All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

An enterprise is migrating its legacy data center workloads to AWS. The migration involves two primary NFS-based datasets that must be migrated within a strict $30\text{-day}$ window:

* Dataset 1: A $1.2\text{ PB}$ historical archive dataset containing static files. This data will be migrated to Amazon S3 and must be accessible by an external, third-party auditing application located in a separate AWS account.
* Dataset 2: An $80\text{ TB}$ active operational dataset that is continuously updated. This data must be migrated to an Amazon EFS file system, and all POSIX metadata (ownership, permissions, and directory structures) must be preserved.

The company has a $1\text{ Gbps}$ AWS Direct Connect connection, but bandwidth throttling limits the maximum dedicated network throughput for migration traffic to $400\text{ Mbps}$ . All data at rest must be encrypted using an AWS KMS key that supports cross-account sharing.

Which two actions should the Solutions Architect recommend to achieve this migration within the required timeline? (Select TWO.)

Select all that apply

Order multiple AWS Snowball Edge Storage Optimized devices to import the

1.2\text{ PB}

archive dataset to Amazon S3. Configure the Snowball jobs to encrypt the imported data using a Customer Managed Key (CMK) in AWS KMS.

Deploy AWS DataSync agents on-premises and configure a task to replicate the

80\text{ TB}

operational dataset to Amazon EFS over the Direct Connect connection, enabling the options to preserve group ID, owner ID, permissions, and timestamps.

Deploy AWS DataSync agents on-premises and configure a task to replicate both the

1.2\text{ PB}

archive dataset and the

80\text{ TB}

operational dataset to AWS over the dedicated Direct Connect connection to centralize and simplify migration management.

Order multiple AWS Snowball Edge Storage Optimized devices to import the

1.2\text{ PB}

archive dataset to Amazon S3. Configure the Snowball jobs to encrypt the data at rest using the default AWS-managed key (aws/s3) to minimize key management complexity.

Deploy AWS DataSync agents on-premises to replicate the

80\text{ TB}

operational dataset to Amazon EFS. Establish network path connectivity by routing the DataSync traffic over the Direct Connect connection into a transit VPC, and then transitively route it to the destination EFS VPC using an established VPC Peering connection between the transit VPC and the EFS VPC.

Show answer & explanation

Answer: Order multiple AWS Snowball Edge Storage Optimized devices to import the $1.2\text{ PB}$ archive dataset to Amazon S3. Configure the Snowball jobs to encrypt the imported data using a Customer Managed Key (CMK) in AWS KMS.; Deploy AWS DataSync agents on-premises and configure a task to replicate the $80\text{ TB}$ operational dataset to Amazon EFS over the Direct Connect connection, enabling the options to preserve group ID, owner ID, permissions, and timestamps.

Answer

The correct architecture requires ordering multiple AWS Snowball Edge Storage Optimized devices to migrate the

1.2\text{ PB}

archive dataset to Amazon S3 using a Customer Managed Key (CMK), and deploying AWS DataSync agents on-premises to replicate the active

80\text{ TB}

operational dataset directly to Amazon EFS over the Direct Connect connection while preserving POSIX metadata.

The correct solutions combine an offline and online migration strategy based on bandwidth constraints. The

1.2\text{ PB}

archive dataset is too large to fit over the

400\text{ Mbps}

dedicated network allocation within 30 days. Multiple AWS Snowball Edge Storage Optimized devices must be used. To allow the third-party auditing application in a separate AWS account to read this data, the Snowball job must use a Customer Managed Key (CMK) with a key policy configured for cross-account access. The

80\text{ TB}

active operational dataset can be transferred within the timeline (taking ~18.5 days) and should be migrated online using AWS DataSync to ensure active updates and POSIX metadata are natively preserved when writing to Amazon EFS.

Step-by-Step Solution

Calculate the maximum data that can be transferred over the network within the timeline.

The dedicated network allocation is

400\text{ Mbps}

. In

30\text{ days}

, the maximum theoretical data transfer is:

400\text{ Mbps} \times 86400\text{ seconds/day} \times 30\text{ days} = 1.0368 \times 10^{15}\text{ bits} \approx 129.6\text{ TB}

Determining network capacity defines which datasets must be shipped physically versus which can be copied online.

Select the transfer method for the

1.2\text{ PB}

historical archive dataset.

Since

1.2\text{ PB}

(

1,200\text{ TB}

) exceeds the

129.6\text{ TB}

maximum online transfer limit, this dataset must be transferred offline using AWS Snowball Edge devices.

Using the network for this dataset would take roughly 278 days, failing the 30-day timeline requirement.

Evaluate the encryption requirements for the archive dataset.

The archive data must be encrypted using a Customer Managed Key (CMK) in AWS KMS because AWS-managed keys (such as `aws/s3`) cannot be shared across accounts to allow the third-party auditing application access.

Custom key policies can only be attached to Customer Managed Keys.

Select the transfer method and network routing path for the

80\text{ TB}

operational dataset.

The

80\text{ TB}

dataset fits within the remaining transfer window (taking approximately 18.5 days over

400\text{ Mbps}

). Use AWS DataSync to preserve ownership, permissions, and directory structures natively on Amazon EFS.

AWS DataSync simplifies migration over network links while automatically maintaining full POSIX compliance for EFS.

Key Concept

Selecting data transfer tools based on network constraints and security requirements

Question 1702Question →

A company is planning to migrate its on-premises MySQL 8.0 database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The database contains several tables with JSON and large binary object (BLOB) columns that are updated frequently. A solutions architect has already used the AWS Schema Conversion Tool (SCT) to migrate the schema. The architect now configures an AWS Database Migration Service (AWS DMS) replication instance and task to perform a full load with ongoing replication (Change Data Capture - CDC). During initial testing of the CDC phase, the replication task fails with errors when update operations occur on tables containing the BLOB columns. Which configuration change must the solutions architect apply to resolve this issue and ensure successful CDC replication?

Modify the source database configuration to set the binlog_format parameter to MIXED to allow both statement-based and row-based replication during high-throughput updates.

Enable Microsoft Change Data Capture (MS-CDC) on the source database engine and start the SQL Server Agent to track updates on the BLOB columns.

Configure the binlog_row_image parameter to FULL in the source database parameters, and restart the source database instance.

Configure the AWS DMS replication task settings to enable Inline LOB mode with a MaxLobSize parameter of 0 to force immediate replication of all BLOB data.

Show answer & explanation

Answer: Configure the binlog_row_image parameter to FULL in the source database parameters, and restart the source database instance.

Answer

Configure the binlog_row_image parameter to FULL in the source database parameters, and restart the source database instance.

The correct answer is to configure the binlog_row_image parameter to FULL on the source MySQL database. AWS DMS requires that the source MySQL database has binlog_format set to ROW and binlog_row_image set to FULL. When an update occurs on a row containing a BLOB or LOB column, a setting of MINIMAL or NOBLOB would omit unchanged columns from the binary log. This prevents AWS DMS from acquiring the full row image required to apply the update to the target database, resulting in task failures.

Step-by-Step Solution

Analyze the source database engine and migration requirements.

The source is MySQL 8.0, and the migration requires Change Data Capture (CDC) via AWS DMS.

Identifying the database engine helps narrow down the correct configuration parameters for binary logging.

Identify the cause of the task failure during update operations on LOB/BLOB tables.

AWS DMS requires a complete before-and-after image of the modified row to perform CDC successfully, especially for tables containing large objects.

If the binary log row image is set to MINIMAL or NOBLOB, the binlog does not include the LOB columns unless they are explicitly modified, which causes the AWS DMS CDC task to fail on update events.

Select the parameter that controls the binary log row image in MySQL.

Setting binlog_row_image to FULL ensures all column values (including unmodified LOBs) are written to the binary log.

This configuration satisfies the prerequisite for AWS DMS CDC replication from a MySQL source database.

Key Concept

AWS DMS source database prerequisites for MySQL CDC replication

Estimated Time:2m 30s

Question 1703Question →

A financial technology company is migrating its core ledger database and transaction processing servers from an on-premises VMware environment to AWS using AWS Application Migration Service (MGN). The migration must occur over a private network path using an existing AWS Direct Connect connection. The staging area subnet in the target VPC has no path to the public internet. Which two configurations must the Solutions Architect implement to establish replication? (Select TWO).

Select all that apply

Configure the AWS Application Migration Service replication template to use private IP routing for data replication over the Direct Connect connection.

Configure the staging area security group to allow inbound traffic on TCP Port 1500 from the subnet hosting the on-premises source servers.

Configure the staging area security group to only allow inbound traffic on TCP Port 443 from the on-premises servers, routing all replication traffic over secure HTTPS.

Configure the Transit Gateway route table to route replication traffic directly to the Direct Connect Gateway without associating it with a Transit Gateway attachment, enabling transitive routing.

Deploy a Route 53 Private Hosted Zone for the AWS Application Migration Service endpoint in the staging VPC without associating it with the other VPCs in the environment.

Show answer & explanation

Answer: Configure the AWS Application Migration Service replication template to use private IP routing for data replication over the Direct Connect connection.; Configure the staging area security group to allow inbound traffic on TCP Port 1500 from the subnet hosting the on-premises source servers.

Answer

The Solutions Architect must configure the AWS Application Migration Service replication template to use private IP routing for data replication, and configure the staging area security group to allow inbound traffic on TCP Port 1500 from the subnet hosting the on-premises source servers.

To replicate data privately over Direct Connect, the replication template must be configured to use private IP routing, and the staging area security group must allow inbound traffic on TCP Port 1500 from the source subnet. These settings enable private, block-level data replication from the on-premises servers to the replication instances.

Step-by-Step Solution

Configure the MGN replication template for private IP routing.

The Replication Agent will attempt to establish connections to the private IPs of the replication servers in the staging VPC rather than public IPs.

This satisfies the requirement to route replication traffic privately over the Direct Connect connection without internet exposure.

Configure the security group for the replication servers in the staging subnet.

The security group allows inbound traffic on TCP Port 1500 from the on-premises subnet.

AWS Application Migration Service requires TCP Port 1500 to transfer replication data blocks from the source agent to the replication servers.

Key Concept

AWS Application Migration Service (MGN) private replication requires configuring the replication template to use private IP routing and ensuring TCP Port 1500 is open from the source environment to the staging area.

Estimated Time:2m 0s

Question 1704Question →

A company is planning to migrate its on-premises IBM DB2 LUW database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The database contains complex PL/SQL-equivalent stored procedures and is approximately 8 TB in size. The company requires a migration strategy that minimizes downtime to under 30 minutes and converts the database schema and application logic with minimal manual effort. Which of the following approaches should a solutions architect recommend to meet these requirements?

Use the AWS Schema Conversion Tool (SCT) to generate an assessment report, convert the database schemas and stored procedures, and apply the converted schema to the target Aurora DB cluster. Enable archival logging and transaction logging on the source DB2 database to meet AWS DMS Change Data Capture (CDC) prerequisites. Create an AWS DMS replication instance, configure a Full Load and CDC task, and switch application traffic to Aurora when replication lag is near zero.

Create an AWS DMS replication instance and configure a migration task to migrate the database directly from DB2 to Aurora PostgreSQL. Rely on AWS DMS to dynamically convert the source stored procedures and tables during the initial migration phase. Do not configure any additional transaction logging on the source database to maximize write performance, and cut over to the new database immediately after the full load completes.

Use the AWS Schema Conversion Tool (SCT) to convert the source database schema and stored procedures, and apply the converted schema to the target Aurora DB cluster. Set up an AWS DMS replication instance and initiate a migration task with Full Load and Change Data Capture (CDC). Do not modify the source DB2 logging configuration to avoid CPU overhead on the production database, and rely on standard AWS DMS querying to replicate ongoing changes.

Order an AWS Snowball Edge device to copy DB2 database backup files to Amazon S3. Use the AWS Schema Conversion Tool (SCT) to convert the schema and apply it to Aurora PostgreSQL. Configure Aurora Auto Scaling replicas on the target cluster to scale horizontally to handle the incoming write traffic from the restore process, and use AWS DMS to synchronize the remaining delta changes.

Show answer & explanation

Answer: Use the AWS Schema Conversion Tool (SCT) to generate an assessment report, convert the database schemas and stored procedures, and apply the converted schema to the target Aurora DB cluster. Enable archival logging and transaction logging on the source DB2 database to meet AWS DMS Change Data Capture (CDC) prerequisites. Create an AWS DMS replication instance, configure a Full Load and CDC task, and switch application traffic to Aurora when replication lag is near zero.

Answer

The correct approach uses the AWS Schema Conversion Tool (SCT) to assess and convert the database schema and PL/SQL-equivalent stored procedures from DB2 to PostgreSQL. It also configures the required transaction logging on the source DB2 database so that AWS DMS can perform Change Data Capture (CDC) alongside the initial Full Load. This enables continuous replication, allowing the final switchover to occur with minimal downtime.

Step-by-Step Solution

Assess and convert the schema using the AWS Schema Conversion Tool (SCT).

An assessment report outlining migration challenges and a converted schema ready to be applied to the Amazon Aurora PostgreSQL-Compatible target database.

Because DB2 and PostgreSQL are heterogeneous database engines, direct schema replication is not possible, requiring schema conversion before data migration.

Configure transaction and archival logging on the source IBM DB2 database.

The source database writes transaction logs in a format that AWS DMS can read for ongoing changes.

AWS DMS CDC relies on the database's native transaction logs to capture data changes. Neglecting this configuration will prevent replication of live updates.

Create an AWS DMS replication instance and run a Full Load + CDC task.

Existing data is loaded, and subsequent changes are replicated continuously with minimal lag.

Running both full load and CDC allows the target database to catch up to the source, minimizing downtime during the final switchover.

Key Concept

Heterogeneous database migration using AWS SCT to convert schemas/stored procedures, and AWS DMS with CDC enabled via source engine logging prerequisites to minimize downtime.

Estimated Time:2m 0s

Question 1705Question →

A financial services firm is refactoring a legacy, on-premises stock-trading API into a serverless microservices architecture on AWS. The modernized solution uses Amazon API Gateway (regional endpoint) and AWS Lambda functions deployed inside private subnets of a VPC. The Lambda functions must execute trades by writing to an Amazon Aurora PostgreSQL database and must also communicate with a third-party regulatory compliance endpoint over the public internet.

The architecture must meet the following requirements:
- Prevent the trade-processing Lambda functions from exhausting the Aurora database's connection pool during peak market hours.
- Prevent trade-processing traffic spikes from consuming the entire regional Lambda concurrency pool, which would throttle other critical services in the same AWS account.
- Ensure high availability for all outbound internet traffic from the Lambda functions.
- Securely store and decrypt regulatory API credentials using AWS Systems Manager Parameter Store. The decryption key must support custom key policy modifications to delegate read-only access to a separate security auditing AWS account.
- Deploy updates to the Lambda function safely using gradual traffic shifting, with automatic rollback if CloudWatch alarms detect errors.

Which design strategy should the Solutions Architect implement to satisfy these requirements?

Deploy a single NAT Gateway in one Availability Zone to route all outbound internet traffic. Set up Amazon RDS Proxy in the VPC to manage database connections for the Lambda functions. Assign a reserved concurrency limit to the trade-processing Lambda function. Store the credentials as SecureString parameters in Parameter Store, encrypted with the default AWS-managed KMS key (aws/ssm), and attach an IAM policy to the auditing account allowing decryption of this key. Configure AWS CodeDeploy to perform a canary or linear deployment for Lambda function updates, with CloudWatch alarms configured to automatically roll back on errors.

Deploy redundant NAT Gateways across multiple Availability Zones in public subnets, and configure private subnet route tables to direct internet-bound traffic through their local NAT Gateway. Set up Amazon RDS Proxy in the VPC to manage database connections for the Lambda functions. Do not configure a reserved concurrency limit for the trade-processing Lambda function, allowing it to scale dynamically using the account's unreserved concurrency pool. Store the credentials as SecureString parameters in Parameter Store, encrypted with the default AWS-managed KMS key (aws/ssm), and configure the key policy of the aws/ssm key to permit decryption by the auditing account. Configure AWS CodeDeploy to perform a canary or linear deployment for Lambda function updates, with CloudWatch alarms configured to automatically roll back on errors.

Deploy redundant NAT Gateways across multiple Availability Zones in public subnets, and configure private subnet route tables to direct internet-bound traffic through their local NAT Gateway. Set up Amazon RDS Proxy in the VPC to manage database connections for the Lambda functions. Assign a reserved concurrency limit to the trade-processing Lambda function. Store the credentials as SecureString parameters in Parameter Store, encrypted with a KMS Customer Managed Key (CMK), and configure the CMK's key policy to permit decryption by the auditing account and the Lambda execution role. Configure AWS CodeDeploy to perform a canary or linear deployment for Lambda function updates, with CloudWatch alarms configured to automatically roll back on errors.

Deploy redundant NAT Gateways across multiple Availability Zones in public subnets, and configure private subnet route tables to direct internet-bound traffic through their local NAT Gateway. Set up Amazon RDS Proxy in the VPC to manage database connections for the Lambda functions. Assign a reserved concurrency limit to the trade-processing Lambda function. Store the credentials as SecureString parameters in Parameter Store, encrypted with a KMS Customer Managed Key (CMK), and configure the CMK's key policy to permit decryption by the auditing account and the Lambda execution role. Configure AWS CodeDeploy to perform an all-at-once deployment for Lambda function updates, relying on manual rollbacks if CloudWatch alarms detect errors.

Show answer & explanation

Answer: Deploy redundant NAT Gateways across multiple Availability Zones in public subnets, and configure private subnet route tables to direct internet-bound traffic through their local NAT Gateway. Set up Amazon RDS Proxy in the VPC to manage database connections for the Lambda functions. Assign a reserved concurrency limit to the trade-processing Lambda function. Store the credentials as SecureString parameters in Parameter Store, encrypted with a KMS Customer Managed Key (CMK), and configure the CMK's key policy to permit decryption by the auditing account and the Lambda execution role. Configure AWS CodeDeploy to perform a canary or linear deployment for Lambda function updates, with CloudWatch alarms configured to automatically roll back on errors.

Answer

Deploy redundant NAT Gateways across multiple Availability Zones, use Amazon RDS Proxy to manage database connections, set a reserved concurrency limit on the Lambda function, encrypt Parameter Store secrets using a Customer Managed Key with delegated key policy permissions, and use an AWS CodeDeploy canary or linear deployment configuration with automatic rollbacks.

The correct solution addresses every requirement in accordance with the AWS Well-Architected Framework: redundant NAT Gateways ensure high availability; Amazon RDS Proxy pools relational database connections; reserved concurrency limits the function's maximum capacity to protect the rest of the account; a KMS Customer Managed Key supports the custom key policy modifications needed for cross-account auditing; and AWS CodeDeploy canary or linear configurations shift traffic gradually with automatic rollbacks.

Step-by-Step Solution

Configure redundant NAT Gateways across multiple Availability Zones in public subnets and update private subnet route tables.

Outbound traffic to the regulatory compliance endpoint remains highly available and resilient to a single Availability Zone failure.

Deploying only a single NAT Gateway introduces a single point of failure for private subnet egress.

Deploy Amazon RDS Proxy between the Lambda functions and the Aurora database.

Database connections are pooled and shared, reducing overhead and preventing connection exhaustion during traffic bursts.

AWS Lambda scales out rapidly, which can easily exhaust the connection limits of a relational database.

Set a reserved concurrency limit on the trade-processing Lambda function.

The function is capped at a specific concurrency limit, preserving the remainder of the regional pool for other services in the account.

Uncapped functions can consume the entire account's regional concurrency pool, causing throttling for other critical functions.

Create a KMS Customer Managed Key (CMK) and configure its key policy to delegate decryption permissions to both the Lambda execution role and the security auditing account.

The Systems Manager Parameter Store SecureString parameters are decrypted securely, and the auditing account can verify the key.

AWS-managed KMS keys do not support policy modification and cannot be used for cross-account delegation.

Configure AWS CodeDeploy with a Canary or Linear deployment configuration, linking CloudWatch alarms to the deployment group.

Traffic shifts gradually to the new Lambda version, and any spike in error rates triggers an automatic rollback.

All-at-once deployments do not satisfy the requirement for gradual shifting and risk substantial downtime if errors occur.

Key Concept

Modernizing legacy transactional applications with AWS Lambda and Amazon API Gateway requires careful orchestration of database connection pooling (RDS Proxy), concurrency management (Reserved Concurrency), redundant egress networking (multi-AZ NAT Gateways), cross-account security controls (KMS Customer Managed Key policies), and safe deployment automation (CodeDeploy gradual traffic shifting).

Question 1706Question →

A global gaming publisher is designing a new cloud-based multiplayer game. The game requires a database and storage architecture for two key workloads:

1. Player session state: A database that supports global active-active replication with sub-10 millisecond latency for both reads and writes to serve players in North America, Europe, and Asia.
2. Historical match data: Long-term archival logs that must be stored durably and made accessible to a data analytics team operating in a separate, dedicated AWS account. This data must be encrypted at rest, and the encryption keys must allow cross-account access configuration.

Which two options should the solutions architect choose to meet these requirements?

Select all that apply

Configure Amazon DynamoDB global tables for the player session state to achieve single-digit millisecond latency and active-active replication across the target AWS Regions.

Store the historical match data in an Amazon S3 bucket encrypted with an AWS KMS customer managed key (CMK). Update both the S3 bucket policy and the KMS key policy to permit cross-account read access for the analytics team.

Configure an Amazon Aurora Global Database for the session state to handle the high write throughput in all target regions, using Aurora Auto Scaling on the reader instances in secondary regions to automatically promote them to handle local write traffic.

Store the historical match data in an Amazon S3 bucket encrypted with the default AWS-managed KMS key (aws/s3). Configure the S3 bucket policy to grant read access to the analytics team's AWS account.

Deploy a multi-region Amazon EFS file system with cross-region replication (CRR) to store player session state, relying on the replication mechanism to achieve near-zero RTO and active-active writes in all regions.

Show answer & explanation

Answer: Configure Amazon DynamoDB global tables for the player session state to achieve single-digit millisecond latency and active-active replication across the target AWS Regions.; Store the historical match data in an Amazon S3 bucket encrypted with an AWS KMS customer managed key (CMK). Update both the S3 bucket policy and the KMS key policy to permit cross-account read access for the analytics team.

Answer

Configure Amazon DynamoDB global tables for the player session state to achieve active-active global replication. For historical match data, store the files in an Amazon S3 bucket encrypted with an AWS KMS customer managed key (CMK) and update both the S3 bucket policy and KMS key policy to permit cross-account access.

Amazon DynamoDB global tables provide fully managed, active-active replication across multiple AWS Regions with single-digit millisecond latency for both reads and writes, which meets the session state workload requirements. Storing historical logs in Amazon S3 encrypted with a customer managed KMS key allows cross-account decryption access to be delegated to the analytics team via custom policies on both the S3 bucket and the KMS key.

Step-by-Step Solution

Evaluate the database options for the player session state requirement of sub-10ms active-active replication across multiple regions.

Amazon DynamoDB global tables are identified as the only option that natively supports multi-region active-active writes with single-digit millisecond latency.

Relational databases like Amazon Aurora Global Database only support writes in a single primary region, and file systems like Amazon EFS do not support multi-region active-active writes.

Evaluate the storage and security options for historical logs that must be shared across different AWS accounts.

Determine that Amazon S3 combined with a customer managed KMS key is required to enable cross-account delegation.

AWS-managed KMS keys cannot be shared cross-account as their key policies cannot be modified, making a customer managed key essential for this scenario.

Establish the permissions required for cross-account S3 access to encrypted data.

Update both the S3 bucket policy and the KMS key policy to trust the analytics team's AWS account.

Cross-account access to KMS-encrypted S3 objects requires permissions on both the S3 bucket policy and the KMS key policy.

Key Concept

Selecting multi-region active-active database solutions and establishing cross-account access to encrypted S3 storage.

Question 1707Question →

A healthcare provider maintains a hybrid environment of Amazon EC2 instances and on-premises servers, all registered as managed instances under AWS Systems Manager. A security policy mandates that a security logging agent must be installed and continuously running on all instances. The operations team has noticed that system administrators occasionally uninstall or stop the agent during manual troubleshooting, creating configuration drift. A Solutions Architect must design a solution to automatically detect drift, reinstall the agent, and report compliance. Which solution meets these requirements with the least operational overhead?

Create an AWS CloudFormation stack containing a user data script to install the logging agent. Enable CloudFormation Drift Detection on a scheduled basis, and configure an AWS Lambda function to redeploy the stack whenever drift is detected.

Create an AWS Systems Manager State Manager association that runs a runbook to install and start the logging agent. Target the instances using tags, and configure the association to run daily. Monitor the association status using AWS Config, and configure an Amazon EventBridge rule to forward non-compliance events to a centralized security account.

Deploy the logging agent package across all accounts using AWS CloudFormation StackSets. To secure the deployment, encrypt the package using an AWS managed KMS key (aws/s3) and delegate cross-account access to the key for all target accounts to pull the installer.

Deploy an AWS Systems Manager Distributor package containing the logging agent. Attach an AWS Organizations Service Control Policy (SCP) to the root OU that explicitly denies the execution of uninstallation commands for the logging agent on EC2 instances.

Show answer & explanation

Answer: Create an AWS Systems Manager State Manager association that runs a runbook to install and start the logging agent. Target the instances using tags, and configure the association to run daily. Monitor the association status using AWS Config, and configure an Amazon EventBridge rule to forward non-compliance events to a centralized security account.

Answer

Create an AWS Systems Manager State Manager association to install and start the logging agent, monitor it with AWS Config, and forward events to a centralized security account using Amazon EventBridge.

The correct answer uses AWS Systems Manager State Manager to enforce the configuration state of the logging agent. State Manager is designed to manage configurations on both Amazon EC2 and hybrid (on-premises) instances. The scheduled run of the State Manager association automatically reinstalls and starts the logging agent if it has been uninstalled or stopped, remediating drift. Using AWS Config to track compliance and EventBridge to forward non-compliance alerts to a central account provides a complete reporting loop with minimal operational overhead.

Step-by-Step Solution

Determine the service scope needed to manage configurations on both cloud and on-premises (hybrid) servers.

AWS Systems Manager is selected since it supports hybrid managed instances through the SSM Agent, whereas CloudFormation and SCPs cannot manage or inspect on-premises server configurations.

The requirement specifies a hybrid environment of EC2 instances and on-premises servers.

Choose a configuration management mechanism to enforce the running state of the logging agent.

Select Systems Manager State Manager, which allows scheduling an association to run a document (like installing and starting a service) and automatically remediates configuration drift during its execution.

State Manager ensures the target state is continually enforced on a schedule.

Set up compliance reporting and notification routing.

Configure AWS Config to monitor State Manager association compliance and route non-compliance events via Amazon EventBridge to the central security account.

This provides centralized compliance reporting with minimal operational overhead.

Key Concept

AWS Systems Manager State Manager enables automatic drift remediation and configuration enforcement for hybrid environments, integrated with AWS Config for compliance monitoring.

Estimated Time:2m 30s

Question 1708Question →

Apex Healthcare is modernizing its prescription processing application by migrating it to AWS. The application will be deployed as containerized tasks using Amazon ECS on AWS Fargate in a VPC in the Production account. The container images must be securely pulled from a centralized Amazon ECR repository in the Shared Services account. To meet regulatory compliance, the ECR images are encrypted at rest using AWS KMS, and all image pull traffic must remain within the AWS network without traversing the public internet.

Which TWO configurations must a solutions architect perform to establish this architecture? (Select TWO.)

Select all that apply

In the Production account, create Interface VPC endpoints for ECR in the VPC where the tasks are deployed, and configure a Gateway VPC endpoint for Amazon S3 in the same VPC.

In the Shared Services account, encrypt the ECR repository using the default AWS-managed KMS key (aws/ecr), and modify its key policy to grant the ECS Task Execution IAM Role in the Production account permissions to use the key.

In the Production account, configure the ECS task definition to use the host network mode to bypass the need for interface VPC endpoints and route traffic directly to ECR.

In the Shared Services account, create a Route 53 Private Hosted Zone for the ECR DNS name, and associate it with the Production account's VPC to enable private ECR resolution without deploying VPC endpoints.

Show answer & explanation

Answer: In the Shared Services account, encrypt the ECR repository using an AWS KMS customer managed key, and update the key policy to grant the ECS Task Execution IAM Role in the Production account permissions to decrypt using the key.; In the Production account, create Interface VPC endpoints for ECR in the VPC where the tasks are deployed, and configure a Gateway VPC endpoint for Amazon S3 in the same VPC.

Answer

In the Shared Services account, encrypt the ECR repository using an AWS KMS customer managed key, and update the key policy to grant the ECS Task Execution IAM Role in the Production account permissions to decrypt using the key. Additionally, in the Production account, create Interface VPC endpoints for ECR in the VPC where the tasks are deployed, and configure a Gateway VPC endpoint for Amazon S3 in the same VPC.

To support private, cross-account ECR image pulls under KMS encryption, you must use a Customer Managed Key in the repository account to delegate decryption permissions to the target account's task execution role. Furthermore, you must establish Interface VPC endpoints in the consumer VPC to allow private communication to ECR API endpoints, alongside a Gateway VPC endpoint for S3 because ECR stores its image layers in S3 buckets.

Step-by-Step Solution

Analyze cross-account encryption requirements.

Determine that the default AWS-managed KMS key cannot be shared cross-account, so a Customer Managed Key must be used for ECR repository encryption.

This allows updating the key policy to permit the Production account's ECS Task Execution IAM Role to perform the kms:Decrypt operation.

Determine private network connectivity needs inside the Production VPC.

Identify that Interface VPC endpoints for ECR and a Gateway VPC endpoint for S3 are needed.

ECR image manifests are retrieved via the ECR endpoints, while the actual image layers are downloaded from S3, requiring secure private routing for both.

Validate network mode compatibility for Fargate tasks.

Verify that tasks launched on AWS Fargate are restricted to the awsvpc network mode.

This eliminates host or bridge network mode configurations as viable alternatives.

Key Concept

Cross-account ECR image pulling with KMS encryption and private endpoint routing on AWS Fargate

Question 1709Question →

A financial services firm is establishing a federated identity mechanism across their AWS Organizations environment. Users stored in an on-premises Active Directory must authenticate via an external SAML 2.0 identity provider to manage resources within individual target AWS accounts.

To set up direct federation with the target accounts without using AWS IAM Identity Center, which configuration steps must a solutions architect implement in each target AWS account? (Select TWO.)

Select all that apply

Create a SAML identity provider resource in IAM using the XML metadata document obtained from the external identity provider.

Create an IAM role with a trust policy that allows the 'sts:AssumeRoleWithSAML' action for the SAML identity provider principal and contains a condition mapping the audience ('SAML:aud') to the AWS SAML endpoint.

Attach a Service Control Policy (SCP) at the Root level of the organization that allows the 'sts:AssumeRoleWithSAML' action for the external identity provider ARN.

Configure an IAM role in each account with a trust policy that allows 'sts:AssumeRole' as the action and defines the external identity provider's SAML entity as the principal.

Configure AWS Resource Access Manager (RAM) in the management account to share a single centralized SAML identity provider resource with all member accounts in the organization.

Show answer & explanation

Answer: Create a SAML identity provider resource in IAM using the XML metadata document obtained from the external identity provider.; Create an IAM role with a trust policy that allows the 'sts:AssumeRoleWithSAML' action for the SAML identity provider principal and contains a condition mapping the audience ('SAML:aud') to the AWS SAML endpoint.

Answer

Create a SAML identity provider resource in IAM using the XML metadata document from the external identity provider, and create an IAM role with a trust policy that allows the 'sts:AssumeRoleWithSAML' action for the SAML identity provider principal and contains a condition mapping the audience ('SAML:aud') to the AWS SAML endpoint.

To configure direct SAML 2.0 federation with AWS accounts, the solutions architect must first establish trust by creating a SAML identity provider resource in the target account using the IdP's metadata XML. Once the provider is established, an IAM role must be configured with a trust policy that trusts the SAML provider principal and specifies the 'sts:AssumeRoleWithSAML' action. This trust policy should also contain a condition that evaluates the SAML audience ('SAML:aud') to match the AWS sign-in endpoint, ensuring that the token was intended for AWS console access.

Step-by-Step Solution

Create the SAML identity provider in AWS IAM for each target account.

An IAM SAML provider entity is created using the XML metadata document from the external identity provider.

This establishes the cryptographic trust boundary between AWS and the external Identity Provider.

Configure the IAM role and its trust policy.

An IAM role is created with a trust policy mapping the SAML provider ARN as the principal and granting the 'sts:AssumeRoleWithSAML' action.

This allows users authenticated by the SAML provider to assume the role and obtain temporary security credentials.

Key Concept

Establishing trust and configuring IAM roles for SAML 2.0 federation in a multi-account environment.

Question 1710Question →

A smart agriculture company operates a real-time soil moisture and environmental monitoring telemetry platform on AWS. The telemetry ingestion service runs on Amazon EC2 instances in an Auto Scaling group (ASG) situated in private subnets across two Availability Zones. Traffic is distributed by an Application Load Balancer (ALB). The EC2 instances process the telemetry messages and require internet connectivity to post aggregated metrics to a third-party SaaS analytics API. During seasonal agricultural cycles, sensor devices wake up simultaneously, causing traffic to surge from $50$ requests per second to $25,000$ requests per second within $2$ minutes. During these spikes, many requests fail with $502\text{ Bad Gateway}$ or gateway timeout errors. Additionally, if an Availability Zone fails, outbound traffic to the SaaS API is interrupted for all instances.

Which two actions should a Solutions Architect implement to scale the architecture efficiently and ensure fault tolerance? (Select TWO.)

Select all that apply

Deploy a NAT Gateway in each Availability Zone where the Auto Scaling group operates, and configure the private subnet route tables to route outbound traffic through the local NAT Gateway in the same zone.

Configure an Amazon EC2 Auto Scaling warm pool with instances in the Stopped state, and request Application Load Balancer pre-warming from AWS Support prior to the seasonal cycle.

Deploy a single NAT Gateway in one public subnet, and configure a transit gateway to route outbound internet traffic from all private subnets through this NAT Gateway to simplify management.

Rely on the Application Load Balancer's automatic scaling and decrease the default Auto Scaling group cooldown period to 30 seconds to trigger rapid scaling of new instances during the load surge.

Implement a target tracking scaling policy based on the RequestCountPerTarget metric, and depend on the Application Load Balancer's default scaling behavior to automatically handle the sudden influx of requests.

Show answer & explanation

Answer: Deploy a NAT Gateway in each Availability Zone where the Auto Scaling group operates, and configure the private subnet route tables to route outbound traffic through the local NAT Gateway in the same zone.; Configure an Amazon EC2 Auto Scaling warm pool with instances in the Stopped state, and request Application Load Balancer pre-warming from AWS Support prior to the seasonal cycle.

Answer

The correct actions are to deploy a NAT Gateway in each Availability Zone and configure the Auto Scaling group warm pool along with requesting ALB pre-warming.

Deploying a dedicated NAT Gateway per Availability Zone removes the single point of failure for outbound traffic. Using an Auto Scaling group warm pool keeps instances in a stopped state ready to scale out rapidly, bypassing bootstrapping delays, while Application Load Balancer pre-warming prepares the load balancer for the immediate load spike.

Step-by-Step Solution

Analyze the traffic profile and provisioning delays.

The traffic spikes from

50

25,000

requests per second in

2

minutes, while EC2 instances take

5

minutes to bootstrap.

Normal auto-scaling is too slow to react to this flash traffic pattern, necessitating a mechanism like a warm pool to bypass bootstrapping, and pre-warming of the Application Load Balancer to prevent gateway errors.

Assess the NAT Gateway architecture for Availability Zone fault tolerance.

A single NAT Gateway creates a single point of failure for all instances in private subnets across all zones.

To ensure fault tolerance, a NAT Gateway must be deployed in each Availability Zone where the private subnets are situated.

Select the combination of solutions that resolves the issues.

Combining multi-AZ NAT Gateways, an Auto Scaling group warm pool, and ALB pre-warming satisfies all scaling and reliability constraints.

This satisfies the requirements without introducing single points of failure or runaway scaling issues caused by incorrect cooldown configurations.

Key Concept

Implementing Auto Scaling and Fault Tolerance

Question 1711Question →

A company is migrating a self-managed Microsoft SQL Server database running on-premises to an Amazon Aurora MySQL-Compatible Edition DB cluster. A solutions architect uses the AWS Schema Conversion Tool (SCT) to convert the database schema. The migration strategy requires continuous replication to keep the target database in sync with the source database until the cutover window. The solutions architect configures an AWS Database Migration Service (AWS DMS) replication task with the migration type set to 'Full load and CDC'. During a test run, the full load phase completes successfully, but subsequent transactional updates on the source SQL Server database are not reflected in the target Aurora DB cluster. Which of the following is the most likely cause of this replication failure?

The target Amazon Aurora MySQL DB cluster was not configured with binary logging enabled in its cluster parameter group.

Microsoft Change Data Capture (MS-CDC) or SQL Server Replication was not enabled on the source SQL Server database and tables.

The AWS DMS replication task was configured with the target table preparation mode set to 'Do nothing' instead of 'Truncate'.

AWS Application Migration Service (MGN) was not deployed on the source SQL Server host to replicate the transactional changes at the block level.

Show answer & explanation

Answer: Microsoft Change Data Capture (MS-CDC) or SQL Server Replication was not enabled on the source SQL Server database and tables.

Answer

Microsoft Change Data Capture (MS-CDC) or SQL Server Replication was not enabled on the source SQL Server database and tables.

For AWS Database Migration Service (AWS DMS) to capture ongoing changes (CDC) from a self-managed Microsoft SQL Server source database, you must enable Microsoft Change Data Capture (MS-CDC) or MS-Replication on the source database and tables. This generates the necessary transaction logs that AWS DMS reads to capture changes. If this configuration is omitted, the full load phase completes successfully, but subsequent transactional updates will not be replicated.

Step-by-Step Solution

Analyze the migration symptom: the initial full load completed successfully, but subsequent transactional updates (CDC) are not being replicated.

Identify that the issue lies specifically with capturing change data (CDC) from the source database, not with target writing or connectivity.

This narrows down the troubleshooting scope to the source-side transaction logging configuration.

Recall the prerequisites for SQL Server when acting as a source for AWS DMS CDC tasks.

Determine that AWS DMS requires SQL Server Change Data Capture (MS-CDC) or MS-Replication to be enabled on the database and tables to capture ongoing transactions.

AWS DMS reads the SQL Server active transaction logs to replicate changes, which requires these SQL Server native features.

Evaluate the choices to find the one addressing the source database CDC prerequisites.

Confirm that failing to enable MS-CDC or SQL Server Replication on the source is the direct cause of this replication stall.

Without MS-CDC/Replication, the source database does not produce the necessary transaction log entries that AWS DMS expects.

Key Concept

AWS DMS CDC requirements for SQL Server source databases

Question 1712Question →

A smart utility provider is designing a new IoT monitoring platform to ingest and store metrics from $10 \text{ million}$ smart meters globally. The system requirements include:
- High-throughput write ingestion of telemetry data (each write payload is approximately $500 \text{ bytes}$ ) with sub-second response times.
- Aggregated daily telemetry summaries that must be retained for audit purposes, where they are queried occasionally but must be highly durable and cost-effective.

Which two database and storage strategies should the solutions architect choose to meet these requirements? (Select TWO.)

Select all that apply

Deploy Amazon DynamoDB with auto-scaling to ingest the real-time telemetry writes, utilizing its partition-based horizontal scalability.

Store the aggregated daily summaries in Amazon S3, using S3 Lifecycle policies to transition objects to S3 Standard-Infrequent Access after 30 days to optimize storage costs.

Provision an Amazon Aurora PostgreSQL Global Database with multiple reader instances to ingest the primary telemetry write traffic across multiple AWS Regions.

Deploy a single-AZ Amazon RDS for MySQL instance with a cross-Region Read Replica to achieve a near-zero RPO and RTO for telemetry writes during a disaster recovery event.

Encrypt the telemetry data client-side before storage using the AWS-managed KMS key for Amazon S3 shared across separate logging and processing accounts.

Show answer & explanation

Answer: Deploy Amazon DynamoDB with auto-scaling to ingest the real-time telemetry writes, utilizing its partition-based horizontal scalability.; Store the aggregated daily summaries in Amazon S3, using S3 Lifecycle policies to transition objects to S3 Standard-Infrequent Access after 30 days to optimize storage costs.

Answer

Deploy Amazon DynamoDB with auto-scaling to ingest the real-time telemetry writes, and store the aggregated daily summaries in Amazon S3 with S3 Lifecycle policies to transition objects to Amazon S3 Standard-Infrequent Access after 30 days.

For the high-throughput write workload, Amazon DynamoDB is the correct option because it scales partition capacity horizontally and delivers single-digit millisecond latency. For the aggregated daily reports, storing files in Amazon S3 and using S3 Lifecycle policies to transition objects to S3 Standard-Infrequent Access after 30 days meets the durability, compliance, and cost-efficiency requirements.

Step-by-Step Solution

Analyze write ingestion requirements.

Identified high-throughput, low-latency, small-payload writes (

500 \text{ bytes}

) from

10 \text{ million}

devices, pointing to a key-value NoSQL database.

DynamoDB scales horizontally and handles high-frequency writes with sub-second latencies.

Analyze data archival and auditing requirements.

Identified aggregated daily summaries requiring high durability, cost efficiency, and occasional query support.

Amazon S3 provides

99.999999999\%

durability. Utilizing S3 Standard-IA for data older than 30 days lowers storage costs while maintaining millisecond retrieval times.

Evaluate and rule out multi-Region write solutions that violate core services limits.

Disqualified Aurora read replicas for scaling writes and cross-account AWS-managed KMS key sharing.

Aurora Global Database only permits writes to the primary writer instance, and AWS-managed KMS keys cannot be shared cross-account.

Key Concept

Selecting the optimal AWS database and storage service based on access patterns, write scaling requirements, and cross-account access limitations.

Estimated Time:2m 0s

Question 1713Question →

A technology company manages its multi-account environment using AWS Organizations. The security team has established a dedicated Sandbox Organizational Unit (OU) for developers to experiment with new services. Developers are granted administrator privileges in their respective sandbox accounts to allow rapid prototyping. The security team has deployed a security audit tool that relies on a specific IAM role named SecurityAuditRole in every sandbox account. The security team must ensure that developers cannot delete or modify this role, its attached policies, or its trust relationships, even though the developers have administrator permissions in their accounts. Which strategy should a solutions architect implement to meet these requirements with the least operational overhead?

Attach a Service Control Policy (SCP) to the Sandbox OU with a Deny effect on IAM write actions, such as iam:DeleteRole, iam:PutRolePolicy, and iam:UpdateAssumeRolePolicy, when the resource is the ARN of the SecurityAuditRole. Use local IAM policies in the sandbox accounts to grant developer permissions.

Attach a Service Control Policy (SCP) to the Sandbox OU that allows standard development actions but denies access to the SecurityAuditRole. Do not create local IAM policies or roles in the sandbox accounts, relying on the SCP to grant administrative access.

Configure a SAML 2.0 federated identity provider in each sandbox account, and attach an IAM permissions boundary to the federated role that denies modifications to the SecurityAuditRole while allowing all other administrator permissions.

Establish a centralized S3 bucket policy in a logging account that denies IAM deletion API requests originating from the sandbox accounts, and point the sandbox accounts' audit tools to write to this bucket.

Show answer & explanation

Answer: Attach a Service Control Policy (SCP) to the Sandbox OU with a Deny effect on IAM write actions, such as iam:DeleteRole, iam:PutRolePolicy, and iam:UpdateAssumeRolePolicy, when the resource is the ARN of the SecurityAuditRole. Use local IAM policies in the sandbox accounts to grant developer permissions.

Answer

Attach a Service Control Policy (SCP) to the Sandbox OU with a Deny effect on IAM write actions (such as iam:DeleteRole, iam:PutRolePolicy, and iam:UpdateAssumeRolePolicy) targeting the SecurityAuditRole resource ARN, while using local IAM policies to grant administrator access.

The correct strategy is to attach a Service Control Policy (SCP) to the Sandbox OU that denies write actions on the specific IAM role. SCPs act as guardrails that apply to all IAM entities in the member accounts, including the root user and administrators. Even if a developer has administrator privileges in a sandbox account, they cannot override a Deny action defined in an SCP. This ensures the integrity of the audit role with minimal operational overhead.

Step-by-Step Solution

Analyze the account structure and user privileges.

Developers have administrator permissions in sandbox accounts under a dedicated OU, meaning they can bypass local IAM restrictions and permission boundaries.

To identify the scope of enforcement needed to block administrators from modifying specific resources.

Select the appropriate policy type to override administrator permissions.

Service Control Policies (SCPs) apply to all users and roles in member accounts, including administrators.

SCPs are the only mechanism in AWS Organizations that can restrict the actions of local administrator users and roles.

Define the SCP rule with a explicit Deny effect on the role.

Create a Deny rule on IAM write actions, specifying the resource ARN of the SecurityAuditRole.

This prevents anyone in the sandbox accounts from modifying or deleting the audit role while still permitting all other administrator actions.

Key Concept

Service Control Policies (SCPs) in AWS Organizations define guardrails that local administrators cannot override.

Question 1714Question →

An enterprise is migrating a business-critical multi-tier application from an on-premises VMware vSphere cluster to a VMware Cloud (VMC) on AWS Software-Defined Data Center (SDDC). The application consists of a write-heavy database VM with an $8\text{ TB}$ virtual disk that requires zero downtime during migration, and fifty stateless web servers that can tolerate a brief reboot of less than $10\text{ minutes}$ . The on-premises network ( $192.168.10.0/24$ ) must be extended to VMC on AWS to maintain IP addresses. The VMC on AWS SDDC is connected to native AWS VPCs containing shared services via an AWS Transit Gateway. The network path between the on-premises environment and VMC on AWS is established over a $10\text{ Gbps}$ AWS Direct Connect connection.

To optimize the migration timeline, minimize downtime, and prevent sub-optimal routing (hairpinning) for migrated VMs communicating with native AWS services, which actions should the Solutions Architect take? (Select TWO.)

Select all that apply

Use VMware HCX Replication Assisted vMotion (RAV) to migrate the write-heavy database VM, and enable VMware HCX Mobility Optimized Routing (MOR) on the extended network segment.

Use VMware HCX Bulk Migration to migrate the fifty stateless web server VMs, scheduling the switchover to occur during a maintenance window.

Use VMware HCX Cold Migration to migrate the write-heavy database VM to ensure data consistency, and establish a VMware HCX Network Extension without enabling Mobility Optimized Routing (MOR).

Use VMware HCX Bulk Migration to migrate the database VM, and attach the VMware Cloud on AWS SDDC directly to a Direct Connect Gateway to route traffic between the extended network and the native AWS VPCs.

Use VMware HCX vMotion to migrate the fifty stateless web server VMs in parallel, and configure a Route 53 Private Hosted Zone associated only with the native VPCs to resolve the on-premises gateway IP address.

Show answer & explanation

Answer: Use VMware HCX Replication Assisted vMotion (RAV) to migrate the write-heavy database VM, and enable VMware HCX Mobility Optimized Routing (MOR) on the extended network segment.; Use VMware HCX Bulk Migration to migrate the fifty stateless web server VMs, scheduling the switchover to occur during a maintenance window.

Answer

Use VMware HCX Replication Assisted vMotion (RAV) to migrate the database VM, enable VMware HCX Mobility Optimized Routing (MOR) on the extended network, and use VMware HCX Bulk Migration to migrate the stateless web servers.

The correct options are to use VMware HCX Replication Assisted vMotion (RAV) for the database VM along with enabling Mobility Optimized Routing (MOR), and to use VMware HCX Bulk Migration for the stateless web server VMs. RAV replicates the VM active state and performs a hot cutover, meeting the zero-downtime database requirement. MOR prevents local traffic between the migrated VMs and native AWS VPCs from routing back to the on-premises default gateway. Bulk Migration allows for parallel replication and scheduled cutovers, which is perfect for the stateless web servers that can tolerate a brief reboot.

Step-by-Step Solution

Analyze migration requirements for the database VM.

The database VM is write-heavy, has a large virtual disk (

8\text{ TB}

), and requires zero downtime during migration.

This requirement rules out Cold Migration and Bulk Migration, which cause VM downtime. RAV or vMotion is required; RAV is preferred for large/active VMs as it replicates data in the background and does a hot cutover.

Analyze migration requirements for the fifty web server VMs.

The web servers are stateless and can tolerate brief reboots.

This allows the use of HCX Bulk Migration, which replicates the VMs in parallel while they are running, and then reboots them on the target side during a scheduled window, avoiding the serial limitations of HCX vMotion.

Evaluate network routing optimization for the extended network.

Traffic between migrated VMs in VMC on AWS and native AWS VPCs needs to avoid routing back to the on-premises gateway.

By default, extended L2 networks route all traffic through the on-premises default gateway. Enabling Mobility Optimized Routing (MOR) allows the VMC SDDC's Tier-1 router to intercept and route local cloud traffic directly to the Transit Gateway, preventing tromboning.

Key Concept

Selecting appropriate VMware HCX migration methods (Bulk Migration vs. RAV) and optimizing hybrid routing using Mobility Optimized Routing (MOR) to prevent latency-inducing hairpinning.

Question 1715Question →

A utility enterprise is designing a new cloud-based smart-grid monitoring platform. The system handles two primary data workloads. First, a time-series telemetry ingest workload receives smart meter readings at a rate of $100,000$ writes/second with sub-millisecond latency. Second, an online transaction processing (OLTP) workload manages customer billing and subscription metadata. The billing metadata requires a disaster recovery strategy with a Recovery Time Objective (RTO) of less than $15$ minutes and a Recovery Point Objective (RPO) of less than $5$ seconds across AWS regions. Additionally, weekly billing reports must be saved to object storage and securely shared with a third-party auditing AWS account. Encryption-at-rest is mandatory for these reports, and the primary account must maintain full control over the encryption key policy. Which database and storage architecture should a solutions architect design to satisfy these requirements with the lowest operational overhead?

Deploy Amazon DynamoDB with auto-scaling to ingest the smart meter telemetry. Deploy Amazon Aurora PostgreSQL in the primary region for billing metadata, and configure automated hourly snapshots copied to a secondary region. In a disaster recovery event, restore the database from the latest snapshot in the secondary region using AWS CloudFormation. Store the weekly reports in an Amazon S3 bucket encrypted with a KMS Customer Managed Key (CMK) and share them with the auditing account.

Deploy Amazon DynamoDB with auto-scaling to ingest the smart meter telemetry. Use a Multi-AZ deployment of Amazon RDS for PostgreSQL for the billing metadata, and configure the billing application to read from the standby database instance in the secondary Availability Zone to scale read capacity during report generation. Store the weekly reports in Amazon S3 encrypted with a KMS Customer Managed Key (CMK) and grant cross-account permissions via the key policy.

Deploy Amazon DynamoDB with auto-scaling to ingest the smart meter telemetry. Deploy Amazon Aurora Global Database for the transactional billing metadata, utilizing cross-region replicas to achieve the target RPO. Store the weekly reports in an Amazon S3 bucket encrypted with a KMS Customer Managed Key (CMK), and configure both the KMS key policy and the S3 bucket policy to allow access to the auditing account.

Deploy Amazon DynamoDB with auto-scaling to ingest the smart meter telemetry. Deploy Amazon Aurora Global Database for the billing metadata to meet the cross-region disaster recovery requirements. Store the weekly reports in an Amazon S3 bucket encrypted with the default AWS-managed KMS key (aws/s3), and configure an S3 bucket policy that permits read access to the external auditing account.

Show answer & explanation

Answer: Deploy Amazon DynamoDB with auto-scaling to ingest the smart meter telemetry. Deploy Amazon Aurora Global Database for the transactional billing metadata, utilizing cross-region replicas to achieve the target RPO. Store the weekly reports in an Amazon S3 bucket encrypted with a KMS Customer Managed Key (CMK), and configure both the KMS key policy and the S3 bucket policy to allow access to the auditing account.

Answer

Deploy Amazon DynamoDB with auto-scaling for the telemetry data. Deploy Amazon Aurora Global Database for the transactional billing metadata, utilizing cross-region replicas. Store the weekly reports in an Amazon S3 bucket encrypted with a KMS Customer Managed Key (CMK), and configure both the KMS key policy and the S3 bucket policy to allow access to the auditing account.

The correct answer recommends using Amazon DynamoDB with auto-scaling to absorb the high-throughput write workload. For the OLTP workload, Amazon Aurora Global Database satisfies the strict disaster recovery constraints with a cross-region replication lag of less than

1

second and a rapid cross-region failover time. To share encrypted reports cross-account, a Customer Managed Key (CMK) is used because its key policy can be updated to trust the external auditing account principal alongside the S3 bucket policy.

Step-by-Step Solution

Select storage for the high-volume NoSQL telemetry data.

Amazon DynamoDB with auto-scaling is selected.

DynamoDB is a fully managed NoSQL database that can natively scale to handle

100,000

writes/second with sub-millisecond latency.

Determine the OLTP database replication configuration to satisfy RPO and RTO constraints.

Amazon Aurora Global Database is selected.

Aurora Global Database utilizes fast storage-level cross-region replication, offering an RPO of less than

1

second and an RTO of less than

1

minute via managed global failover.

Establish cross-account sharing and encryption configuration for the S3-hosted reports.

Use Amazon S3 with a Customer Managed Key (CMK), configuring both S3 bucket and KMS key policies.

Default AWS-managed keys (aws/s3) do not allow modification of their key policies, making them incompatible with cross-account access delegation. A Customer Managed Key (CMK) allows configuring key policy permissions for the external auditing account.

Key Concept

Selecting and configuring database engines and key management solutions based on performance, RTO/RPO, and security sharing requirements.

Estimated Time:3m 0s

Question 1716Question →

An enterprise needs to migrate an $850\text{ TB}$ dataset from an on-premises NFSv4 file system to an Amazon EFS file system. The migration must be completed within a strict $45\text{-day}$ window. The enterprise has a dedicated $1\text{ Gbps}$ AWS Direct Connect connection, but local network policy restricts migration traffic to a maximum of $250\text{ Mbps}$ to avoid impacting production workloads. The data must be encrypted at rest in AWS using a KMS key that supports annual rotation and custom policy modifications. The migration process must preserve all POSIX permissions, ownership metadata, and directory structures. Which of the following solutions meets these requirements with the least operational overhead?

Deploy AWS DataSync agents on-premises. Establish a connection to the AWS environment using the existing

1\text{ Gbps}

AWS Direct Connect connection. Create a Direct Connect gateway and configure transitive routing to connect the on-premises DataSync agents directly to the Amazon EFS mount target in the private subnet. Start a DataSync task with a bandwidth limit of

250\text{ Mbps}

to copy the data directly from the on-premises NFS share to Amazon EFS.

Order multiple AWS Snowball Edge Storage Optimized devices. Configure the devices with the NFS interface and copy the data from the on-premises NFS share. Specify the AWS-managed KMS key (`aws/s3`) to secure the data on the devices. Ship the devices to AWS to import the data into an Amazon S3 bucket. Deploy an AWS DataSync agent on a virtual machine in the target VPC, and configure a DataSync task to copy the data from the S3 bucket to the Amazon EFS file system.

Order multiple AWS Snowball Edge Storage Optimized devices. Configure the devices with the NFS interface, mount them on-premises, and copy the files from the NFS share to the devices while specifying a KMS Customer Managed Key (CMK) for encryption. Ship the devices back to AWS to import the data into an Amazon S3 bucket. Create an AWS DataSync task without deploying any agents, selecting the S3 bucket as the source and the Amazon EFS file system as the destination, to copy the files while preserving POSIX permissions and metadata.

Deploy AWS DataSync agents on-premises and configure a direct DataSync task to transfer data from the on-premises NFS share to the Amazon EFS file system over the

1\text{ Gbps}

Direct Connect connection. Set the task bandwidth limit to

250\text{ Mbps}

to comply with the network policy, and schedule it to run continuously until completion.

Show answer & explanation

Answer: Order multiple AWS Snowball Edge Storage Optimized devices. Configure the devices with the NFS interface, mount them on-premises, and copy the files from the NFS share to the devices while specifying a KMS Customer Managed Key (CMK) for encryption. Ship the devices back to AWS to import the data into an Amazon S3 bucket. Create an AWS DataSync task without deploying any agents, selecting the S3 bucket as the source and the Amazon EFS file system as the destination, to copy the files while preserving POSIX permissions and metadata.

Answer

The solution that orders AWS Snowball Edge Storage Optimized devices, encrypts them using a Customer Managed Key (CMK), imports the data to Amazon S3, and then uses an agentless AWS DataSync task to copy the files to Amazon EFS.

The correct answer provides a dual-phase approach where the bulk offline transfer of

850\text{ TB}

is executed via multiple AWS Snowball Edge Storage Optimized devices, preventing network saturation. By utilizing a Customer Managed Key (CMK), the enterprise can successfully modify the key policy to delegate decrypt and encrypt permissions to the Snowball service principal. Finally, because both the S3 staging bucket and the destination EFS are within AWS, an agentless AWS DataSync task can be used, minimizing operational overhead while keeping POSIX permissions intact during the final migration phase.

Step-by-Step Solution

Calculate the transfer duration over the available network bandwidth.

Transferring

850\text{ TB}

250\text{ Mbps}

requires:

\frac{850 \times 10^{12} \text{ bytes} \times 8 \text{ bits/byte}}{250 \times 10^6 \text{ bits/second}} \approx 2.72 \times 10^7 \text{ seconds} \approx 315 \text{ days}

. This exceeds the

45\text{-day}

limit, meaning offline data transfer using AWS Snowball Edge is mandatory.

Determines whether an online transfer is mathematically feasible within the customer's timeline.

Verify KMS encryption compatibility for Snowball Edge.

AWS Snowball Edge requires custom permissions to be granted via a key policy to access the KMS key. AWS-managed KMS keys (like `aws/s3`) cannot be configured with custom key policies, so a Customer Managed Key (CMK) must be selected.

Ensures the encryption meets the compliance constraint and is technically compatible with Snowball Edge.

Select the correct protocol interface and verify metadata preservation.

Configure Snowball Edge with the NFS interface to copy files from the on-premises NFS share. This preserves POSIX permissions, ownership, and metadata by saving them as S3 user-defined metadata when imported.

Meets the requirement to preserve source file system permissions and structure.

Design the post-import transfer to the target file system.

Create an AWS DataSync task with Amazon S3 as the source and Amazon EFS as the destination. Because this is an AWS-to-AWS transfer, no DataSync agent needs to be deployed. DataSync reads the metadata stored in S3 and reconstructs the POSIX permissions on EFS.

Allows the transfer of data from the S3 landing zone to the final EFS target with minimum operational overhead and full metadata preservation.

Key Concept

Large-Scale Data Transfer using Snow Family, DataSync, and EFS

Question 1717Question →

A retail enterprise is modernizing its legacy on-premises inventory replenishment system by moving to a serverless architecture on AWS. The system must expose a private REST API via Amazon API Gateway to multiple partner AWS accounts over an AWS Transit Gateway. The API invokes AWS Lambda functions deployed inside private subnets of a shared services VPC. These Lambda functions must perform high-frequency read and write operations against a centralized Amazon Aurora PostgreSQL database situated in a dedicated database VPC. The database credentials are stored in AWS Secrets Manager within the database VPC account. The Lambda functions in the shared services account must retrieve and decrypt these credentials. The design must prevent database connection exhaustion, support cross-account access to the credentials, and ensure that bursts in replenishment traffic do not exhaust the regional concurrency limits, which would throttle other critical customer-facing Lambda functions in the shared services account. Which TWO options should a solutions architect implement to meet these requirements? (Select TWO.)

Select all that apply

Provision an Amazon RDS Proxy endpoint in the shared services VPC to pool database connections to the Aurora PostgreSQL database, and configure reserved concurrency on the inventory replenishment Lambda function.

Create a Customer Managed Key (CMK) in AWS KMS within the database account, configure its key policy to grant the Lambda execution role in the shared services account permission to decrypt, and use this key to encrypt the secret in AWS Secrets Manager.

Create the database credentials secret in AWS Secrets Manager using the default AWS-managed KMS key in the database account, and attach an IAM policy to the Lambda execution role in the shared services account that allows cross-account decryption of that key.

Deploy a single NAT Gateway in one Availability Zone of the shared services VPC to route outgoing traffic from the private subnets to the Aurora PostgreSQL database and the Secrets Manager endpoints.

Configure provisioned concurrency on the inventory replenishment Lambda function to pre-warm execution environments, and rely on the default regional unreserved concurrency pool to automatically scale the replenishment workload during traffic spikes.

Show answer & explanation

Answer: Provision an Amazon RDS Proxy endpoint in the shared services VPC to pool database connections to the Aurora PostgreSQL database, and configure reserved concurrency on the inventory replenishment Lambda function.; Create a Customer Managed Key (CMK) in AWS KMS within the database account, configure its key policy to grant the Lambda execution role in the shared services account permission to decrypt, and use this key to encrypt the secret in AWS Secrets Manager.

Answer

The solutions architect should provision an Amazon RDS Proxy endpoint in the shared services VPC to pool database connections to the Aurora PostgreSQL database, configure reserved concurrency on the inventory replenishment Lambda function, and create a Customer Managed Key (CMK) in AWS KMS within the database account with a key policy configured to grant the Lambda execution role in the shared services account permission to decrypt, using this key to encrypt the secret in AWS Secrets Manager.

The correct solution involves provisioning an Amazon RDS Proxy endpoint to pool database connections to the Aurora PostgreSQL database, limiting the concurrency impact using Lambda reserved concurrency, and utilizing a Customer Managed Key (CMK) in AWS KMS to allow cross-account credential decryption. RDS Proxy manages database connection pooling efficiently. Reserved concurrency guarantees that the high-volume function does not exhaust the regional concurrency limits. A CMK allows modifying the key policy to delegate cross-account access to the shared services account's Lambda execution role.

Step-by-Step Solution

Analyze database connection limits and scaling characteristics of Lambda.

Identify that scaling Lambda functions create a

1:1

relationship with database connections, which can exhaust Aurora PostgreSQL connection limits.

To determine the need for a database connection pooler.

Evaluate options for database connection pooling.

Select Amazon RDS Proxy to pool and share connections, buffering traffic spikes.

To safeguard database availability and resource consumption.

Analyze account-level concurrency settings for Lambda.

Determine that using Reserved Concurrency on the replenishment Lambda function limits its maximum concurrent executions, preventing it from consuming the entire regional pool.

To protect other critical customer-facing functions from concurrency starvation.

Evaluate cross-account KMS key access requirements for Secrets Manager.

Identify that AWS-managed KMS keys do not support policy modifications for cross-account access, necessitating the creation of a Customer Managed Key (CMK) with a cross-account key policy.

To allow the shared services Lambda execution role to decrypt the database credentials.

Key Concept

Designing secure, resilient, and performant serverless architectures using Amazon RDS Proxy for connection pooling, Lambda Reserved Concurrency for blast radius limitation, and Customer Managed Keys for cross-account KMS decryption.

Question 1718Question →

LogiTransit Global is modernizing a legacy order processing workload by migrating it to Amazon ECS on AWS Fargate. The ECS tasks will run in a private subnet within an application VPC that has no internet access. The application container images are stored in an Amazon Elastic Container Registry (ECR) repository located in a separate Shared Services AWS account. The container image layers in the ECR repository are encrypted using an AWS KMS Customer Managed Key (CMK) in the Shared Services account. Which configuration will allow the ECS Fargate tasks to pull the container images while adhering to the security principle of least privilege and minimizing data transfer costs?

Configure the ECS task definition to use the bridge network mode to allow dynamic port mapping. Create Interface VPC endpoints for the ECR API and ECR Docker registries in the application VPC. In the Shared Services VPC, configure a NAT Gateway to route container image layer downloads from S3 to the public internet. Update the key policy of the Customer Managed Key in the Shared Services account to allow kms:Decrypt permissions for the ECS task execution role ARN from the application account.

Configure the ECS task definition to use the awsvpc network mode. In the application VPC, create Interface VPC endpoints with Private DNS enabled for the ECR API and ECR Docker registries, and a Gateway VPC endpoint for Amazon S3. Encrypt the ECR repository layers using the default AWS-managed KMS key (aws/ecr). Update the default AWS-managed KMS key policy to delegate kms:Decrypt permissions to the ECS task execution role in the application account. Grant the task execution role permissions to pull from the ECR repository.

Configure the ECS task definition to use the awsvpc network mode. In the application VPC, create Interface VPC endpoints with Private DNS enabled for the ECR API and ECR Docker registries, and a Gateway VPC endpoint for Amazon S3. Update the key policy of the Customer Managed Key in the Shared Services account to allow kms:Decrypt permissions for the ECS task execution role ARN from the application account. Grant the task execution role permissions to pull from the ECR repository, and configure the ECR repository policy to trust the task execution role.

Configure the ECS task definition to use the awsvpc network mode. In the application VPC, create Interface VPC endpoints for the ECR API and ECR Docker registries, but disable Private DNS to avoid conflicts with the Shared Services account. Create a Route 53 Private Hosted Zone (PHZ) for ecr.us-east-1.amazonaws.com in the Shared Services account, but do not associate it with the application VPC. Update the key policy of the Customer Managed Key in the Shared Services account to allow kms:Decrypt permissions for the ECS task execution role ARN from the application account.

Show answer & explanation

Answer: Configure the ECS task definition to use the awsvpc network mode. In the application VPC, create Interface VPC endpoints with Private DNS enabled for the ECR API and ECR Docker registries, and a Gateway VPC endpoint for Amazon S3. Update the key policy of the Customer Managed Key in the Shared Services account to allow kms:Decrypt permissions for the ECS task execution role ARN from the application account. Grant the task execution role permissions to pull from the ECR repository, and configure the ECR repository policy to trust the task execution role.

Answer

Configure the ECS task definition to use the awsvpc network mode. In the application VPC, create Interface VPC endpoints with Private DNS enabled for the ECR API and ECR Docker registries, and a Gateway VPC endpoint for Amazon S3. Update the key policy of the Customer Managed Key in the Shared Services account to allow kms:Decrypt permissions for the ECS task execution role ARN from the application account. Grant the task execution role permissions to pull from the ECR repository, and configure the ECR repository policy to trust the task execution role.

The correct configuration uses the awsvpc network mode (mandatory for Fargate) and establishes private connectivity via Interface endpoints for ECR and a Gateway endpoint for S3 (essential for downloading the image layers at no extra data processing cost). It also utilizes a Customer Managed Key (CMK) in the Shared Services account and updates its policy, since default AWS-managed keys cannot be shared cross-account.

Step-by-Step Solution

Select the correct container network mode for Fargate tasks.

AWS Fargate tasks must be configured to use the awsvpc network mode, which assigns a dedicated ENI to each task.

Fargate does not support host or bridge networking modes.

Set up private VPC endpoints for the necessary AWS services in the application VPC.

Interface endpoints for ecr.api and ecr.dkr with Private DNS enabled, and a Gateway endpoint for Amazon S3 associated with the task subnet route tables.

Since the VPC is private, ECS needs endpoints to authenticate against ECR and pull image layers. S3 Gateway endpoint is used to download container layers from ECR's underlying S3 bucket without paying Interface endpoint data processing fees.

Configure cross-account permissions for IAM, ECR, and KMS.

The target ECS Task Execution Role is trusted by the ECR repository policy and the KMS Customer Managed Key policy in the Shared Services account.

The default AWS-managed KMS keys do not support policy modifications and cannot be shared across accounts. A Customer Managed Key is required to delegate cross-account access.

Key Concept

Cross-account Amazon ECR pull from private ECS Fargate tasks using VPC endpoints and KMS Customer Managed Keys.

Question 1719Question →

An enterprise has an existing workload running on Amazon EC2 instances in a private subnet of VPC A. The application on these instances must access Amazon DynamoDB and must also assume a cross-account IAM role in Account B to write data to a partner API. Currently, all outbound traffic from the private subnet is routed through a NAT Gateway to the internet. To strengthen network and identity security, a solutions architect must ensure that traffic to DynamoDB does not traverse the public internet, and the IAM role in Account B can only be assumed if the request originates from VPC A.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Create a gateway VPC endpoint for DynamoDB in VPC A, and associate it with the route table of the private subnet.

Create an interface VPC endpoint for AWS STS in VPC A. In Account B, update the trust policy of the IAM role to allow assumption by the application's IAM principal with a condition restricting aws:sourceVpc to the VPC ID of VPC A.

Create an interface VPC endpoint for DynamoDB in VPC A, and associate it with a Route 53 private hosted zone to resolve DynamoDB service endpoints.

Attach a Service Control Policy (SCP) at the root of the AWS Organization that restricts sts:AssumeRole to the IAM role in Account B, with a condition allowing access only when the principal's VPC ID matches VPC A.

Create an AWS Transit Gateway to route STS traffic directly to Account B, and configure a Customer Managed Key (CMK) policy in Account B to restrict the kms:ViaService condition to AWS STS.

Show answer & explanation

Answer: Create a gateway VPC endpoint for DynamoDB in VPC A, and associate it with the route table of the private subnet.; Create an interface VPC endpoint for AWS STS in VPC A. In Account B, update the trust policy of the IAM role to allow assumption by the application's IAM principal with a condition restricting aws:sourceVpc to the VPC ID of VPC A.

Answer

Create a gateway VPC endpoint for DynamoDB in VPC A and associate it with the route table of the private subnet, and create an interface VPC endpoint for AWS STS in VPC A, updating the target IAM role's trust policy in Account B with an aws:sourceVpc condition for VPC A.

To secure the network path to DynamoDB, a gateway VPC endpoint is created and added to the private subnet's route table. This redirects DynamoDB traffic from the NAT Gateway directly to the AWS internal network. To restrict cross-account role assumption to requests originating from the VPC, an interface VPC endpoint for AWS STS must be created in VPC A. When the application calls sts:AssumeRole through this VPC endpoint, the request carries the source VPC ID. The trust policy of the role in Account B can then validate this with the aws:sourceVpc condition key, blocking any calls from outside the VPC.

Step-by-Step Solution

Configure private access to DynamoDB.

A gateway VPC endpoint for Amazon DynamoDB is created in VPC A and associated with the private subnet's route table, routing DynamoDB traffic directly through the AWS network.

This prevents DynamoDB traffic from routing through the NAT Gateway and traversing the public internet.

Establish a private path for STS calls.

An interface VPC endpoint for AWS STS (com.amazonaws.region.sts) is deployed in VPC A.

This routes the sts:AssumeRole calls through the VPC endpoint, appending the VPC metadata (such as the VPC ID) to the request context.

Enforce VPC source restriction on the target IAM role.

The trust policy of the cross-account role in Account B is updated with a StringEquals condition checking if the aws:sourceVpc matches the ID of VPC A.

This ensures that the cross-account role can only be assumed when the STS request originates from VPC A.

Key Concept

VPC endpoints allow private routing to AWS services, and interface endpoints preserve VPC context (such as VPC ID) for IAM policy condition evaluations.

Question 1720Question →

A smart agriculture technology provider is migrating its telemetry aggregation workloads, consisting of $15$ on-premises physical servers, to AWS using AWS Application Migration Service (MGN). The on-premises data center is connected to AWS via an AWS Direct Connect connection with a Private Virtual Interface (VIF) terminated on an AWS Transit Gateway. The target environment is a multi-account structure under AWS Organizations, where the migration staging area resides in a dedicated Staging VPC. Due to strict security policies, neither the on-premises environment nor the Staging VPC has direct internet access, and all data transfer must go over private networks. During the replication phase, the migration team observes that the MGN Replication Agent on the source servers cannot connect to the AWS MGN control plane or the staging area replication servers, preventing initial sync. Which of the following configuration steps must the Solutions Architect perform to successfully establish replication? (Select TWO.)

Select all that apply

Configure the on-premises firewall to permit outbound traffic on TCP port 1500 to the Staging VPC's replication subnet, and ensure the Staging VPC's replication security group allows inbound TCP port 1500 from the on-premises IP ranges.

Deploy Interface VPC endpoints for both AWS MGN and Amazon S3 in the Staging VPC, associate them with a Route 53 Private Hosted Zone that is shared with the on-premises DNS resolver, and configure the on-premises firewall to allow TCP port 443 outbound to these endpoints.

Deploy a Gateway VPC endpoint for Amazon S3 in the Staging VPC, configure the Transit Gateway route tables to propagate routes from the gateway endpoint to the on-premises Direct Connect connection, and allow TCP port 80 outbound on the on-premises firewall.

Create a Route 53 Private Hosted Zone for AWS MGN, and disable the 'enableDnsHostnames' and 'enableDnsSupport' options on the Staging VPC to force the VPC to delegate all DNS resolution to the on-premises DNS server.

Deploy a NAT Gateway in a public subnet of the Staging VPC to route replication traffic, and configure the on-premises firewall to allow outbound UDP traffic on port 1500 to the NAT Gateway's public IP address.

Show answer & explanation

Answer: Configure the on-premises firewall to permit outbound traffic on TCP port 1500 to the Staging VPC's replication subnet, and ensure the Staging VPC's replication security group allows inbound TCP port 1500 from the on-premises IP ranges.; Deploy Interface VPC endpoints for both AWS MGN and Amazon S3 in the Staging VPC, associate them with a Route 53 Private Hosted Zone that is shared with the on-premises DNS resolver, and configure the on-premises firewall to allow TCP port 443 outbound to these endpoints.

Answer

Deploy Interface VPC endpoints for AWS MGN and Amazon S3 in the Staging VPC, share the associated Route 53 Private Hosted Zones with the on-premises resolver, allow outbound TCP port 443, and configure firewalls and security groups to permit TCP port 1500 for data replication.

Establishing replication without internet access requires opening TCP port 1500 for data replication and deploying Interface VPC endpoints for both AWS MGN and Amazon S3. The associated Route 53 Private Hosted Zones must be shared with the on-premises DNS resolver so the agent on the source servers resolves the public endpoints to the private IPs of the VPC endpoints.

Step-by-Step Solution

Open replication data path.

The MGN replication agent can send block-level replication traffic to the replication servers.

AWS MGN requires TCP port 1500 to be allowed outbound from the source servers and inbound to the staging subnet replication servers.

Deploy private service endpoints.

Source servers can reach the MGN control plane and S3 over Direct Connect.

Since the environment lacks internet connectivity, AWS PrivateLink Interface endpoints for MGN and S3 are required to route HTTPS control traffic privately.

Establish private DNS resolution.

On-premises servers resolve the regional MGN and S3 endpoints to the private IP addresses of the VPC endpoints.

Integrating on-premises DNS resolvers with Route 53 Private Hosted Zones ensures that API calls to MGN and S3 are redirected to the Interface VPC endpoints.

Key Concept

Deploying AWS Application Migration Service (MGN) in a secure, hybrid environment with no direct internet access requires using Interface VPC endpoints (PrivateLink) for both the MGN control plane and Amazon S3, along with opening TCP port 1500 for replication data traffic.

PreviousPage 86 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept