All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A company hosts a critical web application on AWS using Amazon EC2 instances in an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The instances are deployed across $3$ Availability Zones and require outbound internet access to communicate with a third-party payment gateway. The company experiences two recurring issues during flash sale events: first, during the first few minutes of a traffic surge, users experience HTTP $503$ errors. Second, the ASG launches excess instances because new instances take $8$ minutes to bootstrap, and the ASG initiates subsequent scale-out actions before the initial batch of instances completes bootstrapping. Currently, outbound internet traffic is routed via a single NAT gateway in one Availability Zone. Which TWO actions should a Solutions Architect recommend to resolve these scaling and reliability issues?

Select all that apply

Deploy a NAT gateway in each Availability Zone, update the route tables to route outbound traffic through the local NAT gateway, and contact AWS Support to pre-warm the Application Load Balancer before scheduled flash sale events.

Transition the Auto Scaling group to use target tracking scaling policies, and configure the instance warmup time to be greater than the

8

-minute instance bootstrapping duration.

Maintain the single NAT gateway to minimize running costs, and configure the Auto Scaling group to use step scaling policies with a scaling cooldown period of

120

seconds.

Decrease the default cooldown period of the Auto Scaling group to

300

seconds to accelerate scaling actions, and rely on the Application Load Balancer's automatic scaling to absorb the initial traffic spikes without pre-warming.

Configure simple scaling policies with a cooldown period that is shorter than the bootstrapping time to ensure the Auto Scaling group remains highly responsive during traffic surges.

Show answer & explanation

Answer: Deploy a NAT gateway in each Availability Zone, update the route tables to route outbound traffic through the local NAT gateway, and contact AWS Support to pre-warm the Application Load Balancer before scheduled flash sale events.; Transition the Auto Scaling group to use target tracking scaling policies, and configure the instance warmup time to be greater than the $8$ -minute instance bootstrapping duration.

Answer

Deploy a NAT gateway in each Availability Zone, update route tables to route outbound traffic locally, request Application Load Balancer pre-warming prior to events, and transition the Auto Scaling group to target tracking scaling policies with an instance warmup time set to be greater than the

8

-minute bootstrapping duration.

Deploying a NAT gateway per Availability Zone ensures that outbound connectivity is fault-tolerant across AZs. Pre-warming the Application Load Balancer ensures the load balancer has sufficient capacity to handle sudden flash sale traffic immediately without dropping connections. Configuring the target tracking scaling policy with an instance warmup period longer than the

8

-minute bootstrapping time prevents the Auto Scaling group from launching redundant instances while the initial instances are still completing their startup configuration.

Step-by-Step Solution

Address the immediate Application Load Balancer limitation for sudden traffic surges.

By pre-warming the Application Load Balancer, AWS provisionally scales the load balancer capacity to meet the expected flash sale traffic, eliminating the HTTP

503

errors caused by scaling lag.

Sudden spikes in traffic exceed the normal scaling speed of the Application Load Balancer.

Address the Auto Scaling Group's over-provisioning behavior during bootstrapping.

By transitioning to target tracking scaling policies and configuring the instance warmup period to exceed the

8

-minute (

480

seconds) bootstrapping time, the Auto Scaling group will wait for new instances to become operational and start contributing to metric reduction before executing further scaling actions.

This prevents duplicate scaling actions while the initial instances are booting.

Address the single point of failure in the outbound network path.

By deploying a NAT gateway in each of the three Availability Zones and directing each private subnet's route table to its local NAT gateway, the outbound connection is protected against a single Availability Zone outage.

This establishes fault tolerance and high availability for payment gateway communication.

Key Concept

Auto scaling warmup configuration, load balancer pre-warming, and multi-AZ NAT gateway redundancy are critical for fault tolerance and scaling efficiency under predictable burst loads.

Question 1442Question →

An e-commerce corporation hosts its microservices across multiple AWS accounts structured under an AWS Organization. To automate resource provisioning, the DevOps team utilizes AWS CloudFormation StackSets initiated from a central release account. The templates and software packages are stored in a shared Amazon S3 bucket in this central release account. Recently, engineering teams in individual production accounts have performed ad-hoc manual adjustments to their VPC configuration and security group rules, causing subsequent automated stack updates to fail. The security compliance guidelines demand that the shared S3 bucket must be encrypted at rest, and cross-account access must adhere strictly to the principle of least privilege. Which two actions should a solutions architect perform to establish automated drift remediation and ensure secure, seamless cross-account deployment pipeline execution?

Select all that apply

Encrypt the shared Amazon S3 bucket in the central release account using a Customer Managed Key (CMK), and configure the key policy to grant the AWS CloudFormation StackSet execution roles in the target member accounts permissions to perform the kms:Decrypt action.

Implement an AWS Config organizational rule across all accounts to detect resource non-compliance, and configure an AWS Systems Manager Automation runbook to automatically remediate any unauthorized changes.

Encrypt the shared Amazon S3 bucket in the central release account using the default AWS-managed S3 key (aws/s3), and apply an Organization-level Service Control Policy (SCP) that allows target member account execution roles to perform KMS decryption operations on the key.

Establish an Organization-level Service Control Policy (SCP) that overrides local IAM policies in target member accounts, directly granting the central release account pipeline identity permission to provision resources without local cross-account execution roles.

Configure AWS Systems Manager State Manager in the target member accounts to execute an Ansible playbook that forcibly deletes and recreates any drift-detected resources hourly, ensuring compatibility with the StackSet templates without triggering CloudFormation stack updates.

Set up AWS CodeDeploy in the central release account to manage CloudFormation template deployments using a linear deployment strategy, and trigger automated rollbacks using AWS Config alerts when configuration changes occur.

Show answer & explanation

Answer: Encrypt the shared Amazon S3 bucket in the central release account using a Customer Managed Key (CMK), and configure the key policy to grant the AWS CloudFormation StackSet execution roles in the target member accounts permissions to perform the kms:Decrypt action.; Implement an AWS Config organizational rule across all accounts to detect resource non-compliance, and configure an AWS Systems Manager Automation runbook to automatically remediate any unauthorized changes.

Answer

Encrypt the shared Amazon S3 bucket using a Customer Managed Key (CMK) in the central release account with a cross-account decryption key policy, and deploy an AWS Config organizational rule with an AWS Systems Manager Automation runbook for automatic remediation.

To support cross-account CloudFormation deployments, the deployment artifacts stored in the S3 bucket of the central release account must be decryptable by execution roles in the target member accounts. A Customer Managed Key (CMK) must be used because AWS-managed keys (like aws/s3) cannot be configured with cross-account permissions. Additionally, manual configuration changes introduce drift that blocks CloudFormation updates. Implementing an AWS Config organizational rule with an AWS Systems Manager Automation runbook allows the organization to detect and automatically revert manual modifications (drift) back to the compliant state without altering physical resource IDs, ensuring that subsequent CloudFormation deployments proceed successfully.

Step-by-Step Solution

Provision a Customer Managed Key (CMK) in the central release account.

A customizable KMS key is created that supports cross-account key policies.

AWS-managed KMS keys do not allow policy modifications and cannot grant access to roles in other AWS accounts.

Update the KMS key policy of the CMK to grant kms:Decrypt permissions to the IAM execution roles in the target member accounts, and enable S3 default encryption on the bucket using this key.

The deployment artifacts are securely encrypted, and the StackSet execution roles in member accounts can successfully read and decrypt templates during deployment.

Enforces the principle of least privilege by specifying exactly which target execution roles can decrypt the deployment artifacts.

Deploy an AWS Config organizational rule across all target member accounts to monitor security groups and VPC configurations.

Continuous compliance monitoring is established, triggering alerts whenever manual changes to managed resources occur.

Provides organization-wide detection of configuration drift on the resources managed by CloudFormation.

Associate an AWS Systems Manager Automation runbook as the remediation target for the AWS Config rule.

When non-compliance or drift is detected, the runbook automatically corrects the resource attributes back to the target baseline.

Remediates the configuration drift programmatically, ensuring future StackSet deployments do not fail due to conflicting manually applied settings.

Key Concept

Automated drift remediation and secure cross-account deployment using CloudFormation StackSets, AWS Config, and KMS Customer Managed Keys.

Question 1443Question →

An online retail company, ShopVibe, is modernizing its legacy order processing application to run on AWS. The application consists of a frontend service and an order validation service. The modernization strategy requires migrating the application to Amazon ECS using the AWS Fargate launch type to minimize operational overhead. The database hosting the order data remains on-premises, accessed via an AWS Direct Connect connection. The validation service must communicate with the frontend service with low latency and must not be exposed to the public internet. Security policies dictate that all inter-container traffic must be encrypted, and container task execution roles must follow the principle of least privilege. Which TWO configurations must a Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Configure the Amazon ECS tasks using the awsvpc network mode inside private subnets, and enable ECS Service Connect with TLS encryption for secure, internal service-to-service communication.

Provision distinct ECS Task Execution Roles for pulling images and secrets, and distinct ECS Task Roles specifying minimal permissions for runtime access to external resources like the on-premises database.

Configure the ECS tasks to use the bridge network mode to enable dynamic port mapping on the underlying host, facilitating container-to-container communication.

Create a single Route 53 Private Hosted Zone for internal DNS resolution in a centralized management VPC without associating it with the task VPC.

Place the tasks in a single Availability Zone and deploy a single NAT Gateway in that zone to handle all outbound database synchronization requests.

Show answer & explanation

Answer: Configure the Amazon ECS tasks using the awsvpc network mode inside private subnets, and enable ECS Service Connect with TLS encryption for secure, internal service-to-service communication.; Provision distinct ECS Task Execution Roles for pulling images and secrets, and distinct ECS Task Roles specifying minimal permissions for runtime access to external resources like the on-premises database.

Answer

To meet the requirements, the Solutions Architect should configure the Amazon ECS tasks using the awsvpc network mode inside private subnets with ECS Service Connect and TLS, and provision distinct ECS Task Execution Roles and ECS Task Roles.

The correct configurations involve using the awsvpc network mode (which is required by AWS Fargate) paired with ECS Service Connect for encrypted private traffic, and establishing separate task execution and runtime task roles to maintain least privilege.

Step-by-Step Solution

Determine the supported network mode for AWS Fargate containers.

Fargate tasks require the awsvpc network mode, which provides a dedicated elastic network interface (ENI) for each task.

Bridge or host networking modes are incompatible with AWS Fargate.

Configure secure, private communication between services.

Enable ECS Service Connect with TLS, which handles service discovery and encrypts container-to-container traffic automatically within the VPC.

Service Connect bypasses the public internet and fulfills the encryption requirement without manual SSL certificate management.

Apply security permissions following least privilege.

Establish separate IAM roles: the Task Execution Role for ECS agent permissions (e.g., pulling images, reading secrets) and the Task Role for the container application runtime (e.g., communicating with the database).

Separating these roles prevents credential exposure and restricts runtime environments to only necessary resources.

Key Concept

Fargate networking constraints and proper configuration of IAM roles for least-privilege task security.

Question 1444Question →

A company manages its multi-account environment using AWS Organizations. A central DevOps account contains an AWS CodePipeline pipeline that deploys application infrastructure to multiple production target accounts using AWS CloudFormation StackSets. The pipeline stores its build artifacts in an Amazon S3 bucket within the DevOps account. During a deployment, target accounts are unable to retrieve artifacts from the S3 bucket. Additionally, security audits reveal that local administrators in target accounts are manually modifying security groups, causing configuration drift and subsequent deployment failures.

Which of the following actions should the Solutions Architect take to resolve the artifact access issue and automatically remediate the configuration drift? (Select TWO.)

Select all that apply

Configure an AWS Key Management Service (AWS KMS) Customer Managed Key to encrypt the S3 artifact bucket, and update the key policy to allow the deployment roles in the target accounts to decrypt artifacts.

Deploy an AWS Config rule across all target accounts using AWS Organizations conformance packs to monitor security group configurations, and associate an AWS Systems Manager (SSM) Automation runbook to automatically revert unauthorized changes.

Enable default encryption on the S3 artifact bucket using the AWS-managed KMS key (aws/s3), and attach a bucket policy that grants cross-account read access to the target account IAM roles.

Attach a Service Control Policy (SCP) to the target accounts' Organization Unit (OU) that explicitly grants read permissions for the DevOps S3 bucket to bypass local IAM policy checks in the target accounts.

Configure the CloudFormation StackSet deployment parameters with the IgnoreDrift flag enabled to automatically overwrite manual modifications in target accounts without triggering rollbacks.

Show answer & explanation

Answer: Configure an AWS Key Management Service (AWS KMS) Customer Managed Key to encrypt the S3 artifact bucket, and update the key policy to allow the deployment roles in the target accounts to decrypt artifacts.; Deploy an AWS Config rule across all target accounts using AWS Organizations conformance packs to monitor security group configurations, and associate an AWS Systems Manager (SSM) Automation runbook to automatically revert unauthorized changes.

Answer

Configure an AWS KMS Customer Managed Key to encrypt the S3 bucket and allow cross-account decrypt operations, and use AWS Config rules with AWS Systems Manager Automation to detect and revert security group modifications.

The correct options involve configuring a Customer Managed Key (CMK) in KMS to encrypt the S3 bucket and updating the key policy to allow cross-account access, and deploying an AWS Config rule using AWS Organizations conformance packs with an SSM Automation runbook for drift remediation. This ensures target account roles can access artifacts securely and any manual modifications are automatically reverted to maintain compliance.

Step-by-Step Solution

Address the cross-account S3 artifact decryption constraint.

Create a Customer Managed Key (CMK) in KMS, associate it with the S3 bucket, and grant key decrypt permissions to the target accounts' roles.

AWS-managed keys cannot be shared cross-account, so a CMK is required for target accounts to access DevOps S3 artifacts.

Implement a configuration compliance framework.

Use AWS Config conformance packs deployed organization-wide to monitor security group modifications.

AWS Config provides continuous monitoring of resource configurations across the AWS Organization.

Automate remediation of configuration drift.

Configure AWS Systems Manager (SSM) Automation as a remediation target for the AWS Config rule.

SSM Automation can execute predefined or custom runbooks to automatically revert unauthorized changes, remediating drift.

Key Concept

Automating drift remediation and managing cross-account resource encryption in multi-account CI/CD pipelines.

Question 1445Question →

A financial services company is migrating a legacy, compliance-restricted application from an on-premises data center to AWS using AWS Application Migration Service (MGN). The target architecture consists of a multi-account environment managed by AWS Organizations. The application servers will be launched into a private subnet within a Workload VPC.

Hybrid connectivity is established using an AWS Direct Connect connection terminated at an AWS Transit Gateway. The Transit Gateway connects the Workload VPC and a centralized Network Services VPC. The Network Services VPC hosts an outbound internet egress path consisting of a cluster of firewalls behind NAT Gateways. Due to strict regulatory requirements, the on-premises source servers have no outbound public internet access. The Solutions Architect has configured the MGN replication template to "Use private IP" for data routing and has created Interface VPC endpoints for MGN in the Workload VPC to keep all replication traffic within the private network.

The replication agent was successfully installed on the source servers, but the replication status is stuck at $0\%$ (Initiating) and fails to establish a data connection. Which combination of configuration modifications will resolve this issue and allow replication to proceed?

Configure the on-premises DNS servers to conditionally forward queries for mgn.<region>.amazonaws.com to Route 53 Resolver Inbound Endpoints in the Workload VPC. Allow outbound TCP port

443

on the on-premises firewall to the Workload VPC CIDR. Configure the MGN replication server security group to allow inbound TCP port

443

from the on-premises subnet, and configure the on-premises firewall to block TCP port

1500

to enforce secure HTTPS-only data transit.

Associate the MGN Interface VPC endpoints with a Direct Connect Gateway using a private virtual interface (VIF). Configure the Workload VPC route table to route all on-premises replication traffic directly through a private VIF on the Direct Connect Gateway, bypassing the Transit Gateway for transitive routing between the Workload VPC and the on-premises environment.

Configure the on-premises DNS servers to conditionally forward queries for mgn.<region>.amazonaws.com to Route 53 Resolver Inbound Endpoints in the Workload VPC. Allow outbound TCP port

443

and TCP port

1500

on the on-premises firewall to the Workload VPC CIDR. Ensure the security group of the MGN Interface VPC endpoints allows inbound TCP port

443

from the on-premises subnet, and the MGN replication server security group allows inbound TCP port

1500

from the on-premises subnet.

Deploy the MGN Interface VPC endpoints and Route 53 Resolver Inbound Endpoints in the Network Services VPC. Create the Route 53 Private Hosted Zone for mgn.<region>.amazonaws.com and associate it only with the Network Services VPC. Configure the on-premises DNS servers to forward queries to the Inbound Endpoints, and configure the on-premises firewall to allow outbound TCP port

1500

and port

443

to the Workload VPC CIDR.

Show answer & explanation

Answer: Configure the on-premises DNS servers to conditionally forward queries for mgn.<region>.amazonaws.com to Route 53 Resolver Inbound Endpoints in the Workload VPC. Allow outbound TCP port $443$ and TCP port $1500$ on the on-premises firewall to the Workload VPC CIDR. Ensure the security group of the MGN Interface VPC endpoints allows inbound TCP port $443$ from the on-premises subnet, and the MGN replication server security group allows inbound TCP port $1500$ from the on-premises subnet.

Answer

Configure on-premises DNS to forward queries for the MGN service to Route 53 Resolver Inbound Endpoints, allow outbound TCP ports

443

and

1500

on the on-premises firewall to the Workload VPC CIDR, and allow inbound traffic on those ports in the corresponding AWS security groups.

The correct solution addresses both the control plane communication (TCP port

443

via Route 53 Resolver Inbound Endpoints and Interface VPC Endpoints) and the data plane replication (TCP port

1500

via Direct Connect routing and security groups). This allows secure, private infrastructure migration without exposing any workloads to the public internet.

Step-by-Step Solution

Set up private DNS resolution for the MGN endpoint from on-premises.

Deploy Route 53 Resolver Inbound Endpoints in the Workload VPC, and configure the on-premises DNS servers to forward queries for mgn.<region>.amazonaws.com to the Inbound Endpoint IPs.

Since there is no public internet access, the on-premises servers must resolve the public MGN API endpoint name to the private IPs of the Interface VPC Endpoints.

Configure on-premises firewall rules.

Permit outbound TCP port

443

and TCP port

1500

from the source servers to the Workload VPC CIDR.

TCP port

443

is required to communicate with the MGN control plane API, and TCP port

1500

is required to transmit replication data to the replication servers.

Configure AWS Security Groups for incoming traffic.

Ensure the MGN Interface VPC Endpoint security group allows inbound TCP port

443

from the on-premises subnet, and the replication server security group allows inbound TCP port

1500

from the on-premises subnet.

This allows the source servers to establish connections to the MGN control plane endpoints and to the target replication servers in the staging area.

Key Concept

AWS MGN replication requires TCP port

443

to access the service API and TCP port

1500

for data replication. In private networks, this requires proper Route 53 Resolver Inbound Endpoints, Private Hosted Zone association, and security group/firewall configurations.

Estimated Time:3m 0s

Question 1446Question →

A financial services organization uses AWS Organizations to manage a multi-account environment. A shared services VPC in a central networking account hosts a Route 53 Private Hosted Zone (PHZ) named `corp.internal` containing records for internal tools. Multiple application VPCs in member accounts need to resolve records in this PHZ. Additionally, the security team requires that all VPCs within the organization block DNS resolution for known malicious domain names to prevent data exfiltration. The solution must be highly available, minimize latency, and automatically apply to any new VPCs created within the organization. Which solution meets these requirements with the least operational overhead?

Associate the Private Hosted Zone (PHZ) with the application VPCs by authorizing the association from the central account and accepting it in the member accounts, automating the process for new VPCs using AWS Lambda. Share a Route 53 Resolver DNS Firewall rule group containing the blocked domains with the organization via AWS Resource Access Manager (RAM), and use AWS Firewall Manager to centrally associate it with all VPCs.

Share the Private Hosted Zone (PHZ) with the AWS Organization using AWS Resource Access Manager (RAM) to allow automatic resolution across all application VPCs. Share a Route 53 Resolver DNS Firewall rule group containing the blocked domains with the organization via RAM, and use AWS Firewall Manager to centrally associate it with all VPCs.

Configure Route 53 Resolver inbound endpoints in the shared services VPC and outbound endpoints in the application VPCs, creating forwarding rules to route DNS queries to the inbound endpoints. Create local Route 53 Resolver DNS Firewall rule groups in each member account, manually associating them with each VPC, and enforce configuration lock-down via Service Control Policies (SCPs).

Associate the Private Hosted Zone (PHZ) with the application VPCs by authorizing the association from the central account and accepting it in the member accounts, automating the process for new VPCs using AWS Lambda. Apply a Service Control Policy (SCP) at the organization root that includes a Deny statement for DNS resolution requests targeting the malicious domain names.

Show answer & explanation

Answer: Associate the Private Hosted Zone (PHZ) with the application VPCs by authorizing the association from the central account and accepting it in the member accounts, automating the process for new VPCs using AWS Lambda. Share a Route 53 Resolver DNS Firewall rule group containing the blocked domains with the organization via AWS Resource Access Manager (RAM), and use AWS Firewall Manager to centrally associate it with all VPCs.

Answer

Directly associating the Route 53 Private Hosted Zone (PHZ) with the member VPCs using cross-account authorizations allows the local Route 53 Resolver in each VPC to answer queries directly, ensuring high availability, minimizing latency, and avoiding extra endpoint costs. Using AWS Resource Access Manager (RAM) and AWS Firewall Manager is the correct and automated way to share and centrally apply a Route 53 Resolver DNS Firewall rule group across the entire AWS Organization, automatically protecting new VPCs as they are created.

Step-by-Step Solution

Configure cross-account Route 53 Private Hosted Zone (PHZ) association.

Create association authorizations from the central networking account for each application VPC, and accept the associations in the member accounts. This allows the Route 53 Resolver in each application VPC to resolve the PHZ records locally without traversing transit gateway endpoints.

Direct association provides the lowest latency and highest availability for DNS resolution in a multi-account environment.

Automate VPC associations for future accounts.

Deploy an AWS Lambda function triggered by AWS Organizations event patterns (such as CreateAccount or new VPC creation) to automatically authorize and associate the PHZ with new VPCs.

This removes manual operational overhead and ensures compliance for new resources.

Create and share the Route 53 Resolver DNS Firewall rule group.

Create the rule group with a domain list containing the blocked malicious domains. Share this rule group with the AWS Organization using AWS Resource Access Manager (RAM).

Centrally managing the list in the networking account ensures consistency and security policy alignment.

Associate the DNS Firewall rule group centrally using AWS Firewall Manager.

Configure a Firewall Manager policy that targets all VPCs in the organization and associates the shared DNS Firewall rule group.

Firewall Manager automatically applies the rule group association to any new VPCs created within the targeted OUs or accounts.

Key Concept

Cross-account DNS architecture and centralized security policy enforcement using Route 53 Resolver DNS Firewall, AWS RAM, and AWS Firewall Manager.

Estimated Time:2m 30s

Question 1447Question →

An online learning platform hosts its virtual classroom service on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances process real-time WebSocket connections and video streaming metadata. The application requires approximately $8\text{ minutes}$ ( $480\text{ seconds}$ ) to download container images, run local database migrations, and pass application-level health checks. The platform experiences sudden spikes in users at the start of every hour. During these spikes, the ALB returns HTTP $503$ errors for the first $10\text{ minutes}$ , and the ASG launches three times as many instances as needed, causing a significant budget overrun. Additionally, if an Availability Zone fails, outbound API calls to external video rendering services fail for instances running in the remaining healthy zones because all outbound traffic is routed through a single NAT gateway in the affected Availability Zone.

Which configuration changes should a solutions architect implement to resolve these issues? (Select TWO.)

Select all that apply

Deploy a NAT gateway in each Availability Zone, and update the route tables of the private subnets in each zone to route outbound traffic (

0.0.0.0/0

) through the NAT gateway in the same zone.

Increase the default instance warmup time in the Auto Scaling group's target tracking scaling policy to at least

540\text{ seconds}

, and configure an Auto Scaling warm pool to keep pre-warmed instances ready to transition to the running state.

Reduce the default cooldown period of the Auto Scaling group to

120\text{ seconds}

to allow the scaling policy to react faster to sudden load spikes at the start of each hour.

Submit a request to AWS Support to pre-warm the Application Load Balancer before the start of each hour, and rely on the ALB's target tracking policy to scale the backend EC2 instances.

Configure a single NAT gateway in a public subnet spanning all Availability Zones, and update the private route tables to route all outbound traffic (

0.0.0.0/0

) to this NAT gateway.

Show answer & explanation

Answer: Deploy a NAT gateway in each Availability Zone, and update the route tables of the private subnets in each zone to route outbound traffic ( $0.0.0.0/0$ ) through the NAT gateway in the same zone.; Increase the default instance warmup time in the Auto Scaling group's target tracking scaling policy to at least $540\text{ seconds}$ , and configure an Auto Scaling warm pool to keep pre-warmed instances ready to transition to the running state.

Answer

Deploy a NAT gateway in each Availability Zone with local routing, and increase the default instance warmup time in the Auto Scaling group's target tracking scaling policy to at least

540\text{ seconds}

along with an Auto Scaling warm pool.

To achieve high availability and fault tolerance for outbound internet traffic, a NAT gateway must be deployed in each Availability Zone, with the private subnet route tables configured to point outbound traffic to the local NAT gateway. To resolve the Auto Scaling group launch loop caused by the

8\text{ minutes}

bootstrapping time, the default instance warmup time must be configured to be longer than the boot time (such as

540\text{ seconds}

). This prevents the target tracking policy from launching additional instances before the newly booted ones register as healthy and decrease the metric average. A warm pool also helps by keeping pre-warmed instances ready, reducing the time to bring new instances into service.

Step-by-Step Solution

Analyze the NAT gateway failure pattern.

Identify that the current architecture uses a single NAT gateway in one Availability Zone, which represents a single point of failure for all instances in other Availability Zones during a zone outage.

To ensure fault-tolerant outbound connectivity, outbound traffic must be distributed across redundant NAT gateways located in each Availability Zone.

Address the Auto Scaling group launch loop and boot delay.

Determine that the EC2 boot lag (

8\text{ minutes}

480\text{ seconds}

) is causing the ASG to launch extra instances because the scaling metric does not reflect the capacity of booting instances.

By setting the default instance warmup time to at least

540\text{ seconds}

(which exceeds the

480\text{ seconds}

boot time), the scaling policy will wait for newly launched instances to begin contributing to metrics before triggering another scaling activity. The warm pool further reduces this delay.

Key Concept

Configuring redundant NAT gateways for Availability Zone resilience and adjusting Auto Scaling metrics (instance warmup and warm pools) to align with instance bootstrapping times.

Question 1448Question →

A company is building a continuous integration and continuous delivery (CI/CD) pipeline using AWS CodePipeline in a centralized DevTools AWS account. The pipeline needs to deploy application stacks to multiple production member accounts within the same AWS Organization by using AWS CloudFormation. The deployment artifacts are stored in an Amazon S3 bucket in the DevTools account. The company's security policy requires that all data stored in the S3 bucket be encrypted at rest and that access follow the principle of least privilege. During execution, the pipeline fails because the deployment roles in the target production accounts cannot access the artifacts in the S3 bucket. Which combination of actions will allow the pipeline to successfully deploy the application stacks to the production accounts? (Select two.)

Select all that apply

Configure the Amazon S3 artifact bucket in the DevTools account to use an AWS KMS customer managed key, and update the key policy to allow the cross-account IAM roles in the production accounts to perform decryption operations.

Configure the Amazon S3 artifact bucket in the DevTools account to use the default AWS managed key (aws/s3), and attach a policy to the production execution roles allowing cross-account access to the default key.

Configure the pipeline's deployment stage to assume a cross-account IAM role in the target production accounts, and update the S3 bucket policy in the DevTools account to grant these roles permission to read the artifacts.

Apply a Service Control Policy (SCP) to the production Organizational Unit (OU) that explicitly delegates access to the DevTools account's CodePipeline service role, allowing it to bypass local IAM policies in the production accounts.

Manually update the configuration of the deployed resources in the production accounts using the AWS Console to point to the central S3 bucket, then configure CloudFormation drift detection to prevent future stack updates from rolling back due to manual changes.

Show answer & explanation

Answer: Configure the Amazon S3 artifact bucket in the DevTools account to use an AWS KMS customer managed key, and update the key policy to allow the cross-account IAM roles in the production accounts to perform decryption operations.; Configure the pipeline's deployment stage to assume a cross-account IAM role in the target production accounts, and update the S3 bucket policy in the DevTools account to grant these roles permission to read the artifacts.

Answer

Configure the Amazon S3 artifact bucket in the DevTools account to use an AWS KMS customer managed key with a key policy allowing cross-account decryption, and configure the pipeline's deployment stage to assume a cross-account IAM role in the production accounts while granting it read access in the S3 bucket policy.

For cross-account deployments, the pipeline must assume an IAM role in the destination account. Since the S3 bucket contains build artifacts, that destination role must be granted permissions to read from the bucket via the bucket policy in the DevTools account. Additionally, because the artifacts are encrypted, a customer managed key (CMK) must be used since default AWS managed keys cannot be shared across accounts. The key policy on the CMK must allow the target role in the production account to decrypt the objects.

Step-by-Step Solution

Configure the S3 bucket to use an AWS KMS customer managed key (CMK).

Deployment artifacts will be encrypted with a key that supports sharing across AWS accounts.

AWS-managed KMS keys do not allow cross-account access.

Update the S3 bucket policy and KMS key policy in the DevTools account.

The target production account roles are allowed to get objects and decrypt them.

Explicit cross-account permissions must be granted on both the storage resource and the key resource.

Configure the CodePipeline deployment action to assume the target production account IAM role.

The deployment is executed in the context of the destination account with proper localized permissions.

CloudFormation needs local execution capabilities inside the production account to deploy resources.

Key Concept

Cross-account pipeline automation and secure artifact sharing using Customer Managed KMS Keys and S3 bucket policies.

Question 1449Question →

A financial technology startup is designing a global payment processing platform. The platform requires a multi-region database and storage strategy across us-east-1 (primary) and us-west-2 (secondary). The requirements include:

* A transactional ledger database (OLTP) that requires a Recovery Time Objective (RTO) of less than 1 minute and a Recovery Point Objective (RPO) of less than 5 seconds.
* A user session store (NoSQL) that must support active-active low-latency writes and reads in both regions.
* Transaction receipt images stored in Amazon S3 must be replicated to the secondary region and remain accessible to an audit team operating in a separate AWS account.

Which combination of AWS database and storage configurations will meet these requirements? (Select TWO.)

Select all that apply

Deploy Amazon Aurora Global Database for the transactional ledger, and use Amazon DynamoDB global tables to store user session data.

Configure Amazon S3 Cross-Region Replication (CRR) for transaction receipts using a Customer Managed Key (CMK) in AWS KMS, updating the KMS key policy in the primary account to delegate access to the audit account's role.

Deploy Amazon RDS Multi-AZ DB clusters in both regions and configure AWS Database Migration Service (DMS) for bi-directional replication to meet RTO and RPO requirements.

Configure Amazon S3 Cross-Region Replication (CRR) for transaction receipts using the AWS-managed KMS key (aws/s3) and use S3 bucket policies to grant read permissions to the audit account role.

Use Amazon DynamoDB in a single region and configure AWS Resource Access Manager (RAM) to share the user session tables between the primary and secondary regions to achieve active-active capability.

Show answer & explanation

Answer: Deploy Amazon Aurora Global Database for the transactional ledger, and use Amazon DynamoDB global tables to store user session data.; Configure Amazon S3 Cross-Region Replication (CRR) for transaction receipts using a Customer Managed Key (CMK) in AWS KMS, updating the KMS key policy in the primary account to delegate access to the audit account's role.

Answer

To meet the requirements, the startup must deploy Amazon Aurora Global Database for the transactional ledger, use Amazon DynamoDB global tables for the active-active user session store, and configure Amazon S3 Cross-Region Replication (CRR) using a Customer Managed Key (CMK) with cross-account access delegated via its key policy.

The correct options involve deploying Amazon Aurora Global Database for the OLTP ledger and Amazon DynamoDB global tables for the session store, combined with S3 Cross-Region Replication using a KMS Customer Managed Key (CMK) for the receipts. Aurora Global Database uses storage-level physical replication to secondary regions, maintaining lag under a second, which allows for RPO under 5 seconds and RTO under a minute upon promotion. DynamoDB global tables offer active-active replication to provide local read and write latencies in multiple regions. Furthermore, S3 Cross-Region Replication using a Customer Managed Key allows the key policy to be customized, which is necessary to grant cross-account decryption rights to the external audit team.

Step-by-Step Solution

Evaluate OLTP requirements.

Identify that Amazon Aurora Global Database replicates storage at the physical layer with lag typically under 1 second, providing RPO < 5 seconds. Promoting a secondary region takes less than 1 minute, meeting RTO requirements.

Standard RDS replication or DMS replication does not guarantee the required sub-minute RTO and sub-5-second RPO at the database layer.

Evaluate NoSQL requirements.

Identify that Amazon DynamoDB global tables provide fully managed active-active replication with local read/write capabilities.

Single-region tables with resource sharing or other workarounds do not support low-latency active-active performance.

Evaluate cross-account storage encryption and replication.

Determine that Amazon S3 Cross-Region Replication (CRR) with Customer Managed Keys (CMK) is required to allow key policy modifications for cross-account KMS key delegation.

AWS-managed KMS keys (aws/s3) do not support policy modification and cannot be shared with external audit accounts.

Key Concept

Designing a secure, high-performing, and resilient multi-region database and storage architecture using Aurora Global Database, DynamoDB Global Tables, and S3 Cross-Region Replication with KMS Customer Managed Keys.

Question 1450Question →

An enterprise is planning to migrate a legacy retail order management system to AWS. The migration must be completed within 6 months due to an upcoming data center lease expiration. The system consists of three distinct tiers:

* Presentation Tier: A custom Node.js web application running on VM instances. The development team has containerized the application locally and wants to run it on a managed container service (Amazon ECS on AWS Fargate) to reduce operational overhead without modifying any application code.
* Database Tier: An Oracle Database 19c running on IBM AIX. The database has complex PL/SQL packages. The enterprise wants to migrate the database to Amazon Aurora PostgreSQL to eliminate expensive Oracle licensing costs. The schema and code migration will require utilizing the AWS Schema Conversion Tool (AWS SCT) and rewriting database stored procedures.
* Legacy Processing Tier: A proprietary, COBOL-based batch processing engine that runs on a mainframe. The system relies on physical USB security keys connected to the mainframe hardware for cryptographic validation. There is no timeline or budget to refactor this application, and it must remain operational.

Which of the following migration strategy mappings should the solutions architect recommend under the 7 Rs framework? (Select TWO.)

Select all that apply

Refactor the Database Tier by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) to convert the schema and rewrite stored procedures for Amazon Aurora PostgreSQL.

Retain the Legacy Processing Tier on-premises because the mainframe workload depends on physical USB hardware keys that cannot be virtualized or replicated in the cloud.

Replatform the Database Tier by using AWS Schema Conversion Tool (AWS SCT) to migrate the Oracle database schema to Amazon Aurora PostgreSQL without modifying application code.

Rehost the Legacy Processing Tier by using AWS Application Migration Service (MGN) to lift-and-shift the mainframe operating system blocks directly to Amazon EC2.

Rehost the Database Tier by using AWS Database Migration Service (AWS DMS) to perform a direct schema-only lift-and-shift of the Oracle database on IBM AIX to Amazon RDS for PostgreSQL.

Show answer & explanation

Answer: Refactor the Database Tier by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) to convert the schema and rewrite stored procedures for Amazon Aurora PostgreSQL.; Retain the Legacy Processing Tier on-premises because the mainframe workload depends on physical USB hardware keys that cannot be virtualized or replicated in the cloud.

Answer

The Solutions Architect should recommend Refactoring the Database Tier to migrate from Oracle to Aurora PostgreSQL, and Retaining the Legacy Processing Tier on-premises due to its physical hardware dependency.

The Database Tier requires a database engine migration from Oracle to Amazon Aurora PostgreSQL, which involves schema conversion and rewriting stored procedures. This falls under the Refactor (Re-architect) migration strategy. The Legacy Processing Tier depends on physical USB hardware keys connected to mainframe hardware and lacks a migration or modernization budget, which requires keeping the workload on-premises. This falls under the Retain migration strategy.

Step-by-Step Solution

Analyze the Database Tier requirements and constraints.

The target is to move from Oracle to Aurora PostgreSQL to eliminate licensing costs. This requires schema conversion and rewrite of PL/SQL stored procedures, which represents a structural database change.

Identifying the required modifications helps classify the migration strategy. Since code changes and engine transformation are required, this matches the Refactor (Re-architect) strategy under the 7 Rs framework.

Analyze the Legacy Processing Tier requirements and constraints.

The system runs on mainframe hardware, requires a physical USB security key for cryptographic validation, and has no modernization budget or timeline.

Since the physical hardware dependency cannot be replicated in a standard cloud environment and there is no budget to rewrite the system, the workload must remain on-premises, which maps to the Retain strategy.

Compare valid strategies with the options to identify correct selections and eliminate distractors.

Refactoring is correct for the database tier, and Retaining is correct for the mainframe. Rehosting or Replatforming options either misclassify the database engine conversion or propose technically impossible cloud migrations for the mainframe.

Selecting the correct two strategies ensures compliance with the 7 Rs framework and the technical realities of the legacy architecture.

Key Concept

Selecting migration strategies under the 7 Rs framework requires evaluating technical dependencies (like physical hardware or operating systems) and the degree of application modification (like database engine conversions).

Question 1451Question →

A company is planning to migrate a highly active on-premises Microsoft SQL Server database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration must convert all SQL Server database schemas, stored procedures, and triggers, and must be executed with minimal downtime. The database contains several tables with frequent update activities. A Solutions Architect is designing the migration process using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) with Change Data Capture (CDC). Which strategy should the Solutions Architect recommend to perform this migration successfully?

Use AWS SCT to convert the SQL Server schema and stored procedures to PostgreSQL, and apply the schema to the target Aurora PostgreSQL DB cluster. Create an AWS DMS task configured for Full Load plus CDC, using the default source endpoint configurations without enabling MS-Replication or Change Data Capture (CDC) on the SQL Server instance.

Use AWS SCT to convert the database schema, stored procedures, and triggers, and apply the converted schema to the target Aurora PostgreSQL DB cluster. Configure the source SQL Server database to use the Full Recovery model, perform a full backup, enable MS-Replication or Change Data Capture (CDC) on the source database, and configure the AWS DMS task to perform a Full Load and continuous Change Data Capture (CDC).

Replatform the database by using SQL Server Native Backup and Restore to copy the backup files directly to Amazon S3, and restore them into Amazon RDS for SQL Server. Use AWS SCT on the restored database to convert the schema and stored procedures, and directly migrate the database code and tables to Aurora PostgreSQL.

Use AWS SCT to convert the SQL Server schema and apply the schema directly to the Aurora PostgreSQL primary instance. Configure AWS DMS to run a Full Load task targeting the Aurora Read Replica, then enable Aurora Replica Auto Scaling to handle continuous replication workloads from the source SQL Server database.

Show answer & explanation

Answer: Use AWS SCT to convert the database schema, stored procedures, and triggers, and apply the converted schema to the target Aurora PostgreSQL DB cluster. Configure the source SQL Server database to use the Full Recovery model, perform a full backup, enable MS-Replication or Change Data Capture (CDC) on the source database, and configure the AWS DMS task to perform a Full Load and continuous Change Data Capture (CDC).

Answer

The correct strategy requires converting the schema and database code from SQL Server to PostgreSQL using the AWS Schema Conversion Tool (AWS SCT) and applying it to the target Aurora PostgreSQL DB cluster. For the ongoing data replication (CDC) via AWS DMS, the source SQL Server database must be configured with the Full Recovery model, a full backup must be taken to initiate the log sequence chain, and MS-Replication or MS-CDC must be enabled to allow DMS to read the database transaction logs.

Step-by-Step Solution

Run AWS SCT to convert SQL Server schemas, stored procedures, and triggers, and apply the generated PostgreSQL DDL schemas to the target Amazon Aurora PostgreSQL cluster.

The target Aurora PostgreSQL database is initialized with the converted tables, procedures, and triggers.

This is a heterogeneous migration, so schema conversion must occur before copying the actual data.

Ensure the source SQL Server database uses the Full Recovery model, perform a full backup of the source, and enable either MS-Replication or MS-CDC on the tables being migrated.

The SQL Server database is ready to record and maintain transaction logs in a format that AWS DMS can read for ongoing changes.

AWS DMS requires these configuration parameters to access the SQL Server transaction log replication capabilities for CDC.

Create and run an AWS DMS replication task using the 'Full Load + CDC' migration type targeting the Aurora PostgreSQL primary DB instance.

Data is successfully loaded, and updates are replicated to the target with minimal downtime.

The combination of Full Load and CDC allows migration of historical data followed by continuous updates, keeping the target database in sync until cutover.

Key Concept

Heterogeneous database migration from Microsoft SQL Server to Amazon Aurora PostgreSQL requires schema conversion via AWS SCT and CDC prerequisites on the source SQL Server database (Full Recovery model, backups, and MS-Replication/MS-CDC) to enable continuous replication via AWS DMS.

Question 1452Question →

An enterprise is reviewing the security of a multi-account AWS environment. In Account A, an application running on Amazon EC2 instances needs to read encrypted files from an Amazon S3 bucket located in Account B. The S3 bucket is currently encrypted using the default AWS-managed key (`aws/s3`). To comply with the principle of least privilege and strengthen cross-account access controls, a solutions architect must configure the access path. Which of the following configurations will successfully and securely enable the EC2 instances in Account A to read the encrypted S3 objects in Account B?

Configure the S3 bucket in Account B to use a Customer Managed Key (CMK) for encryption. Update the CMK key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform decryption. Grant the S3 bucket policy in Account B and the IAM policy in Account A permissions to read the S3 objects.

Retain the default AWS-managed key (`aws/s3`) for S3 bucket encryption. Modify the key policy of `aws/s3` in Account B to allow the IAM role of the EC2 instances in Account A to perform decryption, and configure the S3 bucket policy in Account B to allow cross-account access.

Attach a Service Control Policy (SCP) at the AWS Organizations root that explicitly grants decryption and read access to the S3 bucket in Account B for the IAM role in Account A, and rely on the SCP to automatically delegate permissions cross-account.

Create a Route 53 Private Hosted Zone for the S3 bucket endpoint in Account B and associate it with the VPC in Account A, relying on the private DNS resolution to bypass default KMS cross-account decryption restrictions.

Show answer & explanation

Answer: Configure the S3 bucket in Account B to use a Customer Managed Key (CMK) for encryption. Update the CMK key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform decryption. Grant the S3 bucket policy in Account B and the IAM policy in Account A permissions to read the S3 objects.

Answer

The correct configuration uses a Customer Managed Key (CMK) for the S3 bucket encryption. Because default AWS-managed keys (like `aws/s3`) do not support policy modification, they cannot be configured to allow decryption requests from external AWS accounts. Using a Customer Managed Key allows the owner of the key (Account B) to edit the key policy and grant `kms:Decrypt` access to the IAM role in Account A. Combined with the appropriate S3 bucket policy in Account B and the IAM user/role policy in Account A, this securely authorizes the cross-account read request.

Step-by-Step Solution

Transition S3 encryption from the AWS-managed key (`aws/s3`) to a Customer Managed Key (CMK) in Account B.

A Customer Managed Key is created and configured as the encryption key for the target S3 bucket.

AWS-managed KMS keys do not permit modifications to their key policies, making them unusable for cross-account decryption operations.

Update the CMK key policy in Account B to trust the IAM role in Account A.

The key policy explicitly grants the `kms:Decrypt` permission to the ARN of the IAM role assigned to the EC2 instances in Account A.

For cross-account KMS access, the resource owner (Account B) must explicitly authorize the external identity in the key policy.

Update the S3 bucket policy in Account B and the IAM policy in Account A to allow read permissions.

The S3 bucket policy in Account B allows `s3:GetObject` for the Account A IAM role, and the Account A IAM policy allows `s3:GetObject` and `kms:Decrypt`.

Cross-account S3 access requires explicit authorization in both the source IAM policy (trusting/allowing outbound) and the target bucket policy (allowing inbound).

Key Concept

Cross-account access to KMS-encrypted S3 objects requires a Customer Managed Key because AWS-managed keys cannot be shared cross-account.

Question 1453Question →

A healthcare SaaS company runs a medical imaging archiving workload in a dedicated member account of an AWS Organization. The architecture consists of the following components:

- A fleet of Amazon EC2 instances running inside an Auto Scaling group behind an Application Load Balancer across three Availability Zones. The instances are currently of type `c5.xlarge` (which provides $4$ vCPUs and $8$ GiB of memory). Over the past 90 days, CloudWatch metrics show average CPU utilization is at $18\%$ , while memory utilization consistently peaks at $85\%$ .
- An Amazon RDS for PostgreSQL database instance (`db.r5.8xlarge` with $32$ vCPUs and $256$ GiB of memory) configured in a Multi-AZ deployment. Database CPU utilization averages $8\%$ and write throughput is low.
- Several AWS Lambda functions used for processing metadata, triggering dynamically throughout the day.

Consolidated billing is managed from the management account. The company wants to optimize costs while ensuring no degradation in performance, durability, or availability.

Which combination of recommendations will achieve the greatest cost optimization? (Select TWO.)

Select all that apply

Modify the Auto Scaling group launch template to use `m6g.large` instances, which provide

2

vCPUs and

8

GiB of memory, and recompile the application for the Graviton architecture.

Purchase Compute Savings Plans in the AWS Organizations management account to maximize discount coverage across the EC2 instances in the member account and the Lambda functions.

Purchase EC2 Instance Savings Plans in the member account for the C5 instance family to ensure the discounts are strictly locked to the application instances and cover the Lambda functions.

To reduce NAT Gateway costs in the member account, deploy a single NAT Gateway in one Availability Zone and update the route tables of the private subnets across all Availability Zones to route outbound internet traffic through this single NAT Gateway.

Consolidate outbound traffic by sharing subnets using AWS Resource Access Manager (RAM) with external third-party partner accounts outside the AWS Organization to route traffic through a single NAT Gateway, without enabling sharing with external entities in the RAM settings.

Show answer & explanation

Answer: Modify the Auto Scaling group launch template to use `m6g.large` instances, which provide $2$ vCPUs and $8$ GiB of memory, and recompile the application for the Graviton architecture.; Purchase Compute Savings Plans in the AWS Organizations management account to maximize discount coverage across the EC2 instances in the member account and the Lambda functions.

Answer

The correct recommendations are to modify the Auto Scaling group launch template to use `m6g.large` instances (requiring recompilation for Graviton) and to purchase Compute Savings Plans in the AWS Organizations management account.

The combination of using `m6g.large` instances and purchasing Compute Savings Plans is correct because it addresses the mismatched resource consumption (low CPU, high memory) of the C5 instances by migrating to a more cost-effective instance family with equivalent memory capacity. In addition, Compute Savings Plans provide the flexibility required to cover both the EC2 instance workloads and the AWS Lambda functions, and purchasing them in the management account enables sharing the discount benefits across all member accounts under consolidated billing.

Step-by-Step Solution

Analyze the EC2 CPU and memory utilization metrics.

CPU utilization is

18\%

4\text{ vCPUs} = 0.72\text{ vCPUs}

. Memory utilization peaks at

85\%

8\text{ GiB} = 6.8\text{ GiB}

This establishes that the workload is memory-bound and does not require

4

vCPUs. An instance with

2

vCPUs and

8

GiB of memory (such as `m6g.large`) is a better fit.

Evaluate the discount plans for compute workloads including serverless.

Compute Savings Plans cover both EC2 and Lambda compute usage and apply regardless of instance family changes.

This guarantees that the discounts will persist even after the migration from C5 to M6g instances, unlike EC2 Instance Savings Plans which are locked to a specific instance family.

Key Concept

Right-sizing instance configurations based on active utilization metrics and applying flexible Savings Plans at the organization level.

Alternative Method

Instead of manual resizing, AWS Compute Optimizer could be used to analyze historical utilization patterns and automatically suggest the optimal Graviton-based instance types.

Estimated Time:2m 0s

Question 1454Question →

An enterprise runs an application hosted on Amazon ECS tasks using the AWS Fargate launch type inside a private subnet of VPC A in Account A (Production). The application needs to retrieve database credentials from AWS Secrets Manager in Account B (Shared Services). The secret is encrypted using an AWS KMS Customer Managed Key (CMK) in Account B. In addition, the application must resolve private DNS records for services in Account B, which are defined in a Route 53 Private Hosted Zone (PHZ) in Account B.

Currently, all traffic from VPC A to Secrets Manager traverses the public internet via NAT Gateways, and the application cannot resolve the private DNS names of the resources in Account B. The Solutions Architect must strengthen the identity, access, and network security posture of this existing solution by keeping all traffic within the AWS private network and using least-privilege access.

Which TWO actions should the Solutions Architect take to meet these requirements?

Select all that apply

Create an Interface VPC Endpoint for AWS Secrets Manager in VPC A. Update the key policy of the Customer Managed Key in Account B to grant kms:Decrypt permissions to the ECS task role in Account A. Attach an IAM policy to the ECS task role in Account A that permits the secretsmanager:GetSecretValue action.

From Account B, authorize the association of the Route 53 Private Hosted Zone with VPC A using the AWS CLI or SDK. From Account A, associate the Route 53 Private Hosted Zone with VPC A.

Encrypt the secret in Account B using the default AWS managed key (aws/secretsmanager), and modify the AWS managed key policy to grant the ECS task role in Account A decrypt permissions.

Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A that grants the ECS task role the secretsmanager:GetSecretValue and kms:Decrypt permissions, removing the need for local IAM policies.

Route DNS queries from VPC A to the Amazon-provided DNS server (

169.254.169.253

) in VPC B over a Transit Gateway attachment, without associating the Private Hosted Zone with VPC A.

Show answer & explanation

Answer: Create an Interface VPC Endpoint for AWS Secrets Manager in VPC A. Update the key policy of the Customer Managed Key in Account B to grant kms:Decrypt permissions to the ECS task role in Account A. Attach an IAM policy to the ECS task role in Account A that permits the secretsmanager:GetSecretValue action.; From Account B, authorize the association of the Route 53 Private Hosted Zone with VPC A using the AWS CLI or SDK. From Account A, associate the Route 53 Private Hosted Zone with VPC A.

Answer

Create an Interface VPC Endpoint for AWS Secrets Manager in VPC A, configure cross-account access using a Customer Managed Key with modified key policies, and associate the Route 53 Private Hosted Zone in Account B with VPC A.

Establishing an Interface VPC Endpoint for AWS Secrets Manager ensures that traffic between VPC A and Secrets Manager remains within the AWS network. For cross-account access to the secret, a Customer Managed Key (CMK) must be used because its key policy can be modified to grant decrypt permissions to the external ECS task role, and the ECS task role itself must have the corresponding Secrets Manager permission. Additionally, associating the Route 53 Private Hosted Zone in Account B with VPC A enables VPC A to resolve the private DNS names directly via the VPC's local resolver.

Step-by-Step Solution

Deploy an Interface VPC Endpoint for AWS Secrets Manager in VPC A.

Traffic between the ECS tasks in VPC A and the Secrets Manager service endpoint routes privately within the AWS network.

This satisfies the requirement to prevent traffic from traversing the public internet via NAT Gateways.

Configure cross-account key and identity policies for Secrets Manager.

The ECS task role in Account A is granted permissions to read the secret, and the key policy of the Customer Managed Key in Account B is updated to permit decryption by the task role.

Because AWS managed keys cannot be modified or shared cross-account, a Customer Managed Key is required to delegate decrypt privileges securely.

Associate the Route 53 Private Hosted Zone from Account B with VPC A.

VPC A's Amazon-provided DNS resolver can resolve the private hostnames defined in Account B's hosted zone.

A Private Hosted Zone cannot resolve names in VPCs of other accounts unless an association is authorized from the owner account and completed by the consumer account.

Key Concept

Cross-account resource access requires configuring a Customer Managed Key (since AWS managed keys cannot be modified) and updating both IAM and key policies. Cross-account Route 53 Private Hosted Zone resolution requires explicit authorization and association.

Question 1455Question →

A solutions architect is planning the migration of a mission-critical, on-premises Oracle database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The source database contains complex PL/SQL packages, custom functions, and several high-transaction tables, some of which do not have primary keys. To minimize the migration's impact on the source database's CPU utilization during the change data capture (CDC) phase, and to ensure that the application's Oracle-specific database functions are supported on the target database, which combination of actions should the solutions architect take?

Convert the schema using AWS SCT and manually rewrite the PL/SQL packages. Configure the AWS DMS replication task using the Oracle LogMiner method for CDC, and enable supplemental logging for primary keys on all source tables.

Convert the schema using AWS SCT and apply the SCT extension pack to the target Aurora DB cluster. Configure the AWS DMS replication task to use the Binary Reader method for CDC, and enable supplemental logging for all columns on the source Oracle tables that lack primary keys.

Perform an offline migration by taking a cold backup of the Oracle database, converting the schemas with AWS SCT, and using AWS DataSync to copy the database files to an Amazon S3 bucket for import into Aurora PostgreSQL.

Convert the schema using AWS SCT and apply the SCT extension pack to Aurora PostgreSQL. Configure the AWS DMS replication task using the Oracle LogMiner method for CDC, and scale the target Aurora PostgreSQL DB cluster using reader endpoints to offload replication processing.

Show answer & explanation

Answer: Convert the schema using AWS SCT and apply the SCT extension pack to the target Aurora DB cluster. Configure the AWS DMS replication task to use the Binary Reader method for CDC, and enable supplemental logging for all columns on the source Oracle tables that lack primary keys.

Answer

The correct answer is correct because applying the AWS SCT extension pack allows the target Aurora PostgreSQL DB cluster to emulate Oracle-specific functions. Implementing the AWS DMS Binary Reader method for CDC allows DMS to read redo logs directly, minimizing resource consumption on the source database. Furthermore, enabling supplemental logging for all columns on the source Oracle tables without primary keys is required so that AWS DMS can uniquely identify rows and correctly apply updates and deletes during replication.

Step-by-Step Solution

Use AWS SCT to convert the Oracle database schema and apply the generated SCT extension pack to the target Aurora PostgreSQL DB cluster.

Oracle-specific features and functions are emulated successfully on the PostgreSQL target, maintaining database compatibility without manual rewrites.

Heterogeneous migrations require schema translation and target emulation for database-specific logic.

Configure the AWS DMS replication task with the Oracle source endpoint settings to use the Binary Reader method for CDC.

DMS reads redo logs directly from the OS or ASM directory, avoiding SQL-based LogMiner execution.

This minimizes the CPU overhead on the source Oracle database under high-transaction workloads.

On the source Oracle database, enable supplemental logging for all columns on tables that do not have primary keys.

Full row image information is placed in the redo logs for updates and deletes on these tables.

AWS DMS logical replication requires the value of all columns to identify target rows when primary keys are absent.

Key Concept

Heterogeneous database migration utilizing AWS SCT extension packs and optimizing AWS DMS CDC performance on Oracle sources by leveraging Binary Reader and supplemental log configuration.

Question 1456Question →

A retail company wants to modernize its legacy order-processing application by migrating it from on-premises virtual machines to AWS. The company wants to minimize operational overhead and has chosen to deploy the containerized application on Amazon Elastic Container Service (Amazon ECS) using AWS Fargate. When configuring the ECS task definition, the solutions architect must select a network mode that assigns each task its own elastic network interface and private IP address. Which network mode must the solutions architect specify in the ECS task definition?

awsvpc

bridge

host

none

Show answer & explanation

Answer: awsvpc

Answer

awsvpc

The correct answer is awsvpc. AWS Fargate requires the awsvpc network mode for all tasks. This mode ensures that every task is allocated its own Elastic Network Interface (ENI) and a private IP address within the Amazon VPC, allowing the tasks to be managed and secured using standard VPC security groups and network access control lists.

Step-by-Step Solution

Identify the container hosting platform and launch type chosen for modernization.

Amazon ECS with AWS Fargate launch type.

AWS Fargate manages the underlying host infrastructure, restricting the available configuration parameters to those compatible with serverless containers.

Determine the network mode constraints imposed by the serverless container runtime (AWS Fargate).

AWS Fargate requires the awsvpc network mode.

Fargate tasks require dedicated Elastic Network Interfaces (ENIs) to integrate natively with VPC security groups, private IP spaces, and routing tables, which is only possible via the awsvpc network mode.

Key Concept

AWS Fargate networking modes

Question 1457Question →

An enterprise is designing a new multi-VPC environment in the `us-west-2` region. The design includes a central egress VPC (`vpc-egress`) and two spoke VPCs (`vpc-workload-a` and `vpc-workload-b`). The workloads must route all internet-bound traffic through the central egress VPC. The architecture must be highly available across two Availability Zones (`us-west-2a` and `us-west-2b`) without any single points of failure. Additionally, the workloads in the spoke VPCs must resolve private DNS names hosted in a Route 53 Private Hosted Zone (PHZ) `corp.internal` that is managed in a separate shared services AWS account.

Which two configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Deploy a NAT Gateway in the public subnet of each Availability Zone in the egress VPC. Configure the private subnet route tables to direct outbound traffic to the NAT Gateway in the corresponding Availability Zone.

Create VPC association authorizations for the spoke VPCs from the shared services AWS account where the private hosted zone is hosted, and associate the private hosted zone with the spoke VPCs using the AWS CLI or SDK.

Deploy a single NAT Gateway in one Availability Zone within the egress VPC, and configure the route tables of all other subnets in the egress VPC to route internet-bound traffic through this NAT Gateway to minimize costs.

Associate the private hosted zone with the shared services VPC and rely on Transit Gateway route propagation to transitively resolve private DNS records from the spoke VPCs.

Use an AWS Direct Connect Gateway associated with all three VPCs to enable transitive VPC-to-VPC routing for outbound internet-bound traffic.

Show answer & explanation

Answer: Deploy a NAT Gateway in the public subnet of each Availability Zone in the egress VPC. Configure the private subnet route tables to direct outbound traffic to the NAT Gateway in the corresponding Availability Zone.; Create VPC association authorizations for the spoke VPCs from the shared services AWS account where the private hosted zone is hosted, and associate the private hosted zone with the spoke VPCs using the AWS CLI or SDK.

Answer

Deploy a NAT Gateway in each Availability Zone in the egress VPC, and create VPC association authorizations in the shared services account to associate the Private Hosted Zone with the spoke VPCs.

The correct configurations deploy a NAT Gateway in the public subnet of each Availability Zone in the egress VPC, and route private subnet traffic to the local NAT Gateway. This ensures high availability and avoids cross-AZ traffic charges. Additionally, cross-account association of the Route 53 Private Hosted Zone must be authorized by the shared services account and associated with each spoke VPC so they can resolve the `corp.internal` domains.

Step-by-Step Solution

Ensure NAT gateway redundancy in the egress VPC by deploying a NAT Gateway in the public subnet of each Availability Zone.

Egress traffic remains resilient to Availability Zone outages, preventing a single point of failure.

Routing traffic across Availability Zones to a single NAT Gateway violates the high availability requirement.

Configure the spoke VPCs to route internet-bound traffic via Transit Gateway to the egress VPC, and map subnets in the egress VPC to route traffic to their respective local NAT Gateways.

Spoke VPC outbound traffic is successfully routed to the internet with AZ-level isolation.

This establishes the path for egress traffic through the central egress VPC.

Create VPC association authorizations for the spoke VPCs in the shared services account, and complete the associations in the workload accounts.

The spoke VPCs are associated with the PHZ and can resolve DNS queries for `corp.internal`.

Route 53 Private Hosted Zones do not support transitive DNS resolution over Transit Gateway, so they must be explicitly associated with each VPC.

Key Concept

High availability configuration of NAT Gateways for centralized egress and cross-account Route 53 Private Hosted Zone association.

Question 1458Question →

A financial company is migrating an on-premises Microsoft SQL Server database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration must have minimal downtime. The database contains tables with XML and VARBINARY columns (large binary objects, or LOBs) that are up to 256 KB in size. The source database utilizes active transactions and requires Change Data Capture (CDC) to replicate ongoing changes. The database migration team uses the AWS Schema Conversion Tool (SCT) and AWS Database Migration Service (DMS).

Which three actions should the Solutions Architect perform to prepare the source database and configure AWS DMS and SCT for a successful migration? (Select three.)

Select all that apply

Ensure that the SQL Server Agent service is running on the source server, enable Microsoft Change Data Capture (MS-CDC) on the source database and tables, and grant the AWS DMS database user account the db_owner role.

Install the AWS Schema Conversion Tool (SCT) Extension Pack on the target Aurora PostgreSQL DB cluster to emulate Microsoft SQL Server system functions, schema components, and database objects.

Configure the AWS DMS replication task to use Limited LOB mode, and set the maximum LOB size to 256 KB.

Configure the AWS DMS replication task to use Full LOB mode, and set the LOB chunk size to 256 KB to allow parallel replication of the XML and VARBINARY columns without performance degradation.

Install the AWS SCT extraction agent on the source SQL Server host to capture real-time transaction logs, and stream the changes to Amazon Kinesis Data Streams for loading into Aurora PostgreSQL.

Configure AWS DMS to read the active transaction logs directly from the SQL Server source without enabling MS-CDC or SQL Server Agent, using a database user account restricted to the db_datareader role to minimize security privileges.

Show answer & explanation

Answer: Ensure that the SQL Server Agent service is running on the source server, enable Microsoft Change Data Capture (MS-CDC) on the source database and tables, and grant the AWS DMS database user account the db_owner role.; Install the AWS Schema Conversion Tool (SCT) Extension Pack on the target Aurora PostgreSQL DB cluster to emulate Microsoft SQL Server system functions, schema components, and database objects.; Configure the AWS DMS replication task to use Limited LOB mode, and set the maximum LOB size to 256 KB.

Answer

The correct configuration requires enabling MS-CDC and the SQL Server Agent on the source database with a user account in the db_owner role, applying the AWS SCT Extension Pack on the target Aurora PostgreSQL DB cluster to emulate SQL Server system functions, and setting the AWS DMS task to use Limited LOB mode with a maximum LOB size of 256 KB.

For a successful heterogeneous CDC migration from SQL Server to Aurora PostgreSQL with minimal downtime, MS-CDC and SQL Server Agent must be active on the source database, and the DMS user must have the db_owner role to read transaction logs. Since the XML and VARBINARY columns (LOBs) have a maximum size of 256 KB, using Limited LOB mode set to 256 KB provides optimal replication speed compared to Full LOB mode, while avoiding truncation. Applying the AWS SCT Extension Pack on the target Aurora PostgreSQL cluster ensures compatibility by emulating SQL Server-specific system functions and schemas.

Step-by-Step Solution

Prepare the source SQL Server database for change data capture.

Ensure the SQL Server Agent service is running, enable MS-CDC on the database and specific tables, and assign the db_owner role to the migration user.

AWS DMS relies on MS-CDC to read the transaction logs on self-managed SQL Server databases. The SQL Server Agent must run to manage CDC jobs, and db_owner permissions are necessary to access the CDC tables.

Convert and apply the schema using AWS SCT.

Generate the PostgreSQL target schema using AWS SCT and apply the generated SQL. Install the AWS SCT Extension Pack on the target Aurora PostgreSQL cluster.

The SCT Extension Pack emulates SQL Server system functions, schemas, and data types on the target PostgreSQL engine to ensure compatibility of the converted schema.

Configure LOB settings in the AWS DMS replication task.

Select Limited LOB mode and set the Max LOB size to 256 KB.

Since the source database's LOB columns (XML and VARBINARY) are known to be up to 256 KB, using Limited LOB mode with this maximum size pre-allocates memory and transfers LOBs inline. This provides much higher replication performance than Full LOB mode while preventing data truncation.

Key Concept

Heterogeneous database migration from SQL Server to Aurora PostgreSQL requires source configuration (MS-CDC, running Agent, and db_owner permissions), target emulation (SCT Extension Pack), and task LOB tuning (Limited LOB mode) to balance data integrity and replication performance.

Question 1459Question →

A financial services firm is building a high-performance transaction auditing platform. The application requires an OLTP database for transaction metadata and an object storage solution for archiving raw transaction receipt files. The system must meet the following requirements:

- The transaction metadata database must handle high write throughput in the primary region (us-east-1) and support cross-region disaster recovery (us-west-2) with a recovery point objective (RPO) of less than 1 second and a recovery time objective (RTO) of less than 1 minute. Under normal operations, write performance in us-east-1 must not be impacted by database replication.
- Raw receipt files are stored in an Amazon S3 bucket in us-east-1 and must be automatically replicated to a compliance S3 bucket in us-west-2 owned by a separate audit AWS account.
- All receipt files must be encrypted at rest using Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS). The replicated files in us-west-2 must be encrypted using a CMK owned by the audit account.
- The replication process must adhere to the principle of least privilege.

Which combination of database and storage configurations should the Solutions Architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Deploy an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure local Aurora Replicas in the secondary region to enable rapid failover and support read scaling.

Configure Amazon S3 Cross-Region Replication (CRR) from the source bucket to the destination bucket. In the replication configuration, enable replication of KMS-encrypted objects, specify the audit account's Customer Managed Key (CMK) for destination encryption, and grant the replication IAM role permissions to decrypt in the source account and encrypt in the destination KMS key policy.

Provision an Amazon RDS for PostgreSQL database with a Multi-AZ deployment in us-east-1, and configure a cross-region Multi-AZ standby deployment in us-west-2. Route read-heavy queries to the standby instance in us-west-2 to optimize database performance.

Configure Amazon S3 Cross-Region Replication using the default AWS-managed KMS key (aws/s3) for encrypting objects in both the source and destination buckets. Update the default S3 KMS key policy to grant decrypt and encrypt permissions to the source account's replication IAM role.

Configure a multi-Region Amazon RDS for PostgreSQL database with synchronous replication across us-east-1 and us-west-2 to guarantee zero data loss. Implement a custom AWS Lambda function that copies receipt files to the destination S3 bucket on every s3:ObjectCreated event to achieve near-instantaneous file replication.

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure local Aurora Replicas in the secondary region to enable rapid failover and support read scaling.; Configure Amazon S3 Cross-Region Replication (CRR) from the source bucket to the destination bucket. In the replication configuration, enable replication of KMS-encrypted objects, specify the audit account's Customer Managed Key (CMK) for destination encryption, and grant the replication IAM role permissions to decrypt in the source account and encrypt in the destination KMS key policy.

Answer

The Solutions Architect should recommend deploying an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, along with configuring Amazon S3 Cross-Region Replication (CRR) from the source bucket to the destination bucket, enabling replication of KMS-encrypted objects, and granting the replication IAM role appropriate permissions in the source and destination KMS key policies.

Deploying Amazon Aurora Global Database satisfies the database RTO of under 1 minute and RPO of under 1 second, as Aurora Global Database uses asynchronous storage-level replication that does not degrade write performance in the primary region. For the storage tier, configuring S3 Cross-Region Replication (CRR) with Customer Managed Keys (CMKs) is the only valid way to copy encrypted objects to a destination bucket in another AWS account. The replication IAM role must be granted permissions to decrypt in the source account and encrypt using the destination CMK in the target audit account, maintaining least-privilege access controls.

Step-by-Step Solution

Evaluate the database tier requirements.

Identify that the database must support an RPO under 1 second, RTO under 1 minute, and asynchronous replication so write performance in the primary region is unaffected.

Amazon Aurora Global Database replicates data physically and asynchronously to a secondary region with typical lag under 1 second. Promoting the secondary cluster takes less than 1 minute, matching both RTO and RPO targets without adding synchronous write overhead.

Analyze why Amazon RDS Multi-AZ and synchronous replication are unsuitable.

Determine that Amazon RDS does not support synchronous cross-region replication, and Multi-AZ standbys cannot serve read queries.

RDS Multi-AZ is designed for high availability within a single region (or across AZs) and its standby is passive. Synchronous cross-region replication would cause prohibitive write latency.

Evaluate cross-account storage replication requirements.

Identify that raw transaction receipts in S3 must replicate cross-account and remain encrypted using Customer Managed Keys (CMKs).

S3 Cross-Region Replication (CRR) supports replicating KMS-encrypted objects. Because the target bucket is in a different account, the destination KMS CMK must explicitly authorize the source replication IAM role to perform kms:GenerateDataKey and kms:Encrypt actions.

Verify key constraints regarding KMS key types.

Confirm that AWS-managed keys (aws/s3) cannot be shared across accounts or have their policies modified.

Using AWS-managed keys for cross-account S3 replication fails because their key policies are immutable and cannot authorize roles from other AWS accounts.

Key Concept

Designing multi-region database replication using Amazon Aurora Global Database, and configuring cross-account Amazon S3 Cross-Region Replication for KMS-encrypted objects using Customer Managed Keys.

Question 1460Question →

A financial services enterprise is modernizing a legacy monolithic transaction routing application currently running on-premises on VMware virtual machines. The target architecture must be highly available across three Availability Zones, achieve a Recovery Time Objective (RTO) of less than 15 minutes, and minimize operational overhead. The modernized application will run as containers on AWS Fargate. The containerized workloads must reside in private subnets without direct internet access and securely connect to an Amazon Aurora PostgreSQL database in a shared services VPC. The private endpoint of the database is registered in an Amazon Route 53 Private Hosted Zone (PHZ) in the shared services AWS account. All container registries must be accessed privately. Which combination of network topology and task configuration meets these modernization requirements with the least operational overhead?

Deploy Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Configure ECS interface VPC endpoints in the workload VPC. Establish a Transit Gateway attachment to route traffic to the shared services VPC. Create a Route 53 Private Hosted Zone association authorization from the shared services account to the workload VPC, and associate the private hosted zone with the workload VPC.

Deploy Amazon ECS tasks using the AWS Fargate launch type with the bridge network mode. Configure ECS interface VPC endpoints in the workload VPC. Establish a Transit Gateway attachment to route traffic to the shared services VPC. Create a Route 53 Private Hosted Zone association authorization from the shared services account to the workload VPC, and associate the private hosted zone with the workload VPC.

Deploy Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Configure ECS interface VPC endpoints in the workload VPC. Establish a VPC Peering connection to route traffic to the shared services VPC. Rely on the default Route 53 Resolver to automatically resolve the shared services database endpoint across the peered VPCs without explicitly authorizing or associating the Private Hosted Zone with the workload VPC.

Deploy Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Provision a single NAT Gateway in a single public subnet of the workload VPC to route task pulling requests to Amazon ECR. Establish a Transit Gateway attachment to route traffic to the shared services VPC. Create a Route 53 Private Hosted Zone association authorization from the shared services account to the workload VPC, and associate the private hosted zone with the workload VPC.

Show answer & explanation

Answer: Deploy Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Configure ECS interface VPC endpoints in the workload VPC. Establish a Transit Gateway attachment to route traffic to the shared services VPC. Create a Route 53 Private Hosted Zone association authorization from the shared services account to the workload VPC, and associate the private hosted zone with the workload VPC.

Answer

Deploy Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode, configure ECS interface VPC endpoints, use a Transit Gateway attachment for routing to the shared services VPC, and associate the shared services Route 53 Private Hosted Zone with the workload VPC.

The correct option outlines a fully private, highly available, and operationally lightweight architecture. AWS Fargate tasks must use the awsvpc network mode. By deploying interface VPC endpoints (PrivateLink) for ECS and ECR, container images can be securely pulled without public internet paths. Cross-VPC routing to the Aurora PostgreSQL database is handled through AWS Transit Gateway. To ensure the workload VPC can resolve the database DNS name registered in the shared services account, the Route 53 Private Hosted Zone must be associated with the workload VPC. This requires a cross-account association authorization.

Step-by-Step Solution

Select container platform and networking mode.

Amazon ECS with AWS Fargate launch type configured with the awsvpc network mode, which is the only supported networking mode on Fargate.

AWS Fargate manages the underlying host instances, which requires task-level elastic network interfaces (ENIs) provided by awsvpc mode.

Configure private access to AWS container registries and control plane services.

Interface VPC endpoints (AWS PrivateLink) created for Amazon ECS, Amazon ECR, and Amazon S3 (gateway endpoint) in the workload VPC.

Ensures tasks can register with the ECS cluster and pull container images privately without requiring public IP routing or NAT Gateways.

Set up private routing and cross-VPC DNS resolution for the database connection.

Establish a Transit Gateway attachment between the workload VPC and the shared services VPC, authorize the Private Hosted Zone association from the shared services account, and associate the PHZ with the workload VPC.

Enables IP-level routing for database traffic via Transit Gateway and allows resources in the workload VPC to resolve the database private domain name using Route 53 Resolver.

Key Concept

AWS Fargate network modes, VPC Endpoint configuration, and cross-account Route 53 Private Hosted Zone association

PreviousPage 73 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution