All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

AeroTelemetry Systems is modernizing its on-premises SCADA telemetry pipeline by migrating its ingestion microservices to an Amazon EKS cluster. Due to strict data residency regulations and sub- $10\text{ ms}$ latency requirements for local factory machinery, the EKS worker nodes are deployed on an AWS Outposts rack in the local facility, while the EKS control plane is hosted in the parent AWS Region. The ingestion pods running on the Outposts nodes must securely and privately connect to an Amazon Aurora PostgreSQL database located in a database VPC within the parent Region. An Amazon Route 53 Private Hosted Zone (PHZ) for 'telemetry-db.internal' is hosted in a central shared services AWS account. The EKS Outposts VPC and the database VPC are connected via an AWS Transit Gateway. The system must maintain an SLA of $99.99\%$ ingestion availability, survive WAN connectivity drops of up to $2\text{ hours}$ to the parent AWS Region without failing local DNS resolution, and comply with data residency standards that prohibit telemetry data transit over the public internet. Which architecture meets these requirements while ensuring local DNS resilience and private connectivity?

Authorize and associate the Private Hosted Zone 'telemetry-db.internal' in the shared services account with the EKS Outposts VPC. Deploy a Route 53 Resolver on Outposts in the EKS Outposts VPC. Configure the CoreDNS ConfigMap in the EKS cluster to forward DNS queries for 'telemetry-db.internal' to the Route 53 Resolver on Outposts endpoint, and configure Transit Gateway static routes to route database-bound traffic between the EKS Outposts VPC and the database VPC.

Create Route 53 Resolver inbound endpoints in the shared services VPC and outbound endpoints in the EKS Outposts VPC. Set up a Route 53 Resolver forwarding rule in the EKS Outposts VPC to forward queries for 'telemetry-db.internal' to the inbound endpoints in the shared services account over Transit Gateway, and configure Transit Gateway static routes to route database-bound traffic.

Authorize and associate the Private Hosted Zone 'telemetry-db.internal' in the shared services account with the EKS Outposts VPC. Deploy a Route 53 Resolver on Outposts in the EKS Outposts VPC. Configure the CoreDNS ConfigMap in the EKS cluster to forward DNS queries to the Route 53 Resolver on Outposts endpoint. Connect the EKS Outposts VPC and the database VPC to an AWS Direct Connect Gateway directly to enable transitive VPC-to-VPC routing for database traffic, bypassing the Transit Gateway.

Deploy an AWS Fargate profile on EKS to run the ingestion pods on the Outposts rack, configuring the tasks with the 'bridge' network mode to minimize VPC IP address consumption. Authorize and associate the Private Hosted Zone 'telemetry-db.internal' in the shared services account with the EKS Outposts VPC. Set up a Route 53 Resolver on Outposts to handle DNS queries locally, and configure Transit Gateway static routes to route database-bound traffic.

Show answer & explanation

Answer: Authorize and associate the Private Hosted Zone 'telemetry-db.internal' in the shared services account with the EKS Outposts VPC. Deploy a Route 53 Resolver on Outposts in the EKS Outposts VPC. Configure the CoreDNS ConfigMap in the EKS cluster to forward DNS queries for 'telemetry-db.internal' to the Route 53 Resolver on Outposts endpoint, and configure Transit Gateway static routes to route database-bound traffic between the EKS Outposts VPC and the database VPC.

Answer

The correct option is the one that authorizes the private hosted zone in the shared services account, associates it with the EKS Outposts VPC, deploys a Route 53 Resolver on Outposts to ensure local DNS resolution during WAN outages, and utilizes Transit Gateway for private cross-VPC routing.

The correct option is correct because Route 53 Resolver on Outposts provides local DNS caching and resolution within the Outpost environment, ensuring that the EKS pods can resolve the database domain even during a WAN link failure to the parent Region. Associating the cross-account Private Hosted Zone directly with the EKS Outposts VPC enables local resolution of the private DNS name. Transit Gateway static routing allows secure, private cross-VPC communication between the Outposts VPC and the database VPC.

Step-by-Step Solution

Enable cross-account VPC association for the Route 53 Private Hosted Zone.

The EKS Outposts VPC can be associated with the 'telemetry-db.internal' hosted zone from the shared services account.

Private Hosted Zones must be explicitly authorized and associated to VPCs across accounts to allow resolution of private domain names.

Deploy Route 53 Resolver on Outposts in the EKS Outposts VPC and point CoreDNS to its endpoint.

Pods resolve DNS queries locally on the Outposts hardware, cache results, and maintain resolution capabilities during WAN outages.

Outposts require a local resolver to satisfy sub-

10\text{ ms}

latency and survive parent Region connectivity drops.

Configure Transit Gateway routing between the EKS Outposts VPC and the Database VPC.

Network packets route privately over AWS networks without using the public internet.

Transit Gateway is required to establish private VPC-to-VPC communication.

Key Concept

Local VPC DNS resolution and private cross-account container communication on AWS Outposts.

Alternative Method

Alternatively, Route 53 Resolver endpoints can be deployed locally on AWS Outposts to resolve DNS queries from on-premises clients, but for pods inside the EKS cluster running in the VPC, using the Local VPC Resolver (Route 53 Resolver on Outposts) is the standard and most resilient method.

Estimated Time:3m 0s

Question 1582Question →

A real-time ride-sharing application tracks driver availability and active passenger sessions. The backend database is an Amazon RDS for PostgreSQL DB instance. During rush hours, the platform experiences a massive surge in read queries from passengers searching for nearby driver metadata and viewing their active trip statuses. This surge causes database CPU utilization to spike to $95\%$ , resulting in dispatch delays. The passenger session data must be cached with sub-millisecond latency, must survive cache node failures, and must be replicated across multiple Availability Zones. Additionally, the database read load must be optimized.

Which two actions should a solutions architect take to resolve these bottlenecks and satisfy the high availability requirements? (Select TWO.)

Select all that apply

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled, and configure the application to cache passenger session data.

Deploy Amazon RDS Read Replicas, and configure the application to direct read-heavy queries for nearby driver metadata to the read replica endpoints.

Deploy an Amazon ElastiCache for Memcached cluster across multiple Availability Zones, and configure the application to cache passenger session data.

Enable Multi-AZ deployment on the primary RDS for PostgreSQL DB instance, and configure the application to route read queries for driver metadata to the standby replica.

Configure a single-node Amazon ElastiCache for Redis cluster, and implement a pilot light disaster recovery strategy in a secondary Availability Zone to replicate cached session data.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled, and configure the application to cache passenger session data.; Deploy Amazon RDS Read Replicas, and configure the application to direct read-heavy queries for nearby driver metadata to the read replica endpoints.

Answer

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled to store active passenger sessions, and deploy Amazon RDS Read Replicas to offload read-heavy driver metadata queries from the primary database.

Caching passenger session data in an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover ensures that sub-millisecond latency requirements are met and that the cache survives node failures through automated replication and failover. Offloading read-heavy queries for driver metadata to Amazon RDS Read Replicas directly reduces the CPU utilization on the primary DB instance, resolving the performance bottleneck.

Step-by-Step Solution

Analyze the database bottleneck and caching requirements.

Identified that active passenger session data requires low-latency access, high availability, and replication to survive node failures, while driver metadata queries are causing high CPU utilization.

This analysis determines the architectural constraints for caching and database scalability.

Select the appropriate caching solution.

Chose Amazon ElastiCache for Redis with Multi-AZ and automatic failover over Memcached.

Redis supports Multi-AZ replication and failover, fulfilling the high availability requirements for session data, whereas Memcached lacks replication and data would be lost upon node failure.

Select the database scaling strategy.

Chose RDS Read Replicas to offload read-heavy driver metadata queries.

Read replicas horizontally scale read-heavy traffic and reduce primary DB CPU load, whereas Multi-AZ standby instances cannot serve read traffic.

Key Concept

Selecting ElastiCache for Redis for highly available replicated caching, and using RDS Read Replicas instead of Multi-AZ standby instances to scale read queries.

Question 1583Question →

A Solutions Architect is planning the heterogeneous database migration of an on-premises Oracle 19c database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The source database supports a critical OLTP application experiencing a high volume of transactions, exceeding $12,000$ write transactions per second. The schema contains complex PL/SQL objects, standard relational tables, and several tables containing Large Binary Objects (LOBs) up to $5\text{ MB}$ in size. The migration must minimize downtime for the cutover, maintain high replication performance without degrading the source database's CPU utilization, and guarantee that LOB data is not truncated.

Which two actions must the Solutions Architect take to configure the migration components successfully? (Select two.)

Select all that apply

Configure the AWS DMS source endpoint with extra connection attributes to use the AWS DMS Binary Reader instead of Oracle LogMiner to process redo and archive logs directly from the file system.

Configure the AWS DMS replication task to use Limited LOB mode with a Max LOB size of

1,024\text{ KB}

to optimize initial transfer speed, allowing DMS to automatically query the source database to fetch the remaining LOB content exceeding this limit during replication.

Enable database-level minimal supplemental logging and table-level primary key supplemental logging on the source Oracle database before starting the replication task.

Install the AWS SCT agent on the source database server and configure it to stream real-time transaction changes directly to the target Aurora PostgreSQL DB cluster using PostgreSQL logical replication slots.

Enable Amazon Aurora Auto Scaling on the target DB cluster and configure the AWS DMS replication task to write directly to the Aurora Reader endpoint to distribute the write load across multiple read replicas.

Show answer & explanation

Answer: Configure the AWS DMS source endpoint with extra connection attributes to use the AWS DMS Binary Reader instead of Oracle LogMiner to process redo and archive logs directly from the file system.; Enable database-level minimal supplemental logging and table-level primary key supplemental logging on the source Oracle database before starting the replication task.

Answer

Configure the AWS DMS source endpoint to use the Binary Reader instead of LogMiner, and enable database-level minimal supplemental logging along with table-level primary key supplemental logging on the source Oracle database.

For high-volume transaction databases (exceeding 10,000 write TPS), using the default Oracle LogMiner API introduces severe CPU and memory overhead on the source database and can lead to lag in capturing changes. The Solutions Architect should use the AWS DMS Binary Reader, which reads the redo and archive logs directly from the file system. Furthermore, AWS DMS CDC requires minimal supplemental logging at the database level and table-level primary key supplemental logging to ensure the logs contain enough context to reproduce SQL statements on the target.

Step-by-Step Solution

Configure Oracle supplemental logging on the source database.

Database-level minimal supplemental logging and table-level primary key supplemental logging are enabled, which ensures update and delete events write full row identifiers to the redo logs.

Required for AWS DMS CDC to successfully parse and apply updates/deletes to target tables.

Set up extra connection attributes on the AWS DMS Oracle source endpoint to enable the AWS DMS Binary Reader.

DMS switches from using the Oracle LogMiner API to reading redo and archive log files directly from the directory structures.

Avoids the CPU overhead and performance limitations of the LogMiner API under transaction rates exceeding 10,000 TPS.

Configure target endpoint routing to the Aurora writer endpoint and select appropriate LOB replication tasks.

The replication task writes to the active writer and successfully processes LOBs up to 5 MB without truncation (either through Full LOB mode or configured Inline LOB settings).

Aurora Reader endpoints do not support writes, and Limited LOB mode with lower thresholds truncates data.

Key Concept

Heterogeneous migration from Oracle to Aurora PG with high throughput and LOB constraints requires bypassing LogMiner with DMS Binary Reader and enabling mandatory supplemental logging.

Question 1584Question →

A solutions architect is designing the migration of an on-premises 12 TB Oracle database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The source database supports a critical transactional application and experiences high write activity. The database contains several tables with Large Object (LOB) columns that store binary data up to 50 MB, alongside standard transactional tables. The migration strategy requires schema conversion and continuous replication to minimize downtime during the cutover window.

During initial testing of the AWS Database Migration Service (DMS) Change Data Capture (CDC) replication task, the solutions architect observes significant replication lag and CPU spikes on both the source database server and the AWS DMS replication instance. Additionally, some updates are not being replicated to the target database.

Which combination of actions will resolve these performance and replication issues while maintaining the target replication SLA? (Select two.)

Select all that apply

Separate the tables containing large LOB columns into a dedicated AWS DMS task configured with Full LOB mode, while configuring the main task for all other tables to use Limited LOB mode with a maximum LOB size threshold.

Set the AWS DMS replication task to use Oracle LogMiner for high-performance log analysis, and disable supplemental logging to reduce the CPU overhead on the source database.

Enable supplemental logging at the table level only for tables with LOBs, and run a single AWS DMS replication task with Full LOB mode enabled for all tables to ensure transaction consistency.

Use the AWS Schema Conversion Tool (SCT) to automatically convert all LOB columns to PostgreSQL JSONB data types, and run the replication task without enabling ARCHIVELOG mode on the source database.

Show answer & explanation

Answer: Configure the AWS DMS replication task to use the AWS DMS Binary Reader to read the redo logs directly from the source Oracle database, and verify that supplemental logging is enabled at both the database level and table level for all replicated tables.; Separate the tables containing large LOB columns into a dedicated AWS DMS task configured with Full LOB mode, while configuring the main task for all other tables to use Limited LOB mode with a maximum LOB size threshold.

Answer

Configure the AWS DMS replication task to use the AWS DMS Binary Reader to read the redo logs directly from the source Oracle database, and verify that supplemental logging is enabled at both the database level and table level for all replicated tables. Also, separate the tables containing large LOB columns into a dedicated AWS DMS task configured with Full LOB mode, while configuring the main task for all other tables to use Limited LOB mode with a maximum LOB size threshold.

The correct combination of actions involves using the AWS DMS Binary Reader to reduce CPU overhead on the source Oracle database by reading redo logs directly, while ensuring that supplemental logging is fully enabled at the database and table levels to capture all changes. Additionally, separating the large LOB tables into their own task utilizing Full LOB mode prevents the main replication task (configured with Limited LOB mode) from being bottlenecked by the slow, row-by-row LOB lookup operations.

Step-by-Step Solution

Address source database resource consumption during Change Data Capture (CDC).

Configured AWS DMS to use Binary Reader instead of Oracle LogMiner.

Binary Reader reads redo log files directly, reducing the CPU impact on the source Oracle database instance.

Ensure all transactional updates are captured by the CDC task.

Enabled supplemental logging at both the database level and table level on the source database.

Without proper supplemental logging, AWS DMS cannot extract the complete data required to construct replication statements, resulting in skipped updates.

Optimize replication throughput for tables containing Large Objects (LOBs).

Split the migration into two tasks: one for LOB tables using Full LOB mode, and one for other tables using Limited LOB mode.

Replicating LOBs in Full LOB mode requires querying the source table row-by-row, which slows down the task. Isolating LOB tables prevents them from bottlenecking the main transactional replication flow.

Key Concept

AWS DMS performance tuning and prerequisite configuration for Oracle CDC migration, specifically supplemental logging, Binary Reader vs LogMiner, and LOB handling strategies.

Estimated Time:3m 0s

Question 1585Question →

A media company hosts a live video commentating platform on Amazon EC2 instances inside an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The instances require 7 minutes to download application dependencies and initialize the service before passing target group health checks. During sudden high-profile broadcasts, traffic surges instantly, causing the ALB to return multiple HTTP 503 Service Unavailable errors. In addition, the ASG launches far more instances than necessary during these spikes, resulting in high resource over-provisioning costs. All outbound traffic from the instances is routed via a single NAT Gateway located in a single public subnet. The architecture must be modified to prevent HTTP 503 errors, prevent instance over-provisioning, and remove any single points of failure for outbound traffic. Which combination of architectural modifications will resolve these issues?

Deploy a NAT Gateway in each Availability Zone where application instances reside, request ALB pre-warming from AWS Support prior to the scheduled live events, and configure the Auto Scaling Group scaling policy cooldown or warm-up period to 480 seconds.

Keep the single NAT Gateway in a single public subnet to reduce operational costs, request ALB pre-warming from AWS Support prior to the scheduled live events, and configure the Auto Scaling Group scaling policy cooldown or warm-up period to 120 seconds.

Deploy a NAT Gateway in each Availability Zone where application instances reside, rely on the default Application Load Balancer auto-scaling behavior to handle the sudden traffic spikes, and configure the Auto Scaling Group scaling policy cooldown or warm-up period to 480 seconds.

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone where application instances reside, request ALB pre-warming from AWS Support prior to the scheduled live events, and configure the Auto Scaling Group scaling policy cooldown or warm-up period to 480 seconds.

Answer

The correct option addresses all design constraints. Deploying a NAT Gateway in each Availability Zone ensures outbound internet routing is redundant across zones. Requesting ALB pre-warming allows the load balancer to handle flash traffic immediately without dropping packets. Configuring a 480-second scaling cooldown/warm-up period allows the new instances up to 8 minutes to boot and start serving traffic before another scaling action is evaluated, preventing capacity over-provisioning.

Step-by-Step Solution

Address outbound traffic fault tolerance.

Identify that the single NAT Gateway is a single point of failure, requiring deployment of a NAT Gateway in each Availability Zone.

Outbound traffic must be highly available and resilient to Availability Zone outages.

Address flash traffic scaling issues on the load balancer.

Request ALB pre-warming from AWS Support prior to scheduled events.

Default ALB auto-scaling is gradual and cannot cope with instantaneous traffic surges, which leads to HTTP 503 errors.

Address Auto Scaling Group over-provisioning due to instance boot latency.

Configure the ASG scaling policy cooldown or warm-up period to 480 seconds.

Setting the cooldown/warm-up period to be longer than the 7-minute (420-second) boot time prevents the ASG from launching additional instances before the previously launched instances become healthy and contribute to CPU reduction.

Key Concept

Configuring resilient multi-AZ architectures with appropriate scaling cooldown thresholds to match instance bootstrap latency, alongside pre-warming load balancers for scheduled traffic spikes.

Question 1586Question →

A company is modernizing its application by migrating legacy APIs to Amazon API Gateway and AWS Lambda. The system consists of a high-volume telemetry ingestion endpoint and a critical payment processing endpoint, both running in the same AWS account and Region. During performance testing, a massive surge in telemetry traffic causes the payment processing Lambda function to be throttled with HTTP 429 errors. Which configuration change will guarantee that the payment processing function has dedicated execution capacity?

Configure a linear deployment strategy in AWS CodeDeploy to route traffic gradually to the payment processing Lambda function.

Rely on the regional unreserved concurrency pool and increase the account-level concurrency limit via AWS Support.

Configure reserved concurrency specifically for the payment processing Lambda function.

Configure an AWS-managed KMS key to encrypt the environment variables and payload of the payment processing Lambda function.

Show answer & explanation

Answer: Configure reserved concurrency specifically for the payment processing Lambda function.

Answer

Configure reserved concurrency specifically for the payment processing Lambda function.

Configuring reserved concurrency for a Lambda function guarantees that a specific number of concurrent executions are set aside exclusively for that function. This prevents other high-volume functions (like the telemetry function) from exhausting the regional concurrency pool and throttling the critical payment processing function.

Step-by-Step Solution

Analyze the cause of the throttling.

The payment processing Lambda function is being throttled because the high-volume telemetry Lambda function is consuming all available concurrency in the shared regional account pool.

By default, all functions in a Region share a common concurrency pool, and an unconfigured function can consume all executions.

Determine the correct Lambda configuration to isolate execution capacity.

Reserved concurrency must be allocated to the payment processing function.

Reserved concurrency reserves a dedicated portion of the account concurrency limit specifically for that function, preventing other functions from exhausting it.

Key Concept

Lambda Reserved Concurrency prevents resource exhaustion by allocating dedicated execution capacity to critical functions.

Question 1587Question →

Vortex Logistics is modernizing its legacy fleet tracking and dispatch application by migrating it to AWS. The application consists of several microservices that will be deployed on Amazon ECS using the AWS Fargate launch type. The tasks must be distributed across three Availability Zones in private subnets. The microservices must download dynamic compliance lists from the public internet and resolve hostnames for an internal inventory service hosted in a shared-services AWS account via a Route 53 Private Hosted Zone (PHZ) named `inventory.internal`. All Fargate tasks must run in isolated network environments without public IP addresses to comply with strict security policies. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Configure the ECS task definition to use `awsvpc` network mode. When creating the ECS service, assign the tasks to the private subnets and set the `AssignPublicIp` parameter to `DISABLED` to prevent direct public internet access.

Associate the Route 53 Private Hosted Zone `inventory.internal` from the shared-services account with the application VPC, and ensure that both `enableDnsHostnames` and `enableDnsSupport` are set to `true` on the application VPC.

Configure the ECS task definition to use `bridge` network mode to enable dynamic port mapping and allow the tasks to bind to the host network interface of the Fargate infrastructure.

Create a duplicate Private Hosted Zone `inventory.internal` in the application account and deploy Route 53 Resolver outbound endpoints in the application VPC to forward internal queries to a Resolver inbound endpoint in the shared-services VPC.

Deploy a single NAT Gateway in a single public subnet to optimize costs, and configure the route tables of all private subnets across the three Availability Zones to route outbound internet traffic (

0.0.0.0/0

) to this NAT Gateway.

Show answer & explanation

Answer: Configure the ECS task definition to use `awsvpc` network mode. When creating the ECS service, assign the tasks to the private subnets and set the `AssignPublicIp` parameter to `DISABLED` to prevent direct public internet access.; Associate the Route 53 Private Hosted Zone `inventory.internal` from the shared-services account with the application VPC, and ensure that both `enableDnsHostnames` and `enableDnsSupport` are set to `true` on the application VPC.

Answer

Configure the ECS task definition to use `awsvpc` network mode, run the tasks in the private subnets with `AssignPublicIp` disabled, and associate the shared-services Route 53 Private Hosted Zone with the application VPC while ensuring DNS support and hostnames are enabled.

AWS Fargate requires the `awsvpc` network mode. To run tasks in private subnets without public IP addresses, `AssignPublicIp` must be disabled, and outbound traffic must route through NAT Gateways. Cross-account Route 53 Private Hosted Zone association allows the VPC in the application account to resolve hostnames in the shared-services zone directly, provided that DNS hostnames and DNS support are enabled in the consumer VPC.

Step-by-Step Solution

Select the correct network mode for ECS Fargate.

Confirm that the task definition uses `awsvpc` network mode, as AWS Fargate does not support bridge or host network modes.

AWS Fargate requires `awsvpc` mode where each task receives its own elastic network interface (ENI).

Ensure network isolation for private tasks.

Launch ECS Fargate tasks within private subnets with the `AssignPublicIp` configuration disabled.

This prevents Fargate from assigning public IP addresses, maintaining strict compliance and isolation.

Enable cross-account internal name resolution.

Associate the Route 53 Private Hosted Zone `inventory.internal` from the shared-services account with the application VPC.

Direct association allows resources in the application VPC to resolve hostnames within the shared private hosted zone.

Verify VPC DNS settings.

Enable `enableDnsSupport` and `enableDnsHostnames` attributes on the application VPC.

Route 53 Private Hosted Zone resolution depends on these VPC attributes being enabled.

Key Concept

AWS ECS Fargate networking rules and cross-account Route 53 Private Hosted Zone association.

Estimated Time:3m 0s

Question 1588Question →

A company is modernizing a legacy application by refactoring its API into a serverless architecture using Amazon API Gateway and AWS Lambda. The backend will be accessed by Amazon EC2 instances residing in a private VPC subnet. The solutions architect must ensure that traffic between the EC2 instances and the API Gateway does not traverse the public internet, and that a sudden burst of requests to this specific Lambda function does not exhaust the regional concurrency pool, which would impact other critical workloads in the same AWS account. Which TWO configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Configure reserved concurrency for the AWS Lambda function.

Create an interface VPC endpoint for Amazon API Gateway in the VPC.

Configure provisioned concurrency for the AWS Lambda function.

Route outbound API traffic from the private subnet through a single NAT Gateway in a public subnet.

Enable a Canary deployment strategy in AWS CodeDeploy for the Lambda function.

Show answer & explanation

Answer: Configure reserved concurrency for the AWS Lambda function.; Create an interface VPC endpoint for Amazon API Gateway in the VPC.

Answer

Configuring reserved concurrency for the AWS Lambda function and creating an interface VPC endpoint for Amazon API Gateway in the VPC.

The correct configurations involve setting up an interface VPC endpoint for API Gateway to ensure traffic remains entirely within the AWS network without traversing the public internet, and configuring reserved concurrency on the Lambda function to cap its execution scale so that a burst in traffic does not deplete the account's shared regional concurrency limit.

Step-by-Step Solution

Evaluate the network routing requirement to ensure traffic does not traverse the public internet.

Identify that AWS PrivateLink interface VPC endpoints allow private connections to Amazon API Gateway endpoints from within a VPC.

An interface VPC endpoint allocates private IP addresses from the VPC subnets, enabling direct private communication with API Gateway.

Evaluate the concurrency limit requirement to protect the regional concurrency pool.

Identify that configuring reserved concurrency sets a dedicated and maximum concurrency limit on the specific Lambda function.

Reserved concurrency reserves a portion of the account's regional concurrency pool for the function and also acts as a ceiling, preventing the function from exceeding its allocation and throttling other workloads in the account.

Key Concept

Using AWS PrivateLink (interface VPC endpoints) for secure private API access, and AWS Lambda reserved concurrency to limit scaling and protect the AWS account's regional concurrency limit.

Question 1589Question →

A collaborative software-as-a-service (SaaS) platform hosts its workspace configuration data and active user session privileges on an Amazon RDS for MySQL DB instance. During core business hours, database CPU utilization reaches 92% due to a high volume of read-heavy queries that retrieve authorization metadata. To mitigate this bottleneck, a solutions architect must implement a caching layer. The cached session data must remain highly available, replicate across multiple Availability Zones, and survive cache node failures. Which solution meets these requirements?

Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover enabled.

Deploy an Amazon ElastiCache for Memcached cluster with nodes distributed across multiple Availability Zones.

Enable Multi-AZ on the existing Amazon RDS for MySQL DB instance and route the read-heavy metadata queries to the standby replica.

Deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache queries from the relational database tables.

Show answer & explanation

Answer: Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover enabled.

Answer

Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover enabled.

The correct solution uses Amazon ElastiCache for Redis with Multi-AZ and automatic failover enabled. Redis is the appropriate caching engine because it supports data replication across multiple Availability Zones, persistent data storage, and automated failover in the event of a primary node outage, ensuring the session data remains durable and highly available.

Step-by-Step Solution

Analyze the technical requirements of the caching layer.

The requirements demand high availability, multi-AZ replication, and the ability to survive node failures without data loss.

This establishes the criteria for selecting the appropriate caching engine and configuration.

Evaluate Amazon ElastiCache engine capabilities against requirements.

ElastiCache for Redis supports replication, multi-AZ with automatic failover, and data persistence. ElastiCache for Memcached lacks replication, auto-failover, and persistence.

Choosing the correct engine ensures compliance with high availability and data durability requirements.

Compare against database scaling alternatives.

RDS Multi-AZ standbys cannot serve read traffic, and DynamoDB Accelerator (DAX) is incompatible with RDS MySQL.

This rules out non-viable architectural configurations that fail to offload read traffic from the primary RDS instance.

Key Concept

Selecting and configuring ElastiCache engines based on replication and durability requirements

Estimated Time:2m 0s

Question 1590Question →

A biotechnology enterprise is designing a genomics research pipeline (File storage and OLTP workloads) that runs on Amazon EC2 instances across multiple Availability Zones in a single AWS Region. The pipeline has the following requirements:

- A shared file system that is POSIX-compliant, supports concurrent access from hundreds of EC2 instances, and scales throughput dynamically up to $3\text{ GB/s}$ during peak sequencing phases.
- A metadata database that must handle high-volume write and read queries with low latency.
- High availability with a Recovery Time Objective (RTO) of under $5\text{ minutes}$ and a Recovery Point Objective (RPO) of under $1\text{ minute}$ in the event of an Availability Zone outage.
- Securely share final sequencing output files, stored in Amazon S3, with a separate audit AWS account.

Which of the following database and storage strategies meets these requirements?

Deploy Amazon EFS with Elastic throughput for the shared file system. Deploy an Amazon Aurora PostgreSQL DB cluster with a writer instance and one or more Aurora Replicas across different Availability Zones, and configure Aurora Auto Scaling for the reader instances. Encrypt the S3 buckets for the sequencing output using an AWS KMS Customer Managed Key (CMK) and configure the key policy to allow access from the audit AWS account.

Deploy Amazon EFS with Elastic throughput for the shared file system. Deploy an Amazon RDS for PostgreSQL DB instance with a Multi-AZ deployment, and configure the application to route read queries to the standby replica to handle dynamic read scaling. Encrypt the S3 buckets using an AWS KMS Customer Managed Key (CMK) and configure the key policy to allow access from the audit AWS account.

Deploy Amazon EFS with Elastic throughput for the shared file system. Deploy an Amazon Aurora PostgreSQL DB cluster with a writer instance and one or more Aurora Replicas across different Availability Zones, and configure Aurora Auto Scaling for the reader instances. Encrypt the S3 buckets using the default AWS-managed KMS key (aws/s3) and configure the S3 bucket policy to grant read access to the audit AWS account.

Deploy Amazon EBS volumes with Multi-Attach enabled across the EC2 instances in different Availability Zones for the shared file system. Deploy an Amazon Aurora PostgreSQL DB cluster with a single writer instance, schedule daily DB snapshots, and copy them to the audit AWS account to satisfy disaster recovery and audit sharing requirements.

Show answer & explanation

Answer: Deploy Amazon EFS with Elastic throughput for the shared file system. Deploy an Amazon Aurora PostgreSQL DB cluster with a writer instance and one or more Aurora Replicas across different Availability Zones, and configure Aurora Auto Scaling for the reader instances. Encrypt the S3 buckets for the sequencing output using an AWS KMS Customer Managed Key (CMK) and configure the key policy to allow access from the audit AWS account.

Answer

Deploy Amazon EFS with Elastic throughput for the shared file system. Deploy an Amazon Aurora PostgreSQL DB cluster with a writer instance and Aurora Replicas across multiple Availability Zones with Auto Scaling. Use an AWS KMS Customer Managed Key (CMK) for cross-account S3 sharing.

The strategy using Amazon EFS with Elastic throughput satisfies the file storage requirements because it natively supports multi-AZ concurrent POSIX access and can scale throughput dynamically. Amazon Aurora PostgreSQL with Aurora Replicas and Auto Scaling provides high-performance reads and writes with failover times well under

5\text{ minutes}

and replication lag under

1\text{ minute}

. Finally, using a Customer Managed Key (CMK) allows updating the KMS key policy to permit the external audit account to decrypt objects, which is not possible with AWS-managed keys.

Step-by-Step Solution

Select the appropriate shared storage service.

Amazon EFS with Elastic throughput is selected because it supports POSIX compliance, concurrent access from hundreds of EC2 instances across multiple Availability Zones, and scales dynamically to handle

3\text{ GB/s}

throughput.

Alternative storage options like EBS Multi-Attach are confined to a single Availability Zone and cannot support Multi-AZ high availability.

Determine the database configuration that meets the RTO/RPO constraints.

An Amazon Aurora DB cluster with a primary writer and one or more reader replicas is chosen.

Aurora failover takes less than

120\text{ seconds}

(meeting the RTO of

5\text{ minutes}

) and uses synchronous physical replication within the cluster storage volume with near-zero replica lag (meeting the RPO of

1\text{ minute}

). Standard RDS Multi-AZ standbys cannot serve read traffic to handle scale.

Configure encryption and cross-account access for the shared S3 bucket.

Use an AWS KMS Customer Managed Key (CMK) for encryption and modify its key policy to grant decrypt permissions to the external audit account.

The default AWS-managed KMS key (aws/s3) cannot be shared across accounts as its key policy is immutable.

Key Concept

Designing highly available, scalable database and shared storage architectures that support strict RTO/RPO targets and secure cross-account resource sharing.

Question 1591Question →

An organization is launching a serverless backend using Amazon API Gateway and AWS Lambda. While the main API functions experience steady traffic, a specific administrative function executes bursty, resource-intensive import jobs. The team needs to prevent the bursty administrative function from degrading the performance of the main API functions, and they must implement a deployment strategy that allows safe, monitored rollbacks for new versions. Which TWO configurations should the solutions architect implement? (Select TWO.)

Select all that apply

Configure reserved concurrency on the administrative Lambda function to limit its maximum execution capacity and safeguard the account's unreserved concurrency pool.

Use AWS CodeDeploy to perform canary or linear deployments for the Lambda function versions to safely shift traffic and monitor rollback alarms.

Leave the administrative Lambda function's concurrency unconfigured to allow it to scale dynamically and consume the entire regional concurrency pool during import spikes.

Deploy a single, non-redundant NAT Gateway in one Availability Zone to handle all outbound traffic from the Lambda functions to the database, relying on route tables for high availability.

Use the default AWS-managed KMS key (aws/lambda) to encrypt the Lambda environment variables and modify its key policy to allow cross-account access for external consumers.

Show answer & explanation

Answer: Configure reserved concurrency on the administrative Lambda function to limit its maximum execution capacity and safeguard the account's unreserved concurrency pool.; Use AWS CodeDeploy to perform canary or linear deployments for the Lambda function versions to safely shift traffic and monitor rollback alarms.

Answer

The solutions architect should configure reserved concurrency on the administrative Lambda function and use AWS CodeDeploy to perform canary or linear deployments for the Lambda function versions.

Configuring reserved concurrency on the administrative Lambda function ensures it has a dedicated limit that it cannot exceed, which prevents it from exhausting the regional concurrency pool and throttling the main API functions. Additionally, using AWS CodeDeploy for canary or linear deployments provides a controlled environment where traffic is shifted gradually to new function versions and automatically rolled back if alarms are triggered.

Step-by-Step Solution

Isolate the bursty workload's resource usage by configuring reserved concurrency on the administrative Lambda function.

The administrative function is capped at a set concurrency limit, protecting the remaining regional pool for the steady-traffic main API functions.

This prevents regional throttling and ensures application reliability.

Integrate AWS CodeDeploy with the Lambda deployment pipeline to utilize canary or linear deployments.

Traffic is gradually shifted to the new version of the function while monitoring CloudWatch alarms.

This minimizes the blast radius of new deployments and enables automated rollbacks in case of errors.

Key Concept

Concurrency management and safe deployment strategies in serverless architectures

Question 1592Question →

A medical device company is designing a new AWS environment in the `eu-central-1` region. The architecture consists of a Production VPC (`vpc-prod-clinical`) and a Development VPC (`vpc-dev-clinical`), each deployed across two Availability Zones (AZ-A and AZ-B). The application workloads in the private subnets of both VPCs require highly available outbound internet access to download software patches. Additionally, the company needs to resolve internal API endpoints hosted in a Route 53 Private Hosted Zone (PHZ) named `clinical.internal` across both VPCs. Which two network design actions should the Solutions Architect recommend to satisfy these requirements while preventing single points of failure?

Select all that apply

Deploy a NAT Gateway in a public subnet in AZ-A and another NAT Gateway in a public subnet in AZ-B within the Production VPC, then configure the private subnet route tables to direct outbound traffic (

0.0.0.0/0

) to the NAT Gateway in their respective Availability Zones.

Deploy a single NAT Gateway in a public subnet in AZ-A of the Production VPC, and configure the route tables of private subnets in both AZ-A and AZ-B to route outbound traffic (

0.0.0.0/0

) to this NAT Gateway.

Associate the Route 53 Private Hosted Zone `clinical.internal` directly with both the Production VPC and the Development VPC from the AWS account owning the hosted zone.

Associate the Route 53 Private Hosted Zone only with the Production VPC, and deploy Route 53 Resolver inbound and outbound endpoints in each VPC to forward DNS queries from the Development VPC to the Production VPC.

Create an AWS Transit Gateway to connect the VPCs, and route all outbound internet traffic (

0.0.0.0/0

) from both VPC private subnets directly to the Transit Gateway without deploying NAT Gateways, relying on the Transit Gateway to route the traffic directly to the internet.

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet in AZ-A and another NAT Gateway in a public subnet in AZ-B within the Production VPC, then configure the private subnet route tables to direct outbound traffic ( $0.0.0.0/0$ ) to the NAT Gateway in their respective Availability Zones.; Associate the Route 53 Private Hosted Zone `clinical.internal` directly with both the Production VPC and the Development VPC from the AWS account owning the hosted zone.

Answer

Deploy a NAT Gateway in a public subnet in AZ-A and another in AZ-B within the Production VPC, configure private subnet route tables to direct outbound traffic to the NAT Gateway in their respective Availability Zones, and associate the Route 53 Private Hosted Zone directly with both VPCs.

The correct architecture uses one NAT Gateway in each Availability Zone within the VPC, with local routing configured to ensure high availability and prevent cross-AZ data charges. Additionally, Route 53 Private Hosted Zones support direct association with multiple VPCs, ensuring native cross-VPC DNS resolution without the overhead of Route 53 Resolver endpoints.

Step-by-Step Solution

Analyze outbound internet egress requirements for high availability.

Identify that a single NAT Gateway creates a single point of failure across Availability Zones. Multi-AZ deployment requires deploying a NAT Gateway in each AZ and modifying route tables so each private subnet utilizes the NAT Gateway in its local zone.

This guarantees that an AZ-level failure does not disrupt the internet connection of the other operational AZ.

Analyze Route 53 Private Hosted Zone resolution across multiple VPCs.

Recall that Route 53 Private Hosted Zones can be directly associated with multiple VPCs, even across different AWS accounts in the same organization.

Direct association allows DNS resolution to function natively within the VPCs without needing DNS forwarding rules or Route 53 Resolver endpoints.

Key Concept

High availability network design using multi-AZ NAT Gateways and native Route 53 Private Hosted Zone multi-VPC associations.

Question 1593Question →

A healthcare provider is migrating its core electronic health record (EHR) database and web application servers from a private virtualization host to AWS using AWS Application Migration Service (MGN). The migration must utilize a secure, private network path over a $10\text{ Gbps}$ AWS Direct Connect connection terminated at an AWS Transit Gateway. Outbound internet access from the source virtual machines is prohibited due to regulatory requirements, meaning both replication data and control plane API traffic must remain strictly inside the private network. The staging area subnets are located in a dedicated Staging VPC connected to the Transit Gateway. Which of the following configuration steps must the Solutions Architect perform to establish the replication and control paths? (Select TWO.)

Select all that apply

Configure the security groups associated with the Replication Servers in the Staging VPC to allow inbound replication traffic on TCP Port 1500 from the on-premises source subnets, and ensure the on-premises firewall allows outbound traffic on TCP Port 1500.

Create Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN service inside the Staging VPC, and associate the Route 53 Private Hosted Zone (PHZ) created for the MGN service with the Staging VPC to enable private DNS resolution of the MGN API endpoints.

Deploy a single NAT Gateway in a public subnet of the Staging VPC and configure the private subnets' route tables to point default routes to the NAT Gateway to route replication traffic to the public MGN endpoints.

Configure a Direct Connect Gateway to perform transitive routing of replication traffic directly between the on-premises data center and the Staging VPC, bypassing the Transit Gateway for all replication operations.

Provision Route 53 Resolver endpoints in the Staging VPC but do not associate the Private Hosted Zone for MGN with the Staging VPC, allowing the on-premises servers to resolve the endpoint address via public DNS resolvers.

Show answer & explanation

Answer: Configure the security groups associated with the Replication Servers in the Staging VPC to allow inbound replication traffic on TCP Port 1500 from the on-premises source subnets, and ensure the on-premises firewall allows outbound traffic on TCP Port 1500.; Create Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN service inside the Staging VPC, and associate the Route 53 Private Hosted Zone (PHZ) created for the MGN service with the Staging VPC to enable private DNS resolution of the MGN API endpoints.

Answer

To configure private replication using AWS Application Migration Service (MGN), the Solutions Architect must allow inbound replication traffic on TCP Port 1500 from the on-premises source subnets in the Staging VPC security groups, and configure Interface VPC Endpoints for the AWS MGN service in the Staging VPC while associating the Route 53 Private Hosted Zone to ensure private DNS resolution.

The correct configurations allow both the replication data stream and the control plane API communication to remain completely private over the Direct Connect connection. Specifically, the data stream replicates over TCP Port 1500 to the Replication Servers, which requires appropriate security group and firewall permissions. Control plane APIs are accessed privately via interface endpoints, which require the Route 53 Private Hosted Zone associated with the Staging VPC for correct resolution.

Step-by-Step Solution

Configure the security groups of the MGN Replication Servers in the Staging VPC to allow inbound traffic on TCP Port 1500, which is the dedicated port for agent-to-replication-server data transit.

The Replication Servers can successfully receive data blocks sent by the on-premises agents.

This is required because the AWS MGN replication agent copies blocks directly to the Replication Servers using TCP Port 1500.

Create Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN API service in the Staging VPC to provide private access to the control plane.

The MGN control plane endpoints receive private IP addresses within the Staging VPC CIDR.

This ensures the agent can communicate with the service APIs without traversing the public internet.

Associate the Route 53 Private Hosted Zone generated by the MGN interface endpoints with the Staging VPC.

DNS queries for the MGN service endpoint resolve to the private IP addresses of the interface endpoints.

Without this association, the source servers and local resources would resolve the MGN endpoint to public IP addresses, which are unreachable under the strict private-only policy.

Key Concept

Private replication configuration for AWS Application Migration Service (MGN)

Question 1594Question →

FinTrace Analytics is modernizing its transaction-matching audit engine by migrating it from on-premises virtualized environments to AWS. The target architecture requires the ingestion and preprocessing service to be deployed on Amazon ECS using the AWS Fargate launch type across three Availability Zones in a private subnet in VPC-A. This service needs to communicate privately with a transaction-matching engine, also running on Amazon ECS with the AWS Fargate launch type across three Availability Zones in a private subnet in VPC-B.

Both VPCs are connected using an AWS Transit Gateway, with routing properly configured between the subnets. The matching engine must be resolvable via the private domain name engine.fintrace.local from the preprocessing tasks in VPC-A. The design must ensure high availability, zero exposure of the matching engine to the public internet, and minimal operational overhead.

Which of the following configurations should a Solutions Architect recommend?

Deploy the matching engine tasks using the bridge network mode to enable dynamic port mapping, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated with both VPC-A and VPC-B containing an alias record pointing to the internal ALB.

Deploy the matching engine tasks using the awsvpc network mode, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated only with VPC-B containing an alias record pointing to the internal ALB, relying on Transit Gateway to propagate Route 53 DNS resolution across VPC boundaries.

Deploy the matching engine tasks using the awsvpc network mode, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated with both VPC-A and VPC-B containing an alias record pointing to the internal ALB.

Deploy the matching engine tasks using the awsvpc network mode, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated with both VPC-A and VPC-B containing an alias record pointing to the internal ALB, while routing all VPC-B outbound traffic through a single NAT Gateway in one Availability Zone.

Show answer & explanation

Answer: Deploy the matching engine tasks using the awsvpc network mode, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated with both VPC-A and VPC-B containing an alias record pointing to the internal ALB.

Answer

Deploy the matching engine tasks using the awsvpc network mode, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated with both VPC-A and VPC-B containing an alias record pointing to the internal ALB.

Deploying the tasks in awsvpc network mode satisfies Fargate's networking requirement. The internal ALB provides highly available distribution of traffic without exposing the backend to the public internet. Associating the Route 53 Private Hosted Zone with both VPCs ensures that client tasks in VPC-A can resolve the private domain name directly to the internal ALB in VPC-B across the Transit Gateway connection.

Step-by-Step Solution

Select the correct container network mode for Fargate.

Use awsvpc network mode for the ECS tasks.

AWS Fargate does not support host or bridge networking; tasks must run in awsvpc mode, giving each task its own elastic network interface (ENI).

Expose the backend container tasks within the VPC privately and highly available.

An internal ALB allows load balancing across tasks in multiple Availability Zones within the private subnets without exposing them to the internet.

Configure the DNS resolution across VPC boundaries.

Create a Route 53 Private Hosted Zone and associate it with both VPC-A and VPC-B.

A Private Hosted Zone must be associated with any VPC from which you want to resolve records. Transit Gateway connects network pathways but does not propagate DNS queries across VPCs without explicit association.

Key Concept

Cross-VPC private container networking and name resolution

Question 1595Question →

A company is migrating an on-premises MySQL database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster using AWS Database Migration Service (AWS DMS) and the AWS Schema Conversion Tool (AWS SCT). The migration strategy requires a full load followed by continuous replication (Change Data Capture) to minimize application downtime. After the AWS DMS task completes the full load phase successfully, the replication task fails to capture any ongoing inserts or updates from the source MySQL database.

Which of the following database configurations must be modified on the source MySQL database to allow AWS DMS to successfully perform Change Data Capture?

Enable supplemental logging at the database level and configure the source database to write full image rows to the redo log.

Configure the binary log format (binlog_format) to ROW and set the binary log retention period to a non-zero value on the source MySQL database.

Convert the database migration to an offline replatforming strategy using pg_dump and pg_restore directly from the source to the target DB cluster.

Enable Aurora Auto Scaling on the target Aurora cluster to provision additional Read Replicas to handle the replication load.

Show answer & explanation

Answer: Configure the binary log format (binlog_format) to ROW and set the binary log retention period to a non-zero value on the source MySQL database.

Answer

Configure the binary log format (binlog_format) to ROW and set the binary log retention period to a non-zero value on the source MySQL database.

For AWS DMS to perform Change Data Capture (CDC) on a source MySQL database, binary logging must be enabled, the binary log format must be set to ROW, and the binlog retention period must be set to a value greater than zero. This allows the DMS replication task to read the row-level changes from the binary logs.

Step-by-Step Solution

Analyze the failure stage and the source database engine.

The source database is MySQL, the target is Aurora PostgreSQL, and the full load succeeded but CDC failed. This indicates the issue lies in the source change logging configuration.

AWS DMS requires specific database logging configurations on the source engine to read transaction logs for CDC.

Identify the required CDC configuration for a MySQL source database.

MySQL requires row-based binary logging (binlog_format = ROW) and a non-zero log retention period.

Without ROW-based binary logging, DMS cannot capture row-level transactional changes, and without log retention, logs might be purged before DMS can read them.

Select the option that matches this configuration change and satisfies the low-downtime requirement.

Configuring row-based binary logging on the source MySQL database allows the DMS task to resume CDC and minimize downtime.

This configuration directly addresses the root cause of the CDC replication failure on MySQL.

Key Concept

AWS DMS CDC prerequisites for MySQL source databases

Question 1596Question →

An organization is setting up federated single sign-on (SSO) to allow on-premises directory users to access the AWS Management Console across multiple member accounts in an AWS Organization. The solution must use a third-party SAML 2.0 Identity Provider (IdP). Which two configuration steps must be performed in each target AWS member account to establish this federation? (Select TWO.)

Select all that apply

Create an IAM SAML identity provider in each target member account using the XML metadata document from the on-premises IdP.

Create an IAM role in each target member account with a trust policy that defines the SAML provider as the principal and allows the sts:AssumeRoleWithSAML action.

Create an IAM role in each target member account with a trust policy that defines the SAML provider as the principal and allows the sts:AssumeRole action.

Apply a Service Control Policy (SCP) at the Organizational Unit level that explicitly grants the sts:AssumeRoleWithSAML permission to the federated users.

Create an IAM user in each target member account with a trust policy that grants the sts:AssumeRoleWithSAML permission to the on-premises IdP.

Show answer & explanation

Answer: Create an IAM SAML identity provider in each target member account using the XML metadata document from the on-premises IdP.; Create an IAM role in each target member account with a trust policy that defines the SAML provider as the principal and allows the sts:AssumeRoleWithSAML action.

Answer

To establish SAML 2.0 federation, each target member account must have an IAM SAML identity provider created using the IdP's metadata document, and an IAM role with a trust policy allowing the federated principal to assume the role via the sts:AssumeRoleWithSAML action.

Establishing SAML 2.0 federation with AWS requires two primary configurations in each target member account: first, creating an IAM SAML identity provider using the metadata document from the IdP to establish the trust boundary; second, creating an IAM role with a trust policy that targets the SAML provider ARN as the principal and allows the sts:AssumeRoleWithSAML action. This allows the SAML assertion to be exchanged for temporary AWS security credentials.

Step-by-Step Solution

Generate the SAML metadata document from the on-premises Identity Provider (IdP) containing the entity ID, public keys, and redirect URLs.

The metadata XML file is ready to be imported into AWS.

AWS requires this document to establish trust and verify SAML assertions signed by the IdP.

Create an IAM SAML identity provider in each target AWS member account and upload the metadata XML document.

An IAM SAML provider entity is created with a unique ARN.

This establishes the identity provider within the local scope of each target AWS account.

Create an IAM role in each target account with a trust policy designating the newly created SAML provider ARN as the principal, specifying the sts:AssumeRoleWithSAML action, and evaluating the SAML:aud condition.

An IAM role is created that can be assumed by federated users.

This links the authenticated SAML assertions to specific permissions inside the AWS account.

Key Concept

Establishing SAML 2.0 federation trust relationships in multi-account environments.

Question 1597Question →

A retail company is planning to migrate its supply chain platform to AWS. The on-premises infrastructure consists of 400 virtual machines running on VMware vCenter, and 30 physical bare-metal database servers. The company's security policy strictly prohibits the installation of any software agents on the production application servers running on the virtual machines. Additionally, the physical database servers run a mix of legacy Red Hat Enterprise Linux (RHEL) 5 (which is not supported by the AWS Application Discovery Agent) and Windows Server 2019 (which is supported). The database subnet has no direct outbound internet access, but traffic can be routed through an internal HTTPS proxy. The company wants to perform system discovery and track the migration progress in AWS Migration Hub. Which of the following actions should the Solutions Architect recommend? (Select TWO.)

Select all that apply

Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware vCenter environment to discover the application tier virtual machines without installing agents.

Import the inventory details for the unsupported RHEL 5 physical database servers using a CSV template in AWS Migration Hub, and install the AWS Application Discovery Agent on the supported physical Windows servers configured with an HTTPS proxy for outbound communications.

Install the AWS Application Discovery Agent on all VMware virtual machines to capture detailed database schemas, and use an AWS Direct Connect connection to route discovery traffic directly to AWS Migration Hub.

Deploy the AWS Application Discovery Agentless Collector on a physical gateway server in the database subnet, configuring it to scan the bare-metal database servers via WMI and SSH to bypass local firewall restrictions.

Utilize AWS Database Migration Service (DMS) schema assessment tools to discover host-level network dependencies, and configure AWS Migration Hub to automatically query the on-premises vCenter server directly over the internet.

Show answer & explanation

Answer: Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware vCenter environment to discover the application tier virtual machines without installing agents.; Import the inventory details for the unsupported RHEL 5 physical database servers using a CSV template in AWS Migration Hub, and install the AWS Application Discovery Agent on the supported physical Windows servers configured with an HTTPS proxy for outbound communications.

Answer

Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware vCenter environment, and import the inventory details for the unsupported RHEL 5 physical database servers using a CSV template while installing the Application Discovery Agent on the supported physical Windows servers configured with an HTTPS proxy.

Deploying the Agentless Collector as a virtual appliance in the VMware environment fulfills the requirement to discover the virtual machine fleet without violating the policy against agent installations. For the physical servers, using a CSV import handles the legacy RHEL 5 servers which lack agent support, while the supported Windows servers can run the Application Discovery Agent configured to route its traffic through the internal HTTPS proxy.

Step-by-Step Solution

Evaluate the discovery mechanism for the VMware virtual machines.

Identify that the AWS Application Discovery Agentless Collector is required to satisfy the security policy against installing agents on the virtual machines.

The Agentless Collector gathers VM metadata, configuration, and performance info directly from vCenter Server without requiring in-guest agent software.

Address the discovery requirements for the physical database servers.

Divide the physical database discovery into manual CSV import for unsupported RHEL 5 servers and agent-based discovery for Windows Server 2019 servers using an HTTPS proxy.

The Application Discovery Agent does not support legacy RHEL 5, necessitating a CSV upload for those hosts. Windows Server 2019 is supported, and the agent can communicate outbound via an HTTPS proxy to bypass the subnet's direct internet restriction.

Consolidate the discovery outputs into the central tracking system.

Track the collected virtual and physical inventory data directly within the AWS Migration Hub dashboard.

AWS Migration Hub integrates both the Agentless Collector data, the agent-collected data, and manually imported server inventories for unified tracking.

Key Concept

Selecting the correct discovery mechanism (Agent vs. Agentless) and import options in AWS Application Discovery Service and tracking migration progress in AWS Migration Hub.

Question 1598Question →

A logistics company is migrating $8$ physical on-premises servers to AWS using AWS Application Migration Service (MGN). A $1\text{ Gbps}$ AWS Direct Connect connection is established and terminated at an AWS Transit Gateway, which connects to the AWS landing zone VPCs. The on-premises servers are isolated from the public internet. The company requires that all replication control plane traffic and data replication traffic traverse the Direct Connect connection privately. Which TWO configurations must the solutions architect implement to meet these requirements?

Select all that apply

Configure the AWS Application Migration Service replication template to route replication data using private IP addresses, and configure network firewalls and security groups to allow outbound traffic on TCP port

1500

from the source servers to the staging area subnet.

Create an interface VPC endpoint (AWS PrivateLink) for AWS Application Migration Service in the staging VPC, and execute the replication agent installer on the on-premises servers specifying the endpoint's private DNS name or IP address.

Configure the AWS Application Migration Service replication template to use private IP routing, and restrict the staging area security groups to allow inbound replication traffic on TCP port

443

only.

Bypass the Transit Gateway by connecting the Direct Connect connection to a Direct Connect Gateway associated directly with the target VPCs to manage transitive VPC-to-VPC routing for the migration workloads.

Create a Private Hosted Zone for the MGN service endpoint in a shared services VPC, and rely on Transit Gateway route propagation to automatically resolve the endpoint names across all staging and target VPCs.

Show answer & explanation

Answer: Configure the AWS Application Migration Service replication template to route replication data using private IP addresses, and configure network firewalls and security groups to allow outbound traffic on TCP port $1500$ from the source servers to the staging area subnet.; Create an interface VPC endpoint (AWS PrivateLink) for AWS Application Migration Service in the staging VPC, and execute the replication agent installer on the on-premises servers specifying the endpoint's private DNS name or IP address.

Answer

The solutions architect must configure the replication template to use private IP addresses, open outbound TCP port 1500 to the staging subnet, provision an interface VPC endpoint (PrivateLink) for the migration service, and run the agent installer specifying the private endpoint details.

The correct options state that the solutions architect should configure the replication template to use private IP routing, allow outbound traffic on TCP port 1500, create an interface VPC endpoint for the service, and install the agent specifying the private endpoint. This addresses both replication data transmission (via private IPs and port 1500) and control plane registrations (via the interface VPC endpoint) without requiring any public internet access.

Step-by-Step Solution

Configure the MGN replication template to use private IP routing.

This prevents replication data from trying to route over the public internet, directing it over the private hybrid network path (Direct Connect and Transit Gateway) instead.

By default, replication servers communicate over public IPs, which is blocked by the internet-isolated source environment.

Provision an interface VPC endpoint (PrivateLink) for the MGN service in the staging VPC.

Creates private IP interfaces within the VPC for control plane communication.

Allows the on-premises replication agents to securely register and send heartbeat signals to the MGN control plane privately.

Ensure firewalls and security groups allow TCP port 1500.

Enables uninterrupted flow of data blocks from the agent to the replication servers.

Port 1500 is the dedicated port for data replication in AWS Application Migration Service.

Key Concept

Private replication and control plane connectivity over hybrid paths with AWS Application Migration Service (MGN)

Question 1599Question →

A company manages a multi-account AWS environment using AWS Organizations. The central platform team maintains shared resources in a shared services account. The team needs to automate the deployment and configuration of a proprietary security agent on Amazon EC2 instances located in multiple production accounts. The agent requires a license key that must be stored securely in the shared services account. The deployment must automatically detect and remediate configuration drift on the production instances. Which two actions must the solutions architect take to meet these requirements? (Select two.)

Select all that apply

Store the license key in AWS Secrets Manager in the shared services account using a Customer Managed Key (CMK), configure the secret's resource-based policy to allow cross-account access, and update the KMS key policy to permit decryption by the production IAM roles.

Use AWS CloudFormation StackSets to deploy an AWS Systems Manager State Manager association to the production accounts to install the agent and enforce configuration consistency.

Store the license key in AWS Secrets Manager in the shared services account using the default AWS-managed KMS key for Secrets Manager, and attach an IAM policy to the production instances' roles to permit decryption.

Deploy AWS Config rules in the production accounts that continuously monitor the instance operating systems and directly write the correct configuration files to the instances when drift is detected.

Attach a Service Control Policy (SCP) to the production Organizational Units (OUs) that permits the production EC2 instances to call the Secrets Manager API operations in the shared services account.

Show answer & explanation

Answer: Store the license key in AWS Secrets Manager in the shared services account using a Customer Managed Key (CMK), configure the secret's resource-based policy to allow cross-account access, and update the KMS key policy to permit decryption by the production IAM roles.; Use AWS CloudFormation StackSets to deploy an AWS Systems Manager State Manager association to the production accounts to install the agent and enforce configuration consistency.

Answer

Store the license key in AWS Secrets Manager in the shared services account using a Customer Managed Key (CMK) with appropriate cross-account permissions, and use AWS CloudFormation StackSets to deploy a Systems Manager State Manager association to the production accounts to enforce agent configuration consistency.

The correct solution involves storing the license key in AWS Secrets Manager using a Customer Managed Key (CMK), allowing the policies to be modified for cross-account access, and deploying a Systems Manager State Manager association via CloudFormation StackSets to enforce configuration consistency and remediate drift on the production EC2 instances.

Step-by-Step Solution

Configure secure cross-account parameter storage

The license key is stored in Secrets Manager under a Customer Managed Key, with the resource policy and key policy allowing the production IAM roles access.

AWS-managed KMS keys do not support cross-account access because their key policies cannot be modified.

Deploy drift detection and remediation configurations cross-account

CloudFormation StackSets deploy Systems Manager State Manager associations to production accounts.

State Manager continuously applies the configuration to the EC2 instances, automatically remediating configuration drift.

Key Concept

Cross-account resource sharing with KMS encryption and automated drift remediation using Systems Manager State Manager.

Question 1600Question →

An organization is planning to migrate a critical, highly transactional Oracle database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The database contains several tables with large amounts of data, some of which contain Large Objects (LOBs) and do not have primary keys defined. The migration must have near-zero downtime, so the team is using the AWS Schema Conversion Tool (SCT) and AWS Database Migration Service (DMS) with Change Data Capture (CDC) enabled. Minimal supplemental logging is enabled at the database level on the source Oracle database. During testing, the DMS task completes the full load phase successfully. However, during the CDC phase, the task shows a status of 'Running with errors'. An analysis of the target database shows that while INSERT operations are being replicated, UPDATE and DELETE operations are missing for tables that do not have primary keys. Furthermore, tables containing LOB columns are experiencing severe performance degradation during replication. Which combination of actions will resolve these issues while maintaining replication performance?

Enable table-level supplemental logging on the source Oracle database for all columns of tables without primary keys, and primary key columns for tables with primary keys. Configure the AWS DMS replication task to use Limited LOB mode with a specified maximum LOB size to optimize replication speed.

Enable database-level supplemental logging for all columns on the source Oracle database. Configure the AWS DMS task to use Full LOB mode, and increase the LOB chunk size parameter to improve replication performance.

Change the AWS DMS source endpoint settings to use Oracle Binary Reader instead of Oracle LogMiner to bypass the requirement for table-level supplemental logging. Configure the AWS DMS task to exclude LOB columns during CDC, and migrate LOB columns using a separate AWS SCT agent task.

Install the AWS SCT extension pack on the target Aurora PostgreSQL database to automatically generate primary keys using UUIDs. Configure the AWS DMS task to use Inline LOB mode with a custom replication task setting to sync tables without primary keys.

Show answer & explanation

Answer: Enable table-level supplemental logging on the source Oracle database for all columns of tables without primary keys, and primary key columns for tables with primary keys. Configure the AWS DMS replication task to use Limited LOB mode with a specified maximum LOB size to optimize replication speed.

Answer

The correct action is to enable table-level supplemental logging on the source Oracle database for all columns of tables without primary keys, and primary key columns for tables with primary keys. This allows AWS DMS to parse the redo logs and correctly identify which rows need to be updated or deleted on the target. Additionally, using Limited LOB mode with a specified maximum LOB size optimizes replication performance because it avoids the need to query the source database for each LOB row individually, which is a major performance bottleneck in Full LOB mode.

Step-by-Step Solution

Configure table-level supplemental logging on the source database.

Tables without primary keys now have supplemental logging enabled for all columns. Tables with primary keys have supplemental logging for their primary keys.

For AWS DMS to replicate UPDATE and DELETE operations during CDC, it must be able to identify the unique rows being changed in the redo logs. For tables without primary keys, this requires logging all columns.

Configure LOB settings on the AWS DMS task.

The replication task is configured to use Limited LOB mode with a specified maximum LOB size.

Limited LOB mode is significantly faster than Full LOB mode because DMS allocates a buffer of the specified maximum LOB size and transfers the data inline, avoiding additional round-trips to the source database.

Key Concept

AWS DMS requires appropriate supplemental logging on Oracle source databases to replicate update and delete changes during CDC, and performance is optimized by selecting Limited LOB mode instead of Full LOB mode.

PreviousPage 80 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution