outbound traffic through its local gateway. Update the Auto Scaling group to use a target tracking scaling policy with the instance warmup time set to 540 seconds. Coordinate with clients to obtain advance notice of promotional events and request AWS Support to pre-warm the Application Load Balancer.
The correct solution addresses all three failure points. First, setting up a NAT Gateway in each Availability Zone ensures that a failure or capacity limit in one zone does not impact outbound database connections in other zones. Second, configuring the instance warmup time to 540 seconds (which is greater than the 8-minute boot/initialization time) prevents the Auto Scaling group from launching excess instances before the newly scaled-out instances can begin processing traffic and lowering the target metric. Third, obtaining advance warning and pre-warming the Application Load Balancer ensures that the load balancer has enough pre-provisioned capacity to handle the immediate, massive traffic surge without dropping requests or returning 503 errors.

Step-by-Step Solution

1
Address outbound connectivity fault tolerance by provisioning a NAT Gateway in each of the three Availability Zones.
Outbound traffic from each Availability Zone goes through its local NAT Gateway, eliminating cross-AZ dependencies and avoiding a single point of failure.
The original architecture relied on a single NAT Gateway, which crashed due to high traffic and took down outbound connectivity for two other Availability Zones.
2
Modify the Auto Scaling group policy to prevent over-provisioning during instance bootstrapping by adjusting the instance warmup time.
Setting the instance warmup time to 540 seconds (9 minutes) ensures that the group waits for the 8-minute bootstrap process to finish before evaluating scaling metrics again.
If the warmup or cooldown period is shorter than the time required for a new instance to boot and begin processing traffic (8 minutes), the Auto Scaling group will falsely detect that more capacity is needed and launch redundant instances.
3
Establish a process for advance notice of flash traffic spikes and configure load balancer pre-warming.
AWS Support pre-warms the Application Load Balancer to support the expected traffic volume before the spike occurs, preventing 503 Service Unavailable errors.
Application Load Balancers automatically scale in response to traffic, but sudden, massive spikes can overwhelm the load balancer before it can scale up to meet the demand.

Key Concept

To ensure high availability and proper scaling behavior, outbound traffic paths must be redundant across Availability Zones, the Auto Scaling cooldown or warmup times must exceed the initialization time of new instances, and load creators must pre-warm Application Load Balancers for immediate flash traffic.
Question 1398Question →

An autonomous vehicle technology firm is designing a high-performance simulation platform on AWS. The platform requires a shared file storage solution to support machine learning model training and log analysis.

The workload profiles and performance indicators are as follows:
* Workload Type: Shared File Storage (POSIX-compliant, supporting advisory file locking)
* Active Dataset: 500 TB500\text{ TB} requiring sub-millisecond read latency and up to 12 GB/s12\text{ GB/s} read throughput
* Archive Dataset: 4 PB4\text{ PB} of historical sensor logs that are infrequently accessed but must be immediately available with low latency when a simulation is rerun
* Disaster Recovery Constraints: The primary deployment is in `us-east-1`. A read-only secondary replica must be maintained in `eu-west-1` with a Recovery Point Objective (RPO) of less than 10 minutes10\text{ minutes} and a Recovery Time Objective (RTO) of less than 1 hour1\text{ hour}.
* Security Constraints: All data must be encrypted at rest using Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS).

Which storage architecture represents the most cost-effective design that satisfies all latency, throughput, RPO/RTO, and security requirements?

Show answer & explanation

Answer: Deploy Amazon FSx for NetApp ONTAP in `us-east-1` using FlexGroup volumes with an 'Auto' tiering policy to transition cold data to capacity pool storage. Encrypt the file system using a regional customer managed KMS key. Deploy a single-AZ FSx for ONTAP file system in `eu-west-1` encrypted with a local customer managed KMS key. Configure NetApp SnapMirror to replicate data from `us-east-1` to `eu-west-1` on a schedule that satisfies the 10-minute10\text{-minute} RPO.

Answer

Deploy Amazon FSx for NetApp ONTAP in the primary region using FlexGroup volumes with Capacity Pool tiering and customer managed KMS encryption, then replicate to a secondary region cluster using NetApp SnapMirror.
The correct architecture uses Amazon FSx for NetApp ONTAP with FlexGroup volumes to scale throughput to twelve gigabytes per second and support POSIX locking. The Auto tiering policy minimizes storage costs by automatically tiering the four petabytes of cold logs to capacity pool storage. Cross-region replication via NetApp SnapMirror enables block-level replication capable of meeting the sub-ten-minute RPO. Customer Managed Keys are utilized to configure custom KMS key policies allowing cross-region key delegation.

Step-by-Step Solution

1
Analyze performance and scalability constraints.
Amazon FSx for NetApp ONTAP FlexGroup volumes support scaling read throughput to over ten gigabytes per second with sub-millisecond latencies, satisfying the active simulation throughput requirement.
Identifying the file system technology that natively supports the performance scale and POSIX locks is the first step in storage selection.
2
Analyze cost-effective tiering for the archive dataset.
The Auto tiering policy on FSx for ONTAP transparently transitions cold block data to the Capacity Pool, reducing storage costs for the four petabytes of log archives while keeping them immediately accessible.
Storing multiple petabytes of cold logs on high-performance SSD storage is cost-prohibitive, necessitating tiering.
3
Evaluate the disaster recovery replication path.
NetApp SnapMirror replicates metadata and block updates incrementally, easily achieving a recovery point objective under ten minutes, unlike file-based sync methods or high-latency replication schedules.
Ensuring the selected replication mechanism matches the recovery point and recovery time objectives.
4
Evaluate key management and encryption capabilities.
Customer Managed Keys (CMKs) must be utilized because AWS-managed keys do not allow cross-region policy modifications required by NetApp SnapMirror.
Ensuring encryption meets the security policy and allows cross-region cryptographic actions.

Key Concept

Selecting and configuring high-performance shared file storage with cross-region replication and data tiering while satisfying strict compliance and recovery objectives.
Question 1399Question →

A company runs a critical business application on a fleet of Amazon EC2 instances. The infrastructure is deployed and managed using AWS CloudFormation. The internal operating system configurations and application settings on these instances must strictly align with a configuration definition defined in an Ansible playbook. Recently, system administrators have performed manual updates to the configuration files on individual instances via SSH to troubleshoot issues, resulting in configuration drift that has caused application instability. A solutions architect needs to design a solution that will automatically detect these manual operating system-level changes and restore the instances to the desired state with minimal service disruption and operational overhead. Which solution should the solutions architect implement?

Show answer & explanation

Answer: Configure AWS Systems Manager State Manager by creating an association that targets the EC2 instances. Specify the AWS-ApplyAnsiblePlaybooks document and point it to the Ansible playbook stored in an Amazon S3 bucket. Configure the association to run on a regular schedule to automatically reapply the playbook and correct any operating system-level configuration drift.

Answer

Configure AWS Systems Manager State Manager by creating an association targeting the EC2 instances with the AWS-ApplyAnsiblePlaybooks document pointing to the Ansible playbook in Amazon S3, configured to run on a regular schedule.
AWS Systems Manager State Manager is specifically designed to enforce a consistent configuration state on EC2 instances. By creating an association targeting the fleet using the AWS-ApplyAnsiblePlaybooks document and referencing a playbook in S3, State Manager periodically executes Ansible to ensure the OS configuration matches the defined baseline. This automatically remediates any drift introduced by manual console or SSH operations with minimal overhead.

Step-by-Step Solution

1
Determine the scope of the configuration drift.
The drift is occurring at the operating system file level (internal settings modified via SSH), not at the AWS resource property level.
This helps select the appropriate tool, as CloudFormation drift detection only tracks resource properties defined in the template, while Systems Manager manages internal OS state.
2
Select a configuration management tool capable of applying local playbooks.
AWS Systems Manager State Manager is selected because it integrates with target EC2 instances and can execute the AWS-ApplyAnsiblePlaybooks document.
State Manager associations can run periodically to enforce a desired state, automatically correcting local configuration drift.
3
Evaluate and eliminate options that violate access and security scopes.
Eliminated options using SCPs for OS restrictions and cross-account decryption using AWS-managed KMS keys.
SCPs cannot control OS files, and AWS-managed KMS keys cannot be modified or shared cross-account.

Key Concept

Operating system-level configuration drift management and remediation using AWS Systems Manager State Manager.
Question 1400Question →

An enterprise is strengthening the security posture of an existing data processing application. The application runs on Amazon ECS Fargate tasks in a private subnet within VPC A (Account A). The tasks process telemetry data and write the results to a centralized Amazon S3 bucket in Account B. The S3 bucket is configured with default encryption using an AWS KMS Customer Managed Key (CMK) in Account B.

Currently, the ECS tasks access the S3 bucket via an S3 Gateway VPC Endpoint in VPC A. The security team must implement the following improvements:
- Ensure all data upload requests to the S3 bucket and KMS cryptographic requests are kept off the public internet.
- Restrict the S3 bucket and KMS CMK access so that they only accept requests originating from VPC A's VPC endpoints.
- Prevent administrators in Account A from modifying the KMS key policies or S3 bucket policies in Account B, while ensuring Account B security administrators retain full management capabilities.

Which combination of actions will meet these security requirements with the least operational complexity?

Show answer & explanation

Answer: Create a KMS Interface VPC Endpoint in VPC A. Update the S3 bucket policy in Account B to allow write permissions for the ECS task IAM role, with a condition restricting access to the S3 Gateway VPC Endpoint ID. Update the KMS CMK key policy in Account B to allow cryptographic permissions for the ECS task IAM role, with a condition restricting access to the KMS Interface VPC Endpoint ID. Rely on the default AWS cross-account security boundaries to restrict Account A administrators.

Answer

Create a KMS Interface VPC Endpoint in VPC A. Update Account B's S3 bucket policy and KMS CMK key policy to trust Account A's ECS task IAM role, using the condition key aws:sourceVpce restricted to the S3 Gateway Endpoint ID and the KMS Interface Endpoint ID, respectively. Prevent Account A administrators from modifying Account B's resources by relying on standard AWS cross-account boundaries.
The correct answer provides a secure architecture that uses a KMS Interface VPC Endpoint in VPC A to ensure KMS API calls stay off the public internet, and restricts access to both S3 and KMS using the aws:sourceVpce condition key in the S3 bucket policy and KMS key policy. It also correctly relies on default AWS account boundaries, as Account A administrators have no native access to modify policies in Account B.

Step-by-Step Solution

1
Address the network path requirement for KMS by creating a KMS Interface VPC Endpoint in VPC A.
KMS cryptographic requests from the ECS tasks in VPC A can be routed privately within the AWS network without traversing the public internet.
AWS KMS does not support Gateway VPC Endpoints, so an Interface VPC Endpoint (PrivateLink) must be used to ensure private connectivity.
2
Configure S3 bucket policy restrictions in Account B using the S3 Gateway Endpoint ID.
The S3 bucket policy allows writes from Account A's ECS tasks only when requests originate from VPC A's S3 Gateway Endpoint.
Using the aws:sourceVpce condition key with the S3 Gateway Endpoint ID enforces that S3 write operations are strictly routed through VPC A's endpoint.
3
Configure the KMS Customer Managed Key policy in Account B to grant access to the ECS task IAM role, restricted by the KMS Interface VPC Endpoint ID.
ECS tasks can call KMS APIs to generate data keys for uploading data, but only when requests originate from the KMS Interface VPC Endpoint.
Since the bucket is encrypted with SSE-KMS using a Customer Managed Key, the client must have permissions to the KMS key. Restricting this using the KMS Interface VPC Endpoint ID ensures the cryptographic operations remain private.
4
Evaluate administrative control requirements for the policies in Account B.
No Service Control Policy (SCP) or extra IAM configuration is required to block Account A admins from modifying Account B's policies.
Default AWS cross-account security boundaries prevent administrators in one account from modifying policies or resources in another account unless explicit cross-account administration roles are created and assumed.

Key Concept

Strengthening identity and network security in a hybrid, cross-account architecture involves combining VPC Interface and Gateway Endpoints with resource-based policies (S3 bucket and KMS key policies) restricted by condition keys like aws:sourceVpce, while understanding that AWS account boundaries natively isolate resource management.
PreviousPage 70 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin