Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1901Question →

A financial services firm needs to relocate its historical transaction archives from an on-premises legacy POSIX storage array to Amazon S3. The archive consists of 750 TB750\text{ TB} of data. The target S3 bucket is hosted in the firm's production AWS account (Account A). The security policy requires that all archived data must be encrypted at rest using a customer managed key (CMK) hosted in a separate security governance AWS account (Account B). The migration must be completed within 2525 days. The firm has an active 1 Gbps1\text{ Gbps} AWS Direct Connect connection, but network utilization reports indicate that only 200 Mbps200\text{ Mbps} of bandwidth can be spared for this migration without impacting core trading operations. Which migration strategy should a solutions architect recommend to meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Order multiple AWS Snowball Edge Storage Optimized devices in Account A, specifying the ARN of the customer managed key from Account B for encryption when creating the jobs. Configure Account B's key policy to allow Account A's IAM entities and the Snowball service principal to use the key. Copy the data to the devices on-premises, and ship them back to AWS to import the data into Account A's S3 bucket.

Answer

Ordering multiple AWS Snowball Edge Storage Optimized devices in Account A, specifying the ARN of the customer managed key from Account B, and configuring the key policy to allow cross-account access is the correct solution.
The correct strategy involves using AWS Snowball Edge devices to physically transfer the 750 TB750\text{ TB} of data, which easily completes within the 2525-day window (typically taking a few days for copy and shipping). To satisfy the security requirement of encrypting the data with Account B's customer managed KMS key, the job must be created with the cross-account key ARN, and the key policy in Account B must be configured to permit the Snowball service principal and Account A's IAM identities to use the key.

Step-by-Step Solution

1
Calculate the network transfer time for the dataset over the available network bandwidth.
750 TB750\text{ TB} of data transferred over a 200 Mbps200\text{ Mbps} connection would take ≈347\approx 347 days, which is far greater than the 2525-day migration window. Therefore, offline data transfer using AWS Snowball Edge is required.
Determines if an online or offline migration strategy is required based on bandwidth and time constraints.
2
Configure the KMS Customer Managed Key policy in Account B to allow cross-account usage.
Add the target AWS Account A's root ARN or specific IAM role, along with the Snowball service principal (`import.snowball.amazonaws.com`), to the key policy with actions such as `kms:DescribeKey`, `kms:CreateGrant`, `kms:Decrypt`, and `kms:GenerateDataKey*`.
Enables the Snowball service in Account A to use Account B's customer managed key for encryption during the import process.
3
Order AWS Snowball Edge Storage Optimized devices from Account A and copy the data.
Multiple devices are ordered, specifying the cross-account KMS key ARN. The data is copied from the on-premises storage to the devices using the Snowball client, and the devices are shipped back to AWS.
Executes the physical data transfer within the timeline and ensures data is encrypted at rest using the correct key.

Key Concept

Selecting between online and offline migration based on bandwidth and time constraints, and configuring cross-account KMS key policies for Snowball Edge imports.
Question 1902Question →

A media production company is designing a collaborative video editing platform. The platform has two main requirements:

1. A relational metadata database for video clips (OLTP) that requires complex SQL queries, a recovery point objective (RPO) of under 11 minute, and a recovery time objective (RTO) of under 1515 minutes in a secondary disaster recovery region.
2. An object store for raw video assets in a central AWS account that must be securely accessed by an external vendor's IAM roles in a separate AWS account, requiring cross-account access and server-side encryption.

Which of the following database and storage strategies meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the disaster recovery region. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.

Answer

Deploy an Amazon Aurora Global Database with the primary cluster in the primary region and a secondary cluster in the disaster recovery region. Store the raw video assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key, and configure the S3 bucket policy and KMS key policy to grant read access to the external vendor's IAM roles.
The correct strategy uses Amazon Aurora Global Database to achieve near-zero RPO and low RTO because of its storage-level replication. For S3 cross-account access, a customer managed key is required because its key policy can be modified to trust the external account's IAM principal, which is not possible with AWS-managed keys like aws/s3.

Step-by-Step Solution

1
Evaluate the RTO and RPO requirements for the database.
Identify that Amazon Aurora Global Database is required to support sub-second cross-region replication (RPO under 1 minute) and failover/promotion in under 15 minutes (RTO under 15 minutes).
Standard RDS replication or backups (such as a pilot light configuration) do not meet the stringent recovery time and recovery point objectives.
2
Check the read-scaling capability of standard RDS Multi-AZ deployments.
Determine that standard RDS Multi-AZ standby instances are passive and cannot serve read traffic, which rules out routing read traffic to the standby instance.
Only Aurora Replicas or active RDS Read Replicas can be used to scale read workloads.
3
Verify cross-account S3 bucket sharing and encryption configuration.
Conclude that an AWS KMS customer managed key (CMK) must be used to encrypt the S3 bucket, with appropriate permissions granted in the KMS key policy to allow cross-account decryption.
AWS-managed KMS keys (like aws/s3) cannot be shared across different AWS accounts as their key policies cannot be modified.

Key Concept

To meet strict RTO/RPO objectives in multi-region deployments, Amazon Aurora Global Database provides active-passive cross-region physical replication with fast failover. Furthermore, S3 buckets shared across accounts must use Customer Managed Keys (CMKs) to enable decryption by external account principals, as AWS managed keys cannot be shared cross-account.
Question 1903Question →

A geospatial satellite image processing company is designing a new multi-region pipeline on AWS. The application will be deployed in VPCs in us-east-1 (Primary) and us-west-2 (Secondary). The workflow orchestration tier runs on Amazon EC2 instances in private subnets that require highly available outbound internet access to ingestion APIs, resilient to any Availability Zone (AZ) failure. The database layer uses Amazon Aurora PostgreSQL to store image metadata. The company requires a Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 2 minutes. Additionally, internal EC2 processing nodes in us-west-2 must resolve hostnames in a Route 53 Private Hosted Zone (PHZ) managed in us-east-1. Which TWO architectural configurations must a solutions architect implement to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Use managed failover to promote the secondary cluster to a write-capable region during disaster recovery.; In both VPCs, deploy a NAT Gateway in each Availability Zone where private EC2 instances reside, and configure the routing tables of each private subnet to direct egress traffic to the local NAT Gateway in its respective Availability Zone.

Answer

The correct configurations are to configure an Amazon Aurora Global Database using managed failover, and to deploy NAT Gateways in multiple Availability Zones in each VPC with updated route tables for each private subnet.
Configuring an Amazon Aurora Global Database satisfies the low RTO and RPO limits. Aurora Global Database utilizes fast storage-level replication to achieve an RPO of under 1 second, and its managed failover enables promoting the secondary region to primary within 2 minutes. Additionally, deploying a NAT Gateway in each Availability Zone where private EC2 instances reside ensures outbound internet connection remains available in the event of an Availability Zone outage, since each zone's private route tables route egress traffic independently to the local NAT Gateway.

Step-by-Step Solution

1
Evaluate the HA/DR requirements for the database tier to determine the replication mechanism.
Identify that a backup/restore or snapshot replication mechanism cannot meet the 1-minute RPO and 2-minute RTO. Amazon Aurora Global Database replication latency is under 1 second, and its managed failover meets the under 2 minutes RTO requirement.
This establishes the database replication and failover architecture needed for compliance with recovery objectives.
2
Evaluate the egress internet traffic resilience requirements.
Identify that a single NAT Gateway in a VPC is a single point of failure. Deploying a NAT Gateway in each Availability Zone where EC2 instances reside and updating corresponding route tables maintains internet access if one AZ goes down.
This ensures the outbound connection path remains highly available and AZ-fault tolerant.
3
Review options to eliminate distractors violating RTO/RPO, AZ resilience, DNS Private Hosted Zone cross-VPC association, or database replica scaling constraints.
Select the correct combination consisting of Aurora Global Database with managed failover, and multi-AZ NAT Gateway deployments.
This guarantees that both database and networking layers fulfill all business constraints.

Key Concept

Designing multi-region disaster recovery for databases and highly available network paths while managing private DNS resolution across VPCs.
Question 1904Question →

An enterprise is designing a secure hybrid and multi-account network topology using AWS Organizations. The environment consists of 5050 spoke VPCs distributed across two AWS regions: `us-east-1` and `us-west-2`. The architecture includes an AWS Transit Gateway (TGW) in each region with inter-region peering established, and a Shared Services VPC in a dedicated Infrastructure account. An on-premises data center is connected via AWS Direct Connect to a Direct Connect Gateway associated with both regional TGWs. The enterprise must meet the following requirements:

1. Spoke VPCs in all accounts must resolve domain names in a Private Hosted Zone (PHZ) named `internal.awsinternal.aws` hosted in the Shared Services account.
2. Spoke VPCs must forward DNS queries for the domain `onprem.corponprem.corp` to on-premises DNS servers.
3. Outbound internet traffic from all spoke VPCs must be centrally inspected by AWS Network Firewall endpoints deployed across multiple Availability Zones in a centralized Egress VPC in each region.

Which two actions should the solutions architect take to configure the DNS resolution and traffic routing to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure DNS resolution by creating the `internal.awsinternal.aws` PHZ in the Shared Services account. Authorize cross-account VPC associations for the spoke VPCs, and accept the associations in the spoke accounts. Create Route 53 Resolver outbound endpoints in the Shared Services VPC, define a forwarding rule for `onprem.corponprem.corp` pointing to on-premises DNS servers, share this rule via AWS Resource Access Manager (RAM) with the organization, and associate the shared rule with all spoke VPCs.; Configure egress routing by deploying regional AWS Network Firewall endpoints, TGW attachments, and NAT Gateways across multiple Availability Zones in the Egress VPC. In the regional TGW route table associated with the spoke VPCs, add a static default route (`0.0.0.0/00.0.0.0/0`) pointing to the local Egress VPC TGW attachment. In the Egress VPC, configure the TGW subnet route tables to route `0.0.0.0/00.0.0.0/0` to the Network Firewall endpoints, and configure the firewall subnet route tables to route `0.0.0.0/00.0.0.0/0` to the NAT Gateways.

Answer

Configure DNS resolution using cross-account Private Hosted Zone association and Route 53 Resolver forwarding rules shared via AWS RAM. Configure centralized egress routing using multi-AZ AWS Network Firewall endpoints and NAT Gateways with static default routes in the regional Transit Gateway.
The correct solution involves two main architectures. For hybrid DNS resolution, a Private Hosted Zone cannot be shared directly via AWS RAM; instead, it must be associated with the spoke VPCs using cross-account hosted zone association authorization. The Route 53 Resolver forwarding rule for the on-premises domain is shared via AWS RAM and associated with the spoke VPCs to redirect queries to the outbound endpoints. For centralized egress, high availability requires multi-AZ deployment of Network Firewall endpoints and NAT Gateways in the Egress VPC. Spoke traffic is sent to the Egress VPC via TGW default routing, inspected by the local firewall endpoint, and sent to the NAT Gateway.

Step-by-Step Solution

1
Set up DNS resolution for the central Private Hosted Zone across accounts.
Authorized cross-account VPC associations are created for the spoke VPCs, enabling them to associate with and resolve queries within the central `internal.awsinternal.aws` PHZ.
Private Hosted Zones are not supported by AWS RAM for cross-account sharing, so API-based cross-account association is required.
2
Configure hybrid DNS forwarding to the on-premises DNS servers.
A Route 53 Resolver forwarding rule is created for the `onprem.corponprem.corp` domain pointing to the on-premises DNS servers, shared via AWS RAM with the organization, and associated with all spoke VPCs.
This allows centralized outbound DNS resolution while minimizing the cost and management of deploying endpoints in every spoke VPC.
3
Configure high-availability egress routing path in the Egress VPC.
TGW route tables point `0.0.0.0/00.0.0.0/0` to the Egress VPC attachment. Egress VPC TGW subnets route `0.0.0.0/00.0.0.0/0` to the Network Firewall endpoints, which in turn route to the local NAT Gateways.
This guarantees that all outbound internet traffic is inspected by the AWS Network Firewall without creating a single point of failure.

Key Concept

Centralized network security routing and cross-account hybrid DNS architecture using AWS Transit Gateway and Route 53 Resolvers.
Estimated Time:3m 0s
Question 1905Question →

Zephyr Payments is modernizing its on-premises payment processing application by migrating it to AWS. The architecture consists of a frontend web portal and a backend payment API. The Solutions Architect has decided to deploy the backend payment API as containerized tasks using Amazon ECS on AWS Fargate across multiple Availability Zones in a private VPC. The backend API needs to communicate securely and privately with a legacy reporting service deployed in a separate VPC within the same AWS Region. The network architecture must ensure that no traffic between these VPCs passes over the public internet, and the configuration must minimize operational overhead while adhering to Fargate's architectural boundaries. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS task definition for the backend payment API using the awsvpc network mode.; Create an AWS Transit Gateway and attach both the ECS VPC and the legacy reporting VPC to route traffic privately between them.

Answer

The Solutions Architect should configure the ECS task definition for the backend payment API using the awsvpc network mode, and create an AWS Transit Gateway attaching both the ECS VPC and the legacy reporting VPC to route traffic privately between them.
The correct options are configuring the ECS task definition using the awsvpc network mode and routing the traffic using an AWS Transit Gateway. AWS Fargate tasks exclusively support the awsvpc network mode, which registers an Elastic Network Interface (ENI) directly for each task. Private VPC-to-VPC connectivity is securely and scalably managed by attaching both VPCs to an AWS Transit Gateway, which supports transitive routing without sending traffic over the public internet.

Step-by-Step Solution

1
Select the correct network mode for AWS Fargate tasks.
The ECS task definition is configured with the awsvpc network mode.
AWS Fargate does not support bridge, host, or none network modes. Tasks must use the awsvpc mode to get their own elastic network interface (ENI).
2
Establish private inter-VPC network connectivity.
An AWS Transit Gateway is deployed, and both VPCs are attached to it with appropriate route table entries.
Transit Gateway allows private, scalable, and low-latency routing between multiple VPCs without routing traffic over the public internet.

Key Concept

AWS Fargate task networking configurations and private multi-VPC routing options.
Estimated Time:2m 30s
Question 1906Question →

A retail corporation is modernizing its on-premises inventory management backend by migrating to Amazon Aurora PostgreSQL. A serverless application using Amazon API Gateway and AWS Lambda will ingest high-frequency updates from partner supply-chain systems. The partner systems connect to the VPC using AWS Direct Connect.

The architecture must meet the following requirements:
- API traffic from partners must remain entirely private without traversing the public internet.
- Partner requests must be authenticated using OAuth2 tokens validated by a Lambda authorizer against an external Identity Provider (IdP) on the public internet.
- Database connection scaling must be managed efficiently.
- High-volume surges in inventory API traffic must not exhaust the regional account concurrency pool, which would throttle other critical applications.
- Credentials must be encrypted using AWS KMS, with the key policy configured to delegate management to a central security team.

Which architecture meets these requirements while aligning with AWS best practices?

Show answer & explanation

Answer: Deploy a Private API Gateway with an Interface VPC Endpoint. Configure the inventory Lambda function in the VPC to use Amazon RDS Proxy. Set Reserved Concurrency on the inventory Lambda function. Run the Lambda authorizer inside private subnets across multiple Availability Zones, routing outbound traffic through a NAT Gateway in each Availability Zone to validate tokens against the external Identity Provider. Encrypt database credentials using a Customer Managed Key (CMK) with a customized key policy.

Answer

Deploy a Private API Gateway with an Interface VPC Endpoint, use Amazon RDS Proxy for connection pooling, set Reserved Concurrency on the inventory Lambda function, route the Lambda authorizer's outbound traffic through a NAT Gateway in each Availability Zone, and encrypt credentials using a Customer Managed Key (CMK) with a customized key policy.
The correct solution uses a Private API Gateway with a VPC endpoint for private access over Direct Connect. It deploys the inventory Lambda function inside the VPC using Amazon RDS Proxy to safely scale database connections. It establishes a Reserved Concurrency limit to prevent the function from exhausting the account-level concurrency pool, which safeguards other application functions. For authentication, the Lambda authorizer is deployed across multiple private subnets and accesses the public internet IdP via redundant NAT Gateways to avoid a single point of failure. Finally, it uses a Customer Managed Key (CMK) for credential encryption, allowing the customized key policy needed to delegate administrative control to the security team.

Step-by-Step Solution

1
Expose the API privately over Direct Connect.
A Private API Gateway is set up with an Interface VPC Endpoint in the VPC, allowing partner systems to reach it over Direct Connect without crossing the public internet.
Meets the requirement for private network transit.
2
Configure backend scaling and protection.
Amazon RDS Proxy is placed between the Lambda functions and the Aurora PostgreSQL database. Reserved Concurrency is configured on the inventory Lambda function.
RDS Proxy prevents database connection exhaustion. Reserved Concurrency limits and guarantees concurrency for the function, preventing it from consuming the entire regional account-level concurrency pool and throttling other workloads.
3
Set up outbound internet access for the Lambda authorizer.
The Lambda authorizer is deployed to private subnets across multiple Availability Zones. Outbound routes are configured through a NAT Gateway in each Availability Zone.
The authorizer must validate tokens against an external IdP on the public internet. Utilizing multiple NAT Gateways ensures high availability and resilience to AZ outages.
4
Configure secure credential encryption.
A Customer Managed Key (CMK) is created, and its key policy is configured to delegate management to the central security team.
AWS-managed keys (like aws/lambda) cannot have their key policies modified. A CMK is required to customize the policy for delegation.

Key Concept

Designing secure, highly available, and scalable serverless workloads with AWS Lambda and Amazon API Gateway integrated with VPC resources and external endpoints.
Question 1907Question →

An enterprise is planning to migrate its on-premises VMware vSphere environment containing 80 virtual machines (VMs) to a VMware Cloud on AWS SDDC. The migration has the following technical requirements:

* A critical database cluster of 5 VMs must be migrated with zero downtime during replication and cutover to maintain continuous application availability.
* The remaining 75 application VMs can tolerate a brief service interruption of up to 15 minutes during an off-peak scheduled maintenance window.
* All VMs must retain their existing on-premises IP addresses post-migration to prevent breaking hardcoded application configurations.
* The migration traffic must traverse a private connection using an existing 1 Gbps AWS Direct Connect connection.

Which combination of VMware HCX migration methods and network configurations should the Solutions Architect select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use VMware HCX Replication Assisted vMotion (RAV) to migrate the database VMs, and use VMware HCX Bulk Migration to migrate the application VMs with a scheduled switchover.; Establish a VMware HCX Layer 2 Network Extension over the Direct Connect connection to stretch the on-premises VLANs to the VMware Cloud on AWS SDDC.

Answer

The correct configurations are using VMware HCX Replication Assisted vMotion (RAV) for database VMs along with Bulk Migration for application VMs, and establishing a VMware HCX Layer 2 Network Extension over the Direct Connect connection.
To satisfy the requirements, the Solutions Architect should select VMware HCX Replication Assisted vMotion (RAV) for the database VMs to ensure zero downtime, use VMware HCX Bulk Migration for the remaining application VMs to allow scheduled parallel switchovers within their 15-minute downtime window, and establish a VMware HCX Layer 2 Network Extension over Direct Connect to preserve IP addresses.

Step-by-Step Solution

1
Analyze the downtime tolerance of the workloads.
The database VMs require zero downtime, which mandates HCX Replication Assisted vMotion (RAV). The application VMs can tolerate up to 15 minutes of downtime, making HCX Bulk Migration (which uses replication followed by a scheduled reboot switchover) the most efficient and scalable choice.
Matching migration methods with workload requirements ensures that application availability matches defined objectives.
2
Determine the network requirements for IP preservation.
To preserve on-premises IP addresses without updating hardcoded application configurations, a Layer 2 network extension must be configured.
Layer 2 extensions stretch VLANs across hybrid environments, preventing IP address changes.
3
Select the appropriate network path.
The migration traffic must travel over a private connection, so VMware HCX should be configured to run over the Direct Connect Private VIF rather than the public internet.
Direct Connect Private VIF ensures secure, high-throughput, private routing of HCX replication and vMotion traffic.

Key Concept

Selecting the appropriate VMware HCX migration methods (Replication Assisted vMotion and Bulk Migration) and extending the Layer 2 network over a private Direct Connect path to satisfy workload availability and IP preservation requirements.
Estimated Time:2m 0s
Question 1908Question →

A financial services company is using AWS Application Migration Service (MGN) to migrate its legacy transaction-processing servers from an on-premises data center to AWS. The network connection is established via an AWS Direct Connect connection terminating at a Transit Gateway, which is associated with a dedicated staging VPC. The solutions architect has installed the AWS Replication Agent on the on-premises servers, but the replication status in the AWS MGN console displays 'Stalled' for all source servers. A network analysis shows that the agents are unable to establish a connection to the replication servers in the staging area subnet. Which of the following actions will resolve the replication connection issue?

Show answer & explanation

Answer: Update the security group associated with the replication servers in the staging area subnet to allow inbound traffic on TCP port 1500 from the on-premises subnet range.

Answer

Update the security group associated with the replication servers in the staging area subnet to allow inbound traffic on TCP port 1500 from the on-premises subnet range.
AWS Application Migration Service (MGN) relies on TCP port 1500 to stream replicated blocks from the agent running on the source server to the replication servers in the staging area VPC. Ensuring that the staging area security group permits inbound TCP traffic on port 1500 from the source subnet range allows the replication process to establish connectivity and proceed.

Step-by-Step Solution

1
Identify the port required by AWS Application Migration Service (MGN) for data replication.
TCP port 1500 is identified as the dedicated port used by the Replication Agent to send replication data to the replication servers.
Data replication packets are sent directly from the source servers to the staging area replication servers over TCP port 1500.
2
Analyze the security group and firewall configurations in the staging VPC.
Confirm that the security group attached to the replication servers does not permit inbound TCP port 1500 traffic from the on-premises network range.
By default, security groups block all inbound traffic unless explicitly permitted. If port 1500 is not allowed, the agents will show a status of 'Stalled'.
3
Update the staging VPC security group to allow inbound TCP port 1500.
Traffic flow is permitted and the Replication Agent establishes connection to the replication servers, resuming the data synchronization.
Allowing the replication port resolves the network block at the staging subnet level.

Key Concept

Replication data transport in AWS Application Migration Service (MGN) requires TCP port 1500 to be open from the source environment to the replication servers in the staging area.
Question 1909Question →

An online banking consortium is implementing a serverless wire transfer API. The backend logic is hosted on AWS Lambda functions, fronted by Amazon API Gateway. The compliance department mandates that any updates to the transfer Lambda function must undergo automated end-to-end transaction validation in the production environment before any actual user traffic is routed to the new code. If validation succeeds, the new version must be gradually introduced, starting at 5%5\% of live traffic, scaling up by 5%5\% every 10 minutes, until it handles 100%100\% of the workload. If the error rate of the new version exceeds 0.5%0.5\% or if the validation fails at any point, the system must immediately and automatically roll back to the previous stable version with zero downtime. Which of the following configurations represents the most operationally efficient deployment strategy that meets these requirements?

Show answer & explanation

Answer: Configure AWS CodeDeploy to use a custom deployment configuration defined with a linear traffic shifting type, a step percentage of 5%5\%, and a step interval of 10 minutes. In the AppSpec file, define a `BeforeAllowTraffic` hook pointing to a validation Lambda function that executes the end-to-end transaction tests. Associate a CloudWatch Alarm monitoring the Lambda function's error rate with the CodeDeploy deployment group to trigger automatic rollbacks.

Answer

Configure AWS CodeDeploy to use a custom deployment configuration defined with a linear traffic shifting type, a step percentage of 5%5\%, and a step interval of 10 minutes. In the AppSpec file, define a `BeforeAllowTraffic` hook pointing to a validation Lambda function that executes the end-to-end transaction tests. Associate a CloudWatch Alarm monitoring the Lambda function's error rate with the CodeDeploy deployment group to trigger automatic rollbacks.
Defining a custom CodeDeploy deployment configuration with a linear shifting pattern is correct because it matches the requested custom increments of 5%5\% every 10 minutes. Using the `BeforeAllowTraffic` hook allows the system to validate the deployment on the new Lambda function version in the target environment before any live user traffic is routed. Linking the deployment group to CloudWatch alarms ensures that any breach of the error rate threshold immediately triggers an automatic, zero-downtime rollback.

Step-by-Step Solution

1
Analyze standard versus custom CodeDeploy configurations.
Determine that AWS does not provide a predefined linear deployment configuration matching exactly 5%5\% every 10 minutes, meaning a custom configuration must be defined.
Predefined options only cover standard steps like 10%10\% increments.
2
Select the correct lifecycle hook for pre-traffic verification.
Choose the `BeforeAllowTraffic` hook in the AppSpec file to execute the validation Lambda function.
This hook executes before the first traffic shifting step starts, ensuring no production users hit unverified code.
3
Configure the automated rollback mechanism.
Create and link a CloudWatch Alarm monitoring the Lambda function's error rate to the CodeDeploy deployment group.
This enables automatic rollback to the previous stable version if the error rate exceeds the defined threshold.

Key Concept

Custom deployment configurations and lifecycle hooks in AWS CodeDeploy for serverless applications.
Question 1910Question →

An enterprise has a 600 TB600\text{ TB} historical dataset stored on an on-premises NFS file system that must be migrated to Amazon S3. The enterprise has a dedicated 200 Mbps200\text{ Mbps} internet connection. In addition, the enterprise must establish an ingestion pipeline to receive daily reports totaling 100 GB100\text{ GB} from external vendors via the SFTP protocol, storing them directly in Amazon S3. The migration of the historical 600 TB600\text{ TB} dataset must be completed within 2020 days. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Order multiple AWS Snowball Edge Storage Optimized devices, transfer the 600 TB600\text{ TB} dataset locally from the NFS server, and ship the devices back to AWS to import the data into the Amazon S3 bucket using an AWS KMS customer managed key.; Provision an AWS Transfer Family server with an SFTP-enabled public endpoint, map the endpoint to the target Amazon S3 bucket, and configure external vendors to upload their daily reports using the SFTP protocol.

Answer

The correct strategy requires ordering multiple AWS Snowball Edge Storage Optimized devices to migrate the historical 600 TB600\text{ TB} dataset using a customer managed KMS key, and provisioning an AWS Transfer Family SFTP-enabled public endpoint to ingest the daily 100 GB100\text{ GB} vendor reports directly to Amazon S3.
Using AWS Snowball Edge Storage Optimized devices is the only way to meet the migration timeline for the 600 TB600\text{ TB} dataset given the 200 Mbps200\text{ Mbps} network limit. The import job requires an AWS KMS customer managed key because AWS managed keys do not support the delegation necessary for Snowball. Meanwhile, AWS Transfer Family with an SFTP public endpoint mapped to Amazon S3 offers a native, scalable solution for daily reports from external vendors.

Step-by-Step Solution

1
Calculate the network transfer time for the historical dataset to determine if online transfer is feasible.
At 200 Mbps200\text{ Mbps}, transferring 600 TB600\text{ TB} takes over 270270 days, which is well beyond the 2020-day migration window.
This establishes that a physical offline transfer mechanism (Snowball Edge) is required rather than an online service like DataSync.
2
Evaluate the encryption requirements for the offline Snowball transfer.
Determine that an AWS KMS customer managed key must be configured because default AWS managed keys (`aws/s3`) do not support external access or cross-service delegation needed by the Snowball import process.
This guarantees compliance with security rules and ensures the Snowball import task succeeds.
3
Determine the optimal endpoint configuration for the SFTP ingestion pipeline.
Deploy an AWS Transfer Family SFTP-enabled public endpoint backed by Amazon S3 to support external vendors directly without complex transitive routing.
This provides a highly available, simple, and standard method for secure public ingestion.

Key Concept

Large-scale data migration decisions based on bandwidth limits, execution timelines, and service constraints (Snowball vs DataSync and Transfer Family).
Estimated Time:3m 0s
Question 1911Question →

A retail company has an AWS Organization with six VPCs in a single AWS Region. The company needs to establish highly available connectivity to its on-premises data center using an existing AWS Direct Connect connection. The design must support transitive routing for VPC-to-VPC traffic as well as connectivity between all VPCs and the on-premises data center, while minimizing administrative overhead and the number of BGP sessions. Which architecture should the solutions architect implement to meet these requirements?

Show answer & explanation

Answer: Deploy a central AWS Transit Gateway, attach all six VPCs to the Transit Gateway, and associate it with a Direct Connect Gateway using a transit virtual interface to manage both VPC-to-VPC and hybrid traffic.

Answer

Deploy a central AWS Transit Gateway, attach all six VPCs to the Transit Gateway, and associate it with a Direct Connect Gateway using a transit virtual interface to manage both VPC-to-VPC and hybrid traffic.
Deploying a central AWS Transit Gateway and attaching the VPCs to it allows for scalable, transitive routing between VPCs. Associating the Transit Gateway with a Direct Connect Gateway using a transit virtual interface enables traffic to flow between the VPCs and the on-premises data center over a single consolidated BGP session, satisfying both the transitive routing and administrative overhead constraints.

Step-by-Step Solution

1
Analyze the transitive routing requirement between VPCs and the on-premises data center.
Identify that AWS Transit Gateway is required to enable VPC-to-VPC communication as well as consolidated hybrid access, since Direct Connect Gateway alone does not support transitive routing between VPCs.
Establishing a hub-and-spoke model simplifies routing and meets the transitive communication requirements.
2
Select the appropriate Direct Connect interface type.
A transit virtual interface (Transit VIF) must be configured on the AWS Direct Connect connection to connect to the AWS Transit Gateway via the Direct Connect Gateway.
Private virtual interfaces cannot be associated with Transit Gateways; Transit Gateways require Transit VIFs.
3
Verify compliance with high availability and administrative overhead constraints.
Associating the Transit Gateway with a single Direct Connect Gateway simplifies BGP session management to a single peer relationship while maintaining scalability.
This avoids the complexity of managing multiple Direct Connect virtual interfaces and BGP sessions per VPC.

Key Concept

AWS Transit Gateway transitive routing and Direct Connect Gateway integration using Transit VIFs
Estimated Time:2m 0s
Question 1912Question →

A company manages 3030 member accounts within a single organization in AWS Organizations. The security team is setting up AWS Config in all member accounts and wants to centralize all configuration history files and snapshots into a single Amazon S3 bucket located in a dedicated Security Archive account. They want to encrypt all configuration data in the S3 bucket using a Customer Managed Key (CMK) in AWS KMS. Which configuration combination will allow AWS Config to successfully deliver the files to the S3 bucket?

Show answer & explanation

Answer: In the Security Archive account, configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for the config.amazonaws.com service principal, conditioned on the organization ID. Create a KMS CMK in the Security Archive account, and configure its key policy to allow config.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt, conditioned on the organization ID. In the member accounts, point AWS Config to the central S3 bucket and the KMS CMK ARN.

Answer

In the Security Archive account, configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for the config.amazonaws.com service principal, conditioned on the organization ID. Create a KMS CMK in the Security Archive account, and configure its key policy to allow config.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt, conditioned on the organization ID. In the member accounts, point AWS Config to the central S3 bucket and the KMS CMK ARN.
The correct answer configuration successfully authorizes cross-account delivery by targeting the config.amazonaws.com service principal in both the S3 bucket policy and the KMS Customer Managed Key (CMK) policy. Because AWS Config uses the service principal rather than member account IAM roles to perform delivery, and because AWS-managed keys cannot be used for cross-account encryption, a Customer Managed Key (CMK) in the central account with explicit service principal trust is the only valid solution.

Step-by-Step Solution

1
Determine key requirements for cross-account KMS encryption.
Identify that a Customer Managed Key (CMK) is mandatory because AWS-managed keys cannot be shared across accounts.
AWS-managed keys have fixed key policies that cannot be modified to grant cross-account permissions.
2
Configure the resource-based access policy for the central S3 bucket.
Grant s3:PutObject and s3:GetBucketAcl to the config.amazonaws.com service principal.
AWS Config delivers configuration history using the service principal directly rather than assuming the member account's IAM role.
3
Configure the key policy for the central KMS CMK.
Grant kms:GenerateDataKey* and kms:Decrypt permissions to the config.amazonaws.com service principal.
AWS Config requires these permissions to generate data keys for encrypting the log objects before writing them to the S3 bucket.

Key Concept

Centralized cross-account resource delivery with AWS Config, S3, and KMS Customer Managed Keys
Estimated Time:2m 0s
Question 1913Question →

A company is designing a deployment pipeline for a production web application hosted on Amazon EC2 instances inside an Auto Scaling group behind an Application Load Balancer (ALB). The application requires zero downtime during deployments, and the operations team must have the ability to automatically roll back the deployment if new errors are detected via CloudWatch alarms. The team has decided to use AWS CodeDeploy to manage the deployments.

Which two configuration steps should the solutions architect include in the deployment strategy to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the CodeDeploy deployment group to use a Blue/Green deployment style, and choose the option to copy the existing Auto Scaling group as the replacement environment.; Configure CloudWatch alarms to monitor key application metrics such as HTTP 5xx error rates, and associate these alarms with the CodeDeploy deployment group to trigger an automatic rollback if they enter the ALARM state during the deployment.

Answer

To meet the requirements, the solutions architect should configure the CodeDeploy deployment group to use a Blue/Green deployment style that copies the existing Auto Scaling group, and associate CloudWatch alarms with the deployment group to trigger an automatic rollback if they enter the ALARM state.
The correct options recommend configuring a blue/green deployment style by copying the existing Auto Scaling group, and using CloudWatch alarms associated with the CodeDeploy deployment group for automated rollback. Copying the Auto Scaling group ensures a clean replacement environment is provisioned and verified before traffic is shifted, preserving the original environment in case of failure. Associating CloudWatch alarms with the deployment group allows CodeDeploy to monitor the application during and immediately after deployment, triggering an automatic rollback to the original environment if errors exceed defined thresholds.

Step-by-Step Solution

1
Select the appropriate deployment style for zero-downtime and clean rollback requirements.
Determine that a blue/green deployment style using CodeDeploy with a copy of the existing Auto Scaling group provides a separate, clean replacement environment for testing before traffic routing.
An in-place deployment runs the risk of downtime or capacity reduction, whereas a blue/green deployment isolates the new version and ensures the old version remains healthy until traffic is shifted.
2
Select the appropriate mechanism to automate rollback based on post-deployment errors.
Associate CloudWatch alarms monitoring application health and error rates with the CodeDeploy deployment group.
AWS CodeDeploy natively integrates with CloudWatch alarms to monitor deployments. If an alarm fires during the deployment or during the bake time, CodeDeploy will automatically roll back traffic to the blue environment, minimizing the blast radius.
3
Exclude incompatible configuration settings.
Identify that the LambdaLinear deployment configuration is invalid for EC2 deployments, and that setting MinInstancesInService to 0 causes complete application downtime.
Only deployment configurations compatible with EC2/On-premises can be used, and the minimum instances in service must be maintained to satisfy the zero-downtime mandate.

Key Concept

Designing a reliable blue/green deployment strategy for Amazon EC2 Auto Scaling groups using AWS CodeDeploy, including automated rollbacks via CloudWatch alarms.
Question 1914Question →

A telecommunications company is designing a new real-time network fault monitoring system on AWS. The application will be deployed across two AWS Regions: `us-west-2` (Primary) and `us-east-1` (Secondary). The architecture requires an active-passive disaster recovery strategy with a Recovery Time Objective (RTO) of ≤5\leq 5 minutes and a Recovery Point Objective (RPO) of ≤1\leq 1 minute. The application runs on Amazon EC2 instances in private subnets, which must regularly connect to external diagnostic probes on the internet. For internal service communication, microservices rely on a shared Route 53 Private Hosted Zone named `corp.internal`. Which of the following architectures meets these requirements while minimizing regional failover time and ensuring high availability within each Region?

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. In both VPCs, deploy a NAT Gateway in each Availability Zone. Associate the Route 53 Private Hosted Zone corp.internal with the VPCs in both Regions. Use Route 53 Application Recovery Controller (ARC) routing controls to manage traffic redirection between Regions.

Answer

The correct architecture uses Amazon Aurora Global Database for database replication, deploys a NAT Gateway in each Availability Zone of both VPCs, associates the Route 53 Private Hosted Zone corp.internal with both VPCs, and implements Route 53 Application Recovery Controller (ARC) routing controls for multi-region failover.
The correct architecture leverages Amazon Aurora Global Database, which replicates data with sub-second latency to meet the 11-minute RPO and can be promoted via managed failover in under a minute to satisfy the 55-minute RTO. A NAT Gateway in each Availability Zone of both VPCs guarantees redundant internet egress, and associating the Route 53 Private Hosted Zone corp.internal with both VPCs ensures that internal services can resolve names before and after a regional failover. Route 53 ARC controls allow for rapid, deterministic routing changes.

Step-by-Step Solution

1
Evaluate the database replication strategy against RTO and RPO constraints.
Amazon Aurora Global Database provides typical replication lag of less than 11 second (satisfying the 11-minute RPO) and supports managed failover that promotes the secondary region in less than 11 minute (satisfying the 55-minute RTO). Amazon RDS with manual read replica promotion cannot reliably meet the 55-minute RTO.
Choosing the correct disaster recovery pattern is critical to meet the strict RTO and RPO targets.
2
Examine internal DNS configuration across VPCs.
A Route 53 Private Hosted Zone (PHZ) must be explicitly associated with the VPCs in both Regions to allow resources in either Region to resolve the internal domain names.
Failing to associate the PHZ with the secondary VPC results in name resolution failures when traffic shifts to the secondary region.
3
Ensure outbound connectivity redundancy within each Region.
Deploying a NAT Gateway in each Availability Zone of both VPCs prevents a single AZ outage from interrupting outbound internet communication to the diagnostic probes.
Using a single NAT Gateway per Region creates a single point of failure, violating local high-availability requirements.

Key Concept

High Availability and Disaster Recovery Design for Multi-Region Architectures
Question 1915Question →

An enterprise is migrating its legacy on-premises VMware vSphere workloads to a Multi-AZ VMware Cloud on AWS (VMC on AWS) SDDC. The SDDC is connected to the on-premises data center via AWS Direct Connect using a Direct Connect Gateway (DXGW) attached to a VMware Transit Connect (vTGW). The enterprise is using VMware HCX to extend several on-premises L2 VLANs to the SDDC.

During the migration, virtual machines (VMs) are moved using HCX Replication-Assisted vMotion (RAV). A set of migrated VMs on an extended network segment needs to communicate with database servers remaining on-premises that reside on a non-extended subnet. The network team reports that traffic from the migrated VMs to the on-premises database servers is experiencing high latency and routing loops. Diagnostics show that packets from the migrated VMs are traversing the HCX Network Extension (L2 path) back to the on-premises default gateway and then to the database servers, while return traffic is routing over the Direct Connect path.

Which solution will resolve the routing inefficiency and ensure optimal bidirectional path routing between the migrated VMs and the on-premises database servers?

Show answer & explanation

Answer: Enable Proximity Routing in the HCX Network Extension configuration. In the VMware Cloud on AWS console, configure Route Redistribution under the Transit Connect settings to enable the redistribution of HCX host routes (/32) to the Direct Connect Gateway. Ensure that the on-premises router is configured to accept and prioritize these host routes over the extended network's summary route.

Answer

The correct solution is to enable Proximity Routing in the HCX Network Extension configuration, and configure Route Redistribution under the Transit Connect settings in the VMware Cloud on AWS console to enable the redistribution of HCX host routes (/32) to the Direct Connect Gateway.
The correct solution involves enabling Proximity Routing in the HCX Network Extension. When Proximity Routing is enabled, the HCX appliance in the SDDC intercepts traffic from migrated VMs destined for non-extended subnets and redirects it to the SDDC routing path. To ensure bidirectional routing, the SDDC Tier-0 router must advertise /32 host routes of the migrated VMs to the on-premises router. This requires configuring Route Redistribution under the Transit Connect settings in the VMware Cloud on AWS console to propagate HCX host routes to the Direct Connect Gateway, and ensuring that the on-premises router prioritizes these specific host routes.

Step-by-Step Solution

1
Analyze the traffic flow and routing behavior between the migrated VMs (on the extended network) and the on-premises database servers (on a non-extended network).
Identify that outgoing traffic is hairpining through the L2 extended network, while return traffic is using the Direct Connect routed path, causing asymmetrical routing and high latency.
By default, the migrated VMs use their on-premises default gateway for all off-subnet traffic, which pulls packets back across the L2 extended network.
2
Enable HCX Proximity Routing on the extended network segment.
The SDDC HCX Network Extension appliance intercepts outgoing traffic destined for non-extended subnets and forwards it locally to the SDDC Tier-1/Tier-0 routing path.
Proximity Routing redirects traffic locally so that outgoing packets can utilize the low-latency Direct Connect routed path instead of crossing the L2 extension.
3
Configure Route Redistribution in the VMware Cloud on AWS SDDC console for Transit Connect.
Enable the redistribution of HCX host routes (/32) to propagate the individual host routes of migrated VMs to the Direct Connect Gateway (DXGW) and the on-premises router.
The on-premises router must receive these /32 host routes to know that the migrated VMs are located in the SDDC, ensuring return traffic is routed back via Direct Connect instead of the L2 extended network.

Key Concept

Ensuring optimal bidirectional routing for VMs migrated to VMware Cloud on AWS on extended L2 segments using HCX Proximity Routing and VMC route redistribution.
Question 1916Question →

A utility enterprise is modernizing its legacy smart meter telemetry ingestion backend to a serverless architecture on AWS. The solution must ingest bursty, real-time meter readings via an Amazon API Gateway endpoint and process them using an AWS Lambda function. The API Gateway endpoint must only be accessible privately from the enterprise's on-premises network via an AWS Direct Connect connection. The processed data is then stored in an Amazon RDS for PostgreSQL database in a private subnet. The database requires highly resilient connection management to prevent connection exhaustion during peak traffic times. Additionally, the ingestion workload must be configured so that it does not exhaust the regional execution pool and throttle critical downstream customer billing and payment Lambda functions. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a private API Gateway endpoint using an interface VPC endpoint, and configure an Amazon RDS Proxy between the telemetry processing Lambda function and the RDS for PostgreSQL database.; Configure reserved concurrency on the telemetry processing Lambda function to limit its maximum concurrent executions, preventing it from consuming the entire regional concurrency pool.

Answer

Deploy a private API Gateway endpoint using an interface VPC endpoint, configure an Amazon RDS Proxy between the telemetry processing Lambda function and the RDS database, and configure reserved concurrency on the telemetry processing Lambda function to limit its execution rate.
The correct answer combination involves deploying a private API Gateway with an interface VPC endpoint and RDS Proxy, and setting reserved concurrency on the telemetry function. The private API Gateway ensures that traffic from the on-premises network via AWS Direct Connect remains private. Amazon RDS Proxy pools connections to prevent connection exhaustion at the database layer. Configuring reserved concurrency on the telemetry Lambda function sets a concurrency ceiling, guaranteeing that the remaining regional concurrency is preserved for downstream payment and billing functions.

Step-by-Step Solution

1
Analyze private API connectivity requirements.
Identify that a private API Gateway combined with an interface VPC endpoint (AWS PrivateLink) allows the on-premises network to securely route traffic to API Gateway via AWS Direct Connect without traversing the public internet.
Meets the requirement for the API Gateway endpoint to be privately accessible from the corporate network.
2
Address database connection resiliency.
Determine that Amazon RDS Proxy should be placed between the Lambda function and the PostgreSQL database to pool and share database connections.
Prevents connection exhaustion on the RDS instance caused by highly concurrent Lambda scale-out events.
3
Design concurrency controls to protect neighboring workloads.
Apply reserved concurrency to the high-volume, bursty telemetry Lambda function.
Configuring reserved concurrency isolates the function's scale-out capacity, leaving the remaining regional account pool available for other critical functions like payment and billing.

Key Concept

Serverless architectural integration patterns using API Gateway private endpoints, RDS database connection pooling via RDS Proxy, and concurrency isolation via Lambda reserved concurrency.
Question 1917Question →

A financial institution is launching a new mobile banking application. During a scheduled national marketing campaign, the application expects a sudden, massive spike in traffic, transitioning from a baseline of 3,0003,000 requests per second (RPS) to a peak of 120,000120,000 RPS within a few minutes. The application's backend runs on Amazon ECS tasks using AWS Fargate, and uses an Amazon Aurora PostgreSQL database for transaction history. Which two actions should a solutions architect recommend to ensure the platform scales and maintains performance during the launch? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Contact AWS Support to pre-warm the Application Load Balancer to the expected traffic volume of 120,000120,000 RPS.; Configure scheduled scaling policies for the Amazon ECS service to scale out Fargate tasks to the anticipated peak capacity before the campaign begins.

Answer

Contact AWS Support to pre-warm the Application Load Balancer to the expected traffic volume, and configure scheduled scaling policies for the Amazon ECS service to scale out Fargate tasks to the anticipated peak capacity before the campaign begins.
For predictable flash traffic spikes of this magnitude, standard reactive scaling is insufficient. The Application Load Balancer must be pre-warmed by contacting AWS Support to prevent dropped connections during the rapid increase. Similarly, the Amazon ECS service must use scheduled scaling policies to pre-provision Fargate tasks ahead of time, ensuring sufficient compute capacity is online when the traffic arrives.

Step-by-Step Solution

1
Analyze the traffic profile and determine the scaling requirements.
The traffic increases from 3,000 RPS to 120,000 RPS (a 40x increase) in a few minutes, which constitutes flash traffic.
Standard reactive scaling mechanisms for ALBs and ECS tasks are too slow to cope with this rate of increase.
2
Address the entry point scaling (Load Balancing).
Requesting ELB pre-warming from AWS Support ensures the ALB is pre-provisioned with the capacity to handle 120,000 RPS.
Without pre-warming, the ALB will drop connections while attempting to scale out reactively.
3
Address the compute layer scaling (ECS/Fargate).
Create scheduled scaling policies to scale the ECS service's task count to the anticipated peak level before the event starts.
Scheduled scaling ensures compute capacity is ready immediately when the campaign begins, avoiding cold-start latency and delayed reaction times of target tracking policies.

Key Concept

Handling sudden, predictable flash traffic spikes requires proactive pre-provisioning (ELB pre-warming and scheduled scaling for compute layers) rather than relying on reactive auto-scaling.
Estimated Time:2m 0s
Question 1918Question →

A solutions architect is designing a new high-frequency transaction processing application that requires a relational database. The database must support an unpredictable read workload that surges during marketing campaigns, needing auto-scaling read capacity. Additionally, the system must achieve high availability with an automatic failover recovery time objective (RTO) of less than 30 seconds. Which database and storage strategy meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL DB cluster with a primary instance and an Aurora Replica in a different Availability Zone. Configure Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization.

Answer

Deploy an Amazon Aurora PostgreSQL DB cluster with a primary instance and an Aurora Replica in a different Availability Zone. Configure Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization.
The correct strategy uses Amazon Aurora PostgreSQL with an Aurora Replica in another Availability Zone. This architecture ensures high availability with automatic failover (typically completed within 30 seconds) and scales read operations dynamically using Aurora Auto Scaling based on target CPU utilization metrics.

Step-by-Step Solution

1
Analyze high availability and failover requirements.
An RTO of less than 30 seconds requires an automated failover mechanism. Amazon Aurora DB clusters automatically fail over to an existing replica in a different Availability Zone within 30 seconds, whereas Amazon RDS Multi-AZ failovers can take 1-2 minutes.
Ensures the database strategy matches the strict RTO target.
2
Analyze read scaling requirements.
Unpredictable read workloads require horizontal read scaling. Aurora Replicas can handle read queries, and Aurora Auto Scaling dynamically provisions and terminates replicas based on CPU utilization target tracking.
Allows the architecture to handle surges in read traffic automatically.
3
Validate security and integration constraints.
The correct strategy must utilize Customer Managed Keys (CMKs) if cross-account sharing is needed, but for the basic setup, deploying Aurora with Aurora Auto Scaling is the only choice that satisfies both high availability failover and dynamic read scaling without custom scripting.
Confirms the operational feasibility and compliance of the chosen option.

Key Concept

Amazon Aurora provides rapid automated failover to replicas and supports dynamic horizontal scaling of read capacity via Aurora Auto Scaling, whereas standard RDS standby instances cannot serve read traffic.
Estimated Time:2m 0s
Question 1919Question →

An enterprise manages multiple AWS accounts under AWS Organizations and has configured federation with an on-premises SAML 2.0 Identity Provider (IdP). Internal database administrators (DBAs) successfully authenticate with the IdP but receive an access denied error when attempting to assume the cross-account DBA role in target member accounts. A review of the configuration shows that the SAML provider object has been created in each target account. What configuration modification must the Solutions Architect apply to the target accounts to resolve this issue?

Show answer & explanation

Answer: Update the IAM role trust policy in the target accounts to list the SAML provider ARN as the Principal, specify 'sts:AssumeRoleWithSAML' as the Action, and include a Condition checking that the 'SAML:aud' attribute matches 'https://signin.aws.amazon.com/saml'.

Answer

Update the IAM role trust policy in the target accounts to list the SAML provider ARN as the Principal, specify 'sts:AssumeRoleWithSAML' as the Action, and include a Condition checking that the 'SAML:aud' attribute matches 'https://signin.aws.amazon.com/saml'.
The correct configuration for SAML 2.0 federation requires the IAM role trust policy in the target account to list the SAML provider's ARN as the federated principal, specify the 'sts:AssumeRoleWithSAML' action, and validate the audience attribute ('SAML:aud') to point to the AWS SAML endpoint.

Step-by-Step Solution

1
Identify the authentication and authorization mechanism in use.
The scenario describes SAML 2.0 federation where users authenticate at an external IdP and receive a SAML assertion to assume an IAM role in target AWS accounts.
This establishes that the target role's trust policy must allow federation via SAML.
2
Determine the required API action and principal for SAML 2.0 federation trust policies.
SAML-based federation requires the 'sts:AssumeRoleWithSAML' action and must trust the SAML provider ARN created in the target account.
Standard 'sts:AssumeRole' is for AWS IAM principals, and 'sts:AssumeRoleWithWebIdentity' is for OIDC providers.
3
Validate required conditions for SAML trust relationships.
A condition block must verify that the 'SAML:aud' (audience) attribute matches the AWS SAML endpoint 'https://signin.aws.amazon.com/saml'.
This prevents unauthorized endpoints from initiating session requests using the SAML assertion.

Key Concept

SAML 2.0 Multi-Account Federation IAM Trust Policies
Estimated Time:2m 0s
Question 1920Question →

A software-as-a-service (SaaS) provider is migrating its multi-tier backend application from an on-premises hypervisor to AWS using AWS Application Migration Service (MGN). The hybrid network architecture includes a 1 Gbps1\text{ Gbps} AWS Direct Connect connection that terminates at an AWS Transit Gateway in a shared services account. The replication staging area is set up in a dedicated VPC. After installing the AWS MGN Replication Agent on the on-premises source servers, the network administrator reports that while the control plane communication over HTTPS (port 443) is successful, the replication status remains permanently stalled. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The security group associated with the replication servers in the staging area subnet does not permit inbound traffic on TCP port 1500 from the on-premises network range.

Answer

The security group associated with the replication servers in the staging area subnet does not permit inbound traffic on TCP port 1500 from the on-premises network range.
The correct option is correct because AWS Application Migration Service (MGN) uses TCP port 1500 for replication data transit. While the control plane uses HTTPS (port 443) for management, the actual block-level replication stream requires TCP port 1500 to be open from the source replication agent to the replication servers in the staging area. Blocking this port prevents replication from initiating.

Step-by-Step Solution

1
Analyze the network configuration and ports used by AWS Application Migration Service (MGN).
Identify that MGN uses two primary communication channels: HTTPS (port 443) for control plane orchestration, and TCP port 1500 for block-level data replication.
To determine which port failure aligns with the symptom of successful control plane traffic but stalled data replication.
2
Evaluate the current network connectivity status described in the scenario.
Control plane communication is functional over HTTPS (port 443), proving that general routing, DNS, and Transit Gateway connectivity are operational.
To rule out complete routing issues or basic DNS resolution failures.
3
Diagnose the cause of the stalled data replication.
The block-level replication traffic over TCP port 1500 is blocked at the staging area's security groups or firewall, preventing the replication servers from receiving data.
To identify the specific security group misconfiguration blocking TCP port 1500.

Key Concept

AWS MGN Data Replication Port Requirements
Estimated Time:2m 0s
PreviousPage 96 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin