All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

An enterprise manages its multi-account environment using AWS Organizations. The central platform team uses AWS CloudFormation StackSets to deploy standardized security groups and Amazon EC2 instances from a central administrative account into multiple member accounts. The deployment artifacts and templates are stored in an Amazon S3 bucket within the administrative account.

A security audit identifies two main issues:
1. Authorized users in member accounts are manually modifying the security group rules and disabling mandatory OS-level security agents on the EC2 instances, creating configuration drift.
2. Attempts to update the StackSet to deploy new versions fail in several member accounts because the member accounts' CloudFormation execution roles are denied access to the S3 bucket and cannot decrypt the deployment artifacts.

The solutions architect must implement an automated configuration management strategy that remediates drift on security groups and EC2 instances, and ensures that cross-account StackSet updates succeed.

Which combination of actions should the solutions architect take to meet these requirements?

Configure AWS Config in the member accounts with a managed rule to monitor the security groups, and associate an AWS Systems Manager (SSM) Automation document to automatically revert unauthorized modifications. Set up an SSM State Manager association targeting the EC2 instances to continuously enforce the OS-level security agent configuration. Update the S3 bucket policy in the administrative account to allow read access from the member accounts, and encrypt the bucket using a KMS Customer Managed Key (CMK) with a key policy that grants the member accounts' roles permission to use the key.

Enable AWS CloudFormation drift detection on the StackSets, and configure an Amazon EventBridge rule that triggers an AWS Lambda function to redeploy the drifted stacks in the target accounts. Enable default S3 encryption on the administrative account's S3 bucket using the AWS managed key (aws/s3), and attach a Service Control Policy (SCP) at the Organization root that allows the member account roles to perform KMS decryption operations on the AWS managed key.

Configure an AWS Systems Manager State Manager association to run an Ansible playbook every hour that directly overwrites both the security group rules and the OS-level EC2 configurations. To resolve the cross-account deployment failures, use AWS Resource Access Manager (RAM) to share the administrative S3 bucket with the organization, and configure CloudFormation to use the default AWS managed S3 key for object decryption during stack execution.

Attach a Service Control Policy (SCP) to the member accounts' Organizational Unit (OU) that explicitly denies member account IAM roles the ability to modify security groups or EC2 settings, assuming this provides the necessary permissions to secure the configurations. To resolve the deployment issues, create a cross-account IAM role in the administrative account that the member accounts' CloudFormation service roles can assume to download and decrypt the templates.

Show answer & explanation

Answer: Configure AWS Config in the member accounts with a managed rule to monitor the security groups, and associate an AWS Systems Manager (SSM) Automation document to automatically revert unauthorized modifications. Set up an SSM State Manager association targeting the EC2 instances to continuously enforce the OS-level security agent configuration. Update the S3 bucket policy in the administrative account to allow read access from the member accounts, and encrypt the bucket using a KMS Customer Managed Key (CMK) with a key policy that grants the member accounts' roles permission to use the key.

Answer

The correct configuration uses AWS Config and Systems Manager State Manager to remediate drift on resources and instances, combined with a KMS Customer Managed Key (CMK) and S3 bucket policy updates to enable cross-account CloudFormation StackSet deployments.

The correct option correctly identifies the need for AWS Config to detect and automatically remediate security group modifications, and AWS Systems Manager State Manager to enforce OS-level agent compliance on EC2 instances. It also correctly specifies using a Customer Managed Key (CMK) in AWS KMS to allow cross-account decryption, as AWS managed KMS keys cannot be shared across accounts.

Step-by-Step Solution

Define configuration management for OS-level and resource-level requirements.

AWS Config and Systems Manager State Manager are selected as the appropriate tools.

Systems Manager State Manager enforces OS-level configuration (e.g., security agents) continuously, while AWS Config with automated SSM Automation remediation reverts resource-level changes (e.g., security group rules) to prevent out-of-band updates.

Address cross-account access and decryption for the S3 deployment artifacts.

A Customer Managed Key (CMK) is chosen over the AWS managed key.

AWS managed keys (aws/s3) cannot have their key policies modified to allow cross-account access. A Customer Managed Key (CMK) is required to grant decryption rights to target member accounts.

Verify the configuration and policy scope.

The S3 bucket policy and KMS key policy are updated to allow access to member account roles.

CloudFormation StackSets requires the execution role in the target accounts to have read access to the S3 bucket and decrypt permissions on the KMS key encrypting the template.

Key Concept

Continuous configuration enforcement and cross-account CI/CD permissions

Estimated Time:3m 0s

Question 1502Question →

A solutions architect is designing a migration strategy to move an on-premises self-managed MySQL 8.0 database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The database contains critical transactional tables with high write throughput. The migration must minimize downtime and ensure that schema incompatibilities, such as custom stored functions, are handled correctly before replication begins. Which two actions must the solutions architect take to prepare the database and execute the migration? (Select two.)

Select all that apply

Enable MySQL binary logging on the source database, set the binary log format to ROW, and ensure the logs are retained for a duration sufficient to support the replication task.

Run the AWS Schema Conversion Tool (SCT) to convert the MySQL schema to PostgreSQL, generate an assessment report, and manually rewrite the unsupported custom functions into PostgreSQL PL/pgSQL functions before applying the schema to the target.

Keep the MySQL database in its default logging configuration and configure the AWS DMS task to read directly from the InnoDB transaction redo log files to capture modifications.

Perform a Replatform migration by taking a physical backup of the MySQL database using Percona XtraBackup, restoring it to an EC2 instance running MySQL, and using that instance to automatically sync schemas and write workloads directly to the target Aurora PostgreSQL cluster.

Deploy an Amazon ElastiCache for Memcached replication group as a target cache endpoint in AWS DMS to buffer the converted write queries before applying them to the Aurora PostgreSQL DB cluster to mitigate replication lag.

Show answer & explanation

Answer: Enable MySQL binary logging on the source database, set the binary log format to ROW, and ensure the logs are retained for a duration sufficient to support the replication task.; Run the AWS Schema Conversion Tool (SCT) to convert the MySQL schema to PostgreSQL, generate an assessment report, and manually rewrite the unsupported custom functions into PostgreSQL PL/pgSQL functions before applying the schema to the target.

Answer

Enable MySQL binary logging on the source database in ROW format and use AWS Schema Conversion Tool (SCT) to convert the schema, manually refactoring the unconverted functions.

To migrate heterogeneously from MySQL to Aurora PostgreSQL with minimal downtime, the database schema must be converted using the AWS Schema Conversion Tool (SCT). Any custom database functions that cannot be automatically converted must be manually refactored into the target database's language (PL/pgSQL). To replicate changes continuously (CDC) using AWS Database Migration Service (DMS), MySQL binary logging must be enabled and configured to ROW format, which records the actual row changes so DMS can capture and apply them to the target.

Step-by-Step Solution

Analyze source schema compatibility

Identify that custom stored functions cannot be automatically converted by AWS SCT and need manual refactoring.

Ensures that schema elements are rewritten into target-compatible PL/pgSQL code.

Configure source database logging

Enable binary logging with the format set to ROW on the source MySQL instance.

Allows AWS DMS to capture and replicate ongoing transactions (CDC) from the source database.

Convert and apply schema

Use AWS SCT to convert the schema, manually update the custom functions, and apply the schema to the Amazon Aurora PostgreSQL database.

Prepares the target database structure before data replication starts.

Run DMS task

Initiate an AWS DMS full-load and continuous replication task to migrate data.

Performs initial copy and keeps target database in sync with minimal downtime.

Key Concept

Heterogeneous database migration using AWS Schema Conversion Tool (SCT) for schema conversion and AWS Database Migration Service (DMS) with Change Data Capture (CDC) requiring row-based binary logging.

Question 1503Question →

A logistics company hosts a fleet telemetry tracking application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances reside in private subnets across two Availability Zones, Zone A and Zone B. The instances must download routing updates daily from an external server over the internet. Currently, a single NAT Gateway is deployed in Zone A to provide outbound internet access.

The company has identified two primary failure patterns:
1. Outbound internet connectivity fails for all instances in both zones if Zone A experiences an outage.
2. At the start of daily delivery shifts at 8:00 AM, a sudden, massive surge in telemetry connections causes the ALB to drop requests and return HTTP 503 (Service Unavailable) errors, even though dynamic CPU-based auto-scaling is configured.

Which combination of actions will resolve these issues? (Select TWO.)

Select all that apply

Deploy a NAT Gateway in a public subnet in each Availability Zone, and update the route table of each private subnet to route outbound traffic through the local NAT Gateway in its respective zone.

Create a Scheduled Scaling policy to scale out the Auto Scaling group before 8:00 AM, and request AWS Support to pre-warm the Application Load Balancer to handle the anticipated connection surge.

Reduce the Auto Scaling group cooldown period to 30 seconds to allow the tracking instances to launch and bootstrap more rapidly during the traffic surge.

Deploy a single NAT Gateway in a public subnet in Zone B, and configure the route tables of both private subnets to use this new NAT Gateway as a secondary failover route for internet traffic.

Configure dynamic scaling policies with a CPU utilization target threshold of 90% to trigger rapid auto-scaling of both the Application Load Balancer and the Auto Scaling group when the traffic surge occurs.

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet in each Availability Zone, and update the route table of each private subnet to route outbound traffic through the local NAT Gateway in its respective zone.; Create a Scheduled Scaling policy to scale out the Auto Scaling group before 8:00 AM, and request AWS Support to pre-warm the Application Load Balancer to handle the anticipated connection surge.

Answer

Deploy a NAT Gateway in each Availability Zone, update private subnet route tables to use local NAT Gateways, implement scheduled scaling before 8:00 AM, and request ALB pre-warming from AWS Support.

Deploying a NAT Gateway in each Availability Zone ensures high availability and eliminates the single point of failure, as outbound traffic stays local to the zone. For sudden, predictable spikes in traffic (like the start of shifts at 8:00 AM), relying on dynamic scaling is insufficient because Application Load Balancers (ALBs) and Auto Scaling groups take time to scale out. Pre-warming the ALB ensures it has the capacity immediately, and scheduled scaling proactively launches instances before the spike occurs.

Step-by-Step Solution

Analyze the outbound internet connectivity path to eliminate the single point of failure.

Discovered that a single NAT Gateway in Zone A creates a dependency for Zone B. A failure in Zone A disrupts all internet access.

To build a fault-tolerant architecture, outbound NAT resources must be deployed in each Availability Zone so that failures are isolated within the zone.

Address the Application Load Balancer capacity issues during sudden spikes.

Determined that the sudden traffic surge at 8:00 AM requires ALB pre-warming since standard scaling cannot react quickly enough to flash traffic.

ALB requires pre-warming by AWS Support to handle rapid, massive increases in connection rates.

Address the EC2 instance capacity scaling delays.

Identified that scheduled scaling is required to scale the ASG before the predictable 8:00 AM shift starts.

Scheduled scaling ensures capacity is online and bootstrapped before the traffic arrives, preventing initial connection drops.

Key Concept

Fault-tolerant network architecture and scaling strategies for predictable flash traffic.

Estimated Time:3m 0s

Question 1504Question →

An organization runs a daily batch analytics workload on a fleet of Amazon EC2 instances in private subnets across three Availability Zones in the `eu-west-1` Region. The workload downloads a static $40\text{ TB}$ reference dataset every day from a central Amazon S3 bucket in the `us-east-1` Region. The dataset is updated only once per month. The instances also write $15\text{ TB}$ of logs daily to an S3 bucket in the `eu-west-1` Region. Currently, all outbound traffic to S3 is routed through NAT Gateways in the VPC. The monthly bill shows high NAT Gateway data processing and cross-Region data transfer charges.

Which TWO actions should a Solutions Architect recommend to optimize these costs?

Select all that apply

Configure an S3 Gateway Endpoint in the VPC and associate it with the route tables of the private subnets.

Configure Amazon S3 Cross-Region Replication (CRR) to replicate the dataset from the us-east-1 bucket to a new S3 bucket in the eu-west-1 Region, and update the workload to read from the local bucket.

Deploy S3 Interface Endpoints (AWS PrivateLink) in each Availability Zone within the VPC, and update the route tables to route S3 traffic through these endpoints.

Establish an AWS Direct Connect connection with a public virtual interface (VIF) to route S3 traffic directly from the VPC to Amazon S3 over a private network path.

Set up a VPC Peering connection between the VPC in eu-west-1 and a new VPC in us-east-1 containing an S3 Gateway Endpoint, and route S3 traffic through the peering connection.

Show answer & explanation

Answer: Configure an S3 Gateway Endpoint in the VPC and associate it with the route tables of the private subnets.; Configure Amazon S3 Cross-Region Replication (CRR) to replicate the dataset from the us-east-1 bucket to a new S3 bucket in the eu-west-1 Region, and update the workload to read from the local bucket.

Answer

Configure an S3 Gateway Endpoint in the VPC and associate it with the route tables of the private subnets, and configure Amazon S3 Cross-Region Replication (CRR) to replicate the dataset from the `us-east-1` bucket to a new S3 bucket in the `eu-west-1` Region, updating the workload to read from the local bucket.

To eliminate the NAT Gateway data processing charges for writing logs to the local S3 bucket, creating an S3 Gateway Endpoint in the VPC and associating it with the private route tables is the most cost-effective approach since S3 Gateway Endpoints are free. To eliminate the daily cross-Region data transfer costs of downloading a static

40\text{ TB}

dataset from the `us-east-1` region, replicating it once to the local `eu-west-1` region using Amazon S3 Cross-Region Replication (CRR) allows the EC2 instances to perform local reads via the Gateway Endpoint, avoiding recurring cross-Region charges.

Step-by-Step Solution

Analyze the current data transfer pathways and costs.

Identify that downloading

40\text{ TB}

daily from `us-east-1` to `eu-west-1` incurs substantial cross-Region data transfer fees (

0.02\text{ USD}

per GB), and uploading

15\text{ TB}

daily through NAT Gateways incurs high NAT Gateway data processing charges (

0.045\text{ USD}

per GB).

This establishes the baseline of where the high costs are originating.

Optimize regional data transfer and processing costs for local uploads.

Associate an Amazon S3 Gateway Endpoint with the private route tables in `eu-west-1`.

Gateway Endpoints provide free, direct access to S3 within the same region, bypassing the NAT Gateways and completely eliminating the

0.045\text{ USD}

per GB data processing fee.

Optimize cross-Region data transfer for the reference dataset.

Configure S3 Cross-Region Replication (CRR) to replicate the static

40\text{ TB}

dataset once per month (when updated) to an S3 bucket in `eu-west-1`.

This limits the cross-Region data transfer charge to a one-time monthly replication sync of

40\text{ TB}

instead of a daily download of

40\text{ TB}

(

1,200\text{ TB}

monthly), resulting in massive cost savings.

Key Concept

Managing Storage and Data Transfer Costs using S3 Gateway Endpoints and Cross-Region Replication

Question 1505Question →

A medical technology company is designing a new patient monitoring system that registers real-time telemetry from wearable devices (OLTP workload). The system must scale to ingest up to $100,000$ writes per second. The telemetry data must be buffered and cached for real-time visualization with less than $10\text{ ms}$ read latency. The cache requires high availability, automated failover, and data persistence to survive node failures. The historical telemetry data must be persisted in a database, and the architecture must ensure horizontal scaling of read operations during peak diagnostic hours. Finally, the company requires a disaster recovery strategy to a secondary AWS Region with a Recovery Time Objective (RTO) of less than $5\text{ minutes}$ and a Recovery Point Objective (RPO) of less than $1\text{ minute}$ . Which of the following database and storage strategies meets these requirements with the lowest operational complexity?

Deploy Amazon ElastiCache for Redis with Multi-AZ and auto-failover enabled to serve the caching layer, configuring database persistence. Deploy a single-region Amazon Aurora PostgreSQL cluster as the persistent database engine. Configure AWS Backup to copy daily snapshots to the disaster recovery region, and implement an automated CloudFormation template to restore the database to a new Aurora cluster in the secondary region during a failover event.

Deploy Amazon ElastiCache for Memcached to serve the caching layer. Deploy Amazon Aurora Global Database as the persistent database engine. Use Aurora Replicas in the primary AWS Region with Application Auto Scaling to handle dynamic read scaling, and provision a secondary Aurora cluster in the disaster recovery region.

Deploy Amazon ElastiCache for Redis with Multi-AZ and auto-failover enabled to serve the caching layer, configuring database persistence. Deploy Amazon Aurora Global Database as the persistent database engine. Use Aurora Replicas in the primary AWS Region with Application Auto Scaling to handle dynamic read scaling, and provision a secondary Aurora cluster in the disaster recovery region.

Deploy Amazon ElastiCache for Redis with Multi-AZ and auto-failover enabled to serve the caching layer, configuring database persistence. Deploy Amazon RDS for PostgreSQL in a Multi-AZ deployment as the primary database. Configure the application to route read queries directly to the Multi-AZ standby instance during peak hours to achieve horizontal read scaling, and deploy a cross-region read replica in the disaster recovery region.

Show answer & explanation

Answer: Deploy Amazon ElastiCache for Redis with Multi-AZ and auto-failover enabled to serve the caching layer, configuring database persistence. Deploy Amazon Aurora Global Database as the persistent database engine. Use Aurora Replicas in the primary AWS Region with Application Auto Scaling to handle dynamic read scaling, and provision a secondary Aurora cluster in the disaster recovery region.

Answer

Deploy Amazon ElastiCache for Redis with Multi-AZ and auto-failover enabled for caching, and utilize Amazon Aurora Global Database for persistence with auto-scaled Aurora Replicas and a secondary cluster in the disaster recovery region.

The correct strategy combines Amazon ElastiCache for Redis and Amazon Aurora Global Database. ElastiCache for Redis supports the required sub-millisecond latencies, Multi-AZ automated failover, and data persistence to survive node losses. Amazon Aurora Global Database facilitates sub-second cross-region replication to satisfy the sub-minute RPO, while supporting rapid promotion to meet the sub-5-minute RTO. Aurora Replicas in the primary region scale horizontally and automatically using Application Auto Scaling to accommodate variable read loads.

Step-by-Step Solution

Analyze the caching requirements (latency, high availability, failover, and persistence).

Identify that Amazon ElastiCache for Redis is required because it supports multi-AZ configurations with auto-failover and data persistence mechanisms (such as AOF or RDB snapshots), whereas Memcached does not support persistence or replication.

This filters out strategies utilizing Memcached.

Evaluate the database options for read scalability.

Determine that Amazon Aurora Replicas with Application Auto Scaling can horizontally scale read workloads dynamically. In contrast, Amazon RDS Multi-AZ standby instances are passive and cannot be targeted for read queries.

This eliminates solutions attempting to route read traffic directly to an RDS Multi-AZ standby instance.

Verify the disaster recovery parameters (RTO < 5 minutes, RPO < 1 minute).

Amazon Aurora Global Database uses dedicated, low-latency replication that yields a typical RPO of less than 1 second and allows promotion of the secondary cluster in less than 5 minutes. Daily backup copying strategies cannot achieve sub-minute RPO.

This confirms that Aurora Global Database is the only design that fulfills the RPO and RTO bounds with low operational overhead.

Key Concept

Selecting high-performance cache and database layers that support multi-AZ persistence, horizontal read scaling, and low RTO/RPO cross-region replication.

Estimated Time:3m 0s

Question 1506Question →

An insurance firm is modernizing its legacy claims validation backend application by migrating it from on-premises virtual machines to AWS. The proposed architecture requires deploying the application as containerized tasks using the AWS Fargate launch type on Amazon ECS. The tasks must run in a private subnet of an application VPC with no direct outbound path to the internet. The container images must be securely pulled from a centralized Amazon Elastic Container Registry (ECR) repository located in a shared services VPC within the same AWS Organization. A Route 53 Private Hosted Zone for ECR has been created and is hosted in the shared services VPC. Which TWO configurations must a Solutions Architect implement to allow the ECS tasks to pull images from ECR without traversing the public internet? (Select TWO.)

Select all that apply

Associate the Route 53 Private Hosted Zone from the shared services VPC with the application VPC.

Create Interface VPC Endpoints for Amazon ECR and a Gateway VPC Endpoint for Amazon S3 in the application VPC.

Configure the ECS task definition to use host network mode to route traffic directly to the shared services VPC.

Set up an AWS Transit Gateway to route DNS queries transitively to the Route 53 Private Hosted Zone without VPC association.

Deploy a single NAT Gateway in the application VPC to route image pull traffic to the public ECR service endpoints.

Show answer & explanation

Answer: Associate the Route 53 Private Hosted Zone from the shared services VPC with the application VPC.; Create Interface VPC Endpoints for Amazon ECR and a Gateway VPC Endpoint for Amazon S3 in the application VPC.

Answer

Associate the Route 53 Private Hosted Zone from the shared services VPC with the application VPC, and create Interface VPC Endpoints for Amazon ECR and a Gateway VPC Endpoint for Amazon S3 in the application VPC.

To pull container images from Amazon ECR without internet access, ECS Fargate tasks—which require the awsvpc network mode—must resolve ECR endpoints privately. This is achieved by creating Interface VPC Endpoints for ECR (ecr.api and ecr.dkr) in the application VPC, and a Gateway VPC Endpoint for Amazon S3 because ECR stores image layers in S3. Additionally, the Route 53 Private Hosted Zone managing the private DNS records for ECR in the shared services VPC must be associated with the application VPC so that tasks can resolve the ECR DNS names to the private IP addresses of the interface endpoints.

Step-by-Step Solution

Enable DNS resolution across the accounts by associating the Route 53 Private Hosted Zone with the application VPC.

The application VPC is authorized to resolve ECR endpoint names to private IP addresses.

By default, a Private Hosted Zone is only resolvable within the VPCs with which it is associated.

Provision VPC Endpoints for Amazon ECR (ecr.api and ecr.dkr) in the application VPC.

Network endpoints are established inside the application VPC's subnets.

This allows Fargate tasks to communicate with ECR API and download image manifests privately.

Provision a Gateway VPC Endpoint for Amazon S3 in the application VPC.

Secure, private routing to S3 is enabled for the application VPC subnets.

Amazon ECR hosts the container image layers in Amazon S3 buckets, meaning tasks must also have private access to S3 to successfully download the image layers.

Key Concept

Private container image retrieval in AWS ECS Fargate requires Interface VPC Endpoints for ECR API and registry endpoints, a Gateway VPC Endpoint for S3 where layers reside, and cross-VPC association of Route 53 Private Hosted Zones.

Question 1507Question →

A digital payment startup, PayFast, is modernizing its on-premises transactional auditing workload by migrating it to AWS. The workload runs on Docker containers and processes high-security compliance data. To minimize operational overhead, the company decides to host the containers using Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The security compliance policy requires that each deployed task must have its own dedicated elastic network interface (ENI) and a specific security group to restrict inbound and outbound traffic. Which network configuration should the solutions architect specify in the task definition to meet these requirements?

Set the network mode to awsvpc in the task definition to allocate a dedicated network interface and security group to each task.

Set the network mode to bridge in the task definition to utilize docker0 default virtual network interfaces.

Set the network mode to host in the task definition to share the underlying container instance port space directly.

Set the network mode to none in the task definition to disable external container networking entirely.

Show answer & explanation

Answer: Set the network mode to awsvpc in the task definition to allocate a dedicated network interface and security group to each task.

Answer

Set the network mode to awsvpc in the task definition to allocate a dedicated network interface and security group to each task.

AWS Fargate only supports the awsvpc network mode. In this mode, Amazon ECS assigns a dedicated Elastic Network Interface (ENI) and a private IPv4 address to each task, allowing the application to use task-level security groups to control network traffic.

Step-by-Step Solution

Analyze the launch type and compliance requirements.

The workload must run on AWS Fargate, and each task requires its own dedicated security group.

AWS Fargate does not support traditional host-level network configurations and enforces specific container networking modes.

Evaluate the supported network modes for AWS Fargate.

AWS Fargate only supports the awsvpc network mode.

Other modes like host, bridge, or none are only supported on ECS EC2 launch types.

Verify if the selected network mode meets the security requirements.

The awsvpc network mode assigns a dedicated ENI and security group to each task, satisfying the security compliance policy.

This allows fine-grained security control at the individual task level instead of the host level.

Key Concept

Amazon ECS task network modes for AWS Fargate

Question 1508Question →

A digital publishing company, AuraMedia, is modernizing its legacy editorial content management system (CMS) by migrating it from an on-premises virtualized environment to AWS. The new architecture will run as containerized microservices on Amazon ECS. The application consists of a public-facing reader service in a Front-End VPC and a sensitive, restricted content ingestion service in a Back-End VPC under a separate AWS account. The content ingestion service must process raw files, store metadata in Amazon DynamoDB, and encrypt assets using AWS KMS. All data transfer between the VPCs and to AWS services must remain entirely within the AWS private network to meet strict data privacy compliance standards. The reader service needs to resolve the private DNS names of the ingestion service tasks. To minimize server maintenance, the solutions architect must use AWS Fargate. The system must achieve a Recovery Time Objective (RTO) of 15 minutes. Which design satisfies these security and connectivity requirements with the least operational overhead?

Configure the Amazon ECS tasks for both services to use the awsvpc network mode. Deploy the ingestion service in the Back-End VPC with interface VPC endpoints for AWS KMS, Amazon ECR, and Amazon ECS, and a gateway VPC endpoint for Amazon DynamoDB. Configure AWS Cloud Map for service discovery, which creates a Route 53 private hosted zone. Associate this private hosted zone with the Front-End VPC across accounts. Establish VPC peering between the Front-End and Back-End VPCs, and update route tables to allow direct container-to-container traffic.

Configure the Amazon ECS tasks for the ingestion service using the bridge network mode to optimize container-to-container communication within Fargate. Deploy the tasks in private subnets, configure AWS Cloud Map for service discovery, and set up an AWS Transit Gateway to route traffic between the Front-End VPC and the Back-End VPC. Create interface VPC endpoints for AWS KMS and Amazon DynamoDB.

Configure the Amazon ECS tasks to use the awsvpc network mode. Deploy the ingestion service in the Back-End VPC with a gateway VPC endpoint for Amazon DynamoDB and interface VPC endpoints for AWS KMS. Configure AWS Cloud Map to register tasks under a private hosted zone in the Back-End VPC's account. Set up VPC peering between the VPCs, but do not associate the hosted zone with the Front-End VPC, relying on the VPC peering connection to automatically propagate DNS queries between the accounts.

Configure the Amazon ECS tasks to use the awsvpc network mode. Deploy the ingestion service in the Back-End VPC and configure the tasks to use the default AWS-managed KMS key (aws/kms) for cross-account encryption. Instead of VPC endpoints, deploy a single NAT Gateway in a public subnet of the Back-End VPC to route outbound traffic to AWS KMS and Amazon DynamoDB, and use AWS Cloud Map for service discovery without cross-account private hosted zone associations.

Show answer & explanation

Answer: Configure the Amazon ECS tasks for both services to use the awsvpc network mode. Deploy the ingestion service in the Back-End VPC with interface VPC endpoints for AWS KMS, Amazon ECR, and Amazon ECS, and a gateway VPC endpoint for Amazon DynamoDB. Configure AWS Cloud Map for service discovery, which creates a Route 53 private hosted zone. Associate this private hosted zone with the Front-End VPC across accounts. Establish VPC peering between the Front-End and Back-End VPCs, and update route tables to allow direct container-to-container traffic.

Answer

Configure the Amazon ECS tasks for both services to use the awsvpc network mode, configure the private endpoints for DynamoDB, KMS, ECR, and ECS, and associate the AWS Cloud Map Route 53 private hosted zone with the Front-End VPC across accounts while establishing VPC peering.

The correct architecture uses the awsvpc network mode for ECS tasks, which is mandatory for Fargate. It establishes private connection endpoints (Gateway VPC endpoint for DynamoDB, Interface VPC endpoints for KMS, ECR, and ECS) to prevent any traffic from traversing the public internet, satisfying the compliance requirement. For service discovery, it leverages AWS Cloud Map, and manually associates the resulting Route 53 Private Hosted Zone with the reader service's Front-End VPC across accounts. Finally, VPC peering provides the private network path for inter-service communication.

Step-by-Step Solution

Select the correct network mode for Fargate tasks.

Confirm the use of awsvpc network mode for the ECS task definitions.

AWS Fargate only supports the awsvpc network mode, which assigns a unique elastic network interface (ENI) to each task.

Design private endpoint access to AWS services.

Provision a gateway endpoint for Amazon DynamoDB, and interface VPC endpoints for AWS KMS, Amazon ECR (api and dkr), and Amazon ECS (agent, telemetry, and ecs).

Ensures that calls from Fargate tasks to pull container images, access state, write to DynamoDB, and encrypt assets remain strictly within the AWS private network without internet traversal.

Configure DNS resolution and network peering.

Establish VPC peering between the Front-End and Back-End VPCs, update route tables, and associate the AWS Cloud Map Route 53 Private Hosted Zone with the Front-End VPC.

Allows the reader service in the Front-End VPC to resolve the private DNS names of the ingestion service tasks and route traffic directly to their ENIs.

Key Concept

Cross-account Amazon ECS Fargate networking and Route 53 Private Hosted Zone associations using AWS Cloud Map

Question 1509Question →

An enterprise is migrating a self-managed, on-premises IBM DB2 LUW ( $version\ 11.5$ ) database to an Amazon Aurora PostgreSQL-Compatible Edition cluster. The source database contains high-volume transactional tables, some of which include Character Large Object (CLOB) columns storing data up to $10\text{ MB}$ in size. The migration strategy requires schema conversion using the AWS Schema Conversion Tool (SCT) and data replication with minimal downtime using AWS Database Migration Service (DMS) with continuous replication (CDC).

During a migration test run, the solutions architect observes the following issues:
1. The AWS DMS replication task successfully completes the Full Load phase but fails to replicate any subsequent transactions during the CDC phase, causing the replication task to stall.
2. Analysis of the target Aurora PostgreSQL database shows that several text fields originating from the CLOB columns are truncated.
3. The overall replication throughput is significantly lower than the target baseline.

Which combination of actions will resolve these issues while maintaining optimal replication performance?

Configure the source IBM DB2 database to use circular logging, and append the db2UseCircularLog=true connection attribute to the AWS DMS source endpoint. Create a single AWS DMS replication task for all tables, and configure it to use Full LOB mode with InlineLobMaxSize set to

10240\text{ KB}

to prevent CLOB truncation.

Enable supplemental logging on the source IBM DB2 database using the ALTER DATABASE ADD SUPPLEMENTAL LOG DATA command. Create a single AWS DMS replication task for all tables, configure it to use Limited LOB mode with LobMaxSize set to

10\text{ MB}

, and enable task validation to automatically rebuild and re-replicate any truncated LOBs.

Verify that archive logging is enabled on the source IBM DB2 database by setting LOGARCHMETH1 to a valid destination, and run ALTER TABLE <table_name> DATA CAPTURE CHANGES for each table selected for replication. Create two separate AWS DMS replication tasks: one task for tables without LOB columns with LOB support disabled to maximize throughput, and a second task for tables containing CLOB columns configured with Limited LOB mode and LobMaxSize set to

10240\text{ KB}

Verify that archive logging is enabled on the source IBM DB2 database by setting LOGARCHMETH1 to a valid destination, and run ALTER TABLE <table_name> DATA CAPTURE CHANGES for all replicated tables. Create a single AWS DMS replication task for all tables, and configure it to use Full LOB mode to avoid truncation, as splitting tables into separate Full Load and CDC tasks is not supported for IBM DB2 sources.

Show answer & explanation

Answer: Verify that archive logging is enabled on the source IBM DB2 database by setting LOGARCHMETH1 to a valid destination, and run ALTER TABLE <table_name> DATA CAPTURE CHANGES for each table selected for replication. Create two separate AWS DMS replication tasks: one task for tables without LOB columns with LOB support disabled to maximize throughput, and a second task for tables containing CLOB columns configured with Limited LOB mode and LobMaxSize set to $10240\text{ KB}$ .

Answer

Verify that archive logging is enabled on the source IBM DB2 database by setting LOGARCHMETH1, run ALTER TABLE DATA CAPTURE CHANGES for the replicated tables, and split the migration into two AWS DMS tasks: one with LOB support disabled for non-LOB tables, and another using Limited LOB mode with LobMaxSize set to

10240\text{ KB}

for tables with CLOB columns.

The correct solution requires configuring the IBM DB2 LUW source database for Change Data Capture (CDC) by enabling archive logging via LOGARCHMETH1 and running ALTER TABLE DATA CAPTURE CHANGES on the replicated tables to ensure before/after images are written to the transaction logs. To address performance and CLOB truncation, separating the tables into two tasks is an AWS best practice. The task for tables without LOBs has LOB support disabled to optimize throughput, while the task for LOB-heavy tables uses Limited LOB mode with LobMaxSize set to

10240\text{ KB}

(

10\text{ MB}

) to prevent truncation.

Step-by-Step Solution

Configure database-level and table-level logging on the source IBM DB2 LUW database.

Database logging is configured to use archive logging instead of circular logging, and the DATA CAPTURE CHANGES setting is enabled on all tables targeted for migration.

AWS DMS CDC requires transaction logs to have write-ahead logging enabled with full row images (before and after images) to capture modifications, which circular logging or default logging does not provide.

Analyze LOB column requirements and segment tables based on LOB presence.

Group tables into two sets: tables with no LOB columns and tables with CLOB columns up to

10\text{ MB}

Separating LOB tables from non-LOB tables prevents LOB processing overhead (which requires additional round-trips or memory) from slowing down the replication of high-volume standard transactional data.

Configure AWS DMS replication task settings for each table group.

Disable LOB support for the non-LOB task to maximize throughput, and set the LOB task to Limited LOB mode with LobMaxSize set to

10240\text{ KB}

(

10\text{ MB}

Limited LOB mode pre-allocates memory buffer pools on the replication instance, making it much faster than Full LOB mode. Setting the size to

10240\text{ KB}

ensures that no CLOB values up to the maximum

10\text{ MB}

size are truncated.

Start both replication tasks with Full Load and CDC enabled.

Data is successfully migrated and replicated continuously without truncation or replication stalls.

The database changes are captured from the logs, and LOB data is replicated efficiently without exceeding memory buffers or causing truncation.

Key Concept

AWS DMS replication requires source-specific logging settings (like DATA CAPTURE CHANGES for IBM DB2) to enable CDC, and performance is optimized by splitting LOB and non-LOB tables into separate tasks with appropriate LOB size limitations.

Estimated Time:3m 0s

Question 1510Question →

A logistics company operates a package tracking web application backed by an Amazon RDS for PostgreSQL DB instance. Users frequently query the status of their packages, resulting in high read latency and DB CPU utilization during peak delivery hours. The tracking data is read-heavy and must be retrieved with sub-millisecond latency. Additionally, the caching solution must support multi-AZ replication for high availability and data persistence to prevent cache-stampede issues after a cold start. Which solution should the Solutions Architect implement to improve database efficiency and meet these requirements?

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ replication and persistence enabled.

Deploy an Amazon ElastiCache for Memcached cluster with multi-node replication to ensure high availability and data durability.

Configure the Amazon RDS for PostgreSQL DB instance with a Multi-AZ deployment and route package status read queries to the standby replica.

Deploy an Amazon ElastiCache for Memcached cluster and configure scheduled snapshots to an Amazon S3 bucket to persist the cached data.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ replication and persistence enabled.

Answer

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ replication and persistence enabled.

Deploying an Amazon ElastiCache for Redis cluster with Multi-AZ replication and persistence enabled meets all requirements. Redis supports advanced features such as replication, automatic failover, and data persistence to disk or backups, which prevents cache-stampede issues after a restart.

Step-by-Step Solution

Identify database load characteristics and performance requirements.

High database CPU utilization and read latency due to frequent package status queries requiring sub-millisecond retrieval.

This establishes the need for an in-memory caching layer rather than direct database scaling.

Evaluate caching engine capabilities against persistence and availability needs.

ElastiCache for Redis supports Multi-AZ replication and persistence, whereas ElastiCache for Memcached supports neither replication nor data persistence.

This rules out Memcached-based solutions.

Verify RDS PostgreSQL Multi-AZ capabilities.

RDS PostgreSQL Multi-AZ standby instances are strictly passive and cannot serve read traffic.

This rules out routing read traffic to the standby instance.

Key Concept

Selecting the correct in-memory caching engine based on replication and persistence requirements.

Question 1511Question →

A logistics company manages its IT environment using AWS Organizations with consolidated billing enabled. The environment consists of a production account and a development account. The production account runs a continuous telemetry application on Amazon ECS Fargate and a legacy database cluster on Amazon EC2 m6i instances. The development account runs dynamic, ephemeral testing environments on AWS Lambda and Amazon EC2. The company wants to optimize its compute spend across both accounts while maintaining high availability and minimizing administrative overhead. Which strategy should a solutions architect recommend to achieve these goals at the lowest cost?

Purchase Compute Savings Plans in the organization's management account.

Purchase EC2 Instance Savings Plans for the m6i instance family in the management account.

Purchase EC2 Instance Savings Plans in the production account and Compute Savings Plans in the development account, then share them across accounts using AWS Resource Access Manager (RAM).

Consolidate all outbound traffic from both accounts through a single NAT Gateway in the production account, and purchase Compute Savings Plans in the production account.

Show answer & explanation

Answer: Purchase Compute Savings Plans in the organization's management account.

Answer

Purchase Compute Savings Plans in the organization's management account.

Purchasing Compute Savings Plans in the organization's management account provides the highest flexibility and maximum overall savings. Compute Savings Plans automatically apply to EC2 instances (regardless of family, region, or operating system), ECS Fargate tasks, and AWS Lambda functions across all accounts under consolidated billing. This requires no administrative sharing setup and covers all the specified compute services.

Step-by-Step Solution

Analyze the compute workload types across the AWS Organization.

The workloads consist of Amazon EC2 instances, Amazon ECS Fargate tasks, and AWS Lambda functions.

Understanding the specific compute types determines the appropriate Savings Plan category required to cover all active resources.

Evaluate the eligibility of Savings Plan types for the workloads.

Compute Savings Plans cover EC2, Fargate, and Lambda. EC2 Instance Savings Plans only cover EC2.

This step ensures that the selected Savings Plan type maximizes discount coverage across the heterogeneous compute fleet.

Determine how Savings Plan benefits are shared across a multi-account organization.

Savings Plans purchased in any account (including the management account) automatically apply to eligible usage in any member account under consolidated billing.

This confirms that purchasing in the management account will distribute the discount across production and development accounts without manual intervention or RAM sharing.

Verify that all architecture and high availability constraints are met.

Avoiding NAT Gateway consolidation ensures that no single point of failure is introduced into the networking path.

Cost-saving measures must not compromise the high availability requirements of the production workloads.

Key Concept

Selecting and applying the appropriate Savings Plan type across a multi-account AWS Organization containing serverless and traditional compute resources.

Estimated Time:2m 0s

Question 1512Question →

A company plans to migrate its legacy on-premises Oracle 19c database to Amazon Aurora PostgreSQL-Compatible Edition. The database schema has been successfully converted using the AWS Schema Conversion Tool (AWS SCT). The migration team is establishing an AWS Database Migration Service (AWS DMS) replication task with Full Load and Change Data Capture (CDC) to minimize application downtime during the cutover. However, immediately after completing the full load phase, the DMS task fails and logs errors stating that the replication agent cannot read the transaction log sequence or access transaction records on the source database. Which of the following database-level configurations must be enabled on the source Oracle database to allow AWS DMS to successfully capture and replicate ongoing transactional changes?

Set the database replication mode by configuring the wal_level parameter to logical in the postgresql.conf file and restarting the database instance.

Enable binary logging on the source by setting the binlog_format parameter to ROW and the binlog_row_image parameter to FULL in the database initialization parameters.

Configure the source database to run in ARCHIVELOG mode, enable minimal supplemental logging at the database level, and enable supplemental logging on the tables selected for replication.

Run the system stored procedure sys.sp_cdc_enable_db to enable Change Data Capture at the database level and configure the database recovery model to FULL.

Show answer & explanation

Answer: Configure the source database to run in ARCHIVELOG mode, enable minimal supplemental logging at the database level, and enable supplemental logging on the tables selected for replication.

Answer

Configure the source database to run in ARCHIVELOG mode, enable minimal supplemental logging at the database level, and enable supplemental logging on the tables selected for replication.

To replicate ongoing changes (CDC) from an Oracle source database, AWS DMS relies on reading the database redo logs. The source Oracle database must be in ARCHIVELOG mode to prevent logs from being overwritten before DMS can process them. Additionally, minimal supplemental logging must be enabled at the database level, and table-level supplemental logging must be enabled for the replicated tables to ensure that the redo log records contain sufficient information (such as column values before and after changes) for DMS to build the corresponding DML statements on the target.

Step-by-Step Solution

Analyze the source database type and the point of failure.

The source is an Oracle 19c database, and the failure occurs immediately when starting the Change Data Capture (CDC) replication phase.

AWS DMS has different log requirements for different database engines to track incremental modifications.

Determine the CDC logging requirements for an Oracle source database.

Oracle requires the database to operate in ARCHIVELOG mode to preserve transaction logs, and needs supplemental logging enabled so that columns are written to the redo logs.

By default, Oracle redo logs do not write sufficient column details required by AWS DMS to reconstruct SQL changes.

Evaluate the distractors containing prerequisites for other database engines.

Identify that wal_level is a PostgreSQL parameter, binlog parameters belong to MySQL, and sys.sp_cdc_enable_db is a SQL Server procedure.

Differentiating these logging parameters avoids applying incorrect configuration steps to the Oracle database.

Key Concept

AWS DMS source database prerequisites for Oracle CDC migration

Question 1513Question →

An enterprise is designing a new multi-account architecture on AWS in the ap-southeast-2 region. The design includes a shared services account managing a central VPC (vpc-shared-services) and two spoke VPCs in separate accounts: vpc-sales-prod and vpc-hr-prod. A Route 53 Private Hosted Zone (PHZ) named corp.aws is hosted in the shared services account. Workloads in the spoke VPCs require private DNS resolution for corp.aws and must be able to download software patches from the internet. The network design must be highly available, minimize single points of failure, and use AWS Transit Gateway (tgw-sydney) to interconnect the VPCs. Which combination of steps should a Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

In the shared services AWS account, authorize the association of the Private Hosted Zone corp.aws with the spoke VPCs (vpc-sales-prod and vpc-hr-prod), and then accept the association from the sales and HR AWS accounts.

Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-shared-services, and configure the route tables of the private subnets to route outbound traffic through the NAT Gateway in the same Availability Zone.

Deploy a single NAT Gateway in one public subnet of vpc-shared-services to centralize internet egress and minimize operational cost, routing all traffic from all Availability Zones through it.

Configure a Direct Connect Gateway directly connected to the spoke VPCs (vpc-sales-prod and vpc-hr-prod) to enable transitive traffic routing between them.

Associate the Private Hosted Zone corp.aws with the spoke VPCs (vpc-sales-prod and vpc-hr-prod) directly from the Route 53 console in the sales and HR accounts, without performing any cross-account authorization steps.

Show answer & explanation

Answer: In the shared services AWS account, authorize the association of the Private Hosted Zone corp.aws with the spoke VPCs (vpc-sales-prod and vpc-hr-prod), and then accept the association from the sales and HR AWS accounts.; Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-shared-services, and configure the route tables of the private subnets to route outbound traffic through the NAT Gateway in the same Availability Zone.

Answer

To meet the requirements, the Solutions Architect must authorize and accept the cross-account association of the Private Hosted Zone corp.aws with the spoke VPCs, and deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-shared-services to ensure Availability Zone-level redundancy.

To meet the requirements, the Solutions Architect must authorize and accept the cross-account association of the Private Hosted Zone corp.aws with the spoke VPCs to allow private DNS resolution. Additionally, deploying a NAT Gateway in each Availability Zone of the shared services VPC ensures Availability Zone-level redundancy for outbound internet connectivity, eliminating any single points of failure.

Step-by-Step Solution

Authorize the association of the Private Hosted Zone corp.aws with the spoke VPCs in the shared services account, and accept the association from the spoke accounts.

The spoke VPCs vpc-sales-prod and vpc-hr-prod can privately resolve domain names within the corp.aws zone.

Cross-account association of Private Hosted Zones requires explicit authorization from the hosted zone owner before the VPC owner can associate it.

Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-shared-services.

Redundant internet egress paths are established.

Deploying NAT Gateways across multiple Availability Zones provides high availability and prevents a single AZ outage from interrupting egress traffic.

Configure the private subnets' route tables in vpc-shared-services to send internet-bound traffic (

0.0.0.0/0

) to the local NAT Gateway in the same Availability Zone.

AZ-independent egress routing.

This ensures that workloads routed through Transit Gateway to vpc-shared-services leverage the redundant NAT infrastructure properly.

Key Concept

Multi-account private DNS resolution and highly available centralized egress design using Transit Gateway.

Question 1514Question →

A logistics company is preparing to migrate its on-premises VMware vCenter environment to AWS. The security compliance policy strictly prohibits the installation of any local software agents or third-party monitoring utilities on production virtual machines. The solutions architect needs to perform an initial discovery of virtual machine configurations and resource utilization (CPU, memory, and disk) to generate sizing recommendations in AWS Migration Hub. Which of the following discovery configurations should the solutions architect implement to satisfy the compliance policy and collect the necessary data?

Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware environment to collect configuration and utilization metadata.

Install the AWS Application Migration Service (MGN) replication agent on each production virtual machine to continuously discover dependencies and track resource utilization.

Configure AWS Database Migration Service (DMS) with Change Data Capture (CDC) on the database servers to dynamically discover and map application dependencies.

Execute the AWS Schema Conversion Tool (SCT) to perform a replatforming assessment of the entire application virtual machine fleet and export the results to AWS Migration Hub.

Show answer & explanation

Answer: Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware environment to collect configuration and utilization metadata.

Answer

Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware environment to collect configuration and utilization metadata.

The correct answer is correct because the AWS Application Discovery Agentless Collector is deployed as a VMware OVA virtual appliance. It communicates directly with VMware vCenter to collect VM-level metadata, configuration, and performance history without installing any software inside the guest operating systems, satisfying the compliance requirement. The other options either require agent installation or are incorrect services for general server discovery.

Step-by-Step Solution

Analyze the migration discovery constraints.

On-premises environment uses VMware vCenter, and the security policy strictly prohibits agent installation on the production virtual machines.

This rules out any agent-based discovery mechanisms (such as the Application Discovery Agent or other replication agents).

Evaluate AWS Application Discovery Service options.

The Agentless Collector is designed for VMware vCenter and runs as an OVA appliance, gathering VM configuration and utilization metrics without local agents.

It meets both the virtualization platform capability and the compliance constraint.

Differentiate from replication and database assessment tools.

AWS DMS, MGN agents, and SCT are ruled out as they do not serve the target purpose of agentless server infrastructure discovery.

Choosing the Agentless Collector is the only compliant and appropriate configuration for initial discovery.

Key Concept

AWS Application Discovery Agentless Collector vs. Agent-based discovery under security constraints

Estimated Time:1m 0s

Question 1515Question →

An energy infrastructure company, GridOps Core, is modernizing its legacy SCADA telemetric aggregation application, which runs on-premises and communicates directly with power substations. To comply with national regulations and maintain sub-millisecond latency to local hardware controllers, the company must deploy the containerized workload onto Amazon EKS running on AWS Outposts. The EKS cluster control plane is hosted in the parent AWS Region. The containerized pods must be assigned IP addresses that are directly routable from the on-premises network to allow bidirectional communication with the substations. Furthermore, the pods must securely pull images from a private Amazon Elastic Container Registry (Amazon ECR) repository in the parent Region, and resolve hostnames in the on-premises domain `ops.grid.local` along with Route 53 Private Hosted Zones, without traversing the public internet.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create EKS node groups on Amazon EC2 instances on the AWS Outpost. Provision interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr in the Outpost subnets, and create a gateway VPC endpoint for Amazon S3 associated with the Outpost subnet route tables. Configure a Route 53 Resolver outbound endpoint in the VPC, and create a resolver rule to forward queries for ops.grid.local to the on-premises DNS servers.

Configure EKS worker nodes on EC2 instances in the Outpost subnets. Configure the Amazon VPC CNI plugin with custom networking to assign pod IPs from a dedicated VPC secondary CIDR block, and configure the Outpost Local Gateway (LGW) route table with Direct VPC Routing to advertise the pod CIDR block to the on-premises network.

Deploy EKS worker nodes using AWS Fargate profiles mapped to the Outpost subnets. Configure the pods to use host networking mode to bypass the VPC CNI and gain direct access to the on-premises network.

Update the VPC DHCP options set to list the on-premises DNS server IP addresses as the primary resolvers. Create the Route 53 Private Hosted Zone (PHZ) in the AWS account, and associate it with the VPC to enable local resolution.

Configure the EKS worker nodes' subnet route tables to route all ECR and S3 traffic through a single NAT Gateway deployed in a public subnet of the parent AWS Region. Create an interface VPC endpoint for Amazon S3 in the Outpost subnets to cache image layers locally.

Show answer & explanation

Answer: Create EKS node groups on Amazon EC2 instances on the AWS Outpost. Provision interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr in the Outpost subnets, and create a gateway VPC endpoint for Amazon S3 associated with the Outpost subnet route tables. Configure a Route 53 Resolver outbound endpoint in the VPC, and create a resolver rule to forward queries for ops.grid.local to the on-premises DNS servers.; Configure EKS worker nodes on EC2 instances in the Outpost subnets. Configure the Amazon VPC CNI plugin with custom networking to assign pod IPs from a dedicated VPC secondary CIDR block, and configure the Outpost Local Gateway (LGW) route table with Direct VPC Routing to advertise the pod CIDR block to the on-premises network.

Answer

The correct configurations are to deploy the EKS node groups on EC2 instances on the Outpost, configure ECR interface endpoints and an S3 gateway endpoint, configure Route 53 Resolver outbound endpoints for hybrid DNS resolution, and configure the Amazon VPC CNI with custom networking alongside Direct VPC Routing on the Outpost Local Gateway.

The correct design combines EKS node groups running on EC2 instances on AWS Outposts, private VPC endpoints (ECR interface endpoints and an S3 gateway endpoint) for private image retrieval, and a Route 53 Resolver outbound endpoint to forward on-premises queries. To achieve direct routability of pod IP addresses on the local network, the Amazon VPC CNI plugin is configured with custom networking to pull from a secondary CIDR, which is advertised to the customer network using Direct VPC Routing at the Outpost Local Gateway.

Step-by-Step Solution

Determine compute placement on AWS Outposts.

Identify that EC2-backed EKS node groups must be deployed since AWS Fargate is not supported on Outposts.

Ensures the containerized SCADA workload runs locally on physical Outposts infrastructure to meet latency and sovereignty requirements.

Design private image pulling mechanics.

Configure interface VPC endpoints for ECR api and dkr, and a gateway VPC endpoint for S3.

Allows container nodes to pull images from the private ECR registry in the parent region securely without traversing the public internet.

Establish hybrid DNS resolution.

Deploy Route 53 Resolver outbound endpoints in the VPC and map the on-premises domain to the local DNS servers.

Enables pods to resolve names in the on-premises domain while preserving the ability of the Route 53 Resolver to resolve private hosted zones and local Kubernetes services.

Configure pod IP routing on the local network.

Enable custom networking in the VPC CNI for secondary CIDR allocation, and configure Direct VPC Routing on the Outpost Local Gateway.

Provides pods with routable IP addresses that can communicate bidirectionally with on-premises substation controllers without NAT.

Key Concept

Modernizing workloads on AWS Outposts using Amazon EKS with hybrid connectivity, private container registry access, and integrated DNS resolution.

Question 1516Question →

An enterprise hosts a partner-only web portal behind an Application Load Balancer (ALB). To secure the portal, a Solutions Architect configures an AWS WAF Web ACL with a default action of 'Block'. The Web ACL contains two rules: a rule using an IP set to allow corporate partner network ranges, and a rate-based rule to block clients sending more than 2,000 requests per 5 minutes. The IP allowlist rule is currently evaluated first. During a security audit, a simulated HTTP flood from a partner's IP address successfully overwhelms the backend servers because the rate-based rule was not triggered. Which of the following changes should the Solutions Architect make to remediate this vulnerability?

Keep the IP allowlist rule evaluated first, but configure a scope-down statement within the IP allowlist rule that references the rate-based rule to dynamically exclude blocked IPs.

Configure the rate-based rule with a higher evaluation priority (lower rule priority number) than the IP allowlist rule, ensuring the rate-based rule is evaluated first.

Deploy a Service Control Policy (SCP) at the AWS Organizations Organizational Unit (OU) level that restricts the maximum request rate for the ALB, allowing the SCP to override local WAF rule evaluation.

Configure AWS-managed KMS key policies for the application's database to restrict API decryption rates, throttling the partner's traffic at the database layer instead.

Show answer & explanation

Answer: Configure the rate-based rule with a higher evaluation priority (lower rule priority number) than the IP allowlist rule, ensuring the rate-based rule is evaluated first.

Answer

Configure the rate-based rule with a higher evaluation priority (lower rule priority number) than the IP allowlist rule, ensuring the rate-based rule is evaluated first.

Evaluating the rate-based rule first ensures that any client exceeding the request threshold is blocked, regardless of whether their IP is on the corporate partner allowlist. Requests from partner IPs that do not exceed the rate limit will proceed to the next rule and be allowed.

Step-by-Step Solution

Analyze the existing WAF Web ACL rule evaluation flow.

Identify that the IP allowlist rule is currently evaluated first, and its 'Allow' action terminates rule evaluation for matching partner traffic, bypassing the rate-based rule.

AWS WAF processes rules sequentially. A terminating 'Allow' action stops further rule processing for that request.

Determine the required precedence for rate limiting.

Rate limiting must apply to all traffic, including partners, meaning the rate-based rule must take precedence over the allowlist.

To block HTTP floods from any source, the rate-based rule must evaluate before any terminating 'Allow' rule.

Reorder the rules in the Web ACL.

Move the rate-based rule to a higher priority (lower numeric priority value) than the IP allowlist rule.

This ensures that a client exceeding the rate limit is blocked by the rate-based rule first. Under-limit partner traffic then falls through to the IP allowlist rule and is allowed.

Key Concept

AWS WAF Web ACL rule evaluation order and action behaviors

Question 1517Question →

A media company hosts a high-throughput video transcoding platform on Amazon EC2 instances in an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The EC2 instances reside in private subnets across three Availability Zones. During video upload surges, the system encounters two critical issues: first, newly launched EC2 instances require $8$ minutes to download dependencies and complete their bootstrapping sequence, while the scaling policy cooldown is set to $3$ minutes, resulting in rapid, unnecessary scale-out (thrashing) of instances. Second, when the single NAT Gateway deployed in Availability Zone A experiences network degradation, transcoding instances in all three Availability Zones fail to access the internet to retrieve dependencies, halting the processing pipeline. Which of the following combinations of actions will resolve these issues? (Select TWO.)

Select all that apply

Deploy a dedicated NAT Gateway in each Availability Zone where the EC2 instances reside, and update the route tables of the private subnets to direct outbound traffic (

0.0.0.0/0

) to the respective local NAT Gateway.

Update the Auto Scaling group launch template to use a pre-baked AMI containing the transcoding dependencies, and set the default cooldown and instance warmup periods to exceed the remaining bootstrapping time.

Consolidate all outbound internet routing by deploying a single high-bandwidth NAT Gateway in a shared services VPC and routing private subnet traffic to it over an AWS Transit Gateway.

Configure the Auto Scaling group cooldown period to

60

seconds to ensure that the target tracking scaling policy immediately triggers subsequent scale-out actions to handle transcoding load surges.

Submit an AWS Support request to enable pre-warming for the Application Load Balancer to ensure it automatically bypasses the bootstrapping sequence during rapid instance scale-out events.

Show answer & explanation

Answer: Deploy a dedicated NAT Gateway in each Availability Zone where the EC2 instances reside, and update the route tables of the private subnets to direct outbound traffic ( $0.0.0.0/0$ ) to the respective local NAT Gateway.; Update the Auto Scaling group launch template to use a pre-baked AMI containing the transcoding dependencies, and set the default cooldown and instance warmup periods to exceed the remaining bootstrapping time.

Answer

The correct actions are to deploy a dedicated NAT Gateway in each Availability Zone where the EC2 instances reside, update the private subnet route tables to direct traffic to their local NAT Gateways, update the launch template to use a pre-baked AMI with transcoding dependencies, and ensure the scaling policy cooldown and warmup periods exceed the remaining initialization time.

Deploying a NAT Gateway in each Availability Zone ensures that a local zone failure does not break the outbound connectivity of instances in other zones. Implementing a pre-baked AMI and configuring scaling warmup/cooldown parameters to exceed the bootstrap time stops the Auto Scaling group from spawning unnecessary instances (thrashing) before the newly launched instances are ready to assume load.

Step-by-Step Solution

Analyze the fault-tolerance issue related to internet egress.

The single NAT Gateway in Availability Zone A represents a single point of failure.

If the single NAT Gateway degrades, all instances in all zones lose internet access. Deploying a NAT Gateway in each zone and mapping subnets to their respective local gateway eliminates this risk.

Analyze the auto-scaling thrashing issue.

The boot time (

8

minutes) is much longer than the cooldown period (

3

minutes).

Because the scaling policy does not wait long enough for new instances to start processing traffic, it continues to scale out unnecessarily. Pre-baking dependencies into the AMI and adjusting the cooldown/warmup parameters resolves this.

Key Concept

Auto Scaling cooldown configuration and Multi-AZ NAT Gateway redundancy

Question 1518Question →

A financial technology company is planning to migrate its legacy reporting and auditing platform to AWS. The migration must be completed within a strict 3-month window before their on-premises data center lease expires. The development team is currently fully committed to a core product launch and has zero availability to perform code changes or database schema modifications. The platform consists of the following three components:

1. Reporting Web Application: A Java Tomcat web application running on virtual machines.
2. Transactional Database: A Microsoft SQL Server database. The company wants to eliminate database administration tasks such as backups and patching to minimize operational overhead.
3. Archived Compliance Log Viewer: A legacy PHP application used only for read-only historical compliance audits. The application is scheduled to be decommissioned in 9 months when the regulatory data retention period expires.

Which two of the following migration strategy mappings are correct for these components? (Select TWO)

Select all that apply

Rehost the Reporting Web Application using AWS Application Migration Service (MGN), and Replatform the Transactional Database to Amazon RDS for SQL Server.

Refactor the Reporting Web Application to run on AWS Lambda serverless functions, and Refactor the Transactional Database by converting the schema to Amazon Aurora PostgreSQL using the AWS Schema Conversion Tool (SCT).

Retain the Archived Compliance Log Viewer on-premises until it is decommissioned next year, rather than migrating it to AWS.

Replatform the Reporting Web Application by rewriting its core business logic as containerized microservices on Amazon Elastic Kubernetes Service (EKS).

Retire the Archived Compliance Log Viewer immediately to eliminate on-premises infrastructure footprint before the lease expires.

Show answer & explanation

Answer: Rehost the Reporting Web Application using AWS Application Migration Service (MGN), and Replatform the Transactional Database to Amazon RDS for SQL Server.; Retain the Archived Compliance Log Viewer on-premises until it is decommissioned next year, rather than migrating it to AWS.

Answer

Rehosting the Reporting Web Application using AWS Application Migration Service (MGN), replatforming the Transactional Database to Amazon RDS for SQL Server, and retaining the Archived Compliance Log Viewer on-premises.

Rehosting the web tier using AWS Application Migration Service (MGN) allows for a rapid migration to meet the 3-month lease expiration deadline without requiring code changes. Replatforming the SQL Server database to Amazon RDS for SQL Server eliminates administrative overhead like backup and patching tasks while preserving the existing database engine and schema, matching the constraint of zero developer availability. Retaining the compliance viewer on-premises avoids the cost and effort of migrating a system that is scheduled to be decommissioned in 9 months, while still adhering to the regulatory retention period.

Step-by-Step Solution

Analyze the migration constraints for the Reporting Web Application.

The migration must be completed within 3 months, and the development team has zero availability for code modifications. This dictates a Rehost strategy (using AWS MGN) to move the virtual machines as-is.

Rehosting minimizes migration time and requires no source code modifications.

Analyze the migration constraints for the Transactional Database.

The database must be migrated to a managed service to eliminate administrative overhead, but schema or database engine modifications are not allowed due to developer constraints. This dictates a Replatform strategy to Amazon RDS for SQL Server.

Replatforming to RDS SQL Server offloads patching and backup overhead to AWS without modifying the database engine or application SQL dialect.

Analyze the constraints for the Archived Compliance Log Viewer.

The application is used only for historical audits and will be decommissioned in 9 months. Immediate deletion is not allowed due to regulatory retention policies. This dictates a Retain strategy.

Retaining the application on-premises avoids migration effort and costs for a workload that is shortly to be decommissioned, while maintaining compliance.

Key Concept

Selecting migration strategies based on timeline constraints, developer availability, and compliance rules using the 7 Rs framework.

Question 1519Question →

An enterprise is planning to migrate 50 physical servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The hybrid network infrastructure includes a 10 Gbps AWS Direct Connect connection terminated on a Transit Gateway in a central shared services VPC. Strict security policies dictate that all replication traffic must be private and cannot traverse the public internet. The staging area VPC has no Internet Gateway attached. After installing the AWS Replication Agent on several on-premises servers, the Solutions Architect notes that the replication status is 'Stalled' and the agents cannot connect to the replication servers. Which two configuration steps must the Solutions Architect perform to resolve this issue and establish private replication? (Select TWO.)

Select all that apply

Configure the AWS Application Migration Service replication settings to use private IP routing, and ensure that the on-premises firewall and the staging VPC security groups permit outbound and inbound traffic on TCP Port 1500 respectively.

Create interface VPC endpoints for AWS Application Migration Service in the staging VPC, and associate the resulting Route 53 Private Hosted Zone with the staging VPC and any peer VPCs that handle DNS resolution for the hybrid network.

Deploy a single NAT Gateway in the staging VPC to route the data replication traffic, allowing the replication servers to communicate with the AWS Application Migration Service public endpoints over the public internet.

Configure the AWS Replication Agent to route block-level data replication over TCP Port 443 to the MGN control plane interface endpoint, eliminating the need to open port 1500 on the on-premises firewall.

Configure a Direct Connect Gateway to enable transitive VPC-to-VPC routing between the staging VPC and the central shared services VPC without using a Transit Gateway to resolve DNS queries.

Show answer & explanation

Answer: Configure the AWS Application Migration Service replication settings to use private IP routing, and ensure that the on-premises firewall and the staging VPC security groups permit outbound and inbound traffic on TCP Port 1500 respectively.; Create interface VPC endpoints for AWS Application Migration Service in the staging VPC, and associate the resulting Route 53 Private Hosted Zone with the staging VPC and any peer VPCs that handle DNS resolution for the hybrid network.

Answer

The correct actions are to configure the AWS Application Migration Service replication settings to use private IP routing while ensuring port 1500 is open, and to create interface VPC endpoints for AWS Application Migration Service while associating the private hosted zone with the relevant VPCs.

To establish private replication using AWS Application Migration Service (MGN) over Direct Connect, you must configure the service to use private IP routing and ensure TCP Port 1500 is allowed through both the local firewall and the staging area security groups. Additionally, you must provision interface VPC endpoints for the MGN service endpoint in the staging VPC, and associate the resulting Route 53 Private Hosted Zone with the staging VPC and any peer VPCs that resolve DNS queries, ensuring that the replication agents can resolve the service endpoint to private IP addresses.

Step-by-Step Solution

Verify control plane connectivity requirements for the replication agent.

Determine that the agent needs to reach the MGN service control plane privately via com.amazonaws.<region>.mgn using interface VPC endpoints and associated Route 53 Private Hosted Zones.

The agent requires control plane access to receive instructions and coordinate migration, which must go over Direct Connect in a private architecture.

Configure replication data path settings in the MGN replication template.

Enable private IP routing in the replication template to ensure data replicates over the Direct Connect connection rather than the public internet.

Private IP routing forces the replication servers to use private IP addresses, satisfying the security requirements.

Open the necessary network paths for data replication.

Open TCP Port 1500 on the on-premises firewall and the staging VPC security groups.

Replication agents stream block-level data to replication servers specifically over port 1500, which is distinct from control plane communications.

Key Concept

Establishing private, secure replication for AWS Application Migration Service (MGN) using Direct Connect, VPC endpoints, and appropriate port configurations.

Estimated Time:2m 30s

Question 1520Question →

A company is migrating an on-premises Microsoft SQL Server database to an Amazon Aurora PostgreSQL-Compatible Edition cluster using AWS Database Migration Service (DMS) and the AWS Schema Conversion Tool (SCT). The database schema has already been successfully converted and applied. The solutions architect needs to run a DMS replication task with Change Data Capture (CDC) to perform a minimal-downtime migration. However, during testing, the DMS task completes the full load phase but fails to replicate any ongoing data changes (CDC) and stalls. Which of the following actions must the solutions architect perform on the source database to enable successful Change Data Capture (CDC) replication? (Select TWO.)

Select all that apply

Enable Change Data Capture (MS-CDC) for the database and the specific tables slated for replication.

Ensure that the SQL Server Agent service is running on the source database instance.

Configure binary logging (binlog) on the database and set the binlog format to ROW.

Enable supplemental logging for all replicated tables using ALTER DATABASE and ALTER TABLE commands.

Enable logical replication by setting the wal_level parameter to logical in the parameter group.

Show answer & explanation

Answer: Enable Change Data Capture (MS-CDC) for the database and the specific tables slated for replication.; Ensure that the SQL Server Agent service is running on the source database instance.

Answer

Enable Change Data Capture (MS-CDC) for the database and specific tables, and ensure that the SQL Server Agent service is running on the source database instance.

For Microsoft SQL Server sources, AWS DMS reads changes from the SQL Server transaction log using MS-CDC (Microsoft Change Data Capture). This requires that MS-CDC is explicitly enabled on both the database and the tables being replicated. Additionally, the SQL Server Agent service must be active because it drives the CDC capture job that reads from the transaction log and populates the change tables that DMS queries.

Step-by-Step Solution

Analyze the source database engine and the requirements for AWS DMS CDC.

The source database is Microsoft SQL Server.

AWS DMS requires different CDC mechanisms depending on the source database engine.

Determine the CDC mechanism used by AWS DMS for Microsoft SQL Server.

AWS DMS utilizes Microsoft SQL Server Change Data Capture (MS-CDC) or MS-Replication to capture changes from the transaction logs.

In order for DMS to read transactions, MS-CDC must be enabled on the database and table levels.

Verify SQL Server system dependencies for MS-CDC.

The SQL Server Agent must be running to execute the CDC capture and cleanup jobs.

If the Agent is stopped, change tables are not populated, resulting in DMS stalling during the CDC replication phase.

Key Concept

AWS Database Migration Service (DMS) Change Data Capture (CDC) prerequisites for Microsoft SQL Server sources.

PreviousPage 76 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept