All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

A media company is designing a hybrid network architecture to connect $8$ VPCs in the `us-east-1` Region to their on-premises datacenter. They have established an AWS Direct Connect (DX) connection with a Transit VIF terminated at a Direct Connect Gateway (DXGW), which is attached to a regional AWS Transit Gateway (TGW). To ensure high availability, the company has also deployed an AWS Site-to-Site VPN connection as a backup to the same TGW. They want to configure dynamic routing using BGP such that the DX link is always preferred for all active traffic, and the VPN link is only utilized if the DX connection fails.

Which configuration should the company implement to meet these requirements with minimal administrative overhead?

Configure BGP dynamic routing on both paths. To prefer the Direct Connect link, configure the on-premises router to prepend its Autonomous System (AS) path multiple times when advertising its routes to AWS over the Direct Connect connection.

Configure BGP dynamic routing on both paths. Create an AWS Route 53 Private Hosted Zone (PHZ) containing failover routing records pointing to the Direct Connect Gateway and the VPN connection, and associate this PHZ with all

8

VPCs.

Configure BGP dynamic routing on both the Direct Connect connection and the Site-to-Site VPN, advertising identical prefixes from the datacenter. On the on-premises router, configure a higher BGP local preference for routes received via the Direct Connect connection compared to the VPN connection.

Configure BGP dynamic routing on the Direct Connect connection and static routing on the Site-to-Site VPN. In the Transit Gateway route table, configure a static route for the on-premises CIDR pointing to the VPN attachment with a higher administrative distance.

Show answer & explanation

Answer: Configure BGP dynamic routing on both the Direct Connect connection and the Site-to-Site VPN, advertising identical prefixes from the datacenter. On the on-premises router, configure a higher BGP local preference for routes received via the Direct Connect connection compared to the VPN connection.

Answer

Configure BGP dynamic routing on both the Direct Connect connection and the Site-to-Site VPN, advertising identical prefixes from the datacenter, and configure a higher BGP local preference on the on-premises router for routes received via the Direct Connect connection.

Configuring BGP dynamic routing on both paths ensures automatic failover and minimal administrative overhead. For traffic from AWS to the datacenter, AWS Transit Gateway naturally prefers Direct Connect Gateway attachments over VPN attachments when the same prefixes are propagated. For traffic from the datacenter to AWS, the on-premises router must be configured to prefer the Direct Connect path, which is achieved by setting a higher BGP local preference for routes received via Direct Connect.

Step-by-Step Solution

Analyze AWS Transit Gateway path selection behavior for outbound traffic from AWS to the on-premises datacenter.

Identify that when identical prefixes are advertised over both Direct Connect Gateway and VPN, Transit Gateway automatically prefers the Direct Connect Gateway attachment over the VPN attachment.

This establishes the correct primary path for egress traffic from the VPCs without manual route table manipulation.

Analyze path selection behavior for return traffic from the on-premises datacenter to AWS.

Determine that the on-premises router must be configured to prefer the prefixes received via Direct Connect over those received via the VPN.

BGP local preference is a standard attribute used to influence outbound routing choices within the on-premises Autonomous System.

Evaluate the administrative overhead of the proposed routing mechanisms.

Using dynamic routing (BGP) on both paths propagates changes automatically, minimizing manual configuration compared to static routing.

This satisfies the constraint of minimizing administrative overhead.

Key Concept

BGP routing preference and path selection in hybrid AWS network designs using Transit Gateway

Question 1802Question →

A financial services company is designing a centralized logging architecture for its AWS environment. The environment consists of $75$ member accounts organized under AWS Organizations. The company has designated a dedicated Security Operations account for managing security tools and a separate Log Archive account for long-term log storage. The Solutions Architect must configure AWS CloudTrail to capture all management events across all accounts. The logs must be consolidated in a single Amazon S3 bucket in the Log Archive account, encrypted with a Customer Managed Key (CMK) in AWS KMS, and managed from the Security Operations account.

Which TWO actions must the Solutions Architect take to configure this solution?

Select all that apply

From the organization's management account, register the Security Operations account as a delegated administrator for CloudTrail. In the Security Operations account, create an organization trail configured to send logs to the S3 bucket in the Log Archive account.

Configure the key policy of the Customer Managed Key (CMK) in the Log Archive account to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:Decrypt` operations, restricting access using the `aws:PrincipalOrgID` condition.

Configure the S3 bucket policy in the Log Archive account to grant `s3:PutObject` permissions directly to the IAM roles of the member accounts to enable cross-account log delivery.

Configure the organization trail to use the default AWS-managed KMS key (`aws/s3`) in the Log Archive account to encrypt the logs.

Attach a Service Control Policy (SCP) to the root of the organization that grants the `s3:PutObject` permission on the destination bucket to all member accounts.

Show answer & explanation

Answer: From the organization's management account, register the Security Operations account as a delegated administrator for CloudTrail. In the Security Operations account, create an organization trail configured to send logs to the S3 bucket in the Log Archive account.; Configure the key policy of the Customer Managed Key (CMK) in the Log Archive account to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:Decrypt` operations, restricting access using the `aws:PrincipalOrgID` condition.

Answer

Register the Security Operations account as a delegated administrator from the management account to create the organization trail, and configure the key policy of the Customer Managed Key (CMK) in the Log Archive account to grant necessary permissions to the CloudTrail service principal with an organization condition.

To centralize log management under the Security Operations account, it must be registered as a delegated administrator for AWS CloudTrail from the management account. This allows the security team to define the organization trail. When encrypting consolidated logs across multiple accounts with a Customer Managed Key (CMK), the key policy must explicitly allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to generate data keys and decrypt logs, which can be secured using the `aws:PrincipalOrgID` condition to ensure only trails within the organization can utilize the key.

Step-by-Step Solution

The Security Operations account gains administrative privileges to create and manage organization-level trails.

To centralize security operations, administrative tasks should be delegated out of the management account.

Create an organization trail from the newly registered Security Operations account, directing the output to the centralized S3 bucket.

CloudTrail automatically initiates log collection from all

75

member accounts in the organization.

This establishes centralized logging without requiring individual manual trail setups in each member account.

Configure the KMS key policy for the Customer Managed Key in the Log Archive account.

The CloudTrail service principal is granted permissions to generate data keys and decrypt logs for all accounts belonging to the organization.

A Customer Managed Key (CMK) is required because AWS-managed keys cannot be shared for cross-account log delivery.

Key Concept

Delegated administration for AWS CloudTrail and cross-account KMS encryption key policies in a multi-account organization.

Question 1803Question →

A logistics enterprise manages $50$ AWS accounts under a single organization in AWS Organizations. The security team is implementing an organization trail in AWS CloudTrail that will write log files to a centralized Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). What configuration must be implemented to allow CloudTrail to successfully deliver encrypted log files to the centralized S3 bucket?

Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the CloudTrail service principal (cloudtrail.amazonaws.com) with a condition restricting writes to the organization's trail. Additionally, configure the KMS key policy of the CMK to grant the CloudTrail service principal permissions for kms:GenerateDataKey* and kms:DescribeKey with appropriate resource conditions.

Configure the S3 bucket policy in the Security account to grant write permissions to the CloudTrail service principal. For encryption, configure the organization trail to use the default AWS-managed KMS key for Amazon S3 (aws/s3) in the Security account to encrypt the logs.

Create a Service Control Policy (SCP) at the root of the organization that allows s3:PutObject and kms:GenerateDataKey* for the CloudTrail service principal. Apply this SCP to all Organizational Units (OUs) to automatically delegate log delivery permissions without modifying the S3 bucket policy or the KMS key policy in the Security account.

Configure the S3 bucket policy in the Security account to grant write permissions to the IAM roles of the administrators in the member accounts. Configure the KMS key policy to trust the member accounts' IAM roles to perform encryption operations on behalf of CloudTrail.

Show answer & explanation

Answer: Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the CloudTrail service principal (cloudtrail.amazonaws.com) with a condition restricting writes to the organization's trail. Additionally, configure the KMS key policy of the CMK to grant the CloudTrail service principal permissions for kms:GenerateDataKey* and kms:DescribeKey with appropriate resource conditions.

Answer

To configure centralized logging with an organization trail and a customer managed KMS key, the S3 bucket policy and the KMS key policy in the Security account must explicitly trust the CloudTrail service principal (cloudtrail.amazonaws.com) and grant it the necessary write and key generation permissions.

The correct answer accurately configures both resource policies (the S3 bucket policy and the KMS key policy) to grant the necessary permissions to the CloudTrail service principal (cloudtrail.amazonaws.com) using security conditions to prevent unauthorized log writing and key usage.

Step-by-Step Solution

Identify the writer of the logs.

The AWS CloudTrail service principal (cloudtrail.amazonaws.com) delivers logs, not individual member account IAM identities.

This determines which principal needs permissions in the target S3 bucket and KMS policies.

Evaluate key types for cross-account KMS usage.

Default AWS-managed keys (like aws/s3) cannot be shared or modified via policies, requiring a Customer Managed Key (CMK) instead.

AWS CloudTrail needs cross-account access to encrypt logs when writing to a bucket in another account.

Examine policy capabilities (SCPs vs resource policies).

SCPs do not grant permissions across accounts; resource policies on both the S3 bucket and the KMS key must explicitly grant permissions to the CloudTrail service principal.

This clarifies why the target policies must be modified and why SCP configurations alone are insufficient.

Key Concept

Cross-Account Centralized Trail Log Delivery and Encryption

Question 1804Question →

A company is implementing direct identity federation from an on-premises SAML 2.0-compliant Identity Provider (IdP) to multiple target AWS accounts in their AWS Organization. The Solutions Architect needs to set up the trust relationships so that corporate users can assume roles in these target accounts. Which of the following configuration steps must be performed in each target AWS account to successfully establish this trust? (Select TWO.)

Select all that apply

Create an IAM identity provider in the target AWS account by uploading the SAML metadata document obtained from the on-premises IdP.

Create an IAM role in the target AWS account with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML identity provider principal.

Create an IAM role in the target AWS account with a trust policy that allows the sts:AssumeRole action for the SAML identity provider principal.

Attach a Service Control Policy (SCP) to the target accounts' Organizational Unit (OU) that grants the required IAM permissions directly to the IdP users.

Show answer & explanation

Answer: Create an IAM identity provider in the target AWS account by uploading the SAML metadata document obtained from the on-premises IdP.; Create an IAM role in the target AWS account with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML identity provider principal.

Answer

To configure direct federation, you must create an IAM SAML identity provider in each target account using the IdP's metadata document, and create an IAM role with a trust policy permitting the sts:AssumeRoleWithSAML action.

Establishing direct SAML 2.0 federation requires creating an IAM SAML identity provider in each target AWS account using the IdP's metadata document. Additionally, an IAM role must be created in each target account with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider principal. This enables users authenticated by the on-premises IdP to safely assume the role and obtain temporary AWS credentials.

Step-by-Step Solution

An IAM SAML identity provider entity is created inside the target account.

This establishes the cryptographic trust from the target AWS account to the external Identity Provider by utilizing its metadata document.

Create the Federated IAM Role

An IAM role configured with a trust policy for the SAML provider is created.

The role must have a trust policy that explicitly allows the sts:AssumeRoleWithSAML action for the newly created SAML identity provider principal to allow federated users to obtain temporary security credentials.

Key Concept

Direct SAML 2.0 Federation Configuration in AWS Multi-Account Environments

Estimated Time:2m 0s

Question 1805Question →

A company manages its multi-account AWS environment using AWS Organizations. A solutions architect is configuring SAML 2.0-based federation with an external Identity Provider (IdP) to allow database administrators to log in directly to a target production account (111122223333) and manage Amazon RDS databases.

The solutions architect creates an IAM role named `DBA-Federated-Role` and configures its trust policy as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::111122223333:saml-provider/Corporate-IdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

To control permissions centrally, the solutions architect attaches a Service Control Policy (SCP) to the Production Organizational Unit (OU) that contains the production account. The SCP contains an `Allow` statement for all Amazon RDS actions (`rds:*`). No identity-based permission policies are attached directly to the `DBA-Federated-Role`.

When database administrators attempt to log in using the corporate identity provider portal, the federation fails and they cannot assume the role.

Which combination of actions must the solutions architect take to resolve the federation failure and ensure the database administrators have the necessary permissions to manage the RDS databases?

Change the action in the trust policy of the IAM role to `sts:AssumeRoleWithSAML`, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.

Change the action in the trust policy of the IAM role to `sts:AssumeRoleWithSAML`. No local IAM policies are required because the Service Control Policy (SCP) attached to the Organizational Unit (OU) explicitly allows the RDS actions, which automatically grants the permissions to all authenticated principals in the member accounts.

Modify the trust policy of the IAM role to use `sts:AssumeRole` with the SAML provider as a service principal, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.

Change the action in the trust policy of the IAM role to `sts:AssumeRoleWithWebIdentity`, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.

Show answer & explanation

Answer: Change the action in the trust policy of the IAM role to `sts:AssumeRoleWithSAML`, and attach an identity-based IAM policy to the role in the target production account that explicitly allows the required Amazon RDS actions.

Answer

The correct answer updates the trust policy action to `sts:AssumeRoleWithSAML` which is required for SAML-based federation, and attaches an identity-based IAM policy to the federated role. In AWS Organizations, Service Control Policies (SCPs) set permission guardrails but do not grant permissions directly. Therefore, local identity-based policies must be used to grant access.

Step-by-Step Solution

Analyze the IAM trust policy action configuration for external SAML 2.0 federation.

Determine that the trust policy must use `sts:AssumeRoleWithSAML` as its action.

When federating via a SAML IdP, the user client requests temporary security credentials by calling the AWS STS `AssumeRoleWithSAML` API. The default `sts:AssumeRole` is meant for IAM users, cross-account access, or AWS services, not SAML federation.

Evaluate the role of Service Control Policies (SCPs) versus identity-based policies in AWS Organizations.

Identify that an identity-based IAM policy allowing `rds:*` must be attached directly to the `DBA-Federated-Role` role.

SCPs act as boundaries (guardrails) that restrict the maximum permissions available to accounts within an OU. They do not grant permissions to IAM roles or users. Without a local identity-based policy, the federated user has an implicit deny for all actions.

Key Concept

SAML 2.0 federation requires the `sts:AssumeRoleWithSAML` action in the trust policy, and Service Control Policies (SCPs) function as permission filters rather than granting permissions directly.

Estimated Time:2m 0s

Question 1806Question →

An enterprise is planning to migrate a hybrid portfolio of VMware vSphere-based workloads to AWS. The workload consists of two main tiers:

- Tier 1: Active-active transaction processing VMs ( $30$ VMs, $12\text{ TB}$ total storage) that have strict zero-downtime requirements (no service interruption during migration) and require preservation of IP addresses because of hardcoded application dependencies.
- Tier 2: Batch processing and reporting workloads ( $150$ VMs, $45\text{ TB}$ total storage) that can tolerate a brief service interruption (reboot) of up to $30\text{ minutes}$ during the final cutover, but data replication must occur continuously to minimize the final cutover window.

Network connectivity is established via a $10\text{ Gbps}$ Dedicated AWS Direct Connect connection terminating at a customer-managed transit router. The target architecture includes a VMware Cloud (VMC) on AWS Software-Defined Data Center (SDDC) and three native AWS spoke VPCs in a multi-account organization. Private DNS resolution must be maintained across on-premises, VMC on AWS SDDC, and native VPC workloads.

Which combination of migration and networking configuration steps should the solutions architect implement to meet these requirements with the least operational overhead? (Select THREE.)

Select all that apply

Use VMware HCX Replication-Assisted vMotion (RAV) to migrate Tier 1 VMs, utilizing an HCX L2 Network Extension to stretch the broadcast domain and maintain IP addresses with zero service downtime.

Use VMware HCX Bulk Migration to perform scheduled, low-downtime migrations of Tier 2 VMs, allowing replication to occur in the background and performing a virtual machine reboot during cutover.

Connect the VMC on AWS SDDC to a VMware Cloud Transit Connect (VTGW), associate the VTGW with the Direct Connect Gateway (DXGW) for hybrid connectivity, and peer the customer-managed AWS Transit Gateway (TGW) with the VTGW to enable routing between the native VPCs and the SDDC.

Use AWS Application Migration Service (MGN) to replicate the Tier 1 database and application VMs directly to native EC2 instances over the stretched layer 2 network to achieve zero-downtime migrations.

Associate the Route 53 Private Hosted Zones (PHZs) of the native VPCs directly with the VMC on AWS SDDC management VPC to ensure seamless cross-environment private DNS resolution.

Configure the Direct Connect Gateway (DXGW) to route traffic transitively between the native spoke VPCs and the VMware Cloud on AWS SDDC over the Direct Connect link without establishing a Transit Gateway.

Show answer & explanation

Answer: Use VMware HCX Replication-Assisted vMotion (RAV) to migrate Tier 1 VMs, utilizing an HCX L2 Network Extension to stretch the broadcast domain and maintain IP addresses with zero service downtime.; Use VMware HCX Bulk Migration to perform scheduled, low-downtime migrations of Tier 2 VMs, allowing replication to occur in the background and performing a virtual machine reboot during cutover.; Connect the VMC on AWS SDDC to a VMware Cloud Transit Connect (VTGW), associate the VTGW with the Direct Connect Gateway (DXGW) for hybrid connectivity, and peer the customer-managed AWS Transit Gateway (TGW) with the VTGW to enable routing between the native VPCs and the SDDC.

Answer

Use VMware HCX Replication-Assisted vMotion (RAV) to migrate Tier 1 VMs, VMware HCX Bulk Migration for Tier 2 VMs, and connect VMC on AWS SDDC using VMware Cloud Transit Connect (VTGW) peered with the customer-managed AWS Transit Gateway (TGW).

The correct answer combines VMware HCX Replication-Assisted vMotion (RAV) with L2 Network Extension to migrate Tier 1 VMs live with no downtime, uses HCX Bulk Migration to replicate Tier 2 VMs in the background with a scheduled reboot, and uses VMware Cloud Transit Connect (VTGW) peered with a customer-managed AWS Transit Gateway (TGW) to build a fully routed hybrid network path across native VPCs, the VMC SDDC, and the on-premises environment.

Step-by-Step Solution

Analyze Tier 1 migration requirements: zero downtime and preservation of IP addresses.

Determine that VMware HCX Replication-Assisted vMotion (RAV) along with HCX L2 Network Extension is required because it allows live migration without state loss or IP modification.

RAV supports zero-downtime migrations by utilizing vMotion over a stretched Layer 2 network, matching the strict SLA.

Analyze Tier 2 migration requirements: bulk migration of 150 VMs with up to 30 minutes downtime allowed.

Select VMware HCX Bulk Migration, which handles parallel background replication and triggers a virtual machine reboot during cutover.

Bulk migration is optimized for large-scale migrations where a brief downtime is acceptable for final cutover.

Design the network connectivity architecture for native VPCs, VMC SDDC, and on-premises.

Connect VMC SDDC to VMware Cloud Transit Connect (VTGW), associate the VTGW with the DXGW, and peer the customer-managed TGW with the VTGW.

This establishes valid transitive routing paths across VMC SDDC, native VPCs, and on-premises over the Direct Connect connection.

Key Concept

Selecting appropriate VMware HCX migration methods (RAV vs. Bulk) and establishing correct hybrid connectivity with transitive routing using Transit Gateway and VMware Cloud Transit Connect.

Estimated Time:3m 0s

Question 1807Question →

A company is modernizing a legacy, highly secure internal customer service API and migrating it to a serverless architecture on AWS. The system must meet the following requirements:

* The API must be accessible only from the company's on-premises network (connected via AWS Direct Connect) and specific consumer VPCs in other AWS accounts; it must never be exposed to the public internet.
* The backend logic runs in AWS Lambda, which needs to retrieve data from an Amazon RDS PostgreSQL database located in a private subnet. The database has strict connection limits.
* The architecture must be highly available across multiple Availability Zones, and outbound internet traffic from the Lambda functions (for third-party API verification) must be resilient to Availability Zone failures.
* Updating the Lambda functions must support canary releases with automated rollback based on synthetic test failures.
* High-volume traffic bursts must not allow the database-querying function to exhaust the regional execution pool of the AWS account, which hosts other critical business workloads.

Which combination of actions should the solutions architect take to meet these requirements? (Select THREE.)

Select all that apply

Create a private Amazon API Gateway API with interface VPC endpoints. Apply an API Gateway resource policy that restricts access to the VPC endpoints of the consumer VPCs and the corporate Direct Connect gateway.

Deploy the Lambda functions within private subnets across multiple Availability Zones, and configure route tables to route outbound internet traffic through a dedicated NAT Gateway in each Availability Zone. Deploy an Amazon RDS Proxy in the same private subnets to manage database connection pooling.

Configure a reserved concurrency limit on the database-querying Lambda function. Use AWS CodeDeploy to manage deployments using a canary release configuration, and set up CloudWatch alarms on function errors to trigger automated rollbacks.

Route all outbound Lambda traffic through a single NAT Gateway located in a central egress VPC to minimize NAT charges. Set provisioned concurrency on all Lambda functions to pre-warm execution environments and mitigate cold starts during traffic spikes.

Deploy a public API Gateway endpoint and authenticate incoming requests using a custom Lambda Authorizer. Encrypt data payloads using the AWS-managed KMS key for Lambda (aws/lambda) and configure CodeDeploy to perform linear updates with manual rollbacks.

Allow the database-querying Lambda functions to run with default unreserved concurrency to maximize scaling throughput under burst conditions. Set up an Auto Scaling group of EC2 instances running HAProxy to handle database connection pooling instead of serverless proxies.

Show answer & explanation

Answer: Create a private Amazon API Gateway API with interface VPC endpoints. Apply an API Gateway resource policy that restricts access to the VPC endpoints of the consumer VPCs and the corporate Direct Connect gateway.; Deploy the Lambda functions within private subnets across multiple Availability Zones, and configure route tables to route outbound internet traffic through a dedicated NAT Gateway in each Availability Zone. Deploy an Amazon RDS Proxy in the same private subnets to manage database connection pooling.; Configure a reserved concurrency limit on the database-querying Lambda function. Use AWS CodeDeploy to manage deployments using a canary release configuration, and set up CloudWatch alarms on function errors to trigger automated rollbacks.

Answer

The correct combination of actions consists of: creating a private API Gateway with interface VPC endpoints and an appropriate resource policy to restrict access; deploying the Lambda functions across multiple Availability Zones in private subnets with dedicated NAT Gateways and utilizing Amazon RDS Proxy; and setting a reserved concurrency limit on the function while managing canary deployments and rollbacks with AWS CodeDeploy and CloudWatch Alarms.

The correct solution addresses private network routing, backend high availability, database connection safety, and controlled serverless deployments. Private API Gateway with interface endpoints and resource policies limits access strictly to the corporate Direct Connect and target consumer VPCs. Placing Lambda in private subnets with a dedicated NAT Gateway per Availability Zone guarantees redundant outbound internet paths. Amazon RDS Proxy resolves PostgreSQL database connection limit issues. Defining reserved concurrency on the Lambda function guarantees that burst traffic will not exhaust the regional concurrency limit, protecting other functions in the account. Finally, AWS CodeDeploy canary configurations coupled with CloudWatch Alarms provide automated safe deployments and rollbacks.

Step-by-Step Solution

Ensure the API is kept private and secure from external networks.

Create a private API Gateway with an interface VPC endpoint (VPCE) and configure a resource policy to allow incoming calls only from the corporate Direct Connect gateway and specified consumer VPC endpoints.

This configuration prevents exposure of the endpoint to the public internet while permitting authorized cross-account and hybrid corporate network traffic.

Establish highly available, redundant networking for the backend Lambda functions.

Deploy the Lambda functions in private subnets spanning multiple Availability Zones and set up a NAT Gateway in each AZ for outbound traffic.

This guarantees that outbound connection paths to third-party verification APIs remain operational even if a single Availability Zone experiences an outage.

Configure database connection management and concurrency safety controls.

Implement Amazon RDS Proxy in the Lambda functions' VPC subnets, and configure a reserved concurrency limit on the Lambda function itself.

RDS Proxy pools database connections to protect the RDS PostgreSQL limits, while reserved concurrency protects the AWS account's regional concurrency pool from exhaustion during burst periods.

Set up automated deployment security mechanisms.

Configure AWS CodeDeploy to execute canary deployments and link it to CloudWatch Alarms measuring function errors.

This automates the verification of new versions and triggers automatic rollbacks if synthetic tests or errors exceed defined thresholds.

Key Concept

Designing secure, resilient, and scalable serverless APIs with private API Gateway endpoints, multi-AZ Lambda networking, connection pooling via RDS Proxy, account concurrency safeguards, and automated canary deployment verification.

Estimated Time:3m 0s

Question 1808Question →

A smart grid utility provider is designing a new telemetry processing system in AWS to ingest meter readings from millions of smart meters. The application's database must be highly available and resilient. The system is designed with a primary Region of `eu-central-1` and a disaster recovery Region of `eu-west-1`. The business requires a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $5$ minutes. Additionally, outbound communication to external grid APIs must remain highly available within the primary Region, even during a single Availability Zone outage. Which two options should the solutions architect select to meet these requirements?

Select all that apply

Deploy an Amazon Aurora Global Database with the primary cluster in eu-central-1 and a secondary cluster in eu-west-1. Configure Aurora replicas across multiple Availability Zones in the primary Region.

Configure subnet route tables in all Availability Zones of the primary Region to route outbound traffic through a single NAT Gateway deployed in a single Availability Zone to minimize NAT Gateway charges.

Set up daily Amazon Aurora database snapshot exports to Amazon S3, copy the snapshots to eu-west-1 using AWS Backup, and restore the database from the copied snapshot during a failover event.

Create a Route 53 Private Hosted Zone for the database in eu-central-1, associate it only with the primary VPC, and use cross-region VPC peering to resolve the database DNS endpoint in eu-west-1.

Deploy NAT Gateways in multiple Availability Zones in the primary VPC, and configure the subnet route table in each Availability Zone to direct outbound traffic through the local NAT Gateway in that same zone.

Deploy a single-node Amazon RDS PostgreSQL instance in the primary Region, and configure Aurora Auto Scaling to dynamically provision a standby instance in the secondary Region to scale out read capacity during traffic spikes.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in eu-central-1 and a secondary cluster in eu-west-1. Configure Aurora replicas across multiple Availability Zones in the primary Region.; Deploy NAT Gateways in multiple Availability Zones in the primary VPC, and configure the subnet route table in each Availability Zone to direct outbound traffic through the local NAT Gateway in that same zone.

Answer

Deploying Amazon Aurora Global Database to achieve cross-region replication for RTO/RPO objectives, alongside deploying multiple NAT Gateways in each Availability Zone of the primary Region to ensure high availability for outbound traffic.

Deploying an Amazon Aurora Global Database provides cross-region replication with a typical RPO of less than 1 second and a quick failover RTO, which easily satisfies the 15-minute RTO and 5-minute RPO. Multi-AZ deployment within the primary Region ensures local database high availability. Furthermore, deploying NAT Gateways in multiple Availability Zones in the primary VPC ensures that outbound connectivity to external grid APIs is highly available locally within the Region, removing any single point of failure from an AZ outage.

Step-by-Step Solution

Analyze the database RTO and RPO requirements.

RTO is

15

minutes and RPO is

5

minutes.

Standard cross-region database snapshot copy solutions fail to meet a

5

-minute RPO. Amazon Aurora Global Database provides sub-second replication latency, meeting the

5

-minute RPO, and can be promoted in minutes, satisfying the

15

-minute RTO.

Identify the high availability requirements for outbound network traffic within the primary Region.

NAT Gateways must be deployed in multiple Availability Zones.

A single NAT Gateway in a single AZ represents a single point of failure. If that AZ goes down, outbound connectivity to the grid APIs fails. Placing NAT Gateways in multiple AZs removes this single point of failure.

Key Concept

Designing multi-region disaster recovery and high availability for databases and networking on AWS.

Question 1809Question →

A healthcare provider is migrating its clinical diagnostics imaging system from an on-premises data center to AWS using AWS Application Migration Service (MGN). The on-premises environment is connected to AWS via a $1\text{ Gbps}$ AWS Direct Connect connection terminated at an AWS Transit Gateway. To comply with patient data privacy regulations, the source servers are hosted in a secure zone with no outbound internet access, and all data transmission to AWS must occur over private connections.

The migration engineer has installed the AWS Replication Agent on the source servers, but the replication status remains stuck at "Connecting" and the agents fail to register with the AWS MGN service.

Which of the following configuration steps should the solutions architect perform to resolve the connectivity issues and initiate replication? (Select two.)

Select all that apply

Configure the security groups of the replication servers in the staging area and the on-premises firewalls to allow inbound traffic on TCP port 1500 from the source servers.

Deploy Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN service in the staging VPC, and configure the on-premises DNS to forward queries for the MGN regional endpoint to Route 53 Resolver inbound endpoints.

Deploy a single NAT Gateway in the staging VPC and update the Transit Gateway route table to direct outbound traffic from the on-premises subnet to the NAT Gateway to resolve the public MGN API endpoint.

Create a Route 53 Private Hosted Zone for the MGN regional endpoint in the staging VPC, but do not associate it with the staging VPC, relying on the Transit Gateway to propagate the DNS records to the on-premises networks.

Establish a Direct Connect Gateway connection directly to handle transitive routing between the staging VPC and the target VPC, bypassing the Transit Gateway for replication data.

Show answer & explanation

Answer: Configure the security groups of the replication servers in the staging area and the on-premises firewalls to allow inbound traffic on TCP port 1500 from the source servers.; Deploy Interface VPC Endpoints (AWS PrivateLink) for the AWS MGN service in the staging VPC, and configure the on-premises DNS to forward queries for the MGN regional endpoint to Route 53 Resolver inbound endpoints.

Answer

The solutions architect must configure the staging area security groups and on-premises firewalls to allow inbound traffic on TCP port 1500 from the source servers, and deploy Interface VPC Endpoints for the AWS MGN service in the staging VPC while configuring on-premises DNS to forward queries to Route 53 Resolver inbound endpoints.

To establish replication in a strictly private environment, two communication channels must be configured. First, the data replication channel requires TCP port 1500 to be open from the source servers to the replication servers in the staging area. Second, the control plane registration and communication require the agent to reach the MGN API endpoint on TCP port 443. Since public internet access is prohibited, Interface VPC Endpoints must be created in the staging VPC. On-premises DNS servers must then be configured to resolve the MGN endpoint to these private IPs by forwarding queries to a Route 53 Resolver inbound endpoint.

Step-by-Step Solution

Identify the network requirements for AWS MGN replication data transfer.

Establish that the replication agents send data to replication servers in the staging area using TCP port 1500.

Replication traffic requires opening port 1500 through all firewalls and security groups along the network path.

Identify the network requirements for MGN control plane registration and management.

Acknowledge that agents must communicate with the regional MGN service API over HTTPS (TCP port 443).

Because the source environment has no internet access, interface VPC endpoints (PrivateLink) are required in the staging VPC to access the MGN endpoints privately.

Configure DNS resolution for private endpoints.

Route queries for the MGN service endpoint from the on-premises DNS to the Route 53 Resolver inbound endpoint.

This ensures the source servers resolve the public MGN service address to the private IP addresses of the interface VPC endpoints.

Key Concept

Network architecture and DNS resolution for private replication using AWS Application Migration Service (MGN) over AWS Direct Connect.

Estimated Time:2m 0s

Question 1810Question →

An enterprise is implementing a multi-account AWS environment across the `us-east-1` and `us-west-2` regions. Each region contains multiple spoke VPCs in separate AWS accounts. The spoke VPCs in each region are connected to a regional AWS Transit Gateway. The enterprise requires secure, highly available connectivity to its on-premises datacenter. They have established an AWS Direct Connect (DX) connection with a Transit Virtual Interface (VIF) terminating at a Direct Connect Gateway, and a backup AWS Site-to-Site VPN connection. The architecture must route all traffic destined for the on-premises datacenter via the DX connection as the primary path and automatically fail over to the Site-to-Site VPN. Additionally, traffic between the spoke VPCs must be strictly blocked, and the solution must minimize administrative overhead. Which TWO configurations must the solutions architect implement to meet these requirements?

Select all that apply

Associate the spoke VPC attachments with a dedicated Spoke Transit Gateway route table, and enable route propagation from both the Direct Connect Gateway and the Site-to-Site VPN attachments to this route table while keeping spoke VPC route propagation disabled.

Associate the Direct Connect Gateway and Site-to-Site VPN attachments with a dedicated Hybrid Transit Gateway route table, and enable route propagation from all spoke VPC attachments to this route table.

Connect the Direct Connect Gateway directly to each spoke VPC using Virtual Private Gateways in each account to enable transitive routing and failover between the VPCs without using Transit Gateway.

Associate a single Route 53 Private Hosted Zone for on-premises DNS resolution with a shared services VPC, and rely on Transit Gateway routing to automatically forward DNS queries from all spoke VPCs without associating the zone with those VPCs.

Deploy a single NAT Gateway in one availability zone of a centralized egress VPC in `us-east-1` to route all outbound internet traffic from both regions to minimize NAT Gateway costs.

Show answer & explanation

Answer: Associate the spoke VPC attachments with a dedicated Spoke Transit Gateway route table, and enable route propagation from both the Direct Connect Gateway and the Site-to-Site VPN attachments to this route table while keeping spoke VPC route propagation disabled.; Associate the Direct Connect Gateway and Site-to-Site VPN attachments with a dedicated Hybrid Transit Gateway route table, and enable route propagation from all spoke VPC attachments to this route table.

Answer

Associate the spoke VPC attachments with a dedicated Spoke Transit Gateway route table, propagating only the hybrid connections (Direct Connect and VPN) routes to it. Also, associate the hybrid connections with a dedicated Hybrid Transit Gateway route table, propagating the spoke VPC routes to it.

To achieve path redundancy and traffic isolation, the architecture uses separate Transit Gateway route tables. The Spoke Transit Gateway route table is associated with the spoke VPCs and only propagates routes from the Direct Connect Gateway and VPN attachments. This allows the spokes to route traffic to the on-premises datacenter without learning routes to other spoke VPCs. The Hybrid Transit Gateway route table is associated with the Direct Connect Gateway and VPN attachments and propagates routes from the spoke VPCs, allowing return traffic to reach the spokes. BGP path selection automatically prefers the Direct Connect path over the VPN path for identical prefix advertisements.

Step-by-Step Solution

Analyze the spoke-to-spoke isolation requirement.

Identify that spoke VPCs must not route traffic to one another, requiring segregation of routing tables on the Transit Gateways.

Standard route propagation in a single route table would allow all VPCs to communicate with each other.

Design the Spoke Transit Gateway route table configuration.

Associate all spoke VPC attachments with the Spoke route table and propagate only the Direct Connect Gateway and VPN attachments to this table.

This allows the spokes to learn routes to on-premises while keeping spoke VPC CIDRs out of their routing tables, preventing spoke-to-spoke communication.

Design the Hybrid Transit Gateway route table configuration.

Associate the Direct Connect Gateway and VPN attachments with a Hybrid route table and propagate the spoke VPC attachments to this table.

This allows traffic originating from the on-premises network to be correctly routed back to the spoke VPCs.

Verify routing preference and failover behavior.

BGP dynamically advertises routes over both Direct Connect (Transit VIF) and Site-to-Site VPN. AWS Transit Gateway prefers the Direct Connect Gateway path over the VPN path for identical prefix advertisements, ensuring automatic failover.

AWS Transit Gateway path selection natively prefers Direct Connect Gateway attachments over VPN attachments for the same prefix.

Key Concept

AWS Transit Gateway route table association and propagation separation for network isolation (Hub-and-Spoke pattern).

Question 1811Question →

An energy management company is designing a new real-time smart grid telemetry platform. The platform collects high-velocity grid telemetry data from millions of smart meters globally. The database layer must store real-time telemetry metadata and be deployed across two AWS Regions: us-east-1 (Primary) and us-west-2 (Secondary). The system requires a database recovery time objective (RTO) of less than 1 minute and a recovery point objective (RPO) of less than 1 second. To handle seasonal analytics, the read capacity in both regions must scale horizontally and automatically based on CPU utilization. Additionally, historical telemetry aggregations are exported hourly to an Amazon S3 bucket. An auditing and analytics team working in a separate, dedicated AWS account must be granted direct cross-account access to read these exported files. All S3 objects must be encrypted at rest.

Which two options should the Solutions Architect select to meet these requirements?

Select all that apply

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure Aurora Auto Scaling on both the primary and secondary clusters to dynamically adjust the number of Aurora Replicas based on CPU utilization.

Deploy an Amazon RDS Multi-AZ DB instance with two standby replicas in different Availability Zones within us-east-1. Configure the application to route read traffic directly to the RDS Multi-AZ standby instances and set up Auto Scaling to scale the standby instances horizontally during peak reporting hours.

Export the historical reports to an Amazon S3 bucket in the primary account. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK). Configure the CMK key policy in the primary account to grant the external analytics IAM role permissions to decrypt, and configure the S3 bucket policy to allow read access from the external account.

Deploy an Amazon RDS for PostgreSQL Multi-AZ DB instance in us-east-1, and configure a cross-region Read Replica in us-west-2 using a pilot light disaster recovery strategy. In the event of a primary region failure, run a script to manually promote the cross-region Read Replica to a primary DB instance.

Export the historical reports to an Amazon S3 bucket encrypted using the default AWS managed key (aws/s3). Modify the default aws/s3 KMS key policy to trust the external AWS account's IAM role, and configure the S3 bucket policy to allow read permissions for the external account.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure Aurora Auto Scaling on both the primary and secondary clusters to dynamically adjust the number of Aurora Replicas based on CPU utilization.; Export the historical reports to an Amazon S3 bucket in the primary account. Encrypt the S3 bucket using an AWS KMS Customer Managed Key (CMK). Configure the CMK key policy in the primary account to grant the external analytics IAM role permissions to decrypt, and configure the S3 bucket policy to allow read access from the external account.

Answer

Deploy an Amazon Aurora Global Database with Aurora Auto Scaling in us-east-1 and us-west-2, and export historical reports to an Amazon S3 bucket encrypted with an AWS KMS Customer Managed Key (CMK), configuring both the key policy and bucket policy to allow cross-account access.

The correct architecture uses Amazon Aurora Global Database to achieve the required sub-second RPO and sub-minute RTO across us-east-1 and us-west-2, with Aurora Auto Scaling handling read capacity dynamically. For cross-account access to S3, using an AWS KMS Customer Managed Key allows the key policy to be modified to delegate decryption rights to the external account, while the S3 bucket policy grants the read permissions.

Step-by-Step Solution

Analyze the database disaster recovery requirements (RTO < 1 minute, RPO < 1 second) and scalability needs across regions.

Determine that Amazon Aurora Global Database is required because it replicates data in under 1 second and supports fast failover (< 1 minute), and that Aurora Auto Scaling can scale read replicas dynamically.

Standard RDS replication does not support automated cross-region failover within the required RTO/RPO targets, and standby instances cannot serve read traffic.

Analyze the storage encryption and cross-account access requirements.

Determine that an AWS KMS Customer Managed Key (CMK) must be used to encrypt the S3 bucket because AWS-managed keys (aws/s3) cannot be modified to grant cross-account access.

Cross-account access to encrypted S3 objects requires updating both the S3 bucket policy and the KMS key policy to allow the external IAM role to decrypt the data.

Key Concept

Designing multi-region database replication with sub-minute RTO and sub-second RPO using Aurora Global Database, and configuring cross-account access to KMS-encrypted S3 objects using Customer Managed Keys.

Question 1812Question →

A collaborative workspace company is designing a new project management application. The application requires a transactional metadata store for workspace properties and document access history, which must support high-frequency reads and writes with automated failover. The application also stores document files that must be highly available initially, but are rarely accessed after 30 days. The security team requires that all data must be encrypted at rest and support cross-account access delegation to external partners. Which combination of AWS database and storage strategies should the solutions architect select to meet these requirements? (Select TWO.)

Select all that apply

Use Amazon Aurora PostgreSQL for the transactional metadata, configuring Aurora Replicas across multiple Availability Zones to handle read scaling and automate failover.

Store the document files in Amazon S3, and implement an S3 Lifecycle rule to transition documents to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

Store the transactional metadata in Amazon RDS for PostgreSQL in a Multi-AZ deployment, and configure the application to read from the standby instance in the secondary Availability Zone during peak traffic.

Store document files in Amazon S3, encrypting the objects using the default AWS KMS AWS-managed key (aws/s3) and configuring bucket policies to delegate cross-account access to external partners.

Use Amazon ElastiCache for Memcached to store transactional metadata with multi-AZ replication to ensure metadata persistence and low-latency failover.

Show answer & explanation

Answer: Use Amazon Aurora PostgreSQL for the transactional metadata, configuring Aurora Replicas across multiple Availability Zones to handle read scaling and automate failover.; Store the document files in Amazon S3, and implement an S3 Lifecycle rule to transition documents to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

Answer

Use Amazon Aurora PostgreSQL for the metadata with multi-AZ replicas to scale reads and automate failover, and store document files in Amazon S3 with an S3 Lifecycle rule to transition files to S3 Standard-IA after 30 days.

The correct strategy combines Amazon Aurora PostgreSQL for high-performance transactional metadata (using Aurora Replicas to scale reads and handle automated failover) and Amazon S3 for document storage (using S3 Lifecycle policies to transition objects to S3 Standard-IA after 30 days to reduce costs). S3 buckets and Aurora databases can be encrypted using Customer Managed KMS Keys to allow cross-account access policy modifications.

Step-by-Step Solution

Analyze the transactional metadata requirements for the workspace application.

The metadata database requires high-frequency OLTP read and write scalability and automated failover. Amazon Aurora PostgreSQL with multi-AZ Aurora Replicas satisfies these requirements by allowing reads from replicas and supporting automated, rapid failover.

This establishes the optimal relational database engine that can scale dynamically.

Analyze the document storage and access patterns.

The files require highly available object storage, but access frequency drops significantly after 30 days. Storing documents in Amazon S3 Standard and applying a Lifecycle policy to transition them to Amazon S3 Standard-IA after 30 days optimizes storage costs.

This balances durability and cost-efficiency over the lifespan of the documents.

Evaluate the encryption and cross-account access delegation requirements.

The security team requires KMS encryption with cross-account access delegation. This necessitates Customer Managed Keys (CMKs) because their key policies can be modified to trust external accounts, which is not possible with AWS-managed keys.

This ensures the security constraints are fully met.

Key Concept

Selecting and combining cost-effective, secure, and highly available database and storage solutions based on access patterns and workload requirements.

Estimated Time:2m 0s

Question 1813Question →

Vertex Media Group is migrating a legacy media transcoding pipeline from VMware virtual machines to AWS. The solution must containerize the transcoding tasks and run them on Amazon ECS using the AWS Fargate launch type to minimize operational overhead. The container images will be stored in a centralized Shared Services AWS account's Amazon ECR repository, which is encrypted using an AWS KMS Customer Managed Key (CMK). The Application VPC where the ECS tasks will run has no internet access, and all communication must remain within the AWS private network. Which combination of actions should the Solutions Architect take to configure the networking and permissions for the ECS tasks? (Select TWO.)

Select all that apply

Configure the ECS task definition to use the awsvpc network mode, and deploy Interface VPC endpoints for Amazon ECR (ecr.api and ecr.dkr) and AWS KMS, along with a Gateway VPC endpoint for Amazon S3 in the Application VPC.

Grant the ECS task execution role in the Application account permissions to pull images from ECR and decrypt them using the KMS key. Configure the ECR repository policy and the KMS Customer Managed Key policy in the Shared Services account to allow access from the Application account.

Configure the ECS task definition to use the bridge network mode to enable task communication, and deploy Interface VPC endpoints for Amazon ECR and AWS KMS in the Application VPC.

Configure the ECS task execution role to decrypt the image using the default AWS-managed KMS key (aws/ecr) in the Shared Services account, and configure cross-account access via the Application account's IAM policy.

Show answer & explanation

Answer: Configure the ECS task definition to use the awsvpc network mode, and deploy Interface VPC endpoints for Amazon ECR (ecr.api and ecr.dkr) and AWS KMS, along with a Gateway VPC endpoint for Amazon S3 in the Application VPC.; Grant the ECS task execution role in the Application account permissions to pull images from ECR and decrypt them using the KMS key. Configure the ECR repository policy and the KMS Customer Managed Key policy in the Shared Services account to allow access from the Application account.

Answer

Configure the ECS task definition to use the awsvpc network mode, deploy ECR and KMS Interface VPC endpoints, along with an S3 Gateway VPC endpoint, and grant the ECS task execution role cross-account permissions to pull from the ECR repository and decrypt using the Customer Managed Key (CMK) in the Shared Services account.

To support containerized tasks on AWS Fargate in a private VPC, the ECS task definition must use the awsvpc network mode. Since the VPC lacks internet access, the task must resolve and pull images via VPC endpoints. ECR requires Interface VPC endpoints (ecr.api and ecr.dkr) and a Gateway VPC endpoint for Amazon S3 (where ECR stores layers). Additionally, to pull images encrypted with a KMS CMK from a Shared Services account, the task execution role must be granted cross-account pull and decrypt permissions, and the ECR repository policy and KMS Customer Managed Key policy must explicitly allow cross-account access from the Application account. AWS-managed KMS keys cannot be shared cross-account, necessitating a Customer Managed Key.

Step-by-Step Solution

Select the correct networking configuration for the ECS tasks on AWS Fargate.

The ECS task definition is configured to use the awsvpc network mode.

AWS Fargate only supports the awsvpc network mode, which assigns each task its own Elastic Network Interface (ENI).

Set up private VPC endpoints in the Application VPC to pull images from ECR without internet access.

Interface VPC endpoints for Amazon ECR (ecr.api and ecr.dkr) and AWS KMS are deployed, and a Gateway VPC endpoint for Amazon S3 is created.

Since the Application VPC has no internet access, private endpoints are required to reach AWS services. ECR requires both the ECR APIs and S3 (where image layers are stored) to pull images.

Configure permissions for cross-account ECR repository and KMS key access.

The ECS task execution role in the Application account is granted access, and the ECR repository and Customer Managed Key (CMK) policies in the Shared Services account are updated to allow access from the Application account.

Cross-account access requires configuring permissions on both the IAM role pulling the image (identity-based policy) and the resources in the Shared Services account (resource-based policies).

Key Concept

Modernizing legacy workloads using Amazon ECS on AWS Fargate requires configuring private connectivity via VPC endpoints (ECR, S3, KMS) and configuring cross-account access utilizing IAM roles and resource-based policies for Customer Managed Keys (CMKs) and ECR repositories.

Question 1814Question →

An enterprise is establishing direct federated access for its operations team to a Shared Services AWS account (account ID 111122223333) using an on-premises SAML 2.0-compliant Identity Provider (IdP). A Solutions Architect creates a SAML provider named 'CorporateIdP' and an IAM role named 'OpsConsoleRole' in the Shared Services account.

During testing, users receive an error message in their browser stating: 'Your request to assume a role has been denied' when redirecting from the IdP portal. The trust policy of the 'OpsConsoleRole' is currently configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::111122223333:saml-provider/CorporateIdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

Additionally, a Service Control Policy (SCP) is attached to the organizational unit (OU) containing the Shared Services account:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sts:AssumeRole",
"sts:AssumeRoleWithSAML"
],
"Resource": "*"
}
]
}

Which of the following actions should the Solutions Architect take to resolve the authentication error and successfully establish federated access? (Select TWO.)

Select all that apply

Change the Action in the trust policy of the 'OpsConsoleRole' IAM role from 'sts:AssumeRole' to 'sts:AssumeRoleWithSAML'.

Configure the SAML assertion sent by the Identity Provider to include the 'https://aws.amazon.com/SAML/Attributes/Role' attribute with the ARNs of both the IAM role and the SAML provider.

Modify the Service Control Policy (SCP) to explicitly grant permissions to the 'CorporateIdP' SAML provider, as SCPs must authorize external federated principals.

Configure the Principal in the trust policy of the IAM role to trust the AWS account root 'arn:aws:iam::111122223333:root' instead of the SAML provider.

Remove the trust policy from the 'OpsConsoleRole' IAM role entirely, relying on the SCP attached to the OU to grant the required 'sts:AssumeRoleWithSAML' permissions.

Show answer & explanation

Answer: Change the Action in the trust policy of the 'OpsConsoleRole' IAM role from 'sts:AssumeRole' to 'sts:AssumeRoleWithSAML'.; Configure the SAML assertion sent by the Identity Provider to include the 'https://aws.amazon.com/SAML/Attributes/Role' attribute with the ARNs of both the IAM role and the SAML provider.

Answer

Change the Action in the trust policy of the IAM role to 'sts:AssumeRoleWithSAML' and ensure the Identity Provider's SAML assertion contains the 'https://aws.amazon.com/SAML/Attributes/Role' attribute with both the role and provider ARNs.

For SAML 2.0 identity federation to succeed in AWS, two conditions must be met: the IAM role's trust policy must trust the SAML provider and specify the 'sts:AssumeRoleWithSAML' action, and the external Identity Provider must include mandatory SAML attributes, specifically the 'https://aws.amazon.com/SAML/Attributes/Role' attribute containing the ARNs of both the role and the SAML provider.

Step-by-Step Solution

Identify the authentication action required for federated SAML logins.

Determine that the trust policy must use the action 'sts:AssumeRoleWithSAML' instead of 'sts:AssumeRole'.

SAML assertions require the WebSSO/SAML-specific assume role action to process security assertions properly.

Verify required SAML attributes in the incoming assertion.

Identify that the IdP must send the 'https://aws.amazon.com/SAML/Attributes/Role' attribute populated with the role ARN and SAML provider ARN.

AWS relies on these attributes within the SAML payload to locate the matching IAM role and establish session variables.

Examine the role of the Service Control Policy (SCP) in IAM evaluation.

Confirm that the existing SCP allows 'sts:AssumeRoleWithSAML' but does not replace the requirement for a local trust policy.

SCPs act as authorization filters/boundaries and do not grant access or configuration parameters directly.

Key Concept

SAML 2.0 Federation Trust Policy and Assertion Attributes

Question 1815Question →

An enterprise manages its multi-account AWS environment using AWS Organizations. The enterprise federates user identities from an external SAML 2.0-compliant identity provider (IdP). To enforce fine-grained access control across accounts, the solutions architect needs to implement Attribute-Based Access Control (ABAC) using the user's Department attribute defined in the IdP. The SAML assertion is already configured to send the department name. Which configuration must the solutions architect apply to the IAM roles in the target accounts to support this identity federation and access control model?

Configure the IAM role trust policy to trust the SAML IdP, and allow both the sts:AssumeRole and sts:TagSession actions. Use the aws:RequestTag/Department condition key in the role's policies to validate the user's department.

Configure the IAM role trust policy to trust the SAML IdP, and allow both the sts:AssumeRoleWithSAML and sts:TagSession actions. Use the aws:PrincipalTag/Department condition key in the role's policies to permit access to resources with matching tags.

Configure the IAM role trust policy to trust the SAML IdP and allow the sts:AssumeRoleWithSAML action. Use the saml:Attributes/Department condition key in the role's policies to restrict resource access.

Configure a Service Control Policy (SCP) at the Organizational Unit (OU) level to propagate the SAML assertion's Department attribute as a session tag. Allow the sts:AssumeRoleWithSAML action in the target IAM role's trust policy.

Show answer & explanation

Answer: Configure the IAM role trust policy to trust the SAML IdP, and allow both the sts:AssumeRoleWithSAML and sts:TagSession actions. Use the aws:PrincipalTag/Department condition key in the role's policies to permit access to resources with matching tags.

Answer

The correct option is correct because implementing ABAC with SAML federation requires the SAML assertion to pass the attributes as session tags. For AWS to accept and apply these attributes as principal tags, the IAM role's trust policy must explicitly allow the sts:AssumeRoleWithSAML action to authorize federation and the sts:TagSession action to permit session tagging. Once trusted, these tags can be referenced globally in IAM policies using the aws:PrincipalTag/Department condition key.

Step-by-Step Solution

Ensure the external SAML identity provider (IdP) is configured to send the user's department attribute mapped to the AWS-defined SAML attribute name prefix for principal tags.

The SAML assertion will contain the Department value in the format required for AWS session tagging.

AWS requires federated attributes intended for session tags to be formatted correctly in the SAML assertion.

Modify the target IAM role's trust policy in the target AWS accounts to allow the sts:AssumeRoleWithSAML action for authentication and the sts:TagSession action for passing attributes as tags.

The IAM role is authorized to federate users and map the incoming SAML attributes as transient session tags (principal tags).

Without sts:TagSession authorized in the trust policy, any session tags passed in the SAML assertion will be rejected by AWS Security Token Service (STS).

Reference the department attribute using the aws:PrincipalTag/Department condition key in the target role's IAM policies to restrict resource access to matching tags.

The IAM policies will dynamically evaluate access based on the department tag associated with the federated session.

Using aws:PrincipalTag/Department enables Attribute-Based Access Control (ABAC) by comparing the federated session tag with resource tags.

Key Concept

To implement Attribute-Based Access Control (ABAC) using external SAML federation in a multi-account setup, the IAM role trust policy must allow both the sts:AssumeRoleWithSAML action (for authentication) and the sts:TagSession action (to accept federated attributes as principal tags). The tags can then be evaluated dynamically using the aws:PrincipalTag condition key in authorization policies.

Estimated Time:2m 0s

Question 1816Question →

A retail company uses AWS Organizations to manage its multi-account environment. The organization structure has a parent `Workloads` Organizational Unit (OU) containing a `Development` child OU and a `Production` child OU.

The security team wants to enforce the following governance controls:
1. Member accounts in the `Development` OU must be prevented from sharing AWS resources externally with accounts outside the AWS Organization using AWS Resource Access Manager (RAM).
2. Users in the `Development` OU must be blocked from deleting or modifying AWS Config rules to prevent disabling compliance checks.
3. These restrictions must be enforced even for the root user of the member accounts and must not be bypassable by administrator users in those accounts.

Which solution should a solutions architect implement to meet these requirements with the least administrative overhead?

Enable resource sharing with AWS Organizations in AWS RAM from the management account. Attach a Service Control Policy (SCP) to the `Development` OU that denies `ram:CreateResourceShare` and `ram:AssociateResourceShare` actions if the `ram:AllowsExternalPrincipals` condition key is set to true, and denies the `config:PutConfigRule`, `config:DeleteConfigRule`, and `config:StopConfigurationRecorder` actions. Configure local IAM policies in the member accounts to grant standard developer permissions.

Attach a Service Control Policy (SCP) to the `Development` OU that explicitly allows `ram:CreateResourceShare` only when sharing with the `Production` OU, and allows read-only access to AWS Config. Remove all local IAM policies from the member accounts, as the SCP will automatically delegate and restrict the permitted actions to all users.

Configure AWS Resource Access Manager (RAM) by enabling resource sharing with AWS Organizations in the management account. Rely on RAM's default behavior, which automatically blocks all external resource sharing when organizational sharing is enabled. For AWS Config, have local administrators in the member accounts attach an IAM permissions boundary to all developers to deny AWS Config rule modifications.

Configure SAML 2.0 federation for the member accounts. In the trust relationship policy of the federated IAM roles, include `ram:CreateResourceShare` and `config:PutConfigRule` under the action list alongside `sts:AssumeRoleWithSAML` to deny these permissions during federation.

Show answer & explanation

Answer: Enable resource sharing with AWS Organizations in AWS RAM from the management account. Attach a Service Control Policy (SCP) to the `Development` OU that denies `ram:CreateResourceShare` and `ram:AssociateResourceShare` actions if the `ram:AllowsExternalPrincipals` condition key is set to true, and denies the `config:PutConfigRule`, `config:DeleteConfigRule`, and `config:StopConfigurationRecorder` actions. Configure local IAM policies in the member accounts to grant standard developer permissions.

Answer

The correct solution uses a Service Control Policy (SCP) attached to the child OU. SCPs act as guardrails that define the maximum available permissions for member accounts, applying to all users including the root user. By denying resource share creation when external principals are allowed, the SCP prevents sharing outside the organization. Denying Config rule modification and stopping the configuration recorder ensures compliance remains active. Enabling Organizations sharing in RAM allows internal sharing to work as expected. Local IAM policies are still required to grant actual permissions, as SCPs do not grant any permissions directly.

Step-by-Step Solution

Enable sharing within the organization in AWS Resource Access Manager (RAM) from the management account.

Allows RAM to support sharing across accounts within the AWS Organization structure.

This is a prerequisite for controlled internal sharing before enforcing restrictions on external sharing.

Create a Service Control Policy (SCP) to restrict external resource sharing and block changes to AWS Config rules.

An SCP is created with an explicit Deny on `ram:CreateResourceShare` and `ram:AssociateResourceShare` when the `ram:AllowsExternalPrincipals` condition key is true, and on `config:PutConfigRule`, `config:DeleteConfigRule`, and `config:StopConfigurationRecorder`.

SCPs apply to all users (including root) and cannot be bypassed or modified by administrators in the member accounts.

Attach the SCP to the Development OU.

The guardrails are applied to all member accounts residing in the Development OU, leaving the Production OU unaffected.

This target application satisfies the requirement to isolate the development environment restriction without impacting production.

Ensure local IAM policies are in place to grant developer permissions.

Users can execute actions allowed by local IAM policies, provided they do not violate the SCP guardrails.

SCPs act as filters and do not grant permissions; local IAM policies are still required to allow authorized activities.

Key Concept

Implementing Multi-Account Governance with Service Control Policies (SCPs) and Resource Access Manager (RAM).

Estimated Time:2m 0s

Question 1817Question →

A logistics company runs its delivery dispatch application on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB) across three Availability Zones. The instances download a $1.5\text{ GB}$ application package and perform database schema checks during bootstrapping, which takes approximately $8\text{ minutes}$ ( $480\text{ seconds}$ ) to complete. The company experiences a predictable daily surge in API requests at 8:00 AM. During this surge, users experience connection failures, and the ALB returns HTTP 503 Service Unavailable errors. The ASG launches a large number of unnecessary instances during scale-out, resulting in high compute costs. Additionally, the outbound traffic to third-party maps APIs fails entirely if Availability Zone us-east-1a experiences an outage, as all subnets currently route outbound traffic through a single NAT Gateway in us-east-1a.

Which two actions should the Solutions Architect take to improve the application's fault tolerance and address the scaling issues? (Select TWO.)

Select all that apply

Configure the Auto Scaling group's target tracking policy with an estimated instance warmup of

540\text{ seconds}

to prevent premature subsequent scale-out activities during bootstrapping.

Deploy a NAT Gateway in each of the three Availability Zones, and update the route tables of the private subnets in each zone to route internet-bound traffic through their respective local NAT Gateway.

Decrease the Auto Scaling group's default cooldown period to

120\text{ seconds}

to force the scaling policy to evaluate metrics more frequently and terminate redundant instances faster.

Request that AWS Support permanently pre-warm the Application Load Balancer to its maximum anticipated capacity, avoiding the need to scale out the EC2 instance tier.

Create a backup NAT Gateway in Availability Zone us-east-1b, configure a Route 53 active-passive failover routing policy, and update the route tables to point outbound traffic to a Route 53 alias record.

Show answer & explanation

Answer: Configure the Auto Scaling group's target tracking policy with an estimated instance warmup of $540\text{ seconds}$ to prevent premature subsequent scale-out activities during bootstrapping.; Deploy a NAT Gateway in each of the three Availability Zones, and update the route tables of the private subnets in each zone to route internet-bound traffic through their respective local NAT Gateway.

Answer

To resolve the scaling and fault tolerance issues, the Solutions Architect should set the Auto Scaling group's estimated instance warmup to 540 seconds to cover the bootstrapping period and deploy a dedicated NAT Gateway in each Availability Zone with updated subnet routing tables.

The correct answer combines modifying the scaling metrics warmup parameter and updating the outbound routing structure. Setting the estimated instance warmup to 540 seconds prevents premature scale-out events by allowing the full 8-minute bootstrapping process to complete before checking metrics again. Deploying local NAT Gateways per Availability Zone and updating the route tables ensures outbound internet availability is isolated within each zone, achieving high availability.

Step-by-Step Solution

Analyze the bootstrapping timeline against scaling policy parameters.

The bootstrapping duration is 8 minutes (480 seconds), while the current scaling triggers do not account for this, causing premature launches.

Adjusting the estimated instance warmup to a value higher than 480 seconds (such as 540 seconds) tells the target tracking policy to wait until the new instance has warmed up before including it in metrics calculations or triggering further scaling actions.

Evaluate outbound routing architecture for external dependencies.

A single NAT Gateway in us-east-1a creates a single point of failure for all three Availability Zones.

By deploying a NAT Gateway in each of the three zones and modifying the respective private subnets' route tables to use their local NAT Gateway, Availability Zone fault isolation is achieved.

Key Concept

Configuring appropriate warmup/cooldown settings for Auto Scaling Groups to match bootstrapping durations, and implementing Multi-AZ NAT Gateway redundancy to prevent single points of failure.

Alternative Method

A complementary approach would be to build a custom AMI that pre-packages the 1.5 GB application package, thereby reducing the bootstrapping time to under 1 minute. Combining this custom AMI with an Auto Scaling warm pool allows instances to launch almost instantly, eliminating both the over-scaling and connection failures during the 8:00 AM surge.

Estimated Time:2m 30s

Question 1818Question →

Astraea Genomics is modernizing its on-premises legacy genomic sequencing application by migrating it to AWS. The application will run as containerized tasks in a Production AWS account on Amazon ECS using AWS Fargate. To meet strict HIPAA and GDPR compliance standards, all data and container images must be encrypted at rest, and all traffic must remain within the private network. The modernization must satisfy the following constraints:
1. The container images must be pulled from an Amazon Elastic Container Registry (Amazon ECR) repository located in a Shared Services AWS account.
2. All traffic between the Production VPC and Amazon ECR must be routed entirely over the private AWS network, as the Production VPC has no internet access.
3. The container images are encrypted at rest using an AWS KMS key in the Shared Services account.
4. The network architecture must be highly available across three Availability Zones without introducing single points of failure.

Which combination of actions should a solutions architect take to configure this environment? (Select TWO.)

Select all that apply

In the Production VPC, create interface VPC endpoints for the ECR API and ECR Docker registry, and a gateway VPC endpoint for Amazon S3. Configure the ECS task definition to use the awsvpc network mode.

In the Shared Services account, configure the ECR repository to use a Customer Managed Key (CMK). Update the key policy of the CMK to grant the ECS task execution IAM role in the Production account permissions for the kms:Decrypt and kms:DescribeKey actions.

In the Production VPC, deploy a single NAT Gateway in one Availability Zone to route ECR traffic, and configure the ECS task definition to use the bridge network mode.

In the Shared Services account, configure the ECR repository to use the AWS-managed KMS key (aws/ecr). Update the key policy of aws/ecr to grant the ECS task execution IAM role in the Production account permissions for the kms:Decrypt action.

Create a Route 53 Private Hosted Zone (PHZ) for the ECR DNS namespace in the Shared Services account, associate it with the Shared Services VPC, and route ECR traffic using a Direct Connect gateway without a Transit Gateway.

Show answer & explanation

Answer: In the Production VPC, create interface VPC endpoints for the ECR API and ECR Docker registry, and a gateway VPC endpoint for Amazon S3. Configure the ECS task definition to use the awsvpc network mode.; In the Shared Services account, configure the ECR repository to use a Customer Managed Key (CMK). Update the key policy of the CMK to grant the ECS task execution IAM role in the Production account permissions for the kms:Decrypt and kms:DescribeKey actions.

Answer

The correct combination of actions is: creating ECR interface endpoints and an S3 gateway endpoint in the Production VPC with the task definition configured for the awsvpc network mode; and using a Customer Managed Key (CMK) in the Shared Services account with its key policy updated to grant decryption permissions to the Production account's ECS task execution role.

To achieve a secure, private, and highly available architecture, the Production VPC must have local interface endpoints for ECR and a gateway endpoint for S3 to pull image layers. Since tasks run on AWS Fargate, the task definition must use the awsvpc network mode. In addition, ECR cross-account image pull requires decrypting image layers encrypted with a KMS Customer Managed Key (CMK). AWS-managed keys cannot be shared cross-account, so a CMK is required in the Shared Services account with a key policy that explicitly delegates access to the Production account's ECS task execution role.

Step-by-Step Solution

Determine the required VPC endpoints for private ECR communication.

Identify that ECR API and ECR Docker registry endpoints, alongside an Amazon S3 gateway endpoint (for image layers), must be created in the Production VPC.

Since the Production VPC has no internet access, interface VPC endpoints are required to privately access ECR. ECR stores image layers in Amazon S3, requiring a gateway VPC endpoint for S3.

Identify the correct network mode for AWS Fargate tasks on Amazon ECS.

Specify the awsvpc network mode in the task definition.

AWS Fargate does not support host or bridge network modes; the awsvpc network mode is mandatory.

Address ECR image decryption for cross-account setups.

Configure ECR to use a Customer Managed Key (CMK) in the Shared Services account and update the key policy to grant kms:Decrypt and kms:DescribeKey permissions to the Production account's task execution IAM role.

AWS-managed KMS keys (like aws/ecr) cannot be shared cross-account. A Customer Managed Key must be used to allow cross-account access.

Key Concept

Privately pulling ECR container images across accounts using ECS on AWS Fargate with Customer Managed Key encryption.

Question 1819Question →

An enterprise with 75 member accounts in AWS Organizations wants to centralize VPC Flow Logs from all VPCs into an Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS to comply with security requirements. The security team must prevent member account administrators from deleting or modifying the flow log configurations. Which TWO actions should the Solutions Architect perform to meet these requirements?

Select all that apply

In the Security account, configure the S3 bucket policy to allow the delivery.logs.amazonaws.com service principal s3:PutObject and s3:GetBucketAcl permissions. Update the key policy of the Customer Managed Key to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the same service principal.

Create a Service Control Policy (SCP) and attach it to the Organization root that denies ec2:DeleteFlowLogs and ec2:CreateFlowLogs actions across all member accounts, with a condition that excludes a centralized provisioning IAM role used by the platform team.

In the Security account, configure the S3 bucket policy to allow the delivery.logs.amazonaws.com service principal s3:PutObject and s3:GetBucketAcl permissions. Enable default bucket encryption using the AWS-managed key aws/s3 to simplify key sharing across the Organization.

Configure the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions for the IAM roles in member accounts, using a condition that matches aws:PrincipalOrgID to authorize all accounts in the organization.

Create a Service Control Policy (SCP) and attach it to the Organization root that grants the security account's logging role permissions to create and manage Flow Logs in member accounts, thereby bypassing local IAM policy requirements.

Show answer & explanation

Answer: In the Security account, configure the S3 bucket policy to allow the delivery.logs.amazonaws.com service principal s3:PutObject and s3:GetBucketAcl permissions. Update the key policy of the Customer Managed Key to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the same service principal.; Create a Service Control Policy (SCP) and attach it to the Organization root that denies ec2:DeleteFlowLogs and ec2:CreateFlowLogs actions across all member accounts, with a condition that excludes a centralized provisioning IAM role used by the platform team.

Answer

Configure the S3 bucket policy and KMS key policy to trust the VPC Flow Logs service principal for delivery, and apply an SCP that denies flow log modification while excluding a centralized provisioning role.

Centralizing VPC Flow Logs requires configuring the destination S3 bucket policy and Customer Managed Key (CMK) key policy in the Security account to trust the VPC Flow Logs service principal (delivery.logs.amazonaws.com). Applying an SCP at the Organization root prevents member account administrators from deleting or disabling the flow logs, while excluding a dedicated automation role ensures that centralized tooling can still configure the logs.

Step-by-Step Solution

Configure permissions for the VPC Flow Logs service in the Security account.

The S3 bucket policy allows s3:PutObject and s3:GetBucketAcl for delivery.logs.amazonaws.com, and the KMS CMK key policy allows kms:GenerateDataKey* and kms:DescribeKey for the same principal.

This enables the cross-account delivery service to write encrypted objects to the central bucket.

Implement a Service Control Policy (SCP) at the Organization root.

The SCP denies ec2:DeleteFlowLogs and ec2:CreateFlowLogs for all users/roles except the centralized provisioning IAM role.

This establishes a security guardrail preventing local administrators from disabling flow logs while preserving administrative capability for automation.

Key Concept

Centralized VPC Flow Logs delivery requires authorizing the delivery.logs.amazonaws.com service principal in both the S3 bucket policy and the Customer Managed Key (CMK) policy. Security guardrails to prevent modification should be enforced via SCPs with appropriate exceptions.

Question 1820Question →

A company is planning to migrate 50 VMware-based application virtual machines (VMs) from an on-premises data center to VMware Cloud on AWS. The application VMs are highly sensitive to IP address changes, and the company requires that all VMs retain their original IP addresses after migration. Additionally, the migration must be completed with near-zero downtime for the applications. The WAN connectivity between the on-premises environment and AWS has limited bandwidth. Which of the following VMware HCX features or migration methods should the Solutions Architect select to meet these requirements? (Select TWO.)

Select all that apply

VMware HCX Replication-Assisted vMotion (RAV) to replicate VM disks in the background and perform a live switchover.

VMware HCX Network Extension to stretch the Layer 2 network from the on-premises data center to the VMware Cloud on AWS SDDC.

VMware HCX Cold Migration to migrate active virtual machines without interrupting user traffic.

AWS Direct Connect Gateway with public virtual interfaces to establish a native Layer 2 broadcast domain across the hybrid link.

AWS Transit Gateway with Route 53 Private Hosted Zones configured to dynamically re-point DNS records to new subnet segments.

Show answer & explanation

Answer: VMware HCX Replication-Assisted vMotion (RAV) to replicate VM disks in the background and perform a live switchover.; VMware HCX Network Extension to stretch the Layer 2 network from the on-premises data center to the VMware Cloud on AWS SDDC.

Answer

Select VMware HCX Replication-Assisted vMotion (RAV) and VMware HCX Network Extension.

To preserve VM IP addresses, the Layer 2 network must be stretched to AWS using VMware HCX Network Extension. To complete the migration with near-zero downtime while using limited WAN bandwidth, VMware HCX Replication-Assisted vMotion (RAV) is selected because it replicates data asynchronously in the background and executes a hot vMotion cutover.

Step-by-Step Solution

Evaluate the downtime requirement.

Identify that to achieve near-zero downtime, a live migration mechanism is required.

Cold migration introduces downtime, while RAV supports live switchover with background replication.

Evaluate the IP retention requirement.

Determine that the Layer 2 network must be extended from the on-premises environment to AWS.

VMware HCX Network Extension stretches the Layer 2 network, allowing the VMs to retain their original IP and MAC addresses without IP re-routing.

Key Concept

VMware HCX provides Replication-Assisted vMotion (RAV) and Network Extension capabilities to migrate VMware workloads to VMware Cloud on AWS with minimal downtime and without changing VM IP addresses.

Estimated Time:2m 0s

PreviousPage 91 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution