Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1461Question →

An online food delivery platform experiences intermittent HTTP 503 Service Unavailable errors and slow response times during a daily, predictable traffic surge from 11:30 AM to 1:00 PM. The application's dispatch service runs on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer. The EC2 instances are located in private subnets across multiple Availability Zones, and they access external APIs through a single NAT Gateway located in one Availability Zone. The instances require approximately 7 minutes (420 seconds) to boot, configure, and pass health checks. The Auto Scaling group's scaling policy is configured with a cooldown period of 300 seconds. Which of the following solutions will resolve the service unavailability and address the single point of failure in the most reliable and fault-tolerant manner?

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone used by the EC2 instances and update the corresponding route tables. Adjust the Auto Scaling group cooldown period to 480 seconds, and configure a scheduled scaling policy to scale out the instances before 11:30 AM.

Answer

Deploy a NAT Gateway in each Availability Zone used by the EC2 instances, update the route tables, adjust the Auto Scaling group cooldown period to 480 seconds, and configure a scheduled scaling policy to scale out before the peak.
The correct solution addresses the network bottleneck, scaling lag, and instance thrashing. First, deploying a NAT Gateway in each Availability Zone ensures high availability for outbound traffic, removing the single point of failure. Second, setting the cooldown to 480 seconds (exceeding the 420-second instance launch and bootstrap duration) ensures the Auto Scaling group does not launch redundant instances before the active ones become healthy. Finally, using a scheduled scaling policy allows the platform to proactively add capacity ahead of the predictable lunch rush, preventing the initial response lag.

Step-by-Step Solution

1
Deploy NAT Gateways across all utilized Availability Zones.
High availability and fault tolerance are achieved for outbound traffic from the private subnets, eliminating the single point of failure.
A single NAT Gateway in one AZ leaves the entire multi-AZ stack vulnerable to an outage of that specific AZ.
2
Update the Auto Scaling group cooldown period to 480 seconds.
The Auto Scaling group will wait 8 minutes before evaluating scaling metrics again, allowing the bootstrapping instances (which take 7 minutes) to become healthy.
This prevents scaling thrashing/over-provisioning caused by scaling activities occurring before the newly launched instances register as healthy.
3
Configure a scheduled scaling policy for the known peak time.
The dispatch service scales out proactively before 11:30 AM, avoiding the lag and latency associated with reactive scaling during the sudden surge.
Since the traffic surge is highly predictable, scheduled scaling is the most effective way to guarantee resource availability.

Key Concept

Auto Scaling cooldown management, scheduled scaling for predictable loads, and multi-AZ network fault tolerance.
Question 1462Question →

A company is migrating a self-managed, on-premises PostgreSQL database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. A Solutions Architect successfully converts the database schema using the AWS Schema Conversion Tool (AWS SCT) and applies it to the target cluster. To migrate the data with minimal downtime, the architect plans to use AWS Database Migration Service (AWS DMS) with full load and Change Data Capture (CDC) enabled. However, when starting the DMS task, the full load completes successfully, but the task fails immediately upon transitioning to the CDC phase. Which configuration change must be applied to the source PostgreSQL database to resolve this issue?

Show answer & explanation

Answer: Modify the postgresql.conf file to set wal_level = logical, increase max_replication_slots and max_wal_senders to accommodate the migration tasks, and restart the PostgreSQL database instance.

Answer

Modify the postgresql.conf file to set wal_level = logical, increase max_replication_slots and max_wal_senders to accommodate the migration tasks, and restart the PostgreSQL database instance.
The correct answer is to modify the postgresql.conf file to set wal_level to logical, increase replication slots and WAL senders, and restart the database. AWS DMS requires logical replication to capture changes on PostgreSQL sources. Setting wal_level to logical enables the writing of logical replication data to the WAL, which is consumed by logical decoding plug-ins via replication slots.

Step-by-Step Solution

1
Open the postgresql.conf file on the source PostgreSQL database server.
Access is gained to edit the configuration parameters.
The configuration parameters that control write-ahead logging level and replication settings reside in this file.
2
Set the wal_level parameter to logical, and set max_replication_slots and max_wal_senders to values matching or exceeding the concurrent DMS tasks.
The parameters are defined for logical replication, which is required for AWS DMS CDC.
AWS DMS requires logical decoding on PostgreSQL to capture ongoing changes, which is only active when wal_level is set to logical.
3
Restart the PostgreSQL database server to apply the changes.
The PostgreSQL database runs with logical replication and CDC features enabled.
Changing the wal_level parameter is a static change that requires a full database restart to take effect.

Key Concept

Configuring PostgreSQL sources for AWS DMS CDC requires setting the WAL level to logical and provisioning replication slots.
Question 1463Question →

An enterprise is migrating a legacy, stateful Java application to AWS. The application consists of a public-facing web frontend and a background worker that processes messages from an Amazon SQS queue. The migration requires the web frontend to scale dynamically, the background worker to operate with minimum idle compute costs, and the entire deployment to have the lowest possible operational overhead. The enterprise also mandates high availability across multiple Availability Zones and strict network isolation within private subnets, while allowing the background worker to securely poll SQS and download external updates. Which of the following architectures meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Deploy both the web application and the background worker as Amazon ECS services on AWS Fargate using the awsvpc network mode, placing the container tasks in private subnets across multiple Availability Zones with a NAT Gateway deployed in each Availability Zone for outbound internet access.

Answer

Deploying the web application and background worker on Amazon ECS using the AWS Fargate launch type with the awsvpc network mode, combined with multi-AZ private subnets and redundant NAT Gateways, meets all operational, security, and high availability requirements.
The correct answer correctly utilizes AWS Fargate to run containers serverlessly, meeting the requirement for low operational overhead. It configures the tasks with the awsvpc network mode, which is the only network mode supported by Fargate, providing network isolation with dedicated Elastic Network Interfaces. Finally, it ensures high availability by distributing the tasks across multiple Availability Zones and deploying a NAT Gateway in each zone, preventing a single point of failure for outbound traffic.

Step-by-Step Solution

1
Identify the compute launch type that minimizes infrastructure management and operational overhead.
Select AWS Fargate, which is a serverless compute engine for containers and removes the need to provision or manage EC2 instances.
The requirement specifies minimizing operational overhead.
2
Identify the required network mode for container security, isolation, and compatibility with AWS Fargate.
Select the awsvpc network mode.
AWS Fargate only supports the awsvpc network mode, which assigns a dedicated Elastic Network Interface (ENI) to each task for secure VPC communication.
3
Design the networking topology to ensure high availability and prevent single points of failure for outbound internet traffic.
Deploy the tasks across multiple Availability Zones and configure route tables to point to a local NAT Gateway in each Availability Zone.
A single NAT Gateway creates a single point of failure for outbound traffic if its host zone becomes unavailable.

Key Concept

Modernizing legacy workloads using Amazon ECS on AWS Fargate with proper VPC network configuration and redundant egress routing.
Estimated Time:2m 0s
Question 1464Question →

An educational technology (EdTech) platform delivers online exams to hundreds of thousands of concurrent students. The application's backend database is an Amazon RDS for PostgreSQL DB instance. During peak testing hours, the database experiences performance degradation, resulting in high query latencies and database connection exhaustion. Analysis reveals two primary bottlenecks: read-heavy queries for static exam questions and test structures, which are updated rarely; and a massive surge of write-heavy transactions when students submit their answers simultaneously. The Solutions Architect must optimize the database and caching efficiency. The caching layer must support replication and automatic failover to prevent database stampedes in the event of a cache node failure, and the write bottleneck must be mitigated while limiting the rate of concurrent database connections. Which two of the following actions should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement Amazon ElastiCache for Redis in a Multi-AZ replication group to cache the static exam questions and test structures.; Decouple the quiz submission process by sending student responses to an Amazon SQS queue, and configure an AWS Lambda function with reserved concurrency to poll the queue and write answers to the RDS database in batches.

Answer

Implementing Amazon ElastiCache for Redis in a Multi-AZ replication group to cache the static exam questions, and decoupling the write-heavy quiz submissions using Amazon SQS and AWS Lambda with reserved concurrency to control the database write rate.
To offload the database from read-heavy static exam questions under high-availability constraints, the Solutions Architect should implement Amazon ElastiCache for Redis in a Multi-AZ replication group. Unlike Memcached, Redis supports replication and automatic failover, ensuring that a node failure does not drop the entire cache and overwhelm the backend database. To address the write-heavy quiz submissions, using an Amazon SQS queue to decouple the workload and an AWS Lambda function configured with reserved concurrency ensures that the database receives writes at a controlled, batched pace, avoiding connection pool exhaustion.

Step-by-Step Solution

1
Evaluate the caching requirements for the read-heavy workload.
Identify that the cache requires replication and automatic failover to prevent database stampedes upon node failure.
Amazon ElastiCache for Redis supports replication, Multi-AZ, and automatic failover, making it the appropriate choice compared to ElastiCache for Memcached.
2
Address the write-heavy bottleneck and connection exhaustion issue.
Introduce an Amazon SQS queue to buffer incoming quiz submissions and decouple the synchronous writes.
Buffering write requests prevents immediate spikes from overwhelming the database.
3
Configure the consumer to write to the RDS database safely.
Use an AWS Lambda function with reserved concurrency to pull from the SQS queue and write to the database in batches.
Batching reduces the total transaction rate, and reserved concurrency limits the number of concurrent connections the Lambda function can open to the RDS database.

Key Concept

Improving Database and Caching Efficiency using ElastiCache Redis for replicated cache reads and SQS with Lambda reserved concurrency for decoupled write rate-limiting.
Estimated Time:3m 0s
Question 1465Question →

A pharmaceutical company is executing a lift-and-shift migration of its on-premises Manufacturing Execution System (MES) to AWS using AWS Application Migration Service (MGN). The on-premises servers are located in a secure subnet with outbound traffic filtered through a local firewall. Connectivity to AWS is established via a Site-to-Site VPN terminated on an AWS Transit Gateway in a centralized Network Services account. The target staging area resides in a dedicated Staging VPC in a separate Migration account, which is attached to the same Transit Gateway. After successful installation of the MGN replication agent on the source servers, the replication status in the AWS Migration Hub console remains 'Stalled' with zero bytes transferred. Which configuration changes must the Solutions Architect implement to establish replication connectivity and allow replication data to flow to the staging area? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the security group of the Replication Servers in the Staging VPC to allow inbound traffic on TCP port 15001500 from the on-premises source subnet CIDR block.; Update the Transit Gateway route tables and the Staging VPC route tables to ensure bidirectional routing is established between the Staging VPC subnet and the on-premises subnet.

Answer

Configure the security group of the Replication Servers in the Staging VPC to allow inbound traffic on TCP port 15001500 from the on-premises source subnet CIDR block, and update the Transit Gateway route tables and the Staging VPC route tables to ensure bidirectional routing is established between the Staging VPC subnet and the on-premises subnet.
The correct options ensure that the data replication path is open. First, configuring the security group in the staging area to allow inbound TCP port 15001500 from the source CIDR is mandatory because AWS MGN uses TCP port 15001500 for data replication. Second, routing tables on both the Transit Gateway and Staging VPC must be updated to facilitate private bidirectional communication across accounts and over the Site-to-Site VPN connection.

Step-by-Step Solution

1
Analyze the replication path requirements for AWS MGN.
Identify that the Replication Agent replicates data to the Staging Area over TCP port 15001500, while control plane communication uses port 443443.
Because the status is stalled and zero bytes have been transferred, data channel connectivity (TCP port 15001500) is blocked.
2
Review the staging area security group configuration.
Confirm that the Replication Server's security group must permit inbound TCP port 15001500 traffic from the on-premises source CIDR.
This allows the agent to push replicated blocks to the Replication Servers.
3
Review hybrid routing path via Transit Gateway.
Ensure Transit Gateway route tables propagate the on-premises CIDR to the Staging VPC attachment, and the Staging VPC route table has a route for the on-premises CIDR pointing to the Transit Gateway.
Without bidirectional routing, the TCP handshake on port 15001500 cannot complete.

Key Concept

AWS MGN data replication requires network-level routing and security group permissions on TCP port 15001500 between the source servers and the Replication Servers in the target staging VPC.
Estimated Time:3m 0s
Question 1466Question →

An enterprise has a multi-tier web application running on Amazon EC2 instances in a production VPC. The instances are placed in private subnets behind an internet-facing Application Load Balancer (ALB). An AWS WAF WebACL is associated with the ALB. The WebACL includes a custom IP match rule with an 'Allow' action to permit traffic from partner IP ranges, followed by AWS Managed Rules to block SQL injection (SQLi) attacks.

A recent security audit reveals two security issues:
1. The web application EC2 instances are receiving HTTP traffic directly from external sources, bypassing the ALB.
2. Malicious SQLi attacks originating from the partner IP ranges are successfully reaching the application.

Which combination of actions should a solutions architect take to resolve these security issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the security groups of the web tier EC2 instances to only allow inbound HTTP/HTTPS traffic from the security group of the ALB, and remove any rules allowing direct public inbound access.; Adjust the rule evaluation order in the AWS WAF WebACL to position the SQL injection detection rules with a higher priority (lower numeric value) than the partner IP allow-list rule.

Answer

Configure the security groups of the web tier EC2 instances to only allow inbound HTTP/HTTPS traffic from the security group of the ALB, and adjust the rule evaluation order in the AWS WAF WebACL to position the SQL injection detection rules with a higher priority (lower numeric value) than the partner IP allow-list rule.
The correct solution involves restricting the network path at the security group level and fixing the AWS WAF evaluation order. Enforcing the EC2 security groups to only accept the ALB security group as a source blocks any direct external bypass traffic. Reordering the WebACL rules so that SQL injection detection occurs before the IP allow-list rule ensures that malicious requests from allowed IPs are inspected and blocked before being granted entry.

Step-by-Step Solution

1
Update the security groups associated with the EC2 instances in the private subnets.
Inbound rules are changed to permit traffic exclusively from the source security group of the ALB.
This guarantees that no external network traffic can bypass the load balancer and its security controls to access the application instances directly.
2
Modify the priority of the rules within the AWS WAF WebACL.
The SQL injection mitigation rule is set with a priority lower than the IP match rule.
Because AWS WAF processes rules sequentially and stops evaluation upon matching an 'Allow' action, the blocking rule must be evaluated first to intercept and drop malicious payloads before they hit the allow-list rule.

Key Concept

Strengthening identity and network boundary security by enforcing security group integration and correcting AWS WAF rule evaluation order.
Estimated Time:3m 0s
Question 1467Question →

An enterprise manages a multi-account environment under AWS Organizations with consolidated billing enabled. The architecture includes two member accounts with the following workloads:

* Account A (Production): Runs a web application on Amazon ECS using AWS Fargate. Analysis of the Fargate tasks reveals they are configured with 4 vCPU4\text{ vCPU} and 16 GB16\text{ GB} of memory. Over the past 30 days30\text{ days}, Amazon CloudWatch metrics show that the average CPU utilization is consistently at 15%15\% and peak memory utilization is 3.2 GB3.2\text{ GB}. The account also utilizes high-volume AWS Lambda functions for event-driven background processing.

* Account B (Development): Runs a fleet of Amazon EC2 instances (m6i.xlargem6i.xlarge) that operate 24/724/7. Analysis shows these instances have an average CPU utilization of 20%20\% and memory utilization never exceeds 4 GB4\text{ GB}. The development team wants to retain the instance types but apply Savings Plans to reduce compute costs.

The Solutions Architect must optimize the resource costs and sizing across these accounts while maintaining high availability for the production workloads.

Which of the following actions should the Solutions Architect recommend to achieve these objectives? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Downsize the Amazon ECS Fargate tasks in Account A to 1 vCPU1\text{ vCPU} and 4 GB4\text{ GB} of memory based on the analyzed utilization metrics.; Purchase a Compute Savings Plan in the AWS Organizations management account to automatically apply discounts to the EC2 instances, Fargate tasks, and Lambda functions across both member accounts.

Answer

Right-size the Amazon ECS Fargate tasks in Account A to 1 vCPU1\text{ vCPU} and 4 GB4\text{ GB} of memory, and purchase a Compute Savings Plan in the AWS Organizations management account.
Right-sizing the Amazon ECS Fargate tasks to 1 vCPU1\text{ vCPU} and 4 GB4\text{ GB} of memory aligns resource allocation with the measured peak memory (3.2 GB3.2\text{ GB}) and average CPU utilization (0.6 vCPU0.6\text{ vCPU}), generating immediate cost reduction without impacting performance. Purchasing a Compute Savings Plan at the AWS Organizations management account level allows the savings discount to distribute dynamically across all member accounts. Because the environment features a mix of EC2 instances, ECS Fargate tasks, and Lambda functions, a Compute Savings Plan is the only savings type that covers all three compute services, maximizing the overall financial benefit.

Step-by-Step Solution

1
Analyze Fargate utilization metrics in Account A.
Identify that average CPU utilization (15%15\% of 4 vCPU=0.6 vCPU4\text{ vCPU} = 0.6\text{ vCPU}) and peak memory (3.2 GB3.2\text{ GB}) can be accommodated by a 1 vCPU1\text{ vCPU} and 4 GB4\text{ GB} task configuration.
This right-sizes the compute resources, reducing waste while maintaining safe overhead and complying with Fargate task configuration limits.
2
Evaluate the different Savings Plan options for the multi-account architecture.
Determine that Compute Savings Plans apply to EC2, Fargate, and Lambda, whereas EC2 Instance Savings Plans only apply to EC2.
Since the workload contains Fargate tasks and Lambda functions in addition to EC2 instances, Compute Savings Plans provide the necessary flexibility to cover all these resources.
3
Determine the purchasing location for the Savings Plan.
Select the management account of the AWS Organization to leverage consolidated billing and share the savings across all member accounts.
Purchasing at the management account level allows the benefit of the Compute Savings Plan to automatically float and apply to eligible usage in any member account.

Key Concept

Compute Resource Sizing and Savings Plans Optimization under AWS Organizations
Question 1468Question →

A financial services company is planning to migrate a three-tier customer portfolio management system to AWS. The project must be completed within 6 months due to datacenter decommissioning. An assessment of the application components reveals the following:

* Reporting Component: A legacy reporting system runs on a proprietary AIX environment. The source code is unavailable, and the vendor no longer supports the product. The historical reports must remain accessible for regulatory compliance, but there is no budget to migrate or rewrite this system. The company decides to keep this component running in the on-premises datacenter with a dedicated network connection to AWS.
* Web Dashboard: An administration dashboard runs on Apache Tomcat on Linux. The development team wants to avoid managing OS patching and scaling configurations. They plan to package the application as a Docker container and deploy it to AWS Fargate using Amazon Elastic Container Service (Amazon ECS) without modifying the application code.
* Core Processing Engine: A transaction processing application relies on an on-premises Oracle Database. To eliminate expensive software licensing fees and support a 10-fold increase in transactional volume, the team wants to migrate to a serverless architecture. They plan to rewrite the application code to use AWS Lambda and convert the relational schema to a NoSQL model using Amazon DynamoDB.

Which combination of migration strategies represents the most appropriate 7 Rs classification for each component?

Show answer & explanation

Answer: Retain the Reporting Component; Replatform the Web Dashboard; Refactor the Core Processing Engine.

Answer

Retain the Reporting Component; Replatform the Web Dashboard; Refactor the Core Processing Engine.
The Reporting Component is kept in the source environment, which represents Retain. The Web Dashboard is packaged into containers and moved to a managed platform (AWS Fargate) without changing its core application code, representing Replatform. The Core Processing Engine requires rewriting code for AWS Lambda and a complete schema conversion to Amazon DynamoDB, representing Refactor.

Step-by-Step Solution

1
Analyze the migration plan for the Reporting Component.
The component will remain on-premises due to OS constraints and lack of rewrite budget.
Keeping a system in its source environment is classified as Retain.
2
Analyze the migration plan for the Web Dashboard.
The dashboard will be containerized and run on AWS Fargate without changing application code.
Optimizing the runtime platform (moving to containers and Fargate) without code changes is classified as Replatform.
3
Analyze the migration plan for the Core Processing Engine.
The engine will be rewritten for AWS Lambda and its schema converted to DynamoDB.
Rewriting application code to use cloud-native services (Lambda, DynamoDB) is classified as Refactor/Re-architect.

Key Concept

Applying the AWS 7 Rs migration strategies (Retain, Replatform, Refactor) based on constraints like OS compatibility, licensing, and code modification capability.
Estimated Time:2m 30s
Question 1469Question →

A financial services firm wants to migrate its containerized risk-simulation engine from an on-premises datacenter to AWS. The workload runs in a highly bursty manner and requires strict network isolation to comply with security regulations. The firm decides to deploy the workload using Amazon ECS on AWS Fargate. To ensure high availability, compliance, and proper functionality of the tasks in private subnets, which of the following networking and deployment configurations should the solutions architect implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the Amazon ECS task definitions to use the awsvpc network mode.; Create interface VPC endpoints (AWS PrivateLink) for Amazon ECS and Amazon ECR in the VPC to allow tasks to pull images and communicate with the control plane without traversing the public internet.

Answer

The correct configuration involves configuring the task definitions to use the awsvpc network mode and creating interface VPC endpoints (AWS PrivateLink) for Amazon ECS and Amazon ECR in the application VPC.
The correct design configurations are configuring the task definitions to use the awsvpc network mode and deploying interface VPC endpoints (AWS PrivateLink) for ECS and ECR in the VPC. Since AWS Fargate tasks require the awsvpc networking mode, configuring this mode is mandatory for container deployment on Fargate. Creating interface endpoints ensures that all container image retrieval and orchestration API traffic remain within the AWS network backbone, adhering to strict compliance and network isolation rules.

Step-by-Step Solution

1
Determine the required ECS networking mode for AWS Fargate tasks.
AWS Fargate only supports the awsvpc network mode, which provisions a dedicated network interface for each task.
This allows containers to communicate securely with standard AWS networking constructs.
2
Establish secure, private connectivity to AWS services from private subnets.
Interface VPC endpoints (AWS PrivateLink) are created for ECS and ECR within the application VPC.
This ensures container images can be pulled and control plane communications occur without routing traffic over the public internet, satisfying the strict isolation requirement.

Key Concept

AWS Fargate networking constraints and private endpoint architecture for secure container modernization
Question 1470Question →

An online education platform is deploying its new containerized application across three VPCs (vpc-edu-frontend, vpc-edu-backend, and vpc-edu-database) in the us-east-2 region. The application requires outbound internet access for package updates, private DNS resolution using a custom domain (internal.edu.aws), and communication between the three VPCs. The solution must be highly available across two Availability Zones, minimize management overhead, and ensure that VPC-to-VPC traffic does not traverse the public internet. Which architecture meets these requirements?

Show answer & explanation

Answer: Deploy an AWS Transit Gateway tgw-edu-us-east-2 to interconnect vpc-edu-frontend, vpc-edu-backend, and vpc-edu-database. Create a centralized egress VPC vpc-edu-egress containing a NAT Gateway in each of the two Availability Zones. Route outbound traffic from the application VPCs through tgw-edu-us-east-2 to vpc-edu-egress. Create a Route 53 Private Hosted Zone for internal.edu.aws and associate it with all three application VPCs.

Answer

The correct architecture uses AWS Transit Gateway to interconnect the application VPCs, deploys a centralized egress VPC with redundant NAT Gateways across two Availability Zones, and associates the Route 53 Private Hosted Zone with all three application VPCs.
The correct architecture uses AWS Transit Gateway to securely route traffic between all three application VPCs. High availability is achieved by placing a NAT Gateway in both Availability Zones inside a centralized egress VPC, routing all outbound internet traffic from the applications through the Transit Gateway to this egress VPC. Finally, associating the Route 53 Private Hosted Zone with all three application VPCs ensures they can resolve the custom domain names directly with minimal overhead.

Step-by-Step Solution

1
Select the hub-and-spoke connectivity service.
Determine that AWS Transit Gateway is the correct service to route traffic between multiple VPCs transitively without traversing the public internet.
Direct Connect Gateway and VPC Peering do not natively support transitive routing, making Transit Gateway the appropriate choice.
2
Ensure outbound connectivity is highly available.
Create a centralized egress VPC connected to the Transit Gateway containing one NAT Gateway in each of the two Availability Zones.
Deploying a single NAT Gateway creates a single point of failure, violating the high availability requirement across Availability Zones.
3
Establish private DNS resolution across all VPCs.
Associate the Route 53 Private Hosted Zone for the custom domain with all three application VPCs.
Directly associating the Private Hosted Zone with the target VPCs ensures seamless, low-latency, and cost-effective resolution without the management overhead of Resolver endpoints.

Key Concept

Designing multi-VPC networks using AWS Transit Gateway, implementing high availability NAT gateway egress architectures, and associating Route 53 Private Hosted Zones across multiple VPCs in the same region.
Question 1471Question →

A digital payment processing company operates a backend microservice on Amazon EC2 instances within an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The instances retrieve tasks from an internal processing queue and verify external merchant accounts by calling external APIs. The instances are situated in private subnets across three Availability Zones (AZs), with all outbound internet traffic routed through a single NAT Gateway located in the first AZ. During a major promotional campaign, the application experiences a massive, instantaneous surge in requests. This causes a sudden latency spike on the ALB, leading to dropped connections. Simultaneously, the ASG attempts to scale out rapidly, but because instances run custom bootstrapping scripts to download updates that take 8 minutes to complete, the ASG repeatedly launches additional instances before the first batch is fully operational. Shortly after, a physical fiber outage disables the first AZ, which causes transaction processing to stall entirely for instances in the remaining two active AZs. Which set of actions will resolve the availability, scaling latency, and initialization issues?

Show answer & explanation

Answer: Request ALB pre-warming from AWS Support prior to the promotional campaign, provision dedicated NAT gateways across all three active zones and update private subnet routing to use zone-specific gateways, bake application dependencies into a golden Amazon Machine Image (AMI) to bypass runtime bootstrapping, and adjust the ASG's scaling policies to use a warm-up period that matches the new launch duration.

Answer

Request ALB pre-warming from AWS Support prior to the promotional campaign, provision dedicated NAT gateways across all three active zones and update private subnet routing to use zone-specific gateways, bake application dependencies into a golden Amazon Machine Image (AMI) to bypass runtime bootstrapping, and adjust the ASG's scaling policies to use a warm-up period that matches the new launch duration.
The correct solution addresses all three failure modes described in the scenario. Deploying a NAT Gateway in each active Availability Zone ensures that a zone outage does not disrupt outbound internet connectivity for the instances in the surviving zones. Creating a custom golden AMI containing all application dependencies removes the 8-minute bootstrap latency, reducing instance startup times. Configuring the warm-up period to match this shortened startup duration prevents the Auto Scaling Group from launching unnecessary redundant instances. Lastly, requesting Application Load Balancer pre-warming prepares the load balancer to instantly support the sudden traffic surge without dropping client connections.

Step-by-Step Solution

1
Deploy independent NAT Gateways in each of the three Availability Zones and configure each private subnet's route tables accordingly.
Fault isolation is achieved for outbound internet traffic; the failure of a single Availability Zone does not impact external API connectivity for the remaining healthy zones.
Using a single NAT Gateway creates a single point of failure (SPOF) for the entire VPC's outbound traffic.
2
Bake all dependencies, runtime engines, and updates directly into a custom Amazon Machine Image (AMI) rather than performing bootstrapping tasks during instance initialization.
The instance boot time is significantly reduced, allowing instances to reach a healthy state in under a minute.
Lengthy bootstrap scripts run on instance launch delay scale-out actions, causing metrics to remain elevated and forcing the ASG to launch redundant instances.
3
Configure the ASG's scaling policies and instance warm-up periods to reflect the rapid startup time of the new golden AMI.
The ASG correctly waits for newly launched instances to become active before triggering subsequent scaling actions, preventing over-scaling.
The scaling warm-up period must be at least as long as the time it takes for an instance to start passing health checks and handling workload traffic.
4
Submit a request to AWS Support for Application Load Balancer pre-warming before the promotional campaign begins.
The ALB is pre-configured with sufficient internal resource capacity to handle the immediate influx of connections without experiencing processing bottlenecks.
ALBs scale automatically but require time to handle sudden, severe traffic spikes. Pre-warming prevents connection drops at the start of the event.

Key Concept

Auto Scaling Group scaling behavior optimization and VPC outbound path fault tolerance
Estimated Time:2m 0s
Question 1472Question →

A multinational logistics provider, CargoFlow, is modernizing its legacy package sorting and dispatch application. The current application runs on-premises on virtualized Linux servers and consists of an API ingestion service and a backend processing engine. The company plans to migrate this workload to AWS and deploy it as containers. The modernization must meet strict compliance and security guidelines: it must require zero management of underlying virtual machine infrastructure, ensure container tasks are strictly isolated at the hypervisor level, and enforce that all internal communication between the ingestion service (deployed in VPC A) and the processing engine (deployed in VPC B) remains entirely within the AWS private network. The two VPCs are located in different AWS accounts under the same AWS Organization. A Solutions Architect needs to design a solution that achieves these goals with the minimum operational overhead.

Which TWO actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the ingestion service and processing engine tasks on Amazon ECS using the AWS Fargate launch type.; Configure an Interface VPC Endpoint (AWS PrivateLink) in VPC A pointing to a Network Load Balancer in VPC B that routes traffic to the processing engine tasks, and associate the Route 53 Private Hosted Zone containing the service endpoint record with VPC A.

Answer

Deploy the ingestion service and processing engine tasks on Amazon ECS using the AWS Fargate launch type, and configure an Interface VPC Endpoint in VPC A pointing to a Network Load Balancer in VPC B while associating the Private Hosted Zone with VPC A.
Deploying the ingestion service and processing engine tasks on Amazon ECS with AWS Fargate satisfies the requirement for zero virtual machine management while maintaining hypervisor-level isolation. To connect the frontend in VPC A securely to the backend in VPC B across accounts without internet traversal, AWS PrivateLink (an Interface VPC Endpoint) is the most operationally efficient method. To enable proper hostname resolution from VPC A, the Route 53 Private Hosted Zone containing the endpoint record must be explicitly associated with VPC A.

Step-by-Step Solution

1
Determine compute type based on VM management and isolation requirements.
Select Amazon ECS using AWS Fargate launch type.
AWS Fargate removes EC2 server management (minimum operational overhead) and executes each task in a dedicated kernel/hypervisor environment, satisfying the security isolation requirement.
2
Design private cross-account communication between VPC A and VPC B.
Implement an AWS PrivateLink endpoint service with a Network Load Balancer in VPC B and an Interface VPC Endpoint in VPC A.
AWS PrivateLink enables secure, unidirectional, private connections between VPCs in different accounts without exposing traffic to the internet or managing complex VPC peering relationships.
3
Establish DNS resolution across accounts for the private endpoint.
Associate the Route 53 Private Hosted Zone from the processing engine account with VPC A.
VPC A must be associated with the Private Hosted Zone to resolve the service hostname. This is a mandatory requirement for private cross-account endpoint resolution.

Key Concept

Modernizing legacy workloads to AWS serverless container platforms (ECS Fargate) with secure, private, cross-account networking via AWS PrivateLink and Route 53 Private Hosted Zone associations.
Question 1473Question →

An enterprise document management SaaS provider runs an Optical Character Recognition (OCR) processing engine on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB) across three Availability Zones (AZ-A, AZ-B, and AZ-C). Outbound traffic to third-party licensing APIs is routed through a single NAT Gateway deployed in AZ-A. During peak hours, sudden spikes in scanned document uploads cause a processing backlog. The ASG scales out based on average CPU utilization exceeding 70%, but new instances require 8 minutes to bootstrap (downloading OCR libraries and loading language models) before they can pass ALB health checks. During this startup window, the ASG continuously launches unnecessary instances, leading to cost inefficiencies. Additionally, a recent outage in AZ-A caused all OCR processing in AZ-B and AZ-C to fail due to blocked outbound license checks. A Solutions Architect must optimize the architecture to prevent redundant instance launches, reduce processing backlogs during spikes, and eliminate the single point of failure for outbound traffic. Which of the following architectural modifications best satisfies these requirements with the lowest operational overhead?

Show answer & explanation

Answer: Create a custom AMI containing the pre-installed OCR libraries and language models, configure an Auto Scaling group warm pool, and set the instance warmup time in the target tracking scaling policy to match the remaining initialization duration. Deploy a NAT Gateway in each of the three Availability Zones, and update the route table of each private subnet to route outbound traffic through its local NAT Gateway.

Answer

Create a custom AMI with the pre-installed OCR libraries and models, configure an Auto Scaling group warm pool, and set the instance warmup time in the target tracking scaling policy to match the remaining initialization duration. Deploy a NAT Gateway in each of the three Availability Zones, and update the route table of each private subnet to route outbound traffic through its local NAT Gateway.
The correct option addresses all three issues effectively. Pre-installing the libraries into a custom AMI avoids long download and compilation steps during startup. An Auto Scaling group warm pool keeps instances pre-warmed so they can transition to the running state quickly. Setting the instance warmup period prevents the Auto Scaling group from launching redundant instances while the initial ones are bootstrapping. Deploying a NAT Gateway in each Availability Zone and mapping each private subnet's route table to its local NAT Gateway eliminates the single point of failure and ensures Availability Zone independence.

Step-by-Step Solution

1
Address instance bootstrap latency and redundant scaling
Create a custom AMI with OCR libraries and language models pre-installed, and configure a warm pool with target tracking instance warmup alignment.
This reduces the startup time from 8 minutes and ensures the Auto Scaling group waits for newly launched instances to become active before evaluating further scaling actions.
2
Eliminate the outbound traffic single point of failure (SPOF)
Deploy a NAT Gateway in each of the three Availability Zones (AZ-A, AZ-B, AZ-C) and update subnet-specific route tables.
By having a NAT Gateway per Availability Zone, if AZ-A experiences an outage, instances in AZ-B and AZ-C will continue to route outbound traffic through their respective local NAT Gateways.

Key Concept

Auto Scaling Warm Pools and Multi-AZ NAT Gateway Redundancy
Question 1474Question →

An enterprise is planning to migrate its inventory tracking system to AWS. The system consists of three main components:

1. Web Tier: A Java web application currently running on Apache Tomcat on VMware virtual machines (VMs). The enterprise wants to migrate it to AWS without modifying its code, but aims to eliminate the overhead of managing VMs and operating system patching.
2. Database: A Microsoft SQL Server database. The enterprise wants to migrate this database to Amazon Aurora PostgreSQL to eliminate licensing fees. They have allocated budget and time for schema conversion and application code adjustments.
3. Legacy File Archiver: A legacy tool running on a physical on-premises Windows server. It uses a node-locked license tied to the hardware MAC address of the physical server. The software vendor is out of business, so the license cannot be modified or reissued, and the tool remains business-critical.

Which combination of migration strategies represents the most appropriate alignment with the 7 Rs framework for these components?

Show answer & explanation

Answer: Web Tier: Replatform; Database: Refactor; Legacy File Archiver: Retain

Answer

The correct strategy alignment is Replatform for the Web Tier, Refactor for the Database, and Retain for the Legacy File Archiver.
The correct option is the one specifying Replatform for the Web Tier, Refactor for the Database, and Retain for the Legacy File Archiver. Replatforming the Web Tier to a managed container service (like Amazon ECS on AWS Fargate) or AWS Elastic Beanstalk allows the enterprise to run the Java web application without code changes while eliminating VM and OS management. Migrating a Microsoft SQL Server database to Amazon Aurora PostgreSQL (a heterogeneous database migration) involves schema conversion and application code changes, which corresponds to the Refactor strategy. The Legacy File Archiver cannot be migrated because of physical hardware MAC address node-locking and the vendor being out of business, meaning it must be Retained on-premises.

Step-by-Step Solution

1
Analyze the migration requirements for the Web Tier.
The web application must be migrated without code changes, but the enterprise wants to eliminate VM administration and OS patching. This corresponds to the Replatform strategy, where the application is moved to a managed service like AWS Elastic Beanstalk or Amazon ECS on AWS Fargate.
Replatforming changes the runtime environment to a managed service to reduce operational overhead without modifying the core application code.
2
Analyze the migration requirements for the Database.
The target is to move from Microsoft SQL Server to Amazon Aurora PostgreSQL. Because the source and target database engines are different, this is a heterogeneous migration requiring schema translation (e.g., using AWS SCT) and application SQL query modifications.
A heterogeneous database engine change involves rewriting schema and code components, which classifies it under the Refactor (or Re-architect) strategy rather than a simple Replatform.
3
Analyze the migration requirements for the Legacy File Archiver.
The archiver uses a hardware-locked license tied to the MAC address of a physical server, and the vendor is out of business. Because it cannot be run on AWS and is still needed by the business, it cannot be migrated or retired.
Workloads that cannot be migrated due to hard licensing constraints or physical dependencies must be kept on-premises, which represents the Retain strategy.

Key Concept

Selecting migration strategies using the 7 Rs framework based on organizational and technical constraints.
Estimated Time:1m 30s
Question 1475Question →

A financial services company is planning to migrate its on-premises self-managed PostgreSQL 14 database containing large tables with complex PL/pgSQL stored procedures to an Amazon Aurora MySQL-Compatible Edition DB cluster. The migration must minimize downtime and ensure continuous replication during the transition period. The company also wants to analyze schema compatibility and perform conversion before starting the data transfer. Which of the following actions should the Solutions Architect take to configure this migration? (Select two.)

Select all that apply

Show answer & explanation

Answer: Use the AWS Schema Conversion Tool (SCT) to generate a migration assessment report and convert the database schema, including PL/pgSQL stored procedures, to equivalent MySQL structures.; Configure the on-premises PostgreSQL source database by setting the wal_level parameter to logical and increasing max_replication_slots and max_wal_senders to enable Change Data Capture (CDC) replication in AWS DMS.

Answer

Use the AWS Schema Conversion Tool (SCT) to convert the schema and stored procedures, and configure the source PostgreSQL database parameters (wal_level to logical, max_replication_slots, and max_wal_senders) to support continuous Change Data Capture (CDC) replication.
The correct options are using the AWS Schema Conversion Tool (SCT) to perform the schema translation for the heterogeneous migration, and configuring PostgreSQL's native logical replication parameters (wal_level, max_replication_slots, max_wal_senders) on the source database to support Change Data Capture (CDC) replication.

Step-by-Step Solution

1
Use AWS SCT to perform schema analysis and conversion.
The AWS Schema Conversion Tool converts the PostgreSQL schemas, functions, and stored procedures to their MySQL equivalents and outputs a migration assessment report showing any manual adjustments required.
Because PostgreSQL to Aurora MySQL is a heterogeneous migration, AWS DMS cannot convert the schema structures and code objects automatically.
2
Configure PostgreSQL replication parameters for CDC.
Set wal_level to logical, configure max_replication_slots and max_wal_senders to be greater than 1, and grant replication permissions to the database user.
This enables PostgreSQL to store transaction logs for logical decoding, which AWS DMS reads during the Change Data Capture (CDC) phase to replicate ongoing changes.
3
Create and run the AWS DMS task.
Launch a replication task configured for Full Load and Change Data Capture (CDC) using the converted schema target.
This ensures that initial data is loaded and subsequent changes are synchronized in real-time, minimizing downtime during the eventual cutover.

Key Concept

Heterogeneous database migration using SCT for schema translation and DMS logical replication settings (wal_level, replication slots) for continuous replication (CDC).
Question 1476Question →

A software-as-a-service (SaaS) provider is launching a new collaborative task management application. The application will serve users globally, with primary traffic split between us-east-1 and eu-central-1. The database and storage strategy must meet the following requirements:
- Task metadata (OLTP workload): Requires a relational database schema with strong consistency for local reads, a recovery point objective (RPO) of less than 1 second, and a recovery time objective (RTO) of less than 1 minute. Outbound read scaling must automatically handle regional traffic spikes.
- User attachment uploads (Object storage): Must be replicated across both regions. Compliance regulations dictate that the data must be encrypted at rest using customer-controlled keys.
Which architecture should a solutions architect design to meet these requirements?

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-central-1. Configure Aurora Auto Scaling for reader instances in both regions. Store user attachments in an Amazon S3 bucket in us-east-1 with Cross-Region Replication (CRR) configured to a destination bucket in eu-central-1. Encrypt the S3 buckets using AWS KMS multi-Region customer managed keys.

Answer

Deploy an Amazon Aurora PostgreSQL Global Database with reader auto-scaling and store user attachments in Amazon S3 with Cross-Region Replication using AWS KMS multi-Region customer managed keys.
The correct solution leverages Amazon Aurora Global Database, which utilizes storage-based replication to achieve a typical replication lag of under 1 second (satisfying the RPO) and can failover within 1 minute (satisfying the RTO). Using Aurora Auto Scaling on reader instances allows the platform to scale out horizontally in response to regional read spikes. Additionally, configuring Amazon S3 Cross-Region Replication with AWS KMS multi-Region customer managed keys ensures that the uploaded files are copied automatically between regions while maintaining encryption under customer-controlled keys.

Step-by-Step Solution

1
Select the relational database platform that satisfies the RTO and RPO limits.
Amazon Aurora Global Database provides sub-second replication latency (RPO < 1s) and sub-minute regional failovers (RTO < 1m).
Standard snapshot restoration or multi-region manual promotions cannot meet the tight RTO/RPO limits.
2
Establish read scalability mechanisms.
Enable Aurora Auto Scaling for read replicas in both regions.
Allows the architecture to dynamically adjust to regional read traffic spikes without administrative overhead.
3
Configure secure object storage replication.
Configure Amazon S3 Cross-Region Replication (CRR) between us-east-1 and eu-central-1 using AWS KMS multi-Region customer managed keys.
Ensures user attachments are copied across regions while satisfying the compliance directive to use customer-controlled keys.

Key Concept

Designing a highly available, multi-region database and object storage strategy using Amazon Aurora Global Database and S3 Cross-Region Replication with KMS multi-Region customer managed keys.
Question 1477Question →

An organization deploys its application stack across multiple AWS accounts using AWS CloudFormation StackSets. The stack includes Amazon EC2 instances that must adhere to a strict security configuration baseline, such as running specific security agents and maintaining local firewall rules. Developers frequently bypass standard CI/CD pipelines to make manual configuration changes directly on the instances during troubleshooting, leading to configuration drift. The Solutions Architect needs to implement a solution to automatically enforce the baseline and remediate any drift on these instances with minimal operational overhead. Which strategy should the Solutions Architect implement to meet these requirements?

Show answer & explanation

Answer: Create an AWS Systems Manager State Manager association that applies a configuration document to the EC2 instances on a recurring schedule to enforce the baseline and automatically remediate local configuration drift.

Answer

Create an AWS Systems Manager State Manager association that applies a configuration document to the EC2 instances on a recurring schedule to enforce the baseline and automatically remediate local configuration drift.
AWS Systems Manager State Manager is designed to define and maintain consistent operating system and software configurations on EC2 instances. By setting up an association that runs a configuration document on a schedule, any unauthorized configuration changes (drift) made on the EC2 instances will be automatically corrected during the next execution run, ensuring compliance without manual intervention.

Step-by-Step Solution

1
Define the target security configuration baseline in an AWS Systems Manager (SSM) document.
A reusable SSM document is created that contains instructions for installing required agents and setting firewall rules.
Establishes a defined target state for the EC2 instances.
2
Create an SSM State Manager association targeting the EC2 instances.
The association is scheduled to run at regular intervals (e.g., hourly or daily).
Enforces configuration compliance on a schedule and automatically reverts any manual adjustments made outside the standard pipeline.
3
Enable AWS Config in the accounts to monitor compliance.
Changes are recorded and compliance status is logged.
Provides visibility and auditing for compliance monitoring across the organization.

Key Concept

Continuous configuration enforcement and drift remediation using AWS Systems Manager State Manager
Question 1478Question →

An enterprise runs a public-facing web application behind an Application Load Balancer (ALB) in a production VPC in Account A. To strengthen network and application security, the enterprise deploys an Amazon CloudFront distribution in front of the ALB. An AWS WAF WebACL is associated with the CloudFront distribution to inspect and filter inbound traffic. During a security audit, the team discovers that the ALB's DNS name is publicly resolvable, allowing malicious traffic to bypass the CloudFront distribution and target the ALB directly. The solution must ensure that only requests routed through CloudFront are accepted by the ALB. The team wants to secure the custom header value used for validation by storing it as a secret in AWS Secrets Manager in a centralized Security Account (Account B) and allowing Account A's resources to retrieve it. Which of the following is the most secure and operationally efficient configuration to prevent direct public access to the ALB while ensuring CloudFront can successfully forward requests?

Show answer & explanation

Answer: Configure CloudFront to inject a custom HTTP header containing a secret value. Set the ALB listener rules to forward traffic only when this header is present and matches the secret value, and restrict the ALB's security group to allow inbound traffic only from CloudFront IP ranges using the AWS-managed prefix list. Store the secret in AWS Secrets Manager in Account B, encrypted with a Customer Managed Key (CMK), and configure its key policy to allow cross-account access from Account A.

Answer

Configure CloudFront to inject a custom HTTP header containing a secret value. Set the ALB listener rules to forward traffic only when this header is present and matches the secret value, and restrict the ALB's security group to allow inbound traffic only from CloudFront IP ranges using the AWS-managed prefix list. Store the secret in AWS Secrets Manager in Account B, encrypted with a Customer Managed Key (CMK), and configure its key policy to allow cross-account access from Account A.
The correct solution combines network-level protection (restricting the ALB security group to the CloudFront AWS-managed prefix list) and application-level verification (verifying a custom header injected by CloudFront). For cross-account retrieval of the secret from Account B, a Customer Managed Key (CMK) is required because AWS-managed KMS keys cannot have their key policies modified and cannot be shared across different accounts.

Step-by-Step Solution

1
Enforce network-level restriction on the Application Load Balancer (ALB).
The ALB's security group is configured to only allow inbound HTTP/HTTPS traffic from CloudFront edge servers using the AWS-managed prefix list (com.amazonaws.global.cloudfront.origin-facing).
This prevents direct client connections to the ALB from outside CloudFront's network ranges.
2
Configure application-level request validation using custom headers.
CloudFront is configured to inject a custom HTTP header (e.g., X-Origin-Verify) with a secret value on origin requests, and the ALB listener rule is configured to return a 403 response if the header is missing or incorrect.
This prevents attackers from forging requests directly to the ALB DNS name if they bypass the IP restriction.
3
Configure secure cross-account secret management.
The secret containing the header value is stored in Account B, encrypted using a KMS Customer Managed Key (CMK) with a key policy allowing cross-account decryption by Account A's role.
AWS-managed KMS keys do not support policy modifications and cannot be used for cross-account access, making a CMK mandatory.

Key Concept

Strengthening origin security for ALBs behind CloudFront using security group prefix lists, custom origin headers, and cross-account Customer Managed Keys (CMKs).
Question 1479Question →

A logistics enterprise is migrating its legacy order-processing application to AWS. The solution requires modernizing the workload using a containerized architecture on Amazon Elastic Container Service (Amazon ECS) using the serverless AWS Fargate launch type to minimize operational overhead. Which network mode must the solutions architect specify in the Amazon ECS task definition to support the AWS Fargate launch type?

Show answer & explanation

Answer: The awsvpc network mode, which allocates an Elastic Network Interface (ENI) to each task and grants it a unique private IPv4 address.

Answer

The awsvpc network mode, which allocates an Elastic Network Interface (ENI) to each task and grants it a unique private IPv4 address.
The correct option is the awsvpc network mode. For tasks running on AWS Fargate, awsvpc is the only supported network mode. It assigns an Elastic Network Interface (ENI) to each task, giving it a dedicated private IP address and allowing the attachment of security groups directly to the task.

Step-by-Step Solution

1
Analyze the hosting platform and launch type requirements.
Identify that the workload is being modernized on Amazon ECS using the AWS Fargate launch type.
AWS Fargate runs containers in a serverless environment where the underlying host is fully managed by AWS.
2
Evaluate the supported network modes for AWS Fargate task definitions.
Determine that AWS Fargate strictly requires the awsvpc network mode.
Fargate does not allow tasks to share host resources or use docker network bridges directly, making awsvpc the only compatible network mode.

Key Concept

AWS Fargate network modes
Estimated Time:45s
Question 1480Question →

A multinational retail corporation is migrating 150 legacy on-premises CentOS and Windows servers to AWS. The hybrid network infrastructure consists of a 10 Gbps AWS Direct Connect (DX) connection with a private virtual interface (VIF) terminating on a Direct Connect Gateway (DXGW), which is associated with an AWS Transit Gateway (TGW). The TGW is shared with a dedicated Migration VPC where the staging area subnets for AWS Application Migration Service (MGN) reside. Security policies dictate that all replication traffic must be encrypted, must not traverse the public internet, and the staging area subnets must not have direct internet access. The migration team has installed the AWS Replication Agent on the on-premises servers. However, the replication status for all servers is 'Stalled', and the agents cannot communicate with either the MGN control plane or the staging area replication servers. Which combination of actions should a solutions architect recommend to resolve the connectivity issues and establish private replication?

Show answer & explanation

Answer: Establish VPC interface endpoints for the MGN and EC2 services within the Migration VPC. Deploy Route 53 Resolver Inbound Endpoints in the Migration VPC, and configure the on-premises DNS forwarders to redirect MGN and EC2 API queries to these Resolver IP addresses. Adjust the staging area security group in the Migration VPC to allow inbound TCP port 1500 and TCP port 443 from the on-premises server subnet CIDR, and verify that the Transit Gateway route table has active routes routing the on-premises CIDR to the Migration VPC and vice versa.

Answer

The correct architecture requires deploying interface VPC endpoints for MGN and EC2, configuring Route 53 Resolver Inbound Endpoints to resolve those endpoints from on-premises, opening inbound TCP ports 1500 and 443 in the staging area security group, and establishing bidirectional routing on the Transit Gateway.
The correct solution addresses all aspects of the communication failure. First, private endpoints for MGN and EC2 provide local private IP addresses for the agents to send API requests without internet access. Second, the Route 53 Resolver Inbound Endpoints resolve the DNS names of these interface endpoints for the on-premises DNS servers. Third, opening TCP port 1500 and TCP port 443 in the staging area security groups satisfies both the control plane (443) and data plane (1500) traffic requirements. Finally, verifying Transit Gateway routing establishes the network paths required to carry the replication traffic between the on-premises data center and the staging subnets in the Migration VPC.

Step-by-Step Solution

1
Deploy VPC interface endpoints for MGN and EC2 in the Migration VPC.
Establishes private IP addresses within the VPC for agent API communications, eliminating the need to access the public internet.
The replication agent must reach MGN control plane APIs privately to coordinate replication tasks.
2
Create Route 53 Resolver Inbound Endpoints in the Migration VPC and configure on-premises DNS forwarding.
Allows on-premises source servers to resolve the private DNS names of the interface endpoints to their respective private IP addresses in the VPC.
On-premises servers cannot natively resolve AWS Private Hosted Zones without an inbound DNS resolver query path.
3
Open TCP port 1500 and TCP port 443 in the staging area security groups.
Enables data transmission over port 1500 to the replication servers and API communication over port 443.
The replication agent writes blocks directly to replication servers in the staging subnet over port 1500, which must be allowed through the staging area security group.
4
Verify bidirectional routing tables on the AWS Transit Gateway.
Ensures that packet paths between the DXGW and the Migration VPC are defined and active.
Without correct route propagation or static routes in the Transit Gateway route tables, IP packets cannot traverse between the on-premises network and the staging subnets.

Key Concept

AWS MGN private replication architecture requires control plane access via VPC endpoints (port 443), data plane access to replication servers (port 1500), hybrid DNS resolution via Route 53 Resolver Inbound Endpoints, and hybrid network routing via Direct Connect and Transit Gateway.
PreviousPage 74 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin