All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A healthcare enterprise is designing a new cloud-native patient monitoring platform. The architecture comprises a high-throughput telemetry service (NoSQL database workload) and a medical imaging archiving service (Object storage workload). The solution must span two AWS accounts: a Production account (where applications run in the us-east-1 primary region and us-west-2 secondary region) and a centralized Security account.

The system must satisfy the following design constraints:
- Telemetry database writes must support low-latency ingest, and read availability must be maintained in both regions. The disaster recovery requirements dictate a Recovery Time Objective (RTO) of less than 10 minutes and a Recovery Point Objective (RPO) of less than 1 minute.
- Imaging reports must be written directly from application servers in the Production account to an Amazon S3 bucket in the Security account.
- The S3 bucket data must be encrypted at rest. To comply with corporate audits, the encryption keys must support custom rotation schedules and policy-based delegation. The application servers in the Production account must have permission to upload objects and read them back.

Which database and storage strategy meets these requirements?

Deploy Amazon DynamoDB global tables in the Production account across us-east-1 and us-west-2. In the Security account, create the S3 bucket and an AWS KMS Customer Managed Key (CMK). Configure the CMK's key policy to grant the Production account IAM roles permissions for kms:GenerateDataKey and kms:Decrypt, and configure the S3 bucket policy to grant the Production IAM roles permissions for s3:PutObject and s3:GetObject.

Deploy Amazon DynamoDB global tables in the Production account across us-east-1 and us-west-2. In the Security account, create the S3 bucket and configure it to use the default AWS-managed KMS key (aws/s3) for encryption. Configure the S3 bucket policy to grant the Production IAM roles permissions for s3:PutObject and s3:GetObject.

Deploy Amazon RDS for PostgreSQL in us-east-1 with a Multi-AZ deployment. To handle query scaling and ensure high availability, configure the application to write to the primary DB instance and read from both the primary instance and the Multi-AZ standby instance. In the Security account, create the S3 bucket and an AWS KMS Customer Managed Key (CMK), granting key policy and bucket policy access to the Production IAM roles.

Deploy a single-region Amazon DynamoDB table in us-east-1. Use AWS Backup to take daily backups of the DynamoDB table and copy them to us-west-2 for disaster recovery. In the Security account, create the S3 bucket and an AWS KMS Customer Managed Key (CMK), granting key policy and bucket policy access to the Production IAM roles.

Show answer & explanation

Answer: Deploy Amazon DynamoDB global tables in the Production account across us-east-1 and us-west-2. In the Security account, create the S3 bucket and an AWS KMS Customer Managed Key (CMK). Configure the CMK's key policy to grant the Production account IAM roles permissions for kms:GenerateDataKey and kms:Decrypt, and configure the S3 bucket policy to grant the Production IAM roles permissions for s3:PutObject and s3:GetObject.

Answer

The correct answer provides a database strategy that utilizes Amazon DynamoDB global tables, which replicate data across regions in less than a second. This satisfies the RPO requirement of less than 1 minute and enables near-zero RTO during failover. For storage, it uses a Customer Managed Key (CMK) in the destination Security account. Unlike AWS-managed keys, a Customer Managed Key has a modifiable key policy that can grant cross-account permissions (such as kms:GenerateDataKey and kms:Decrypt) to the Production account IAM roles. This, combined with the S3 bucket policy permissions, allows the application servers to write and read the encrypted medical reports.

Step-by-Step Solution

Analyze the database requirements for telemetry: low-latency, active-active multi-region, RPO < 1 minute, RTO < 10 minutes.

Amazon DynamoDB global tables replicate asynchronously across regions in less than a second, meeting the RPO/RTO goals.

DynamoDB global tables offer active-active replication suitable for low-latency writes and rapid cross-region recovery.

Analyze the storage and encryption requirements for S3: S3 bucket in a separate Security account, cross-account access, KMS encryption with compliance controls (rotation, custom policy).

AWS-managed KMS keys (aws/s3) cannot be shared across accounts. A Customer Managed Key (CMK) must be created in the Security account with cross-account access delegated via its key policy.

Only Customer Managed Keys support key policy modifications to grant cross-account permissions to the Production account IAM roles.

Establish the resource permissions: update the S3 bucket policy in the Security account and the key policy of the CMK.

The Production account's IAM roles are allowed to perform s3:PutObject and s3:GetObject on the bucket, and kms:GenerateDataKey and kms:Decrypt on the CMK.

Both S3 permissions and KMS key permissions must be present for a cross-account IAM role to successfully upload and retrieve KMS-encrypted S3 objects.

Key Concept

Designing secure cross-account S3 object storage with KMS Customer Managed Keys, combined with active-active DynamoDB global tables for low RTO/RPO multi-region workloads.

Question 1642Question →

A digital media platform is planning a large-scale migration of its application portfolio to AWS. The current on-premises infrastructure consists of 150 VMware vSphere virtual machines (VMs) and 25 physical bare-metal servers running CentOS. Due to strict corporate security and compliance policies, installing any software agents on the VMware VMs is strictly prohibited. However, agents are permitted on the physical bare-metal servers. The Solutions Architect must collect CPU and memory utilization history for right-sizing calculations across all servers, determine network dependencies for the physical servers to plan migration groups, and consolidate all tracking data in AWS Migration Hub. Which TWO actions should the Solutions Architect take to perform this discovery and tracking? (Select TWO.)

Select all that apply

Deploy the AWS Application Discovery Agentless Collector as an OVA virtual appliance in the VMware environment to gather VM inventory, configuration, and performance history.

Install the AWS Application Discovery Agent on the physical bare-metal servers to collect system performance, running processes, and inbound/outbound network dependencies.

Install the AWS Application Discovery Agent on the VMware vCenter Server to automatically push and run the agent within the guest operating systems of the VMs.

Install the AWS Application Discovery Agentless Collector directly on the physical bare-metal servers to discover network dependencies without installing guest agents.

Import a flat CSV file containing the network dependency mapping of the VMware VMs into AWS Migration Hub using the Migration Hub Import tool.

Show answer & explanation

Answer: Deploy the AWS Application Discovery Agentless Collector as an OVA virtual appliance in the VMware environment to gather VM inventory, configuration, and performance history.; Install the AWS Application Discovery Agent on the physical bare-metal servers to collect system performance, running processes, and inbound/outbound network dependencies.

Answer

Deploy the AWS Application Discovery Agentless Collector in the VMware environment and install the AWS Application Discovery Agent on the physical bare-metal servers.

To satisfy the requirements under strict compliance, the solutions architect must use the AWS Application Discovery Agentless Collector for the VMware VMs. The Agentless Collector runs as a virtual appliance in the vSphere environment and queries vCenter for inventory and performance metrics, avoiding any guest-level agent installations. For the physical bare-metal servers, where agents are permitted, installing the AWS Application Discovery Agent is required because agentless discovery cannot run on bare-metal systems, and only the agent-based method can capture the network dependency mapping necessary for migration group planning.

Step-by-Step Solution

Address the VMware VM discovery while complying with the agent-less restriction.

Deploy the AWS Application Discovery Agentless Collector as an OVA appliance in vCenter.

This allows agentless discovery of VM inventory, configuration, and performance history without installing guest-level agents.

Address the physical bare-metal server discovery and dependency mapping.

Install the AWS Application Discovery Agent directly on the physical bare-metal servers.

Since agents are permitted on the physical servers, using the Agent is necessary because physical servers cannot be discovered agentlessly, and agents are required to collect network dependency mappings.

Verify integration with AWS Migration Hub for central tracking.

Configure both the Agentless Collector and the Discovery Agents to send data to the AWS Application Discovery Service, which automatically populates AWS Migration Hub.

This consolidates all discovery data in a single dashboard for tracking and planning.

Key Concept

Choosing between agent-based and agentless discovery mechanisms based on VM vs physical environments and compliance rules, and mapping dependencies.

Question 1643Question →

An enterprise is migrating its legacy document management system to AWS. The system contains $1.8\text{ PB}$ of unstructured data stored on on-premises Network File System (NFS) and Server Message Block (SMB) file shares. The company has a $1\text{ Gbps}$ AWS Direct Connect connection, but only $400\text{ Mbps}$ of this bandwidth can be dedicated to the migration due to ongoing production traffic. The migration must be completed, validated, and fully cut over within a strict $30\text{-day}$ window. In addition, external partners must continue to upload daily delta feeds (approximately $50\text{ GB}$ per day) using the SFTP protocol. The files must be stored in the destination Amazon S3 bucket and encrypted at rest using an AWS Key Management Service (AWS KMS) Customer Managed Key (CMK). Which combination of actions will meet these requirements in the most operationally efficient manner? (Select TWO.)

Select all that apply

Order multiple AWS Snowball Edge Storage Optimized devices to migrate the bulk of the

1.8\text{ PB}

dataset offline. After the Snowball import is complete, deploy AWS DataSync agents on-premises to sync the remaining incremental updates over the Direct Connect connection to the target S3 bucket.

Provision an AWS Transfer for SFTP endpoint backed by the target Amazon S3 bucket. Configure the Transfer Family service role with an IAM policy that allows access to the S3 bucket and decrypt/encrypt permissions on the KMS Customer Managed Key (CMK).

Deploy AWS DataSync agents on-premises and configure them to transfer the entire

1.8\text{ PB}

dataset directly to the target S3 bucket over the

400\text{ Mbps}

Direct Connect allocation, scheduling the task to run continuously to meet the deadline.

Migrate the initial

1.8\text{ PB}

dataset using AWS Transfer Family SFTP endpoints over the Direct Connect connection by running concurrent SFTP scripts on-premises, and configure the S3 bucket to use the AWS-managed KMS key (aws/s3) to encrypt the data.

Order multiple AWS Snowball Edge Storage Optimized devices to migrate the bulk of the

1.8\text{ PB}

dataset offline. Configure the target S3 bucket to use the AWS-managed KMS key (aws/s3), and modify the key policy of the aws/s3 key to grant the AWS Transfer Family service role permissions to encrypt the daily partner SFTP uploads.

Show answer & explanation

Answer: Order multiple AWS Snowball Edge Storage Optimized devices to migrate the bulk of the $1.8\text{ PB}$ dataset offline. After the Snowball import is complete, deploy AWS DataSync agents on-premises to sync the remaining incremental updates over the Direct Connect connection to the target S3 bucket.; Provision an AWS Transfer for SFTP endpoint backed by the target Amazon S3 bucket. Configure the Transfer Family service role with an IAM policy that allows access to the S3 bucket and decrypt/encrypt permissions on the KMS Customer Managed Key (CMK).

Answer

The correct options are the ones proposing to use multiple AWS Snowball Edge Storage Optimized devices for the bulk offline migration followed by AWS DataSync for incremental online synchronization, and provisioning an AWS Transfer for SFTP endpoint with a service role that has explicit permissions on the KMS Customer Managed Key (CMK).

The correct combination requires using multiple AWS Snowball Edge Storage Optimized devices to handle the initial bulk migration offline, because the network bandwidth calculation proves that transferring

1.8\text{ PB}

over

400\text{ Mbps}

would violate the

30\text{-day}

limit. An incremental synchronization via AWS DataSync agents is then used to sync updates made to the on-premises shares while the devices were in transit. The partner workflow is met natively by AWS Transfer Family, and since a KMS Customer Managed Key (CMK) is required, the Transfer Family service role must be granted permissions on the key, which is only possible with a customer-owned key rather than an AWS-managed key.

Step-by-Step Solution

Calculate the transfer time for the bulk dataset over the available network bandwidth.

Total size is

1.8\text{ PB}

(

14.4\text{ million gigabits}

). Over a

400\text{ Mbps}

(

0.4\text{ Gbps}

) allocation, the transfer takes

14.4\text{ million} / 0.4 = 36\text{ million seconds} \approx 416.7\text{ days}

This shows that an online-only migration using AWS DataSync or SFTP directly over the Direct Connect link cannot meet the

30\text{-day}

requirement.

Select the appropriate offline migration mechanism for the initial copy.

Order multiple AWS Snowball Edge Storage Optimized devices to ship the bulk

1.8\text{ PB}

dataset offline to AWS.

Snowball Edge bypasses the network bandwidth constraint, allowing the bulk data to be imported within

10\text{ to }15\text{ days}

including shipping times.

Identify the synchronization mechanism for the data delta changes.

Deploy AWS DataSync agents on-premises to perform an incremental synchronization of the changed files after the Snowball import finishes.

DataSync is optimized for scanning and syncing metadata/file differences, which can easily be completed within the remaining migration days over the Direct Connect link.

Configure the legacy partner ingestion endpoint with security controls.

Provision AWS Transfer for SFTP and associate the service role with a policy allowing access to the KMS Customer Managed Key (CMK).

AWS-managed keys (aws/s3) do not support policy modifications. Therefore, custom integrations like Transfer Family requiring key policy access require a Customer Managed Key (CMK).

Key Concept

Selecting the optimal hybrid migration path using AWS Snow Family for physical transit limits combined with AWS DataSync for online delta validation, and leveraging AWS Transfer Family with custom Customer Managed Key policies for legacy SFTP protocols.

Question 1644Question →

An aerospace defense company is migrating its multi-tier application portfolio to AWS and must centralize tracking in AWS Migration Hub. The current on-premises environment consists of:

* 200 standard VMware vSphere virtual machines (VMs) running supported Windows and Linux distributions where network dependency mapping is required to group servers into applications.
* 50 highly secured VMware vSphere VMs containing export-controlled data. Regulatory compliance strictly forbids installing third-party agent software or modifying guest configurations, though hypervisor-level monitoring is permitted.
* 50 legacy physical servers running custom Linux distributions with kernels older than version 2.6.18, which cannot be virtualized or upgraded prior to migration.

The migration will be executed using a combination of AWS Application Migration Service (MGN) and a supported partner-developed migration tool.

Which of the following actions must the Solutions Architect take to perform discovery and track migration progress? (Select TWO.)

Select all that apply

For discovery, deploy the AWS Application Discovery Agent on the 200 standard VMware VMs to collect network dependencies; deploy the AWS Application Discovery Agentless Collector in the VMware environment to discover the 50 secured VMs; and import the metadata for the 50 legacy physical servers using the Application Discovery Service import CSV template.

For migration tracking, configure the partner-developed migration tool to call the AWS Migration Hub API to publish migration status updates, ensuring that all API payloads and discovery data target the designated Migration Hub Home Region.

For discovery, deploy the AWS Application Discovery Agentless Collector, configure it with administrative credentials, and use guest-level SSH and WMI queries to perform process-to-process network dependency mapping across all 300 servers.

For discovery, install the AWS Application Discovery Agent on all 300 servers, configure a local HTTPS proxy to route compliance-sensitive data, and bypass the operating system kernel check for the 50 legacy physical servers.

For migration tracking, share the AWS Migration Hub discovery datastore across the AWS Organization using AWS Resource Access Manager (RAM), and configure the partner migration tool to write status JSON payloads directly to the shared Amazon S3 bucket.

Show answer & explanation

Answer: For discovery, deploy the AWS Application Discovery Agent on the 200 standard VMware VMs to collect network dependencies; deploy the AWS Application Discovery Agentless Collector in the VMware environment to discover the 50 secured VMs; and import the metadata for the 50 legacy physical servers using the Application Discovery Service import CSV template.; For migration tracking, configure the partner-developed migration tool to call the AWS Migration Hub API to publish migration status updates, ensuring that all API payloads and discovery data target the designated Migration Hub Home Region.

Answer

To perform discovery and track migration, the Solutions Architect must deploy the AWS Application Discovery Agent on the 200 standard VMware VMs, deploy the AWS Application Discovery Agentless Collector in the VMware environment for the 50 secured VMs, and manually import metadata for the 50 legacy physical servers via a CSV template. For migration tracking, they must configure the partner-developed migration tool to call the AWS Migration Hub API while targeting the designated Migration Hub Home Region.

The correct strategy combines the AWS Application Discovery Agent on the standard VMs (which allows collecting network dependency information), the VMware-based AWS Application Discovery Agentless Collector on the secured VMs (which collects VM metadata from vCenter without installing guest software), and manual CSV import for the legacy physical servers (since their OS kernels are too old to support the agent, and they are not virtualized). For migration tracking, the partner tool must publish status updates using the Migration Hub API targeting the designated Migration Hub Home Region.

Step-by-Step Solution

Assess agent and agentless capabilities against server types.

The 200 standard VMs require network dependency mapping, which is only supported by the Application Discovery Agent. The 50 compliance VMs forbid agents but permit hypervisor-level data, which is supported by the VMware-based Agentless Collector. The 50 legacy physical servers cannot run the agent due to unsupported operating systems (older than kernel 2.6.18) and cannot use the Agentless Collector because they are not on vSphere.

Correct mapping of discovery tools is necessary to ensure data is collected without violating compliance boundaries or failing due to compatibility limits.

Determine the discovery mechanism for the unsupported legacy physical servers.

Since neither agent-based nor agentless discovery is feasible, the metadata must be imported manually using the Application Discovery Service import CSV template.

This guarantees that all 300 servers are cataloged in AWS Migration Hub for planning.

Configure tracking for the partner-developed migration tool.

The partner tool must be configured to call the AWS Migration Hub API to publish status updates. All API calls and discovery data must target the selected Migration Hub Home Region.

Migration Hub tracks migration progress by aggregating data published via its API from supported tools in the selected Home Region.

Key Concept

Selecting appropriate discovery mechanisms (Agent, Agentless, CSV import) based on OS compatibility and compliance requirements, and integrating third-party migration tools using the AWS Migration Hub API and Home Region.

Question 1645Question →

An enterprise runs an application on Amazon EC2 instances inside a private subnet in VPC A under AWS Account A. The application must retrieve sensitive database credentials stored in AWS Secrets Manager inside a central security account (Account B). Currently, the EC2 instances access Secrets Manager via an Interface VPC Endpoint (AWS PrivateLink) created in VPC A. To strengthen network and identity security, the solutions architect must ensure that only these specific application EC2 instances can retrieve this particular secret, and that no other resources in VPC A can use the Interface VPC Endpoint to access Secrets Manager. Which combination of actions will meet these requirements?

Configure the VPC Endpoint policy on the Secrets Manager interface endpoint in VPC A to allow secretsmanager:GetSecretValue for the secret ARN in Account B only when the principal is the application's IAM role. Configure the secret resource policy in Account B to allow the IAM role to retrieve the secret. Encrypt the secret using a customer managed KMS key in Account B, and update its key policy to grant the application's IAM role kms:Decrypt permissions. Set the VPC endpoint's security group to only allow inbound traffic from the application EC2 instances' security group.

Configure the VPC Endpoint policy on the Secrets Manager interface endpoint in VPC A to allow secretsmanager:GetSecretValue for the secret ARN in Account B only when the principal is the application's IAM role. Configure the secret resource policy in Account B to allow the IAM role to retrieve the secret. Encrypt the secret using the default AWS managed key (aws/secretsmanager) in Account B, and configure a Service Control Policy (SCP) in Account B to permit Account A's IAM role to decrypt using this key. Set the VPC endpoint's security group to only allow inbound traffic from the application EC2 instances' security group.

Create a Service Control Policy (SCP) at the root of the AWS Organization that explicitly grants secretsmanager:GetSecretValue and kms:Decrypt permissions for the application's IAM role to access Account B resources. In VPC A, configure the VPC Endpoint policy to allow all principals (*) to access the Secrets Manager endpoint. Use the default AWS managed key for Secrets Manager in Account B to encrypt the secret. Set the VPC endpoint's security group to only allow inbound traffic from the application EC2 instances' security group.

Configure the VPC Endpoint policy on the Secrets Manager interface endpoint in VPC A to allow secretsmanager:GetSecretValue for the secret ARN in Account B for all principals. In Account B, share the customer managed KMS key and the database secret with Account A using AWS Resource Access Manager (RAM). Set the security group on the Interface VPC Endpoint to allow inbound traffic from the entire VPC A CIDR block.

Show answer & explanation

Answer: Configure the VPC Endpoint policy on the Secrets Manager interface endpoint in VPC A to allow secretsmanager:GetSecretValue for the secret ARN in Account B only when the principal is the application's IAM role. Configure the secret resource policy in Account B to allow the IAM role to retrieve the secret. Encrypt the secret using a customer managed KMS key in Account B, and update its key policy to grant the application's IAM role kms:Decrypt permissions. Set the VPC endpoint's security group to only allow inbound traffic from the application EC2 instances' security group.

Answer

Configure the VPC Endpoint policy to allow only the application's IAM role to access the secret in Account B, use a customer managed KMS key in Account B with a key policy allowing cross-account decryption, configure the secret resource policy to trust the role, and restrict the endpoint security group to allow inbound traffic only from the application EC2 instances' security group.

The correct solution uses a customer managed KMS key (CMK) in Account B with a key policy that grants decrypt permissions to the cross-account role in Account A. This is necessary because AWS-managed keys cannot have their key policies modified for cross-account access. In addition, configuring the VPC endpoint policy to restrict access to the specific IAM role and target secret ARN, combined with a security group that limits inbound traffic to only the application's security group, ensures both network and identity-level security constraints are met.

Step-by-Step Solution

Ensure the KMS key used for the secret supports cross-account delegation.

Use a Customer Managed Key (CMK) instead of the default AWS managed key (aws/secretsmanager), and modify the key policy in Account B to grant kms:Decrypt permissions to the application IAM role in Account A.

AWS managed KMS keys do not allow their policies to be modified, making cross-account access impossible with them.

Restrict access on the Interface VPC Endpoint.

Apply a VPC endpoint policy to the Secrets Manager interface endpoint in VPC A, restricting access to the specific database secret ARN in Account B and limiting the principal to the application's IAM role.

This prevents other IAM roles or resources in VPC A from utilizing the VPC endpoint to access other secrets or accounts.

Configure network-level security on the Interface VPC Endpoint.

Associate a security group with the Interface VPC Endpoint that only permits inbound HTTPS (port 443) traffic from the security group attached to the application's EC2 instances.

This ensures that only traffic originating from the authorized EC2 instances can physically reach the VPC endpoint.

Key Concept

Cross-account access to AWS Secrets Manager using Customer Managed KMS Keys and restricting access via Interface VPC Endpoint policies.

Question 1646Question →

A digital ticketing platform hosts high-profile concert ticket releases on AWS. During these releases, traffic surges from $100$ requests per second to over $50,000$ requests per second within a $2$ -minute window. The current architecture uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group (ASG) of Amazon EC2 instances in private subnets. The instances use a custom AMI with an application that takes $8$ minutes to bootstrap and pass health checks. Outbound licensing checks are routed through a single NAT Gateway in a single Availability Zone.

During recent releases, users experienced HTTP $503$ Service Unavailable errors during the first few minutes of the surge. Additionally, the ASG over-provisioned instances, launching far more than needed before the initial scale-out instances could finish bootstrapping. Finally, a brief outage in the Availability Zone containing the NAT Gateway prevented licensing checks for all instances.

Which combination of actions should a solutions architect take to resolve these issues? (Select TWO.)

Select all that apply

Deploy a NAT Gateway in each Availability Zone with private subnet routing configured to use the local gateway, and request Application Load Balancer pre-warming before scheduled releases.

Set the Auto Scaling group instance warmup period to

540

seconds to ensure instances complete bootstrapping before they contribute to the target tracking metrics.

Deploy a NAT Gateway in a single public subnet to route outbound traffic for all Availability Zones, and rely on the Application Load Balancer's automatic scaling to handle the traffic surge without pre-warming.

Configure the Auto Scaling group default cooldown and instance warmup periods to

60

seconds to allow the scaling policy to rapidly launch additional instances in response to sudden CPU spikes.

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone with private subnet routing configured to use the local gateway, and request Application Load Balancer pre-warming before scheduled releases.; Set the Auto Scaling group instance warmup period to $540$ seconds to ensure instances complete bootstrapping before they contribute to the target tracking metrics.

Answer

Deploy a NAT Gateway in each Availability Zone along with requesting Application Load Balancer pre-warming, and set the Auto Scaling group instance warmup period to

540

seconds.

Deploying a NAT Gateway in each Availability Zone ensures that outbound routing is redundant and resilient to single-zone failures. Requesting Application Load Balancer pre-warming prepares the load balancer for massive traffic spikes that exceed standard automatic scaling rates. Configuring the instance warmup period to

540

seconds (which is longer than the

8

-minute bootstrapping time) ensures that the target tracking policy does not include warming-up instances in its metric calculations, preventing over-provisioning and scaling thrashing.

Step-by-Step Solution

Deploy a NAT Gateway in each Availability Zone and update the private subnet route tables to use the NAT Gateway in the same zone.

Establishes a fault-tolerant egress path where an outage in a single Availability Zone does not impact outbound traffic in other zones.

Resolves the single point of failure of the NAT Gateway and ensures licensing checks succeed during AZ outages.

Request Application Load Balancer pre-warming from AWS Support prior to the scheduled release events.

Pre-provisions ALB resources to handle the massive, immediate surge of traffic from

100

50,000

requests per second.

Prevents HTTP

503

errors during the first few minutes of the surge because standard ALB scaling is too slow for instantaneous spikes.

Configure the Auto Scaling group's instance warmup period to

540

seconds (

9

minutes).

Excludes the CPU and request metrics of newly launched instances from target tracking averages until they are fully operational.

Prevents the Auto Scaling group from over-provisioning and thrashing, as the warmup period exceeds the

8

-minute (

480

-second) bootstrap time.

Key Concept

Designing for fault tolerance with multi-AZ NAT Gateways, pre-warming load balancers for flash traffic, and configuring appropriate Auto Scaling warmup periods to match instance bootstrapping times.

Question 1647Question →

A company needs to migrate $600\text{ TB}$ of unstructured data from an on-premises SMB file share to an Amazon S3 bucket within a strict $40\text{-day}$ window. The company has a $200\text{ Mbps}$ internet connection, but only $100\text{ Mbps}$ can be allocated for the migration to avoid impacting production operations. During the migration, the on-premises data will continue to be modified, producing approximately $2\text{ TB}$ of new or changed files weekly. All migrated data must be encrypted at rest in Amazon S3 using a Customer Managed Key (CMK) in AWS KMS to comply with strict security auditing policies. After the migration, external business partners must be able to securely access specific subsets of the data using the SFTP protocol, authenticating against the company's existing on-premises Active Directory. Which migration and access strategy meets these requirements with the least administrative effort and lowest risk of exceeding the timeline?

Deploy an AWS DataSync agent on-premises. Configure a replication task with bandwidth throttling set to

100\text{ Mbps}

to copy the data directly from the SMB share to the Amazon S3 bucket, using the AWS KMS Customer Managed Key (CMK). Configure AWS Transfer for SFTP with custom Lambda-based authentication that queries the on-premises Active Directory to grant external partners access.

Order 8 AWS Snowball Edge Storage Optimized devices. Create import jobs specifying the S3 bucket and the AWS KMS Customer Managed Key (CMK). Copy the initial dataset to the devices locally, ship them to AWS, and wait for the data to be imported. Deploy an AWS DataSync agent on-premises, and configure a task to sync the SMB share to the S3 bucket. Run the DataSync task to transfer the weekly delta changes. Create an AWS Transfer for SFTP endpoint configured with an AWS Directory Service AD Connector to authenticate external partners against the on-premises Active Directory.

Order 8 AWS Snowball Edge Storage Optimized devices. Create import jobs using the default AWS-managed KMS key (aws/s3) to simplify the initial import configuration. Copy the initial dataset to the devices locally, ship them, and allow AWS to import the data. Deploy an AWS DataSync agent on-premises, and run weekly tasks to sync the changes. Create an AWS Transfer for SFTP endpoint with an AD Connector for authentication. Modify the key policy of the AWS-managed KMS key to delegate decryption rights to a separate audit account.

Request a new

1\text{ Gbps}

AWS Direct Connect connection. Once provisioned, deploy an AWS DataSync agent on-premises and configure a task to replicate the

600\text{ TB}

dataset directly to the Amazon S3 bucket using the Customer Managed Key (CMK) for encryption. Create an AWS Transfer for SFTP endpoint using service-managed authentication to manage the external business partners.

Show answer & explanation

Answer: Order 8 AWS Snowball Edge Storage Optimized devices. Create import jobs specifying the S3 bucket and the AWS KMS Customer Managed Key (CMK). Copy the initial dataset to the devices locally, ship them to AWS, and wait for the data to be imported. Deploy an AWS DataSync agent on-premises, and configure a task to sync the SMB share to the S3 bucket. Run the DataSync task to transfer the weekly delta changes. Create an AWS Transfer for SFTP endpoint configured with an AWS Directory Service AD Connector to authenticate external partners against the on-premises Active Directory.

Answer

The correct strategy requires ordering 8 AWS Snowball Edge Storage Optimized devices using a KMS Customer Managed Key for initial bulk migration, deploying AWS DataSync on-premises for transferring the weekly delta changes, and setting up AWS Transfer for SFTP with an AWS Directory Service AD Connector for partner authentication.

The correct strategy uses AWS Snowball Edge Storage Optimized devices to transfer the bulk data offline. Since transferring

600\text{ TB}

over a

100\text{ Mbps}

link takes over

550\text{ days}

, an offline migration is necessary to meet the

40\text{-day}

timeline. Deploying an AWS DataSync agent on-premises allows the weekly

2\text{ TB}

delta changes to be synchronized online, which takes less than two days. Specifying the Customer Managed Key (CMK) during the Snowball job creation ensures compliance with custom auditing policies. Configuring AWS Transfer for SFTP with an AWS Directory Service AD Connector satisfies the partner SFTP access requirements while authenticating users against the existing on-premises Active Directory.

Step-by-Step Solution

Calculate the time required to transfer

600\text{ TB}

over the allocated

100\text{ Mbps}

network connection.

100\text{ Mbps}

, the transfer rate is approximately

1.08\text{ TB/day}

, meaning it would take over

550\text{ days}

to complete the copy. This confirms an offline shipping mechanism is required.

Establishing the baseline constraint ensures that online transfer is ruled out for the initial bulk data migration.

Select the appropriate Snowball Edge device quantity and configuration.

Since each Snowball Edge Storage Optimized device has approximately

80\text{ TB}

of usable storage, ordering 8 devices allows parallel local data copying and shipping, easily fitting within the

40\text{-day}

window.

This guarantees that the initial bulk data is migrated safely within the project timeline constraints.

Select and configure the encryption key mechanism.

The import jobs must be configured with a Customer Managed Key (CMK). AWS-managed keys (such as aws/s3) are ineligible because their policies cannot be customized to delegate access to external auditing accounts.

This satisfies the security auditing requirements for data at rest in Amazon S3.

Configure the delta synchronization and partner access methods.

Deploy an AWS DataSync agent on-premises to sync weekly modifications (

2\text{ TB}

takes less than two days over

100\text{ Mbps}

). Set up AWS Transfer for SFTP using an AD Connector to route authentication requests to the existing on-premises Active Directory.

This enables continuous updates during the migration process and provides partners with secure, federated access without duplicating credentials.

Key Concept

Selecting the optimal hybrid migration model based on network transfer constraints, utilizing offline import mechanisms for bulk data, delta sync for modifications, and standard identity federation for file protocol endpoints.

Estimated Time:3m 0s

Question 1648Question →

A medical diagnostics company is designing a multi-account architecture using AWS Organizations. The organization consists of a Management account, a Security Operations account, and a Production organizational unit (OU) containing multiple application member accounts.

The solutions architect must design a governance strategy to meet the following requirements:
1. Enable centralized management of AWS Security Hub and AWS Backup from the Security Operations account, ensuring that administrative operations can be performed without logging into the Management account.
2. Enforce that all Amazon EC2 instances and Amazon RDS DB instances launched within the Production OU are tagged with a valid 'CostCenter' key and value. Non-compliant resource creation must be blocked at API call time.
3. Ensure that an automated disaster recovery (DR) service, which runs under a cross-account IAM role named 'DR-Automation-Role' from a dedicated DR account, can still launch EC2 instances in the Production OU without being blocked by the tag enforcement.

Which combination of actions should the solutions architect take to meet these requirements with the least administrative overhead?

Configure AWS Security Hub and AWS Backup in the Management account. Create an IAM policy in each Production member account that allows tag-free creation specifically for the DR-Automation-Role, and apply an SCP to the Production OU that denies EC2 and RDS creation without the CostCenter tag. Rely on the local IAM policies to override the organizational SCP.

Register the Security Operations account as a Delegated Administrator. Use AWS Resource Access Manager (RAM) to share the DR-Automation-Role from the DR account with the Production OU. Apply an AWS Organizations tag policy to the Production OU with enforcement enabled, relying on AWS RAM to automatically exempt shared roles from tag policy validation.

Register the Security Operations account as a Delegated Administrator for AWS Security Hub and AWS Backup. Apply an AWS Organizations tag policy at the root level to define the allowed values for the CostCenter tag. Apply a Service Control Policy (SCP) to the Production OU that denies ec2:RunInstances and rds:CreateDBInstance if the aws:RequestTag/CostCenter key is missing or invalid, using a condition that excludes the aws:PrincipalARN of the DR-Automation-Role.

Register the Security Operations account as a Delegated Administrator. Share the default AWS-managed KMS key for EBS (aws/ebs) from the DR account with the member accounts. Configure the SCP on the Production OU to deny resource creation unless encrypted by this shared key, assuming the DR role will automatically bypass tag enforcement through this KMS key sharing.

Show answer & explanation

Answer: Register the Security Operations account as a Delegated Administrator for AWS Security Hub and AWS Backup. Apply an AWS Organizations tag policy at the root level to define the allowed values for the CostCenter tag. Apply a Service Control Policy (SCP) to the Production OU that denies ec2:RunInstances and rds:CreateDBInstance if the aws:RequestTag/CostCenter key is missing or invalid, using a condition that excludes the aws:PrincipalARN of the DR-Automation-Role.

Answer

Register the Security Operations account as a delegated administrator for AWS Security Hub and AWS Backup. Apply an AWS Organizations tag policy at the root to define allowed values, and apply an SCP to the Production OU that denies resource creation without the tag, exempting the cross-account DR role using a condition check on the principal ARN.

Centralizing management of AWS Security Hub and AWS Backup requires registering a delegated administrator account, which allows administration without using the Management account. While AWS Organizations tag policies define tag compliance rules, they do not actively block API requests to create resources; to enforce tagging at the API level, a Service Control Policy (SCP) with a Deny effect must be used. To allow the disaster recovery role to bypass this enforcement, the SCP must contain a condition checking the principal ARN (using 'aws:PrincipalARN') and exempting 'DR-Automation-Role' from the Deny rule. This configuration achieves the desired governance goals with minimal overhead.

Step-by-Step Solution

Centralizes administrative operations for AWS Security Hub and AWS Backup in the Security Operations account without needing Management account access.

Meets security and operational governance requirements to minimize root/management account usage.

Create and attach an AWS Organizations Tag Policy at the root level.

Defines the standardized capitalization and allowed values for the CostCenter tag across the entire organization.

Aligns resource classification compliance across OUs but does not actively enforce API blockages.

Create and attach a Service Control Policy (SCP) to the Production OU containing a Deny rule with a condition exclusion.

Prevents member account users from creating EC2 or RDS resources without the compliant CostCenter tag, while exempting requests originating from the DR-Automation-Role principal ARN.

Satisfies both tag enforcement and the requirement to allow automated disaster recovery replication activities without interruption.

Key Concept

Delegated administration and tag enforcement using Service Control Policies (SCPs) with principal-based exemptions in AWS Organizations.

Estimated Time:3m 0s

Question 1649Question →

An e-commerce enterprise is migrating its legacy inventory management servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The replication path must use a private network link via an existing AWS Direct Connect connection, avoiding the public internet. The staging area VPC in AWS has no route to the internet. During initial setup, the MGN agents installed on the on-premises servers fail to communicate with the staging area in AWS, and replication status remains in the initiating phase. Which of the following actions should the solutions architect take to resolve this connectivity issue and enable private replication? (Select TWO.)

Select all that apply

Ensure that the security group attached to the replication servers in the staging VPC permits inbound traffic from the on-premises CIDR block on TCP port 1500, and configure the MGN replication template to use private IP routing.

Create VPC interface endpoints for MGN in the staging VPC, and configure the on-premises DNS to resolve the MGN service endpoints to the private IP addresses of the interface endpoints via Route 53 Inbound Resolvers.

Establish a Route 53 Private Hosted Zone for the MGN service endpoint associated with the staging VPC, and set the MGN replication template to use public IP routing.

Configure the staging area route tables to direct all replication traffic through a Transit Gateway linked to a single NAT Gateway deployed in a shared services VPC.

Show answer & explanation

Answer: Ensure that the security group attached to the replication servers in the staging VPC permits inbound traffic from the on-premises CIDR block on TCP port 1500, and configure the MGN replication template to use private IP routing.; Create VPC interface endpoints for MGN in the staging VPC, and configure the on-premises DNS to resolve the MGN service endpoints to the private IP addresses of the interface endpoints via Route 53 Inbound Resolvers.

Answer

To resolve the connectivity issues and establish private replication, the solutions architect must configure the staging VPC security groups to permit inbound traffic from the on-premises CIDR block on TCP port 1500, set the MGN replication template to use private IP routing, create VPC interface endpoints for the MGN service in the staging VPC, and set up on-premises DNS to resolve the MGN endpoints to the interface endpoints using Route 53 Inbound Resolvers.

The correct answer combines allowing replication traffic on TCP port 1500 with private IP routing, and configuring interface VPC endpoints for the MGN API with proper DNS resolution. This ensures both data replication traffic and control plane traffic can flow entirely over the private Direct Connect connection.

Step-by-Step Solution

Allow replication traffic on port 1500.

Staging area security groups permit inbound TCP port 1500 traffic from the on-premises source range.

AWS MGN uses TCP port 1500 for transmitting replicated data blocks from the agent to the replication servers.

Configure private IP routing in the template.

The replication servers and agents use private IPs for data replication over Direct Connect.

By default, MGN uses public IPs for data replication. Enabling private IP routing forces replication traffic over the private Direct Connect link.

Establish interface VPC endpoints for MGN API.

Agents can privately communicate with the MGN control plane.

The replication agent must access the MGN control plane API. In an environment without internet access, this requires setting up AWS PrivateLink interface endpoints and forwarding DNS queries accordingly.

Key Concept

Establishing private, secure data replication and control plane connectivity for AWS Application Migration Service (MGN) in environments without public internet access.

Estimated Time:2m 0s

Question 1650Question →

A multinational retail corporation is planning to migrate its hybrid e-commerce and inventory management platform to AWS. The on-premises infrastructure is distributed as follows:

* $300$ virtual machines (VMs) hosted on a VMware vSphere cluster. The Solutions Architect must perform detailed network dependency mapping (including active inbound and outbound TCP connections and process-level details) to design AWS Security Groups and identify migration waves.
* $50$ bare-metal physical servers running Red Hat Enterprise Linux (RHEL) that host the core database tier. The corporate security and compliance policy strictly prohibits the installation of any third-party software agents on these database systems.
* $10$ legacy bare-metal physical servers running IBM AIX that run proprietary inventory lookup services.

The migration must be tracked centrally in AWS Migration Hub. The business requires the integration of both AWS migration tools and custom third-party migration tracking systems to monitor the migration status of all servers.

Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Install the AWS Application Discovery Agent on the

300

VMware VMs to capture network connections and running processes, and manually import the metadata and dependency information for the

50

RHEL and

10

AIX bare-metal servers using the Application Discovery Service import CSV template.

Group the discovered and imported servers into logical applications within the AWS Migration Hub console, and configure the third-party migration tools to update the migration status of these applications using the AWS Migration Hub Home Region API.

Deploy the AWS Application Discovery Agentless Collector on the VMware vCenter Server to gather the required network connection maps and process lists, and install the AWS Application Discovery Agent on all RHEL and AIX physical servers to stream their inventory data.

Deploy the AWS Application Discovery Agent on all VMware, RHEL, and AIX servers, ensuring that port

1500

is opened on the on-premises firewalls to allow the agents to stream the dependency data directly to the AWS Migration Hub endpoint.

Manually import all server configurations via a CSV file, and use AWS Resource Access Manager (RAM) to share the AWS Migration Hub discovery data with target member accounts to allow localized tracking of migration waves.

Deploy the AWS Application Discovery Agentless Collector to discover the VMware VMs. For the physical servers, configure a pilot light disaster recovery replication to AWS using AWS Application Migration Service (MGN), which will automatically populate the Migration Hub with system and network dependencies.

Show answer & explanation

Answer: Install the AWS Application Discovery Agent on the $300$ VMware VMs to capture network connections and running processes, and manually import the metadata and dependency information for the $50$ RHEL and $10$ AIX bare-metal servers using the Application Discovery Service import CSV template.; Group the discovered and imported servers into logical applications within the AWS Migration Hub console, and configure the third-party migration tools to update the migration status of these applications using the AWS Migration Hub Home Region API.

Answer

The correct answer is to install the AWS Application Discovery Agent on the VMware VMs, manually import metadata for the RHEL and AIX physical servers using the import CSV template, group the servers into applications in the AWS Migration Hub console, and use the Migration Hub Home Region API to integrate the third-party migration tools.

To satisfy the requirement of gathering detailed network dependencies (active TCP connections) and process details for the VMware VMs, the Solutions Architect must install the AWS Application Discovery Agent on those VMs, as the Agentless Collector does not support gathering network connection mapping. Because the RHEL bare-metal database servers cannot host agents due to security policies, and the AIX bare-metal servers do not support the agent, the metadata for these physical servers must be manually collected and uploaded using the AWS Application Discovery Service CSV import template. To aggregate tracking for both AWS and third-party tools, the servers must be grouped into applications in AWS Migration Hub, and third-party tracking tools can write status updates to the centralized Migration Hub using the Migration Hub Home Region API.

Step-by-Step Solution

Determine the discovery mechanism for the VMware VMs.

The VMware VMs require detailed network dependency mapping and process-level info, which cannot be captured by the Agentless Collector. Therefore, the AWS Application Discovery Agent must be installed on these VMs.

The Agentless Collector only collects VM configurations, disk I/O, and CPU/RAM utilization. Detailed network connection mappings (source/destination IP and port) require the OS-installed Agent.

Determine the discovery mechanism for the physical RHEL and AIX servers.

Since RHEL physical servers cannot have agents due to policy, AIX is unsupported by the agent, and both are bare-metal (preventing VMware-level agentless collection), their configuration data must be manually gathered and imported using the Application Discovery Service import CSV template.

Manual CSV import allows registering inventory metadata with AWS Application Discovery Service when automated agents or collectors are constrained by policies or platform compatibility.

Determine how to centralize and integrate third-party tracking in AWS Migration Hub.

Group the discovered and imported servers into logical applications in Migration Hub, and configure the third-party migration tools to publish status updates using the Migration Hub Home Region API.

Migration Hub enables tracking at the application level. Third-party tools and custom scripts write updates directly to the AWS Migration Hub Home Region endpoint to populate the central dashboard.

Key Concept

AWS Application Discovery Service supports both agent-based (Agent) and agentless (Collector) discovery modes, alongside manual CSV uploads. Choosing the right mode depends on hypervisor availability, OS compatibility, security policies, and the required depth of network dependency mapping.

Question 1651Question →

Solas Energy is modernizing its on-premises grid monitoring application by migrating it to AWS. The application consists of a Java-based API and a worker service that processes telemetry data. The target state requires hosting the containers on Amazon ECS with AWS Fargate for serverless operations. The API must be accessible only from a consumer VPC in a separate AWS account via a private connection. The worker service requires access to an Amazon DynamoDB table in the same account and must pull container images from a centralized Amazon ECR repository in a shared services account. The migration design must ensure high availability, use private endpoints, and avoid traversing the public internet.

Which combination of actions should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Configure the ECS task definitions to use the awsvpc network mode, and deploy interface VPC endpoints for Amazon ECR and ECS, along with a gateway VPC endpoint for Amazon S3 in the application VPC.

In the shared services account, configure the Amazon ECR repository policy to grant read access to the application account's ECS task execution role, and configure the Customer Managed Key (CMK) policy used for repository encryption to grant decryption permissions to the same role.

Configure the ECS task definitions to use host networking mode to minimize container-to-container latency and map container ports directly to the underlying host interface on AWS Fargate.

Encrypt the Amazon ECR repository in the shared services account using the AWS-managed KMS key for ECR, and update the key policy to delegate cross-account decryption permissions to the task execution role.

Configure the application VPC's private subnets to route traffic destined for Amazon ECR and Amazon DynamoDB through a single NAT Gateway deployed in a single public subnet to ensure secure outbound communication.

Show answer & explanation

Answer: Configure the ECS task definitions to use the awsvpc network mode, and deploy interface VPC endpoints for Amazon ECR and ECS, along with a gateway VPC endpoint for Amazon S3 in the application VPC.; In the shared services account, configure the Amazon ECR repository policy to grant read access to the application account's ECS task execution role, and configure the Customer Managed Key (CMK) policy used for repository encryption to grant decryption permissions to the same role.

Answer

Configure the ECS task definitions to use the awsvpc network mode, deploy interface VPC endpoints for Amazon ECR and ECS, and a gateway VPC endpoint for Amazon S3. In the shared services account, configure the ECR repository policy and the Customer Managed Key (CMK) policy to grant read and decrypt access to the task execution role.

The correct options ensure secure, private container deployments on AWS Fargate. Deploying tasks in the awsvpc network mode is a requirement for Fargate, and leveraging interface VPC endpoints for ECR/ECS along with gateway endpoints for S3 ensures that images are pulled without traversing the public internet. Cross-account access to the container images requires granting pull permissions on the ECR repository policy and decrypt permissions on the Customer Managed Key encrypting the repository to the application account's task execution role.

Step-by-Step Solution

Select the correct container network mode and define VPC endpoints.

Using the awsvpc network mode allows Fargate tasks to get their own elastic network interfaces. Deploying interface VPC endpoints for ECR and ECS, and a gateway endpoint for S3, ensures that Fargate can pull image layers securely without routing out to the public internet.

AWS Fargate requires the awsvpc network mode, and PrivateLink endpoints are required to keep traffic private.

Configure cross-account permissions for the ECR repository and KMS key.

Updating the ECR repository policy and the Customer Managed Key policy allows the task execution role in the target account to pull and decrypt the container image.

AWS-managed KMS keys cannot be shared cross-account, so a Customer Managed Key is necessary for ECR image decryption.

Key Concept

To modernize workloads using ECS on Fargate, you must use the awsvpc network mode, secure container registries using PrivateLink, and correctly configure cross-account access via Customer Managed Keys.

Question 1652Question →

A company is planning to migrate a legacy on-premises IBM Db2 LUW database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The database contains complex SQL PL stored procedures and triggers. The migration must minimize downtime and allow the database to remain online during the migration process. Which two actions should the Solutions Architect perform to convert the schema and configure the database replication?

Select all that apply

Run the AWS Schema Conversion Tool (AWS SCT) to convert the IBM Db2 database schema, including tables, views, and SQL PL stored procedures, to PostgreSQL-compatible formats, and apply the generated DDL schema to the target Aurora PostgreSQL DB cluster.

Enable archival logging on the source IBM Db2 database, set the DATA CAPTURE CHANGES attribute on all source Db2 tables to be replicated, and configure an AWS Database Migration Service (AWS DMS) replication task with Change Data Capture (CDC) enabled.

Enable binary logging on the source IBM Db2 database by setting the binlog_format parameter to ROW, and configure an AWS DMS replication task to stream log events using MySQL replication protocols.

Enable Microsoft Change Data Capture (MS-CDC) on the source database tables, ensure the SQL Server Agent is running, and configure an AWS DMS task with CDC enabled.

Enable supplemental logging at both the database and table levels on the source IBM Db2 database, and use the AWS DMS task settings to automatically generate and apply converted stored procedures and triggers during the replication phase.

Show answer & explanation

Answer: Run the AWS Schema Conversion Tool (AWS SCT) to convert the IBM Db2 database schema, including tables, views, and SQL PL stored procedures, to PostgreSQL-compatible formats, and apply the generated DDL schema to the target Aurora PostgreSQL DB cluster.; Enable archival logging on the source IBM Db2 database, set the DATA CAPTURE CHANGES attribute on all source Db2 tables to be replicated, and configure an AWS Database Migration Service (AWS DMS) replication task with Change Data Capture (CDC) enabled.

Answer

To successfully migrate the database schema and replicate data with minimal downtime, the Solutions Architect must convert the IBM Db2 schema (including SQL PL stored procedures) to PostgreSQL using AWS Schema Conversion Tool (AWS SCT) and apply it to the target cluster. To support Change Data Capture (CDC) replication from the Db2 source, the Architect must enable archival logging on the database, set the DATA CAPTURE CHANGES attribute on the tables to be replicated, and configure an AWS Database Migration Service (AWS DMS) replication task with CDC.

The correct actions involve using the AWS Schema Conversion Tool (AWS SCT) to convert the source IBM Db2 schema (including tables, views, and SQL PL stored procedures) to PostgreSQL-compatible formats and applying them to the target Aurora PostgreSQL database. Additionally, to support ongoing replication with minimal downtime, Change Data Capture (CDC) must be enabled. For an IBM Db2 source, this requires enabling archival logging on the database and setting the DATA CAPTURE CHANGES attribute on all replicated tables so that AWS DMS can read row-level transactional changes from the Db2 transaction logs.

Step-by-Step Solution

Convert database schema using AWS Schema Conversion Tool (AWS SCT).

The IBM Db2 LUW schema, views, and SQL PL stored procedures are successfully converted to PostgreSQL-compatible DDL and stored procedures.

SCT is required for heterogeneous migrations where the source database engine differs from the target engine, converting complex schema components.

Apply the converted schema to the target Amazon Aurora PostgreSQL cluster.

The empty database schema structures, tables, and converted stored procedures are created in the target Aurora DB cluster.

The target schema must exist before starting the AWS DMS replication task to ensure data maps correctly during the full-load and CDC phases.

Configure IBM Db2 source database for Change Data Capture (CDC).

Archival logging is enabled, and the DATA CAPTURE CHANGES attribute is applied to the target tables.

AWS DMS reads the database transaction logs to capture changes. Enabling archival logging and the DATA CAPTURE CHANGES attribute is a prerequisite for DMS to track row-level changes on Db2 LUW.

Create and execute an AWS DMS replication task with CDC enabled.

AWS DMS performs a full load of the data and continuously replicates ongoing transactions from the Db2 transaction logs to the Aurora PostgreSQL target.

CDC replication minimizes downtime by keeping the target database synchronized with the source until the final cutover.

Key Concept

Database migration and schema conversion using AWS SCT and AWS DMS

Question 1653Question →

A company is designing an automated pipeline to deploy and update application configuration parameters on Amazon EC2 instances across multiple AWS accounts within an AWS Organization. The solution must support dynamic configuration updates without requiring instance recreation, enable automatic rollbacks if Amazon CloudWatch alarms detect application errors during the rollout, and use a centralized encryption key to secure the configurations at rest. Which of the following solutions meets these requirements?

Store the configurations in AWS AppConfig, encrypted using a KMS customer managed key with a key policy that allows cross-account access. Deploy the configurations using an AWS AppConfig deployment strategy that monitors CloudWatch alarms and automatically rolls back if the error rate threshold is exceeded.

Store the configurations in AWS AppConfig, encrypted using the default AWS managed KMS key (aws/appconfig) to simplify key management. Deploy the configurations using an AWS AppConfig deployment strategy that monitors CloudWatch alarms and automatically rolls back if the error rate threshold is exceeded.

Deploy configuration files directly to the instances using AWS CloudFormation StackSets and perform a rolling update on the Auto Scaling group. If the application's error rate spikes during the update, rely on CloudFormation's default stack rollback behavior to revert the changes on the instances.

Store the configurations in AWS Systems Manager Parameter Store. Attach a Service Control Policy (SCP) at the Organization root level that grants the member accounts permission to decrypt the parameter using the default AWS managed KMS key (aws/ssm), overriding local IAM policies.

Show answer & explanation

Answer: Store the configurations in AWS AppConfig, encrypted using a KMS customer managed key with a key policy that allows cross-account access. Deploy the configurations using an AWS AppConfig deployment strategy that monitors CloudWatch alarms and automatically rolls back if the error rate threshold is exceeded.

Answer

AWS AppConfig is the correct service for dynamic configuration changes without redeploying instances. Because the application is distributed across multiple accounts, a KMS Customer Managed Key must be used because AWS-managed keys cannot be shared with external accounts. Additionally, AWS AppConfig supports native integration with CloudWatch alarms to monitor application health and trigger automatic rollbacks during deployments.

Step-by-Step Solution

Use AWS AppConfig as the configuration management tool.

Configurations are hosted centrally and can be dynamically pulled or pushed to EC2 instances without requiring instance recreation.

AWS AppConfig is designed specifically for dynamic, safe configuration deployment at runtime.

Create a Customer Managed Key (CMK) in AWS KMS with cross-account access permissions.

Member accounts are able to decrypt the configuration data using the central CMK.

AWS managed KMS keys (like aws/appconfig) have fixed policies that prevent them from being used for cross-account decryption.

Associate CloudWatch alarms to the AppConfig deployment strategy.

The configuration rollout monitors application health and triggers an automatic rollback if the error rate threshold is exceeded.

Integrating CloudWatch alarms directly into the AppConfig deployment strategy satisfies the requirement for automatic rollback during a faulty deployment.

Key Concept

Safe dynamic configuration deployment and cross-account encryption management

Estimated Time:2m 0s

Question 1654Question →

A financial technology company is designing a new high-throughput transaction processing application. The solutions architect must design the database and storage tier to meet the following requirements:

* A relational database to store account balances. The database must automatically scale read capacity during high-traffic events, support automatic failover across multiple Availability Zones, and meet a near-zero RTO and RPO for regional disaster recovery.
* A shared file system to store application configuration files. The file system must be concurrently accessible by multiple Amazon EC2 instances across multiple Availability Zones.
* All data at rest must be encrypted, and the encryption keys must be managed in a way that allows cross-account access for the security auditing team.

Which two configurations should the solutions architect select to meet these requirements?

Select all that apply

Deploy an Amazon Aurora PostgreSQL DB cluster with Aurora Replicas, configure Aurora Auto Scaling to dynamically adjust read capacity, and set up an Aurora Global Database using a Customer Managed Key (CMK) for encryption.

Create an Amazon Elastic File System (Amazon EFS) file system using the EFS Standard storage class and mount it on the Amazon EC2 instances in each Availability Zone.

Deploy an Amazon RDS for PostgreSQL DB instance with a Multi-AZ standby deployment, and route read queries to the standby instance to scale reads during traffic spikes.

Implement a Pilot Light disaster recovery strategy for the relational database by scheduling weekly database snapshots and copying them to a secondary Region to minimize costs.

Encrypt the database storage using the default AWS-managed KMS key (aws/rds) and modify its key policy to grant decrypt permissions to the security auditing account.

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL DB cluster with Aurora Replicas, configure Aurora Auto Scaling to dynamically adjust read capacity, and set up an Aurora Global Database using a Customer Managed Key (CMK) for encryption.; Create an Amazon Elastic File System (Amazon EFS) file system using the EFS Standard storage class and mount it on the Amazon EC2 instances in each Availability Zone.

Answer

Deploy an Amazon Aurora PostgreSQL DB cluster with Aurora Replicas, configure Aurora Auto Scaling, and set up an Aurora Global Database using a Customer Managed Key (CMK). Create an Amazon Elastic File System (Amazon EFS) file system using the EFS Standard storage class.

Deploying an Amazon Aurora PostgreSQL DB cluster with Aurora Replicas and Auto Scaling provides high availability and dynamic read scaling. Aurora Global Database ensures cross-region disaster recovery with near-zero RTO and RPO. Furthermore, using a Customer Managed Key (CMK) allows configuring key policies to share access across accounts. Amazon EFS provides a shared file system that can be mounted concurrently by EC2 instances across multiple Availability Zones, which matches the storage requirement for configuration files.

Step-by-Step Solution

Select the database engine and scaling strategy.

Amazon Aurora PostgreSQL with Aurora Replicas and Auto Scaling is chosen to handle local read spikes and failover.

Amazon RDS Multi-AZ standby instances do not support read traffic, whereas Aurora Replicas can be dynamically scaled to handle read queries.

Select the disaster recovery and encryption method for the database.

Aurora Global Database with Customer Managed Key (CMK) encryption is selected.

Aurora Global Database meets the near-zero RTO/RPO requirements, and CMKs are required because default AWS-managed KMS keys cannot be shared with external accounts.

Select the shared storage class for the configuration files.

Amazon Elastic File System (Amazon EFS) with EFS Standard storage class is selected.

Amazon EFS natively supports concurrent read/write mounts from multiple EC2 instances across multiple Availability Zones, unlike EBS volumes which cannot span AZs for multi-attach.

Key Concept

Selecting database and storage solutions that satisfy performance (read scaling, concurrent multi-AZ access), security (cross-account KMS key sharing), and reliability (RTO/RPO) requirements.

Question 1655Question →

A solutions architect is planning the heterogeneous migration of a 5 TB on-premises Microsoft SQL Server database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration must minimize application downtime. The solutions architect has already used the AWS Schema Conversion Tool (AWS SCT) to convert the schema and apply it to the target Aurora DB cluster. An AWS Database Migration Service (AWS DMS) replication task with 'Full load and ongoing replication' is configured. During testing, the replication task successfully completes the full load phase, but changes made on the source database after the full load started are not being replicated to the target database. Which of the following is the required configuration change to enable ongoing replication?

Enable Microsoft Change Data Capture (MS-CDC) on the source database and the tables to be migrated, and ensure that the SQL Server Agent service is running.

Enable binary logging on the source database instance by setting the parameter log_bin to ON, and configure the binlog format to ROW.

Reclassify the migration path as a Replatform, and use AWS Application Migration Service (AWS MGN) to continuously replicate the SQL Server operating system and database volumes.

Request an AWS Snowball Edge device to ship the SQL Server transaction log backups to Amazon S3, and configure AWS DMS to use the S3 bucket as the replication source for the CDC phase.

Show answer & explanation

Answer: Enable Microsoft Change Data Capture (MS-CDC) on the source database and the tables to be migrated, and ensure that the SQL Server Agent service is running.

Answer

Enable Microsoft Change Data Capture (MS-CDC) on the source database and the tables to be migrated, and ensure that the SQL Server Agent service is running.

To capture ongoing changes from a Microsoft SQL Server source database, AWS Database Migration Service (AWS DMS) requires Microsoft Change Data Capture (MS-CDC) to be enabled on the database and target tables, and the SQL Server Agent service must be running to process transaction logs. This allows AWS DMS to read change tables and replicate new transactions to the target database.

Step-by-Step Solution

Analyze the database engine mismatch between source (SQL Server) and target (Aurora PostgreSQL).

Identify that the migration is heterogeneous, meaning the schema must be converted (completed by AWS SCT) and data replicated with CDC to minimize downtime.

Helps narrow down the required replication technologies and target configurations.

Determine the prerequisites for AWS DMS to perform Change Data Capture (CDC) on a SQL Server source.

Identify that AWS DMS requires either MS-CDC or MS-Replication, along with an active SQL Server Agent, to capture ongoing transaction logs.

Verifies the missing configuration causing the task to stall after the full load.

Evaluate the proposed options against the SQL Server prerequisites and filter out incorrect database engines or block-level tools.

Select the option specifying MS-CDC and SQL Server Agent activation, while rejecting MySQL parameters, block-level host replication, and offline physical transfers.

Arrives at the correct configuration required for SQL Server CDC.

Key Concept

AWS DMS source database prerequisites for Change Data Capture (CDC) on Microsoft SQL Server

Question 1656Question →

A multinational retail corporation is migrating its supply chain management platform to AWS. The current on-premises environment consists of 300 VMware vSphere virtual machines (VMs) running Windows Server 2022 and Red Hat Enterprise Linux 8, and 50 bare-metal legacy servers running IBM AIX on POWER processors. Corporate compliance mandates that no software agents may be installed on any production server operating systems. The on-premises network has no direct internet connectivity, but an HTTP proxy is available for outbound HTTPS traffic (port 443) to AWS endpoints without SSL decryption. The company wants to use AWS Migration Hub to track the migration, utilizing both partner-integrated third-party tools and AWS migration tools. Which strategy should a solutions architect recommend to perform the discovery and track the migration progress?

Deploy the AWS Application Discovery Service Agentless Collector as a virtual appliance in the VMware environment. Configure the collector with the corporate HTTP proxy credentials to upload virtual machine configuration and performance metadata. For the IBM AIX bare-metal servers, collect server specifications and utilization metrics manually, and import them using the AWS Migration Hub import CSV template. Register the third-party migration tools with AWS Migration Hub and use their native integrations to publish migration status updates to the Migration Hub dashboard.

Deploy the AWS Application Discovery Agent on all VMware VMs and IBM AIX bare-metal servers. Configure the agents to route discovery traffic through the corporate HTTP proxy to the AWS Application Discovery Service endpoints. Track the migration using the AWS Migration Hub dashboard.

Deploy the AWS Application Discovery Service Agentless Collector in the VMware environment. Configure it to discover both the VMware VMs and the IBM AIX bare-metal servers by providing the collector with SSH credentials for the AIX hosts. Import the discovery data into AWS Systems Manager, and use Systems Manager to update migration tracking in AWS Migration Hub.

Deploy AWS Systems Manager Quick Setup to configure host management on all on-premises VMs and bare-metal AIX servers to collect hardware inventory and performance metrics. Export the gathered data to Amazon S3, and use AWS Glue to import the inventory into AWS Migration Hub. Use AWS Step Functions to update the migration status in Migration Hub.

Show answer & explanation

Answer: Deploy the AWS Application Discovery Service Agentless Collector as a virtual appliance in the VMware environment. Configure the collector with the corporate HTTP proxy credentials to upload virtual machine configuration and performance metadata. For the IBM AIX bare-metal servers, collect server specifications and utilization metrics manually, and import them using the AWS Migration Hub import CSV template. Register the third-party migration tools with AWS Migration Hub and use their native integrations to publish migration status updates to the Migration Hub dashboard.

Answer

The correct strategy uses the AWS Application Discovery Service Agentless Collector for the VMware VMs to comply with the agentless mandate. The collector is configured to use the corporate HTTP proxy for outbound communication. Since IBM AIX on POWER is unsupported by both the Agentless Collector and the Discovery Agent, the specifications for these servers must be imported manually using the Migration Hub CSV template. Finally, Migration Hub supports native integration with third-party tools, allowing them to report migration status updates via the API directly to the dashboard.

Step-by-Step Solution

Select the discovery tool for the virtualized VMware environment that complies with the security agent restriction.

Identify the AWS Application Discovery Service Agentless Collector as the appropriate tool because it is deployed as an OVA virtual appliance and collects metadata directly from vCenter without requiring OS-level agent installation.

Corporate compliance prohibits installing third-party software agents directly onto production server operating systems.

Determine the discovery mechanism for the non-virtualized IBM AIX on POWER legacy servers.

Choose manual discovery and import via the AWS Migration Hub import CSV template.

The AWS Application Discovery Agent does not support the IBM AIX operating system or POWER CPU architecture, and the Agentless Collector only queries VMware vCenter environments.

Address the network connectivity constraints for sending metadata to AWS.

Configure the Agentless Collector with proxy settings to use the corporate HTTP proxy for outbound HTTPS (port 443) communication to AWS.

The on-premises network lacks direct internet access but permits outbound HTTPS via an explicit forward proxy.

Configure tracking for the heterogeneous set of migration tools in AWS Migration Hub.

Register the partner-integrated migration tools in Migration Hub to allow them to publish migration status updates directly to the dashboard.

AWS Migration Hub integrates natively with various third-party migration tools via the Migration Hub API to provide a unified tracking dashboard.

Key Concept

Selecting and configuring AWS migration discovery mechanisms based on agent compatibility, operating system constraints, network proxy requirements, and tracking migration status using partner integrations in AWS Migration Hub.

Question 1657Question →

A company is implementing a multi-account federation solution using an external SAML 2.0 Identity Provider (IdP). The solutions architect configures a SAML provider in the primary AWS account and wants to allow federated users to assume a specific IAM role across multiple target member accounts in the AWS Organization. During testing, users receive an access denied error when attempting to authenticate and assume the role in the member accounts. Which of the following configurations is required to successfully establish this federated access to the target member accounts?

Create the SAML Identity Provider (IdP) only in the primary management account. In each target member account, create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action and references the ARN of the SAML IdP in the primary management account as the principal.

Create a SAML Identity Provider (IdP) in each target member account. In each member account, create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action and specifies the local SAML IdP as the principal.

Create a SAML Identity Provider (IdP) in each target member account. In each member account, create an IAM role with a trust policy that allows the sts:AssumeRole action and specifies the local SAML IdP as the principal.

Attach a Service Control Policy (SCP) to the organization's root that allows the sts:AssumeRoleWithSAML action for the external identity provider, thereby granting federated access to all member accounts without needing to define local IAM roles or trust relationships in each target account.

Show answer & explanation

Answer: Create a SAML Identity Provider (IdP) in each target member account. In each member account, create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action and specifies the local SAML IdP as the principal.

Answer

For direct SAML federation to work in a multi-account environment, a SAML Identity Provider (IdP) must be created in each target member account. The IAM role in each member account must have a trust policy that allows the sts:AssumeRoleWithSAML action and references the local SAML IdP as the principal. This allows the SAML assertion to be directly validated and exchanged for temporary security credentials in that specific account.

Step-by-Step Solution

Analyze the validation requirements for SAML assertions in AWS.

Establish that an AWS account must possess a local representation of the Identity Provider (IdP) to validate incoming SAML assertions.

IAM roles cannot directly trust a SAML IdP located in a different AWS account; therefore, the SAML IdP resource must exist locally in each target account.

Determine the correct Security Token Service (STS) action for SAML assertion exchange.

Identify that the sts:AssumeRoleWithSAML action is mandatory in the trust policy.

Standard cross-account role assumption uses sts:AssumeRole, but exchanging external SAML tokens for AWS temporary credentials requires the sts:AssumeRoleWithSAML API action.

Verify that Service Control Policies (SCPs) do not block the configuration.

Ensure that SCPs allow the necessary sts:AssumeRoleWithSAML action, while recognizing that the actual permissions must still be granted by local IAM roles.

SCPs restrict maximum permissions but do not grant them, meaning the local IAM roles and federation configurations are still necessary.

Key Concept

Multi-Account Identity and Access Management Federation

Question 1658Question →

A company runs a high-performance compute (HPC) cluster on Amazon EC2 instances in private subnets across two Availability Zones (`us-west-2a` and `us-west-2b`). The instances continuously read and write shared datasets on an Amazon EFS file system in the same Region, processing approximately $150\text{ TB}$ of data per month. A review of the monthly AWS bill reveals high Inter-AZ Data Transfer charges for EFS access, despite the EFS file system having mount targets in both Availability Zones. Investigation reveals that the EC2 instances are mounted to the EFS file system using the static IP address of the mount target in `us-west-2a` to simplify configuration management. Which of the following changes will minimize the data transfer costs while maintaining the required file sharing capability?

Configure a single NAT Gateway in `us-west-2a`, and update the route tables of both private subnets to route all EFS-destined traffic through this NAT Gateway.

Deploy an AWS Transit Gateway, associate the VPC subnets, and configure transitive routing using appliance mode across both Availability Zones to load-balance traffic to the EFS mount targets.

Configure the EC2 instances to mount the EFS file system using its default DNS name rather than a static IP address, and ensure that DNS resolution is enabled in the VPC.

Purchase EC2 Instance Savings Plans to cover the Inter-AZ data transfer fees, and migrate the EFS datasets to an Amazon S3 bucket with a lifecycle policy to archive data to S3 Glacier Flexible Retrieval.

Show answer & explanation

Answer: Configure the EC2 instances to mount the EFS file system using its default DNS name rather than a static IP address, and ensure that DNS resolution is enabled in the VPC.

Answer

Configure the EC2 instances to mount the Amazon EFS file system using its default DNS name instead of a static IP address, ensuring DNS resolution is enabled in the VPC.

Mounting the EFS file system using its DNS name (e.g., `file-system-id.efs.aws-region.amazonaws.com`) ensures that DNS queries resolve to the IP address of the mount target in the client's local Availability Zone. This local resolution keeps the data transfer within the same Availability Zone, eliminating Inter-AZ data transfer costs.

Step-by-Step Solution

Identify the cause of the Inter-AZ data transfer charges.

The EC2 instances in `us-west-2b` are mounting the EFS file system using the mount target's IP address located in `us-west-2a`.

Mounting a resource across Availability Zones using a hardcoded IP address bypasses local AZ routing, forcing all traffic from the other AZ to traverse AZ boundaries and incur inter-AZ charges.

Select a mechanism to resolve EFS endpoints locally.

Configure EFS mounts using the file system's default DNS name.

When DNS resolution is enabled in the VPC, the EFS DNS name automatically resolves to the IP address of the local EFS mount target within the client's Availability Zone, keeping traffic local.

Evaluate and eliminate alternative options based on cost and functional requirements.

Eliminated options using NAT Gateways or Transit Gateways due to high data processing fees, and S3 Glacier due to performance mismatch.

NAT Gateway and Transit Gateway incur significant hourly and per-GB data processing fees, and S3 Glacier is inappropriate for real-time read/write datasets.

Key Concept

Local Availability Zone DNS resolution for Amazon EFS mount targets minimizes inter-AZ data transfer costs.

Question 1659Question →

VeloDynamics Manufacturing is modernizing its transaction-clearing microservices by migrating them from on-premises virtual machines to Amazon EKS in a multi-account AWS environment. The EKS worker nodes must be deployed in a highly constrained VPC where the primary subnet allocated for nodes is a single $/24$ block ( $10.100.1.0/24$ ), which cannot be expanded due to tight integration with the corporate Transit Gateway mesh. The microservices must scale up to $1,000$ concurrent pods during peak clearing cycles. The pods must communicate with on-premises mainframe databases over AWS Direct Connect via an AWS Transit Gateway. The on-premises firewalls and routing tables are strictly managed and will only route traffic originating from the node primary subnet ( $10.100.1.0/24$ ); adding routes for new CIDR blocks to the on-premises network is prohibited. Additionally, client applications in other VPCs must connect to the services via an Application Load Balancer (ALB) with direct routing to pods (minimal network hops) to meet latency SLAs. Which of the following architectures meets these requirements with the least operational overhead?

Associate a secondary CIDR block with the VPC and create subnets in this range. Set the AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG environment variable to true in the VPC CNI DaemonSet, and define ENIConfig custom resources mapping to the secondary subnets to allocate pod IPs. Keep the AWS_VPC_K8S_CNI_EXTERNALSNAT environment variable set to false to ensure the CNI performs source NAT using the worker nodes' primary IPs for outbound traffic. Deploy the AWS Load Balancer Controller and configure the Ingress with the target type set to ip.

Associate a secondary CIDR block with the VPC and create subnets in this range. Configure the EKS cluster with Calico in overlay mode using VXLAN encapsulation to assign pod IPs from the secondary range. Set up the AWS Load Balancer Controller with the target type set to ip to enable direct routing. Configure AWS Transit Gateway to route the overlay network CIDR block to the Direct Connect gateway, and configure the on-premises routers to accept the encapsulated packet headers.

Associate a secondary CIDR block with the VPC and create subnets in this range. Set the AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG environment variable to true in the VPC CNI DaemonSet, and define ENIConfig custom resources mapping to the secondary subnets. Set the AWS_VPC_K8S_CNI_EXTERNALSNAT environment variable to true to allow the pods to bypass NAT and communicate directly with on-premises databases using their secondary IPs. Deploy the AWS Load Balancer Controller and configure the Ingress with the target type set to instance.

Deploy EKS worker nodes on AWS Outposts using the AWS Fargate launch type to scale the pods. Configure the Fargate pod execution role to inherit permissions from the node group. Configure the tasks to use host networking mode to share the underlying host network namespace, bypassing the primary subnet's IP limitations. Deploy an Application Load Balancer and configure target groups using instance mode.

Show answer & explanation

Answer: Associate a secondary CIDR block with the VPC and create subnets in this range. Set the AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG environment variable to true in the VPC CNI DaemonSet, and define ENIConfig custom resources mapping to the secondary subnets to allocate pod IPs. Keep the AWS_VPC_K8S_CNI_EXTERNALSNAT environment variable set to false to ensure the CNI performs source NAT using the worker nodes' primary IPs for outbound traffic. Deploy the AWS Load Balancer Controller and configure the Ingress with the target type set to ip.

Answer

The correct architecture uses Amazon VPC CNI Custom Networking. This separates node IP allocation from pod IP allocation. EKS nodes run in the primary

10.100.1.0/24

subnet, while pods receive IPs from a secondary VPC CIDR block. Because the secondary CIDR block resides within the VPC, the pod IPs are fully routable inside AWS, permitting the AWS Load Balancer Controller to route traffic directly to the pods using the 'ip' target type, satisfying the latency SLA. By keeping 'AWS_VPC_K8S_CNI_EXTERNALSNAT' set to 'false', the CNI translates the source IP of any traffic leaving the VPC to the primary IP of the host node. This ensures that all traffic targeting the on-premises mainframe appears to originate from the whitelisted

10.100.1.0/24

range, complying with firewall constraints.

Step-by-Step Solution

Address the IP exhaustion in the primary

/24

subnet by associating a secondary CIDR block with the VPC.

The VPC has a new, larger CIDR block (e.g.,

100.64.0.0/16

) dedicated for pod allocations.

The primary node subnet

10.100.1.0/24

has only 251 usable IP addresses, which cannot accommodate the

1,000

pods required during peak times.

Configure the Amazon VPC CNI plugin to use custom networking by setting AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG to true and creating ENIConfig custom resources for the secondary subnets.

EKS worker nodes are provisioned in the primary subnet (

10.100.1.0/24

), but their pods are assigned IPs from the secondary CIDR block.

This decouples pod IP allocation from the host node subnets, enabling scaling without exhausting the primary subnet's IPs.

Configure AWS_VPC_K8S_CNI_EXTERNALSNAT to false (default behavior) in the CNI daemonset.

The VPC CNI automatically performs Source NAT (SNAT) for any outbound traffic originating from pods destined for addresses outside the VPC CIDR.

This translates the pod's secondary source IP (e.g.,

100.64.x.y

) to the node's primary IP (

10.100.1.x

) when routing over the Transit Gateway to the on-premises mainframe, matching the firewall whitelist.

Deploy the AWS Load Balancer Controller and configure target groups with target-type set to ip.

The Application Load Balancer routes traffic directly to the pod IP addresses within the VPC secondary CIDR block.

Since the secondary CIDR is native VPC space, the ALB can target the pods directly, minimizing network hops and routing latency.

Key Concept

Amazon EKS VPC CNI custom networking allows worker nodes to reside in a primary subnet while pods are allocated IPs from a secondary CIDR block. By keeping external SNAT disabled, outbound traffic to external networks (like on-premises) is translated to the node's IP, bypassing on-premises routing restrictions while maintaining VPC-routable pod IPs for direct ALB integration.

Question 1660Question →

A Solutions Architect is designing the migration of an on-premises Microsoft SQL Server database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration must be completed with minimal downtime, and the application must continue writing to the source database during the replication process. Which two actions must the Solutions Architect take to support the schema conversion and data replication phases? (Select two.)

Select all that apply

Enable MS-CDC on the source Microsoft SQL Server database and the tables selected for migration to allow the AWS DMS task to perform Change Data Capture (CDC).

Configure AWS DMS to automatically convert the source database schema and create the tables on the target Aurora PostgreSQL database during the replication phase.

Enable supplemental logging on the source database tables to allow AWS DMS to read the transaction logs during the Change Data Capture (CDC) phase.

Deploy a single AWS DMS task configured for Full Load only, and use the SQL Server Agent on the source server to automatically forward incremental transaction log backups directly to the Aurora PostgreSQL target.

Show answer & explanation

Answer: Run the AWS Schema Conversion Tool (SCT) to generate a schema conversion assessment report, convert the schema, and apply the converted SQL scripts to the target Aurora PostgreSQL database before starting the migration task.; Enable MS-CDC on the source Microsoft SQL Server database and the tables selected for migration to allow the AWS DMS task to perform Change Data Capture (CDC).

Answer

Run the AWS Schema Conversion Tool (SCT) to generate a schema conversion assessment report, convert the schema, and apply the converted SQL scripts to the target Aurora PostgreSQL database before starting the migration task. Also, enable MS-CDC on the source Microsoft SQL Server database and the tables selected for migration to allow the AWS DMS task to perform Change Data Capture (CDC).

For a heterogeneous database migration (SQL Server to Aurora PostgreSQL), the schema must first be converted and applied using the AWS Schema Conversion Tool (SCT). To perform replication with minimal downtime, a Full Load plus CDC task is required, which depends on Microsoft Change Data Capture (MS-CDC) being enabled on the source SQL Server database and tables to trace ongoing transactions.

Step-by-Step Solution

Analyze schema compatibility and convert the database schema using the AWS Schema Conversion Tool (SCT).

SQL Server schema is converted to PostgreSQL-compatible SQL scripts.

Since SQL Server and PostgreSQL are heterogeneous database engines, AWS DMS cannot automatically map and convert the schema structures (like stored procedures or custom data types) on its own.

Apply the converted schema scripts to the target Aurora PostgreSQL DB cluster.

The target database schema, tables, and views are created and ready to receive data.

Applying the schema first ensures that when AWS DMS starts copying data, the target tables exist with the correct data types.

Configure Microsoft Change Data Capture (MS-CDC) on the source SQL Server database and individual tables.

SQL Server starts recording changes to system tables, making them accessible to AWS DMS.

Ongoing replication requires AWS DMS to read database changes. For SQL Server, this is achieved by enabling MS-CDC.

Create and run an AWS DMS replication task configured for Full Load plus CDC.

Existing data is migrated, and subsequent updates are replicated to the target in near real-time.

This configuration enables minimal downtime migration by allowing the source database to remain online during replication.

Key Concept

Heterogeneous database migration requires schema pre-conversion via SCT and source-side database engine-specific replication logging configuration (like MS-CDC for SQL Server) to support DMS CDC.

PreviousPage 83 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept