All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A multinational financial services company is designing the database and storage strategy for a new critical payment clearing platform. The platform has the following workloads and requirements:

- A highly transactional OLTP ledger that requires a multi-AZ deployment in the primary region, horizontal scaling of read capacity during peak hours, and a cross-region disaster recovery (DR) site in a secondary region with an RPO of less than 1 second and RTO under 1 minute.
- A massive archive of regulatory audit reports stored as object storage. These objects must be encrypted at rest. The reports must be accessible by an auditing application running in an external AWS account owned by a third-party regulator. The regulator requires full control over the rotation of the encryption keys and who has access to the key policies.

Which two of the following database and storage configurations will meet these requirements? (Select TWO.)

Select all that apply

Deploy Amazon Aurora PostgreSQL Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region. Use Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas in the primary region.

Store the regulatory audit reports in an Amazon S3 bucket. Encrypt the bucket using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to grant decrypt permissions to the external auditing account's IAM role.

Deploy Amazon RDS for PostgreSQL with a Multi-AZ deployment across three Availability Zones. Configure the standby instances to serve read traffic and apply Auto Scaling to the standby instances to handle read spikes.

Configure daily database snapshot replication to the secondary region. In the event of a disaster, restore the database from the replicated snapshot in the secondary region using a Pilot Light strategy.

Store the regulatory audit reports in an Amazon S3 bucket. Encrypt the bucket using the AWS managed key (aws/s3) for S3, and configure an S3 bucket policy that permits cross-account access to the external regulator's IAM role.

Show answer & explanation

Answer: Deploy Amazon Aurora PostgreSQL Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region. Use Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas in the primary region.; Store the regulatory audit reports in an Amazon S3 bucket. Encrypt the bucket using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to grant decrypt permissions to the external auditing account's IAM role.

Answer

The correct configurations are to deploy Amazon Aurora PostgreSQL Global Database with Aurora Auto Scaling in the primary region, and to store the regulatory audit reports in an Amazon S3 bucket encrypted with a Customer Managed Key (CMK) where the key policy is modified to grant access to the external regulator's account.

Deploying Amazon Aurora PostgreSQL Global Database meets the OLTP requirements. The replication lag to the secondary region is typically under 1 second (meeting the RPO of < 1 second), and failover can be completed within 1 minute. Aurora Auto Scaling dynamically adjusts the number of Aurora Replicas to scale read capacity. For the storage requirement, using Amazon S3 with a Customer Managed Key (CMK) allows the company to share the key with the external regulator's account and permits modifying the key policy. This gives the regulator control over key rotation and access policies while keeping the reports secure.

Step-by-Step Solution

Analyze the OLTP database requirements: multi-AZ, read scaling, RPO < 1s, and RTO < 1m across regions.

Identify that Amazon Aurora Global Database provides physical replication with sub-second replication lag (RPO < 1s) and supports promotion of the secondary region within 1 minute (RTO < 1m). Aurora Auto Scaling allows horizontal scaling of read replicas.

Standard RDS Multi-AZ cannot serve read traffic from standby instances, and backup restoration patterns (like Pilot Light) cannot meet the low RTO/RPO requirements.

Analyze the security and cross-account access requirements for regulatory audit reports: object storage, encryption, external account access, and key rotation control.

Identify that Amazon S3 is the optimal object storage solution. To allow cross-account access to encrypted data, a Customer Managed Key (CMK) in AWS KMS must be used.

AWS-managed KMS keys (like aws/s3) do not allow modifications to their key policies and cannot be shared across accounts.

Key Concept

Selecting the optimal database and storage architecture to meet specific scaling, recovery (RPO/RTO), and cross-account access control requirements using AWS services like Amazon Aurora, S3, and KMS.

Question 1482Question →

A multinational enterprise runs an API gateway and an Application Load Balancer (ALB) to expose critical financial APIs to both public users and verified third-party payment processors. The ALB is currently protected by an AWS WAF Web ACL containing the AWS Managed Rules Common Rule Set. During a routine security assessment, the team identifies a need to strengthen network security by implementing rate-limiting to mitigate HTTP flood attacks. The new security policy dictates that verified payment processors, who transmit high-volume API requests from a known static block of IP addresses, must never be throttled. However, all incoming traffic—including that from payment processors—must remain protected against common web exploits. Which configuration represents the most secure and operationally efficient way to implement this policy?

Create an AWS WAF IP set containing the payment processors' IP addresses. Configure a custom rate-based rule in the Web ACL, and define a scope-down statement within the rule to evaluate only requests where the source IP is NOT in the IP set. Associate the rate-based rule and the AWS Managed Rules group with the Web ACL, ensuring both are evaluated for all incoming traffic.

Create an AWS WAF IP set containing the payment processors' IP addresses. Configure a custom rule in the Web ACL with an action of ALLOW that matches the IP set, and position it at the highest evaluation priority (lowest numeric value). Below this rule, add the custom rate-based rule and the AWS Managed Rules group.

Create an AWS WAF IP set containing the payment processors' IP addresses. Configure a Service Control Policy (SCP) at the organizational level to bypass Web ACL evaluation for any requests originating from the payment processors' IP set, and apply the rate-based rule globally to the Web ACL.

Create an AWS WAF IP set containing the payment processors' IP addresses. Configure the rate-based rule to encrypt client request payloads using an AWS-managed KMS key, and configure an IAM policy on the ALB that allows the payment processors' IAM roles to bypass the Web ACL inspection.

Show answer & explanation

Answer: Create an AWS WAF IP set containing the payment processors' IP addresses. Configure a custom rate-based rule in the Web ACL, and define a scope-down statement within the rule to evaluate only requests where the source IP is NOT in the IP set. Associate the rate-based rule and the AWS Managed Rules group with the Web ACL, ensuring both are evaluated for all incoming traffic.

Answer

The correct solution uses an AWS WAF scope-down statement within the custom rate-based rule to target only requests where the source IP is NOT in the payment processors' IP set. This allows the payment processors' requests to exceed the rate limit threshold without being blocked, while ensuring all traffic (including partner traffic) is still evaluated by the AWS Managed Rules group for exploits.

Step-by-Step Solution

Analyze the rate-limiting and vulnerability inspection requirements.

Identify that rate-limiting must exclude payment processors, but all traffic (including payment processors) must be inspected by AWS Managed Rules.

To prevent throttling of legitimate high-volume partners while maintaining full threat protection against web exploits.

Evaluate the evaluation behavior of AWS WAF Web ACL rules.

A terminating ALLOW action stops rule evaluation. Placing an ALLOW rule for payment processors at the highest priority would bypass subsequent security rules.

Understanding WAF rule evaluation order prevents introducing security vulnerabilities where trusted sources bypass exploit detection.

Implement a scope-down statement on the rate-based rule.

Configuring the rate-based rule to evaluate only requests matching the condition 'NOT in IP set' excludes the payment processors from the rate limit without bypassing other rules in the Web ACL.

This satisfies the requirement to allow high-volume partner traffic while still subjecting it to the common rules and other threat inspections.

Key Concept

Scope-down statements in AWS WAF rate-based rules

Question 1483Question →

An infrastructure modernization project requires migrating a high-throughput, on-premises Oracle database to Amazon Aurora PostgreSQL-Compatible Edition. The database is in active use 24/7, requiring a replication strategy that minimizes downtime to under 1 hour. A Solutions Architect uses the AWS Schema Conversion Tool (SCT) to convert the database schema and applies it to the target Aurora DB cluster. Next, the architect configures an AWS Database Migration Service (DMS) replication instance and a replication task with the migration type set to "Migrate existing data and replicate ongoing changes".

The replication task successfully performs the full load of all tables. However, once the replication task transitions to the Change Data Capture (CDC) phase, the task status changes to "Running with errors", and updates made on the source database are not reflected on the target database. Reviewing the DMS task logs reveals that the replication instance is unable to read the transaction changes from the source database's redo logs.

Which sequence of steps must the Solutions Architect perform on the source Oracle database to enable AWS DMS to successfully read the transaction changes and resume CDC replication?

Configure the source database to run in ARCHIVELOG mode, enable minimal supplemental logging at the database level, and enable supplemental logging for the specific tables or columns being replicated.

Configure the source database to run in NOARCHIVELOG mode, set the initialization parameter log_buffer to a value greater than 512 MB, and enable force logging at the database level.

Enable binary logging by setting the initialization parameter log_bin to ON, configure the binlog format to ROW, and grant the REPLICATION CLIENT privilege to the DMS database user.

Install the AWS SCT extraction agent on the source database server, configure the agent to read from the Oracle Active Data Guard standby database, and set the DMS task parameter UseLogminerReader to true.

Show answer & explanation

Answer: Configure the source database to run in ARCHIVELOG mode, enable minimal supplemental logging at the database level, and enable supplemental logging for the specific tables or columns being replicated.

Answer

The correct option correctly identifies the mandatory Oracle database configurations for AWS DMS CDC: ARCHIVELOG mode, database-level minimal supplemental logging, and table-level supplemental logging. ARCHIVELOG mode ensures transaction logs are not lost, while minimal and table-level supplemental logging ensure that update and delete operations record primary keys or full column values in the redo logs, which DMS requires to replicate changes correctly.

Step-by-Step Solution

Enable database archiving

The database is configured to run in ARCHIVELOG mode, preserving redo log files in the archive destination.

AWS DMS requires access to archived redo log files if the online redo logs are overwritten before DMS can process them during CDC.

Enable database-level minimal supplemental logging

The command 'ALTER DATABASE ADD SUPPLEMENTAL LOG DATA' is executed.

This is a prerequisite for Oracle to write additional information, such as ROWIDs and primary keys, to the redo logs, which is required by the log reader.

Enable table-level supplemental logging

Supplemental log groups are created on the target tables (e.g., 'ALTER TABLE table_name ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS' or PRIMARY KEY columns).

Table-level supplemental logging ensures that update and delete operations in the redo log contain enough identifying column data for DMS to construct the corresponding statements on the target database.

Key Concept

AWS DMS Change Data Capture (CDC) prerequisites for Oracle source databases

Question 1484Question →

A real-time multiplayer gaming platform utilizes an Amazon RDS for MySQL Multi-AZ DB instance to store player profile states, matchmaking rankings, and session metadata. During peak tournament events, players experience significant latency when loading profiles and waiting for matchmaking. Database monitoring indicates that DB instance CPU utilization exceeds 90% due to read-heavy traffic, primarily querying static player stats that do not change during a session. The system architecture requires a caching layer that can scale horizontally, support multi-AZ replication for high availability, and persist cached session summaries so they do not need to be rebuilt from the database if a cache node fails. Which solution should a solutions architect implement to improve database efficiency while meeting these performance and availability requirements?

Configure Amazon RDS Read Replicas for the MySQL DB instance. Direct the game client to route update queries to the primary instance and player profile reads to the Multi-AZ standby instance to reduce read latency.

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled. Configure the application to query the Redis cluster first, and retrieve the data from the database only on a cache miss.

Deploy an Amazon ElastiCache for Memcached cluster with nodes distributed across multiple Availability Zones. Configure the application to implement a cache-aside architecture for profile reads and write player data to both the database and the cache.

Submit a request to AWS Support to pre-warm the Application Load Balancer to handle read latency spike thresholds. Configure the application servers to cache player profiles locally in EC2 instance memory.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled. Configure the application to query the Redis cluster first, and retrieve the data from the database only on a cache miss.

Answer

The correct solution is to deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled. Unlike Memcached, Amazon ElastiCache for Redis supports data persistence (using RDB or AOF) and replication with automatic failover. Implementing a cache-aside pattern on Redis offloads the read-heavy queries from the RDS DB instance and ensures that if a cache node fails, the data is preserved or recovered via replication, preventing a database overload.

Step-by-Step Solution

Identify the performance bottleneck and access patterns.

The database CPU utilization is high due to read-heavy traffic querying static player profile data that remains unchanged during sessions.

This establishes that the read queries can be safely cached to offload traffic from the primary database.

Evaluate the persistence and replication requirements of the caching layer.

The application requires horizontal scaling, high availability (Multi-AZ replication with automatic failover), and persistence of cached session summaries.

This determines that Memcached is unsuitable because it does not support persistence or replication/failover, meaning Redis must be used.

Verify database replication limits.

Confirm that RDS Multi-AZ standby instances are passive and cannot serve read traffic directly.

This eliminates options attempting to route read traffic directly to the Multi-AZ standby instance.

Implement the cache-aside design pattern using ElastiCache for Redis.

Configure the application to query Redis first and only fall back to the RDS database upon a cache miss, writing the fetched data back to Redis.

This ensures optimal cache hit ratios and database read offloading.

Key Concept

Distinguishing caching engine capabilities (ElastiCache for Redis vs. Memcached) to support persistence and replication requirements.

Question 1485Question →

A collaborative real-time whiteboarding SaaS platform runs its synchronization and rendering service on Amazon EC2 instances in an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The application requires a complex 4-minute bootstrapping process to download large canvas asset libraries and initialize cache connections before it can accept active WebSocket connections.

During unexpected viral collaboration events, the platform experiences significant latency spikes and dropped WebSocket connections. Analysis reveals the following:
* When traffic surges, new EC2 instances are launched, but before they complete their 4-minute bootstrap and cache warm-up, the ASG launches additional instances because CPU utilization remains high. This results in severe over-provisioning and subsequent thrashing.
* The outbound connection requests from the application instances to external third-party collaboration APIs fail completely if a single Availability Zone (AZ) encounters an outage, even though the instances are distributed across three AZs. A single NAT Gateway is currently deployed in one public subnet.
* Sudden bursts of flash traffic at the start of scheduled corporate workshops cause HTTP 503 Service Unavailable errors on the ALB for the first 5 minutes of the burst.

Which two actions should the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Configure a NAT Gateway in a public subnet within each Availability Zone where the application instances are deployed, and update the private route tables to route outbound traffic to the local NAT Gateway within their respective zone.

Configure the Auto Scaling Group's scaling policies to use an instance warmup time of 300 seconds to allow instance bootstrapping to complete before adding metrics to the group's aggregate.

Deploy a Route 53 active-active failover policy targeting a single NAT Gateway, and update all private route tables to utilize the Route 53 endpoint for transitive outbound routing.

Set the Auto Scaling Group's scaling policy cooldown period to 120 seconds to allow the group to quickly launch additional instances if CPU utilization remains high during the initial traffic spike.

Configure the Application Load Balancer to automatically trigger pre-warming requests via an AWS Lambda function triggered by Application Load Balancer target group metric alarms.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet within each Availability Zone where the application instances are deployed, and update the private route tables to route outbound traffic to the local NAT Gateway within their respective zone.; Configure the Auto Scaling Group's scaling policies to use an instance warmup time of 300 seconds to allow instance bootstrapping to complete before adding metrics to the group's aggregate.

Answer

Deploy a NAT Gateway in a public subnet within each Availability Zone where the application instances are deployed, and update the private route tables to route outbound traffic to the local NAT Gateway within their respective zone. In addition, configure the Auto Scaling Group's scaling policies to use an instance warmup time of 300 seconds to allow instance bootstrapping to complete before adding metrics to the group's aggregate.

Deploying a NAT Gateway in each Availability Zone and mapping it to local route tables isolates outbound routing to individual zones, removing the single point of failure. Setting the instance warmup period to 300 seconds ensures that newly launched instances do not contribute to scaling metrics until they are fully bootstrapped (taking 4 minutes), which prevents premature and excessive scaling.

Step-by-Step Solution

Analyze the bootstrap latency issue.

Identify that the 4-minute bootstrap process causes a delay in instances reporting nominal load, meaning scaling metrics remain artificially high.

This shows that the instance warmup time must be configured to be greater than 240 seconds to prevent metric aggregation overlap.

Address the outbound routing failure during an Availability Zone outage.

Identify that routing traffic from all subnets through a single NAT Gateway creates a single point of failure.

Deploying a NAT Gateway in each Availability Zone creates a zone-redundant routing architecture for outbound API traffic.

Verify correct configurations for both scaling metrics and network redundancy.

Confirm that configuring a 300-second warmup time and deploying three NAT Gateways matches the application's performance and availability goals.

This directly resolves the scaling thrashing and the outbound API communication issues.

Key Concept

Auto Scaling warmup settings must exceed instance boot times to prevent premature scaling, and multi-AZ NAT Gateways must be used to ensure fault-tolerant outbound connectivity.

Question 1486Question →

A logistics company is migrating its container tracking system to AWS. The system consists of two primary components:

1. Front-end Web Tier: A Java web application currently running on Apache Tomcat VMs. The company wants to eliminate VM administration overhead by moving it to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate without modifying the application code.
2. Core Transaction Database: A legacy Microsoft SQL Server database. The company wants to eliminate SQL Server licensing costs by migrating the schema and data to Amazon Aurora PostgreSQL using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS).

Which two migration strategies should the solutions architect select to align with the AWS 7 Rs migration framework?

Select all that apply

Replatform for the front-end web tier

Refactor for the transaction database

Replatform for the transaction database

Rehost for the front-end web tier

Refactor for the front-end web tier

Show answer & explanation

Answer: Replatform for the front-end web tier; Refactor for the transaction database

Answer

The solutions architect should select Replatform for the front-end web tier and Refactor for the transaction database.

Replatforming is the correct strategy for the front-end web tier because the application is packaged into containers and deployed to a managed service (Amazon ECS on AWS Fargate) to reduce administrative overhead without altering the underlying code. Refactoring is the correct strategy for the transaction database because converting from SQL Server to Aurora PostgreSQL requires schema conversion (via AWS SCT) and code/query modifications, representing a re-architecting of the data layer.

Step-by-Step Solution

Analyze the migration requirements for the front-end web tier.

The front-end web tier is moving from VM-based Tomcat deployments to Amazon ECS on AWS Fargate with no code modifications.

This platform-level adjustment represents a modification to utilize managed container services without re-architecting the application code, which aligns with Replatforming.

Analyze the migration requirements for the core transaction database.

The database is migrating from SQL Server to Amazon Aurora PostgreSQL using AWS SCT and AWS DMS.

Because this requires a database engine switch, schema conversion, and query testing, the application database layer is being re-architected, which aligns with Refactoring.

Key Concept

Distinguishing between Replatforming and Refactoring in the AWS 7 Rs migration framework, specifically noting that database engine conversions represent Refactoring due to required schema/query alterations, while containerization without code changes represents Replatforming.

Question 1487Question →

An enterprise is migrating its core on-premises Enterprise Resource Planning (ERP) database and application servers to AWS using AWS Application Migration Service (MGN). The on-premises environment connects to a central Transit Gateway (TGW) in AWS via an AWS Direct Connect connection with a Transit Virtual Interface (VIF). The target AWS architecture consists of a shared services VPC where the MGN staging area is located, and multiple application target VPCs. The enterprise's security policy mandates that all control plane and replication data traffic must remain strictly private and route over the hybrid network connection without traversing the public internet. During the initial agent installation, the migration team observes that the replication status for the source servers remains stuck at 'Initiating connection' and data transfer has stalled. Which combination of actions should the Solutions Architect take to resolve the connectivity issue and satisfy the security requirements? (Select TWO.)

Select all that apply

Configure the on-premises firewall and the staging area security groups to allow inbound and outbound traffic over TCP port 1500 for data replication and TCP port 443 for control plane communication.

Provision interface VPC endpoints for the MGN service within the staging area VPC, create a Route 53 Inbound Resolver, and configure on-premises DNS conditional forwarders to route MGN endpoint queries to the resolver.

Configure the on-premises firewall to permit outbound traffic to the staging area VPC only over TCP ports 80 and 443, as the replication agent tunnels replication payloads using standard HTTPS.

Establish a Direct Connect Gateway connection directly to a Virtual Private Gateway attached to each target application VPC, then configure transitive routing policies on the Direct Connect Gateway to pass replication traffic.

Create MGN interface VPC endpoints in the staging area VPC, associate the default Route 53 Private Hosted Zone with the target application VPCs, and rely on the Transit Gateway to route DNS queries across VPCs without configuring on-premises DNS forwarding.

Show answer & explanation

Answer: Configure the on-premises firewall and the staging area security groups to allow inbound and outbound traffic over TCP port 1500 for data replication and TCP port 443 for control plane communication.; Provision interface VPC endpoints for the MGN service within the staging area VPC, create a Route 53 Inbound Resolver, and configure on-premises DNS conditional forwarders to route MGN endpoint queries to the resolver.

Answer

Configure the on-premises firewall and staging area security groups to allow traffic on TCP port 1500 and TCP port 443, and establish interface VPC endpoints for the MGN service along with a Route 53 Inbound Resolver and conditional forwarders.

The correct options resolve the issue by opening the required port (TCP 1500) for data replication and setting up the hybrid DNS resolution architecture (PrivateLink interface endpoints, Route 53 Inbound Resolver, and conditional forwarders) needed to keep the control plane traffic private.

Step-by-Step Solution

Ensure that the network path allows replication data to flow from the source agents to the staging area.

TCP port 1500 is opened on the firewall and staging area security groups, allowing the block-level data replication stream to connect.

AWS MGN uses TCP port 1500 exclusively for the data replication stream between the agent and the replication servers.

Establish a private path to the MGN control plane to avoid traversing the public internet.

Interface VPC endpoints (AWS PrivateLink) are created for MGN in the staging area VPC.

PrivateLink maps the public MGN service endpoints to private IP addresses within the customer's VPC.

Resolve the MGN service endpoints privately from the on-premises servers.

A Route 53 Inbound Resolver is deployed, and the on-premises DNS is configured with conditional forwarders for the MGN service domain pointing to the inbound resolver.

This allows the on-premises replication agents to resolve the MGN service endpoints to the private IP addresses of the interface VPC endpoints.

Key Concept

AWS Application Migration Service requires TCP port 1500 for data replication and TCP port 443 for control plane communication. When migrating privately over AWS Direct Connect, interface VPC endpoints (PrivateLink) and a Route 53 Inbound Resolver must be configured to ensure private DNS resolution and traffic routing.

Question 1488Question →

An enterprise manages a multi-account environment under AWS Organizations with consolidated billing enabled. The Production account runs a microservices application on Amazon Elastic Container Service (ECS) using AWS Fargate across three Availability Zones. Each Fargate task is configured with $2\text{ vCPU}$ and $8\text{ GB}$ of memory. However, Amazon CloudWatch metrics show that the tasks average $15\%$ CPU utilization and experience a peak memory utilization of $35\%$ ( $2.8\text{ GB}$ ). In the Development account, testing environments run on various transient Amazon EC2 instances that change instance families frequently based on testing needs. The company wants to optimize compute costs across both accounts while maintaining high availability in the Production environment.

Which strategy should a solutions architect recommend to achieve these goals?

Downsize the Fargate tasks in the Production account to

0.5\text{ vCPU}

and

4\text{ GB}

of memory. Keep a NAT Gateway deployed in each of the three Availability Zones. Purchase EC2 Instance Savings Plans at the Organization's management account level.

Downsize the Fargate tasks in the Production account to

0.5\text{ vCPU}

and

4\text{ GB}

of memory. Consolidate the NAT Gateways in the Production account to a single NAT Gateway in one Availability Zone to save on hourly gateway charges. Purchase Compute Savings Plans at the Organization's management account level.

Downsize the Fargate tasks in the Production account to

0.5\text{ vCPU}

and

4\text{ GB}

of memory. Keep a NAT Gateway deployed in each of the three Availability Zones. Purchase Compute Savings Plans at the Organization's management account level.

Keep the Fargate tasks at their current sizes. Share the EC2 capacity from the Development account with the Production account using AWS Resource Access Manager (RAM) to consolidate compute allocations before purchasing EC2 Instance Savings Plans.

Show answer & explanation

Answer: Downsize the Fargate tasks in the Production account to $0.5\text{ vCPU}$ and $4\text{ GB}$ of memory. Keep a NAT Gateway deployed in each of the three Availability Zones. Purchase Compute Savings Plans at the Organization's management account level.

Answer

Downsize the Fargate tasks in the Production account to

0.5\text{ vCPU}

and

4\text{ GB}

of memory. Keep a NAT Gateway deployed in each of the three Availability Zones. Purchase Compute Savings Plans at the Organization's management account level.

The correct strategy involves downsizing the over-provisioned Fargate tasks and purchasing Compute Savings Plans. Downsizing the tasks to

0.5\text{ vCPU}

and

4\text{ GB}

of memory accommodates the peak memory utilization of

2.8\text{ GB}

and average CPU of

0.3\text{ vCPU}

while significantly reducing costs. Purchasing Compute Savings Plans at the Organization's management account level ensures that the savings apply automatically across all member accounts to both Fargate and the transient EC2 instances. Keeping redundant NAT Gateways ensures that high availability is maintained for the Production environment.

Step-by-Step Solution

Analyze Fargate utilization metrics to determine the right-sizing opportunity.

Peak memory utilization is

35\%

8\text{ GB}

, which equals

2.8\text{ GB}

, and average CPU is

15\%

2\text{ vCPU}

, which equals

0.3\text{ vCPU}

. Downsizing to a supported configuration of

0.5\text{ vCPU}

and

4\text{ GB}

of memory safely covers these requirements.

Right-sizing eliminates unnecessary capacity and minimizes the base on-demand cost before applying commitment discounts.

Select the correct Savings Plan type for the mixed compute workload (ECS Fargate and transient EC2 instances).

Compute Savings Plans are selected because they apply to both Fargate and EC2, regardless of instance family, size, or region.

EC2 Instance Savings Plans do not cover Fargate and lack the flexibility needed for the transient EC2 instances in the Development account.

Review network gateway configurations in the Production VPC to maintain high availability.

Retain a NAT Gateway in each of the three Availability Zones to prevent a single point of failure.

Consolidating NAT Gateways would compromise the high availability requirement in the Production environment.

Key Concept

Optimizing resource costs involves first right-sizing resources based on CloudWatch metrics and then applying flexible commitment discounts, such as Compute Savings Plans, to cover dynamic or mixed compute workloads across an AWS Organization without compromising high availability.

Question 1489Question →

A fleet management company, ApexLogistics, is modernizing its on-premises vehicle telematics ingestion system by migrating it to AWS. The application consists of a series of stateless containerized services that process real-time GPS coordinates. The solutions architect decides to deploy the workload on Amazon ECS using the AWS Fargate launch type to minimize operational overhead. The containers must run in private subnets, communicate securely, and write the processed telemetry data to an Amazon DynamoDB table. All traffic between the containerized services and DynamoDB must remain entirely within the AWS internal network without using public IP addresses or traversing the internet. Which architecture should the solutions architect implement to satisfy these requirements?

Configure the ECS task definitions to use the bridge network mode, deploy the tasks across multiple private subnets, and create an interface VPC endpoint for DynamoDB.

Configure the ECS task definitions to use the awsvpc network mode, deploy the tasks in a single private subnet associated with a single NAT Gateway in one Availability Zone, and route DynamoDB traffic through the NAT Gateway.

Configure the ECS task definitions to use the awsvpc network mode, deploy the tasks across multiple private subnets, and create a gateway VPC endpoint for DynamoDB in the VPC route tables.

Configure the ECS task definitions to use the awsvpc network mode, deploy the tasks across multiple private subnets in a primary VPC, and resolve the DynamoDB service endpoint using a Route 53 Private Hosted Zone created in a shared services VPC that is not associated with the primary VPC.

Show answer & explanation

Answer: Configure the ECS task definitions to use the awsvpc network mode, deploy the tasks across multiple private subnets, and create a gateway VPC endpoint for DynamoDB in the VPC route tables.

Answer

Configure the ECS task definitions to use the awsvpc network mode, deploy the tasks across multiple private subnets, and create a gateway VPC endpoint for DynamoDB in the VPC route tables.

The correct architecture uses the awsvpc network mode, which is the only supported networking mode for AWS Fargate. Deploying tasks across multiple private subnets in different Availability Zones ensures high availability. Utilizing a gateway VPC endpoint for Amazon DynamoDB satisfies the security requirement by keeping all traffic internal to the AWS network, avoiding the need for public IPs or NAT Gateways.

Step-by-Step Solution

Determine the networking capability and requirements of the container hosting platform.

Identify that AWS Fargate only supports the awsvpc network mode, which allocates a dedicated Elastic Network Interface (ENI) to each task.

This rules out host or bridge networking modes, which are incompatible with the Fargate launch type.

Design private routing to Amazon DynamoDB.

Create a gateway VPC endpoint for DynamoDB and associate it with the route tables of the private subnets.

A gateway VPC endpoint routes traffic to DynamoDB privately over the AWS network, bypassing the public internet and avoiding the need for public IP addresses or NAT gateways.

Ensure high availability and fault tolerance.

Deploy the tasks across multiple private subnets in different Availability Zones.

Distributing tasks across multiple Availability Zones prevents a single subnet or AZ outage from disrupting the ingestion system.

Key Concept

AWS Fargate networking requires the awsvpc network mode, and secure, private integration with AWS services like DynamoDB is best achieved using VPC endpoints.

Question 1490Question →

An enterprise is migrating a self-managed, on-premises Oracle 19c database containing tables with Transparent Data Encryption (TDE) enabled and several tables with Large Objects (LOBs) up to 150 KB to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration must minimize downtime, and the database experiences high write volumes. A solutions architect is designing the AWS Schema Conversion Tool (SCT) and AWS Database Migration Service (DMS) configuration. Which of the following actions should the Solutions Architect perform to meet these requirements? (Select two.)

Select all that apply

Configure the AWS DMS source database endpoint to use the Binary Reader method instead of Oracle LogMiner, and specify the path to the Oracle wallet containing the Transparent Data Encryption (TDE) keys in the endpoint settings.

Configure the AWS DMS replication task to use Limited LOB mode and set the maximum LOB size to 150 KB to ensure that LOB data is transferred in a single pass without querying the source database.

Configure the AWS DMS replication task to use Full LOB mode and configure the LOB chunk size to 150 KB to optimize the multi-pass data retrieval process for highly active tables.

Enable supplemental logging on the target Aurora PostgreSQL DB cluster for the schema columns containing LOBs and encrypted data to ensure data integrity during replication.

Deploy the AWS Schema Conversion Tool (SCT) extraction agent on a dedicated replication instance and configure it to continuously stream TDE-encrypted transaction changes from the Oracle LogMiner interface.

Show answer & explanation

Answer: Configure the AWS DMS source database endpoint to use the Binary Reader method instead of Oracle LogMiner, and specify the path to the Oracle wallet containing the Transparent Data Encryption (TDE) keys in the endpoint settings.; Configure the AWS DMS replication task to use Limited LOB mode and set the maximum LOB size to 150 KB to ensure that LOB data is transferred in a single pass without querying the source database.

Answer

To migrate the database successfully with TDE and LOBs under high write volumes, you must configure the AWS DMS source endpoint to use the Binary Reader method with the Oracle wallet path for TDE decryption, and set the DMS replication task to use Limited LOB mode with a maximum size of 150 KB.

The correct actions involve configuring the AWS DMS source database endpoint to use the Binary Reader method and using Limited LOB mode on the replication task. The Binary Reader method is required for AWS DMS to read and decrypt Transparent Data Encryption (TDE) protected redo logs directly from the source Oracle file system or ASM, which avoids LogMiner overhead. Limited LOB mode with a maximum size of 150 KB ensures that LOB data is fetched in a single-pass select statement along with the rest of the row, preventing the secondary query lookup per row that Full LOB mode requires, thereby preserving performance on high write volume databases.

Step-by-Step Solution

Analyze the database migration requirements for TDE encryption and LOB data under high write volumes.

Identified that LogMiner is not suitable for TDE decryption under high volumes and that Full LOB mode causes replication lag.

Guides the architecture selection towards Binary Reader and Limited LOB mode.

Configure the AWS DMS source endpoint for the Oracle database.

Set the CDC method to Binary Reader and provided the Oracle wallet path for TDE decryption.

Enables AWS DMS to read and decrypt active and archived redo logs directly from the file system or ASM.

Configure the AWS DMS replication task settings for LOB handling.

Configured Limited LOB mode with a maximum size of 150 KB.

Ensures LOB data is transferred in a single pass without secondary queries, avoiding performance degradation under high write volumes.

Key Concept

AWS DMS Oracle source CDC configuration with TDE and LOB optimization

Question 1491Question →

A logistics company is designing a new cloud architecture in the eu-west-1 region. The design includes two VPCs: vpc-prod-delivery (hosting critical backend applications across two Availability Zones) and vpc-shared-ops (hosting operational tools). The company has an on-premises data center that requires redundant, private connectivity to both VPCs. Additionally, applications in vpc-prod-delivery must resolve internal domain names managed in a Route 53 Private Hosted Zone (PHZ) ops.internal that is owned by vpc-shared-ops. Outbound internet egress for the application instances must be highly resilient against Availability Zone failures. Which of the following networking designs meets these requirements while ensuring maximum resiliency and minimum administrative overhead?

Deploy an AWS Transit Gateway and connect both VPCs to it. Associate the Transit Gateway with a Direct Connect Gateway connected to an AWS Direct Connect connection and a backup Site-to-Site VPN. Deploy a single NAT Gateway in a public subnet in one Availability Zone of vpc-prod-delivery, and configure all private subnet route tables to route outbound internet traffic (

0.0.0.0/0

) through this single NAT Gateway. Associate the private hosted zone ops.internal with both VPCs.

Connect both VPCs directly to a Direct Connect Gateway associated with an AWS Direct Connect connection and a backup Site-to-Site VPN. Configure the Direct Connect Gateway to route traffic transitively between vpc-prod-delivery and vpc-shared-ops. Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-prod-delivery for outbound internet access, and associate the private hosted zone ops.internal with both VPCs.

Deploy an AWS Transit Gateway and connect both VPCs to it. Associate the Transit Gateway with a Direct Connect Gateway connected to an AWS Direct Connect connection and a backup Site-to-Site VPN. Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-prod-delivery, and configure the private route tables to route outbound internet traffic (

0.0.0.0/0

) to the local NAT Gateway in the same Availability Zone. Associate the private hosted zone ops.internal with both vpc-shared-ops and vpc-prod-delivery.

Deploy an AWS Transit Gateway and connect both VPCs to it. Associate the Transit Gateway with a Direct Connect Gateway connected to an AWS Direct Connect connection and a backup Site-to-Site VPN. Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-prod-delivery for outbound internet access. Associate the private hosted zone ops.internal only with vpc-shared-ops, relying on the Transit Gateway attachment to transitively resolve DNS queries from vpc-prod-delivery.

Show answer & explanation

Answer: Deploy an AWS Transit Gateway and connect both VPCs to it. Associate the Transit Gateway with a Direct Connect Gateway connected to an AWS Direct Connect connection and a backup Site-to-Site VPN. Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-prod-delivery, and configure the private route tables to route outbound internet traffic ( $0.0.0.0/0$ ) to the local NAT Gateway in the same Availability Zone. Associate the private hosted zone ops.internal with both vpc-shared-ops and vpc-prod-delivery.

Answer

The correct networking design utilizes an AWS Transit Gateway connected to a Direct Connect Gateway with a backup VPN to provide redundant hybrid connectivity, deploys a NAT Gateway in each Availability Zone of the delivery VPC to guarantee high availability for internet egress, and associates the private hosted zone with both VPCs to enable DNS resolution across accounts.

The correct design uses an AWS Transit Gateway to support multi-VPC hybrid routing over AWS Direct Connect and VPN. It ensures egress resiliency by deploying a NAT Gateway in each Availability Zone of the delivery VPC, protecting outbound internet access against single-zone failures. Finally, it permits proper internal name resolution by explicitly associating the Route 53 Private Hosted Zone with both VPCs.

Step-by-Step Solution

Evaluate hybrid connectivity requirements

Identify that AWS Transit Gateway is the standard mechanism to scale hybrid connectivity to multiple VPCs via a single Direct Connect Gateway association while maintaining backup VPN support.

Direct Connect Gateway alone does not support VPC-to-VPC transitive routing, meaning a Transit Gateway is necessary to bridge on-premises networks and both VPCs.

Design resilient outbound internet egress

Determine that deploying a NAT Gateway in each Availability Zone where application instances reside ensures that a single zone failure does not sever outbound internet access for the surviving zone.

A single NAT Gateway creates an architectural bottleneck and single point of failure, violating the high resiliency requirement.

Configure Route 53 DNS resolution across VPC boundaries

Associate the Route 53 Private Hosted Zone ops.internal with both vpc-shared-ops and vpc-prod-delivery.

Route 53 PHZ DNS resolution is not transitive across VPC attachments or peerings; it must be explicitly associated with each VPC that needs to resolve its resource records.

Key Concept

AWS Hybrid Networking and DNS Design

Question 1492Question →

A real-time sports betting platform hosts its live analytics and odds-calculation service on Amazon EC2 instances within private subnets across two Availability Zones ( $AZ-a$ and $AZ-b$ ). The EC2 instances are managed by an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). Outbound API requests to external sports data feeds are routed through a single NAT Gateway located in the public subnet of $AZ-a$ .

The platform experiences a predictable, massive spike in traffic at the start of major sporting events. During these spikes, the following issues occur:
1. The ALB returns HTTP $503$ Service Unavailable errors during the first few minutes of the traffic spike.
2. The ASG launches new instances in response to the CPU utilization target tracking policy. However, because each instance takes approximately $8\text{ minutes}$ to download reference datasets and bootstrap, the ASG continuously launches unnecessary instances during this period, leading to over-provisioning and high costs.
3. When a transient infrastructure failure occurs in $AZ-a$ , all outbound communication to external sports data feeds is lost for instances in both Availability Zones.

Which set of actions should a Solutions Architect recommend to address all of these issues while optimizing cost and fault tolerance?

Request Application Load Balancer pre-warming from AWS Support before scheduled events. Deploy a NAT Gateway in the public subnet of

AZ-b

, and configure the route table of the private subnet in

AZ-b

to use this new NAT Gateway. Set the `EstimatedInstanceWarmup` parameter of the target tracking scaling policy to

600\text{ seconds}

Request Application Load Balancer pre-warming from AWS Support before scheduled events. Keep the single NAT Gateway in

AZ-a

and route all outbound traffic from both Availability Zones through it. Set the `EstimatedInstanceWarmup` parameter of the target tracking scaling policy to

600\text{ seconds}

Request Application Load Balancer pre-warming from AWS Support before scheduled events. Deploy a NAT Gateway in the public subnet of

AZ-b

, and configure the route table of the private subnet in

AZ-b

to use this new NAT Gateway. Set the default cooldown period of the Auto Scaling Group to

300\text{ seconds}

Configure a Route

53

active-active failover routing policy to distribute the sudden traffic spikes across multiple target groups. Deploy a NAT Gateway in the public subnet of

AZ-b

, and configure the route table of the private subnet in

AZ-b

to use this new NAT Gateway. Set the `EstimatedInstanceWarmup` parameter of the target tracking scaling policy to

600\text{ seconds}

Show answer & explanation

Answer: Request Application Load Balancer pre-warming from AWS Support before scheduled events. Deploy a NAT Gateway in the public subnet of $AZ-b$ , and configure the route table of the private subnet in $AZ-b$ to use this new NAT Gateway. Set the `EstimatedInstanceWarmup` parameter of the target tracking scaling policy to $600\text{ seconds}$ .

Answer

Request Application Load Balancer pre-warming from AWS Support before scheduled events. Deploy a NAT Gateway in the public subnet of the second Availability Zone, configure the local private route tables accordingly, and set the scaling policy's EstimatedInstanceWarmup parameter to 600 seconds.

Deploying a NAT Gateway in the public subnet of the second Availability Zone and mapping the local private subnet route table to it establishes localized outbound routing, avoiding cross-AZ dependencies and single points of failure. Pre-warming the Application Load Balancer ensures it is immediately ready for massive, sudden traffic spikes, preventing HTTP

503

errors. Setting the EstimatedInstanceWarmup parameter to

600\text{ seconds}

(which is greater than the

8\text{ minute}

bootstrap time) ensures that newly launched instances are not included in target tracking metrics calculations until they are ready, preventing over-provisioning.

Step-by-Step Solution

Deploy a NAT Gateway in the public subnet of

AZ-b

and update the route table of the private subnet in

AZ-b

to point to the new NAT Gateway.

Outbound traffic from the private subnet in

AZ-b

is routed locally, eliminating the single point of failure.

This resolves the fault tolerance issue where a failure in one Availability Zone impacts outbound connectivity for instances running in other zones.

Request Application Load Balancer (ALB) pre-warming from AWS Support prior to the scheduled traffic surge.

The ALB is pre-configured with sufficient capacity to handle the sudden, massive traffic spike.

This resolves the HTTP

503

errors that occur due to the load balancer being unable to scale fast enough to meet the flash traffic demand.

Configure the target tracking scaling policy with an `EstimatedInstanceWarmup` of

600\text{ seconds}

(

10\text{ minutes}

Newly launched instances are excluded from contributing to the group metric until they have completed their

8\text{ minute}

bootstrapping process.

This prevents the scaling policy from continuously launching unnecessary instances during the bootstrapping lag, optimizing resource costs.

Key Concept

Auto Scaling Warmup and Multi-AZ Load Balancing/Gateway Fault Tolerance

Estimated Time:3m 0s

Question 1493Question →

An automotive manufacturer is migrating its core supply chain management system, comprising 40 on-premises physical servers, to AWS using AWS Application Migration Service (MGN). The hybrid network connection is established via an AWS Direct Connect (DX) connection terminating on an AWS Transit Gateway. The target environment utilizes a dedicated Staging VPC for data replication and multiple Application VPCs for target workloads. To comply with security policies, all replication traffic must remain private over the DX connection, and no resources in the Staging VPC or on-premises can have direct access to the public internet.

To support this configuration, a solutions architect provisions VPC Interface Endpoints for the MGN control plane (mgn.{region}.amazonaws.com) and Amazon EC2 within a central Shared Services VPC. A Route 53 Private Hosted Zone (PHZ) for the MGN endpoint is created in the Shared Services account. During testing, the MGN agents are successfully installed on the source servers, but the replication status is reported as 'Stalled'. An investigation reveals that the replication servers launched in the Staging VPC are failing to communicate with the MGN control plane.

Which of the following actions should the solutions architect take to resolve this issue?

Associate the Route 53 Private Hosted Zone in the Shared Services account with the Staging VPC. Update the Staging VPC route tables to route traffic destined for the Shared Services VPC through the Transit Gateway, and configure the security group of the MGN interface endpoints in the Shared Services VPC to accept inbound traffic on TCP port 443 from the Staging VPC CIDR range.

Configure Route 53 Resolver outbound endpoints in the Staging VPC to forward DNS queries for the MGN endpoint to the on-premises DNS servers, which then forward those queries to Route 53 Resolver inbound endpoints in the Shared Services VPC, rather than associating the Private Hosted Zone with the Staging VPC.

Associate the Direct Connect Gateway directly with both the Staging VPC and the Shared Services VPC, and configure the Staging VPC route table to route traffic destined for the Shared Services VPC CIDR through the Direct Connect Gateway to enable transitive VPC-to-VPC routing.

Configure the MGN replication template to assign public IP addresses to the replication servers. Update the on-premises firewall to allow outbound TCP port 1500 to the public internet, and route replication traffic through a public internet path instead of the Direct Connect connection.

Show answer & explanation

Answer: Associate the Route 53 Private Hosted Zone in the Shared Services account with the Staging VPC. Update the Staging VPC route tables to route traffic destined for the Shared Services VPC through the Transit Gateway, and configure the security group of the MGN interface endpoints in the Shared Services VPC to accept inbound traffic on TCP port 443 from the Staging VPC CIDR range.

Answer

Associate the Route 53 Private Hosted Zone with the Staging VPC, configure routing via the Transit Gateway, and allow inbound traffic on port 443 in the interface endpoint's security group.

The correct answer addresses the DNS and routing requirements for a fully private MGN replication channel. Associating the Private Hosted Zone with the Staging VPC ensures that the replication servers can resolve the MGN endpoint to the private IP addresses of the interface endpoints in the Shared Services VPC. Configuring the Staging VPC route tables ensures a path exists through the Transit Gateway to the Shared Services VPC. Allowing inbound traffic on port 443 in the interface endpoint's security group allows the HTTPS connection to succeed.

Step-by-Step Solution

Associate the Route 53 Private Hosted Zone (PHZ) created in the Shared Services account with the Staging VPC.

This enables the replication servers launched in the Staging VPC to resolve the MGN service endpoint name (mgn.{region}.amazonaws.com) to the private IP addresses of the VPC Interface Endpoints in the Shared Services VPC.

By default, a PHZ is only resolvable within the VPCs it is associated with. Without this association, the replication servers will attempt to resolve the public IP of the MGN control plane, which they cannot reach due to lack of internet access.

Update the Staging VPC route tables to route traffic destined for the Shared Services VPC CIDR through the Transit Gateway.

Network packets from the replication servers in the Staging VPC can now reach the Shared Services VPC where the interface endpoints are hosted.

The replication servers must have a valid network path to the VPC interface endpoints to establish a connection.

Configure the security group attached to the VPC Interface Endpoints in the Shared Services VPC to allow inbound HTTPS (TCP port 443) traffic from the Staging VPC CIDR range.

The firewall rules allow the replication servers to complete the HTTPS handshake with the MGN control plane.

Security groups on VPC interface endpoints act as stateful firewalls; they must explicitly permit incoming traffic from the source VPC's network range.

Key Concept

To support private replication using AWS MGN over a Direct Connect connection without public internet access, you must deploy VPC interface endpoints in a VPC, associate the corresponding Route 53 Private Hosted Zone with all replicating VPCs (including the Staging VPC), ensure Transit Gateway routing is established, and configure security groups to allow HTTPS traffic (TCP port 443) from the replicating networks.

Alternative Method

Instead of Transit Gateway, VPC Peering could be used to connect the Staging VPC and the Shared Services VPC, provided IP addresses do not overlap, but the Route 53 Private Hosted Zone association with the Staging VPC remains a mandatory requirement.

Estimated Time:2m 30s

Question 1494Question →

A logistics company is migrating its core on-premises dispatch and routing application servers to AWS using AWS Application Migration Service (MGN). The on-premises environment consists of VMware virtual machines connected to AWS via a 10 Gbps AWS Direct Connect connection terminated at an AWS Transit Gateway. The Transit Gateway connects to a central hub VPC and a target migration VPC containing the staging area subnet configured in the MGN replication template. Security policies strictly prohibit any internet access from either the on-premises servers or the target migration VPC. The MGN agents are installed on the source servers, but they cannot establish communication with the MGN service endpoints, preventing the replication process from initiating. Which two actions must the solutions architect take to resolve these connectivity issues and start replication over the private network? (Select TWO.)

Select all that apply

Create interface VPC endpoints for both MGN and Amazon S3 in the staging VPC, and configure the on-premises DNS resolver to forward queries for these endpoints to Route 53 Inbound Resolver endpoints in the hub VPC.

Configure the security group of the MGN replication servers in the staging VPC to allow inbound traffic on TCP port 1500 from the on-premises CIDR block, and verify that the on-premises network firewall allows outbound traffic on TCP port 1500 to the staging subnet.

Configure the security group of the MGN replication servers in the staging VPC to only allow inbound traffic on TCP port 443 from the on-premises CIDR block, assuming replication traffic is encrypted and tunneled over HTTPS.

Provision an Amazon S3 Gateway Endpoint in the staging VPC, and configure the Transit Gateway route tables to advertise the prefix list of the Gateway Endpoint to the on-premises firewall over the Direct Connect connection.

Associate the Route 53 Private Hosted Zones for the MGN and S3 endpoints only with the hub VPC, expecting the target migration VPC to resolve the private DNS names transitively through the Transit Gateway.

Deploy a single NAT Gateway in a single public subnet of the hub VPC to route the replication traffic over the internet, and configure the Transit Gateway to point all outbound traffic to this single NAT Gateway instance.

Show answer & explanation

Answer: Create interface VPC endpoints for both MGN and Amazon S3 in the staging VPC, and configure the on-premises DNS resolver to forward queries for these endpoints to Route 53 Inbound Resolver endpoints in the hub VPC.; Configure the security group of the MGN replication servers in the staging VPC to allow inbound traffic on TCP port 1500 from the on-premises CIDR block, and verify that the on-premises network firewall allows outbound traffic on TCP port 1500 to the staging subnet.

Answer

The correct actions are: 1) Create interface VPC endpoints for MGN and Amazon S3 in the staging VPC, and forward on-premises DNS queries to Route 53 Inbound Resolver endpoints in the hub VPC. 2) Configure the staging VPC security group and on-premises firewall to allow inbound and outbound traffic on TCP port 1500.

To establish private replication using AWS MGN over a Direct Connect connection without internet access, two main components must be configured: control plane communication (including agent installer downloads) and replication data channel connectivity. For control plane communication, the MGN agent needs access to the MGN API and Amazon S3. Because internet access is prohibited, interface VPC endpoints (PrivateLink) for both MGN and S3 must be created in the staging VPC. On-premises source servers must resolve these endpoints to their private IPs, which requires creating Route 53 Inbound Resolver endpoints in the hub VPC and configuring on-premises DNS to forward queries. For replication data channel connectivity, replication servers in the staging VPC communicate with source agents over TCP port 1500. This requires opening TCP port 1500 inbound on the staging security group and outbound on the on-premises firewall.

Step-by-Step Solution

Analyze the network path and security constraints.

Identify that replication traffic must flow privately over Direct Connect / Transit Gateway without using the public internet, requiring AWS PrivateLink for MGN and S3 control plane endpoints.

This determines the choice of Interface Endpoints instead of Gateway Endpoints or NAT Gateways, as Gateway Endpoints are not routable over Direct Connect/TGW from on-premises, and NAT Gateways require internet routing.

Configure DNS resolution for private endpoints.

Create Route 53 Inbound Resolvers in the hub VPC and forward local DNS queries for the MGN and S3 endpoints to these resolver IPs.

On-premises servers must resolve the public DNS names of AWS services (such as MGN API and S3) to the private IP addresses of the interface endpoints.

Configure data plane replication ports.

Modify the security groups in the staging area and the local firewall to allow TCP port 1500.

MGN agents replicate data blocks using TCP port 1500 directly to the replication servers; blocking this port will cause the replication state to remain stalled.

Key Concept

Establishing secure, private, and high-performance network connectivity for AWS Application Migration Service (MGN) using interface endpoints, Route 53 Inbound Resolvers, and security group rules for data replication over AWS Direct Connect.

Estimated Time:4m 0s

Question 1495Question →

A company is modernizing its legacy on-premises web application by migrating the workload to Amazon Elastic Container Service (Amazon ECS) using the AWS Fargate launch type. The modernized architecture requires that containerized tasks run securely in private subnets and pull container images from Amazon Elastic Container Registry (Amazon ECR) without traversing the public internet.

Which TWO configurations should the solutions architect implement to satisfy these requirements?

Select all that apply

Configure the ECS task definitions to use the awsvpc network mode.

Create VPC endpoints for Amazon ECR to enable private image pull operations.

Configure the ECS task definitions to use the bridge network mode to optimize container-to-container port mapping.

Deploy a single NAT Gateway in a public subnet to route all ECR traffic securely over the public internet.

Show answer & explanation

Answer: Configure the ECS task definitions to use the awsvpc network mode.; Create VPC endpoints for Amazon ECR to enable private image pull operations.

Answer

Configure the ECS task definitions to use the awsvpc network mode and create VPC endpoints for Amazon ECR to enable private image pull operations.

The correct configurations are to use the awsvpc network mode, which is the only supported network mode for tasks running on AWS Fargate, and to create VPC endpoints for Amazon ECR, which ensures that all image pulling traffic stays within the AWS network and does not traverse the public internet.

Step-by-Step Solution

Determine the required ECS launch type network requirements.

Identify that AWS Fargate only supports the awsvpc network mode.

This is a fundamental requirement of the Fargate launch type, which automatically provisions ENIs for tasks.

Evaluate the requirement for private image deployment from Amazon ECR.

Implement VPC endpoints for Amazon ECR (api and dkr endpoints).

This establishes private connections between the VPC and Amazon ECR using AWS PrivateLink, avoiding transit over the public internet.

Key Concept

AWS Fargate networking constraints and private access to AWS services via VPC endpoints

Question 1496Question →

An enterprise is planning to migrate its customer support system to AWS. The system consists of three main components:

1. Web Application: A monolithic PHP application running on Apache. The enterprise wants to package the application into Docker containers and run it on Amazon ECS with AWS Fargate to improve operational efficiency, without modifying the application code or architecture.
2. Database: An on-premises Microsoft SQL Server database. To eliminate SQL Server licensing costs, the enterprise wants to migrate the database to Amazon Aurora PostgreSQL. This requires converting schemas using the AWS Schema Conversion Tool (SCT) and updating the application's SQL queries.
3. Legacy Archiving Tool: A proprietary, closed-source document archiving tool that is bound to on-premises hardware licenses. This tool is scheduled to be decommissioned in 8 months when a new global BI system goes live.

The enterprise has a strict 3-month timeline for the migration and limited development resources.

Which combination of migration strategies represents the most appropriate path for each component?

Web Application: Replatform; Database: Refactor; Legacy Archiving Tool: Retain

Web Application: Replatform; Database: Replatform; Legacy Archiving Tool: Retain

Web Application: Rehost; Database: Refactor; Legacy Archiving Tool: Retire

Web Application: Refactor; Database: Replatform; Legacy Archiving Tool: Retire

Show answer & explanation

Answer: Web Application: Replatform; Database: Refactor; Legacy Archiving Tool: Retain

Answer

Web Application: Replatform; Database: Refactor; Legacy Archiving Tool: Retain

The correct option correctly maps the three components to their appropriate migration strategies. Containerizing the monolithic PHP application and hosting it on Amazon ECS with AWS Fargate without modifying code is a Replatform (lift, tinker, and shift) strategy. Migrating the database from Microsoft SQL Server to Amazon Aurora PostgreSQL requires schema conversion and query modification, representing a Refactor (Re-architect) strategy. Keeping the legacy archiving tool on-premises because of licensing limitations and its upcoming decommissioning is a Retain strategy.

Step-by-Step Solution

Analyze the Web Application migration path.

The application is packaged into Docker containers and run on ECS Fargate without changing code or architecture.

Containerizing an application to run on a managed container service without altering its core architecture is a Replatform (lift, tinker, and shift) strategy.

Analyze the Database migration path.

The database is migrated from SQL Server to Aurora PostgreSQL, which requires schema conversion and query rewrites.

A migration that changes the database engine and requires code modifications and schema conversions is classified as a Refactor (Re-architect) strategy.

Analyze the Legacy Archiving Tool migration path.

The tool is bound to on-premises hardware licenses and will be decommissioned in 8 months.

Since the tool cannot be migrated due to licensing constraints and has a defined end-of-life in the near term, keeping it in its current environment is a Retain strategy.

Key Concept

Selecting the correct AWS migration strategy (7 Rs) based on architectural modifications, licensing, timeline, and business constraints.

Question 1497Question →

A healthcare SaaS provider is modernizing its on-premises, queue-driven DICOM image-processing application to AWS. The architecture must run on a serverless container platform to minimize operational overhead and automatically scale down to zero during periods of inactivity. Security and compliance requirements dictate that:

1. Each container task must have a dedicated private IP address and Elastic Network Interface (ENI) to allow granular security group configurations at the individual task level.
2. Ephemeral storage utilized by the container task to stage large medical images must be encrypted using a Customer Managed Key (CMK) in AWS KMS to satisfy HIPAA audit requirements.
3. The container tasks must resolve on-premises database hostnames via a Route 53 Private Hosted Zone (PHZ) hosted in a centralized shared services AWS account.
4. Outbound connectivity to the on-premises database must traverse an AWS Transit Gateway and must be resilient to Availability Zone failures without routing outbound public traffic through a single NAT Gateway.

Which of the following architectures meets these requirements while minimizing operational overhead?

Deploy the workload on Amazon ECS using AWS Fargate. Configure the ECS task definition to use bridge network mode to allow local container port mapping. Enable ephemeral storage encryption using the AWS-managed KMS key for Amazon ECS in the task definition. Associate the centralized Route 53 PHZ with the ECS VPC. Deploy NAT Gateways in each Availability Zone where tasks are running, and route all on-premises database traffic through the Transit Gateway.

Deploy the workload on Amazon ECS using AWS Fargate (Platform Version 1.4.0 or later). Define the ECS tasks to use awsvpc network mode. Configure the ECS cluster setting to use a customer managed KMS key for Fargate ephemeral storage encryption. Associate the centralized Route 53 PHZ in the shared services account with the ECS VPC. Deploy a NAT Gateway in each Availability Zone containing the task subnets, and configure the local route tables to point on-premises traffic to the Transit Gateway attachment.

Deploy the workload on Amazon ECS using AWS Fargate with awsvpc network mode. Configure ephemeral storage encryption at the ECS cluster level using a customer managed KMS key. Rely on Transit Gateway routing to automatically propagate the Route 53 PHZ DNS resolution from the shared services VPC to the ECS VPC without explicit VPC association. Deploy a single NAT Gateway in a public subnet to handle all egress traffic.

Deploy the workload on Amazon ECS using AWS Fargate with awsvpc network mode. Configure the task definition's ephemeral storage settings to use the default AWS-managed KMS key and update its key policy to grant audit read access to the compliance team. Associate the centralized Route 53 PHZ with the ECS VPC. Deploy NAT Gateways in each Availability Zone where tasks are running and route traffic through the Transit Gateway.

Show answer & explanation

Answer: Deploy the workload on Amazon ECS using AWS Fargate (Platform Version 1.4.0 or later). Define the ECS tasks to use awsvpc network mode. Configure the ECS cluster setting to use a customer managed KMS key for Fargate ephemeral storage encryption. Associate the centralized Route 53 PHZ in the shared services account with the ECS VPC. Deploy a NAT Gateway in each Availability Zone containing the task subnets, and configure the local route tables to point on-premises traffic to the Transit Gateway attachment.

Answer

Deploying the workload on Amazon ECS using AWS Fargate with awsvpc network mode, utilizing the ECS cluster setting with a customer managed KMS key for ephemeral storage encryption, associating the centralized Route 53 Private Hosted Zone with the ECS VPC, and deploying redundant NAT Gateways across Availability Zones routing through the Transit Gateway.

Deploying the workload on Amazon ECS using AWS Fargate with the 'awsvpc' network mode satisfies the serverless execution model while guaranteeing dedicated ENIs and IPs for container-level security groups. Ephemeral storage encryption using a customer managed key configured at the cluster level ensures that HIPAA compliance audits can track key usage. Associating the centralized Route 53 PHZ with the ECS VPC enables on-premises hostname resolution. Configuring redundant NAT Gateways across Availability Zones and routing on-premises traffic through Transit Gateway satisfies the high availability and direct private connectivity constraints.

Step-by-Step Solution

Evaluate the container network mode requirements.

Identify that AWS Fargate only supports the 'awsvpc' network mode, which allocates a dedicated ENI and private IP address per task. This fulfills the task-level security group and container isolation requirement.

Fargate abstracts the underlying host network space, making bridge and host networking modes invalid.

Determine the configuration for ephemeral storage encryption.

Specify the customer managed KMS key (CMK) at the ECS cluster level using the Fargate ephemeral storage encryption cluster settings (fargateEphemeralStorageKmsKeyId).

AWS-managed keys (like aws/ecs) have immutable key policies and cannot be customized with policy actions for audit logging, which is required for HIPAA compliance.

Design DNS resolution for the multi-account architecture.

Associate the Route 53 Private Hosted Zone (PHZ) created in the shared services account with the consumer ECS VPC.

DNS resolution of a PHZ does not transitively propagate across Transit Gateway VPC attachments without an explicit association of the hosted zone with the VPC.

Formulate highly available network routing.

Deploy NAT Gateways in each Availability Zone where tasks run to provide redundant egress paths, and update route tables to direct on-premises CIDR traffic to the Transit Gateway.

A single NAT Gateway creates a single point of failure, violating the resilience requirement in the event of an AZ outage.

Key Concept

Modernizing Workloads using Containers (ECS and EKS)

Question 1498Question →

An enterprise runs a payment processing microservice hosted on Amazon ECS tasks in VPC A within the provider AWS account. An order management application running on Amazon EC2 instances in VPC B within a separate consumer AWS account needs to securely access the payment API. The applications are currently connected using a VPC peering connection, but the security team wants to restrict network connectivity so that VPC B can only access the payment microservice and cannot initiate any other traffic to VPC A. Additionally, access must be restricted to only the specific IAM role associated with the order management application. Which two actions should a Solutions Architect take to meet these requirements?

Select all that apply

Configure an Amazon VPC Endpoint Service in VPC A backed by a Network Load Balancer, and add the Amazon Resource Name (ARN) of the specific consumer IAM role to the allowed principals list of the Endpoint Service.

Create an interface VPC endpoint in VPC B pointing to the VPC Endpoint Service, and attach a VPC endpoint policy to the interface VPC endpoint that permits access only to the specific consumer IAM role.

Maintain the VPC peering connection, and attach a Service Control Policy (SCP) to the consumer account's Organizational Unit that restricts the allowed destinations to the IP addresses of the provider's ECS tasks.

Create a Route 53 Private Hosted Zone (PHZ) in VPC A, associate the PHZ with VPC B, and configure a resource-based policy on the hosted zone to restrict DNS resolution requests to the consumer IAM role.

Establish network connectivity via AWS Transit Gateway, and configure AWS KMS using an AWS-managed key (aws/kms) to sign the API requests between the accounts to enforce principal validation.

Show answer & explanation

Answer: Configure an Amazon VPC Endpoint Service in VPC A backed by a Network Load Balancer, and add the Amazon Resource Name (ARN) of the specific consumer IAM role to the allowed principals list of the Endpoint Service.; Create an interface VPC endpoint in VPC B pointing to the VPC Endpoint Service, and attach a VPC endpoint policy to the interface VPC endpoint that permits access only to the specific consumer IAM role.

Answer

Configure an Amazon VPC Endpoint Service in the provider account backed by a Network Load Balancer and add the consumer IAM role to the allowed principals list, then create an interface VPC endpoint in the consumer account pointing to this service with an endpoint policy that permits access only to that specific IAM role.

The correct options work together to establish AWS PrivateLink. Configuring a VPC Endpoint Service backed by a Network Load Balancer in the provider account restricts network traffic solely to the exposed service, preventing general VPC-to-VPC routing. By adding the specific consumer IAM role to the Allowed Principals of the Endpoint Service, we ensure only that identity can establish the connection. Creating an interface VPC endpoint in the consumer account with a custom VPC endpoint policy restricts endpoint access to only the authorized consumer IAM role.

Step-by-Step Solution

Set up the provider-side VPC Endpoint Service.

A VPC Endpoint Service is created in the provider account (VPC A) backed by a Network Load Balancer (NLB). The NLB routes traffic to the ECS tasks. By default, access is restricted.

This establishes a private service publishing mechanism that does not allow arbitrary network routing, satisfying the requirement to block general VPC-to-VPC communication.

Authorize the consumer principal on the Endpoint Service.

The Amazon Resource Name (ARN) of the specific IAM role from the consumer account (VPC B) is added to the Allowed Principals list of the VPC Endpoint Service.

This prevents unauthorized AWS accounts or principals from discovering or connecting to the Endpoint Service.

Deploy and configure the Interface VPC Endpoint (AWS PrivateLink) on the consumer side.

An Interface VPC Endpoint is created in VPC B, pointing to the Endpoint Service in VPC A. A VPC endpoint policy is attached to the endpoint, explicitly allowing access only to the specific IAM role.

This establishes the private endpoint within VPC B and enforces identity-based security at the VPC endpoint boundary to ensure only the authorized application role can communicate through it.

Key Concept

AWS PrivateLink enables secure, private connectivity to services hosted on AWS without exposing the VPCs to the public internet or establishing full network routing like VPC Peering or Transit Gateway. Granular identity-based security is achieved by combining Endpoint Service Allowed Principals (provider side) and VPC Endpoint Policies (consumer side).

Question 1499Question →

A retail company uses AWS Systems Manager State Manager to continuously apply and enforce software configuration templates on a fleet of Amazon EC2 instances deployed across multiple member accounts in an AWS Organization. Some of these configuration templates contain database connection strings that must be decrypted locally using an AWS Key Management Service (KMS) key hosted in a centralized security account. The Operations team discovers that local administrators in some member accounts have manually modified the configuration files directly on the EC2 instances, introducing operational drift. Which of the following is the most secure and operationally efficient solution to automatically remediate this drift while allowing the instances to decrypt the connection strings?

Configure the State Manager association to execute periodically on a schedule to re-apply the configuration document. Encrypt the credentials using the default AWS-managed KMS key for Systems Manager (aws/ssm), and attach an IAM policy to the EC2 instance profile roles in the member accounts allowing cross-account decryption.

Implement an AWS Config rule to monitor the configuration files on the EC2 instances. When configuration drift is detected, configure an AWS Config remediation action to trigger an AWS Lambda function that uses SSH to connect to the EC2 instances and restore the configuration files from an Amazon S3 bucket.

Configure the State Manager association to execute periodically on a schedule to re-apply the configuration document. Encrypt the credentials using a Customer Managed Key (CMK) in the central security account, updating the key policy to delegate decrypt permissions to the member accounts' IAM roles, and grant the corresponding decryption permissions in the local IAM policies.

Configure the State Manager association to execute periodically on a schedule to re-apply the configuration document. Attach a Service Control Policy (SCP) at the root of the AWS Organization that explicitly grants kms:Decrypt permissions for the KMS key to the EC2 instance profile roles in all member accounts.

Show answer & explanation

Answer: Configure the State Manager association to execute periodically on a schedule to re-apply the configuration document. Encrypt the credentials using a Customer Managed Key (CMK) in the central security account, updating the key policy to delegate decrypt permissions to the member accounts' IAM roles, and grant the corresponding decryption permissions in the local IAM policies.

Answer

The correct solution utilizes Systems Manager State Manager to periodically apply configuration documents. State Manager naturally remediates drift by running on a schedule to restore the desired state on instances. For KMS decryption across accounts, a Customer Managed Key (CMK) is required as its key policy can be modified to trust external member accounts, and the local IAM policies in the member accounts must grant the corresponding decrypt action to complete permissions.

Step-by-Step Solution

Select the correct mechanism for configuration drift remediation.

Choose Systems Manager State Manager with scheduled execution to periodically re-apply configuration documents.

State Manager automatically overwrites manual configuration changes on managed instances whenever its scheduled run occurs, thereby correcting drift.

Determine the KMS key type required for cross-account access.

Select a Customer Managed Key (CMK) instead of an AWS-managed key.

AWS-managed keys (like aws/ssm) cannot be used cross-account because their key policies cannot be modified. A CMK is required to allow key policy customization.

Configure the required permissions for cross-account KMS decryption.

Update the CMK key policy in the central security account to trust the member accounts, and attach an IAM policy to the local EC2 roles allowing decryption.

Cross-account access to KMS requires permission from both the resource owner (key policy) and the principal owner (IAM policy).

Key Concept

Configuration drift remediation using Systems Manager State Manager paired with cross-account access using KMS Customer Managed Keys.

Question 1500Question →

A software-as-a-service (SaaS) marketing automation platform utilizes an Amazon RDS for PostgreSQL DB instance to support its customer outreach workflows. During large-scale email campaigns, the database experiences high CPU utilization and input/output operations per second (IOPS) bottlenecks, causing delayed delivery actions. A performance analysis reveals that the database bottlenecks are caused by two workloads:

1. Highly frequent read queries to retrieve static email templates that must be highly available and replicated across multiple Availability Zones.
2. High-volume write transactions containing short-lived session tracking tokens that expire after 2 hours and do not require data persistence or replication.

Which of the following actions should the Solutions Architect take to improve database performance and caching efficiency? (Select TWO).

Select all that apply

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ replication to cache the static email templates.

Deploy an Amazon ElastiCache for Memcached cluster to store the transient session tracking tokens.

Deploy an Amazon ElastiCache for Memcached cluster to cache the static email templates, utilizing its multi-AZ replication capabilities.

Provision an Amazon RDS PostgreSQL Read Replica and configure the application to write the transient session tracking tokens directly to it.

Implement Amazon DynamoDB Accelerator (DAX) to cache database queries for both the email templates and session tracking tokens.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ replication to cache the static email templates.; Deploy an Amazon ElastiCache for Memcached cluster to store the transient session tracking tokens.

Answer

The correct answers are to deploy an Amazon ElastiCache for Redis cluster with Multi-AZ replication to cache the static email templates, and to deploy an Amazon ElastiCache for Memcached cluster to store the transient session tracking tokens.

The correct architecture uses Amazon ElastiCache for Redis to cache static templates because it supports Multi-AZ replication, ensuring high availability. It uses Amazon ElastiCache for Memcached for the transient, short-lived session tracking tokens because Memcached is a lightweight, high-performance, and cost-effective key-value store that does not require replication or durability.

Step-by-Step Solution

Analyze the requirements for the static email templates workload.

The templates are read-heavy, require high availability, and must be replicated across Availability Zones.

This determines that the caching engine must support replication and multi-AZ deployments.

Select the correct cache engine for the static templates.

Amazon ElastiCache for Redis is selected because it natively supports Multi-AZ replication and persistence.

ElastiCache for Memcached does not support replication, making it unsuitable for this specific workload.

Analyze the requirements for the session tracking tokens workload.

The tokens are write-heavy, highly transient (expire in 2 hours), and do not require replication or durability.

This indicates that a simple, high-performance, and cost-effective caching solution without replication overhead is needed.

Select the correct cache engine for the session tracking tokens.

Amazon ElastiCache for Memcached is selected because it handles transient data with sub-millisecond latency and has lower cost and management complexity.

Using ElastiCache for Redis for this workload would introduce unnecessary replication overhead and cost since replication is not required.

Eliminate database configuration alternatives that violate technical limitations.

RDS Read Replicas are rejected for write workloads, and DynamoDB Accelerator (DAX) is rejected because it does not support RDS PostgreSQL.

Read replicas cannot accept write traffic, and DAX is incompatible with relational databases.

Key Concept

Selecting the appropriate ElastiCache engine (Redis vs Memcached) and offloading strategies based on data persistence, replication, and database engine compatibility.

PreviousPage 75 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution