All practice questions

A financial technology company is designing a new cloud-native wealth management application. The architecture must span two AWS Regions (Primary and Secondary) to support disaster recovery. The workload consists of:

1. An OLTP database containing transaction records. The database must sustain rapid, unpredictable spikes in read traffic, maintain read replication lag under 20 milliseconds, and support a disaster recovery plan with a Recovery Point Objective (RPO) of 1 second and Recovery Time Objective (RTO) of 1 minute.
2. A centralized audit vault containing monthly PDF statement exports. These statement files must be stored in Amazon S3, encrypted at rest, and made securely accessible to a compliance audit application running in a separate AWS account within the same AWS Organization.

Which combination of database and encryption configurations should a solutions architect select to meet these requirements? (Select TWO.)

An enterprise is implementing federated access to its production database AWS account. The database administrators must authenticate via an external SAML 2.0-compliant Identity Provider (IdP) and assume a specific administrative role (db-admin-role) in the database account. A Solutions Architect has created an IAM SAML identity provider in the target database account. However, when database administrators attempt to log in through the IdP portal, the authentication fails with a 'Not authorized to perform sts:AssumeRoleWithSAML' error. Which configuration change in the database AWS account will resolve this authentication failure?

A regional media broadcasting corporation is planning to migrate its on-premises broadcasting and media asset management (MAM) system to AWS. The environment consists of 120 VMware vSphere VMs hosting web servers, transcoding engines, and database systems. Strict corporate security policies prohibit the installation of any software agents on the database virtual machines. Additionally, there are 15 physical bare-metal media servers running an unsupported legacy Unix-like operating system. The on-premises network restricts direct outbound internet access, but a centralized proxy server is available for outbound HTTPS traffic. The corporation wants to perform a discovery phase to determine dependencies, estimate AWS sizing, and track the migration progress in AWS Migration Hub using both AWS and integrated third-party migration tools.

Which two actions should the Solutions Architect recommend to perform the discovery and track the migration progress in AWS Migration Hub? (Select TWO.)

A global logistics provider has a multi-account AWS environment consisting of $20$ spoke VPCs spread across $2$ AWS Regions: `us-east-1` and `us-west-2`. The provider must establish a highly available, transitive network topology that connects all VPCs to each other and to an on-premises datacenter over a new AWS Direct Connect connection. The architecture must minimize administrative overhead and scale easily as new VPCs are added. Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

A healthcare provider manages $110$ AWS accounts under a single organization in AWS Organizations. The lead security architect is designing a centralized auditing solution to track resource configuration changes. AWS Config must be enabled in all member accounts, with configuration history and snapshots consolidated into a central Amazon S3 bucket in a dedicated Security account. The solution must meet the following requirements:
- All configuration logs must be encrypted at rest using a customer managed key (KMS CMK) controlled by the security team.
- The central S3 bucket must enforce a write-once-read-many (WORM) policy to prevent log deletion or modification, even by administrative users in the Security account.
- Individual member accounts must be prevented from disabling the AWS Config recording or altering the delivery channel configuration.

Which combination of actions will meet these requirements?

Aether Grid Solutions is modernizing its on-premises grid simulation engine by migrating the workload to Amazon ECS. The application consists of several high-performance containerized microservices that must bind directly to the host's network interface to bypass Docker network virtualization layers, minimize latency, and handle UDP broadcast traffic. The architecture must be highly available and deployed across multiple Availability Zones. To download external simulation datasets, the containers require outbound internet connectivity. The network security team mandates that this outbound path must not have any single points of failure. The infrastructure team wants to minimize the operational overhead associated with operating system patching and server provisioning where possible.

Which architectural design should the solutions architect recommend to satisfy these requirements?

A financial services firm, ApexLedger, is modernizing its transaction reconciliation application by migrating from on-premises virtual machines to AWS. The application consists of several containerized microservices that must run on a container orchestration platform. The backend reconciliation tasks require high CPU and memory resources that scale dynamically, and compliance mandates that each task must run in its own dedicated, isolated virtualization boundary with no sharing of the underlying host OS or resources with other tasks. The microservices must also communicate securely using internal DNS names across a multi-account network containing a Shared Services VPC and a Production VPC connected via AWS Transit Gateway. Finally, the application must decrypt sensitive transaction logs using a KMS key managed in a centralized Security account.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

A smart-grid utility provider is modernizing its legacy telemetry collection backend by migrating to a serverless architecture on AWS. The system must process highly bursty, intermittent telemetry payloads from millions of smart meters via an API and write the processed records to an Amazon Aurora PostgreSQL database in a private subnet. The design must satisfy the following requirements:

1. Outbound internet traffic to third-party validation endpoints must be highly available and resilient to single Availability Zone failures.
2. The database must be protected from connection exhaustion during sudden traffic spikes.
3. Other critical microservices running in the same AWS account must be shielded from resource starvation caused by telemetry spikes.
4. Telemetry data must be encrypted with custom security policies and audit controls using AWS KMS.
5. Deployments of the backend code must shift traffic gradually to the new version over $10$ minutes and automatically roll back if errors occur.

Which of the following architectures meets these requirements while adhering to AWS best practices?

An enterprise is migrating its legacy on-premises ERP application consisting of 15 virtual machines to AWS using AWS Application Migration Service (MGN). The hybrid connectivity between the on-premises data center and AWS is established via a 1 Gbps AWS Direct Connect connection that terminates at an AWS Transit Gateway in a centralized Network Services VPC. The Transit Gateway distributes traffic to a dedicated Staging VPC where the MGN replication servers are provisioned. After installing the AWS Replication Agent on the on-premises source servers, the migration team observes that the data replication status remains stuck at 'Initiating' and the agent log files show connection timeouts when attempting to reach the replication servers. Which of the following actions should a Solutions Architect take to resolve this issue and allow data replication to proceed?

A multinational retail pharmaceutical company manages 120 member accounts under AWS Organizations. The security team requires all VPC Flow Logs from all member accounts to be collected and consolidated into a single central Amazon S3 bucket in a dedicated Security account. For data security compliance, all log data must be encrypted at rest using a customer managed KMS key (CMK). Which configuration should a solutions architect recommend to meet these requirements with the least administrative overhead?

Sidero Logistics is modernizing its on-premises containerized warehouse management application by migrating the workload to AWS. Due to strict data residency regulations and a latency requirement of less than $5\text{ ms}$ to local automated sorting systems, the application's processing containers and database must run on AWS Outposts deployed in the local warehouse. The company demands high availability with a Recovery Time Objective (RTO) of less than 1 minute for local component failures. Crucially, the solution must remain fully operational—including the ability to schedule, scale, and restart containers locally—even during a temporary WAN outage that disconnects the AWS Outpost from the parent AWS Region. Which architecture should a solutions architect design to meet these requirements with the least operational complexity?

An enterprise needs to migrate $1.2\text{ PB}$ of unstructured data from an on-premises NFSv4 file system to an Amazon FSx for NetApp ONTAP file system. The target file system is located in the company's production AWS account (Account B), while all migration operations must be initiated and managed from a dedicated migration account (Account A). The migration must be completed within a strict window of $30\text{ days}$. The enterprise has a dedicated $300\text{ Mbps}$ AWS Direct Connect connection available for the migration. All migrated data must be encrypted at rest using a Customer Managed Key (CMK) to satisfy security requirements.

Which of the following actions should the Solutions Architect take to complete this migration within the required timeline? (Select TWO.)

An enterprise is migrating a $280\text{ TB}$ dataset from an on-premises NFS file system to an Amazon S3 bucket located in the company's Production AWS account. The entire migration must be completed within 3 weeks. The company has a $1\text{ Gbps}$ AWS Direct Connect connection, but only $200\text{ Mbps}$ of this bandwidth can be dedicated to the migration project. The solution must support automatic daily replication of incremental changes until the final cutover, preserve file metadata, and ensure that the data is encrypted at rest using a key that can be shared with a separate Analytics AWS account. Which strategy will meet these requirements within the specified timeframe?

A media streaming platform is designing a new video-on-demand application. The application requires a database and storage strategy for two distinct workloads:

1. User session state: A NoSQL workload requiring sub-$10$ millisecond latency for both reads and writes, scaling up to $150,000$ writes per second during peak hours.
2. Catalog metadata: A highly relational OLTP workload that experiences unpredictable spikes in read traffic. The solution must support horizontal read scaling with minimal replica lag, support cross-account key management and rotation policies for at-rest encryption, and replicate data to a secondary AWS Region to achieve a disaster recovery Recovery Time Objective (RTO) of $5$ minutes and a Recovery Point Objective (RPO) of $1$ minute.

Which database and storage architecture should the solutions architect recommend to satisfy these requirements?

A company is designing a new multi-tenant online booking platform that requires a highly available database to handle a read-heavy OLTP workload. The database must automatically fail over to a standby instance in another Availability Zone during an outage to minimize downtime. Additionally, the platform must handle heavy read traffic for reporting dashboards with minimal latency without impacting the performance of the write operations. Which database configuration best meets these requirements?

An enterprise is establishing a multi-account structure in AWS Organizations. The Security team must enforce two governance requirements across all accounts in a newly created Organizational Unit (OU) named Workloads:

1. Prevent local administrators in member accounts from deleting or modifying a cross-account IAM role named SecurityAuditRole.
2. Allow applications in member accounts to encrypt data in their local Amazon S3 buckets using a centralized, customer-managed AWS KMS key hosted in a dedicated Security account. The key must only be usable for S3 encryption services.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

A large logistics company is migrating its on-premises VMware vSphere workloads to VMware Cloud (VMC) on AWS. The migration scope includes $10$ transactional database virtual machines (VMs) totaling $4\text{ TB}$ of storage and $50$ application VMs totaling $12\text{ TB}$ of storage. The database VMs have a maximum allowable downtime of $1$ minute during migration cutover, while the application VMs can tolerate a reboot of up to $15$ minutes. The enterprise has an existing $2\text{ Gbps}$ AWS Direct Connect connection (with $1\text{ Gbps}$ available capacity) linked to a multi-account AWS environment. The workloads must retain their original on-premises IP addresses to prevent application reconfiguration. In addition, the migrated VMs must resolve private DNS records hosted in a Route 53 Private Hosted Zone (PHZ) in the Shared Services VPC. Which combination of VMware HCX migration types and DNS configurations will satisfy these requirements?

A SaaS company operates a document generation platform on AWS. The application tier runs on Amazon EC2 instances within an Auto Scaling group (ASG) behind an Application Load Balancer (ALB) across three Availability Zones. The instances are launched from a standard Amazon Linux AMI and execute a user data bootstrap script to download 4 GB of template libraries and compile application dependencies. This process takes 8 minutes before the instances can pass ALB health checks. During scheduled marketing events, a rapid spike in requests causes the ASG's target tracking policy (set to 70% average CPU utilization) to launch new instances. However, because these instances take 8 minutes to bootstrap, the ASG repeatedly launches additional instances before the first batch becomes healthy, leading to severe over-provisioning. Additionally, a recent NAT Gateway outage in Availability Zone A prevented instances in Availability Zones B and C from retrieving remote template libraries during bootstrapping. Which solution should a Solutions Architect implement to resolve the scaling instability and ensure high availability for outbound traffic?

A logistics company is planning to migrate its on-premises infrastructure to AWS. The environment consists of 150 VMware virtual machines and 20 legacy physical servers running custom Linux distributions that cannot be virtualized. The physical servers require detailed CPU and memory utilization data at the process level to optimize AWS target sizing. However, the corporate security policy strictly forbids installing any third-party agents or making OS-level modifications on the VMware VMs. Both environments have outbound internet connectivity blocked, but they can access a VPC via an existing AWS Direct Connect connection. The migration team wants to track all migration phases, including discovery and server replication progress, from a single centralized dashboard. Which discovery and tracking strategy should the solutions architect recommend to meet these requirements?

A solutions architect is designing the deployment strategy for a critical transaction processing microservice running on Amazon ECS with the AWS Fargate launch type behind an Application Load Balancer (ALB). The business requires a deployment strategy that minimizes the blast radius of new releases by routing exactly $10\%$ of client traffic to the new version initially. The remaining $90\%$ of traffic must be routed to the new version after a 10-minute observation period, provided no errors are detected. If the microservice experiences an elevated 5XX error rate during the transition, the system must execute an automated rollback to the previous version within 2 minutes. Which deployment strategy and configuration should the solutions architect select to satisfy these requirements?