Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1861Question →

A company is modernizing a legacy laboratory data integration system by migrating it to a serverless architecture on AWS. The system must ingest high-volume, bursty clinical test reports at a peak rate of 3,500 requests per second3,500\text{ requests per second} from partner clinics located in external AWS accounts. The API must validate custom JWT tokens against an identity database before forwarding payloads. The payloads must then be written to an Amazon Aurora PostgreSQL database in the company's private VPC. The database cluster has a maximum capacity of 150150 concurrent connections. The company's AWS account has a default regional Lambda concurrency limit of 1,0001,000 executions. The solutions architect must design a highly available, secure, and reliable architecture that prevents database connection exhaustion and avoids exhausting the regional Lambda concurrency pool. Which combination of steps should the solutions architect take to meet these requirements?

Show answer & explanation

Answer: Create a Regional Amazon API Gateway with an API Gateway resource policy restricting access to the partner accounts' source VPC endpoints. Configure a Lambda authorizer with caching enabled to validate JWT tokens. Deploy the ingestion Lambda function in private VPC subnets across three Availability Zones. Set a reserved concurrency limit of 120120 on the ingestion Lambda function, and configure it to connect to the database through an Amazon RDS Proxy endpoint.

Answer

Create a Regional Amazon API Gateway with a resource policy restricting access to partner accounts, configure a cached Lambda authorizer, deploy the ingestion Lambda function across three Availability Zones with a reserved concurrency limit of 120120, and route database connections through an Amazon RDS Proxy endpoint.
The correct solution addresses all requirements: it uses a Regional API Gateway with a resource policy to restrict access to external partner accounts, validates custom tokens via a cached Lambda authorizer, ensures high availability by deploying across three Availability Zones, limits the database connection footprint using Amazon RDS Proxy, and sets a reserved concurrency limit of 120120 to protect the company's regional concurrency limit from depletion during bursts.

Step-by-Step Solution

1
Evaluate access control and authorization requirements.
Using an API Gateway resource policy secures the endpoint against unauthorized cross-account access, while caching authorization decisions in the Lambda authorizer reduces latency and lookup overhead.
Ensures that external clinics are securely authenticated without putting unnecessary load on the identity reference database.
2
Design the network and compute layout for the ingestion Lambda function.
Deploy the Lambda function in private subnets across three Availability Zones to ensure high availability and eliminate single points of failure.
Aligns with the reliability pillar of the AWS Well-Architected Framework by avoiding non-redundant NAT Gateway topologies.
3
Address database connection limits and Lambda concurrency protection.
Deploy Amazon RDS Proxy to manage connection pooling to the Aurora PostgreSQL database, and set a reserved concurrency limit of 120120 on the Lambda function.
Setting reserved concurrency protects the AWS account's regional concurrency pool (1,0001,000 executions) from exhaustion during traffic bursts. In combination with RDS Proxy, it ensures database connections do not exceed the 150150 limit.

Key Concept

To safely modernize legacy databases using serverless components, you must control concurrency scaling at the Lambda level to protect downstream database resources and protect the regional concurrency pool, while ensuring high-availability networking and proper cross-account security controls.
Question 1862Question →

An enterprise is designing a hybrid network connectivity solution for its AWS Organization, which contains 10 spoke VPCs in a single AWS Region. The enterprise needs to establish communication between all spoke VPCs and their on-premises datacenter. They have a 10 Gbps AWS Direct Connect connection at their datacenter. The solution must support VPC-to-VPC communication, enable connectivity to the on-premises datacenter for all VPCs over the single Direct Connect connection, and minimize administrative overhead. Which of the following actions should the solutions architect perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an AWS Transit Gateway, attach all spoke VPCs to the Transit Gateway, and configure VPC route tables to route traffic destined for other VPCs and on-premises to the Transit Gateway.; Create an AWS Direct Connect Gateway, associate the Direct Connect Gateway with the Transit Gateway, and provision a Transit Virtual Interface (Transit VIF) on the Direct Connect connection.

Answer

Create an AWS Transit Gateway and attach all spoke VPCs to it; then create an AWS Direct Connect Gateway, associate it with the Transit Gateway, and provision a Transit Virtual Interface (Transit VIF) on the Direct Connect connection.
To build a scalable and low-maintenance hybrid network supporting VPC-to-VPC routing, AWS Transit Gateway is the correct hub-and-spoke solution. Attaching the VPCs to Transit Gateway allows transitive traffic flow between them. To connect this hub to an on-premises datacenter over Direct Connect, a Direct Connect Gateway must be associated with the Transit Gateway, and a Transit VIF must be configured. This combination allows all spoke VPCs to utilize the single Direct Connect connection dynamically.

Step-by-Step Solution

1
Deploy AWS Transit Gateway in the target Region.
A centralized hub is established that can scale to connect multiple VPCs and VPN/Direct Connect connections.
Transit Gateway simplifies the network topology and supports transitive routing between VPCs.
2
Attach all 10 spoke VPCs to the Transit Gateway and configure their subnet route tables.
Inter-VPC communication is enabled by pointing non-local CIDR blocks to the Transit Gateway attachment.
This allows any-to-any communication between the spoke VPCs and sets up the paths for hybrid traffic.
3
Create an AWS Direct Connect Gateway and associate it with the Transit Gateway.
The Direct Connect Gateway is linked to the Transit Gateway, preparing it to handle traffic from the on-premises datacenter.
Direct Connect Gateway serves as a global resource to bridge Direct Connect VIFs with regional resources like Transit Gateways.
4
Provision a Transit Virtual Interface (Transit VIF) on the Direct Connect connection and connect it to the Direct Connect Gateway.
A BGP session is established between the on-premises router and the Direct Connect Gateway, advertising the prefixes.
A Transit VIF is required to support Transit Gateway attachments over AWS Direct Connect.

Key Concept

Transit Gateway and Direct Connect Gateway Integration using Transit VIF for Scalable Hybrid Connectivity
Question 1863Question →

A logistics company is modernizing a legacy package tracking and address validation service. The service is being rebuilt on AWS using Amazon API Gateway and AWS Lambda functions deployed within a private VPC subnet. The Lambda functions must retrieve database credentials from AWS Secrets Manager in a different shared services account, write tracking details to an Amazon Aurora PostgreSQL database, and make HTTP requests to an external transit carrier's address validation endpoint. During a peak traffic test, the database rejected new connections, and the burst of tracking requests exhausted the AWS account's execution concurrency, causing latency and failures in other critical, unrelated serverless workloads in the same region. Which combination of actions will resolve these issues while ensuring high availability and adhering to security best practices?

Show answer & explanation

Answer: Configure Amazon RDS Proxy to manage database connection pooling. Configure a reserved concurrency limit on the Lambda function. Set up a Customer Managed Key (CMK) in AWS KMS in the shared services account to encrypt the Secrets Manager secret, and configure the key policy to allow the Lambda execution role to decrypt. Deploy a NAT Gateway in each Availability Zone where the Lambda functions are deployed.

Answer

Configure Amazon RDS Proxy, set a reserved concurrency limit on the Lambda function, use a Customer Managed Key (CMK) in KMS with a customized key policy for Secrets Manager decryption, and deploy NAT Gateways in multiple Availability Zones.
The correct option addresses all requirement vectors. First, it uses Amazon RDS Proxy to manage database connection pooling, preventing Aurora from rejecting connections due to scaling spikes. Second, it configures a reserved concurrency limit on the Lambda function, which protects the account's regional pool from exhaustion while guaranteeing execution slots for this workload. Third, it encrypts the database credentials secret with a Customer Managed Key (CMK) in KMS, permitting key policy edits for cross-account access (which default AWS-managed keys do not support). Finally, it deploys NAT Gateways in multiple Availability Zones to ensure high availability for outbound external validation requests.

Step-by-Step Solution

1
Implement Amazon RDS Proxy between the Lambda functions and the Aurora PostgreSQL database.
Database connections are pooled and reused, protecting the database from reaching its maximum connection limit during traffic spikes.
Lambda functions scale rapidly and can launch thousands of concurrent executions, quickly exhausting the database's available connection slots if not managed.
2
Configure a reserved concurrency limit on the high-volume package tracking Lambda function.
The Lambda function's maximum scale-out is capped, protecting the regional pool from exhaustion while reserving a baseline capacity for this function.
Without a reserved concurrency limit, a massive spike in requests can consume the account's entire regional concurrency pool, causing throttling for all other serverless workloads.
3
Create a Customer Managed Key (CMK) in AWS KMS within the shared services account, encrypt the secret, and modify the key policy.
The Lambda execution role in the consumer VPC account is granted decryption rights for the database credentials.
Default AWS-managed keys do not permit policy customization, preventing cross-account access delegation.
4
Deploy redundant NAT Gateways across multiple Availability Zones in the VPC.
The Lambda functions maintain highly available outbound connectivity for address validation API calls.
Deploying a single NAT Gateway creates a single point of failure that would disrupt all outbound connectivity if the hosting Availability Zone fails.

Key Concept

Modernizing legacy workloads using Amazon API Gateway and AWS Lambda, managing database connection limits with RDS Proxy, securing regional concurrency, enforcing cross-account KMS delegation using CMKs, and configuring redundant NAT Gateways.
Question 1864Question →

A global logistics tracking enterprise is designing a real-time shipment monitoring application. The application runs on Amazon ECS containers across multiple Availability Zones in a primary AWS Region (us-east-1) and replicates data to a secondary AWS Region (eu-west-1). The database tier has the following requirements:

- The relational database must support high-throughput write operations and scale read capacity dynamically to handle up to 80,000 queries per second during peak shipping hours.
- In the event of a regional disaster, the database must fail over to the secondary region with a Recovery Time Objective (RTO) of less than 2 minutes and a Recovery Point Objective (RPO) of less than 10 seconds.
- All data at rest must be encrypted using customer-managed KMS keys (CMKs) to satisfy corporate audit compliance.

Which database and storage design meets these requirements?

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1. Configure Aurora Auto Scaling to dynamically add reader instances in the primary cluster based on CPU utilization. Encrypt the database clusters in each region using local customer-managed KMS keys.

Answer

Deploying an Amazon Aurora PostgreSQL Global Database with Auto Scaling for reader instances and local customer-managed KMS keys in each region.
The correct architecture uses Amazon Aurora Global Database to achieve the sub-10 second RPO and sub-2 minute RTO through physical replication. Dynamic scaling of reader instances is handled using Aurora Auto Scaling. Custom-managed keys are utilized in each region to satisfy the strict compliance encryption policy.

Step-by-Step Solution

1
Evaluate the database replication strategy to meet RPO and RTO requirements.
Amazon Aurora Global Database replicates data with latency typically under 1 second and allows failover/promotion of the secondary cluster in less than 2 minutes.
This satisfies the RPO of less than 10 seconds and the RTO of less than 2 minutes.
2
Address the high-throughput read scaling requirements in the primary region.
Configure Aurora Auto Scaling to add reader instances (replicas) dynamically in the primary cluster based on CPU utilization.
Aurora supports up to 15 replicas and Auto Scaling allows the system to handle the peak traffic of 80,000 queries per second.
3
Apply the security encryption requirements for the multi-region configuration.
Encrypt each regional cluster with a local customer-managed KMS key.
Customer-managed keys satisfy corporate audit compliance and support the cross-region encrypted replication required by Aurora Global Database.

Key Concept

Multi-region database design utilizing Amazon Aurora Global Databases with dynamic read scaling and customer-managed KMS encryption.
Question 1865Question →

A biotech research organization uses AWS Organizations to manage 120120 member accounts. A Solutions Architect is designing a centralized logging and auditing solution. The solution must collect AWS CloudTrail logs from all current and future member accounts and store them in a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS KMS to comply with strict industry regulations. The configuration must prevent member accounts from disabling log collection or deleting the logs, while minimizing administrative overhead.

Which TWO configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the Security account, configure the S3 bucket policy to allow the `cloudtrail.amazonaws.com` service principal to perform `s3:GetBucketAcl` and `s3:PutObject` operations, restricting access to the organization using the `aws:PrincipalOrgID` condition key.; In the Security account, create a customer managed KMS key. Configure the KMS key policy to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` operations, using the `aws:PrincipalOrgID` condition key to restrict access to the organization.

Answer

Configure the S3 bucket policy in the Security account to allow the CloudTrail service principal to perform `s3:GetBucketAcl` and `s3:PutObject` operations under the condition that the organization matches the target Org ID. Additionally, create a customer managed KMS key in the Security account and configure its key policy to allow the CloudTrail service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` operations restricted by the same organization ID condition.
For centralized logging using AWS CloudTrail across multiple accounts in AWS Organizations, the destination S3 bucket policy must allow the `cloudtrail.amazonaws.com` service principal to write objects and retrieve bucket ACLs, restricted to the organization ID. When logs are encrypted with a KMS key, the key must be a Customer Managed Key (CMK) because default AWS-managed keys cannot be shared cross-account or have their policies edited. The customer managed KMS key policy must authorize the CloudTrail service principal to generate data keys and describe the key, matching the organization's ID to allow secure cross-account log delivery.

Step-by-Step Solution

1
Configure the destination S3 bucket policy in the dedicated Security account.
The bucket policy allows the `cloudtrail.amazonaws.com` service principal to execute `s3:GetBucketAcl` and `s3:PutObject` actions, restricted to the organization's ID using the `aws:PrincipalOrgID` condition key.
This setup allows CloudTrail trails in member accounts to deliver log files to the central bucket securely without exposing the bucket to external entities.
2
Set up a Customer Managed Key (CMK) in AWS KMS within the Security account.
A customer managed KMS key is created and configured with a key policy allowing the `cloudtrail.amazonaws.com` service principal to use `kms:GenerateDataKey*` and `kms:DescribeKey` under the `aws:PrincipalOrgID` condition.
AWS-managed KMS keys (like `aws/s3`) cannot be shared across accounts or have their key policies edited, which prevents CloudTrail from performing cross-account encryption.

Key Concept

Centralized cross-account logging with AWS CloudTrail, S3 bucket policies, and AWS KMS Customer Managed Keys.
Estimated Time:2m 0s
Question 1866Question →

A financial company is designing a multi-account environment on AWS and wants to federate identities from their on-premises Active Directory Federation Services (ADFS) to allow developers to access resources in a dedicated Development account. A solutions architect configures ADFS as a SAML Identity Provider (IdP) in the Development account. The architect now needs to configure an IAM role that developers can assume upon successful authentication. Which of the following trust policies should be attached to this IAM role to allow ADFS users to assume it?

Show answer & explanation

Answer: An IAM trust policy that sets the 'Federated' principal to the ARN of the SAML provider, specifies the 'sts:AssumeRoleWithSAML' action, and includes a condition verifying the 'SAML:aud' attribute matches the AWS SAML endpoint.

Answer

An IAM trust policy that sets the 'Federated' principal to the ARN of the SAML provider, specifies the 'sts:AssumeRoleWithSAML' action, and includes a condition verifying the 'SAML:aud' attribute matches the AWS SAML endpoint.
The correct answer provides the precise configurations required for SAML federation in an IAM trust policy. The trust policy must trust the SAML provider as a federated entity, invoke the 'sts:AssumeRoleWithSAML' action to assume the role using SAML assertions, and validate the target audience endpoint via 'SAML:aud' to prevent spoofing or security misconfigurations.

Step-by-Step Solution

1
Identify the type of identity federation being configured.
The identity source is ADFS using SAML 2.0 federation.
Choosing the correct Security Token Service (STS) action requires knowing whether the protocol is SAML, OIDC, or standard IAM.
2
Determine the required Principal and Action for the IAM role trust policy.
Principal must be 'Federated' pointing to the SAML provider ARN, and Action must be 'sts:AssumeRoleWithSAML'.
AWS STS requires 'sts:AssumeRoleWithSAML' to exchange SAML assertions for temporary credentials.
3
Define the validation condition for the SAML assertion.
Add a condition that checks 'SAML:aud' matches 'https://signin.aws.amazon.com/saml'.
This prevents credentials from being issued if the assertion was intended for a different audience or service.

Key Concept

SAML 2.0 IAM Role Trust Policy Setup
Question 1867Question →

A logistics company is migrating its real-time shipment-tracking application, running on 12 on-premises servers, to AWS using AWS Application Migration Service (MGN). The hybrid network architecture consists of an AWS Direct Connect connection terminated at an AWS Transit Gateway, which connects to a dedicated migration VPC. The company's security policy requires that all data replication traffic must remain private, traversing the Direct Connect connection without accessing the public internet. Additionally, after cutover, the target instances must automatically register with AWS Systems Manager (SSM) to perform post-launch configuration.

During the initial replication setup, the Solutions Architect notes that the MGN agent installation on the source servers succeeds, but the data replication status remains stalled.

Which two actions should the Solutions Architect take to resolve the replication failure and meet the post-launch management requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the on-premises firewall and the Replication Server security group in the staging area to allow traffic on TCP port 1500 between the source servers and the replication servers.; Create VPC endpoints for AWS Systems Manager (SSM) in the target VPC, and configure the MGN post-launch template to install and verify the SSM Agent.

Answer

The correct actions are to allow TCP port 1500 traffic between the source servers and the replication servers, and to create Systems Manager VPC endpoints in the target VPC while configuring the post-launch template to install the Systems Manager agent.
The correct response combines enabling replication traffic over the required TCP port 1500 with setting up the necessary Systems Manager VPC endpoints and MGN post-launch configuration. Replicating source servers requires TCP port 1500 to be open between the source environment and the staging area replication servers. For target instances to securely register with AWS Systems Manager without internet access, interface VPC endpoints must be created in the target VPC, and the post-launch template must be configured to install the agent.

Step-by-Step Solution

1
Ensure the replication data channel is open by configuring firewalls and security groups to allow TCP port 1500.
Replication agent is able to establish connection with replication servers and begin data transfer.
AWS Application Migration Service requires TCP port 1500 for data replication traffic.
2
Configure the MGN post-launch settings to install the AWS Systems Manager Agent on launched target instances.
Target instances will have the agent installed automatically upon boot.
This automates the agent bootstrap process as part of the post-launch configuration.
3
Deploy Systems Manager interface VPC endpoints in the target VPC and enable Private DNS.
Launched instances can securely register with Systems Manager without needing public internet access.
This satisfies the privacy constraint for post-launch target instance management.

Key Concept

Configuring correct network connectivity (port 1500) and post-launch settings in AWS Application Migration Service (MGN) for secure, private migrations.
Question 1868Question →

An organization is deploying a new version of a microservice hosted on Amazon ECS Fargate using AWS CloudFormation. The deployment strategy must shift 10% of the traffic to the new version initially, and monitor the application for 15 minutes. If any CloudWatch alarms are triggered during this period, the deployment must automatically roll back. Otherwise, the remaining 90% of the traffic must be shifted to the new version. Which of the following configurations should the Solutions Architect implement in the CloudFormation template to meet these requirements?

Show answer & explanation

Answer: Configure the ECS service deployment controller to CODE_DEPLOY, and configure the AWS::CodeDeploy::BlueGreen hook in the CloudFormation template with the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration and target CloudWatch alarms.

Answer

Configure the ECS service deployment controller to CODE_DEPLOY, and configure the AWS::CodeDeploy::BlueGreen hook in the CloudFormation template with the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration and target CloudWatch alarms.
The correct configuration uses the CODE_DEPLOY deployment controller for the ECS service along with the AWS::CodeDeploy::BlueGreen hook in CloudFormation. By selecting the CodeDeployDefault.ECSCanary10Percent15Minutes configuration, CodeDeploy shifts 10% of the traffic to the new task set, waits for 15 minutes while monitoring the specified CloudWatch alarms, and automatically rolls back if any alarm is triggered. If no alarms trigger, it routes the remaining 90% of traffic to complete the deployment.

Step-by-Step Solution

1
Set the deployment controller for the ECS service to CODE_DEPLOY in the CloudFormation template.
This delegates traffic shifting and deployment lifecycle management to AWS CodeDeploy.
Required for performing blue/green and canary deployments on ECS Fargate via CloudFormation.
2
Configure the AWS::CodeDeploy::BlueGreen hook under the Transform section of the CloudFormation template.
This tells CloudFormation to generate a CodeDeploy deployment during the stack update.
Allows CloudFormation to coordinate with CodeDeploy for the deployment process.
3
Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the hook properties, and associate the target CloudWatch alarms.
CodeDeploy will route 10% of traffic to the green task set, monitor the specified CloudWatch alarms for 15 minutes, and if no alarms fire, shift the remaining 90% of traffic to the green task set.
Meets the requirement of a 10% initial canary shift with a 15-minute bake period and automatic rollback on alarm triggers.

Key Concept

AWS CloudFormation integrates with AWS CodeDeploy using the AWS::CodeDeploy::BlueGreen hook to manage canary and linear traffic-shifting deployments for ECS Fargate services, enabling automatic rollback based on CloudWatch alarms.
Question 1869Question →

A medical diagnostics company is designing a new cloud-native patient monitoring and analytics platform. The platform must ingest high-velocity streaming telemetry data from wearable medical devices, which represents a write-heavy NoSQL workload. It must also store structured patient metadata requiring transactional consistency in an OLTP database. The platform must meet a recovery time objective (RTO) of less than 1 minute and a recovery point objective (RPO) of near-zero for disaster recovery. Additionally, all database storage must be encrypted using keys that can be audited by a centralized security account in another AWS organization.

Which of the following database and storage configurations should the solutions architect select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement Amazon DynamoDB to ingest the streaming device telemetry, utilizing customer managed keys (CMKs) in AWS Key Management Service (AWS KMS) for encryption.; Deploy Amazon Aurora PostgreSQL with Aurora Global Database across two AWS regions to store the patient metadata, utilizing regional Customer Managed Keys (CMKs) for encryption.

Answer

The correct configurations are to implement Amazon DynamoDB with AWS KMS Customer Managed Keys for the streaming NoSQL telemetry workload, and deploy Amazon Aurora PostgreSQL with Aurora Global Database and Customer Managed Keys for the patient metadata workload.
The correct options select Amazon DynamoDB with customer managed keys (CMKs) and Amazon Aurora PostgreSQL with Aurora Global Database. DynamoDB effectively addresses the high-velocity write-heavy NoSQL telemetry workload. Using CMKs for encryption allows the organization to modify the key policy to grant the central security account cross-account decryption/management permissions for auditing purposes. For the metadata workload, Aurora Global Database replicates data to a secondary region with typical latency under 1 second, satisfying the RPO requirement, and can be promoted to a primary database in less than a minute, satisfying the RTO requirement.

Step-by-Step Solution

1
Analyze the streaming NoSQL workload requirements.
Amazon DynamoDB is selected due to its ability to handle high-velocity write-heavy workloads, and encrypting it using Customer Managed Keys (CMKs) allows for the cross-account auditing policy modification.
DynamoDB is a fully managed NoSQL database that scales seamlessly, and CMKs are required to enable auditing access from a separate security account.
2
Analyze the transactional OLTP metadata workload and disaster recovery (RTO/RPO) requirements.
Amazon Aurora PostgreSQL with Aurora Global Database is selected because it replicates data cross-region with a latency of less than 1 second, supporting an RTO of under 1 minute.
Standard RDS Multi-AZ or pilot light snapshot strategies cannot achieve near-zero RPO and sub-minute RTO across regions during a disaster scenario.
3
Evaluate the encryption and auditing requirements.
Customer Managed Keys (CMKs) must be used for both databases because AWS-managed keys cannot be shared with the central security account.
AWS KMS key policies for AWS-managed keys cannot be edited to delegate access to other AWS accounts.

Key Concept

Selecting appropriate database engines and encryption configurations to meet performance, disaster recovery, and multi-account security requirements.
Question 1870Question →

A company is designing a deployment process for a critical production web application that runs on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer. The deployment must satisfy the following constraints:

* Zero downtime during updates.
* A canary phase where 10%10\% of live traffic is routed to the new version for 1515 minutes to monitor performance.
* Automated rollback within 33 minutes if the Application Load Balancer's 5XX5\text{XX} error rate or instance CPU utilization exceeds defined thresholds.
* Cost constraints prevent launching a complete duplicate fleet of instances during the traffic-shifting phase.

Which deployment strategy should the solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Create a new (green) Auto Scaling group targeting a new Application Load Balancer target group, and provision it with 10% of the capacity of the existing (blue) Auto Scaling group. Use AWS CodePipeline to invoke an AWS Lambda function that sets the Application Load Balancer routing weights to 10% for the green target group and 90% for the blue target group. Monitor the green target group via CloudWatch alarms for 15 minutes. If an alarm triggers, set the green target group weight to 0% immediately. Otherwise, scale up the green group, shift the routing weight to 100%, and scale down the blue group to zero.

Answer

Create a new (green) Auto Scaling group targeting a new Application Load Balancer target group, provision it with 10%10\% capacity, and use AWS CodePipeline with AWS Lambda to adjust Application Load Balancer routing weights to 10%10\% and 90%90\% respectively. Monitor using CloudWatch alarms, and immediately revert the weight to 0%0\% on alarm triggers.
Using two separate Auto Scaling groups (blue and green) with Application Load Balancer (ALB) weighted target groups allows for a true canary deployment of EC2 instances with fractional traffic routing (e.g., 10%10\%). It satisfies the cost constraint because the green Auto Scaling group is initially provisioned with only 10%10\% of the capacity rather than a duplicate fleet. If an alarm is triggered during the 1515-minute monitoring window, rollback is rapid (less than 11 minute) by changing the ALB routing weight for the green target group to 0%0\%. Since CodeDeploy does not support canary or linear traffic shifting for EC2/on-premises deployments (these configurations are only supported for AWS Lambda and Amazon ECS), a custom orchestration approach using ALB weighted target groups and AWS Lambda is the correct and most optimal solution.

Step-by-Step Solution

1
Create a separate green Auto Scaling group and target group representing 10%10\% of the blue Auto Scaling group's capacity.
A green target group containing new instance versions is created with minimal additional cost, satisfying the constraint of not doubling the fleet size.
Bypasses the default CodeDeploy EC2 blue/green requirement of launching a duplicate fleet of equivalent size.
2
Use AWS CodePipeline to invoke an AWS Lambda function to update the Application Load Balancer routing weights to 10%10\% for the green target group and 90%90\% for the blue target group.
Traffic is split at the load balancer level, sending exactly 10%10\% of live traffic to the new version.
Enables canary testing for EC2 instances, which is not natively supported with canary routing configurations in AWS CodeDeploy.
3
Monitor the green target group metrics using CloudWatch alarms for 1515 minutes. If alarms trigger, invoke the Lambda function to set the green target group routing weight back to 0%0\%.
Immediate redirection of all traffic back to the healthy blue environment within seconds.
Achieves the rollback target of less than 33 minutes without waiting for instance replacement or redeployment.
4
If the evaluation period passes successfully, scale up the green Auto Scaling group to full production capacity, shift the routing weight to 100%100\% green, and scale down the blue group to zero.
Promotion of the new version to full production and termination of old instances.
Completes the deployment lifecycle while maintaining zero downtime.

Key Concept

Canary Deployments on EC2 using Application Load Balancer Weighted Target Groups
Question 1871Question →

A retail enterprise, NovaCart Solutions, is modernizing its legacy order processing application by migrating it to AWS. The application will be deployed on Amazon ECS using the AWS Fargate launch type. The tasks must run in private subnets with no public IP addresses assigned. The application needs to pull container images from a central Amazon ECR repository located in a Shared Services AWS account. This ECR repository is encrypted at rest. Additionally, the application must connect to external payment gateway APIs over the public internet to authorize transactions. The architecture must be highly available and follow AWS security best practices. Which TWO actions should the solutions architect take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy the ECS tasks in private subnets using the awsvpc network mode, and route outbound internet traffic through redundant NAT Gateways deployed in public subnets across multiple Availability Zones.; Configure the central ECR repository to use a customer managed KMS key, and grant decrypt permissions to the ECS task execution role in the application account via the KMS key policy.

Answer

The correct strategy is to deploy the Fargate tasks using the awsvpc network mode with outbound internet traffic routed through redundant NAT Gateways across multiple Availability Zones, and to encrypt the central ECR repository using a customer managed KMS key that grants cross-account decrypt permissions via its key policy.
Deploying the ECS tasks in private subnets using the awsvpc network mode with traffic routed through redundant NAT Gateways satisfies the networking constraints of Fargate while preserving high availability. Utilizing a customer managed KMS key with a cross-account key policy allows the application account's task execution role to decrypt and pull the container images securely from the central Shared Services account.

Step-by-Step Solution

1
Address Fargate network constraints and internet access.
Identify that AWS Fargate only supports the awsvpc network mode. To enable highly available outbound internet access for payment gateway communication without public IPs on the tasks, configure routes through redundant NAT Gateways deployed in multiple public subnets across different Availability Zones.
Ensures adherence to Fargate networking constraints while maintaining high availability for outbound traffic.
2
Configure ECR repository encryption for cross-account access.
Encrypt the ECR repository using a customer managed KMS key instead of the default AWS-managed key. Update the customer managed key policy in the Shared Services account to permit the ECS task execution role in the application account to perform kms:Decrypt actions.
AWS-managed KMS keys cannot have their key policies modified and do not support cross-account usage, necessitating a customer managed key.

Key Concept

Amazon ECS Fargate network architecture limits task execution to the awsvpc network mode. In cross-account scenarios where container images are encrypted in central repositories, default AWS-managed KMS keys cannot be shared, requiring customer managed keys with explicit cross-account permissions.
Question 1872Question →

A financial technology company is designing a new transaction processing platform. The application requires a relational OLTP database with automatic scaling of read capacity to handle traffic spikes. The platform must also store monthly transaction reports in an Amazon S3 bucket, which must be shared with a separate auditing AWS account. The reports must be encrypted at rest, and the auditing account must have direct access to decrypt them. The disaster recovery requirements specify a recovery time objective (RTO) of less than 1 minute and a recovery point objective (RPO) of less than 1 second across two AWS regions. Which combination of AWS database and storage strategies meets these requirements?

Show answer & explanation

Answer: Deploy Amazon Aurora Global Database with Aurora Auto Scaling for the read replicas to handle read spikes. Store transaction reports in Amazon S3, encrypted with a Customer Managed KMS key, and configure the key policy to allow cross-account access for the auditing account.

Answer

Deploy Amazon Aurora Global Database with Aurora Auto Scaling for the read replicas to handle read spikes. Store transaction reports in Amazon S3, encrypted with a Customer Managed KMS key, and configure the key policy to allow cross-account access for the auditing account.
The correct strategy uses Amazon Aurora Global Database to achieve the required sub-second recovery point objective (RPO) and low recovery time objective (RTO). It also utilizes Aurora Auto Scaling to dynamically provision read replicas to handle traffic spikes. For storage, it uses a Customer Managed Key (CMK) on the S3 bucket to allow direct cross-account access and decryption for the auditing account.

Step-by-Step Solution

1
Evaluate the database replication strategy for multi-region disaster recovery.
Amazon Aurora Global Database is selected because it provides sub-second data replication (meeting the RPO of less than 1 second) and automatic failover across regions (meeting the RTO of less than 1 minute).
Traditional snapshot copy strategies fail to meet the sub-second recovery point objective.
2
Evaluate the database scaling strategy for read spikes.
Aurora Auto Scaling is configured to adjust the number of Aurora Replicas based on CPU utilization or connection count.
RDS standby instances in a standard Multi-AZ deployment are passive and cannot be used to scale read traffic.
3
Evaluate the cross-account S3 object decryption strategy.
Encrypted reports in S3 must use a Customer Managed Key (CMK) in AWS KMS with a custom key policy granting decrypt permissions to the auditing AWS account.
AWS-managed KMS keys do not support policy modification and cannot be shared across multiple AWS accounts.

Key Concept

Multi-region disaster recovery, database read-scaling, and cross-account access to encrypted storage.
Estimated Time:2m 0s
Question 1873Question →

An enterprise is planning to migrate two datasets from its on-premises data center to AWS within a 3030-day migration window. The enterprise has a dedicated 1 Gbps1\text{ Gbps} AWS Direct Connect connection. The datasets consist of:

* A 1.5 PB1.5\text{ PB} static archive of seismic research data stored on an NFS v4 file system. This dataset must be migrated to Amazon S3 Standard and encrypted at rest using a Key Management Service (KMS) key.
* An active 75 TB75\text{ TB} engineering dataset stored on an SMB file share. This dataset must be migrated to Amazon FSx for Windows File Server and must remain continuously synchronized with on-premises changes until the final cutover on day 3030.

Which two actions should the solutions architect recommend to complete this migration within the timeline?

Select all that apply

Show answer & explanation

Answer: Deploy the AWS DataSync agent on-premises. Configure a DataSync task with the SMB share as the source and the Amazon FSx for Windows File Server file system as the destination, scheduling the task to run incrementally.; Order AWS Snowball Edge Storage Optimized devices for the NFS dataset. Use a customer managed KMS key to encrypt the data, ensuring the key policy grants the necessary permissions to the Snowball service principal.

Answer

Deploy the AWS DataSync agent to synchronize the SMB share with Amazon FSx for Windows File Server, and order AWS Snowball Edge Storage Optimized devices using a customer managed KMS key for the NFS dataset migration.
The correct strategy combines online and offline tools based on bandwidth limits. Transferring 1.5 PB1.5\text{ PB} over 1 Gbps1\text{ Gbps} takes over 138138 days, so AWS Snowball Edge Storage Optimized devices must be used. Snowball Edge requires a customer managed key (CMK) for KMS encryption because AWS-managed keys do not allow the key policy modifications needed for the Snowball service principal. Meanwhile, the 75 TB75\text{ TB} active SMB dataset can be transferred over the network within 77 days. Using AWS DataSync with an on-premises agent allows continuous, incremental synchronization directly to Amazon FSx for Windows File Server.

Step-by-Step Solution

1
Calculate network migration timeline for the 1.5 PB1.5\text{ PB} NFS archive.
At 1 Gbps1\text{ Gbps} bandwidth, transferring 1.5 PB1.5\text{ PB} (1500 TB1500\text{ TB}) takes approximately 1500×1012 bytes125×106 bytes/sec≈12,000,000 seconds≈138.8\frac{1500 \times 10^{12} \text{ bytes}}{125 \times 10^6 \text{ bytes/sec}} \approx 12,000,000 \text{ seconds} \approx 138.8 days.
This exceeds the 3030-day migration limit, indicating that offline transfer via AWS Snowball Edge is required.
2
Calculate network migration timeline and strategy for the active 75 TB75\text{ TB} SMB share.
At 1 Gbps1\text{ Gbps} bandwidth, transferring 75 TB75\text{ TB} takes approximately 77 days of network transfer, which easily fits within the 3030-day window.
Since the dataset is active and needs continuous synchronization, AWS DataSync is selected as it supports SMB source locations, FSx for Windows File Server destinations, and incremental scans.
3
Address the KMS encryption requirement for the Snowball Edge import job.
Identify that AWS-managed KMS keys (e.g., `aws/s3`) cannot be configured with Snowball Edge import jobs because their key policies cannot be modified.
A customer managed KMS key must be created, and its policy must explicitly grant the Snowball service principal permissions to perform key operations.

Key Concept

Selecting data transfer services based on bandwidth constraints, storage protocol compatibility, and KMS encryption limitations.
Estimated Time:3m 0s
Question 1874Question →

An enterprise wants to migrate a 1.2 PB1.2\text{ PB} dataset from an on-premises NetApp ONTAP NFSv4 file system to Amazon FSx for NetApp ONTAP located in a target VPC. The enterprise also has multiple spoke VPCs that require access to this file system during the migration. The target VPC is connected to the on-premises network via a Transit Gateway and an AWS Direct Connect connection with a 1 Gbps1\text{ Gbps} transit capacity. The migration must be completed within 30 days30\text{ days}. The company's security policy requires that all data must be encrypted in transit and at rest using an AWS KMS Customer Managed Key (CMK) owned by the target AWS account, and no traffic can traverse the public internet. Which of the following is the most efficient and compliant architecture to migrate this data within the required timeframe?

Show answer & explanation

Answer: Order multiple AWS Snowball Edge Storage Optimized devices from the target AWS account, specifying the target account's Customer Managed Key (CMK) for encryption. Copy the data from the on-premises NFS file system to the Snowball Edge devices using the built-in NFS interface. Ship the devices back to AWS to import the data into an Amazon S3 bucket encrypted with the CMK. Use AWS DataSync to copy the data from the S3 bucket to the Amazon FSx for NetApp ONTAP file system within the AWS region.

Answer

Ordering multiple AWS Snowball Edge Storage Optimized devices from the target AWS account to copy the NFS data, shipping them back to AWS to import the data into Amazon S3, and then using AWS DataSync within the AWS region to transfer the data from S3 to Amazon FSx for NetApp ONTAP is the most efficient and compliant architecture.
The correct answer identifies that a 1.2 PB1.2\text{ PB} dataset cannot be transferred over a 1 Gbps1\text{ Gbps} connection within 30 days30\text{ days} (which would take over 111 days111\text{ days} even under ideal conditions), necessitating an offline migration using AWS Snowball Edge Storage Optimized devices. Ordering the devices from the target AWS account using the target account's Customer Managed Key (CMK) satisfies the KMS compliance requirements. Using the built-in NFS interface on the Snowball Edge allows direct copying of the NFSv4 filesystem. Once imported into Amazon S3, using AWS DataSync within the AWS region avoids using the on-premises Direct Connect link and allows fast ingestion into FSx for NetApp ONTAP.

Step-by-Step Solution

1
Calculate the network transfer time for 1.2 PB1.2\text{ PB} of data over a 1 Gbps1\text{ Gbps} link.
The theoretical transfer time is ≈111.1 days\approx 111.1\text{ days} (assuming 100%100\% network efficiency), which exceeds the 30 days30\text{ days} project constraint, indicating that an offline physical migration via AWS Snowball Edge is required.
To determine whether an online network migration or an offline physical transfer is necessary to meet the scheduling requirements.
2
Select the appropriate account context and key type for the AWS Snowball Edge devices.
Ordering the devices from the target AWS account using the target account's Customer Managed Key (CMK) ensures compliance with the encryption requirements and avoids the cross-account limitations of AWS-managed keys.
AWS-managed keys (such as aws/s3) cannot be shared across different accounts, making it critical to use a Customer Managed Key (CMK) when cross-account sharing or replication is involved.
3
Determine the data ingestion path from the imported S3 bucket to Amazon FSx for NetApp ONTAP.
AWS DataSync is selected to transfer the data from the Amazon S3 bucket to the Amazon FSx for NetApp ONTAP file system within the AWS region, which completes rapidly and does not affect on-premises bandwidth.
Unlike FSx for Lustre, FSx for NetApp ONTAP does not natively mount S3 buckets as backing stores, requiring an active synchronization mechanism like AWS DataSync to copy data.

Key Concept

Selecting between online and offline data migration methods based on dataset size and network bandwidth limitations, combined with KMS key sharing policies and destination storage integration capabilities.
Question 1875Question →

A financial services company is designing a centralized auditing and logging architecture for its AWS Organizations structure, which consists of 140140 member accounts. The security team requires all AWS CloudTrail logs from all accounts and regions to be consolidated into a single Amazon S3 bucket located in a dedicated Log Archive account.

The solution must meet the following requirements:
- All logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) to comply with external regulations.
- Local administrators in the member accounts must be prevented from disabling logging, modifying trails, or deleting log archives.
- The principle of least privilege must be applied to S3 bucket and KMS key access.
- Administrative operations for CloudTrail must be delegated to a dedicated Security tooling account, avoiding the use of the Organizations management account for daily administration.

Which combination of configurations should a solutions architect implement to meet these requirements?

Show answer & explanation

Answer: Register the Security tooling account as a delegated administrator for CloudTrail. In the Log Archive account, create an S3 bucket and a KMS customer managed key. Configure the S3 bucket policy to allow the s3:PutObject action for the CloudTrail service principal, restricted by the aws:PrincipalOrgID condition. Configure the KMS key policy to allow the kms:GenerateDataKey* and kms:DescribeKey actions for the CloudTrail service principal, restricted by the aws:PrincipalOrgID condition. In the Security tooling account, create an organization trail pointing to the central S3 bucket and KMS key. Apply a Service Control Policy (SCP) at the organization root that denies CloudTrail write and delete actions unless the caller is the delegated administrator.

Answer

Register the Security tooling account as a delegated administrator for CloudTrail. Create the S3 bucket and a KMS Customer Managed Key (CMK) in the Log Archive account. Configure both resource policies to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs and generate data keys, restricted by the aws:PrincipalOrgID condition. Create the organization trail from the Security tooling account, and apply a Service Control Policy (SCP) at the organization root to deny trail modification or deletion in the member accounts.
The correct solution correctly utilizes CloudTrail delegated administration to keep management account access restricted. It handles the cross-account encryption and delivery requirements by creating a Customer Managed Key and S3 bucket in the central Log Archive account, then configuring their respective resource policies to trust the CloudTrail service principal restricted by the aws:PrincipalOrgID condition. Finally, it uses an SCP to act as a guardrail preventing member accounts from altering the trail configuration.

Step-by-Step Solution

1
Enable delegated administration for CloudTrail in the Organizations management account, designating the Security tooling account.
The Security tooling account gains the ability to create and manage organization-wide trails on behalf of the entire AWS Organization.
This complies with the requirement to delegate administrative operations away from the management account.
2
Create the S3 bucket and a KMS Customer Managed Key (CMK) in the Log Archive account, and configure their resource-based policies.
The S3 bucket policy and KMS key policy allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject, s3:GetBucketAcl, kms:GenerateDataKey*, and kms:DescribeKey actions under the condition that the source organization matches aws:PrincipalOrgID.
This establishes cross-account delivery permissions at scale without hitting policy size limits or manually maintaining account lists.
3
Create the organization trail from the delegated administrator (Security tooling) account and configure it to deliver to the Log Archive S3 bucket encrypted with the CMK.
CloudTrail automatically sets up logging for all member accounts and regions, delivering encrypted logs centrally.
This ensures comprehensive auditing across the organization.
4
Apply a Service Control Policy (SCP) at the root of the organization that denies CloudTrail modifications (e.g., StopLogging, UpdateTrail, DeleteTrail) unless the caller is the delegated administrator or the management account.
Local administrators in member accounts are prevented from stopping or modifying the organization trail, ensuring audit trail integrity.
This enforces the security mandate preventing log tampering.

Key Concept

Designing a secure, scaled centralized logging solution in a multi-account organization requires delegating administration, using KMS Customer Managed Keys for cross-account service encryption, writing scalable resource policies using organizational condition keys, and enforcing immutability through Service Control Policies.
Question 1876Question →

An enterprise is planning to migrate its on-premises VMware vSphere 6.7 environment to VMware Cloud on AWS. The migration includes a set of active database virtual machines (VMs) that require zero-downtime live migration, and a group of non-critical web servers that should be migrated in bulk and cut over during a scheduled weekend maintenance window. Hybrid connectivity is established via a 1 Gbps AWS Direct Connect connection. Which two VMware HCX migration methods should the solutions architect select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Use VMware HCX Replication Assisted vMotion (RAV) to migrate the database virtual machines.; Use VMware HCX Bulk Migration to migrate the web server virtual machines.

Answer

Use VMware HCX Replication Assisted vMotion (RAV) for the critical database virtual machines to achieve zero downtime, and use VMware HCX Bulk Migration for the web server virtual machines to enable parallel replication with a scheduled weekend switchover.
VMware HCX Replication Assisted vMotion (RAV) combines the bulk replication capability of Bulk Migration with the zero-downtime switchover of vMotion, which satisfies the zero-downtime requirement for active databases. VMware HCX Bulk Migration uses host-based replication to move multiple virtual machines in parallel and allows the solutions architect to schedule the cutover window for the weekend, matching the web server requirement.

Step-by-Step Solution

1
Evaluate the downtime tolerance for each workload class.
Database virtual machines require zero-downtime migration, while web servers can tolerate a scheduled weekend cutover.
This establishes the constraints for choosing the migration mechanism.
2
Match the database requirement to the appropriate HCX migration type.
Select Replication Assisted vMotion (RAV) which combines bulk data replication with zero-downtime vMotion switchover.
Pure vMotion is limited in throughput and parallel execution, whereas RAV replicates in bulk and performs hot migration switchovers.
3
Match the web server requirement to the appropriate HCX migration type.
Select Bulk Migration to perform parallel replications and schedule the final cutover to occur during the weekend.
Bulk Migration supports staging the virtual machines in parallel and executing the switchover at a pre-planned maintenance window.

Key Concept

Selecting the appropriate VMware HCX migration method based on workload downtime constraints and bulk scheduling requirements.
Question 1877Question →

An energy utility company is migrating its legacy grid monitoring application, consisting of 5 on-premises servers, to AWS using AWS Application Migration Service (MGN). The on-premises network is connected to AWS using an AWS Direct Connect connection terminated at a Direct Connect Gateway, which is associated with an AWS Transit Gateway. The Transit Gateway routes traffic to a dedicated Migration Staging VPC where the replication servers are located. After installing the AWS Replication Agent on the source servers, the replication status on the AWS MGN console is displayed as 'Stalled'. Which of the following actions should the Solutions Architect take to resolve the replication issue?

Show answer & explanation

Answer: Ensure that the on-premises firewall and the Migration Staging VPC security groups permit outbound and inbound traffic on TCP port 1500, respectively, to allow replication data transfer from the AWS Replication Agent to the replication servers.

Answer

Ensure that the on-premises firewall and the Migration Staging VPC security groups permit outbound and inbound traffic on TCP port 1500, respectively, to allow replication data transfer from the AWS Replication Agent to the replication servers.
The correct answer is to ensure that the on-premises firewall and the Migration Staging VPC security groups permit traffic on TCP port 1500. This is because AWS Application Migration Service replication servers listen on TCP port 1500 to receive replicated data blocks from the AWS Replication Agent installed on the source servers. Without this port open, replication cannot succeed and will be marked as stalled.

Step-by-Step Solution

1
Identify the networking requirements for AWS Application Migration Service (MGN) data replication.
Data replication from the source servers to the replication servers in the Migration Staging VPC requires TCP port 1500.
AWS Application Migration Service uses TCP port 1500 for the secure transfer of replicated data blocks.
2
Analyze the firewall and security group rules along the traffic path.
Traffic must pass through the on-premises firewall (outbound) and the staging VPC security groups (inbound).
Stalled replication indicates that the replication data stream is blocked along the path.
3
Formulate the correct firewall and security group adjustments.
Enable TCP port 1500 outbound on-premises and inbound on the Migration Staging VPC security groups.
Opening TCP port 1500 ensures that replication data blocks can be successfully transmitted to the replication servers.

Key Concept

AWS Application Migration Service (MGN) network replication port requirements
Question 1878Question →

An enterprise is planning to migrate its workloads from an on-premises VMware vSphere data center to a newly deployed VMware Cloud on AWS Software-Defined Data Center (SDDC). The current hybrid network is configured as follows:

* On-premises resources connect to a centralized AWS Transit Gateway (TGW) in a central network account using a 10 Gbps10\text{ Gbps} AWS Direct Connect connection via a Direct Connect Gateway (DXGW).
* Multiple AWS VPCs are attached to the central TGW.
* A Route 53 Private Hosted Zone (PHZ) `internal.enterprise.com` is hosted in a Shared Services AWS account and associated with all AWS VPCs.

The migration must satisfy the following technical requirements:

1. A transactional Web Tier application must be migrated with zero downtime during the cutover.
2. A 12 TB12\text{ TB} database VM must be migrated with a maximum allowable downtime of 15 minutes15\text{ minutes} during a scheduled weekend maintenance window.
3. Migrated VMs in the SDDC must be able to resolve DNS queries for `internal.enterprise.com` and establish network connectivity with the on-premises data center over the Direct Connect connection.

Which architecture should the Solutions Architect implement to meet these requirements with the lowest operational complexity?

Show answer & explanation

Answer: Migrate the Web Tier application using VMware HCX Replication Assisted vMotion (RAV) and the database VM using VMware HCX Bulk Migration. Associate the Direct Connect Gateway directly with the VMware Transit Connect (VTGW) peer. Associate the Route 53 PHZ `internal.enterprise.com` with the SDDC's connected VPC, and configure the SDDC DNS servers to forward queries to the Route 53 Resolver IP address of the connected VPC.

Answer

Migrate the Web Tier application using VMware HCX Replication Assisted vMotion (RAV) and the database VM using VMware HCX Bulk Migration. Associate the Direct Connect Gateway directly with the VMware Transit Connect (VTGW) peer. Associate the Route 53 PHZ `internal.enterprise.com` with the SDDC's connected VPC, and configure the SDDC DNS servers to forward queries to the Route 53 Resolver IP address of the connected VPC.
The correct solution accurately maps the migration methods to the constraints: VMware HCX Replication Assisted vMotion (RAV) enables zero-downtime cutover for the active transactional Web Tier, while HCX Bulk Migration replicates the massive database VM offline and performs a quick switchover within the 1515-minute RTO. For network connectivity, associating the DXGW directly with the VTGW resolves the non-transitive routing issue across peered Transit Gateways. Lastly, associating the Private Hosted Zone with the VMC connected VPC and forwarding SDDC DNS traffic to the VPC DNS resolver (.2 IP) ensures seamless cross-environment name resolution.

Step-by-Step Solution

1
Select the appropriate migration method based on application downtime requirements.
The Web Tier application is matched with HCX Replication Assisted vMotion (RAV) to guarantee zero downtime. The database VM is matched with HCX Bulk Migration to handle the 12 TB12\text{ TB} data footprint within a scheduled 1515-minute downtime window.
RAV provides zero-downtime live migrations by combining bulk replication with live vMotion switchover. Bulk Migration replicates data in the background and reboots the VM on destination, which is ideal for large, non-live migrations that can tolerate a brief reboot.
2
Determine the Direct Connect hybrid connectivity strategy that overcomes transitive routing limits.
Associate the Direct Connect Gateway (DXGW) directly with the VMware Transit Connect (VTGW).
AWS Transit Gateway peering does not allow transitive routing to a Direct Connect Gateway. To route traffic between the SDDC and on-premises over Direct Connect, the DXGW must be associated directly with the VTGW.
3
Establish Route 53 Private Hosted Zone (PHZ) resolution for VMC on AWS workloads.
Associate the PHZ with the VMC connected VPC and configure the SDDC DNS servers to forward queries to the Route 53 Resolver IP address.
Route 53 PHZs require explicit association with target VPCs to allow resolution. Forwarding queries to the connected VPC's Route 53 Resolver IP address (.2 address of the subnet) enables SDDC VMs on NSX-T segments to resolve the zone.

Key Concept

Bypassing non-transitive TGW peering constraints by associating the DXGW directly with the VTGW, combined with proper VMC DNS resolution and HCX migration mode selection.
Question 1879Question →

An enterprise manages a multi-account AWS environment using AWS Organizations. The security team is setting up federated access from their on-premises SAML 2.0 Identity Provider (IdP) to a shared target account containing development resources. They want users in the IdP's 'AdminGroup' to assume an IAM role named FederatedDeveloperRole in the target account. Additionally, they must implement Attribute-Based Access Control (ABAC) using session tags (PrincipalTag:CostCenter and PrincipalTag:Team) passed during federation. The solutions architect must configure the trust relationship and assertion attributes to allow this federation while enforcing that these tags are present.

Which two actions should the solutions architect perform to successfully implement this configuration? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the trust policy of the FederatedDeveloperRole in the target account to allow the SAML provider principal to perform the actions sts:AssumeRoleWithSAML and sts:TagSession.; Configure the SAML assertion in the on-premises Identity Provider (IdP) to include user attributes mapped to the claims https://aws.amazon.com/SAML/Attributes/PrincipalTag:CostCenter and https://aws.amazon.com/SAML/Attributes/PrincipalTag:Team.

Answer

Configure the trust policy of the FederatedDeveloperRole in the target account to allow the SAML provider principal to perform the actions sts:AssumeRoleWithSAML and sts:TagSession, and configure the SAML assertion in the on-premises Identity Provider (IdP) to include user attributes mapped to the claims https://aws.amazon.com/SAML/Attributes/PrincipalTag:CostCenter and https://aws.amazon.com/SAML/Attributes/PrincipalTag:Team.
To implement SAML 2.0 federation with session tags for ABAC, two main components must be configured. First, the IAM role trust policy in the target AWS account must allow the federated principal to perform the sts:AssumeRoleWithSAML action (to permit SAML federation) and the sts:TagSession action (to authorize passing session tags). Second, the SAML identity provider must include attributes in the SAML assertion mapped to the specific namespace https://aws.amazon.com/SAML/Attributes/PrincipalTag: followed by the tag keys (CostCenter and Team).

Step-by-Step Solution

1
Configure the SAML identity provider in AWS to establish trust with the on-premises IdP.
The target AWS account trusts the metadata of the external SAML IdP.
This is a prerequisite for any federated role assumption.
2
Create the FederatedDeveloperRole and write its trust policy.
The role's trust policy specifies the SAML provider as the Principal, and lists both sts:AssumeRoleWithSAML and sts:TagSession in the Action block.
The sts:AssumeRoleWithSAML action allows the federation, and the sts:TagSession action is mandatory to authorize passing session tags (attributes) during the STS session initiation.
3
Configure the SAML assertions on the external IdP to populate the user's CostCenter and Team values.
The SAML assertions contain attributes named 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:CostCenter' and 'https://aws.amazon.com/SAML/Attributes/PrincipalTag:Team'.
AWS STS reads these specific attribute patterns to apply tags to the temporary federated session, which allows ABAC policies to evaluate resource access.

Key Concept

SAML 2.0 federation with Attribute-Based Access Control (ABAC) in multi-account environments.
Estimated Time:2m 30s
Question 1880Question →

A media company is designing a metadata API for a video streaming platform. The application runs on Amazon EC2 instances in private subnets behind an Application Load Balancer (ALB) in the us-east-1 Region. The backend database is an Amazon Aurora PostgreSQL Serverless v2 DB cluster. The company requires a disaster recovery (DR) solution in the us-west-2 Region with a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. The solution must minimize ongoing runtime costs while maintaining high availability. Which of the following database and routing strategies meets these requirements?

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 containing a single Aurora Serverless v2 instance. Pre-provision the VPC, ALB, and an Auto Scaling group of EC2 instances with a desired capacity of zero in us-west-2. Configure Amazon Route 53 Application Recovery Controller (ARC) routing control to manage failover and scale up the Auto Scaling group during a DR event.

Answer

Deploying an Amazon Aurora Global Database with a single Aurora Serverless v2 instance in the secondary region, pre-provisioning the network and application load balancer, and using Route 53 Application Recovery Controller routing controls to coordinate failover and scale up the application tier.
The correct strategy uses Amazon Aurora Global Database replication to meet the 1-minute RPO requirement, and automates failover of the database and compute capacity (which is kept at zero to minimize idle running costs) using Route 53 Application Recovery Controller routing controls to stay within the 15-minute RTO.

Step-by-Step Solution

1
Analyze RTO and RPO requirements to eliminate backup-and-restore options.
Eliminate backup-and-restore options since snapshot recovery takes longer than 15 minutes and hourly copies violate the 1-minute RPO.
Aurora Global Database replication is required to meet the 1-minute RPO constraint.
2
Review recovery region DNS and networking components for high availability and resolution.
Ensure the Route 53 Private Hosted Zone is associated with both VPCs and that NAT Gateways are deployed in multiple Availability Zones.
Private Hosted Zones must be associated with consumer VPCs to resolve DNS queries, and single NAT Gateways represent single points of failure.
3
Verify active-passive scaling configuration and failover mechanism.
Identify the strategy that uses Route 53 Application Recovery Controller (ARC) to automate database promotion and application scaling while keeping pilot-light/warm-standby costs minimal by setting EC2 instance counts to zero.
Route 53 ARC provides reliable routing control for multi-region failovers, and keeping EC2 desired capacity at zero minimizes compute costs.

Key Concept

Multi-Region High Availability and Disaster Recovery Design
PreviousPage 94 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin