All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

Question 1921Question →

A national health agency is designing a portal for citizens to retrieve digital health certificates. A nationwide broadcast scheduled for exactly $20:00$ UTC will direct citizens to log in and download their certificates. The platform's baseline workload is $1,000$ requests per minute, but it is projected to instantly surge to over $800,000$ requests per minute within $2$ minutes of the broadcast. The backend API is deployed on Amazon ECS on AWS Fargate behind an Application Load Balancer (ALB) and retrieves data from an Amazon Aurora PostgreSQL database. Which architecture strategy should a Solutions Architect recommend to ensure the platform handles the peak traffic spike with minimal latency and no dropped requests?

Submit a support case to AWS to pre-warm the Application Load Balancer to the expected traffic volume. Configure Scheduled Scaling for the Amazon ECS service to scale out tasks before the event. Configure the Amazon Aurora database in a Multi-AZ deployment and configure the application to route read queries directly to the failover standby instance in the secondary Availability Zone.

Submit a support case to AWS to pre-warm the Application Load Balancer to the expected traffic volume of

800,000

requests per minute. Configure Scheduled Scaling for the Amazon ECS service to scale out to the required task count before

20:00

UTC. Configure Aurora Auto Scaling to add Aurora Replicas to handle the read load, and configure the application to use the Aurora reader endpoint.

Configure the Application Load Balancer with a target tracking scaling policy based on the ActiveConnectionCount metric. Implement target tracking scaling for the Amazon ECS service using average CPU utilization. Configure Aurora Auto Scaling to provision additional Aurora Replicas dynamically as read latency increases.

Submit a support case to AWS to pre-warm the Application Load Balancer. Configure ECS Service Auto Scaling based on CPU utilization, setting the scale-out cooldown period to

10

seconds to accelerate container launch. Scale the primary Amazon Aurora instance vertically to a larger instance size prior to the event, routing all read and write queries to the primary instance.

Show answer & explanation

Answer: Submit a support case to AWS to pre-warm the Application Load Balancer to the expected traffic volume of $800,000$ requests per minute. Configure Scheduled Scaling for the Amazon ECS service to scale out to the required task count before $20:00$ UTC. Configure Aurora Auto Scaling to add Aurora Replicas to handle the read load, and configure the application to use the Aurora reader endpoint.

Answer

The architecture that pre-warms the Application Load Balancer, uses Scheduled Scaling for ECS tasks, and utilizes Aurora Replicas with the reader endpoint.

The correct architecture leverages AWS Support to pre-warm the Application Load Balancer, ensuring it has enough capacity provisioned to handle the massive surge of

800,000

requests per minute from the first second. Scheduled scaling for ECS Fargate ensures that the container tasks are fully booted, healthy, and registered with the target group before the

20:00

UTC start time. Finally, routing read traffic to the Aurora reader endpoint utilizes Aurora Replicas to scale read performance horizontally, preventing database bottlenecks.

Step-by-Step Solution

Analyze the traffic pattern and load balancer scaling behavior.

An instant surge from

1,000

800,000

requests per minute cannot be handled by the default scaling behavior of the Application Load Balancer, requiring pre-warming.

To ensure the routing infrastructure can handle the immediate load without dropping packets or throttling.

Determine the ECS container scaling strategy.

Dynamic target tracking has a bootstrap delay. Scheduled scaling scales out tasks before

20:00

UTC.

To ensure enough compute instances are fully initialized and ready to process requests before the traffic arrives.

Optimize the database tier for heavy read operations.

Configure Aurora Auto Scaling with Aurora Replicas and update the application client to query the Reader endpoint.

To distribute the read queries horizontally across replicas instead of overloading the primary writer instance.

Key Concept

Handling massive, scheduled flash traffic spikes in AWS requires pre-allocating capacity at both the routing/load-balancing tier and compute tier, combined with horizontal read scaling at the database tier.

Question 1922Question →

An enterprise is designing a highly resilient hybrid network architecture for its multi-account AWS environment. The environment consists of $40$ VPCs distributed across two AWS Regions: `us-east-1` ( $25$ VPCs) and `eu-west-1` ( $15$ VPCs). The enterprise needs to establish redundant connectivity to its primary on-premises data center in London.

The network design must meet the following requirements:
- Establish a primary, high-bandwidth path using a $10\text{ Gbps}$ AWS Direct Connect (DX) connection.
- Establish a backup IPsec VPN connection over the public internet.
- Minimize administrative overhead for managing routing tables.
- Support transitive routing between the VPCs in both regions and the on-premises data center.
- Ensure that the Direct Connect path is preferred for both inbound and outbound traffic, with automatic failover to the VPN connection in the event of a Direct Connect outage.

Which of the following architectures meets these requirements?

Deploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and establish a TGW peering connection between them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating on each regional TGW. Configure BGP routing on all connections, and configure the on-premises router to assign a higher BGP Local Preference to routes received via the Direct Connect Gateway.

Deploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and peer them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating only on the `eu-west-1` TGW. Configure BGP routing on all connections, and rely on the TGW peering connection to route `us-east-1` traffic to the `eu-west-1` TGW's VPN attachment during a Direct Connect outage.

Deploy a Direct Connect Gateway (DXGW) and associate it directly with all

40

Virtual Private Gateways (VGWs) of the VPCs across both regions. Terminate a Private VIF from the Direct Connect connection on the DXGW. For the backup path, establish an AWS Site-to-Site VPN connection to each individual VPC's VGW. Configure BGP routing on all VGWs to manage failover dynamically, preferring the Direct Connect path using BGP community tags.

Deploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and peer them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating on each regional TGW. Associate a single Route 53 Private Hosted Zone (PHZ) for the on-premises domain with a central Shared Services VPC in `eu-west-1`, and rely on the TGW peering connection to automatically resolve on-premises DNS queries for all VPCs in both regions.

Show answer & explanation

Answer: Deploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and establish a TGW peering connection between them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating on each regional TGW. Configure BGP routing on all connections, and configure the on-premises router to assign a higher BGP Local Preference to routes received via the Direct Connect Gateway.

Answer

The correct architecture requires deploying a Transit Gateway in each region, peering them, associating both with a Direct Connect Gateway using a Transit VIF, terminating Site-to-Site VPNs on each regional Transit Gateway, and using BGP with Local Preference configuration on the on-premises router to prioritize the Direct Connect path.

The correct architecture uses a Transit Gateway (TGW) in each region peered together, with a Direct Connect Gateway (DXGW) associated with both TGWs using a Transit VIF. This setup allows all VPCs to access the Direct Connect connection. To provide backup connectivity, an AWS Site-to-Site VPN must be terminated on each regional TGW because TGW peering does not support transitive routing to VPN attachments. Dynamic routing with BGP is used, and configuring a higher BGP Local Preference on the on-premises router for routes received via Direct Connect ensures that inbound traffic prefers the Direct Connect path.

Step-by-Step Solution

Evaluate the VPC scale and routing requirements.

With

40

VPCs across two regions, using individual Virtual Private Gateways (VGWs) associated with a Direct Connect Gateway (DXGW) is not feasible due to the association limit of

10

VGWs per DXGW. Thus, regional AWS Transit Gateways (TGWs) must be used to aggregate VPC connectivity.

Transit Gateway simplifies the network topology and scales to thousands of VPCs, making it the appropriate choice for a multi-account, multi-VPC environment.

Determine the inter-region connectivity and Transit Gateway configuration.

Deploy a Transit Gateway in `us-east-1` and another in `eu-west-1`, peering them to allow inter-region VPC-to-VPC communication. Connect local VPCs to their respective regional TGWs.

TGW VPC attachments are regional, so regional TGWs are required, and TGW peering enables cross-region routing.

Configure the primary and backup hybrid connectivity.

Associate the Direct Connect Gateway (DXGW) with the TGWs in both regions, terminating a Transit VIF. Establish local AWS Site-to-Site VPN connections terminating directly on each regional TGW.

Since TGW peering does not support transitive routing to VPN attachments, each TGW must have its own local VPN connection to the on-premises data center to ensure backup connectivity for both regions during a Direct Connect outage.

Configure BGP routing parameters to enforce path preference and failover.

For AWS-to-on-premises traffic, TGW automatically prefers the DXGW attachment over the VPN attachment for identical prefixes. For on-premises-to-AWS traffic, configure the customer gateway to assign a higher Local Preference to routes received via the Direct Connect Gateway than those received via VPN.

BGP configuration ensures symmetric routing and automatic failover by preferring the higher-bandwidth Direct Connect path under normal conditions.

Key Concept

Multi-region hybrid connectivity requires the combination of regional Transit Gateways (TGWs) associated with a Direct Connect Gateway (DXGW) for high-performance routing, supplemented by local Site-to-Site VPN connections on each TGW to circumvent TGW peering transitive routing limitations.

Estimated Time:2m 30s

Question 1923Question →

A financial services firm utilizes AWS Organizations to manage 70 member accounts. A Solutions Architect is designing a centralized logging solution where AWS CloudTrail trails in all member accounts must deliver log files to a single Amazon S3 bucket in a dedicated Logging account. To comply with security mandates, all log files must be encrypted using an AWS KMS Customer Managed Key (CMK). Which configuration must the Solutions Architect implement to meet these requirements?

Create the S3 bucket and the KMS CMK in the Logging account. Configure the S3 bucket policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, using the aws:PrincipalOrgID condition. Configure the KMS CMK policy to allow the CloudTrail service principal to perform GenerateDataKey* and DescribeKey operations, using the same aws:PrincipalOrgID condition.

Create the S3 bucket in the Logging account and enable default encryption using the AWS-managed KMS key aws/s3. Configure the S3 bucket policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, and configure an IAM policy in the member accounts to allow the CloudTrail service to use the AWS-managed key.

Create the S3 bucket and the KMS CMK in the Logging account. Configure the S3 bucket policy to allow the root user of each member account to perform PutObject operations. Configure the trails in the member accounts to assume a cross-account IAM role in the Logging account to deliver logs and access the KMS CMK.

Create the S3 bucket and the KMS CMK in the Logging account. Attach a Service Control Policy (SCP) at the root of the AWS Organization that allows the s3:PutObject and kms:GenerateDataKey* actions on the logging S3 bucket and KMS CMK for all member accounts, allowing log delivery without modifying the resource policies in the Logging account.

Show answer & explanation

Answer: Create the S3 bucket and the KMS CMK in the Logging account. Configure the S3 bucket policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, using the aws:PrincipalOrgID condition. Configure the KMS CMK policy to allow the CloudTrail service principal to perform GenerateDataKey* and DescribeKey operations, using the same aws:PrincipalOrgID condition.

Answer

Create the S3 bucket and the Customer Managed Key (CMK) in the Logging account. Configure the S3 bucket policy and the KMS CMK policy to grant write and key generation permissions to the CloudTrail service principal, restricting access to the organization using the aws:PrincipalOrgID condition.

The correct answer configuration sets up resource-based policies on both the S3 bucket and the Customer Managed Key (CMK) in the target Logging account to grant the AWS CloudTrail service principal access. Because CloudTrail operates as a service principal (cloudtrail.amazonaws.com) rather than a specific IAM role when delivering logs, the bucket policy and key policy must directly trust this service principal. Scoping the permissions to the organization using the aws:PrincipalOrgID condition ensures that only trails within the organization can write to the bucket and use the key, maintaining security without manual cross-account role configurations.

Step-by-Step Solution

Determine log delivery identity.

CloudTrail delivers logs as a service principal (cloudtrail.amazonaws.com) rather than assuming cross-account IAM roles.

This dictates that permissions must be granted directly to the service principal in the target resource-based policies.

Select encryption key type.

Choose a Customer Managed Key (CMK) instead of an AWS-managed key.

AWS-managed keys (like aws/s3) cannot be shared across accounts or customized to allow access from other accounts' CloudTrail services.

Configure the S3 bucket policy and KMS key policy.

Add policies allowing cloudtrail.amazonaws.com to perform s3:PutObject and kms:GenerateDataKey*.

These are the minimum necessary permissions required by CloudTrail to write encrypted logs to the S3 bucket.

Implement organizational filtering.

Add the aws:PrincipalOrgID condition matching the Organization ID to both policies.

This restricts log delivery and key usage strictly to the member accounts of the specific AWS Organization.

Key Concept

Cross-account AWS CloudTrail logging requires utilizing Customer Managed Keys (CMKs) and configuring resource-based policies (S3 bucket policy and KMS key policy) to trust the CloudTrail service principal, scoped with the aws:PrincipalOrgID condition.

Estimated Time:2m 0s

Question 1924Question →

An enterprise needs to migrate a $300\text{ TB}$ dataset of seismic analysis files from an on-premises SMB file share to Amazon S3 within a strict 10-day migration window. The enterprise has a $100\text{ Mbps}$ dedicated internet connection available for this migration. Following the initial migration, legacy clients must be able to upload daily report files of approximately $50\text{ GB}$ in total using the SFTP protocol, authenticating against the enterprise's existing on-premises Active Directory. Furthermore, a data analysis application hosted in a separate AWS account must be able to access the migrated data securely using server-side encryption with AWS Key Management Service (AWS KMS). Which two of the following options should the solutions architect choose to meet these requirements? (Choose two.)

Select all that apply

Order multiple AWS Snowball Edge Storage Optimized devices to transfer the bulk dataset, and specify a Customer Managed Key (CMK) for encryption to allow cross-account access by modifying the key policy.

Create an AWS Transfer Family SFTP-enabled server endpoint, and configure it to use AWS Directory Service AD Connector to authenticate users against the on-premises Active Directory.

Deploy AWS DataSync agents on-premises to copy the

300\text{ TB}

SMB share directly to Amazon S3 over the

100\text{ Mbps}

connection using scheduled tasks.

Order multiple AWS Snowball Edge Storage Optimized devices to transfer the bulk dataset, encrypting the data with the default AWS-managed KMS key (aws/s3) and granting cross-account access via S3 bucket policies.

Deploy an AWS Transfer Family SFTP-enabled server endpoint inside a central VPC, and route authentication traffic transitively through a Direct Connect Gateway to connect the on-premises Active Directory with spoke VPCs.

Show answer & explanation

Answer: Order multiple AWS Snowball Edge Storage Optimized devices to transfer the bulk dataset, and specify a Customer Managed Key (CMK) for encryption to allow cross-account access by modifying the key policy.; Create an AWS Transfer Family SFTP-enabled server endpoint, and configure it to use AWS Directory Service AD Connector to authenticate users against the on-premises Active Directory.

Answer

Ordering multiple AWS Snowball Edge Storage Optimized devices using a Customer Managed Key (CMK) for encryption, and creating an AWS Transfer Family SFTP-enabled server endpoint using AWS Directory Service AD Connector for user authentication.

The correct architecture requires offline transfer via AWS Snowball Edge due to the network bandwidth constraint, using a Customer Managed Key (CMK) to allow cross-account key delegation, and integrating AWS Transfer Family with AWS Directory Service AD Connector for on-premises AD authentication.

Step-by-Step Solution

Calculate the transfer time for the initial migration of

300\text{ TB}

over the available

100\text{ Mbps}

bandwidth.

Determined that transferring

300\text{ TB}

over

100\text{ Mbps}

takes approximately 277 days, which violates the 10-day requirement. Therefore, offline physical migration using AWS Snowball Edge is mandatory.

Ensure that the proposed migration method conforms to the temporal constraints.

Evaluate KMS key configuration for cross-account read access to the migrated S3 data.

Concluded that a Customer Managed Key (CMK) must be selected during the Snowball Edge job configuration so that its key policy can be updated to permit decryption by the application role in the other AWS account.

AWS-managed KMS keys do not support policy modification and cannot be shared across different accounts.

Select the appropriate authentication service for AWS Transfer Family.

Chose AWS Directory Service AD Connector to integrate the Transfer Family SFTP endpoint directly with the on-premises Active Directory domain controllers.

Allows legacy SFTP clients to authenticate using their existing Active Directory credentials without custom credentials management.

Key Concept

Large-Scale Data Transfer using Snow Family, DataSync, and Transfer Family with cross-account access and Active Directory integration.

Question 1925Question →

A company is deploying a containerized microservice to Amazon ECS on AWS Fargate. The deployment pipeline is managed by AWS CodePipeline and AWS CodeDeploy using an Application Load Balancer. The company's deployment policy requires that exactly $15\%$ of production traffic be redirected to the new task set during the initial deployment phase. The new version must be evaluated for $20\text{ minutes}$ , and if any Amazon CloudWatch alarms are triggered during this window, the deployment must automatically roll back. If no alarms are triggered, all traffic must be routed to the new version. Which strategy should the Solutions Architect implement to meet these requirements with the least operational overhead?

Create a custom CodeDeploy deployment configuration using a TimeBasedCanary traffic routing configuration with a canary percentage of

15\%

and a canary interval of

20\text{ minutes}

. Associate this configuration with the CodeDeploy deployment group.

Configure the CodeDeploy deployment group to use the predefined CodeDeployDefault.ECSCanary15Percent20Minutes deployment configuration.

Configure Amazon Route 53 weighted routing records to direct

15\%

of DNS queries to a new ECS service running the replacement task set. Use an AWS Lambda function triggered by an Amazon EventBridge scheduler rule to update the weights after

20\text{ minutes}

Configure the Application Load Balancer listener rule with weighted target groups, routing

15\%

of traffic to the target group containing the new task set. Use an AWS Step Functions state machine to monitor CloudWatch alarms for

20\text{ minutes}

and update the target group weights.

Show answer & explanation

Answer: Create a custom CodeDeploy deployment configuration using a TimeBasedCanary traffic routing configuration with a canary percentage of $15\%$ and a canary interval of $20\text{ minutes}$ . Associate this configuration with the CodeDeploy deployment group.

Answer

Create a custom CodeDeploy deployment configuration using a TimeBasedCanary traffic routing configuration with a canary percentage of

15\%

and a canary interval of

20\text{ minutes}

. Associate this configuration with the CodeDeploy deployment group.

The correct strategy is to create a custom CodeDeploy deployment configuration. AWS CodeDeploy natively supports ECS blue/green deployments where traffic is shifted between target groups. While AWS provides several predefined configurations (e.g., Canary10Percent5Minutes, Canary10Percent15Minutes), it also allows the creation of custom deployment configurations with arbitrary values for the canary percentage and interval. This matches the requirement of

15\%

for

20\text{ minutes}

with minimal operational overhead.

Step-by-Step Solution

Determine if a predefined CodeDeploy deployment configuration matches the

15\%

canary for

20\text{ minutes}

requirement.

Identify that only configurations like Canary10Percent5Minutes and Canary10Percent15Minutes exist as predefined options for ECS.

Verify if the requirement can be met with zero custom configuration.

Select the appropriate native AWS mechanism for custom ECS deployment routing.

Determine that creating a custom AWS::CodeDeploy::DeploymentConfig with a TimeBasedCanary configuration is supported and minimizes overhead.

Minimize administrative effort by avoiding custom orchestration logic like Step Functions or Lambda.

Evaluate and reject non-native or unreliable deployment methods.

Reject Route 53 weighted routing due to DNS caching limitations, and reject manual ALB target group shifting via Step Functions due to unnecessary operational complexity.

Ensure high reliability, fast rollbacks, and compliance with the 20-minute window constraint.

Key Concept

AWS CodeDeploy supports custom deployment configurations for Amazon ECS, allowing architects to define specific Canary or Linear traffic routing parameters when predefined defaults do not meet business requirements.

Question 1926Question →

A technology company is preparing to migrate its core application portfolio from a local VMware vSphere cluster to a VMware Cloud on AWS (VMC on AWS) Software-Defined Data Center (SDDC). The company's hybrid network architecture consists of a 10 Gbps AWS Direct Connect connection terminated at an AWS Transit Gateway in a centralized Network account using a Transit VIF. The migration candidates consist of 15 high-throughput transactional database virtual machines (VMs) that must remain online with zero operational downtime, and 120 web application VMs that can tolerate a brief service interruption of up to 15 minutes during a weekend maintenance window. Additionally, all migrated workloads must resolve internal service endpoints hosted in a Route 53 Private Hosted Zone for corp.internal in a separate Shared Services AWS account. Which two actions should a solutions architect recommend to satisfy these requirements? (Select two.)

Select all that apply

Configure VMware Transit Connect to peer with the customer's AWS Transit Gateway. Deploy Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure the SDDC's DNS forwarder to route queries for corp.internal to the inbound endpoint IP addresses.

Implement VMware HCX for the migration. Configure Replication-Assisted vMotion (RAV) to migrate the 15 transactional database VMs, and use Bulk Migration to migrate the 120 web application VMs with a scheduled switchover during the maintenance window.

Associate the Route 53 Private Hosted Zone corp.internal directly with the VMware Cloud on AWS SDDC management VPC by using the AWS CLI to authorize and associate the cross-account VPC.

Configure VMware Transit Connect to peer with the customer's AWS Transit Gateway, and configure the customer's AWS Transit Gateway to route HCX migration traffic transitively from the on-premises Direct Connect Transit VIF to the VMware Transit Connect.

Deploy the AWS Application Migration Service (MGN) replication agent on all on-premises VMs. Replicate the workloads over the Direct Connect connection to the VMC on AWS SDDC, and schedule a cutover window for the web application VMs while using live migration for the databases.

Show answer & explanation

Answer: Configure VMware Transit Connect to peer with the customer's AWS Transit Gateway. Deploy Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure the SDDC's DNS forwarder to route queries for corp.internal to the inbound endpoint IP addresses.; Implement VMware HCX for the migration. Configure Replication-Assisted vMotion (RAV) to migrate the 15 transactional database VMs, and use Bulk Migration to migrate the 120 web application VMs with a scheduled switchover during the maintenance window.

Answer

The correct actions are implementing VMware HCX to migrate database VMs via Replication-Assisted vMotion (RAV) and application VMs via Bulk Migration, and configuring VMware Transit Connect peered with the customer's Transit Gateway while utilizing Route 53 Resolver inbound endpoints for DNS resolution.

Implementing VMware HCX with Replication-Assisted vMotion (RAV) ensures that the 15 database VMs migrate with zero downtime, as RAV performs bulk seeding followed by a live switchover. HCX Bulk Migration is ideal for the 120 application VMs because it schedules the switchover during the weekend maintenance window, resulting in a reboot and minimal downtime (under 15 minutes). For connectivity and DNS, peering VMware Transit Connect with the customer's AWS Transit Gateway establishes the necessary cross-account routing path. Because the customer cannot directly associate a Private Hosted Zone with the VMware-managed SDDC VPC, using Route 53 Resolver inbound endpoints in the Shared Services VPC and pointing the SDDC's DNS forwarder to them resolves queries for corp.internal correctly.

Step-by-Step Solution

Analyze the virtual machine migration requirements to choose the correct migration tool and mechanisms.

Identify that since the destination is a VMware Cloud on AWS SDDC, VMware HCX is required (not AWS MGN). For the 15 database VMs needing zero downtime, choose Replication-Assisted vMotion (RAV). For the 120 application VMs that can tolerate minimal downtime, choose Bulk Migration.

HCX RAV enables live migration with zero downtime, while Bulk Migration allows scheduled switchover of multiple VMs with a brief reboot.

Establish hybrid network routing between the VMC SDDC and the multi-account AWS environment.

Configure VMware Transit Connect to peer with the customer's AWS Transit Gateway, and configure appropriate routing rules. Recognize that transitive routing from on-premises to VMware Transit Connect through the customer's peered AWS Transit Gateway is not supported.

VMware Transit Connect is the native way to connect SDDCs to AWS Transit Gateways, but Transit Gateway peering has a transitive routing limitation for on-premises attachments.

Design a private DNS resolution mechanism for SDDC workloads to resolve corp.internal in the Shared Services account.

Deploy Route 53 Resolver inbound endpoints in the Shared Services VPC (which is associated with the Private Hosted Zone) and configure the SDDC's DNS forwarder to forward corp.internal queries to these inbound endpoint IP addresses.

The VMC SDDC cannot directly associate with the customer's Route 53 Private Hosted Zone, so DNS queries must be forwarded to Route 53 Resolver inbound endpoints.

Key Concept

VMware Cloud on AWS migration using VMware HCX, coupled with private DNS resolution via Route 53 Resolver endpoints and hybrid network connectivity with VMware Transit Connect.

Question 1927Question →

A financial services company is modernizing its legacy reporting system. The new architecture will use an Amazon API Gateway REST API to receive JSON report requests and route them to an AWS Lambda function. The Lambda function processes the reports and queries an Amazon RDS for PostgreSQL database located in a private subnet. The report requests are bursty, occasionally generating thousands of concurrent requests within a few minutes. Additionally, the Lambda function needs to call external third-party compliance APIs to validate the report metadata.

Which TWO of the following configurations should the solutions architect implement to ensure a secure, reliable, and scalable serverless architecture? (Select TWO.)

Select all that apply

Deploy Amazon RDS Proxy in the private subnets to pool database connections, and configure reserved concurrency on the Lambda function to prevent overwhelming the PostgreSQL database during traffic bursts.

Deploy NAT Gateways in each Availability Zone where the Lambda function is configured to run, and update the private subnet route tables to direct outbound traffic to the local NAT Gateway.

Deploy a single NAT Gateway in a single Availability Zone, and update the route tables of all private subnets to route outbound traffic through this single NAT Gateway to reduce NAT gateway hourly charges.

Allow the Lambda function to scale dynamically using the default regional concurrency pool without setting any reserved concurrency limits, relying on database-level connection timeouts to handle peaks.

Configure the system to encrypt database credentials in AWS Secrets Manager using the default AWS-managed KMS key (aws/secretsmanager), and update its key policy to delegate read permissions to a cross-account IAM role used by the Lambda function.

Show answer & explanation

Answer: Deploy Amazon RDS Proxy in the private subnets to pool database connections, and configure reserved concurrency on the Lambda function to prevent overwhelming the PostgreSQL database during traffic bursts.; Deploy NAT Gateways in each Availability Zone where the Lambda function is configured to run, and update the private subnet route tables to direct outbound traffic to the local NAT Gateway.

Answer

Deploy Amazon RDS Proxy in the private subnets to pool database connections, configure reserved concurrency on the Lambda function, and deploy NAT Gateways in each Availability Zone where the Lambda function runs to route outbound traffic.

Deploying Amazon RDS Proxy pools and reuses database connections, preventing the PostgreSQL database from crashing due to connection limits under high-volume spikes. Configuring reserved concurrency prevents the Lambda function from scaling excessively, which protects the database and safeguards regional concurrency. Setting up multiple NAT Gateways ensures redundant outbound routes for API validations in case of an Availability Zone outage.

Step-by-Step Solution

Analyze the database connection scaling limits and concurrency requirements under bursty workloads.

Identified that thousands of bursty concurrent Lambda executions will quickly exhaust the connection limit of the Amazon RDS for PostgreSQL database.

Lambda functions scale horizontally by launching individual containers, each establishing its own database connection. Pooling is necessary.

Select a connection management and throttling solution.

Selected Amazon RDS Proxy to pool connections and configured reserved concurrency on the Lambda function to place an upper limit on execution scaling.

This protects the downstream database from connection exhaustion and protects the AWS account from regional concurrency starvation.

Evaluate high availability and outbound network connectivity requirements.

Selected multi-AZ NAT Gateways to route outbound traffic from the private subnets to the external third-party APIs.

A single NAT Gateway introduces a single point of failure, violating the reliability pillar of the AWS Well-Architected Framework.

Key Concept

Modernizing legacy workloads to serverless requires managing outbound internet access, database connection scaling, and function concurrency to prevent regional throttling and database exhaustion.

Question 1928Question →

A company is planning to migrate its on-premises VMware vSphere workloads to a VMware Cloud on AWS Software-Defined Data Center (SDDC). The migration strategy must satisfy the following constraints:

* Live migration with zero downtime is required for a critical transactional database VM.
* A group of 50 non-critical application VMs must be migrated in parallel with a switchover scheduled during a weekend maintenance window to minimize service disruption.
* All replication traffic must traverse a secure, dedicated connection using the existing 1 Gbps AWS Direct Connect connection rather than the public internet.

Which two options should the Solutions Architect select to satisfy these migration requirements? (Select TWO.)

Select all that apply

Use VMware HCX vMotion to migrate the critical transactional database VM to achieve zero-downtime live migration.

Use VMware HCX Bulk Migration for the 50 application VMs to replicate them in parallel and perform a scheduled switchover.

Use VMware HCX Cold Migration for both the database VM and the application VMs to guarantee data consistency during the transfer.

Configure the VMware HCX replication traffic to route directly through an AWS Direct Connect Gateway connected to a Transit Gateway VPC attachment without enabling Transit Connect, relying on the Direct Connect Gateway for transitive routing.

Associate the Route 53 Private Hosted Zone with the on-premises DNS servers only, without associating it with the VMware Cloud on AWS connected VPC.

Show answer & explanation

Answer: Use VMware HCX vMotion to migrate the critical transactional database VM to achieve zero-downtime live migration.; Use VMware HCX Bulk Migration for the 50 application VMs to replicate them in parallel and perform a scheduled switchover.

Answer

Use VMware HCX vMotion to migrate the critical transactional database VM to achieve zero-downtime live migration, and use VMware HCX Bulk Migration for the 50 application VMs to replicate them in parallel and perform a scheduled switchover.

The correct options are to use VMware HCX vMotion for the critical transactional database VM to perform a live migration with zero downtime, and VMware HCX Bulk Migration for the 50 application VMs to allow parallel replication and a scheduled switchover. HCX vMotion migrates one VM at a time with zero downtime, which matches the single database requirement. HCX Bulk Migration replicates multiple VMs in bulk while powered on, and performs a brief switchover (with a reboot on the target side) which can be scheduled for a maintenance window.

Step-by-Step Solution

Analyze the downtime tolerance and concurrency requirements for each workload type.

The critical database VM requires zero downtime, suggesting a live migration mechanism like HCX vMotion. The 50 application VMs require parallel migration and a scheduled switchover, which is best supported by HCX Bulk Migration.

Matching workloads to the correct HCX migration profiles ensures RTO requirements are met.

Assess the routing and network requirements for migration replication traffic.

The replication traffic must run over the existing AWS Direct Connect connection. Ensuring proper routing paths using HCX without relying on unsupported Direct Connect Gateway transitive routing configurations is necessary.

This guarantees that network security and bandwidth constraints are maintained during data transfer.

Key Concept

Selecting appropriate VMware HCX migration methods based on application RTO, downtime tolerance, and scale constraints.

Question 1929Question →

An enterprise manages $200$ AWS accounts within an AWS Organization and is designing a centralized auditing architecture. A Solutions Architect must configure an AWS CloudTrail organization trail that aggregates all API activity logs into a single Amazon S3 bucket located in a dedicated log archive account. All logs must be encrypted at rest using a customer managed AWS KMS key. Which TWO configuration steps must the Solutions Architect perform to implement this solution? (Select TWO.)

Select all that apply

Configure the S3 bucket policy in the log archive account to allow the cloudtrail.amazonaws.com service principal to perform s3:PutObject actions, restricted to the prefix AWSLogs/o-xxxxxxxxx/ where o-xxxxxxxxx is the Organization ID.

Configure the KMS key policy in the log archive account to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the cloudtrail.amazonaws.com service principal, with a condition checking that aws:PrincipalOrgID matches the Organization ID.

Configure the organization trail to encrypt logs using the AWS-managed KMS key (aws/s3) in the log archive account to avoid the administrative overhead of managing custom key policies.

Create an S3 bucket policy in the log archive account that grants s3:PutObject permissions to the individual AWS account root principals of all 200 member accounts to authorize local log uploads.

Create a Service Control Policy (SCP) at the root level of the organization that explicitly grants the s3:PutObject action to the cloudtrail.amazonaws.com principal for the centralized S3 bucket.

Show answer & explanation

Answer: Configure the S3 bucket policy in the log archive account to allow the cloudtrail.amazonaws.com service principal to perform s3:PutObject actions, restricted to the prefix AWSLogs/o-xxxxxxxxx/ where o-xxxxxxxxx is the Organization ID.; Configure the KMS key policy in the log archive account to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the cloudtrail.amazonaws.com service principal, with a condition checking that aws:PrincipalOrgID matches the Organization ID.

Answer

To establish a centralized, encrypted logging architecture, the Solutions Architect must configure the S3 bucket policy in the log archive account to allow the CloudTrail service principal to write to the prefix matching the Organization ID, and configure the customer managed KMS key policy to grant the CloudTrail service principal permissions for key generation and description, restricted by the Organization ID.

To configure an organization trail delivering logs to a centralized S3 bucket in a log archive account, the S3 bucket policy must explicitly permit the CloudTrail service principal to write logs under the organization's prefix. Additionally, when using SSE-KMS with a customer managed key, the KMS key policy must grant permissions to the CloudTrail service principal for generating data keys and describing the key, restricted to the organization using the aws:PrincipalOrgID condition key. This ensures secure, cross-account log delivery and encryption.

Step-by-Step Solution

Configure the S3 bucket policy in the log archive account to allow cross-account log delivery.

The bucket policy allows cloudtrail.amazonaws.com to write objects using the prefix matching the Organization ID (AWSLogs/o-xxxxxxxxx/).

CloudTrail service principal must have permission to write logs directly to the central S3 bucket in a separate log archive account.

Configure the customer managed KMS key policy to support SSE-KMS encryption for the organization trail.

The key policy permits cloudtrail.amazonaws.com to use kms:GenerateDataKey* and kms:DescribeKey, scoped to the organization using aws:PrincipalOrgID.

AWS-managed keys cannot be used for cross-account logging since their policies cannot be modified. A customer managed key is required to delegate permissions to the CloudTrail service.

Key Concept

Centralized cross-account logging using AWS CloudTrail organization trails, requiring S3 resource-based bucket policies and customer managed KMS key policies for encryption.

Question 1930Question →

A healthcare provider is modernizing a legacy patient portal on-premises application by migrating it to a serverless architecture on AWS. The application uses Amazon API Gateway integrated with an AWS Lambda function, which queries an Amazon Aurora PostgreSQL database. The application must connect to the database via Amazon RDS Proxy to prevent connection exhaustion. The database is encrypted at rest using an AWS KMS Customer Managed Key (CMK) to allow cross-account audit access. The Lambda function requires outbound internet access to fetch external insurance verification data, and must be protected from high-traffic spikes that could exhaust the regional Lambda concurrency limit. The architecture must remain highly available across multiple Availability Zones (AZs) without single points of failure. Which architectural configuration meets these requirements?

Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a NAT Gateway deployed in each AZ. Configure reserved concurrency on the Lambda function to protect the regional concurrency pool. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using a Customer Managed Key (CMK).

Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a single NAT Gateway deployed in a single AZ to minimize costs. Configure reserved concurrency on the Lambda function. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using a Customer Managed Key (CMK).

Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a NAT Gateway deployed in each AZ. Do not configure reserved concurrency on the Lambda function, allowing it to scale dynamically using the default regional account concurrency pool. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using a Customer Managed Key (CMK).

Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a NAT Gateway deployed in each AZ. Configure reserved concurrency on the Lambda function. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using the AWS-managed key (aws/rds).

Show answer & explanation

Answer: Configure the Lambda function to run in private subnets across multiple Availability Zones (AZs). Route outbound internet traffic from these subnets through a NAT Gateway deployed in each AZ. Configure reserved concurrency on the Lambda function to protect the regional concurrency pool. Configure Amazon RDS Proxy to connect to the Aurora PostgreSQL database, and encrypt the database at rest using a Customer Managed Key (CMK).

Answer

The correct answer configures a NAT Gateway in each Availability Zone, ensuring that outbound internet access for the Lambda function remains highly available. It also configures reserved concurrency on the Lambda function, which prevents the function from scaling out of control and exhausting the regional concurrency limit. Finally, it uses a Customer Managed Key (CMK) for the database encryption, allowing the team to edit the key policy and grant cross-account audit permissions.

Step-by-Step Solution

Select the correct encryption key type for cross-account auditing.

AWS KMS Customer Managed Key (CMK) is chosen.

AWS-managed keys (e.g., aws/rds) have fixed key policies that cannot be modified to grant cross-account permissions. A Customer Managed Key (CMK) is required to configure custom policies for cross-account access.

Design the network routing for high availability without single points of failure.

Configure a NAT Gateway in each Availability Zone where private subnets are present.

Routing all outbound internet traffic from multiple private subnets through a single NAT Gateway in one AZ introduces a single point of failure (SPOF). If that AZ goes down, outbound connectivity for all subnets is lost.

Configure Lambda concurrency settings to protect account-wide resources.

Configure reserved concurrency on the Lambda function.

By default, Lambda functions share a regional pool of concurrency. Setting reserved concurrency guarantees that this function has a maximum limit, preventing it from consuming the entire regional limit and throttling other critical functions.

Key Concept

Securing and scaling serverless workloads with Lambda and API Gateway requires careful integration of network controls, concurrency limits, and encryption key management.

Estimated Time:2m 30s

Question 1931Question →

A company is designing a new customer portal (OLTP workload) that uses Amazon Aurora PostgreSQL. During marketing campaigns, the portal experiences sudden, massive surges in read traffic, while write traffic remains stable. The database must automatically scale read capacity to maintain latency under $100\text{ ms}$ , and it must support a cross-region disaster recovery plan with a Recovery Time Objective (RTO) of less than $10\text{ minutes}$ and a Recovery Point Objective (RPO) of less than $1\text{ minute}$ . The database must be encrypted at rest, and the encryption keys must support delegation to a separate security account for centralized key management. Which database and storage strategy meets these requirements?

Deploy an Amazon Aurora Global Database with the primary cluster in the main region and a secondary cluster in the recovery region. Configure Aurora Auto Scaling to dynamically add reader instances to the clusters based on CPU utilization. Encrypt the clusters using Customer Managed Keys (CMKs) in AWS KMS in each region, configuring the key policies to allow access from the security account.

Deploy an Amazon Aurora cluster with Multi-AZ enabled in the main region. Configure the Multi-AZ standby instance to automatically scale its instance size during peak read traffic. Encrypt the database using AWS Managed Keys (aws/rds) and configure IAM policies to allow cross-account access from the security account.

Deploy Amazon Aurora PostgreSQL in the main region and set up cross-region replication to an Amazon RDS for PostgreSQL read replica in the recovery region. Use AWS Managed Keys (aws/rds) for database encryption and share the keys with the security account.

Deploy Amazon Aurora PostgreSQL in the main region with Aurora Auto Scaling enabled for reader instances. Use AWS Backup to replicate database backups to the recovery region every

12\text{ hours}

. Encrypt the database using Customer Managed Keys (CMKs) and delegate key management to the security account.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in the main region and a secondary cluster in the recovery region. Configure Aurora Auto Scaling to dynamically add reader instances to the clusters based on CPU utilization. Encrypt the clusters using Customer Managed Keys (CMKs) in AWS KMS in each region, configuring the key policies to allow access from the security account.

Answer

Deploy an Amazon Aurora Global Database with the primary cluster in the main region and a secondary cluster in the recovery region, configure Aurora Auto Scaling based on CPU utilization, and encrypt using Customer Managed Keys (CMKs) in AWS KMS configured to allow access from the security account.

The correct strategy utilizes an Amazon Aurora Global Database to achieve cross-region disaster recovery, as it replicates data asynchronously with typical latency of less than 1 second (meeting the RPO of less than 1 minute) and can be promoted to a primary cluster in minutes (meeting the RTO of less than 10 minutes). Aurora Auto Scaling dynamically scales reader instances to handle read traffic spikes. Using Customer Managed Keys (CMKs) in AWS KMS is necessary because AWS Managed Keys cannot be shared cross-account or have their key policies modified to allow delegation of key management to a separate security account.

Step-by-Step Solution

Select the cross-region database architecture that satisfies RTO <

10\text{ minutes}

and RPO <

1\text{ minute}

Amazon Aurora Global Database provides sub-second replication latency (meeting the RPO) and can be promoted in less than a minute (meeting the RTO).

Alternative strategies like database backup replication every

12\text{ hours}

cannot meet the RPO.

Determine the scaling mechanism for handling sudden read capacity demands.

Aurora Auto Scaling automatically adds reader instances to the cluster based on metrics like CPU utilization.

Multi-AZ standby instances are passive and cannot serve read traffic or scale dynamically.

Select the appropriate encryption key type for cross-account delegation.

AWS KMS Customer Managed Keys (CMKs) allow policy modification to delegate key management and usage to external AWS accounts.

AWS Managed Keys (aws/rds) cannot have their policies modified and cannot be shared across accounts.

Key Concept

Selecting database replication, scaling, and key management strategies that satisfy specific RTO, RPO, performance, and cross-account security constraints.

Question 1932Question →

An enterprise is designing a hybrid network architecture for its multi-account AWS environment consisting of 12 spoke VPCs distributed across us-east-1 and us-west-2. The organization needs to connect its on-premises data center to all VPCs. The solution must use a primary 10 Gbps AWS Direct Connect connection and a backup Site-to-Site VPN connection. The architecture must dynamically route traffic, prefer the Direct Connect path during normal operations, fail over automatically to the VPN path, and minimize administrative overhead.

Which TWO configuration steps should a solutions architect perform to meet these requirements? (Select TWO.)

Select all that apply

Deploy an AWS Transit Gateway in each Region, associate them with a single Direct Connect Gateway, and establish a transit virtual interface (VIF) on the Direct Connect connection to terminate at the Direct Connect Gateway.

Establish Site-to-Site VPN connections terminated directly on the Transit Gateways in both Regions, and advertise the same on-premises IP prefixes via BGP over both the Direct Connect and VPN connections.

Establish a Private Virtual Interface (VIF) on the Direct Connect connection, associate it directly with a Direct Connect Gateway, and attach the Direct Connect Gateway to all 12 spoke VPCs to bypass Transit Gateway routing limits.

Configure a Route 53 Private Hosted Zone (PHZ) for the on-premises domain, associate the PHZ directly with the Direct Connect Gateway, and configure the on-premises DNS servers to forward queries to the inbound Route 53 Resolver endpoint.

Deploy a single NAT Gateway in each spoke VPC's public subnet and update the Route Tables of all private subnets to point to the NAT Gateway for cross-Region Transit Gateway routing.

Show answer & explanation

Answer: Deploy an AWS Transit Gateway in each Region, associate them with a single Direct Connect Gateway, and establish a transit virtual interface (VIF) on the Direct Connect connection to terminate at the Direct Connect Gateway.; Establish Site-to-Site VPN connections terminated directly on the Transit Gateways in both Regions, and advertise the same on-premises IP prefixes via BGP over both the Direct Connect and VPN connections.

Answer

To establish the desired hybrid network, the solutions architect must deploy an AWS Transit Gateway in each Region, associate them with a single Direct Connect Gateway, and establish a transit virtual interface on the Direct Connect connection. Additionally, they must establish Site-to-Site VPN connections terminated directly on the Transit Gateways and advertise the same prefixes over both paths.

Deploying an AWS Transit Gateway in each Region and associating them with a single Direct Connect Gateway using a transit virtual interface enables multi-account, multi-Region hybrid routing. Establishing BGP-based Site-to-Site VPN connections terminated on the Transit Gateways allows automatic failover because AWS automatically prioritizes Direct Connect paths over VPN paths when the same prefix is advertised over both.

Step-by-Step Solution

Deploy regional Transit Gateways and associate them with a centralized Direct Connect Gateway using a Transit VIF.

Establishes the primary high-bandwidth network path to both Regions for all 12 spoke VPCs.

Allows sharing the 10 Gbps Direct Connect connection across multiple accounts and Regions while avoiding individual VPC limits.

Configure Site-to-Site VPN connections from the on-premises router directly to the Transit Gateways in both Regions.

Provides backup connectivity paths in case of Direct Connect failure.

By terminating the VPNs on the Transit Gateways, they can act as failover paths for the same VPCs.

Advertise the same prefixes over both the Direct Connect BGP session and the VPN BGP sessions.

AWS routing automatically prefers the Direct Connect path over the VPN path for outbound traffic.

AWS network routing standards prioritize Direct Connect over VPN when identical routes are received.

Key Concept

AWS Transit Gateway integration with Direct Connect Gateway and Site-to-Site VPN for resilient, multi-Region hybrid routing.

Question 1933Question →

A company is planning to migrate its application workloads from an on-premises VMware vSphere cluster to a newly provisioned VMware Cloud on AWS SDDC. The migration project must accommodate two distinct workload requirements:

1. A group of critical, stateful transaction processing applications that cannot tolerate any downtime or service interruption during migration.
2. A group of multi-terabyte development database servers where data must replicate continuously in the background, with a scheduled reboot and switchover allowed during a weekend maintenance window to minimize the impact on network bandwidth.

Which two VMware HCX migration methods should the Solutions Architect select to meet these requirements? (Select TWO.)

Select all that apply

Utilize VMware HCX Replication-Assisted vMotion (RAV) to migrate the transaction processing applications in parallel batches with zero downtime.

Utilize VMware HCX Bulk Migration for the development database servers to enable background replication and schedule a low-downtime cutover.

Choose VMware HCX Cold Migration to migrate the transaction processing applications while they continue to serve active client connections.

Deploy VMware HCX OS Assisted Migration to replicate the development database servers from the on-premises VMware ESXi hosts.

Use VMware HCX vMotion for the multi-terabyte database servers to queue and replicate their storage disks in parallel before the scheduled weekend cutover.

Show answer & explanation

Answer: Utilize VMware HCX Replication-Assisted vMotion (RAV) to migrate the transaction processing applications in parallel batches with zero downtime.; Utilize VMware HCX Bulk Migration for the development database servers to enable background replication and schedule a low-downtime cutover.

Answer

Utilize VMware HCX Replication-Assisted vMotion (RAV) for the critical transaction processing workloads, and utilize VMware HCX Bulk Migration for the development database servers.

The correct options are to utilize VMware HCX Replication-Assisted vMotion (RAV) for the transaction processing applications and VMware HCX Bulk Migration for the development database servers. HCX RAV combines the parallel scheduling benefits of Bulk Migration with the live migration capabilities of vMotion, providing parallel zero-downtime migrations. HCX Bulk Migration uses host-based replication to copy data in the background, allowing the administrator to schedule a cutover that involves a brief reboot to activate the target VM, which perfectly aligns with the requirements of the database servers.

Step-by-Step Solution

Analyze the requirements for the critical transaction applications.

Identify that the applications are stateful and require batch migrations with zero downtime.

This rules out migration methods that require powering off the VMs or executing them sequentially over high-latency links.

Analyze the requirements for the development database servers.

Identify that the databases are multi-terabyte and require background replication to minimize bandwidth usage, with a scheduled switchover window.

This rules out standard live vMotion, which transfers active memory and disk states continuously and does not support scheduled cutovers.

Map the analyzed requirements to VMware HCX migration capabilities.

Match the transaction applications to VMware HCX Replication-Assisted vMotion (RAV) and the databases to VMware HCX Bulk Migration.

RAV supports zero-downtime migrations in parallel batches, and Bulk Migration replicates disk data in the background to prepare for a scheduled cutover with a brief reboot.

Key Concept

Selecting VMware HCX migration methods based on application dependency, downtime tolerance, and size requirements.

Estimated Time:2m 0s

Question 1934Question →

A hotel reservation platform is modernizing its booking confirmation service by migrating to a serverless architecture on AWS. The system must process booking events sent via an Amazon API Gateway HTTP API, parse the JSON payload using an AWS Lambda function, call an external payment processor API on the public internet, and write reservation details to an Amazon Aurora PostgreSQL database in a private subnet. The database credentials must be retrieved from AWS Secrets Manager, which is managed in a separate centralized security AWS account. During peak promotional periods, the platform experiences sudden traffic spikes of up to 10,000 requests per second. The database has a limited connection pool. The solutions architect needs to design a highly available, scalable, and secure architecture that protects the database from connection exhaustion, provides outbound internet access for the Lambda function, prevents the Lambda function from exhausting the regional account-level concurrency pool, and allows cross-account retrieval of the database credentials. Which architecture should the solutions architect implement to meet these requirements?

Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through a single NAT Gateway in one Availability Zone to optimize network costs. Deploy Amazon RDS Proxy to manage database connections. Configure reserved concurrency on the Lambda function. Use a Customer Managed Key in AWS Key Management Service (AWS KMS) with a cross-account key policy to encrypt the credentials secret.

Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through NAT Gateways deployed in each Availability Zone. Deploy Amazon RDS Proxy to manage database connections. Configure reserved concurrency on the Lambda function. Use the default AWS-managed KMS key (aws/secretsmanager) in the security account to encrypt the credentials secret, and grant the Lambda execution role cross-account decrypt permissions.

Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through NAT Gateways deployed in each Availability Zone. Deploy Amazon RDS Proxy to manage database connections. Configure reserved concurrency on the Lambda function. Use a Customer Managed Key in AWS Key Management Service (AWS KMS) with a cross-account key policy to encrypt the credentials secret in the central security account.

Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through NAT Gateways deployed in each Availability Zone. Deploy Amazon RDS Proxy to manage database connections. Use a Customer Managed Key in AWS KMS with a cross-account key policy to encrypt the credentials secret. Leave the Lambda function's concurrency unconfigured to allow the function to scale freely during peaks.

Show answer & explanation

Answer: Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through NAT Gateways deployed in each Availability Zone. Deploy Amazon RDS Proxy to manage database connections. Configure reserved concurrency on the Lambda function. Use a Customer Managed Key in AWS Key Management Service (AWS KMS) with a cross-account key policy to encrypt the credentials secret in the central security account.

Answer

Configure the Lambda function to run in private subnets across multiple Availability Zones, routing outbound internet traffic through NAT Gateways deployed in each Availability Zone. Deploy Amazon RDS Proxy to manage database connections. Configure reserved concurrency on the Lambda function. Use a Customer Managed Key in AWS Key Management Service (AWS KMS) with a cross-account key policy to encrypt the credentials secret in the central security account.

The correct architecture uses Amazon RDS Proxy to manage and pool connections to the PostgreSQL database, protecting it from exhaustion. Placing the Lambda function in private subnets spanning multiple Availability Zones with dedicated NAT Gateways ensures highly available outbound routing to external payment APIs. Configuring reserved concurrency prevents the function from scaling out of control and throttling other critical workloads in the account. Finally, using a Customer Managed Key in AWS KMS with a cross-account key policy allows the primary account's Lambda function to securely decrypt the database credentials stored in Secrets Manager in the centralized security account.

Step-by-Step Solution

Address database connection limits under scaling pressure

Amazon RDS Proxy is introduced between AWS Lambda and the Aurora PostgreSQL database.

RDS Proxy pools database connections, preventing connection exhaustion during spikes of 10,000 requests per second.

Ensure secure and highly available outbound connectivity for the Lambda function

The Lambda function is configured to run inside private subnets across multiple Availability Zones, with routing tables directing outbound traffic to NAT Gateways in each Availability Zone.

This setup allows the Lambda function to access the external payment API on the public internet while maintaining Multi-AZ high availability.

Protect the AWS account from regional Lambda throttling

Reserved concurrency is configured specifically for the booking confirmation Lambda function.

This places a hard ceiling on the number of concurrent executions for this specific function, preventing it from consuming the entire regional limit and starving other applications.

Configure secure cross-account decryption of database credentials

The credentials secret in AWS Secrets Manager is encrypted using a Customer Managed KMS key with a policy allowing cross-account decryption by the Lambda execution role.

AWS-managed KMS keys (like aws/secretsmanager) cannot have their policies modified, which prevents them from being shared across accounts.

Key Concept

Modernizing legacy workloads to serverless architectures on AWS requires a comprehensive design that manages compute scaling (concurrency), database resource limits (RDS Proxy), high availability networking (multi-AZ NAT Gateways), and cross-account security controls (KMS Customer Managed Keys).

Estimated Time:2m 0s

Question 1935Question →

A media company is designing a real-time news analytics platform to support a major global broadcasting event scheduled for a specific date and time. The platform serves dynamic data via an API hosted on Amazon ECS tasks running on AWS Fargate behind an Application Load Balancer (ALB). The API retrieves data from an Amazon Aurora MySQL database. Baseline traffic is $1,000$ requests per second, but is expected to instantly surge to $400,000$ requests per second at the start of the event. The workload is highly read-intensive. Which of the following architecture sets provides the most performant and scalable solution to handle the traffic spike without dropping requests?

Submit an AWS Support case to pre-warm the Application Load Balancer (ALB) for the expected throughput of

400,000

requests per second. Configure scheduled scaling for the ECS service to scale out Fargate tasks to a pre-calculated number of instances before the event begins. Pre-provision additional Aurora Replicas in the Amazon Aurora database cluster to handle the anticipated read query load.

Submit an AWS Support case to pre-warm the Application Load Balancer (ALB) for the expected throughput of

400,000

requests per second. Configure scheduled scaling for the ECS service to scale out Fargate tasks before the event begins, specifying the host network mode for the tasks to bypass Elastic Network Interface (ENI) provisioning latency. Pre-provision additional Aurora Replicas in the Amazon Aurora database cluster to handle the anticipated read query load.

Configure the Application Load Balancer (ALB) with Target Tracking scaling policies based on RequestCountPerTarget to dynamically scale the load balancer during the event. Configure ECS Target Tracking policies based on CPU utilization to scale out Fargate tasks. Configure Aurora Auto Scaling to dynamically provision Aurora Replicas when the primary writer instance's CPU utilization exceeds

70\%

Submit an AWS Support case to pre-warm the Application Load Balancer (ALB) for the expected throughput of

400,000

requests per second. Configure scheduled scaling for the ECS service to scale out Fargate tasks before the event begins. Configure an Amazon RDS Multi-AZ deployment and configure the application to direct read queries to the standby database instance to handle the peak read traffic.

Show answer & explanation

Answer: Submit an AWS Support case to pre-warm the Application Load Balancer (ALB) for the expected throughput of $400,000$ requests per second. Configure scheduled scaling for the ECS service to scale out Fargate tasks to a pre-calculated number of instances before the event begins. Pre-provision additional Aurora Replicas in the Amazon Aurora database cluster to handle the anticipated read query load.

Answer

The correct strategy pre-warms the Application Load Balancer (ALB), uses ECS Scheduled Scaling to prepare the container tier, and pre-provisions Amazon Aurora Replicas to absorb the database read load.

Pre-warming the ALB ensures that the entry point can handle the high network throughput immediately. Scheduled scaling for ECS Fargate ensures that the compute capacity is ready before the traffic starts. Pre-provisioning Aurora Replicas ensures that the read-heavy queries do not overwhelm the database writer node, as dynamic scaling would execute too slowly to absorb the initial peak.

Step-by-Step Solution

Determine the scaling capabilities of the load balancing tier under an instantaneous surge.

Dynamic scaling of ALBs cannot accommodate a rapid increase from

1,000

400,000

requests per second without dropping requests. Pre-warming must be requested.

Requesting ELB pre-warming ensures that AWS pre-allocates the necessary network interfaces and load-balancing capacity prior to the event.

Evaluate the scaling strategy and configuration requirements for the ECS Fargate compute tier.

ECS Fargate tasks take time to provision and bootstrap. Utilizing scheduled scaling ensures that the compute resources are active and healthy before the event. Fargate tasks must use the awsvpc network mode.

Dynamic autoscaling causes provisioning latency (cold starts), which would result in request timeouts during the initial surge.

Address the scaling constraints of the database layer for read-heavy operations.

Aurora auto-scaling takes minutes to provision new replicas. Pre-provisioning the Aurora Replicas before the event starts ensures the read database requests are successfully processed. RDS Multi-AZ standby instances cannot be read from.

Pre-provisioning prevents database CPU exhaustion and query timeouts when the instantaneous load begins.

Key Concept

Handling sudden, high-magnitude traffic spikes requires proactive pre-warming and pre-provisioning across the networking, compute, and database tiers, rather than relying on reactive dynamic scaling.

Question 1936Question →

A global sports streaming network is launching an interactive prediction platform for a major live event expecting over $15\text{ million}$ concurrent active viewers. At key moments during the live broadcast, viewers will submit predictions, generating sudden, unannounced telemetry write spikes peaking at $2.5\text{ million}$ requests per second. The system must ingest these writes without dropping connections and serve real-time leaderboard statistics with sub-millisecond latency. Which architecture meets these performance and scalability requirements with the lowest operational overhead?

Deploy a Network Load Balancer (NLB) to ingest prediction traffic, routing to Amazon ECS tasks on AWS Fargate. Configure the tasks to write prediction events to Amazon Kinesis Data Streams. Process the stream using AWS Lambda in batches to aggregate predictions before updating the Amazon Aurora PostgreSQL database. Cache real-time leaderboard statistics in Amazon ElastiCache for Redis (Cluster Mode Enabled) to serve read queries.

Deploy an Application Load Balancer (ALB) to distribute prediction traffic to Amazon ECS tasks on AWS Fargate. Configure ECS Auto Scaling based on CPU utilization to scale tasks during the live event. Have the tasks write predictions directly to Amazon Aurora PostgreSQL, and configure Aurora Auto Scaling to dynamically provision new Aurora Replicas to handle the leaderboard read traffic.

Deploy a Network Load Balancer (NLB) routing to Amazon ECS tasks on AWS Fargate. Have the tasks write prediction events directly to an Amazon Aurora PostgreSQL database with Multi-AZ deployment. Scale the leaderboard read queries by routing read traffic to the passive Multi-AZ standby database instance, and configure Aurora Auto Scaling based on replication lag.

Deploy an Application Load Balancer (ALB) to ingest prediction traffic, routing to Amazon ECS tasks on AWS Fargate. Submit an AWS Support request to pre-warm the ALB to handle the expected peak. Configure the Fargate tasks to write predictions directly to an Amazon DynamoDB table in Provisioned Capacity Mode with Auto Scaling enabled, and deploy DynamoDB Accelerator (DAX) to cache leaderboard read queries.

Show answer & explanation

Answer: Deploy a Network Load Balancer (NLB) to ingest prediction traffic, routing to Amazon ECS tasks on AWS Fargate. Configure the tasks to write prediction events to Amazon Kinesis Data Streams. Process the stream using AWS Lambda in batches to aggregate predictions before updating the Amazon Aurora PostgreSQL database. Cache real-time leaderboard statistics in Amazon ElastiCache for Redis (Cluster Mode Enabled) to serve read queries.

Answer

The architecture that uses a Network Load Balancer (NLB) to route to Amazon ECS tasks, writes predictions to Amazon Kinesis Data Streams, aggregates the writes in batches using AWS Lambda, updates Amazon Aurora PostgreSQL, and caches the leaderboard reads using Amazon ElastiCache for Redis (Cluster Mode Enabled).

The correct architecture uses a Network Load Balancer (NLB) which is built to handle sudden, unannounced spikes of millions of requests per second without pre-warming. By routing the prediction writes to Amazon ECS tasks that write directly to Amazon Kinesis Data Streams, the ingestion tier is successfully decoupled from the database. AWS Lambda acts as an aggregator to perform batch writes to the Amazon Aurora PostgreSQL database, preventing write exhaustion. Amazon ElastiCache for Redis (Cluster Mode Enabled) scales read operations horizontally and satisfies the sub-millisecond query latency requirement for the leaderboard.

Step-by-Step Solution

Select the appropriate load balancer for sudden, unannounced spikes.

Choose a Network Load Balancer (NLB) because it is designed to handle sudden spikes of millions of requests per second without pre-warming, unlike an Application Load Balancer (ALB) which would fail to scale in time and drop connections.

To prevent connection drops during instantaneous traffic bursts.

Buffer the incoming high-volume writes before they reach the database.

Write prediction events directly to Amazon Kinesis Data Streams from the Amazon ECS tasks.

Amazon Kinesis Data Streams serves as a durable ingestion buffer that can scale horizontally by increasing the number of shards, avoiding database write bottlenecks.

Aggregate the buffered predictions to minimize database write operations.

Configure AWS Lambda to pull batches of events from Kinesis, aggregate the predictions, and perform bulk writes to the Amazon Aurora PostgreSQL database.

Writing raw events individually at a rate of

2.5\text{ million}

per second would saturate the database writer instance.

Scale the read queries for real-time leaderboard statistics.

Cache the real-time leaderboard statistics in Amazon ElastiCache for Redis (Cluster Mode Enabled).

ElastiCache for Redis provides sub-millisecond read latency and horizontal scaling to handle the massive viewer query volume without putting load on the primary database.

Key Concept

Handling instantaneous, massive write spikes requires decoupling ingestion from storage using a highly scalable buffer like Kinesis Data Streams, combined with an NLB for network-level scaling and ElastiCache for horizontal read scalability.

Question 1937Question →

A digital banking platform is designing a new multi-region credit card processing system on AWS. The system must be deployed in us-east-1 (Primary) and us-west-2 (Secondary). The architecture requires a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 15 minutes. During normal operations, global users must be routed to the region with the lowest latency, and local reads must be served from the nearest region to minimize response times. If the application in the primary region fails, traffic must failover to the secondary region automatically within 5 minutes. Outbound payment network calls from the application instances must remain highly available even if a single Availability Zone experiences an outage. The design should minimize operational complexity while meeting these requirements.

Which of the following architectures meets these requirements?

Deploy the application on Amazon ECS in both Regions behind Application Load Balancers (ALBs). Configure Amazon Route 53 with Latency-based routing records for both ALBs, with Route 53 health checks associated with each record. Deploy an Amazon Aurora Global Database with the writer cluster in us-east-1 and a reader cluster in us-west-2. Deploy a single NAT Gateway in each VPC in the first Availability Zone, and update all private subnet route tables to route outbound internet traffic through this single NAT Gateway.

Deploy the application on Amazon ECS in us-east-1 behind an Application Load Balancer (ALB). Configure Amazon Route 53 with Failover routing to direct traffic to us-east-1 as primary and an Amazon S3 static website hosting a maintenance page in us-west-2 as secondary. Use Amazon Aurora Serverless v2 in us-east-1, take hourly database snapshots, copy them to us-west-2, and use AWS CloudFormation to restore the environment during a disaster.

Deploy the application on Amazon ECS in both Regions behind Application Load Balancers (ALBs). Configure Amazon Route 53 with Latency-based routing records for both ALBs, with Route 53 health checks associated with each record. Deploy an Amazon Aurora Global Database with the writer cluster in us-east-1 and a reader cluster in us-west-2. Deploy NAT Gateways in every Availability Zone within each Region's VPC, updating the private subnet route tables to route outbound internet traffic through the local NAT Gateway in the same zone.

Deploy the application on Amazon ECS in both Regions behind Application Load Balancers (ALBs). Configure Amazon Route 53 with Latency-based routing records for both ALBs, with Route 53 health checks associated with each record. Deploy Amazon RDS for PostgreSQL in us-east-1, and configure an Amazon RDS Multi-AZ standby instance in us-west-2, instructing the ECS tasks in the secondary region to query the standby instance directly to serve local read requests. Deploy NAT Gateways in every Availability Zone within each Region's VPC.

Show answer & explanation

Answer: Deploy the application on Amazon ECS in both Regions behind Application Load Balancers (ALBs). Configure Amazon Route 53 with Latency-based routing records for both ALBs, with Route 53 health checks associated with each record. Deploy an Amazon Aurora Global Database with the writer cluster in us-east-1 and a reader cluster in us-west-2. Deploy NAT Gateways in every Availability Zone within each Region's VPC, updating the private subnet route tables to route outbound internet traffic through the local NAT Gateway in the same zone.

Answer

Deploy the application on Amazon ECS in both Regions behind ALBs, configure Route 53 Latency-based routing with health checks, use Amazon Aurora Global Database with a primary in us-east-1 and a secondary in us-west-2, and deploy NAT Gateways in every Availability Zone in each Region's VPC.

The correct architecture uses Amazon Aurora Global Database to achieve cross-region replication lag of less than a second, while allowing the reader cluster in the secondary region to serve local reads. Amazon Route 53 with Latency-based routing and health checks ensures users are sent to the nearest healthy region and handles automatic failover. High availability of outbound traffic is achieved by deploying redundant NAT Gateways across all Availability Zones.

Step-by-Step Solution

Select a multi-region database solution that supports sub-second cross-region replication and local read scaling to meet the 5-second RPO and local read latency requirements.

Amazon Aurora Global Database provides asynchronous cross-region replication (typically under 1 second) and allows the secondary cluster to serve local reads, fulfilling both database requirements.

Standard multi-region snapshot copies have too high an RPO, and RDS Multi-AZ standbys are located in the same region and do not serve read traffic.

Configure the DNS routing policy to route users based on latency and automatically failover when a region is unhealthy.

Amazon Route 53 Latency-based routing records associated with health checks automatically direct users to the region with the lowest latency and stop routing traffic to a degraded region within minutes of a health check failure.

Without health checks, Route 53 cannot perform automatic failover, and static failover policies do not direct active users to the lowest-latency healthy region.

Ensure outbound connectivity from private subnets is highly available in the event of an Availability Zone outage.

Deploying a dedicated NAT Gateway in each Availability Zone prevents a single point of failure. If an Availability Zone fails, only that zone's resources are affected, and resources in other zones continue using their local NAT Gateways.

Routing all private subnet traffic through a single NAT Gateway in a single Availability Zone creates a single point of failure for the entire VPC.

Key Concept

High Availability and Disaster Recovery Design for Multi-Region Architectures

Question 1938Question →

An enterprise is migrating a legacy B2B transaction processing application to a serverless architecture on AWS. External customer accounts must securely access the API without traversing the public internet. The backend consists of AWS Lambda functions running inside a private VPC subnet that write transactions to an Amazon Aurora PostgreSQL database. During peak B2B upload cycles, the database suffers from connection exhaustion. The Solutions Architect needs to design a secure, highly scalable, and cost-effective solution.

Which TWO actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Select all that apply

Deploy a private Amazon API Gateway endpoint in the provider account, and instruct consumers to configure an interface VPC endpoint for API Gateway in their own VPCs. Apply an API Gateway resource policy that restricts access to the VPC endpoint IDs of the consumers.

Provision an Amazon RDS Proxy in the private subnets where the database resides and configure the Lambda functions to point to the proxy endpoint. Configure reserved concurrency on the Lambda functions.

Configure client-side connection pooling within the Lambda function's initialization code to manage database connections. Leave the regional account concurrency pool unconfigured so the Lambda functions can scale dynamically.

Configure an Application Load Balancer to route traffic to the Lambda functions, and deploy a Route 53 weighted routing policy between two ALBs to execute zero-downtime rolling canary deployments for function updates.

Deploy a single NAT Gateway in a public subnet to route outbound database traffic from the Lambda functions in the private subnets to the Aurora PostgreSQL database over the public internet using the public database endpoint.

Configure API Gateway to encrypt the incoming payloads using the default AWS-managed KMS key for API Gateway, and update the default key policy to delegate cross-account decryption access to the IAM roles in the consumer AWS accounts.

Show answer & explanation

Answer: Deploy a private Amazon API Gateway endpoint in the provider account, and instruct consumers to configure an interface VPC endpoint for API Gateway in their own VPCs. Apply an API Gateway resource policy that restricts access to the VPC endpoint IDs of the consumers.; Provision an Amazon RDS Proxy in the private subnets where the database resides and configure the Lambda functions to point to the proxy endpoint. Configure reserved concurrency on the Lambda functions.

Answer

Deploy a private Amazon API Gateway endpoint with cross-account interface VPC endpoints and an API Gateway resource policy to restrict access. Additionally, provision an Amazon RDS Proxy in the private subnets and configure reserved concurrency on the Lambda functions.

Deploying a private API Gateway endpoint combined with interface VPC endpoints in consumer accounts secures cross-account communication over the AWS backbone network without exposure to the public internet. Restricting access using resource policies ensures only authorized consumers can reach the API. Additionally, using Amazon RDS Proxy resolves database connection exhaustion by pooling connections from Lambda execution environments, while configuring reserved concurrency controls the maximum concurrent executions of the Lambda functions, protecting the database from overloading and preventing the exhaustion of the regional Lambda concurrency limit.

Step-by-Step Solution

Select the correct cross-account private API access mechanism.

A private API Gateway endpoint is created, with interface VPC endpoints deployed in the consumer accounts and a resource policy applied to restrict access to those VPC endpoint IDs.

This configuration routes API calls privately over the AWS backbone network without exposing endpoints to the public internet.

Address database connection limits under serverless scale-out.

An Amazon RDS Proxy is provisioned in the VPC's private subnets, and the Lambda functions are updated to target the proxy endpoint.

Because Lambda functions are short-lived and scale horizontally, client-side connection pooling is ineffective. RDS Proxy pools and shares connections to prevent database connection exhaustion.

Apply concurrency controls at the compute layer.

Reserved concurrency is configured on the target Lambda functions.

Reserved concurrency prevents a traffic spike from consuming all available concurrency in the AWS region, which protects other workloads from throttling and sets an upper limit on connections spawned toward the RDS Proxy.

Key Concept

API Gateway private endpoints enable secure cross-account API integrations via interface VPC endpoints, while Amazon RDS Proxy and reserved concurrency mitigate database connection limits and account-level throttling in highly concurrent Lambda architectures.

Question 1939Question →

An enterprise is migrating 25 critical business application virtual machines (VMs) from an on-premises VMware vSphere 7.0 cluster to a VMware Cloud on AWS (VMC on AWS) Software-Defined Data Center (SDDC). The database VMs are highly sensitive to latency and write transactions continuously, requiring zero downtime during migration (recovery time objective (RTO) of zero). The application components use hardcoded IP addresses that cannot be changed during the migration. The enterprise has a multi-account AWS structure and requires that the migrated VMs privately resolve DNS names in an Amazon Route 53 Private Hosted Zone (PHZ) hosted in a shared services AWS account. In addition, the VMs in the SDDC must communicate privately with resources in multiple spoke VPCs across different AWS accounts. The network between the on-premises datacenter and AWS is a 10 Gbps AWS Direct Connect connection. Which migration and networking strategy should the Solutions Architect implement to satisfy these requirements?

Extend the on-premises network using VMware HCX Network Extension to preserve VM IP addresses. Use HCX Bulk Migration to replicate and migrate the VMs in a single parallel batch. Connect the VMC on AWS SDDC to the spoke VPCs using VMware Transit Connect, and associate the Route 53 Private Hosted Zone in the shared services account with the Connected VPC in the customer AWS account.

Extend the on-premises network using VMware HCX Network Extension to preserve VM IP addresses. Use HCX Replication-Assisted vMotion (RAV) to migrate the VMs with zero downtime. Connect the VMC on AWS SDDC to the spoke VPCs using VMware Transit Connect, and associate the Route 53 Private Hosted Zone in the shared services account with the Connected VPC in the customer AWS account.

Extend the on-premises network using VMware HCX Network Extension to preserve VM IP addresses. Use HCX Replication-Assisted vMotion (RAV) to migrate the VMs with zero downtime. Connect the VMC on AWS SDDC and the spoke VPCs directly to a shared AWS Direct Connect Gateway to enable inter-VPC and SDDC communication, and associate the Route 53 Private Hosted Zone in the shared services account with the Connected VPC in the customer AWS account.

Extend the on-premises network using VMware HCX Network Extension to preserve VM IP addresses. Use HCX Replication-Assisted vMotion (RAV) to migrate the VMs with zero downtime. Connect the VMC on AWS SDDC to the spoke VPCs using VMware Transit Connect, and deploy Route 53 Resolver endpoints in the shared services account without associating the Private Hosted Zone with the Connected VPC.

Show answer & explanation

Answer: Extend the on-premises network using VMware HCX Network Extension to preserve VM IP addresses. Use HCX Replication-Assisted vMotion (RAV) to migrate the VMs with zero downtime. Connect the VMC on AWS SDDC to the spoke VPCs using VMware Transit Connect, and associate the Route 53 Private Hosted Zone in the shared services account with the Connected VPC in the customer AWS account.

Answer

The correct strategy is to extend the on-premises network using VMware HCX Network Extension, migrate the virtual machines using HCX Replication-Assisted vMotion (RAV) to avoid downtime, route multi-account traffic using VMware Transit Connect, and associate the Route 53 Private Hosted Zone with the Connected VPC in the customer account.

The correct answer correctly addresses the requirements for network extension, zero-downtime migration, and multi-account connectivity. VMware HCX Network Extension extends the L2 network to preserve VM IP addresses. HCX Replication-Assisted vMotion (RAV) allows parallel background replication of multiple VMs with a zero-downtime hot switchover. VMware Transit Connect provides high-bandwidth, low-latency connectivity between VMC SDDCs and multiple VPCs. Finally, associating the Private Hosted Zone with the Connected VPC in the customer AWS account ensures private DNS resolution works for the migrated VMs.

Step-by-Step Solution

Extend the on-premises L2 network using VMware HCX Network Extension.

Ensures that VMs can retain their existing IP addresses after migrating to VMware Cloud on AWS, avoiding complex application reconfigurations.

The application components have hardcoded IP addresses that cannot be changed.

Migrate the virtual machines using VMware HCX Replication-Assisted vMotion (RAV).

Replicates VM data in the background and switches over to VMware Cloud on AWS with zero downtime.

The database VMs write transactions continuously and require an RTO of zero (no downtime).

Establish multi-account network connectivity using VMware Transit Connect.

Routes traffic between the VMC on AWS SDDC and multiple spoke VPCs across different AWS accounts.

Direct Connect Gateway does not support transitive routing between attached VPCs, making Transit Connect necessary.

Associate the Route 53 Private Hosted Zone (PHZ) in the shared services account with the Connected VPC of the VMC SDDC.

Allows VMs in the SDDC to resolve private DNS names defined in the PHZ.

Route 53 PHZs require explicit association with the VPC from which DNS queries originate; DNS resolution is not transitive over Transit Gateway connections.

Key Concept

Integrating VMware Cloud on AWS (VMC) migrations using HCX Replication-Assisted vMotion (RAV) with AWS multi-account hybrid networking (Transit Connect and Route 53 Private Hosted Zones).

Estimated Time:3m 0s

Question 1940Question →

A healthcare software-as-a-service (SaaS) provider uses AWS Organizations to manage $110$ member accounts. To meet strict regulatory auditing requirements, a Solutions Architect must design a solution that automatically aggregates AWS CloudTrail logs from all AWS Regions and all current and future member accounts. The logs must be stored in a single centralized Amazon S3 bucket located in a dedicated security operations account. The architecture must enforce that all logs are encrypted at rest using a customer managed KMS key. To prevent tampering, administrators of the member accounts must not have permission to decrypt the stored logs, nor should they be able to modify or delete the logging configuration. Which TWO actions must the Solutions Architect take to design a secure and compliant centralized logging architecture? (Select TWO.)

Select all that apply

Configure the S3 bucket policy in the dedicated security operations account to allow the "cloudtrail.amazonaws.com" service principal to perform "s3:PutObject" actions, restricted by a condition checking the organization ID. Configure the customer managed KMS key policy in the security operations account to allow "cloudtrail.amazonaws.com" to perform "kms:GenerateDataKey*" and "kms:DescribeKey" actions, restricted by the same organization ID condition.

Create an organization trail from the management account (or delegated administrator account) of the AWS Organization. Configure the trail to deliver log files to the centralized S3 bucket in the dedicated security operations account, and configure it to use the Amazon Resource Name (ARN) of the customer managed KMS key located in the security operations account for encryption.

Deploy a Service Control Policy (SCP) to all organizational units (OUs) that allows member accounts to write logs to the centralized S3 bucket, and configure each member account to assume a role in the security operations account to run local CloudTrail trails.

Enable default S3 bucket encryption on the centralized S3 bucket using the AWS-managed KMS key (aws/s3). Rely on AWS-managed S3 bucket keys to automatically handle cross-account key permissions and ensure that member accounts are restricted from decrypting the logs.

Create an S3 bucket policy in the dedicated security operations account that grants "s3:PutObject" permissions to the root principal of each member account, and use S3 Object Lock in compliance mode to prevent the member accounts from reading or modifying the files.

Show answer & explanation

Answer: Configure the S3 bucket policy in the dedicated security operations account to allow the "cloudtrail.amazonaws.com" service principal to perform "s3:PutObject" actions, restricted by a condition checking the organization ID. Configure the customer managed KMS key policy in the security operations account to allow "cloudtrail.amazonaws.com" to perform "kms:GenerateDataKey*" and "kms:DescribeKey" actions, restricted by the same organization ID condition.; Create an organization trail from the management account (or delegated administrator account) of the AWS Organization. Configure the trail to deliver log files to the centralized S3 bucket in the dedicated security operations account, and configure it to use the Amazon Resource Name (ARN) of the customer managed KMS key located in the security operations account for encryption.

Answer

Configure the S3 bucket policy in the dedicated security operations account to allow the CloudTrail service principal to perform write actions restricted by the organization ID, and configure the customer managed KMS key policy to allow CloudTrail to generate data keys. Additionally, create an organization trail from the management account or delegated administrator account, pointing to the centralized S3 bucket and the customer managed KMS key.

The correct architecture requires creating an organization trail from the management account or a delegated administrator account. This automatically configures and deploys CloudTrail across all member accounts (including future ones) and prevents local member account administrators from disabling or modifying the configuration. Additionally, the centralized S3 bucket policy and the KMS key policy in the security operations account must allow the 'cloudtrail.amazonaws.com' service principal to perform 's3:PutObject' and 'kms:GenerateDataKey*'/'kms:DescribeKey' actions respectively, scoped by the organization ID using the 'aws:PrincipalOrgID' condition. This allows cross-account log delivery and encryption while preventing member accounts from decrypting the logs.

Step-by-Step Solution

Set up S3 bucket permissions and KMS key policies in the dedicated security operations account.

The centralized S3 bucket has a policy permitting 's3:PutObject' by the 'cloudtrail.amazonaws.com' service principal under the condition that the 'aws:PrincipalOrgID' matches the AWS Organization ID. The customer managed KMS key has a policy permitting 'kms:GenerateDataKey*' and 'kms:DescribeKey' for the CloudTrail service principal under the same condition, without granting decrypt permissions to the member accounts.

Allows CloudTrail to write logs and generate data keys for encryption across all accounts under the organization, while preventing member account access to decrypt the logs.

Create an organization trail from the organization's management account or a delegated administrator account.

An organization trail is established, which automatically propagates to all current and future member accounts across all AWS Regions.

Ensures complete visibility and logging compliance for the entire organization, prevents local administrators in member accounts from modifying or deleting the trail configuration, and directs logs to the centralized S3 bucket.

Key Concept

Centralized cross-account auditing using AWS Organizations, organization trails, and customer managed KMS keys.

Estimated Time:3m 0s

PreviousPage 97 / 99Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept