All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A financial services company runs a high-throughput transaction processing application on a fleet of Amazon EC2 instances within an Auto Scaling group. The application reads its feature flags and runtime configurations from a local file on each instance. The operations team needs to automate the management and deployment of these configuration updates. The solution must support validating the configuration syntax before deployment, gradually rolling out the configuration updates to the instances over a period of $15$ minutes, and automatically rolling back the deployment if application error rates spike during the rollout. Additionally, the configuration update must be applied with zero downtime and without terminating or launching any EC2 instances. Which approach should a solutions architect recommend to meet these requirements with the least operational overhead?

Store the configurations in AWS Systems Manager Parameter Store. Create an AWS Systems Manager State Manager association to run a custom Systems Manager Document every

15

minutes that pulls the parameter values and overwrites the local configuration file on all instances. Deploy an AWS Lambda function triggered by CloudWatch alarms to restore the previous parameter version in Parameter Store if error rates spike.

Use AWS CloudFormation StackSets to manage the configuration files. Store the configuration files in an Amazon S3 bucket, update the Auto Scaling group launch template with the new S3 file path in the UserData, and perform an Instance Refresh to roll out the updates. Configure StackSets automatic rollback on CloudWatch alarms.

Use AWS AppConfig. Store the configurations in an AppConfig hosted configuration store and configure a JSON schema validator. Deploy the configuration using a custom deployment strategy that defines a

15

-minute rollout duration and associates a CloudWatch alarm for application error rates as the bake time monitor. Run the AWS AppConfig Agent on the EC2 instances to retrieve and apply the configuration updates.

Use AWS Config rules to monitor the local configuration files. When a change is detected, trigger an AWS Systems Manager Automation runbook using an AWS-managed KMS key (aws/ssm) to run a script that updates the files. Modify the key policy of the aws/ssm key to allow the cross-account validation Lambda function to decrypt the configuration payload.

Show answer & explanation

Answer: Use AWS AppConfig. Store the configurations in an AppConfig hosted configuration store and configure a JSON schema validator. Deploy the configuration using a custom deployment strategy that defines a $15$ -minute rollout duration and associates a CloudWatch alarm for application error rates as the bake time monitor. Run the AWS AppConfig Agent on the EC2 instances to retrieve and apply the configuration updates.

Answer

Use AWS AppConfig, configure a JSON schema validator, deploy using a custom deployment strategy with a 15-minute rollout and CloudWatch alarm monitoring, and use the AWS AppConfig Agent on the instances.

AWS AppConfig is designed specifically for dynamic runtime configuration management. It natively supports syntax validation (using JSON schema, Lambda, or other validators), gradual rollout strategies (linear or exponential), and automatic rollbacks based on CloudWatch alarms during a specified bake time without terminating or launching new EC2 instances. Using the AWS AppConfig Agent on the instances minimizes the operational overhead of retrieving and applying configuration updates.

Step-by-Step Solution

Filter deployment methods based on the constraint to apply configuration updates without terminating or launching new EC2 instances.

Eliminates CloudFormation StackSets with launch templates and Instance Refresh, which require instance replacement.

The scenario requires zero-downtime updates without replacing infrastructure.

Evaluate configuration validation, rollout speed, and automatic rollback capabilities.

Identifies that AWS AppConfig provides native hosted configurations, JSON schema validators, and custom deployment strategies with bake times and CloudWatch alarm integration.

Systems Manager State Manager applies configurations simultaneously and lacks native pre-deployment validation, which fails to meet the requirement for a gradual rollout and validation.

Verify key policy and encryption delegation rules.

Confirms that AWS-managed KMS keys do not support policy modification, ruling out any solutions that attempt to edit the key policy of aws/ssm.

AWS-managed KMS keys are not customizable; cross-account or custom key policies require customer-managed keys.

Key Concept

AWS AppConfig for dynamic configuration deployment and validation

Estimated Time:2m 0s

Question 1602Question →

A financial services firm is designing a new customer portal consisting of an online transaction processing (OLTP) database workload for customer account metadata and an Object storage workload for statement PDF reports. The metadata database must support high read volumes that scale dynamically based on demand. The statement reports must be securely archived in Amazon S3. The security team requires that the S3 encryption keys are customer-controlled and can be shared with an external auditing AWS account. Additionally, the system must meet near-zero recovery point objective (RPO) and recovery time objective (RTO) requirements across multiple AWS regions. Which two options should the solutions architect choose to meet these requirements?

Select all that apply

Deploy an Amazon Aurora Global Database cluster, configure Aurora Replicas in the primary region, and implement Application Auto Scaling to adjust the replica count based on CPU utilization.

Encrypt the Amazon S3 bucket using a Customer Managed Key (CMK) in AWS KMS, and update the CMK key policy to grant access to the external auditing AWS account.

Deploy an Amazon RDS for PostgreSQL DB instance with a Multi-AZ standby deployment, and configure the application to route read queries to the standby instance during peak traffic hours.

Encrypt the S3 bucket using an AWS managed KMS key (aws/s3), and modify the AWS managed key policy to allow cross-account access for the external auditing AWS account.

Deploy the database in a single-Region Multi-AZ configuration and establish a Pilot Light disaster recovery strategy in a secondary region to meet the multi-region near-zero RTO and RPO requirements.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database cluster, configure Aurora Replicas in the primary region, and implement Application Auto Scaling to adjust the replica count based on CPU utilization.; Encrypt the Amazon S3 bucket using a Customer Managed Key (CMK) in AWS KMS, and update the CMK key policy to grant access to the external auditing AWS account.

Answer

Deploying an Amazon Aurora Global Database cluster combined with Application Auto Scaling for Aurora Replicas, alongside encrypting the Amazon S3 bucket with a Customer Managed KMS Key (CMK) and updating its key policy to delegate cross-account access, satisfies all requirements.

The correct configurations use an Amazon Aurora Global Database with Aurora Replicas scaled dynamically via Application Auto Scaling to support scaling reads, and a Customer Managed KMS Key (CMK) with a key policy modification to allow cross-account access.

Step-by-Step Solution

Analyze database scaling and multi-region recovery requirements.

Identify that the database requires dynamic read scaling and near-zero RTO/RPO across multiple regions. Aurora Global Database with Auto Scaling Aurora Replicas fits this pattern.

Aurora Global Database offers cross-region replication lag of typically under 1 second, and Auto Scaling allows replicas to scale based on CPU utilization.

Analyze cross-account sharing and encryption requirements.

Identify that the KMS key must be customer-controlled (CMK) and must allow editing key policies to delegate access to external AWS accounts.

AWS managed keys do not support custom key policies and cannot be shared across accounts.

Evaluate and eliminate sub-optimal options.

Eliminate options proposing RDS standby instances for read scaling, AWS managed KMS keys for cross-account access, and Pilot Light DR configurations for near-zero RTO/RPO.

These violate standard AWS architectural limitations and the scenario's recovery objectives.

Key Concept

Designing scalable database architectures using Amazon Aurora and designing cross-account encryption sharing strategies using AWS KMS Customer Managed Keys.

Question 1603Question →

An enterprise logistics company, 'LogiGlobal', is modernizing its core package tracking system by migrating its on-premises microservices to AWS. The microservices must run on Amazon ECS with AWS Fargate to minimize compute management overhead. The tasks need to pull container images from a centralized Amazon Elastic Container Registry (ECR) repository located in a shared services AWS account. All network traffic between the Fargate tasks and the ECR repository must remain entirely within the AWS private network to satisfy security compliance. Additionally, the Fargate tasks must resolve the ECR endpoint using the default private DNS names. Which of the following configuration strategies should a Solutions Architect implement to meet these requirements with the least operational overhead?

Deploy the tasks using the awsvpc network mode. Create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3 in the application VPC, enabling private DNS. Grant pull permissions to the application account's task execution IAM role in the shared services ECR repository policy.

Deploy the tasks using the bridge network mode to enable container port mapping. Create interface VPC endpoints for ECR and Amazon S3 in the application VPC, and configure the task execution role in the application account with ECR permissions.

Deploy the tasks using the awsvpc network mode. Create the interface VPC endpoints for ECR in the shared services VPC with Private DNS enabled. Create an AWS Transit Gateway to route traffic between the application VPC and the shared services VPC without associating the shared services private hosted zone with the application VPC.

Deploy the tasks using the awsvpc network mode. Create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3 in the application VPC. Encrypt the ECR repository using the AWS-managed KMS key (aws/ecr), and add the application task execution IAM role as a key user in the key policy.

Show answer & explanation

Answer: Deploy the tasks using the awsvpc network mode. Create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3 in the application VPC, enabling private DNS. Grant pull permissions to the application account's task execution IAM role in the shared services ECR repository policy.

Answer

To run ECS tasks on AWS Fargate, the network mode must be set to 'awsvpc', as Fargate does not support other modes like bridge or host. Because the tasks are in a private subnet and must not access the public internet, VPC endpoints are required. ECR requires interface VPC endpoints (AWS PrivateLink) for both the API and dkr services. Furthermore, because ECR stores image layers in Amazon S3, the tasks also need access to S3. Creating an S3 gateway VPC endpoint in the application VPC is the most cost-effective way to allow tasks to download image layers privately. Finally, to pull images across accounts, the ECR repository policy in the shared services account must explicitly grant permissions to the application account's ECS task execution IAM role.

Step-by-Step Solution

Configure the ECS task definition to use AWS Fargate with the awsvpc network mode.

The task is configured for launch-type compatibility with Fargate and secures its own dedicated Elastic Network Interface (ENI).

Fargate only supports the awsvpc network mode for task container networking.

Create interface VPC endpoints for ecr.api and ecr.dkr, and a gateway VPC endpoint for Amazon S3 in the application VPC.

Private network paths are established for API calls and image layer downloads.

Fargate tasks in a private subnet need private endpoints to reach ECR and retrieve image layers from S3 without internet access.

Configure the ECR repository policy in the shared services account to grant the ecr:BatchGetImage and ecr:GetDownloadUrlForLayer permissions to the application account's ECS task execution role.

The ECS agent running the Fargate task is authorized to authenticate and pull the container image cross-account.

Cross-account repository access requires permissions to be granted on the resource policy of the source repository.

Key Concept

Cross-account ECR image pulling for ECS Fargate tasks using private VPC endpoints.

Question 1604Question →

ValoLogistics is migrating its on-premises vehicle routing engine to AWS. To comply with strict security standards, the target workload must run on Amazon ECS using AWS Fargate tasks across multiple Availability Zones in a private subnet within the Production account (Account B) with zero direct egress route to the internet. The VPC in Account B has no Internet Gateway or NAT Gateways configured.

Container images are stored in a centralized Amazon ECR repository in a Shared Services account (Account A) and are encrypted using a customer managed AWS KMS key in Account A. The Fargate tasks in Account B must be able to pull these images securely without traversing the public internet, and must also send container logs to Amazon CloudWatch Logs.

Which combination of actions will allow the ECS tasks to pull the images and log successfully? (Select TWO.)

Select all that apply

Configure Interface VPC endpoints in Account B's VPC for com.amazonaws.us-east-1.ecr.api, com.amazonaws.us-east-1.ecr.dkr, and com.amazonaws.us-east-1.logs with Private DNS enabled. Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of Account B's private subnets.

Update the KMS key policy in Account A to allow the ECS task execution role in Account B kms:Decrypt and kms:DescribeKey permissions. Update the ECR repository policy in Account A to grant the ECS task execution role in Account B permissions for ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage.

Create an IAM policy allowing ECR and KMS decrypt access and attach it to the ECS task role in Account B. Configure the ECS tasks to use the host network mode to bypass the default AWS Fargate container network configuration.

Deploy a single NAT Gateway in one of the private subnets of Account B's VPC, and update the private subnet route tables to forward all egress internet traffic to this NAT Gateway to reach the public ECR and CloudWatch endpoints.

Create a Route 53 Private Hosted Zone (PHZ) for dkr.ecr.us-east-1.amazonaws.com in Account A and associate it with Account B's VPC. Create a Route 53 Resolver outbound endpoint in Account B to forward ECR DNS queries to Account A's Amazon Provided DNS.

Show answer & explanation

Answer: Configure Interface VPC endpoints in Account B's VPC for com.amazonaws.us-east-1.ecr.api, com.amazonaws.us-east-1.ecr.dkr, and com.amazonaws.us-east-1.logs with Private DNS enabled. Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of Account B's private subnets.; Update the KMS key policy in Account A to allow the ECS task execution role in Account B kms:Decrypt and kms:DescribeKey permissions. Update the ECR repository policy in Account A to grant the ECS task execution role in Account B permissions for ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage.

Answer

The correct options are configuring the Interface VPC endpoints (ECR API, ECR DKR, CloudWatch Logs) with Private DNS enabled alongside an S3 Gateway endpoint in Account B, and updating both the ECR repository policy and the KMS key policy in Account A to authorize the ECS task execution role in Account B.

To enable AWS Fargate tasks in a fully private VPC (without internet access) to pull images from a cross-account ECR repository and send logs to CloudWatch Logs, two primary requirements must be satisfied: network routing and access permissions. For network routing, Interface VPC endpoints with Private DNS enabled are required for ECR API, ECR DKR, and CloudWatch Logs within the target VPC. Because Amazon ECR stores image layers in Amazon S3, a Gateway VPC endpoint for S3 must also be created and associated with the route tables of the private subnets where the tasks run. For access permissions, since the ECR repository is in another account (Account A) and encrypted with a Customer Managed Key (CMK), the KMS key policy and ECR repository policy in Account A must explicitly allow the ECS Task Execution Role in Account B to decrypt using the KMS CMK and read the ECR repository. Note that the Task Execution Role, not the Task Role, is utilized by the ECS agent/Fargate to perform image pull operations and send logs to CloudWatch.

Step-by-Step Solution

Configure VPC network routing for fully private subnets to allow container task bootstrapping.

Interface VPC endpoints are created for com.amazonaws.us-east-1.ecr.api, com.amazonaws.us-east-1.ecr.dkr, and com.amazonaws.us-east-1.logs with Private DNS enabled, and a Gateway VPC endpoint for Amazon S3 is created and associated with the private subnets' route tables.

Since the VPC has no internet access, Fargate requires VPC endpoints to interact with ECR, S3 (where image layers are stored), and CloudWatch Logs.

Configure ECR cross-account repository access in Account A.

The ECR repository policy in Account A allows the ECS task execution role in Account B to perform ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage.

Allows the task execution role in the Production account to pull container images from the Shared Services account.

Configure KMS cross-account decryption permissions in Account A.

The KMS key policy in Account A allows the ECS task execution role in Account B to perform kms:Decrypt and kms:DescribeKey operations.

Fargate must decrypt the ECR image layers that are encrypted with the customer managed key in Account A during the image pull process.

Key Concept

AWS Fargate cross-account image pulling over private network endpoints

Question 1605Question →

A retail analytics company processes point-of-sale (POS) data uploaded by thousands of stores. The processing workload runs on a fleet of Amazon EC2 instances in private subnets of a VPC in the `eu-west-1` Region. The EC2 instances retrieve approximately $250\text{ TB}$ of raw data monthly from an Amazon S3 bucket in `eu-west-1` and write $150\text{ TB}$ of processed transactional summaries to an Amazon DynamoDB table in the same Region. Currently, all outbound traffic from the private subnets is routed through NAT Gateways deployed across two Availability Zones, resulting in high data processing charges.

Additionally, the raw POS data in the S3 bucket is actively analyzed for the first $30$ days. After $30$ days, the data is rarely accessed but must be retained for $7$ years to comply with regulatory audits. The company requires audit retrievals to complete in less than $5$ hours.

Which two actions should a Solutions Architect recommend to minimize storage and data transfer costs while maintaining application availability and meeting regulatory requirements? (Select two.)

Select all that apply

Create Gateway VPC Endpoints for Amazon S3 and Amazon DynamoDB in the VPC, and update the route tables of the private subnets to route traffic to these endpoints.

Configure an Amazon S3 Lifecycle policy on the S3 bucket to transition the raw POS data to the Amazon S3 Glacier Flexible Retrieval tier

30

days after creation.

Route all outbound traffic from the private subnets through a single NAT Gateway in one Availability Zone to minimize the hourly NAT Gateway provisioning costs.

Utilize AWS Snowcone devices to physically transfer the monthly

250\text{ TB}

of raw POS data from the stores directly to AWS to eliminate internet ingestion costs.

Purchase an EC2 Instance Savings Plan to offset both the EC2 instance compute costs and the data transfer processing charges incurred by the NAT Gateways.

Show answer & explanation

Answer: Create Gateway VPC Endpoints for Amazon S3 and Amazon DynamoDB in the VPC, and update the route tables of the private subnets to route traffic to these endpoints.; Configure an Amazon S3 Lifecycle policy on the S3 bucket to transition the raw POS data to the Amazon S3 Glacier Flexible Retrieval tier $30$ days after creation.

Answer

Create Gateway VPC Endpoints for Amazon S3 and Amazon DynamoDB, and configure an Amazon S3 Lifecycle policy to transition raw POS data to the Amazon S3 Glacier Flexible Retrieval tier 30 days after creation.

Creating Gateway VPC Endpoints for Amazon S3 and Amazon DynamoDB allows the private EC2 instances to communicate directly with these services over the AWS network without traversing the NAT Gateways. Because Gateway Endpoints are free and do not incur data processing fees, this eliminates the data transfer costs associated with the

250\text{ TB}

of S3 traffic and

150\text{ TB}

of DynamoDB traffic. Transitioning raw POS data to Amazon S3 Glacier Flexible Retrieval after

30

days satisfies the regulatory retention period of

7

years at a significantly lower storage cost than S3 Standard, while meeting the retrieval time SLA of less than

5

hours (since standard retrieval for Glacier Flexible Retrieval is

3\text{ to }5\text{ hours}

Step-by-Step Solution

Analyze the current data transfer pathways and identify the source of the high costs.

Traffic to Amazon S3 (

250\text{ TB}

) and Amazon DynamoDB (

150\text{ TB}

) passes through NAT Gateways, incurring data processing charges of

\$0.045\text{ per GB}

Identifying the data volumes and destination services helps target the most cost-effective VPC endpoint type.

Select the correct endpoint solution for the target services.

Deploying Gateway VPC Endpoints for Amazon S3 and Amazon DynamoDB is free of charge and keeps traffic within the AWS network, bypassing the NAT Gateways.

Gateway VPC Endpoints eliminate NAT Gateway data processing charges for traffic destined to S3 and DynamoDB without adding hourly endpoint fees.

Evaluate S3 storage lifecycle and access requirements.

The raw POS data (

250\text{ TB}

/month) is only actively used for

30

days but must be kept for

7

years, with retrievals needed in less than

5

hours.

Transitioning data to a cheaper storage class after

30

days will reduce storage costs significantly.

Select the correct S3 storage class for the transition.

Amazon S3 Glacier Flexible Retrieval offers standard retrieval times of

3\text{ to }5\text{ hours}

and is much cheaper than S3 Standard, while S3 Glacier Deep Archive has retrieval times up to

12\text{ hours}

and cannot meet the limit.

Choosing S3 Glacier Flexible Retrieval meets the audit performance SLA of less than

5

hours while maximizing cost savings.

Key Concept

VPC Gateway Endpoints and S3 Lifecycle policies are primary tools for reducing AWS data transfer and storage costs without compromising availability or performance SLAs.

Estimated Time:3m 0s

Question 1606Question →

A logistics company runs a fleet tracking application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances run in private subnets and send route telemetry updates to an external third-party API via a single NAT Gateway located in Availability Zone A.

Every day at $08:00\text{ UTC}$ , the application experiences a massive surge in traffic, spiking from $500\text{ requests per second}$ to $30,000\text{ requests per second}$ within $2\text{ minutes}$ . During this peak, users experience HTTP 503 Service Unavailable errors and data ingestion failures for the first $10\text{ to }15\text{ minutes}$ .

An architectural review reveals the following:
* The EC2 instances require $8\text{ minutes}$ to download configuration files, initialize application services, and pass load balancer health checks.
* The ASG uses a target tracking scaling policy based on Average CPU Utilization with a default cooldown of $300\text{ seconds}$ .
* During the surge, the ASG continuously launches new instances before the previously launched instances are fully initialized and ready to receive traffic.
* A recent outage in Availability Zone A halted all outbound telemetry transmissions for the entire application, despite instances in other zones remaining healthy.

The company wants to improve the fault tolerance and auto-scaling responsiveness of the architecture. Which combination of actions should the Solutions Architect implement to resolve these issues? (Select TWO.)

Select all that apply

Configure a scheduled scaling policy to scale out the Auto Scaling group in advance of the daily peak, and update the dynamic scaling policy to use an estimated instance warmup of

540\text{ seconds}

Deploy a NAT Gateway in each Availability Zone, and update the route tables of the private subnets to direct outbound traffic to the NAT Gateway in the same Availability Zone.

Decrease the default cooldown period of the Auto Scaling group to

180\text{ seconds}

to allow the group to launch new instances more rapidly during the traffic surge.

Configure a single secondary NAT Gateway in Availability Zone B, and configure Route 53 failover routing to direct outbound traffic to the secondary gateway if the primary NAT Gateway becomes unhealthy.

Rely on the Application Load Balancer's automatic scaling to absorb the rapid daily spike, and configure target tracking scaling based on Average CPU Utilization with a target of

20\%

to initiate earlier scaling.

Show answer & explanation

Answer: Configure a scheduled scaling policy to scale out the Auto Scaling group in advance of the daily peak, and update the dynamic scaling policy to use an estimated instance warmup of $540\text{ seconds}$ .; Deploy a NAT Gateway in each Availability Zone, and update the route tables of the private subnets to direct outbound traffic to the NAT Gateway in the same Availability Zone.

Answer

Configure a scheduled scaling policy to scale out the Auto Scaling group in advance of the daily peak, update the dynamic scaling policy to use an estimated instance warmup of

540\text{ seconds}

, deploy a NAT Gateway in each Availability Zone, and update the route tables of the private subnets to direct outbound traffic to the local NAT Gateway.

The correct architecture uses scheduled scaling to pre-provision instances before the predictable daily spike at

08:00\text{ UTC}

starts, and sets the estimated instance warmup to

540\text{ seconds}

to prevent dynamic target tracking from launching extra instances while existing ones are still bootstrapping (which takes

8\text{ minutes}

). It also deploys a NAT Gateway in each Availability Zone to ensure high availability for outbound traffic, preventing an outage in a single zone from affecting the entire architecture.

Step-by-Step Solution

Analyze the scaling behavior and identify the bottleneck caused by the

8\text{-minute}

bootstrap time versus the

300\text{-second}

default cooldown.

Determine that the estimated instance warmup for dynamic scaling must be increased to at least

480\text{ seconds}

(specifically

540\text{ seconds}

) to prevent the Auto Scaling group from launching redundant instances prematurely.

This prevents scaling policy thrashing during rapid traffic spikes.

Address the predictable daily spike occurring at

08:00\text{ UTC}

Implement scheduled scaling to launch instances before the traffic surge begins.

Scheduled scaling ensures capacity is pre-provisioned, avoiding the latency associated with reactive dynamic scaling and load balancer delays.

Resolve the single point of failure for outbound traffic routed through Availability Zone A.

Deploy a NAT Gateway in each Availability Zone and associate them with corresponding subnet route tables.

This establishes multi-AZ redundancy, ensuring outbound traffic remains operational if one zone goes offline.

Key Concept

Mitigating scaling policy thrashing through estimated instance warmup tuning, pre-provisioning capacity for predictable spikes, and achieving multi-AZ fault tolerance for outbound network paths.

Question 1607Question →

A global digital publishing platform is designing a new high-throughput content management system (NoSQL and Object storage workloads). The system consists of:

1. A metadata database storing article configurations and user session states, which requires multi-region active-active writes and database write and read latencies under $10\text{ ms}$ .
2. An asset repository storing millions of media files, which must be stored in Amazon S3 and replicated from the primary region ( $us-west-2$ ) to a secondary disaster recovery region ( $us-east-1$ ) with a strict recovery point objective (RPO) of $15\text{ minutes}$ .

All data must be encrypted at rest using Customer Managed Keys (CMKs). Cross-account access to the asset repository is required for a security audit application running in a dedicated audit account.

Which combination of database and storage configurations will meet these requirements? (Select TWO.)

Select all that apply

Configure Amazon DynamoDB global tables with replicas in us-west-2 and us-east-1. Encrypt the tables using regional Customer Managed Keys (CMKs) in each region.

Configure Amazon S3 Cross-Region Replication (CRR) with S3 Replication Time Control (S3 RTC) enabled. Encrypt the source and destination S3 buckets using Customer Managed Keys (CMKs), and update the KMS key policies and bucket policies to grant read access to the audit account's IAM role.

Configure Amazon S3 Cross-Region Replication (CRR) with S3 Replication Time Control (S3 RTC) enabled. Encrypt the S3 buckets using AWS managed keys (aws/s3), and configure the bucket policies to grant read access to the audit account's IAM role.

Configure Amazon S3 Cross-Region Replication (CRR) without S3 Replication Time Control (S3 RTC) to replicate assets between regions, relying on standard replication to meet the 15-minute RPO at a lower cost.

Deploy an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Enable write forwarding on the secondary cluster to allow active-active writes in both regions with sub-10 millisecond write latency.

Show answer & explanation

Answer: Configure Amazon DynamoDB global tables with replicas in us-west-2 and us-east-1. Encrypt the tables using regional Customer Managed Keys (CMKs) in each region.; Configure Amazon S3 Cross-Region Replication (CRR) with S3 Replication Time Control (S3 RTC) enabled. Encrypt the source and destination S3 buckets using Customer Managed Keys (CMKs), and update the KMS key policies and bucket policies to grant read access to the audit account's IAM role.

Answer

Configure Amazon DynamoDB global tables with replicas in us-west-2 and us-east-1, encrypting them with regional Customer Managed Keys, and configure Amazon S3 Cross-Region Replication with S3 Replication Time Control enabled, encrypting the buckets with Customer Managed Keys and granting the audit account permission via the KMS key policy and S3 bucket policy.

The correct options are configuring Amazon DynamoDB global tables with regional Customer Managed Keys (CMKs) and configuring Amazon S3 Cross-Region Replication with S3 Replication Time Control (S3 RTC) enabled using Customer Managed Keys (CMKs). DynamoDB global tables enable active-active replication with local sub-10ms latency. S3 RTC guarantees the 15-minute RPO. Customer Managed Keys are required for both systems to support custom key policies that delegate cross-account decryption access to the external audit account's role.

Step-by-Step Solution

Analyze database requirements: active-active multi-region writes and sub-10ms read/write latency.

Amazon DynamoDB global tables provide local sub-10ms read/write operations with multi-region active-active capabilities, whereas Amazon Aurora write forwarding redirects writes to a single region, causing cross-region network latency.

To ensure database latency meets the sub-10ms threshold in both regions, writes must occur locally and replicate asynchronously.

Analyze S3 replication requirements: strict 15-minute RPO.

Amazon S3 Replication Time Control (S3 RTC) provides a SLA-backed replication guarantee of 15 minutes, whereas standard S3 Cross-Region Replication does not guarantee delivery times.

Meeting a strict 15-minute RPO requires S3 RTC configuration.

Analyze encryption and cross-account access requirements: Customer Managed Keys (CMKs) and access for an audit account.

AWS managed KMS keys (such as aws/s3) cannot have their policies modified, preventing cross-account access delegation. Customer Managed Keys are required so that the key policies can be updated to permit the external audit account to decrypt the data.

Cross-account resource sharing with KMS encryption requires CMKs and explicit cross-account key policy configurations.

Key Concept

Selecting the optimal database and storage architecture to meet strict multi-region latency, RPO, and cross-account encryption requirements.

Estimated Time:3m 0s

Question 1608Question →

An enterprise is designing a new critical online transaction processing (OLTP) pharmacy application across two AWS Regions: a primary region and a secondary disaster recovery region. The database layer must support high-volume read scaling with latency under $10\text{ ms}$ . The application must meet a database Recovery Point Objective (RPO) of less than $5\text{ minutes}$ and a Recovery Time Objective (RTO) of less than $15\text{ minutes}$ during a regional outage. The application also stores patient documents in Amazon S3, which must be replicated to an audit S3 bucket in a separate AWS security account. The replicated S3 objects must be encrypted at rest, and the security account must be able to decrypt the replicated data. Which of the following database and storage strategies should a solutions architect recommend to meet these requirements?

Deploy an Amazon RDS for PostgreSQL Multi-AZ DB instance in the primary region, configuring the standby replica to scale out read operations. Implement cross-region backup replication of database snapshots every 15 minutes. Replicate S3 objects using the AWS-managed KMS key (aws/s3) with an S3 bucket policy on the destination bucket allowing cross-account read access.

Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region. Set up Amazon S3 Cross-Region Replication to the audit account's bucket, encrypting the destination objects with the default AWS-managed KMS key (aws/s3) and configuring a cross-account IAM role to delegate decrypt permissions.

Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region. Set up Amazon S3 Cross-Region Replication to the audit account's bucket, encrypting the objects with a KMS Customer Managed Key (CMK), and configure the KMS key policy in the primary account to grant decrypt permissions to the audit account.

Deploy a single-region Amazon Aurora DB cluster in the primary region. Configure an AWS Backup plan to copy snapshots of the database to the secondary region every 4 hours, and restore the cluster using AWS CloudFormation in the event of a regional outage. Replicate S3 objects using a KMS Customer Managed Key (CMK) with appropriate cross-account key policy permissions.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region. Set up Amazon S3 Cross-Region Replication to the audit account's bucket, encrypting the objects with a KMS Customer Managed Key (CMK), and configure the KMS key policy in the primary account to grant decrypt permissions to the audit account.

Answer

Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the secondary region. Set up Amazon S3 Cross-Region Replication to the audit account's bucket, encrypting the objects with a KMS Customer Managed Key (CMK), and configure the KMS key policy in the primary account to grant decrypt permissions to the audit account.

Deploying an Amazon Aurora Global Database provides active-passive replication with sub-second data transport lag (RPO) and quick DNS-based failover (RTO), satisfying the 5-minute RPO and 15-minute RTO database requirements. Aurora Replicas scale the application's read workload with sub-10 ms latency. To achieve cross-account replication of encrypted objects in Amazon S3, a Customer Managed Key (CMK) must be used. Unlike default AWS-managed KMS keys, a CMK allows you to modify its key policy to explicitly delegate decrypt permissions to the audit account.

Step-by-Step Solution

Evaluate the database replication strategy to satisfy the RPO and RTO requirements.

Amazon Aurora Global Database replicates data with a latency of less than

1\text{ second}

, meeting the

5\text{ minutes}

RPO. It also allows failovers within minutes, meeting the

15\text{ minutes}

RTO.

Standard multi-region backups or snapshot replication strategies do not provide recovery speeds that meet the tight RTO and RPO limits.

Address read scaling requirements for the database layer.

Aurora Replicas in the active Aurora cluster handle read-scaling tasks with minimal replication lag.

RDS standby instances in a standard Multi-AZ deployment are passive and cannot serve read traffic.

Design the cross-account encryption and replication strategy for S3.

Configure S3 Cross-Region Replication using a KMS Customer Managed Key (CMK). Add permissions to the KMS key policy to allow the destination audit account to decrypt the objects.

AWS-managed keys (aws/s3) cannot be shared across accounts because their key policies are unmodifiable.

Key Concept

Designing database replication and cross-account encrypted storage strategies that align with specific RPO, RTO, performance, and compliance requirements.

Estimated Time:2m 0s

Question 1609Question →

PaySync Services is modernizing its mission-critical transaction-settlement application by migrating it from an on-premises virtualized environment to Amazon EKS. The application consists of stateless billing pods that process cardholder data and must pull container images from a centralized Amazon ECR repository located in a shared services AWS account. To comply with security policies, the billing pods must run on serverless compute, and the containers must not share hosts or network namespaces with other workloads. The billing pods require access to an Amazon Aurora PostgreSQL database located in an isolated database VPC, and they must retrieve database credentials securely from AWS Secrets Manager without using hardcoded keys.

Which combination of actions should the Solutions Architect perform to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Create an Amazon EKS Fargate profile for the namespace containing the billing pods. Configure the Amazon ECR repository policy in the shared services account to grant pull permissions to the EKS Fargate pod execution role in the application account.

Create an IAM OIDC provider for the Amazon EKS cluster. Create an IAM role with a trust policy that allows the EKS service account in the billing namespace to assume the role, annotate the Kubernetes ServiceAccount with the IAM role ARN, and configure the pods to use this ServiceAccount to access AWS Secrets Manager.

Configure a Route 53 Private Hosted Zone (PHZ) for the Secrets Manager endpoint in the database VPC, and configure the AWS Transit Gateway to route DNS traffic between the EKS VPC and the database VPC.

Configure the billing pods to use host networking mode in their pod specifications to bypass Fargate container network interfaces and directly communicate with the database VPC.

Attach the AmazonEC2ContainerRegistryReadOnly managed IAM policy to the EKS node instance role, and deploy the billing pods as a DaemonSet to ensure image pull capabilities are distributed across all Fargate nodes.

Show answer & explanation

Answer: Create an Amazon EKS Fargate profile for the namespace containing the billing pods. Configure the Amazon ECR repository policy in the shared services account to grant pull permissions to the EKS Fargate pod execution role in the application account.; Create an IAM OIDC provider for the Amazon EKS cluster. Create an IAM role with a trust policy that allows the EKS service account in the billing namespace to assume the role, annotate the Kubernetes ServiceAccount with the IAM role ARN, and configure the pods to use this ServiceAccount to access AWS Secrets Manager.

Answer

Create an Amazon EKS Fargate profile and configure the shared Amazon ECR repository policy to allow image pulls from the Fargate execution role. In addition, configure IAM Roles for Service Accounts (IRSA) using an OIDC provider to allow the pods to securely retrieve database credentials from AWS Secrets Manager.

To modernize the workload with serverless compute on Amazon EKS, the architect must use AWS Fargate. Creating a Fargate profile defines which pods run on Fargate. The EKS service uses the Fargate pod execution role to pull container images from Amazon ECR. Since ECR is in a shared services account, the registry policy must allow access to this execution role. Furthermore, to access Secrets Manager securely at the pod level, IAM Roles for Service Accounts (IRSA) must be configured using an OIDC provider, mapping the pod's ServiceAccount to an IAM role with the correct permissions.

Step-by-Step Solution

Determine the compute model and pod scheduling mechanism.

Identify that AWS Fargate satisfies the requirement for serverless compute and low administrative effort. Create an EKS Fargate profile to match the namespace of the billing pods.

Fargate profiles dictate which Kubernetes pods are scheduled on Fargate serverless infrastructure rather than EC2 nodes.

Configure secure cross-account image pulling from ECR.

Grant the EKS Fargate pod execution role access to the ECR repository policy in the shared services account.

For Fargate deployments, EKS uses the Fargate pod execution role to authenticate with ECR and pull container images before initialization, rather than the pod's IAM role.

Configure fine-grained pod-level access to AWS Secrets Manager.

Establish an IAM OIDC provider for the EKS cluster and associate the service account with an IAM role containing the Secrets Manager read policy.

IAM Roles for Service Accounts (IRSA) provides secure, least-privilege access for application containers running inside pods to read secrets without relying on node instance profiles.

Key Concept

Deploying serverless container workloads on Amazon EKS with Fargate requires understanding the separate roles of the Fargate Pod Execution Role (used by the EKS service for system operations like pulling images) and IAM Roles for Service Accounts (IRSA, used by the application code to access AWS services).

Question 1610Question →

An enterprise runs an application on Amazon EC2 instances in a private subnet within VPC A in Account A. The application must retrieve sensitive files from an Amazon S3 bucket in Account B. The S3 bucket is encrypted using a Customer Managed Key (CMK) in Account B. VPC A has no internet gateway, NAT gateway, or virtual private gateway configured. All traffic must remain within the AWS network, and the solution must enforce least-privilege security.

Which two actions should a Solutions Architect take to configure this connection? (Select two.)

Select all that apply

Create an S3 Gateway VPC Endpoint and a KMS Interface VPC Endpoint in VPC A, and associate the S3 gateway endpoint with the VPC A route tables.

Configure the KMS key policy of the Customer Managed Key in Account B to allow the application's IAM role in Account A to perform kms:Decrypt operations.

Configure the S3 bucket to use the AWS-managed key (aws/s3) in Account B, and update the application's IAM policy in Account A to allow decryption using this key.

Establish a VPC Peering connection between VPC A and a VPC in Account B, and route S3 traffic from VPC A through a Gateway VPC Endpoint deployed in Account B's VPC.

Attach a Service Control Policy (SCP) to the Organization root that grants the application's IAM role in Account A permissions to perform s3:GetObject and kms:Decrypt on resources in Account B.

Show answer & explanation

Answer: Create an S3 Gateway VPC Endpoint and a KMS Interface VPC Endpoint in VPC A, and associate the S3 gateway endpoint with the VPC A route tables.; Configure the KMS key policy of the Customer Managed Key in Account B to allow the application's IAM role in Account A to perform kms:Decrypt operations.

Answer

Create an S3 Gateway VPC Endpoint and a KMS Interface VPC Endpoint in VPC A, and configure the KMS key policy of the Customer Managed Key in Account B to trust the cross-account IAM role.

The correct solution involves setting up both S3 and KMS VPC endpoints in VPC A to ensure the network traffic remains private. S3 traffic goes through the gateway endpoint, and KMS decryption calls go through the KMS interface endpoint. For access, since the S3 objects are encrypted with a Customer Managed Key, the key policy in Account B must be updated to grant decryption rights to the cross-account IAM role in Account A.

Step-by-Step Solution

Configure private network routing to S3 and KMS in VPC A.

Create an S3 Gateway VPC Endpoint and associate it with VPC A's route tables to route S3 traffic privately. Create a KMS Interface VPC Endpoint (PrivateLink) in VPC A to allow the application to privately make kms:Decrypt API calls without internet routing.

Since the VPC has no internet or NAT gateway, all AWS API endpoints must be reached using VPC endpoints. Gateway endpoints are used for S3, while Interface endpoints are used for KMS.

Configure the cross-account KMS key policy.

Update the Customer Managed Key (CMK) key policy in Account B to grant the IAM role from Account A permissions for the kms:Decrypt action.

To read objects encrypted with SSE-KMS, the caller must have decrypt permissions. Because this is a cross-account scenario, a Customer Managed Key must be used, and its key policy must explicitly trust the external IAM role.

Configure cross-account S3 permissions.

Ensure the S3 bucket policy in Account B allows the IAM role in Account A to read the objects.

Cross-account access to S3 requires permissions to be granted both in the caller's IAM policy and the target bucket's policy.

Key Concept

Cross-account access to encrypted S3 resources from a private VPC requires a local S3 Gateway VPC Endpoint, a local KMS Interface VPC Endpoint, and explicit permission grants in both the S3 bucket policy and the KMS Customer Managed Key policy.

Question 1611Question →

An enterprise operates a high-throughput application on Amazon EC2 instances in private subnets across $3$ Availability Zones in the `us-east-1` Region. The application regularly pulls raw data sets from an Amazon S3 bucket, processes them, and writes the results to another S3 bucket in the same Region. Currently, outbound traffic to S3 is routed through a single NAT Gateway located in one of the public subnets. This setup processes approximately $80\text{ TB}$ of data monthly, leading to significant NAT Gateway data processing charges. Which of the following solutions is the most cost-effective and architecturally sound method to minimize these data transfer costs?

Replace the existing NAT Gateway with an Amazon S3 Interface VPC Endpoint in each of the

3

Availability Zones, and update the private route tables to target the interface endpoints.

Create an Amazon S3 Gateway VPC Endpoint in the VPC, and associate it with the route tables of the private subnets to route S3 traffic directly.

Deploy an AWS Transit Gateway, connect it to the VPC, and route all S3-bound traffic through a central egress VPC that hosts S3 Interface Endpoints.

Purchase a Compute Savings Plan to cover the S3 data transfer and processing costs from the NAT Gateway, while retaining the current routing architecture.

Show answer & explanation

Answer: Create an Amazon S3 Gateway VPC Endpoint in the VPC, and associate it with the route tables of the private subnets to route S3 traffic directly.

Answer

Create an Amazon S3 Gateway VPC Endpoint in the VPC, and associate it with the route tables of the private subnets to route S3 traffic directly.

Creating a Gateway VPC Endpoint for S3 is the most cost-effective solution because S3 Gateway Endpoints do not incur any hourly or data processing charges. By associating the endpoint with the private subnet route tables, S3-bound traffic is routed directly to the regional S3 service over the AWS network, bypassing the NAT Gateway and eliminating the associated processing charges.

Step-by-Step Solution

Analyze the current data path and cost drivers.

The application transfers

80\text{ TB}

of data to and from S3 through a NAT Gateway, which incurs a processing fee of

\$0.045\text{ per GB}

in the `us-east-1` Region.

Identifying the primary source of the cost is necessary to determine the appropriate optimization target.

Evaluate AWS VPC endpoints for S3 traffic.

Gateway VPC Endpoints for S3 are free and route traffic privately without traversing a NAT Gateway, whereas Interface VPC Endpoints incur hourly and processing fees (

\$0.01\text{ per GB}

Choosing the endpoint type with the lowest cost model is essential for achieving optimal savings.

Configure routing to bypass the NAT Gateway for S3.

Create a Gateway VPC Endpoint for S3 and associate it with the private subnet route tables. This automatically adds a route pointing to S3 via the prefix list.

Updating route tables ensures that only S3-destined traffic bypasses the NAT Gateway, maintaining external internet access for other traffic.

Key Concept

VPC Gateway Endpoints provide a secure, cost-free mechanism to access Amazon S3 and DynamoDB without routing traffic through a NAT Gateway, NAT instance, or virtual private gateway.

Question 1612Question →

A biotechnology firm is planning to migrate its drug discovery platform to AWS. The on-premises environment consists of 50 VMware vSphere virtual machines (VMs) and 10 physical bare-metal database servers. The firm's strict security compliance policy prohibits installing any third-party software or agents on the production VMware guest operating systems. However, they must perform network connection dependency mapping on the bare-metal database servers to identify active TCP connections and group them with the correct front-end applications. All servers are restricted from direct outbound internet access, but a central proxy server is available for outbound HTTPS traffic. Which combination of actions should a solutions architect recommend to collect the necessary discovery data and track the migration? (Select TWO.)

Select all that apply

Deploy the AWS Application Discovery Agentless Collector as an OVA in the VMware vCenter environment to gather VM configuration and utilization metrics without guest OS agent installation.

Install the AWS Application Discovery Agent on the 10 physical bare-metal database servers and configure the agent configuration file to route HTTPS traffic through the central proxy server.

Install the AWS Application Discovery Agent on the VMware VMs, and configure the local firewall to permit traffic on TCP port 1500 to the migration staging area to discover the server dependencies.

Deploy the AWS Application Discovery Agentless Collector on a dedicated physical utility server to perform active network connection mapping and process discovery on the bare-metal database hosts.

Use AWS Schema Conversion Tool (SCT) to extract database schemas and manually upload the database metadata as a CSV file to AWS Migration Hub to dynamically map real-time network dependencies.

Show answer & explanation

Answer: Deploy the AWS Application Discovery Agentless Collector as an OVA in the VMware vCenter environment to gather VM configuration and utilization metrics without guest OS agent installation.; Install the AWS Application Discovery Agent on the 10 physical bare-metal database servers and configure the agent configuration file to route HTTPS traffic through the central proxy server.

Answer

Deploy the AWS Application Discovery Agentless Collector as an OVA in the VMware vCenter environment, and install the AWS Application Discovery Agent on the 10 physical bare-metal database servers, configuring the agents to route traffic through the central proxy.

To discover the VMware VMs without violating the security policy that prohibits guest OS agent installation, the solutions architect should deploy the Agentless Collector as an OVA in VMware vCenter. To map the network dependencies and process information on the physical bare-metal servers, the Application Discovery Agent must be installed directly on those hosts. Because outbound internet connectivity is restricted, the agents must be configured to route discovery data through the centralized HTTPS proxy server.

Step-by-Step Solution

Analyze the discovery requirements for the VMware vSphere VMs.

Since the security compliance policy prohibits installing guest-level agents, an agentless discovery mechanism is required. The AWS Application Discovery Agentless Collector is deployed as an OVA inside VMware vCenter to discover VMs agentlessly.

Ensures compliance with security policies while still gathering necessary system configurations and utilization data.

Analyze the discovery requirements for the physical bare-metal database servers.

The bare-metal servers require network connection dependency mapping. This depth of discovery is only supported by the host-based AWS Application Discovery Agent, which must be installed on the operating systems.

Agentless mechanisms cannot query OS-level network connections or processes, making the agent necessary for database servers.

Configure network access for the installed agents.

Configure the agent config file on the physical servers to forward outbound HTTPS traffic (port 443) through the designated central proxy server.

Allows the discovery agent to send collected data to AWS endpoints in a restricted network environment.

Key Concept

Hybrid environment discovery using AWS Application Discovery Service agent-based and agentless collection mechanisms while adhering to security and proxy constraints.

Estimated Time:2m 0s

Question 1613Question →

An enterprise needs to migrate $1.2\text{ PB}$ of historical log data from an on-premises Hadoop Distributed File System (HDFS) cluster to Amazon S3. The company has a $1\text{ Gbps}$ AWS Direct Connect connection, but corporate policy restricts the migration workload to utilizing a maximum of $300\text{ Mbps}$ of this bandwidth. The migration must be completed within $45\text{ days}$ . Concurrently, legacy applications must continue writing new log data using the SFTP protocol. The target S3 bucket resides in a centralized Logging Account (Account B), and all stored logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) managed by Account B. The migration is being executed by a team operating within a separate Migration Account (Account A), which is responsible for ordering and managing the transfer infrastructure. Which two options should the Solutions Architect recommend to satisfy these requirements? (Select TWO.)

Select all that apply

Order 15 AWS Snowball Edge Storage Optimized devices from Account A, load the historical HDFS data onto the devices, and ship them to AWS to import the data into a temporary S3 bucket in Account A. Run an AWS DataSync task to copy the imported data from Account A's S3 bucket to Account B's S3 bucket, using Account B's Customer Managed Key (CMK) for encryption.

Deploy an AWS DataSync agent on-premises and configure an HDFS source location. Create a DataSync task to transfer the

1.2\text{ PB}

of historical data directly over the AWS Direct Connect connection to Account B's S3 bucket, setting a bandwidth limit of

300\text{ Mbps}

on the task.

Set up an AWS Transfer Family SFTP-enabled server in Account B, configured with a public VPC endpoint. Map the server's user directories to Account B's S3 bucket, and configure the legacy applications to write new log data using this endpoint, authorizing access via an IAM role that encrypts objects using Account B's Customer Managed Key (CMK).

Order 15 AWS Snowball Edge Storage Optimized devices from Account A. Configure the Snowball jobs to import the HDFS data directly into Account B's S3 bucket, specifying the default AWS-managed KMS key 'aws/s3' in Account B for target object encryption.

Configure an AWS Transfer Family SFTP server in Account A. Establish a transit routing path using AWS Transit Gateway and VPC peering to allow legacy applications to stream new data through Account A's SFTP server directly into Account B's S3 bucket, encrypting the objects using an AWS-managed KMS key.

Show answer & explanation

Answer: Order 15 AWS Snowball Edge Storage Optimized devices from Account A, load the historical HDFS data onto the devices, and ship them to AWS to import the data into a temporary S3 bucket in Account A. Run an AWS DataSync task to copy the imported data from Account A's S3 bucket to Account B's S3 bucket, using Account B's Customer Managed Key (CMK) for encryption.; Set up an AWS Transfer Family SFTP-enabled server in Account B, configured with a public VPC endpoint. Map the server's user directories to Account B's S3 bucket, and configure the legacy applications to write new log data using this endpoint, authorizing access via an IAM role that encrypts objects using Account B's Customer Managed Key (CMK).

Answer

Order AWS Snowball Edge Storage Optimized devices in the Migration Account (Account A) to migrate the historical HDFS data to a temporary S3 bucket in Account A, and then use AWS DataSync to copy that data to Account B's S3 bucket using Account B's Customer Managed Key. For the ongoing legacy SFTP traffic, deploy an AWS Transfer Family SFTP-enabled server in Account B mapping directly to the target S3 bucket and utilizing Account B's Customer Managed Key.

The correct architecture separates the bulk historical migration from the real-time legacy application logs. Because transferring

1.2\text{ PB}

over

300\text{ Mbps}

takes about

370

days, the Solutions Architect must use an offline migration option (AWS Snowball Edge Storage Optimized devices). Since the migration team operates in Account A, the

15

required devices must be ordered in Account A and imported into a temporary S3 bucket in Account A first, as cross-account direct target bucket selection is not supported in the Snowball Edge console. From there, AWS DataSync copies the data into Account B's S3 bucket, leveraging a Customer Managed Key (CMK) in Account B. This KMS key choice is mandatory because default AWS-managed KMS keys ('aws/s3') do not support policy modification and cannot be shared cross-account. To accommodate the legacy application SFTP requirement, establishing an AWS Transfer Family SFTP endpoint directly in Account B ensures that ongoing files write directly into the target bucket under the correct CMK encryption role.

Step-by-Step Solution

Calculate the transfer duration for the historical data over the network.

Total bits to transfer:

1.2\text{ PB} = 1.2 \times 10^{15}\text{ bytes} \times 8 = 9.6 \times 10^{15}\text{ bits}

. At a bandwidth limit of

300\text{ Mbps}

(

3 \times 10^8\text{ bits/second}

), the transfer time is:

\text{Time} = \frac{9.6 \times 10^{15}}{3 \times 10^8} = 3.2 \times 10^7\text{ seconds} \approx 370.37\text{ days}

This far exceeds the required

45

-day migration window.

Identify if physical shipment (Snowball Edge) or online transfer (DataSync) is required for the bulk historical data migration.

Determine Snowball Edge device sizing and cross-account constraint logic.

A single Snowball Edge Storage Optimized device has

80\text{ TB}

usable capacity. The number of devices required is:

\frac{1,200\text{ TB}}{80\text{ TB/device}} = 15\text{ devices}

Because Snowball Edge jobs must target a bucket in the same account as the order, the devices must be imported into a temporary bucket in Account A, and then transferred to Account B.

Comply with procurement rules where Account A manages the migration while honoring the technical constraint that Snowball imports are account-bound.

Select the cross-account encryption and copy tool.

AWS DataSync is selected to perform the copy from Account A's temporary bucket to Account B's bucket. Since the target encryption must use a Customer Managed Key (CMK) in Account B, the CMK's key policy must explicitly allow the DataSync execution role in Account A to use it. Default AWS-managed KMS keys ('aws/s3') cannot be used for this cross-account step.

Ensure security compliance by designing a secure, cross-account file copy mechanism that respects KMS CMK access controls.

Establish the SFTP channel for legacy writes.

Deploy an AWS Transfer Family SFTP endpoint directly in Account B to map user directories to the destination S3 bucket. Applications authenticate and write directly, encrypting objects via Account B's Customer Managed Key.

Satisfy the real-time application write protocol (SFTP) using native AWS services without introducing transitive network routing overhead.

Key Concept

Determining offline vs. online migration strategies based on network bandwidth/duration constraints, and addressing cross-account KMS key and bucket access limitations.

Question 1614Question →

A retail company operates an e-commerce platform that experiences significant performance degradation during promotional flash sales. The application relies on an Amazon Aurora MySQL database cluster to store both the product catalog and customer shopping sessions. During peak events, database CPU utilization reaches $95\%$ , resulting in transaction failures and slow response times. The product catalog data is read-heavy and updated infrequently, while the shopping session data requires high-throughput writes, persistence, and replication across multiple Availability Zones to ensure session recovery in the event of an outage. Which TWO architectural modifications should a Solutions Architect recommend to resolve the database bottleneck while meeting the requirements? (Select TWO.)

Select all that apply

Migrate the shopping session data to an Amazon ElastiCache for Redis replication group with Multi-AZ enabled.

Migrate the shopping session data to an Amazon ElastiCache for Memcached cluster to leverage its high-throughput write capabilities.

Implement an Amazon ElastiCache for Redis cluster with replication to cache product catalog read queries.

Implement an Amazon ElastiCache for Memcached cluster to cache product catalog read queries and configure replication across two Availability Zones.

Configure Amazon Aurora Auto Scaling to dynamically add read replicas, and configure the application to write session data directly to the read replicas.

Show answer & explanation

Answer: Migrate the shopping session data to an Amazon ElastiCache for Redis replication group with Multi-AZ enabled.; Implement an Amazon ElastiCache for Redis cluster with replication to cache product catalog read queries.

Answer

Migrate the shopping session data to an Amazon ElastiCache for Redis replication group with Multi-AZ enabled, and implement an Amazon ElastiCache for Redis cluster with replication to cache product catalog read queries.

The correct approach involves migrating the write-heavy, persistent session data to an Amazon ElastiCache for Redis replication group, which supports replication, persistence, and Multi-AZ failover. Simultaneously, implementing an Amazon ElastiCache for Redis cluster with replication to cache the read-heavy product catalog reads offloads read traffic from the Aurora cluster, providing sub-millisecond latency and preventing a database query stampede if a cache node fails.

Step-by-Step Solution

Analyze the access patterns and durability requirements for both datasets.

Product catalog is read-heavy and static; shopping session is write-heavy and requires persistence and Multi-AZ replication.

This determines the caching or database architecture suitable for each.

Evaluate ElastiCache engines for the shopping sessions.

ElastiCache for Redis is selected because it supports persistence, replication, and Multi-AZ. Memcached is rejected as it lacks replication and persistence.

Session recovery requires data replication and durability.

Evaluate offloading strategies for the read-heavy product catalog.

Cache catalog queries in ElastiCache for Redis with replication to handle spikes and prevent node-failure database stampedes.

Redis replication ensures high availability for the cache layer under heavy read loads.

Key Concept

Distinguishing between Redis and Memcached caching engines based on replication, persistence, and session state requirements.

Question 1615Question →

A logistics company is migrating $18$ legacy route optimization virtual machines from an on-premises VMware vSphere cluster to AWS using AWS Application Migration Service (MGN). The replication traffic must flow privately over an existing AWS Direct Connect connection with a private virtual interface (VIF) terminated at an AWS Transit Gateway. The Transit Gateway connects to a Staging Area VPC. A dedicated Shared Services VPC hosts central Route 53 Private Hosted Zones (PHZs) and Route 53 Resolver endpoints. The company's security policy prohibits any public internet access for the source VMs and the staging environment.

During the initial replication phase, the migration team observes that the MGN Replication Agents installed on the source VMs fail to establish data replication with the Replication Servers in the Staging Area VPC, although control plane connectivity to the MGN endpoints is established.

Which combination of configuration steps will resolve the replication failure and ensure the migration succeeds over the private path in accordance with the security policy?

Bypass the Transit Gateway by establishing a new public virtual interface on the Direct Connect connection to route replication traffic directly to the MGN public endpoints, configure the Staging Area VPC route tables to point to the Direct Connect Gateway as the next hop, and allow TCP port

1500

on the Staging Area VPC network access control lists.

Configure the Staging Area VPC security groups to allow inbound traffic on TCP port

1500

, but restrict the Route 53 Private Hosted Zone associations exclusively to the Shared Services VPC to maintain centralized DNS management, relying on conditional forwarders on the on-premises DNS servers pointing to Route 53 Resolver inbound endpoints.

Configure the Staging Area VPC security groups to allow inbound traffic on TCP port

1500

from the on-premises subnet range, associate the Route 53 Private Hosted Zones for the MGN and EC2 interface endpoints with the Staging Area VPC, and verify that the Transit Gateway route tables contain appropriate routes for transitive traffic between the on-premises network and the Staging Area VPC.

Configure the Staging Area VPC security groups to allow inbound traffic on TCP port

443

for data replication, deploy a single NAT Gateway in a single Availability Zone of the Staging Area VPC to route outbound data replication traffic, and associate the Route 53 Private Hosted Zone with the target workload VPC.

Show answer & explanation

Answer: Configure the Staging Area VPC security groups to allow inbound traffic on TCP port $1500$ from the on-premises subnet range, associate the Route 53 Private Hosted Zones for the MGN and EC2 interface endpoints with the Staging Area VPC, and verify that the Transit Gateway route tables contain appropriate routes for transitive traffic between the on-premises network and the Staging Area VPC.

Answer

Configure the Staging Area VPC security groups to allow inbound traffic on TCP port

1500

To establish private replication using AWS Application Migration Service (MGN) over Direct Connect and Transit Gateway, the replication agents installed on the source servers must transfer data blocks to the MGN Replication Servers over TCP port

1500

. Therefore, the Staging Area VPC security group must allow inbound TCP port

1500

from the on-premises subnet. Additionally, because the architecture uses PrivateLink (interface VPC endpoints) for private MGN and EC2 API access, the associated Route 53 Private Hosted Zones must be associated with the Staging Area VPC so that replication servers can resolve service endpoints to private IPs. Finally, Transit Gateway routing must be correctly configured to enable communication between the on-premises network and the Staging Area VPC.

Step-by-Step Solution

Configure the security groups in the Staging Area VPC.

Inbound TCP port

1500

is allowed from the on-premises subnet range containing the source VMs.

The MGN replication agent transmits replicated data blocks to the staging replication servers over TCP port

1500

. Without this open, data replication stalls.

Associate the Route 53 Private Hosted Zones with the Staging Area VPC.

The replication servers and resources in the Staging Area VPC can resolve AWS service endpoints privately via AWS PrivateLink.

To maintain a private-only network path, MGN and EC2 API calls must go through interface endpoints. The hosted zones must be associated with the Staging VPC to enable DNS resolution.

Verify and configure AWS Transit Gateway route tables.

Bidirectional routing is established between the on-premises network (via Direct Connect) and the Staging Area VPC.

Replication data must traverse the private network path. The Transit Gateway requires correct route propagation and association to allow the VMs to reach the Staging VPC.

Key Concept

Establishing private, secure data replication using AWS Application Migration Service over a hybrid network path.

Question 1616Question →

A university department is migrating its research analytics platform, which consists of $12$ physical servers, to AWS using AWS Application Migration Service (MGN). The migration must use a private network path over a $1\text{ Gbps}$ AWS Direct Connect connection with an AWS Transit Gateway. The AWS Replication Agent has been installed on the source servers, and the agent successfully establishes control plane communication with the MGN service endpoints. However, data replication is failing to initiate, and status logs indicate that the replication servers in the staging area VPC cannot receive replication data blocks from the source servers. Which action should the solutions architect take to resolve this issue and enable replication?

Configure a Direct Connect Gateway directly attached to the staging area VPC using a Private Virtual Interface (VIF) instead of Transit Gateway to route replication traffic.

Allow inbound traffic on TCP port 1500 in the security groups of the staging area VPC and allow outbound traffic on TCP port 1500 from the on-premises firewall.

Associate the Route 53 Private Hosted Zone used for the MGN API endpoints with the staging area VPC to resolve DNS queries for the replication servers.

Deploy a single NAT Gateway in the staging area VPC to route the replication traffic, and update the replication template to route all outbound replication traffic through it.

Show answer & explanation

Answer: Allow inbound traffic on TCP port 1500 in the security groups of the staging area VPC and allow outbound traffic on TCP port 1500 from the on-premises firewall.

Answer

Allow inbound traffic on TCP port 1500 in the security groups of the staging area VPC and allow outbound traffic on TCP port 1500 from the on-premises firewall.

The correct answer correctly identifies that AWS MGN utilizes TCP port 1500 for the continuous replication of data blocks from the source server agent to the replication servers located in the staging area VPC. Opening this port in both directions resolves the data replication timeout while preserving the existing, functioning control plane channel over HTTPS.

Step-by-Step Solution

Analyze the connection status and identify which protocol/ports are failing.

The agent successfully connects to the MGN control plane (TCP port 443) but fails to replicate data blocks (TCP port 1500).

To isolate whether the issue is DNS, routing, or firewall/security group rules.

Check the requirements of the AWS Application Migration Service (MGN) for data replication traffic.

MGN requires TCP port 1500 to be open for data transfer between the replication agent on the source server and the replication servers in the staging area VPC.

To determine the required network port configuration for data replication.

Modify the relevant firewall and security group rules to permit traffic on TCP port 1500.

Outbound TCP port 1500 is allowed on the on-premises firewall, and inbound TCP port 1500 is allowed on the staging area VPC security groups.

To allow the Replication Agent to successfully stream data blocks to the replication servers.

Key Concept

AWS MGN uses TCP port 443 for control plane communication and TCP port 1500 for data replication.

Estimated Time:2m 0s

Question 1617Question →

A company operates a critical web application on AWS that runs on Amazon EC2 instances inside an Auto Scaling group behind an Application Load Balancer (ALB). The instances are deployed across two Availability Zones (us-east-1a and us-east-1b) in private subnets. Outbound internet traffic for both zones is routed through a single NAT Gateway located in us-east-1a.

During sudden morning traffic spikes, CPU utilization on the EC2 instances surges to 95% within 2 minutes. The Auto Scaling group uses a target tracking policy based on average CPU utilization with a 60-second cooldown period. However, because new instances require 5 minutes to bootstrap and initialize, the Auto Scaling group launches duplicate, redundant instances during the lag, which remain idle once initialization completes. Additionally, when us-east-1a experiences an outage, instances in us-east-1b lose all outbound connectivity, failing to reach external APIs.

Which two configurations should the solutions architect implement to resolve these scaling and availability issues?

Select all that apply

Deploy a NAT Gateway in each Availability Zone, and update the private subnet route tables to route outbound traffic through the NAT Gateway in their respective Availability Zone.

Configure an Auto Scaling group warm pool to maintain a pool of pre-warmed instances, and increase the scaling cooldown period to exceed the instance bootstrapping and initialization time.

Keep the single NAT Gateway in us-east-1a, and configure the route table of the private subnet in us-east-1b to route outbound traffic through the Application Load Balancer during an outage.

Decrease the Auto Scaling group cooldown period to 15 seconds to allow the scaling policy to react more aggressively to CPU spikes before the CPU reaches 95%.

Submit a request to AWS Support to pre-warm the Application Load Balancer prior to the morning spikes to distribute traffic more evenly and prevent EC2 CPU surges.

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone, and update the private subnet route tables to route outbound traffic through the NAT Gateway in their respective Availability Zone.; Configure an Auto Scaling group warm pool to maintain a pool of pre-warmed instances, and increase the scaling cooldown period to exceed the instance bootstrapping and initialization time.

Answer

Deploy a NAT Gateway in each Availability Zone, and configure an Auto Scaling group warm pool while increasing the scaling cooldown period.

Deploying a dedicated NAT Gateway in each Availability Zone resolves the single point of failure for outbound traffic. Using an Auto Scaling group warm pool keeps instances in a pre-warmed state to reduce startup latency, and increasing the scaling cooldown period to exceed the initialization time ensures the scaling policy waits for new instances to take load before triggering further scale-out events.

Step-by-Step Solution

Address the single point of failure in outbound traffic routing.

Identify that routing traffic from both Availability Zones through a single NAT Gateway in one zone causes outbound traffic loss during a zone failure.

Deploying a NAT Gateway in each Availability Zone and pointing local private subnets to their respective zone's NAT Gateway ensures high availability and isolates zone failures.

Resolve the issue of launching duplicate, redundant instances during scaling lags.

Recognize that the 60-second cooldown period is too short for a 5-minute instance bootstrapping duration, leading to premature scale-out triggers.

Using an Auto Scaling group warm pool speeds up the availability of ready instances, and increasing the cooldown period to exceed the initialization time prevents unnecessary scaling actions while the scaling policy waits for the new instances to register metrics.

Key Concept

Fault tolerance for outbound traffic requires multi-AZ NAT Gateway redundancy, and auto-scaling policies must account for instance bootstrapping time through proper cooldown settings and warm pools.

Question 1618Question →

An energy utility company plans to migrate its legacy billing and operations platform to AWS. The on-premises environment is hosted on Microsoft Hyper-V. Due to strict energy sector compliance regulations, the security team prohibits installing any third-party software agents on the database virtual machines (VMs) containing customer billing data. However, the migration team requires deep network dependency mapping and process-level details for the web and application tier VMs to identify system boundaries and map network connections. Additionally, the company wants to track the overall migration status from a single dashboard using both AWS Application Discovery Service and third-party migration tools. Which combination of discovery mechanisms and tracking setup will meet these requirements while complying with the security policy?

Deploy the AWS Application Discovery Agentless Collector on the Hyper-V hosts to gather configuration and performance data for the database virtual machines. Install the AWS Application Discovery Agent on the web and application virtual machines to collect network connections and process details. Register both the AWS discovery tools and the third-party migration tools with AWS Migration Hub in a single home Region to track the migration.

Install the AWS Application Discovery Agent on all virtual machines, configuring the agents on the database virtual machines to run in read-only mode to satisfy the security policy. Use AWS Application Migration Service (MGN) to import the server inventory and track the migration status of both AWS and third-party tools from the replication console.

Deploy the AWS Application Discovery Agentless Collector on the Hyper-V hosts for all virtual machines, as the collector can perform guest OS process-level analysis and map TCP/UDP network connections without agent installation. Set up Service Control Policies (SCPs) in AWS Organizations to restrict AWS Migration Hub tracking access to compliance administrators.

Use AWS DataSync to scan the Hyper-V datastores to identify VM configurations and map network dependencies. Deploy the AWS Application Discovery Agentless Collector to monitor performance, and configure AWS Migration Hub in multiple target Regions to track the migration process for each application tier.

Show answer & explanation

Answer: Deploy the AWS Application Discovery Agentless Collector on the Hyper-V hosts to gather configuration and performance data for the database virtual machines. Install the AWS Application Discovery Agent on the web and application virtual machines to collect network connections and process details. Register both the AWS discovery tools and the third-party migration tools with AWS Migration Hub in a single home Region to track the migration.

Answer

The correct answer correctly satisfies both constraints: the database VMs use the Agentless Collector at the Hyper-V host level, preventing guest OS modification, while the web and application VMs use the Agent-based collector to gather the process and network dependency mappings. In addition, it properly designates AWS Migration Hub in a single home Region to aggregate tracking details from both AWS and partner/third-party migration tools.

Step-by-Step Solution

Analyze on-premises VM types and constraints.

The database VMs cannot have agents installed, meaning agentless discovery must be used. Web and application tier VMs require network dependency mapping and process-level details, meaning agent-based discovery must be used.

Choosing the correct discovery tool is governed by the OS-level access constraints and the depth of telemetry required.

Select the appropriate AWS Application Discovery tools.

Deploy the AWS Application Discovery Agentless Collector on Hyper-V for the databases, and install the AWS Application Discovery Agent on the web and application VMs.

Agentless Collector gathers VM metadata and performance specs at the hypervisor layer without OS agents, whereas the Agent gathers process and dependency maps from inside the guest OS.

Determine tracking dashboard configuration.

Configure AWS Migration Hub in a single home Region and register the discovery results along with any supported third-party migration tools.

AWS Migration Hub integrates both AWS and partner migration tools to track migration progress from a centralized dashboard in a designated home Region.

Key Concept

AWS Application Discovery Service Agent vs. Agentless Collector trade-offs and AWS Migration Hub tracking integration.

Estimated Time:2m 0s

Question 1619Question →

A company runs a high-throughput transaction processing system on Amazon EC2 instances within private subnets in the `us-east-1` Region. The instances generate approximately $120\text{ TB}$ of raw application logs each month. These logs are uploaded immediately to an Amazon S3 bucket in `us-east-1` for near-real-time auditing. In compliance with regulatory requirements, the logs must also be replicated to a secondary S3 bucket in the `us-west-2` Region for long-term disaster recovery. The disaster recovery logs are rarely accessed but must be retained for $5$ years. Currently, all outbound internet and S3 traffic from the private subnets routes through a pair of NAT Gateways, resulting in high monthly bills.

Which combination of actions will reduce the storage and data transfer costs for this architecture most effectively? (Select TWO.)

Select all that apply

Create an Amazon S3 Gateway VPC Endpoint in the VPC and associate it with the route tables of the private subnets.

Configure an Amazon S3 Lifecycle policy on the destination S3 bucket in `us-west-2` to transition the log files to S3 Glacier Deep Archive after

30

days.

Provision an Amazon S3 Interface VPC Endpoint in the private subnets and configure the application to upload logs using the interface endpoint's private DNS name.

Enable Amazon S3 Replication Time Control (S3 RTC) on the replication rule and configure a lifecycle policy to transition the source logs to S3 Glacier Deep Archive immediately.

Establish an AWS Site-to-Site VPN tunnel between the VPC and `us-west-2` to route the cross-Region S3 replication traffic over the VPN.

Show answer & explanation

Answer: Create an Amazon S3 Gateway VPC Endpoint in the VPC and associate it with the route tables of the private subnets.; Configure an Amazon S3 Lifecycle policy on the destination S3 bucket in `us-west-2` to transition the log files to S3 Glacier Deep Archive after $30$ days.

Answer

The most cost-effective actions are to create an Amazon S3 Gateway VPC Endpoint in the VPC for same-Region uploads and to configure an Amazon S3 Lifecycle policy to transition logs to S3 Glacier Deep Archive after

30

days on the destination bucket.

Creating a Gateway VPC Endpoint enables the instances in private subnets to send

120\text{ TB}

of data to the local S3 bucket directly and for free, bypassing the NAT Gateways and eliminating the per-GB data processing fees. Transitioning the disaster recovery logs in `us-west-2` to S3 Glacier Deep Archive after

30

days is the most cost-effective option for long-term storage because it aligns with the retention requirement of

5

years and the access pattern of being rarely accessed, resulting in maximum storage cost savings.

Step-by-Step Solution

Analyze the current route for same-Region uploads to S3.

Uploading

120\text{ TB}

of data via NAT Gateways results in significant charges because NAT Gateways charge a per-GB data processing fee ($0.045 per GB in `us-east-1`).

Identify data transfer and processing cost drivers in the existing configuration.

Determine the optimal VPC endpoint type for S3 traffic.

An Amazon S3 Gateway VPC Endpoint is selected because it is free of charge and does not incur hourly or data processing fees, unlike an S3 Interface VPC Endpoint.

Minimize NAT Gateway data processing charges for same-Region S3 traffic.

Evaluate S3 storage classes for the disaster recovery copy.

S3 Glacier Deep Archive is selected because it is the lowest-cost storage tier (

0.00099 per GB-month) suitable for logs that are rarely accessed and must be kept for

5$ years.

Optimize long-term storage costs for compliance and disaster recovery data.

Key Concept

Combining Gateway VPC Endpoints to eliminate NAT Gateway processing costs with S3 Lifecycle policies to optimize long-term cross-Region storage costs.

Question 1620Question →

A public sector transit authority is preparing to migrate its transport management and ticketing systems to AWS. The on-premises infrastructure consists of two environments:

1. A VMware vSphere cluster hosting 150 virtual machines (VMs) running x86-based CentOS and Windows Server.
2. A separate IBM Power Systems environment hosting 15 physical bare-metal servers running IBM AIX for legacy transaction processing.

The authority's security compliance policy strictly prohibits the installation of any third-party software agents on the CentOS and Windows VMs. However, the project team must perform an initial discovery phase to gather hardware specifications (CPU, RAM, and disk capacity) and utilization metrics for these VMs to size the AWS target environment. Additionally, they must inventory the physical AIX servers and consolidate all discovered resource details into AWS Migration Hub to track the migration.

Which of the following discovery strategies should the Solutions Architect implement to meet these requirements?

Deploy the AWS Application Discovery Agentless Collector as an OVA in the VMware vCenter environment to discover the VMware VMs. For the physical AIX servers, use the AWS Migration Hub import template to manually upload a CSV file containing their inventory and configuration details.

Install the AWS Application Discovery Agent on the physical AIX servers to collect their configuration. Deploy the AWS Application Discovery Agentless Collector in the VMware vCenter environment to discover the VMware VMs without installing software on them.

Deploy the AWS Application Discovery Agentless Collector in the VMware vCenter environment and configure it to scan the network subnet of the physical AIX servers using SSH credentials to discover the AIX servers agentlessly.

Install the AWS Systems Manager (SSM) Agent on both the VMware VMs and the physical AIX servers, enable SSM Inventory, and use the AWS Systems Manager integration to sync the discovered resource data directly to AWS Migration Hub.

Show answer & explanation

Answer: Deploy the AWS Application Discovery Agentless Collector as an OVA in the VMware vCenter environment to discover the VMware VMs. For the physical AIX servers, use the AWS Migration Hub import template to manually upload a CSV file containing their inventory and configuration details.

Answer

The correct strategy uses the AWS Application Discovery Agentless Collector to query the VMware vCenter Server. This agentless approach gathers VM metadata and utilization metrics directly from vCenter, satisfying the security policy prohibiting software agent installation on the CentOS and Windows VMs. Since the physical AIX servers are on non-VMware hardware and run an operating system unsupported by the AWS Application Discovery Agent, they must be registered in AWS Migration Hub by manually importing their configurations using a CSV file template.

Step-by-Step Solution

Analyze the discovery requirements for the VMware vSphere environment.

Since agent installation is prohibited, the Agentless Collector is the appropriate tool. It runs as an OVA appliance in vCenter and collects VM specs and performance metrics without guest-level agents.

To comply with the security policy prohibiting agents on the CentOS and Windows VMs.

Analyze the discovery options for the physical IBM AIX servers.

AWS Application Discovery Agents do not support AIX operating systems (only Windows and x86/x64 Linux). The Agentless Collector only works inside VMware environments. Thus, native automatic discovery is not possible.

To identify constraints of native AWS Discovery tools on legacy non-x86 physical infrastructure.

Select a method to consolidate the AIX server inventory into AWS Migration Hub.

AWS Migration Hub allows importing server data manually via a formatted CSV file.

To ensure that all assets, including legacy servers, are tracked in a single pane of glass in AWS Migration Hub.

Key Concept

Discovery tool compatibility and tracking limits based on OS, virtualization, and agent deployment constraints.

Alternative Method

Utilize a Migration Hub-integrated third-party discovery and planning tool that natively supports agentless discovery of legacy UNIX operating systems and physical machines, automatically syncing the inventory to AWS Migration Hub.

Estimated Time:2m 30s

PreviousPage 81 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept