Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1541Question →

A biotechnology research company, GeneSphere, is modernizing its legacy genomic analysis suite by migrating it from on-premises virtual machines to AWS. The company has containerized the workload and wants to deploy it using Amazon ECS with the AWS Fargate launch type for administrative simplicity.

The architecture comprises a multi-account AWS environment managed via AWS Organizations. The container images are stored in a centralized Amazon Elastic Container Registry (ECR) repository in a Shared Services account. The ECS tasks will be deployed in a separate Production account across three Availability Zones within a private subnet of the Production VPC.

For regulatory compliance, the deployment must meet the following requirements:
1. All traffic between the Fargate tasks and AWS services (Amazon ECR and Amazon S3) must remain private within the AWS network without traversing the public internet.
2. The Fargate tasks must resolve internal service endpoints (e.g., service.internal.local) hosted in the Shared Services VPC using a Route 53 Private Hosted Zone (PHZ) managed in the Shared Services account.
3. The network design must be highly available with no single point of failure.

Which configuration meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure the ECS task definition to use the awsvpc network mode. In the Production VPC, create Interface VPC endpoints for Amazon ECR (ecr.dkr and ecr.api) and a Gateway VPC endpoint for Amazon S3. In the Shared Services account, authorize the association of the Route 53 Private Hosted Zone with the Production VPC, and then associate it from the Production account. Configure the Production ECS task execution role and the Shared Services ECR repository policy to allow cross-account access.

Answer

Configure the ECS task definition to use the awsvpc network mode. In the Production VPC, create Interface VPC endpoints for Amazon ECR (ecr.dkr and ecr.api) and a Gateway VPC endpoint for Amazon S3. In the Shared Services account, authorize the association of the Route 53 Private Hosted Zone with the Production VPC, and then associate it from the Production account. Configure the Production ECS task execution role and the Shared Services ECR repository policy to allow cross-account access.
The correct configuration uses the awsvpc network mode, which is required for AWS Fargate tasks. By deploying Interface VPC endpoints for Amazon ECR (both dkr and api) and a Gateway VPC endpoint for Amazon S3 in the Production VPC, Fargate tasks can pull private container images completely within the private AWS network. Associating the Route 53 Private Hosted Zone from the Shared Services account with the Production VPC enables proper internal DNS resolution. Finally, granting cross-account permissions on the ECR repository policy and the Production task execution role allows the Production ECS tasks to pull images successfully.

Step-by-Step Solution

1
Select the correct network mode for AWS Fargate tasks.
The awsvpc network mode is chosen, as it is the only network mode supported by Fargate.
AWS Fargate requires the task definition to use the awsvpc network mode to allocate an elastic network interface (ENI) to each task.
2
Configure private access to Amazon ECR and Amazon S3.
Interface VPC endpoints (ecr.dkr and ecr.api) and a Gateway VPC endpoint for Amazon S3 are deployed in the Production VPC.
To pull container images without traversing the public internet, Fargate tasks must use VPC endpoints. Since ECR image layers are stored in Amazon S3, a Gateway endpoint for S3 is also required to download layers privately.
3
Associate the cross-account Route 53 Private Hosted Zone.
An association authorization is created in the Shared Services account, and the association is accepted/completed in the Production account.
To resolve internal service domain names hosted in the Shared Services account from the Production VPC, the Private Hosted Zone must be associated with the Production VPC.
4
Establish cross-account ECR repository access.
The Production task execution role is granted ECR read permissions, and the Shared Services ECR repository policy is updated to trust the Production account ID.
IAM permissions must allow the Production ECS task agent to authenticate and pull image layers from the registry in the Shared Services account.

Key Concept

Cross-account Amazon ECS container modernization with private networking and DNS resolution
Estimated Time:3m 0s
Question 1542Question →

An e-commerce company operates a flash sales portal on AWS. The application is hosted on Amazon EC2 instances in an Auto Scaling Group (ASG) across three Availability Zones behind an Application Load Balancer (ALB). The instances require outbound internet access to verify payment transactions via third-party APIs. Currently, all private subnets route outbound traffic through a single NAT Gateway located in Availability Zone A.

During scheduled flash sales, the following issues occur:
- The ALB drops incoming requests and returns HTTP 503 service unavailable errors during the first few minutes of the sale.
- The ASG launches more instances than required during scale-out because the custom bootstrapping script takes 7 minutes to complete, which is longer than the ASG's default cooldown period of 300 seconds.
- An outage in Availability Zone A recently blocked all outbound internet traffic for the instances in the other zones.

Which combination of actions should a Solutions Architect implement to resolve these issues?

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone, and update the private subnet route tables to use the corresponding local NAT Gateway. Submit a request to AWS Support to pre-warm the ALB prior to the scheduled flash sales. Configure an Auto Scaling lifecycle hook to keep new instances in the pending state until the bootstrapping script completes.

Answer

Deploy a NAT Gateway in each Availability Zone, configure zonal routing for the private subnets, request ALB pre-warming from AWS Support, and configure an Auto Scaling lifecycle hook to manage bootstrapping delays.
The correct solution resolves all three architectural bottlenecks. First, deploying a NAT Gateway in each Availability Zone and creating separate route tables for each subnet isolates the outbound path, ensuring that a zonal outage does not disrupt traffic in other zones. Second, requesting ALB pre-warming ensures that the load balancer is ready for instant flash traffic spikes, avoiding HTTP 503 errors. Third, implementing an Auto Scaling lifecycle hook prevents the ASG from evaluating scaling policy actions while an instance is still bootstrapping, which eliminates over-provisioning caused by a bootstrapping duration that exceeds the cooldown period.

Step-by-Step Solution

1
Address the NAT Gateway single point of failure.
A NAT Gateway is deployed in each of the three Availability Zones, and the private subnet route tables are updated to point their 0.0.0.0/0 route to their local zonal NAT Gateway.
This isolates outbound failure domains to each individual Availability Zone, preventing an outage in one zone from affecting outbound traffic in other zones.
2
Address the immediate ALB scaling latency.
Submit an AWS support ticket to pre-warm the ALB to the expected capacity prior to the scheduled flash sale start times.
Standard ALB scaling is reactive and gradual. Pre-warming ensures the load balancer has enough capacity provisioned to handle the sudden, massive traffic spike without dropping connections.
3
Resolve the ASG over-provisioning (thrashing) issue during bootstrapping.
Configure an Auto Scaling lifecycle hook (e.g., EC2_INSTANCE_LAUNCHING) that puts the instance in a 'Pending:Wait' state while bootstrapping runs.
Using a lifecycle hook ensures that the ASG does not count the instance as 'InService' or initiate subsequent cooldown/scaling evaluations until the custom script has finished executing and sent a success signal.

Key Concept

Auto Scaling lifecycle hooks, zonal network redundancy, and load balancer scaling characteristics.
Question 1543Question →

An enterprise is migrating a legacy on-premises Oracle 19c database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration strategy utilizes the AWS Schema Conversion Tool (SCT) for schema conversion and AWS Database Migration Service (DMS) for full-load and Ongoing Replication (Change Data Capture - CDC).

The source database contains several tables that do not have primary keys. To prepare the source database for CDC, the database administrator puts the Oracle database in ARCHIVELOG mode and enables database-level minimal supplemental logging by running:
`ALTER DATABASE ADD SUPPLEMENTAL LOG DATA;`

During the migration, the AWS DMS task completes the Full Load phase successfully. However, when the task transitions to the CDC phase, updates to the tables without primary keys are not replicated to the target Aurora DB cluster, and the DMS task log displays errors indicating that target rows cannot be located.

Which of the following describes the root cause of this issue and the correct resolution?

Show answer & explanation

Answer: Oracle writes only the modified columns to the redo logs by default, which prevents AWS DMS from identifying target rows for tables without primary keys. To resolve this, supplemental logging must be configured for all columns of these tables on the source database by executing `ALTER TABLE ... ADD SUPPLEMENTAL LOG GROUP ... ALWAYS` for each table.

Answer

Oracle writes only the modified columns to the redo logs by default, which prevents AWS DMS from identifying target rows for tables without primary keys. To resolve this, supplemental logging must be configured for all columns of these tables on the source database by executing `ALTER TABLE ... ADD SUPPLEMENTAL LOG GROUP ... ALWAYS` for each table.
The correct option is that Oracle writes only the modified columns to the redo logs by default, which prevents AWS DMS from identifying target rows for tables without primary keys. To resolve this, supplemental logging must be configured for all columns of these tables on the source database by executing `ALTER TABLE ... ADD SUPPLEMENTAL LOG GROUP ... ALWAYS` for each table.

Step-by-Step Solution

1
Analyze the DMS CDC log errors regarding target rows that cannot be located during the replication of tables without primary keys.
Identify that the issue is specific to the CDC phase and tables lacking a primary key.
Since the Full Load phase completed successfully, the issue must lie within the transactional changes (redo logs) captured during CDC.
2
Review the default behavior of Oracle redo logging and AWS DMS CDC requirements.
Determine that Oracle only logs modified columns by default. For tables without primary keys, DMS cannot identify which row on the target corresponds to the incoming update/delete from the redo log unless all columns are logged.
DMS requires unchanged column values to formulate the WHERE clause for target updates and deletes on tables without primary keys.
3
Examine the database-level supplemental logging configuration.
Note that minimal database-level supplemental logging (`ALTER DATABASE ADD SUPPLEMENTAL LOG DATA;`) was enabled, but table-level supplemental logging for tables without primary keys was omitted.
Database-level minimal supplemental logging only provides the minimal information needed to identify transactions, not the full column data needed for non-keyed tables.
4
Formulate the resolution to configure table-level supplemental logging.
Add a supplemental log group that contains all columns (using the ALWAYS clause) for each table without a primary key on the source Oracle database.
This forces Oracle to write the values of all columns to the redo log whenever any column is updated, allowing DMS to match the target rows.

Key Concept

Oracle source CDC supplemental logging requirements for tables without primary keys in AWS DMS
Estimated Time:3m 0s
Question 1544Question →

A media company is planning to migrate its video production and archiving platform to AWS. The platform consists of three main components:

1. A proprietary video transcoding engine compiled as a legacy C++ binary. It runs on a specialized Linux kernel configuration with custom hardware optimizations. The source code is unavailable, and the engine cannot be modified or containerized.
2. A metadata store currently running on an on-premises Oracle database. The database uses complex, custom PL/SQL stored procedures. The company wants to modernize this store to Amazon Aurora PostgreSQL to reduce licensing costs, which will require schema rewrite and query modifications using the AWS Schema Conversion Tool (SCT).
3. A legacy media archiving library stored on physical LTO tape drives. The tapes contain historical footage that is rarely accessed but must be kept for regulatory compliance. The company has decided not to migrate this tape library to AWS during the initial phase and will keep it in the on-premises datacenter.

Which combination of migration strategies represents the most appropriate 7 Rs pathways for these components?

Show answer & explanation

Answer: Transcoding engine: Rehost; Metadata store: Refactor; Legacy archive: Retain

Answer

Transcoding engine: Rehost; Metadata store: Refactor; Legacy archive: Retain
The correct option is the strategy mapping 'Transcoding engine: Rehost; Metadata store: Refactor; Legacy archive: Retain'. The transcoding engine cannot be modified or containerized, and needs custom kernel optimizations, which fits a Rehost migration onto EC2. The metadata store requires converting an on-premises Oracle database to Amazon Aurora PostgreSQL, involving PL/SQL code rewrites and schema changes; this constitutes Refactoring. The legacy LTO tape library is not being migrated but must be preserved for compliance, which represents Retain.

Step-by-Step Solution

1
Analyze the constraints of the video transcoding engine.
The transcoding engine requires Rehost.
Since the source code is unavailable and it requires specialized kernel settings, it cannot be refactored or replatformed, making Rehost (lift-and-shift to EC2) the only viable option.
2
Evaluate the migration requirements of the database metadata store.
The metadata store requires Refactor.
Migrating from Oracle to Amazon Aurora PostgreSQL involves schema conversion, PL/SQL rewrites, and application modifications, which constitutes Refactoring (re-architecting) rather than a simple Replatform.
3
Determine the migration pathway for the legacy media archiving library.
The legacy media archiving library requires Retain.
Because the archive contains data required for regulatory compliance but will not be moved to the cloud in the current phase, it must be kept on-premises (Retain) rather than being deleted (Retire).

Key Concept

The 7 Rs migration strategy framework differentiates between Rehost (lift-and-shift), Replatform (lift-tinker-and-shift), Refactor (re-architect), and Retain based on workload constraints and modernization goals.
Estimated Time:1m 30s
Question 1545Question →

An energy utility company is migrating 1212 critical grid-monitoring servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The replication traffic must travel privately over a 1 Gbps1 \text{ Gbps} AWS Direct Connect connection via an AWS Transit Gateway. The target environment is a dedicated Migration VPC. The Solutions Architect has established interface VPC endpoints for the MGN control plane in a Shared Services VPC, which is shared with the Migration VPC via Route 53 Private Hosted Zone associations. After installing the AWS Replication Agent on the source servers, the console indicates that the agents can communicate with the control plane, but the replication status remains stalled at 0%0\% progress. Which combination of actions will resolve the replication stall and resume data transfer?

Show answer & explanation

Answer: Ensure that the on-premises firewall permits outbound traffic on TCP Port 15001500 to the staging area subnet in the Migration VPC, and verify that the route table associated with the staging area subnet contains a route pointing to the Transit Gateway for the on-premises network CIDR.

Answer

Ensure that the on-premises firewall permits outbound traffic on TCP Port 15001500 to the staging area subnet in the Migration VPC, and verify that the route table associated with the staging area subnet contains a route pointing to the Transit Gateway for the on-premises network CIDR.
The correct action is to ensure that the on-premises firewall permits outbound traffic on TCP Port 15001500 to the staging area subnet in the Migration VPC, and to verify that the staging subnet's route table contains a route to the on-premises network CIDR via the Transit Gateway. This is because AWS Application Migration Service uses TCP port 1500 for replication data transfer between the agent on the source server and the replication servers in the staging area. Without this port open and proper routing back to the source network, replication will stall at 0%0\%.

Step-by-Step Solution

1
Analyze the replication path and identify where the failure occurs.
The agent connects to the control plane (using TCP port 443 over VPC endpoints), but data replication (which uses TCP port 1500 to the replication servers) is stalled at 0%0\%.
This indicates a data plane communication issue, not a control plane or DNS resolution issue.
2
Review firewall rules for the data plane traffic.
TCP Port 15001500 must be opened on the on-premises firewall pointing to the staging area subnet.
The AWS Replication Agent sends encrypted replicated data blocks directly to the Replication Servers in the staging area subnet on TCP port 1500.
3
Verify routing configurations in the staging area subnet.
Ensure there is a route in the staging subnet route table pointing back to the on-premises IP range via the Transit Gateway.
Bidirectional network connectivity is required so that replication servers can send acknowledgments back to the on-premises agents.

Key Concept

AWS MGN Data Replication Port and Routing Requirements
Estimated Time:2m 30s
Question 1546Question →

An enterprise has an existing on-premises application that currently uses long-lived AWS IAM user access keys to upload large data logs to an Amazon S3 bucket. To strengthen security, a Solutions Architect is tasked with refactoring the authentication mechanism to use short-lived credentials via AWS IAM Roles Anywhere. The enterprise already operates an internal Certificate Authority (CA). Which combination of actions should the Solutions Architect perform to implement this security improvement? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create a trust anchor in AWS IAM Roles Anywhere by registering the certificate of the internal Certificate Authority (CA), and define a profile that specifies the IAM role that the on-premises application can assume.; Create an IAM role with a trust policy that allows the sts:AssumeRole, sts:TagSession, and sts:SetSourceIdentity actions, and trusts the rolesanywhere.amazonaws.com service principal.

Answer

Create a trust anchor in AWS IAM Roles Anywhere by registering the certificate of the internal Certificate Authority (CA), define a profile that specifies the IAM role, and create an IAM role with a trust policy that trusts the rolesanywhere.amazonaws.com service principal and allows the sts:AssumeRole, sts:TagSession, and sts:SetSourceIdentity actions.
The correct options implement IAM Roles Anywhere by registering the external CA certificate as a trust anchor and defining a profile referencing the role, while configuring the role trust policy to trust the rolesanywhere.amazonaws.com service principal with sts:AssumeRole, sts:TagSession, and sts:SetSourceIdentity actions.

Step-by-Step Solution

1
Register the internal Certificate Authority (CA) certificate as a trust anchor in AWS IAM Roles Anywhere.
Establishes a trust relationship between AWS IAM Roles Anywhere and the external PKI environment.
Allows AWS to validate certificates presented by the on-premises workloads.
2
Create an IAM role with a trust policy trusting the rolesanywhere.amazonaws.com service principal.
Allows the IAM Roles Anywhere service to assume the role on behalf of authenticated on-premises clients.
Ensures that the client can request temporary security credentials using the sts:AssumeRole, sts:TagSession, and sts:SetSourceIdentity actions.
3
Define an IAM Roles Anywhere profile and associate it with the created IAM role.
Maps the authenticated identity to the authorized target role and optional session policies.
Enables the credentials helper tool (aws_signing_helper) on the server to retrieve short-lived credentials for the application.

Key Concept

AWS IAM Roles Anywhere enables on-premises workloads to authenticate securely with AWS using local X.509 certificates to obtain short-lived IAM credentials, replacing static access keys.
Question 1547Question →

A company needs to ensure that a security logging agent's configuration file is kept synchronized and compliant across all Amazon EC2 instances in an Auto Scaling group. The configuration contains sensitive database connection strings and must be protected. If any manual modifications are made to this configuration file on a running instance, the changes must be detected and corrected within an hour to ensure compliance. Which of the following solutions meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Store the configuration file in AWS Systems Manager Parameter Store. Create an AWS Systems Manager State Manager association targeting the instances by their Auto Scaling group tags. Configure the association to run a custom SSM document every 30 minutes that retrieves the configuration from Parameter Store and applies it to the instances.

Answer

The correct solution is to store the configuration file in AWS Systems Manager Parameter Store and use an AWS Systems Manager State Manager association targeting the instances by their Auto Scaling group tags to run a custom SSM document every 30 minutes to fetch and apply the configuration.
The correct solution uses AWS Systems Manager State Manager, which is designed to maintain and enforce consistent OS-level configurations on EC2 instances. By targeting instances using Auto Scaling group tags, any new instances launched by the Auto Scaling group are automatically registered and configured. Running the association every 30 minutes ensures that any configuration drift caused by manual modifications is remediated within the required one-hour window. Storing the configuration file in Parameter Store allows secure, centralized management of the database connection strings.

Step-by-Step Solution

1
Store the configuration file securely.
The configuration file is stored in Systems Manager Parameter Store as a SecureString parameter.
This centralizes configuration management and protects sensitive connection strings.
2
Create a Systems Manager State Manager association.
An association is configured to run an SSM document every 30 minutes, targeting instances using Auto Scaling group tags.
This automates the execution of the configuration enforcement document on all current and future instances.
3
Enforce state and remediate drift.
The SSM document runs, compares the local configuration with Parameter Store, and overwrites any manual modifications.
This ensures that any configuration drift is automatically corrected within the required one-hour compliance window.

Key Concept

Continuous configuration management and drift remediation using AWS Systems Manager State Manager
Question 1548Question →

An online multiplayer gaming platform uses Amazon EC2 instances in an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB) to run its matchmaking service. The matchmaking application requires 5 minutes to bootstrap, load assets, and become fully operational. During peak hours, sudden traffic surges cause players to experience connection timeouts. Monitoring shows that during spikes, the ASG launches new instances, but before they transition to an InService state, the existing instances become overloaded and fail health checks. In addition, outbound database registration requests from the private subnets fail when the Availability Zone hosting the single NAT Gateway experiences an outage. Which TWO configurations should a Solutions Architect implement to improve the fault tolerance and auto-scaling behavior of the application? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Auto Scaling Group Warm Pool with instances in a Stopped state, and configure the default instance warmup time to match the application bootstrapping duration.; Deploy a NAT Gateway in each Availability Zone, and update the route tables of the private subnets to route outbound traffic through the local NAT Gateway in their respective Availability Zone.

Answer

Configure an Auto Scaling Group Warm Pool with instances in a Stopped state, configure the default instance warmup time to match the application bootstrapping duration, and deploy a NAT Gateway in each Availability Zone, updating the route tables of the private subnets to route outbound traffic through the local NAT Gateway in their respective Availability Zone.
To solve the 5-minute bootstrapping delay, configuring an Auto Scaling Group Warm Pool with instances in a Stopped state allows pre-bootstrapped instances to quickly transition to the InService state during surges. Setting the default instance warmup to match the bootstrapping duration prevents the scaling metrics from being skewed by instances that are not yet operational. To solve the outbound connectivity failure, deploying a NAT Gateway in each Availability Zone ensures that private subnets in each zone have a redundant, localized path to the internet, eliminating the single point of failure.

Step-by-Step Solution

1
Analyze the auto-scaling and bootstrapping bottleneck.
The application requires 5 minutes to bootstrap. Under sudden surges, the Auto Scaling Group initiates scale-out actions, but the delay in instances transitioning to an active state causes existing instances to fail due to load.
Identifying the bootstrapping time as the root cause of health check failures and connection timeouts allows us to choose a pre-warming or lifecycle management strategy.
2
Resolve the scaling latency.
Implement an ASG Warm Pool with pre-bootstrapped instances in a Stopped state to reduce launch latency, and adjust the default instance warmup parameter to match the 5-minute bootstrapping phase.
Warm Pools keep instances in a pre-warmed state so they can enter service much faster than standard scaling. Setting the instance warmup ensures the ASG does not initiate further scaling actions before the new instances are active.
3
Analyze and resolve the outbound connectivity single point of failure.
A single NAT Gateway creates a single point of failure across Availability Zones. Outbound database registrations fail when that zone goes down.
Outbound traffic must be distributed across multiple NAT Gateways (one per Availability Zone) to provide Availability Zone-level fault tolerance.

Key Concept

Auto Scaling Warm Pools and Multi-AZ NAT Gateway Redundancy
Estimated Time:2m 0s
Question 1549Question →

A media streaming company is launching a new video-processing platform in the us-west-2 region. The architecture consists of a Production VPC (vpc-prod-processing) and a Shared Services VPC (vpc-shared-services), both connected via an AWS Transit Gateway. The video-processing EC2 instances are distributed across two Availability Zones (us-west-2a and us-west-2b) in private subnets of vpc-prod-processing and must access the internet to download transcoding packages and license updates. The company wants to centralize all outbound internet traffic through vpc-shared-services to inspect traffic and minimize costs. Additionally, the EC2 instances in vpc-prod-processing need to resolve internal database endpoints registered in a Route 53 Private Hosted Zone (corp.internal) managed within vpc-shared-services. The solution must be highly resilient, preventing any single points of failure. Which two actions should the Solutions Architect take to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet within both us-west-2a and us-west-2b in the Shared Services VPC, and route outbound traffic from the Transit Gateway subnet route tables to the NAT Gateway in the same Availability Zone.; Associate the Route 53 Private Hosted Zone corp.internal with both the Shared Services VPC and the Production VPC.

Answer

Deploy a NAT Gateway in each Availability Zone in the Shared Services VPC to prevent single points of failure, and associate the Route 53 Private Hosted Zone corp.internal with both the Shared Services VPC and the Production VPC to allow resolution of internal DNS names.
The correct solution involves deploying a NAT Gateway in each Availability Zone of the Shared Services VPC to ensure high availability and prevent single points of failure. Additionally, the Route 53 Private Hosted Zone corp.internal must be explicitly associated with the Production VPC to allow DNS queries originating from that VPC to resolve successfully.

Step-by-Step Solution

1
Ensure internet egress redundancy in the hub VPC.
Two NAT Gateways are deployed, one in each Availability Zone of the Shared Services VPC.
This guarantees that outbound connectivity is resilient against an Availability Zone outage.
2
Configure routing for centralized egress.
Outbound traffic from the Production VPC is directed to the Transit Gateway, which forwards it to the Shared Services VPC where route tables point to the local NAT Gateways.
This establishes a centralized egress path without creating a single point of failure.
3
Associate the Route 53 Private Hosted Zone with the consumer VPC.
The Private Hosted Zone corp.internal is associated with the Production VPC.
This allows resources in the Production VPC to query the Route 53 Resolver and successfully resolve endpoints in the Private Hosted Zone.

Key Concept

Centralized egress design requires multi-AZ NAT Gateways to avoid a single point of failure, and Route 53 Private Hosted Zones require explicit association with all VPCs that need to resolve their records.
Estimated Time:2m 0s
Question 1550Question →

A global e-commerce firm is designing a new online transaction processing (OLTP) ledger system that must operate across two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). The ledger requires a relational database that can handle high-rate write transactions in the primary region, support local read operations with sub-second latency in both regions to serve real-time analytics dashboards, and support a disaster recovery plan with a Recovery Point Objective (RPO) of under 2 seconds and a Recovery Time Objective (RTO) of under 10 minutes. Additionally, compliance requirements dictate that all data must be encrypted at rest using customer managed keys (CMKs) in AWS Key Management Service (AWS KMS). Which database and storage strategy meets these requirements with the lowest operational overhead?

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure Aurora Replicas in both regions to scale read operations, and enable Aurora Auto Scaling for the replicas. Encrypt the database clusters at rest using customer managed keys (CMKs) in AWS KMS created in each respective region.

Answer

Deploy an Amazon Aurora PostgreSQL global database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, configuring Aurora Replicas with Auto Scaling in both regions, and encrypting clusters using customer managed keys (CMKs) in each respective region.
Deploying an Amazon Aurora PostgreSQL global database is the optimal choice. It natively replicates database updates to the secondary region at the storage layer with minimal lag, ensuring an RPO of under 2 seconds. In the event of a disaster, the secondary cluster can be promoted to a standalone cluster in under 10 minutes, satisfying the RTO target. Readers in both regions can handle local dashboard queries, and Aurora Auto Scaling handles dynamic scaling. For security, encrypting both clusters with region-specific customer managed keys complies with the KMS architecture rules.

Step-by-Step Solution

1
Evaluate the disaster recovery requirements.
An RPO under 2 seconds and RTO under 10 minutes require active replication at the storage level rather than backups. Amazon Aurora Global Database uses storage-based replication with latency typically under 1 second and recovery times under 1 minute.
Traditional backup-and-restore or snapshot copy methods fail to meet the tight RPO constraint.
2
Evaluate read scaling requirements across both regions.
Aurora Replicas must be configured in both us-east-1 and us-west-2, and Aurora Auto Scaling must be enabled to dynamically handle load spikes.
This offloads read operations from the writer instance and serves local dashboards with sub-second latency.
3
Address the encryption requirement with customer managed keys (CMKs).
Create unique KMS CMKs in both us-east-1 and us-west-2, and configure the primary and secondary clusters to encrypt at rest using their local region's key.
AWS KMS keys are region-specific, and default AWS-managed keys cannot have their policies modified for cross-region configurations.

Key Concept

Amazon Aurora Global Database replication, read scaling with replicas, and multi-region encryption using customer managed keys.
Question 1551Question →

A global media company is migrating its legacy application workloads from a co-located data center to AWS using AWS Application Migration Service (MGN). The hybrid connectivity consists of a 10 Gbps10\text{ Gbps} AWS Direct Connect connection terminated at an AWS Transit Gateway. The on-premises source servers reside in a restricted segment with no direct internet access. To facilitate migration, the Solutions Architect deploys Interface VPC Endpoints in the staging VPC for the MGN control plane and creates a Route 53 Private Hosted Zone (PHZ) for the service endpoints. During testing, the MGN agents fail to register from the on-premises servers, and the few servers that did register show a replication status of permanently stalled. Additionally, the staging VPC currently uses a single NAT Gateway in `us-east-1a` to handle egress traffic, violating high availability requirements. Which of the following actions should the Solutions Architect take to resolve the registration and replication stalls while establishing a highly available and resilient architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Route 53 Resolver Inbound Endpoints in the staging VPC, configure the on-premises DNS servers to forward queries for the MGN control plane endpoint to these inbound endpoint IP addresses, and allow inbound TCP port 443443 traffic to the Interface VPC Endpoints from the on-premises network.; Modify the staging VPC security groups and on-premises firewall rules to permit bidirectional traffic over TCP port 15001500 for data replication, and provision a NAT Gateway in each Availability Zone of the staging VPC to ensure redundant egress paths for staging resources.

Answer

To resolve the registration and replication issues and ensure high availability, the Solutions Architect must deploy Route 53 Resolver Inbound Endpoints to handle on-premises DNS forwarding for the MGN private endpoints, open TCP ports 443443 and 15001500 on the security groups and firewalls, and deploy a NAT Gateway in each Availability Zone of the staging VPC.
The correct solutions involve setting up Route 53 Resolver Inbound Endpoints in the staging VPC to allow the on-premises DNS servers to forward and resolve the MGN control plane private endpoint addresses. Additionally, the security groups and firewalls must permit traffic on TCP port 443443 for agent registration and TCP port 15001500 for data replication to the staging area replication servers. To achieve high availability and eliminate single points of failure, a NAT Gateway must be deployed in each Availability Zone of the staging VPC rather than relying on a single NAT Gateway.

Step-by-Step Solution

1
Deploy Route 53 Resolver Inbound Endpoints in the staging VPC and point the on-premises DNS forwarders to them.
On-premises source servers can successfully resolve the private DNS names for the MGN control plane interface endpoints.
On-premises servers must resolve the private IP addresses of the VPC endpoints to register with the MGN control plane.
2
Configure security groups on the Interface VPC Endpoints to allow inbound traffic on TCP port 443443 from the on-premises subnets.
The MGN agents installed on the on-premises servers can successfully register with the MGN service control plane.
Agent registration requires HTTPS access (TCP port 443443) to the MGN control plane endpoints.
3
Allow inbound traffic on TCP port 15001500 in the replication staging area security groups and on-premises firewalls.
The replication agents can stream block-level data to the replication servers in the staging VPC, resolving the stalled replication status.
MGN uses TCP port 15001500 for the continuous replication of disk data blocks from source servers to staging area replication servers.
4
Deploy a NAT Gateway in each Availability Zone of the staging VPC and configure the private route tables accordingly.
The staging area resources have highly available and redundant outbound paths to the internet, eliminating a single point of failure.
A single NAT Gateway creates a single point of failure if its Availability Zone goes offline, disrupting egress traffic from other zones.

Key Concept

Configuring private data replication, hybrid DNS resolution, and multi-AZ egress redundancy for AWS Application Migration Service (MGN)
Question 1552Question →

A Solutions Architect is migrating an on-premises Microsoft SQL Server database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The schema conversion has been completed using the AWS Schema Conversion Tool (SCT). The architect configures an AWS Database Migration Service (DMS) task with Change Data Capture (CDC) for ongoing replication. During testing, the architect notices that updates and deletes on several source tables are not being replicated to the target Aurora DB cluster, while inserts are successfully replicated. Which of the following is the most likely cause of this behavior, and the correct resolution?

Show answer & explanation

Answer: The affected tables lack a primary key or a unique index, which limits AWS DMS to replicating only INSERT statements during CDC. The architect must define a primary key or a unique index on these tables in the source database.

Answer

The affected tables lack a primary key or a unique index, which limits AWS DMS to replicating only INSERT statements during CDC. The architect must define a primary key or a unique index on these tables in the source database.
The correct option is correct because AWS DMS has a specific replication limitation when using Microsoft SQL Server as a source: if a table does not have a primary key or a unique index, DMS can only replicate INSERT statements during Change Data Capture (CDC). Any UPDATE or DELETE operations on these tables are silently ignored. Defining a primary key or unique index on the source tables resolves this limitation.

Step-by-Step Solution

1
Identify the tables in the source SQL Server database that are experiencing missing update and delete replication during the Change Data Capture (CDC) phase.
A list of source tables lacking primary keys or unique indexes is identified.
AWS DMS requires a primary key or unique index to track and apply row-level UPDATE and DELETE operations during CDC on SQL Server databases.
2
Define a primary key or a unique index on each of the identified tables in the source SQL Server database.
Each table now has a unique identifier for its rows.
This allows the AWS DMS task to generate and execute the corresponding UPDATE and DELETE statements on the target PostgreSQL database.
3
Restart the AWS DMS task to ensure changes are correctly read and applied.
The DMS CDC phase successfully replicates INSERT, UPDATE, and DELETE operations to the Amazon Aurora PostgreSQL DB cluster.
Once the source tables have unique identifiers, DMS can map the transaction log changes to the target rows.

Key Concept

AWS DMS Change Data Capture (CDC) limitations with SQL Server source databases.
Question 1553Question →

A company hosts a public web application behind an Application Load Balancer (ALB). To protect the application from SQL injection and HTTP flood attacks, the security team associated an AWS WAF WebACL with the ALB. The WebACL contains 33 rules:

1. A rate-based rule to block clients exceeding 20002{}000 requests per 55 minutes.
2. A custom rule to block requests containing SQL injection patterns in the URI.
3. A rule that allows all traffic matching a specific API key header used by partner integrations.

During a simulated attack, security audits show that partner integrations sending requests with the API key header are successfully executing SQL injection attacks, and some partner IPs are overwhelming the application with HTTP floods.

Which configuration change should the Solutions Architect recommend to resolve this security vulnerability?

Show answer & explanation

Answer: Reorder the WebACL rules so that the SQL injection block rule and the rate-based block rule are evaluated before the rule that allows traffic matching the API key header.

Answer

The correct solution is to reorder the WebACL rules so that the SQL injection block rule and the rate-based block rule are evaluated before the rule that allows traffic matching the API key header.
AWS WAF processes rules in a WebACL sequentially from top to bottom. When a request matches a rule with a terminating action like Allow, evaluation immediately stops, and the request is forwarded to the backend. By placing the partner allow rule at the top, malicious requests containing the partner API key header bypassed both the SQL injection and rate-limiting rules. Moving the block rules to the top of the evaluation order ensures that all requests are inspected for threats and rate violations before any allow rule matches.

Step-by-Step Solution

1
Analyze how AWS WAF evaluates rules in a WebACL.
Identify that AWS WAF evaluates rules sequentially, and matching a rule with a terminating action like Allow stops the evaluation of subsequent rules.
This explains why requests matching the partner allow rule bypass the block rules.
2
Assess the current rule execution order.
Confirm that placing the allow rule first permits malicious requests containing the API key header to bypass the SQL injection and rate-limiting rules.
This pinpoints the architectural vulnerability in the current WebACL design.
3
Reorder rules to enforce security policies globally.
Place the block rules for SQL injection and rate limiting above the partner allow rule, ensuring that all traffic is filtered before being allowed.
This secures the ALB endpoints while preserving access for legitimate partner traffic.

Key Concept

AWS WAF rule evaluation order and terminating action behavior
Question 1554Question →

An enterprise needs to replicate changes from an on-premises Microsoft SQL Server instance to a target Amazon Aurora PostgreSQL DB cluster using AWS DMS. The SQL Server instance has Transparent Data Encryption (TDE) enabled. The migration team has already converted the database schema using the AWS Schema Conversion Tool (AWS SCT). To achieve a near-zero downtime cutover, the AWS DMS task must run with ongoing replication (CDC) enabled while keeping the source database encrypted.

What must the migration team configure to enable the AWS DMS replication task to decrypt and read the source transaction logs during CDC?

Show answer & explanation

Answer: Export the TDE certificate and private key from the SQL Server source, import them into the AWS DMS certificate store, and associate the certificate ARN with the source endpoint.

Answer

Export the TDE certificate and private key from the SQL Server source, import them into the AWS DMS certificate store, and associate the certificate ARN with the source endpoint.
To perform ongoing replication (CDC) from an on-premises Microsoft SQL Server source database that has Transparent Data Encryption (TDE) enabled, AWS DMS must have access to the certificate and private key used to encrypt the database. This allows AWS DMS to decrypt the transaction logs during replication. The migration team must export the TDE certificate and private key, import them into the AWS DMS certificate store, and associate the certificate ARN with the source endpoint. In addition, the DMS user must have the necessary permissions (such as `db_owner` or `sysadmin` role) to access the transaction logs.

Step-by-Step Solution

1
Export the SQL Server TDE certificate and its private key from the source SQL Server database.
Obtained the TDE certificate file and private key file.
AWS DMS requires these files to decrypt the transaction logs.
2
Import the certificate into the AWS DMS certificate store using the AWS DMS console or the `aws dms import-certificate` CLI command.
A certificate resource is created in AWS DMS and assigned an Amazon Resource Name (ARN).
This registers the decryption key within the DMS service catalog so it can be associated with endpoints.
3
Configure the AWS DMS source database endpoint, referencing the imported certificate ARN, and verify that the database user used by DMS has `db_owner` or `sysadmin` permissions.
The source endpoint is associated with the decryption keys and the DMS task starts replication.
This allows the DMS replication instance to decrypt and read the transaction logs on the fly during the CDC phase.

Key Concept

AWS DMS CDC replication from a TDE-encrypted Microsoft SQL Server source requires importing the TDE certificate and private key into the AWS DMS certificate store and associating it with the source endpoint.
Question 1555Question →

CareFlow Systems is modernizing its legacy patient registration API by migrating it from on-premises servers to AWS. The solution will run on Amazon ECS using AWS Fargate across three Availability Zones (AZs) in a single VPC. The application requires outbound internet access to contact third-party medical validation services and must also securely access a legacy database located in the on-premises datacenter via an AWS Direct Connect connection. The database endpoint must be resolved using a private DNS domain hosted in a shared services VPC in a different AWS account within the organization. Which network and container configuration should a solutions architect recommend to satisfy these requirements with high availability?

Show answer & explanation

Answer: Configure the Amazon ECS tasks to use the awsvpc network mode. Deploy a NAT Gateway in a public subnet in each of the three Availability Zones. Associate the Route 53 Private Hosted Zone from the shared services account with the application VPC.

Answer

Configure the Amazon ECS tasks to use the awsvpc network mode, deploy a NAT Gateway in each Availability Zone, and associate the Route 53 Private Hosted Zone from the shared services account with the application VPC.
The correct architecture uses the awsvpc network mode, which is the only network mode supported by AWS Fargate. High availability is maintained for outbound internet traffic by deploying redundant NAT Gateways across all three Availability Zones, ensuring that a single zone failure does not impact the entire system. Private DNS resolution for the database domain is achieved by explicitly associating the Route 53 Private Hosted Zone from the shared services account with the VPC where the ECS tasks are running.

Step-by-Step Solution

1
Select the correct network mode for the Amazon ECS task definition on AWS Fargate.
Use the awsvpc network mode.
AWS Fargate only supports the awsvpc network mode, which allocates an Elastic Network Interface (ENI) to each task.
2
Design redundant outbound path configurations for high availability.
Deploy one NAT Gateway in each of the three Availability Zones.
Deploying a NAT Gateway in each zone ensures that an outage in one zone does not disrupt internet connectivity for tasks running in the remaining zones.
3
Enable DNS resolution for the cross-account database domain name.
Associate the Route 53 Private Hosted Zone hosted in the shared services account with the application VPC.
A Private Hosted Zone must be explicitly associated with any VPC that needs to resolve its DNS records, even if the VPCs belong to the same AWS Organization.

Key Concept

Architecting highly available container networking and private DNS resolution for AWS Fargate tasks.
Estimated Time:2m 0s
Question 1556Question →

ZetaDiagnostics is migrating its HIPAA-compliant medical image processing engine from an on-premises virtualized environment to AWS. The target architecture must run on AWS Fargate across three Availability Zones to minimize operational overhead. The workload VPC is connected to a central shared services VPC via AWS Transit Gateway. The containers must securely pull images from an Amazon Elastic Container Registry (Amazon ECR) repository located in the shared services VPC without traversing the public internet. Additionally, the Fargate tasks must retrieve encrypted clinical parameters from AWS Secrets Manager using a key managed in the shared services account. All internal DNS queries for ECR must resolve directly to the shared services VPC endpoints. Which combination of architectural steps will satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS task definition to use the awsvpc network mode. In the shared services account, associate the Route 53 Private Hosted Zone for the ECR VPC endpoints with the workload VPC. Update the ECR repository policy in the shared services account to grant the task execution role in the workload account permission to pull the container images.; Update the Secrets Manager secret resource policy and the KMS Customer Managed Key (CMK) key policy in the shared services account to grant retrieve and decrypt permissions to the workload task execution role. In the workload account, configure the task execution role with permissions to read the secret and decrypt using the CMK, and reference the cross-account secret ARN in the task container definition.

Answer

To implement this architecture, you must configure the ECS task definition to use the awsvpc network mode, associate the shared services Route 53 Private Hosted Zone for ECR with the workload VPC, and grant cross-account ECR repository permissions. Additionally, you must update the Secrets Manager secret policy and KMS Customer Managed Key key policy to trust the workload task execution role, and reference the cross-account secret ARN in the task container definition.
The correct solution steps resolve both ECR connectivity and Secrets Manager decryption constraints. First, AWS Fargate tasks strictly require the awsvpc network mode. For cross-account ECR access, the Route 53 Private Hosted Zone hosted in the shared services account must be associated with the workload VPC, allowing tasks to resolve ECR endpoints privately. The shared ECR repository policy must also permit the workload task execution role to pull images. Second, cross-account access to Secrets Manager requires a Customer Managed Key (CMK) because the default AWS-managed KMS key key policy cannot be edited to trust an external account. Both the secret policy and the CMK key policy in the shared services account must grant access to the workload account's task execution role, which is referenced in the container definition.

Step-by-Step Solution

1
Enforce AWS Fargate networking constraints by choosing the awsvpc network mode.
Task definitions are validated and can run on AWS Fargate.
AWS Fargate strictly supports only the awsvpc network mode.
2
Establish secure cross-account ECR DNS resolution and repository access.
The Fargate tasks resolve and pull images from ECR privately.
Associating the shared services Route 53 Private Hosted Zone with the workload VPC enables local DNS resolution of the ECR endpoints without internet traversal.
3
Enable cross-account Secrets Manager access using Customer Managed Keys.
The Fargate tasks successfully retrieve and decrypt sensitive parameters.
AWS-managed KMS keys do not support policy modification for cross-account access, necessitating a Customer Managed Key with explicit trust policies in the shared services account.

Key Concept

Cross-account container modernization using AWS Fargate, including awsvpc networking constraints, private ECR access over Route 53 PHZ associations, and cross-account Secrets Manager decryption using Customer Managed Keys (CMKs).
Question 1557Question →

A media streaming enterprise is migrating its legacy content transcoding and metadata processing cluster consisting of 3030 on-premises servers to AWS. The staging area VPC in AWS is connected to the on-premises environment using an AWS Direct Connect connection with a Transit Gateway. During the replication phase, the migration team observes that the AWS Application Migration Service (MGN) replication agent is installed on the on-premises servers, but the replication status remains stuck at 'Initiating' with a communication error. Additionally, in the target VPC, replica test instances launched in the private subnets are unable to download necessary packages from the internet during post-launch scripting, leading to failed test phases. Which two actions should the solutions architect take to resolve these issues and ensure a successful migration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Allow outbound traffic from the on-premises servers to the staging area subnets over TCP port 15001500, and configure the staging area security groups to allow inbound traffic on TCP port 15001500.; Deploy redundant NAT Gateways across multiple Availability Zones in the target VPC's public subnets, and configure the target private subnets' route tables to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the respective NAT Gateway in their zone.

Answer

The solutions architect should allow outbound traffic from on-premises to the staging area subnets over TCP port 15001500 (with corresponding inbound security group rules) and deploy redundant NAT Gateways across public subnets in the target VPC, configuring target private subnets to route outbound traffic through their respective regional NAT Gateway.
The AWS Application Migration Service (MGN) agent requires TCP port 15001500 to send data replication blocks from on-premises servers to the staging area replication servers. In addition, post-launch testing of migrated instances in private subnets requires internet access to fetch packages, which is best achieved in a highly available manner using redundant NAT Gateways across public subnets.

Step-by-Step Solution

1
Update local firewalls and AWS Security Groups associated with the staging area replication instances to permit replication traffic.
Established TCP port 15001500 connectivity between the on-premises source servers and the replication instances.
This allows the replication agent to push data blocks securely to AWS and resolves the 'Initiating' status hang.
2
Deploy highly available NAT Gateways across all public subnets in the target VPC and route private subnet outbound traffic to them.
Highly available outbound internet connectivity is established for target instances in private subnets.
This enables post-launch script execution on target instances to fetch external update packages without creating a single point of failure.

Key Concept

AWS MGN network requirements (port 1500) and highly available target VPC routing for post-launch execution.
Question 1558Question →

An enterprise has a multi-tier application deployed across two VPCs in the same AWS Region: a production VPC and a shared services VPC. The production VPC has private subnets across two Availability Zones hosting a fleet of Amazon EC2 instances that process approximately 600 TB600\text{ TB} of data monthly. This data includes high-volume exchanges with the shared services VPC via an AWS Transit Gateway, as well as read/write operations to Amazon S3 and Amazon DynamoDB. Currently, all outbound traffic, including S3 and DynamoDB traffic, is routed through two active NAT Gateways (one in each Availability Zone) in the production VPC. The enterprise needs to reduce its data transfer and processing costs while maintaining high availability and avoiding any application code changes. Which of the following architectural changes should the Solutions Architect recommend to achieve these goals cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create VPC gateway endpoints for Amazon S3 and Amazon DynamoDB in the production VPC and associate them with the private subnet route tables.; Establish a VPC Peering connection between the production VPC and the shared services VPC, and update the private subnet route tables to route inter-VPC traffic through this connection.

Answer

Create VPC gateway endpoints for Amazon S3 and Amazon DynamoDB in the production VPC and associate them with the private subnet route tables, and establish a VPC Peering connection between the production VPC and the shared services VPC, and update the private subnet route tables to route inter-VPC traffic through this connection.
The correct options recommend establishing VPC gateway endpoints for Amazon S3 and Amazon DynamoDB, and setting up a VPC Peering connection between the two VPCs. Implementing VPC gateway endpoints routes S3 and DynamoDB traffic directly from the private subnets without going through the NAT Gateways, eliminating the 0.045/GBNATGatewaydataprocessingfee.SettingupaVPCPeeringconnectionfortrafficbetweentheproductionVPCandthesharedservicesVPCavoidsthe0.045/GB NAT Gateway data processing fee. Setting up a VPC Peering connection for traffic between the production VPC and the shared services VPC avoids the 0.02/GB AWS Transit Gateway data processing charges, as same-Region VPC Peering does not charge data processing fees. Together, these steps optimize data transfer costs while maintaining a highly available, multi-AZ setup without requiring application code changes.

Step-by-Step Solution

1
Analyze the sources of data transfer costs in the current architecture.
Identify that 600 TB600\text{ TB} of traffic is passing through NAT Gateways and Transit Gateway, incurring significant data processing charges (0.045/GBforNATGatewayand0.045/GB for NAT Gateway and 0.02/GB for Transit Gateway).
To optimize costs, we must address the highest contributors to the bill: the S3/DynamoDB traffic passing through NAT Gateways, and the inter-VPC traffic passing through Transit Gateway.
2
Evaluate S3 and DynamoDB data paths for cost reduction.
Recommend creating VPC gateway endpoints for S3 and DynamoDB in the production VPC.
Gateway endpoints route traffic directly to S3 and DynamoDB without passing through NAT Gateways, eliminating the $0.045/GB NAT Gateway processing fee. Since gateway endpoints are free, this provides immediate and complete savings for this traffic flow.
3
Evaluate the inter-VPC data path for cost reduction.
Recommend establishing a VPC Peering connection between the production VPC and the shared services VPC.
Transit Gateway charges $0.02/GB for data processing. Setting up VPC Peering within the same Region eliminates these processing fees because VPC Peering traffic incurs no processing costs, only standard intra-Region data transfer costs if crossing Availability Zones.

Key Concept

Minimizing data transfer and processing costs by replacing Transit Gateway with VPC Peering for intra-Region traffic and using VPC gateway endpoints for S3 and DynamoDB to bypass NAT Gateways.
Question 1559Question →

A subscription-based meal kit delivery service manages its weekly menu offerings and customer delivery preferences. During the weekly menu release window, the application experiences a significant spike in read requests as customers view the new options. The backend database is an Amazon RDS for PostgreSQL Multi-AZ DB instance. During these peak hours, the DB instance experiences high CPU utilization, leading to delayed response times. The menu data is updated once a week, but the cached database queries must be highly available and support automatic failover across multiple Availability Zones to prevent downtime. Which of the following database and caching strategies should the Solutions Architect implement to resolve the performance bottleneck while meeting the availability requirements?

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover enabled. Configure the application to cache the menu data using a cache-aside strategy.

Answer

Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover enabled, and configure the application to cache the menu data using a cache-aside strategy.
The correct strategy is to deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover. Redis supports replication and failover features, ensuring that the cached query results remain highly available across multiple Availability Zones. Implementing a cache-aside pattern allows the application to offload the read-heavy traffic from the RDS database during peak times.

Step-by-Step Solution

1
Analyze the workload requirements and identify that the menu data is semi-static (updated weekly) and read-heavy.
Caching is identified as the optimal pattern to offload query load from the database.
Since the data changes infrequently, caching prevents repetitive query execution on the relational database.
2
Evaluate caching engines (Redis vs Memcached) against the high availability and automatic failover constraints.
Amazon ElastiCache for Redis is selected because it supports replication groups, Multi-AZ, and automatic failover.
Memcached does not support replication or automatic failover across Availability Zones.
3
Select the caching strategy (cache-aside) to interface between the application, cache, and database.
The application checks the cache first, and queries the database only on a cache miss, writing the result back to the cache.
This pattern is standard for read-heavy workloads where the application handles cache misses gracefully.

Key Concept

Selecting the appropriate in-memory caching engine (Redis vs Memcached) based on replication and high availability requirements.

Alternative Method

For applications with strict microsecond response requirements and complex query patterns, migrating to Amazon Aurora and utilizing Aurora Replicas with Auto Scaling could be a database-level scaling alternative, though an in-memory cache remains more cost-effective and efficient for static data.
Estimated Time:2m 30s
Question 1560Question →

A financial services enterprise is planning to migrate a customer portal application suite to AWS as part of a datacenter decommissioning initiative. The migration must be completed within 6 months. The application suite consists of two primary components:

1. A legacy .NET web application running on Windows IIS servers. The enterprise wants to migrate the application to a managed container service to eliminate operating system administrative overhead, without modifying the application source code.
2. A critical transaction database running on Oracle Database Enterprise Edition. The database contains complex PL/SQL stored procedures. The enterprise wants to eliminate high licensing costs by migrating to a fully managed open-source cloud database on AWS.

Which of the following migration strategy mappings should the solutions architect select to meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Replatform the legacy .NET web application by containerizing it to run on Amazon ECS on AWS Fargate.; Refactor the Oracle database by converting the schema and PL/SQL code to Amazon Aurora PostgreSQL.

Answer

The correct strategies are to replatform the legacy .NET web application by containerizing it to run on Amazon ECS on AWS Fargate, and to refactor the Oracle database by converting the schema and PL/SQL code to Amazon Aurora PostgreSQL.
The option suggesting containerizing the legacy .NET application to run on Amazon ECS on AWS Fargate is correct because it implements a Replatform strategy by shifting the platform runtime to containers to minimize administrative overhead without rewriting the application code. The option suggesting migrating the Oracle database to Amazon Aurora PostgreSQL is correct because it represents a Refactor strategy since changing the database engine to open-source Aurora PostgreSQL requires schema translation and code rewrites.

Step-by-Step Solution

1
Determine the migration strategy for the legacy .NET web application.
Since the application runtime is shifted to a managed container service (Amazon ECS on AWS Fargate) to reduce OS administrative overhead without code changes, this falls under Replatforming (Lift, tinker, and shift).
Replatforming optimizes the platform runtime environment while keeping the core application architecture and code intact.
2
Determine the migration strategy for the Oracle database.
Since the database engine is changing from Oracle to Aurora PostgreSQL to eliminate licensing fees, requiring schema conversion and code rewrite of stored procedures, this falls under Refactoring (Re-architecting).
Refactoring is required because changing database engines requires converting proprietary code (PL/SQL to PL/pgSQL) and making application-level adjustments.
3
Match these conclusions to the provided options.
The options proposing Replatforming the .NET application to ECS on Fargate and Refactoring the Oracle database to Aurora PostgreSQL are the correct mappings.
These choices align with the definitions of the 7 Rs migration framework.

Key Concept

Applying the 7 Rs migration framework to align application workloads and database targets with operational and licensing goals.
PreviousPage 78 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin