Examkin

All practice questions

1964 questions

All types1,964Multiple choice1,006Multiple select931Ordering27
Question 1941Question →

An enterprise architecture team is designing a deployment workflow for a critical customer-facing microservice running on Amazon ECS with the AWS Fargate launch type behind an Application Load Balancer. The update process must be managed using AWS CloudFormation. The team requires a traffic shifting model that shifts 10%10\% of production traffic to the new version initially, and then progressively increases the traffic by 10%10\% every 55 minutes until the new version handles 100%100\% of the traffic. If any CloudWatch alarms are triggered during the deployment or during a subsequent 1515-minute monitoring window, the deployment must automatically roll back.

Which configuration represents the most operationally efficient method to achieve these requirements?

Show answer & explanation

Answer: Define the ECS service deployment controller type as `CodeDeploy` in the CloudFormation template. Use the `AWS::CodeDeploy::BlueGreen` hook to manage the deployment. Create a custom CodeDeploy deployment configuration specifying a time-based linear traffic routing of 10%10\% every 55 minutes. Configure the CodeDeploy deployment group with two target groups, associate the target CloudWatch alarms, and set the original task set termination wait time to 1515 minutes with automatic rollback enabled.

Answer

The configuration that sets the ECS service deployment controller to CodeDeploy, utilizes the CloudFormation BlueGreen hook, defines a custom linear deployment configuration of 10% every 5 minutes, and sets the original task set termination wait time to 15 minutes is correct.
The correct option natively integrates AWS CloudFormation, Amazon ECS, and AWS CodeDeploy. By declaring the ECS service deployment controller as `CodeDeploy` and using the `AWS::CodeDeploy::BlueGreen` transform hook, CloudFormation delegates the update process to CodeDeploy. CodeDeploy handles traffic shifting using two target groups, applying the custom time-based linear configuration (10%10\% every 55 minutes). The 1515-minute baking period is configured using the original task set's termination wait time; if any associated CloudWatch alarms trigger during this interval, CodeDeploy automatically rolls back the traffic to the original task set without downtime.

Step-by-Step Solution

1
Determine the appropriate deployment controller and integration method for CloudFormation.
Identify that the ECS service must use `DeploymentController: { Type: 'CODE_DEPLOY' }` and the CloudFormation template must invoke the `AWS::CodeDeploy::BlueGreen` hook to intercept updates and delegate traffic routing to CodeDeploy.
This enables native CloudFormation-managed Blue/Green updates, eliminating custom scripting.
2
Define the traffic shifting configuration in CodeDeploy.
Create a custom CodeDeploy deployment configuration since the native configurations (like `CodeDeployDefault.ECSLinear10PercentEvery1Minutes` or `CodeDeployDefault.ECSLinear10PercentEvery3Minutes`) do not match the required 10%10\% every 55 minutes cadence.
Custom configurations allow custom linear shifting percentages and intervals.
3
Configure target groups and the baking period monitoring requirements.
Provide two target groups to the deployment group (one active production target group and one replacement target group). Set the 'termination wait time' for the original task set to 1515 minutes.
Two target groups are mandatory for CodeDeploy ECS deployments to route traffic. The termination wait time acts as the post-deployment baking/monitoring window during which the old task set remains active and ready for rapid rollback.
4
Configure automatic rollback behaviors.
Associate the CloudWatch alarms with the CodeDeploy deployment group and configure automatic rollback on alarm execution.
If an alarm transitions to the ALARM state during traffic routing or the 1515-minute post-traffic shift window, CodeDeploy immediately shifts traffic back to the old target group and terminates the replacement task set.

Key Concept

AWS CloudFormation blue/green deployments for Amazon ECS using AWS CodeDeploy target groups and lifecycle/termination wait times.
Question 1942Question →

A company runs a high-traffic web application on AWS Elastic Beanstalk in a load-balanced environment. The development team needs to deploy updates with minimal risk. The deployment strategy must meet the following requirements:
- A small portion of actual production traffic (10%10\%) must be routed to the new version initially.
- The new version must be evaluated using this traffic for 1515 minutes.
- If the new version exhibits issues or fails health checks during the evaluation period, the traffic must be immediately redirected back to the old version without any downtime.
- If no issues are detected, the deployment must automatically complete by routing 100%100\% of traffic to the new version.

Which deployment policy should the solutions architect configure in Elastic Beanstalk to satisfy these requirements?

Show answer & explanation

Answer: Configure the Elastic Beanstalk deployment policy to Traffic Splitting. Set the split percentage to 10%10\% and the evaluation time to 1515 minutes.

Answer

Configure the Elastic Beanstalk deployment policy to Traffic Splitting. Set the split percentage to 10%10\% and the evaluation time to 1515 minutes.
The Traffic Splitting deployment policy in AWS Elastic Beanstalk is designed precisely for canary testing. It launches a new version of the application in a temporary Auto Scaling group, routes a designated percentage of incoming traffic (in this case, 10%10\%) to it for a specified evaluation period (1515 minutes), and monitors health. If the new version passes health checks, Elastic Beanstalk promotes it to the primary environment and terminates the old instances. If health checks fail or an alarm triggers, it immediately shifts traffic back to the old version and terminates the new instances, ensuring zero downtime and immediate rollback.

Step-by-Step Solution

1
Analyze the requirements for canary testing, traffic evaluation window (1515 minutes), and immediate automatic rollback.
Identify that the deployment must split traffic at the load balancer level (10%10\% to the new version, 90%90\% to the old) and automatically promote or roll back based on performance.
This determines the necessary features of the Elastic Beanstalk deployment policy.
2
Evaluate the native AWS Elastic Beanstalk deployment policies (All at once, Rolling, Rolling with additional batch, Immutable, Traffic splitting) against the requirements.
Only Traffic Splitting supports routing a portion of active traffic to a temporary Auto Scaling group while retaining the old instances, evaluating for a specified duration, and performing an automatic cleanup or rollback.
Choosing a native policy minimizes operational complexity and avoids custom scripting.

Key Concept

AWS Elastic Beanstalk Traffic Splitting deployment policy for canary testing
Question 1943Question →

A telemetry company is designing a new vehicle tracking system. The system receives data from 200,000200,000 active devices. Due to a daily batch update from a partner API, the system experiences a sudden, instant spike in read queries on the product database, rising from 500500 queries per second to 30,00030,000 queries per second within 3030 seconds. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) and uses an Amazon RDS for PostgreSQL Multi-AZ DB instance. Which configuration should the solutions architect implement to scale the system for these sudden traffic spikes while minimizing query latency?

Show answer & explanation

Answer: Submit a support case to AWS to pre-warm the Application Load Balancer prior to the daily update window, deploy Amazon RDS PostgreSQL Read Replicas, and configure the application to route read queries to the Read Replica endpoints.

Answer

Submit a support case to AWS to pre-warm the Application Load Balancer prior to the daily update window, deploy Amazon RDS PostgreSQL Read Replicas, and configure the application to route read queries to the Read Replica endpoints.
The correct solution addresses the limitations of both the load balancer and the database during sudden, extreme spikes. First, because the load balancer cannot scale instantly to handle a 6060-fold spike within 3030 seconds, pre-warming by AWS Support is required. Second, standard RDS Multi-AZ deployments use a passive standby database that cannot accept connections; therefore, to scale reads, the solutions architect must deploy RDS Read Replicas and point the application's read queries to the replica endpoints.

Step-by-Step Solution

1
Analyze the load balancer scaling characteristics for the rapid traffic spike.
Identify that the traffic increases from 500500 to 30,00030,000 requests per second within 3030 seconds, which exceeds the normal scaling rate of the Application Load Balancer. This requires pre-warming by AWS Support.
Default scaling of the load balancer is gradual. A sudden surge can cause latency and dropped connections if the load balancer has not pre-scaled.
2
Analyze the database scaling capability for high-volume read traffic.
Determine that the Amazon RDS Multi-AZ standby instance cannot serve read queries, necessitating the creation of dedicated RDS Read Replicas to offload the read traffic from the primary writer instance.
Amazon RDS Multi-AZ standby instances are passive and do not accept incoming connections. Horizontal read scaling must be handled by Read Replicas.
3
Combine the load balancer and database tier solutions.
Formulate a configuration consisting of requesting ALB pre-warming and routing queries to the newly deployed Read Replica endpoints.
This dual-tier optimization ensures that both the ingestion/entry point (ALB) and the data storage layer (RDS) scale seamlessly under flash traffic conditions.

Key Concept

Handling sudden flash traffic spikes requires pre-warming the load balancer and offloading read queries to Read Replicas, since standard RDS Multi-AZ standby instances cannot serve read traffic.
Estimated Time:2m 0s
Question 1944Question →

A financial SaaS company is designing a new multi-region disaster recovery (DR) architecture for its customer portal. The application is deployed across us-east-1 (Primary) and us-west-2 (Secondary) behind Application Load Balancers. The database layer uses Amazon Aurora. The portal requires private DNS resolution for internal microservices across both VPCs via a Route 53 Private Hosted Zone (PHZ). The company needs to design a cost-effective DR strategy that meets a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. Which of the following architectures meets these requirements while minimizing costs?

Show answer & explanation

Answer: Configure Amazon Aurora Global Database with the primary database cluster in us-east-1 and a warm standby cluster in us-west-2 containing a single Aurora Replica. Deploy redundant NAT Gateways across multiple Availability Zones in the VPCs of both Regions. Associate the Route 53 Private Hosted Zone with the VPCs in both us-east-1 and us-west-2. Create a Route 53 Failover routing record group pointing to the Application Load Balancer in each Region.

Answer

The configuration that sets up Amazon Aurora Global Database with redundant NAT Gateways in both Regions, associates the Route 53 Private Hosted Zone with both VPCs, and configures Route 53 Failover routing.
The correct architecture uses Amazon Aurora Global Database to achieve near-zero replication lag, satisfying the 1-minute RPO. It deploys redundant NAT Gateways across multiple Availability Zones in each VPC to eliminate single points of failure for outbound traffic. It also associates the Private Hosted Zone with both VPCs, ensuring private DNS resolution remains operational across regions during a failover.

Step-by-Step Solution

1
Evaluate the database replication strategy against RPO limits.
Amazon Aurora Global Database provides sub-second cross-region replication lag, which easily satisfies the 1-minute RPO requirement.
This is needed because daily snapshot strategies fail to meet the required low data-loss window.
2
Ensure outbound connectivity is highly available.
Redundant NAT Gateways are deployed in multiple Availability Zones within each VPC.
This is needed to avoid a single point of failure if an entire Availability Zone experiences an outage.
3
Associate the Route 53 Private Hosted Zone with all client VPCs.
The Private Hosted Zone is associated with both the us-east-1 and us-west-2 VPCs.
This is needed because internal private DNS resolution does not transitively resolve across VPC boundaries without explicit VPC association.

Key Concept

Multi-region high availability and disaster recovery architecture integrating Aurora Global Database, Private Hosted Zone VPC associations, and NAT Gateway redundancy.
Question 1945Question →

An enterprise manages a multi-account AWS environment with 4040 spoke VPCs in a single AWS Region. The spokes are split equally: 2020 Production VPCs and 2020 Development VPCs. The enterprise is designing a centralized egress architecture using AWS Transit Gateway and a centralized Services VPC.

The architecture must satisfy the following requirements:
- All outbound internet traffic from all spoke VPCs must be inspected by a cluster of virtual security appliances in the Services VPC before exiting to the internet.
- High availability must be maintained across all traffic paths, with no single points of failure.
- Production VPCs must be able to communicate with each other.
- Development VPCs must be isolated from each other and must not be able to communicate with Production VPCs.
- Spoke VPCs must not contain local NAT Gateways to minimize operational costs.

Which Transit Gateway routing and network architecture meets these requirements with the least administrative overhead?

Show answer & explanation

Answer: Create three Transit Gateway route tables: a Production Route Table, a Development Route Table, and a Services Route Table. Associate the Production VPCs with the Production Route Table, enable route propagation from the Production VPCs, and add a static default route (0.0.0.0/00.0.0.0/0) pointing to the Services VPC attachment. Associate the Development VPCs with the Development Route Table, disable route propagation, and add a static default route (0.0.0.0/00.0.0.0/0) pointing to the Services VPC attachment. Associate the Services VPC with the Services Route Table and enable route propagation from all spoke VPCs. In the Services VPC, deploy the security appliances and a NAT Gateway in a public subnet in each Availability Zone, and configure subnet route tables to route outbound traffic to the local NAT Gateway.

Answer

Create three Transit Gateway route tables: a Production Route Table, a Development Route Table, and a Services Route Table. Associate the Production VPCs with the Production Route Table, enable route propagation from the Production VPCs, and add a static default route pointing to the Services VPC. Associate the Development VPCs with the Development Route Table, disable route propagation, and add a static default route pointing to the Services VPC. Associate the Services VPC with the Services Route Table and enable route propagation from all spoke VPCs. In the Services VPC, deploy the security appliances and a NAT Gateway in a public subnet in each Availability Zone, routing outbound traffic to the local NAT Gateway.
The correct architecture uses three Transit Gateway route tables to segment routing domains at the network layer. Production VPCs propagate their CIDRs to the Production Route Table, allowing them to route to each other, while a default route directs internet traffic to the Services VPC. Development VPCs associate with a table that has no propagations, ensuring they cannot route to each other or to Production VPCs, while their default route also points to the Services VPC. In the Services VPC, deploying NAT Gateways and appliances across multiple Availability Zones ensures there is no single point of failure.

Step-by-Step Solution

1
Isolate the traffic domains using separate Transit Gateway route tables.
Create a Production Route Table and a Development Route Table to isolate the association domains.
This allows different propagation behaviors for Production (which need to talk to each other) and Development (which must be isolated).
2
Configure route propagation and default routing on the Transit Gateway.
Enable propagation from Production VPCs to the Production Route Table, but disable propagation in the Development Route Table. Add a static default route (0.0.0.0/00.0.0.0/0) pointing to the Services VPC attachment in both tables.
This configuration allows Production VPCs to learn routes to each other while forcing all other traffic (including all Development traffic) to follow the default route to the Services VPC.
3
Ensure return paths are configured correctly by propagating all spoke routes to the Services VPC.
Associate the Services VPC attachment with the Services Route Table and propagate routes from both Production and Development spoke VPCs.
The security appliances in the Services VPC need return routes to send inspected traffic back to the correct spoke VPCs.
4
Design high availability for egress in the centralized Services VPC.
Deploy the virtual security appliances and NAT Gateways across multiple Availability Zones in the Services VPC, using local subnet routing to direct egress traffic.
This prevents cross-AZ dependencies and ensures that an outage in a single Availability Zone does not disrupt internet egress for the entire multi-account organization.

Key Concept

AWS Transit Gateway supports multiple route tables to enforce network isolation at scale. By controlling route associations and propagations, you can allow inter-VPC communication for some environments (Production) while completely isolating others (Development) without managing complex security groups or firewall rules for local routing. Furthermore, centralized egress filtering must employ multi-AZ NAT Gateways to maintain high availability.
Question 1946Question →

A company is designing a centralized compliance logging solution on AWS. The architecture consists of multiple member accounts within an AWS Organization and a dedicated Security account. The security team wants to configure AWS CloudTrail in each member account to deliver log files to a single Amazon S3 bucket in the Security account. All log files must be encrypted at rest using a Key Management Service (KMS) key. Which combination of actions is required to configure the encryption and access controls? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the Security account, create a customer managed KMS key and configure its key policy to allow the AWS CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations.; Attach an S3 bucket policy to the destination bucket in the Security account that grants s3:PutObject permissions to the AWS CloudTrail service principal, with conditions restricting access to the organization's trail ARNs.

Answer

To configure secure, cross-account log aggregation with encryption, you must create a customer managed KMS key in the Security account with a key policy allowing the CloudTrail service principal to generate data keys, and apply an S3 bucket policy on the destination bucket in the Security account allowing the CloudTrail service principal to write objects under conditions restricted to the organization's trail ARNs.
The correct configuration requires using a customer managed KMS key because AWS-managed keys cannot be shared cross-account. The KMS key policy must authorize the AWS CloudTrail service principal to generate data keys. Additionally, the S3 bucket policy in the Security account must explicitly trust the CloudTrail service principal to upload log files, using organizational trail conditions to prevent unauthorized write attempts.

Step-by-Step Solution

1
Determine the type of KMS key needed for cross-account service encryption.
A customer managed KMS key must be selected because AWS-managed keys cannot be shared cross-account or have their key policies modified.
CloudTrail in member accounts needs to encrypt logs using a key owned by the Security account, which requires custom policy statements.
2
Configure the KMS key policy to permit CloudTrail operations.
Add permissions for the service principal 'cloudtrail.amazonaws.com' to perform 'kms:GenerateDataKey*' and 'kms:DescribeKey'.
This allows CloudTrail to request data keys to encrypt the logs before writing them to S3.
3
Configure S3 bucket access for cross-account logging.
Attach a bucket policy to the Security account's destination S3 bucket allowing 's3:PutObject' for the CloudTrail service principal, scoped to the organization's trail ARNs using condition keys.
This establishes the necessary trust relationship allowing CloudTrail to deliver logs securely to the centralized bucket.

Key Concept

Cross-account resource access and encryption using Customer Managed KMS Keys and S3 Bucket Policies for centralized AWS services.
Question 1947Question →

A manufacturing company has 33 separate AWS accounts within an AWS Organization. Each account has a VPC in the `us-east-1` region containing production workloads. The company wants to establish hybrid connectivity between all 33 VPCs and their on-premises data center. To achieve this, the company has provisioned a single 1 Gbps1\text{ Gbps} AWS Direct Connect connection. The solution must support direct VPC-to-VPC communication and provide a backup pathway over the internet using a Site-to-Site VPN in case the Direct Connect connection fails. The configuration must minimize administrative overhead and routing complexity. Which design should a solutions architect recommend to satisfy these requirements?

Show answer & explanation

Answer: Deploy an AWS Transit Gateway in the organization's network account. Share the Transit Gateway with the other accounts using AWS Resource Access Manager (RAM). Attach the three VPCs to the Transit Gateway. Create a Direct Connect Gateway, associate it with the Transit Gateway using a transit virtual interface (VIF) on the Direct Connect connection, and establish an IPsec Site-to-Site VPN from the on-premises data center to the Transit Gateway. Configure BGP on-premises to prefer the Direct Connect path.

Answer

Deploy an AWS Transit Gateway in the organization's network account. Share the Transit Gateway with the other accounts using AWS Resource Access Manager (RAM). Attach the three VPCs to the Transit Gateway. Create a Direct Connect Gateway, associate it with the Transit Gateway using a transit virtual interface (VIF) on the Direct Connect connection, and establish an IPsec Site-to-Site VPN from the on-premises data center to the Transit Gateway. Configure BGP on-premises to prefer the Direct Connect path.
The correct architecture uses a central AWS Transit Gateway shared across accounts using AWS Resource Access Manager (RAM). The VPCs are attached to this Transit Gateway, enabling direct VPC-to-VPC routing. The Direct Connect Gateway is associated with the Transit Gateway via a transit virtual interface (VIF) to enable primary hybrid traffic flow. Additionally, an IPsec Site-to-Site VPN is established directly to the Transit Gateway, and BGP routing on-premises is configured to prioritize the Direct Connect path, ensuring automatic failover. This design minimizes administrative overhead and routing complexity.

Step-by-Step Solution

1
Consolidate spoke VPC connectivity using AWS Transit Gateway shared via AWS Resource Access Manager (RAM) to allow direct VPC-to-VPC traffic in a hub-and-spoke model.
This eliminates the need for complex mesh VPC peering or hair-pinning traffic through the on-premises data center.
To satisfy the requirement of direct VPC-to-VPC communication while minimizing administrative overhead.
2
Create an AWS Direct Connect Gateway and associate it with the Transit Gateway using a transit virtual interface (VIF).
Hybrid connectivity is established from the on-premises network to the Transit Gateway, enabling access to all attached VPCs over the Direct Connect connection.
Transit Gateway requires a transit VIF (not a private VIF) for Direct Connect Gateway association.
3
Establish an IPsec Site-to-Site VPN connection from the on-premises data center to the Transit Gateway as a backup path.
Both the Direct Connect and VPN paths terminate on the same Transit Gateway, providing a resilient path configuration.
To ensure automatic failover to the backup path over the internet if the Direct Connect link fails.
4
Configure BGP routing on the on-premises router to prioritize the Direct Connect path over the VPN connection.
Traffic automatically uses the higher-bandwidth Direct Connect connection as the primary path and falls back to the VPN in the event of an outage.
Dynamic routing via BGP simplifies failover management and avoids complex static route maintenance.

Key Concept

AWS Transit Gateway simplifies multi-account and hybrid network topologies by acting as a cloud router, enabling transitive routing between VPCs and supporting transit VIFs for Direct Connect along with Site-to-Site VPN failover.
Question 1948Question →

An international logistics firm is designing a new transit tracking pipeline. The system deploys an ingestion service running on Amazon ECS tasks in AWS Account A (111122223333111122223333). The service must write shipment telemetry data directly into an Amazon S3 bucket located in Account B (444455556666444455556666).

The compliance guidelines dictate:
1. All telemetry data at rest in the destination bucket must be encrypted using a Customer Managed Key (CMK) managed in Account B.
2. The destination bucket must deny any upload that is unencrypted or uses an incorrect key.
3. Access control lists (ACLs) must be disabled on the destination bucket, ensuring the bucket owner automatically owns all uploaded data.

Which combination of configuration steps will securely achieve this architecture?

Show answer & explanation

Answer: In Account B, set the S3 bucket's Object Ownership to Bucket Owner Enforced. Configure the S3 bucket policy to allow the ECS task role in Account A to perform `s3:PutObject`, denying requests without `s3:x-amz-server-side-encryption` set to `aws:kms` and referencing the CMK ARN. In Account B, update the CMK key policy to allow the ECS task role in Account A to perform `kms:GenerateDataKey` and `kms:Decrypt`. In Account A, grant the ECS task role permissions to perform `s3:PutObject` on the bucket and `kms:GenerateDataKey` on the CMK in Account B.

Answer

In Account B, set the S3 bucket's Object Ownership to Bucket Owner Enforced. Configure the S3 bucket policy to allow the ECS task role in Account A to perform `s3:PutObject`, denying requests without `s3:x-amz-server-side-encryption` set to `aws:kms` and referencing the CMK ARN. In Account B, update the CMK key policy to allow the ECS task role in Account A to perform `kms:GenerateDataKey` and `kms:Decrypt`. In Account A, grant the ECS task role permissions to perform `s3:PutObject` on the bucket and `kms:GenerateDataKey` on the CMK in Account B.
The correct solution satisfies all architectural and security requirements. Setting the S3 bucket's Object Ownership to Bucket Owner Enforced disables ACLs and guarantees that Account B owns all objects uploaded to the bucket. To allow the ECS task role in Account A to write to the bucket and encrypt using the CMK in Account B, permissions must be granted on both sides: the ECS task role must have identity-based permissions (IAM) in Account A to perform these operations, and the resources in Account B (the S3 bucket policy and the KMS key policy) must explicitly authorize the external ECS task role. Finally, enforcing that all uploads specify the correct encryption parameters in the S3 bucket policy ensures that non-compliant uploads are rejected.

Step-by-Step Solution

1
Disable ACLs and enforce bucket owner control on the destination bucket in Account B.
Setting S3 Object Ownership to Bucket Owner Enforced disables ACLs, ensuring all cross-account uploads are automatically owned by the bucket owner (Account B).
This satisfies the requirement that the bucket owner automatically owns all uploaded data.
2
Configure the cross-account bucket policy in Account B.
The S3 bucket policy grants `s3:PutObject` to the ECS task role in Account A, while denying uploads that do not specify KMS encryption (`aws:kms`) and the specific CMK ARN.
This enforces data encryption at the S3 API level for incoming write operations from Account A.
3
Configure the Customer Managed Key (CMK) policy in Account B.
The CMK key policy is updated to allow the ECS task role in Account A to perform `kms:GenerateDataKey` and `kms:Decrypt` operations.
Cross-account KMS usage requires explicit authorization in the key policy. The KMS service cannot rely solely on IAM policies in the caller's account.
4
Configure the local IAM policy for the ECS task role in Account A.
The ECS task role is granted permissions to write (`s3:PutObject`) to Account B's bucket and generate data keys (`kms:GenerateDataKey`) using Account B's CMK.
This establishes the identity-based permission link allowing the ingestion service to initiate the write and encryption process.

Key Concept

Cross-account security controls using S3 bucket policies, KMS key policies, and IAM roles.
Estimated Time:3m 0s
Question 1949Question →

An enterprise is planning to roll out a major update to its global web application. The application's static assets are hosted in an Amazon S3 bucket and served through an Amazon CloudFront distribution. The update requires changes to the CloudFront configuration, including new origin request policies and updated cache behaviors. The security and operations teams require that these changes be tested with a small percentage of live production traffic before being fully deployed, with the ability to roll back immediately if anomalies are detected.

Which combination of steps should a Solutions Architect recommend to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a staging CloudFront distribution that is linked to the primary distribution, and apply the new configuration changes to the staging distribution.; Create a CloudFront continuous deployment policy that specifies a weight-based traffic split to route a percentage of requests to the staging distribution, and associate it with the primary distribution.

Answer

Create a staging CloudFront distribution linked to the primary distribution, apply the configuration changes to the staging distribution, and then create and associate a continuous deployment policy that specifies a weight-based traffic split to route a percentage of requests to the staging distribution.
Using CloudFront continuous deployment is the recommended AWS best practice for testing CDN configuration changes with live traffic. Creating a staging distribution linked to the primary distribution provides a safe sandbox for configurations like origin request policies and cache behaviors. Associating a weight-based continuous deployment policy ensures a percentage of production traffic is routed to the staging distribution without DNS caching issues or custom code overhead, enabling immediate rollbacks if anomalies are detected.

Step-by-Step Solution

1
Set up the test environment using CloudFront's native features.
A staging distribution linked to the primary distribution is created, hosting the new configuration (origin request policies and cache behaviors) in isolation.
This allows applying modifications safely without affecting production traffic.
2
Configure and attach the routing policy.
A weight-based continuous deployment policy is created and associated with the primary distribution, directing a specific percentage of requests to the staging distribution.
This enables testing the new distribution configuration with a subset of live traffic under production conditions.
3
Monitor performance and prepare for promotion or rollback.
If issues arise, the continuous deployment policy can be deleted or disabled to instantly route all traffic back to the primary configuration. If successful, the staging distribution can be promoted to production.
This guarantees zero downtime and zero DNS propagation delay during rollbacks.

Key Concept

CloudFront Continuous Deployment
Estimated Time:3m 0s
Question 1950Question →

A global ad-tech corporation is deploying a real-time bidding (RTB) exchange on AWS. The platform must process up to 800,000800,000 incoming bid requests per second during peak traffic periods, with an end-to-end processing latency budget of 30 ms30\text{ ms} per request. The architecture requires querying a 12 TB12\text{ TB} user profile store with sub-millisecond read latency to enrich each bid request. In addition, the system must capture and persist transactional bid logs for downstream offline processing, analytics, and compliance audits without blocking the synchronous request-response flow. The platform must dynamically and instantly scale to accommodate sudden traffic bursts.

Which combination of architectural options will satisfy these performance, scalability, and latency requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a Network Load Balancer (NLB) to distribute incoming traffic to the application tier hosted on Amazon ECS with AWS Fargate using the AWS VPC (awsvpc) network mode.; Use Amazon DynamoDB with Amazon DynamoDB Accelerator (DAX) to store user profile data, configuring the application to query the DAX cluster for user attributes.

Answer

Deploying a Network Load Balancer (NLB) with Amazon ECS on AWS Fargate using the awsvpc network mode, and storing user profile data in Amazon DynamoDB with DynamoDB Accelerator (DAX).
The correct architecture uses a Network Load Balancer (NLB) combined with Amazon ECS running on AWS Fargate in the AWS VPC (awsvpc) network mode to handle rapid, massive traffic spikes without pre-warming, while providing low-latency container execution. For the data layer, Amazon DynamoDB with Amazon DynamoDB Accelerator (DAX) is the optimal choice for the 12 TB12\text{ TB} user profile store because it provides sub-millisecond read latencies through in-memory caching, fitting within the 30 ms30\text{ ms} end-to-end latency budget.

Step-by-Step Solution

1
Analyze the load balancing and traffic burst requirements.
Identify that the platform experiences rapid, volatile traffic spikes up to 800,000800,000 requests per second. A Network Load Balancer (NLB) must be selected over an Application Load Balancer (ALB) because NLB can scale instantly to handle millions of requests without requiring pre-warming or incurring scaling latency.
ALB requires pre-warming to handle sudden, large traffic spikes, which fails the requirement of handling unpredictable bursts automatically.
2
Evaluate the compute tier for performance and scalability.
Select Amazon ECS on AWS Fargate using the awsvpc network mode.
Fargate provides serverless, scalable container execution, while the awsvpc network mode assigns a dedicated ENI to each task, eliminating port address translation overhead and maximizing network throughput.
3
Evaluate the data store for latency and capacity constraints.
Select Amazon DynamoDB with DynamoDB Accelerator (DAX) to host the 12 TB12\text{ TB} user profile dataset.
DAX provides a fully managed, highly available in-memory cache in front of DynamoDB, reducing read latencies to sub-milliseconds, which is necessary to meet the 30 ms30\text{ ms} end-to-end latency budget.

Key Concept

Selecting high-throughput, low-latency architectures that can scale horizontally and instantly to meet strict latency budgets under unpredictable load.
Estimated Time:3m 0s
Question 1951Question →

A company is designing a deployment process for a critical customer-facing web application. The application runs on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer (ALB). The infrastructure is managed using AWS CloudFormation templates. The deployment strategy must satisfy the following requirements:

- Perform a blue/green deployment where the new version (green) is fully provisioned alongside the existing version (blue).
- Shift production traffic to the new version, but allow for an immediate rollback (in less than 60 seconds) to the old version if post-deployment smoke tests fail.
- Do not use AWS CodeDeploy or external orchestration tools.
- Keep the deployment process entirely within AWS CloudFormation capabilities.

Which combination of actions should the Solutions Architect include in the design to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Define a second Auto Scaling group and a new target group in the CloudFormation template to represent the green environment, while keeping the blue Auto Scaling group and target group intact.; Configure the ALB listener rule's action to use a ForwardConfig containing both the blue and green target groups, and update the CloudFormation stack to shift traffic weights between them.

Answer

Defining a second Auto Scaling group and target group to run the new version alongside the existing one, and using an ALB listener rule with a weighted forward configuration to shift traffic via CloudFormation updates.
Defining a second Auto Scaling group and a new target group allows the new version to run concurrently with the old version. By using the Application Load Balancer listener rule's ForwardConfig, traffic can be shifted between the two target groups by adjusting their weights via CloudFormation updates. Since target group weight adjustments at the ALB level take effect immediately, this approach enables traffic shifting and allows a rollback to complete in less than 60 seconds if tests fail. This meets the requirements without relying on DNS or external orchestration tools.

Step-by-Step Solution

1
Identify the rollback speed and infrastructure control requirements.
The requirements dictate a blue/green deployment under 60 seconds rollback time using only native CloudFormation features.
This eliminates DNS-based routing (due to propagation and cache delays) and in-place rolling updates (due to the time required to re-provision instances).
2
Design the infrastructure separation for blue and green environments.
Specify two separate Auto Scaling groups and target groups within the CloudFormation template.
This maintains separate environments so that both versions are fully provisioned and can run in parallel.
3
Configure the traffic shifting mechanism.
Update the Application Load Balancer listener rule to forward requests using a ForwardConfig containing both target groups with specified weights.
Changing target group weights at the ALB level via a CloudFormation stack update shifts traffic instantly without relying on DNS propagation, enabling immediate rollback.

Key Concept

Implementing blue/green deployments in AWS CloudFormation using weighted ALB target groups for near-instant rollback capability.
Question 1952Question →

A multinational company is designing a hybrid network architecture to connect two on-premises data centers (located in New York and London) to its AWS multi-account environment. The AWS environment consists of 3030 VPCs distributed across the `us-east-1` and `eu-west-2` regions.

The connectivity requirements are:
- Primary connectivity must use AWS Direct Connect (DX) links with a minimum bandwidth of 10 Gbps10\text{ Gbps} at each location.
- AWS Site-to-Site VPN connections over the internet must serve as the backup path.
- The New York data center must primarily access resources in `us-east-1`, and the London data center must primarily access resources in `eu-west-2`.
- Direct communication between the New York and London data centers through the AWS network must be prevented for regulatory compliance.
- Outbound internet access from the VPCs must be centralized through a shared services VPC in each region, ensuring high availability and resilience against Availability Zone (AZ) failures.

Which TWO steps should the Solutions Architect take to configure the routing and connectivity to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy AWS Transit Gateway in both regions, peered together, and associate them with a Direct Connect Gateway. Use separate Transit Gateway route tables for VPC attachments and hybrid attachments to prevent routing traffic between the two on-premises data centers.; Deploy redundant NAT Gateways across multiple Availability Zones in a central egress VPC in each region, and configure the route tables of the spoke VPCs to route outbound 0.0.0.0/00.0.0.0/0 traffic through the Transit Gateway to the local NAT Gateways.

Answer

Deploy AWS Transit Gateway in both regions, peered together, and associate them with a Direct Connect Gateway. Use separate Transit Gateway route tables for VPC attachments and hybrid attachments to prevent routing traffic between the two on-premises data centers. Deploy redundant NAT Gateways across multiple Availability Zones in a central egress VPC in each region, and configure the route tables of the spoke VPCs to route outbound 0.0.0.0/00.0.0.0/0 traffic through the Transit Gateway to the local NAT Gateways.
The correct solution involves deploying AWS Transit Gateways in both regions, peered together, to support the multi-region, multi-account scale. By associating them with a Direct Connect Gateway and setting up isolated Transit Gateway route tables (associating the hybrid attachments with a route table that does not propagate routes to the other data center), we prevent transitive communication between the New York and London data centers. Additionally, deploying redundant NAT Gateways across multiple Availability Zones in a centralized egress VPC in each region provides a highly available egress path that is resilient to Availability Zone failures.

Step-by-Step Solution

1
Configure Transit Gateway and Direct Connect Gateway associations for hybrid connectivity.
Each region has an AWS Transit Gateway connected via a Direct Connect Gateway using Transit Virtual Interfaces (transit VIFs), enabling high-bandwidth hybrid communication.
Direct Connect Gateway with Transit Gateways is required to connect multiple VPCs (beyond the 1010-VPC limit of a Direct Connect Gateway with private VIFs) across multiple accounts and regions.
2
Implement Transit Gateway route table isolation to prevent inter-data-center transitive routing.
A 'VPC Route Table' associates with VPC attachments and propagates routes to the on-premises networks. A separate 'Hybrid Route Table' associates with the DXGW and VPN attachments, propagates VPC routes, but does not propagate the other hybrid attachments' routes.
Separate route tables isolate the on-premises attachments from each other, preventing traffic from New York routing to London through AWS.
3
Design and implement highly available centralized egress.
Centralized egress VPCs are deployed in both regions containing redundant NAT Gateways across multiple Availability Zones. Route tables in spoke VPCs point 0.0.0.0/00.0.0.0/0 traffic to their local Transit Gateway, which forwards it to the centralized NAT Gateways.
This guarantees that outbound internet traffic is secure, centralized, and resilient against single Availability Zone outages without introducing cross-region latency.

Key Concept

Multi-region hybrid network design with Transit Gateway routing isolation and high-availability centralized egress.
Question 1953Question →

A logistics company is designing a new fleet tracking application on AWS that must be deployed across two AWS Regions: eu-west-1 as primary and us-east-1 as secondary. The architecture must achieve a database Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 10 minutes. The workloads in both VPCs require outbound internet access to track GPS coordinates from external devices. Outbound connectivity must be resilient to Availability Zone outages within each region. Additionally, internal microservices in both VPCs must be able to resolve private DNS records hosted in a centralized Amazon Route 53 Private Hosted Zone (PHZ).

Which two configuration options should the solutions architect select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Aurora Global Database with the primary database cluster in eu-west-1 and a secondary database cluster in us-east-1 to handle replication and failover.; Associate the Route 53 Private Hosted Zone with the VPCs in both regions, and deploy a NAT Gateway in each Availability Zone within both VPCs to handle outbound traffic.

Answer

Configure an Amazon Aurora Global Database with the primary database cluster in eu-west-1 and a secondary database cluster in us-east-1. Also, associate the Route 53 Private Hosted Zone with the VPCs in both regions, and deploy a NAT Gateway in each Availability Zone within both VPCs.
The correct options are configuring Amazon Aurora Global Database and associating the Route 53 Private Hosted Zone with both VPCs while deploying a NAT Gateway in each Availability Zone. Aurora Global Database matches the RPO of less than 1 minute and the RTO of less than 10 minutes. Associating the private hosted zone enables DNS resolution across regions, and AZ-specific NAT Gateways ensure resilient outbound connectivity.

Step-by-Step Solution

1
Select the database replication strategy.
Amazon Aurora Global Database is chosen because it replicates data with latency under 1 second (meeting the RPO of < 1 minute) and supports managed failover (meeting the RTO of < 10 minutes).
Traditional RDS snapshots or read replica promotion cannot guarantee RTO and RPO requirements reliably under 10 minutes without high complexity or data loss.
2
Configure internal DNS resolution across regions.
Associate the Amazon Route 53 Private Hosted Zone created in the primary VPC with the secondary VPC in us-east-1.
By default, Route 53 Private Hosted Zones are only accessible to associated VPCs. Cross-region VPCs must be explicitly associated with the zone to resolve its DNS records.
3
Configure NAT Gateway placement for high availability.
Deploy a NAT Gateway in each Availability Zone of the VPCs in both regions.
If a single NAT Gateway is deployed in one Availability Zone, an outage in that zone would disrupt outbound internet connectivity for workloads in other Availability Zones of the same VPC.

Key Concept

High Availability and Disaster Recovery Design
Question 1954Question →

A solutions architect is designing the database strategy for a new critical online transaction processing (OLTP) application. The application will be deployed in a primary AWS Region and requires a dynamic read-scaling database tier to handle unpredictable query loads. The business demands a disaster recovery (DR) solution in a secondary AWS Region with a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 2 minutes. Furthermore, database backups must be encrypted and securely shared with a centralized security AWS account. Which database and encryption strategy will meet these requirements while minimizing operational overhead?

Show answer & explanation

Answer: Deploy an Amazon Aurora PostgreSQL Global Database. Configure Aurora Auto Scaling for the Aurora Replicas in the primary Region to handle read traffic. Promote the secondary Region in the event of a disaster. Encrypt the database cluster using a Customer Managed Key (CMK) in AWS KMS to allow cross-account sharing of backups with the security account.

Answer

Deploy an Amazon Aurora PostgreSQL Global Database. Configure Aurora Auto Scaling for the Aurora Replicas in the primary Region to handle read traffic. Promote the secondary Region in the event of a disaster. Encrypt the database cluster using a Customer Managed Key (CMK) in AWS KMS to allow cross-account sharing of backups with the security account.
The correct option addresses all database scaling, DR, and encryption requirements. Amazon Aurora Global Database uses dedicated storage replication that offers a typical RPO of less than 1 second and RTO of under 1 minute. Aurora Auto Scaling dynamic scaling works with Aurora Replicas to handle variable read workloads. A Customer Managed Key (CMK) is required because the KMS key policy must be updated to grant permissions to the external centralized security account, which is impossible with the default AWS-managed KMS key.

Step-by-Step Solution

1
Evaluate the database read-scaling and replication requirements.
Amazon Aurora PostgreSQL Global Database is selected because it offers low-latency cross-region replication suitable for an RPO of under 2 minutes and RTO of under 15 minutes, and supports Aurora Auto Scaling for read scaling in the primary region.
Traditional RDS Multi-AZ standby instances cannot be read from, and daily snapshots do not meet the low RPO/RTO targets.
2
Analyze the cross-account KMS encryption and backup requirements.
A Customer Managed Key (CMK) in AWS KMS is required to allow modifying the key policy for cross-account sharing.
AWS-managed keys (aws/rds) cannot be shared across AWS accounts.

Key Concept

Selecting the optimal database engine and replication strategy for strict RTO/RPO targets while ensuring cross-account KMS access control.
Estimated Time:2m 0s
Question 1955Question →

A regional utility company is launching a smart grid monitoring application that ingests telemetry data from 500,000500,000 smart meters. Each meter uploads consumption data every 1515 minutes. During extreme weather events, the application experiences immediate, unannounced traffic spikes that increase the ingestion rate tenfold. The ingestion layer must scale instantly to prevent data loss, and the database must support low-latency write operations. Which two strategies should the Solutions Architect implement to optimize the performance and scalability of this solution?

Select all that apply

Show answer & explanation

Answer: Deploy a Network Load Balancer (NLB) to distribute the incoming traffic, as it can handle sudden, massive spikes in throughput without requiring pre-warming.; Use Amazon DynamoDB with on-demand capacity mode and a partition key based on the meter ID to accommodate sudden spikes in write traffic.

Answer

Deploy a Network Load Balancer (NLB) to handle the sudden traffic spikes and store the processed telemetry data in Amazon DynamoDB using on-demand capacity mode.
Deploying a Network Load Balancer ensures that sudden, unannounced spikes in traffic can be absorbed without dropped connections, as NLBs are designed to handle millions of requests per second instantly without pre-warming. Using Amazon DynamoDB in on-demand capacity mode with a highly distributed partition key like the meter ID ensures the database tier can handle unpredictable write scaling requirements without performance degradation or partition throttling.

Step-by-Step Solution

1
Evaluate load balancer scaling behavior for instantaneous, unannounced traffic spikes.
Identify that a Network Load Balancer (NLB) is required because it handles sudden spikes without needing pre-warming, unlike an Application Load Balancer (ALB).
An ALB scales gradually and would drop requests during a sudden tenfold spike if not pre-warmed.
2
Select a database configuration that handles high-throughput, unpredictable write workloads.
Choose Amazon DynamoDB with on-demand capacity mode and a partition key based on the meter ID.
On-demand capacity mode scales write capacity instantly, and a distributed partition key prevents hot partitions.
3
Identify why alternate architectural options are sub-optimal or incorrect.
Reject standard RDS Multi-AZ standby routing (as standbys do not serve traffic) and ElastiCache for Memcached (as it lacks replication/persistence).
Standby instances in standard RDS are passive, and Memcached does not support multi-AZ replication.

Key Concept

Selecting load balancer and database tiers that scale instantly to absorb unannounced write spikes.
Estimated Time:2m 0s
Question 1956Question →

A regional transit authority is modernizing its legacy commuter fare validation system by migrating to a serverless architecture on AWS. The system must process tap-in events from subway station turnstiles via an Amazon API Gateway Private REST API. An AWS Lambda function will run in private VPC subnets to validate the commuters' cards against a central MySQL database hosted on an Amazon RDS instance. The Lambda function must also query third-party transit APIs on the internet and securely share encrypted commuter validation logs with external partner transportation databases in separate AWS accounts. The solution must ensure high availability, prevent database connection exhaustion, protect the AWS account's execution capacity during morning rush hour spikes, and secure cross-account data sharing. Which architecture should a solutions architect recommend to satisfy these requirements?

Show answer & explanation

Answer: Configure an API Gateway Private REST API using interface VPC endpoints. Deploy the Lambda function across three Availability Zones (AZs) in the private subnets, using Amazon RDS Proxy to manage connection pooling to the MySQL instance. Deploy a NAT Gateway in a public subnet within each AZ to handle outbound internet traffic. Configure a reserved concurrency limit on the Lambda function to safeguard the account's unreserved concurrency pool, and use a customer managed KMS key with a modified key policy to encrypt the shared validation logs.

Answer

Configure an API Gateway Private REST API using interface VPC endpoints. Deploy the Lambda function across three Availability Zones (AZs) in the private subnets, using Amazon RDS Proxy to manage connection pooling to the MySQL instance. Deploy a NAT Gateway in a public subnet within each AZ to handle outbound internet traffic. Configure a reserved concurrency limit on the Lambda function to safeguard the account's unreserved concurrency pool, and use a customer managed KMS key with a modified key policy to encrypt the shared validation logs.
The correct architecture integrates API Gateway Private endpoints for secure internal routing, utilizes RDS Proxy to scale MySQL connection pooling, ensures redundant NAT Gateways across all three Availability Zones to prevent a single point of failure for outbound internet API calls, uses reserved concurrency to safeguard the account's unreserved pool during peak traffic surges, and deploys a customer managed KMS key to support the necessary cross-account decryption permissions.

Step-by-Step Solution

1
Select the correct API Gateway configuration for private turnstile access.
Amazon API Gateway Private REST API with interface VPC endpoints is utilized to keep the traffic isolated within the VPC.
This guarantees that public endpoints are not exposed to the internet, satisfying the private traffic requirements.
2
Determine the database connection pooling strategy.
Use Amazon RDS Proxy in front of the RDS MySQL instance.
Lambda functions scale horizontally and can rapidly open database connections. RDS Proxy pools and shares these connections, preventing database connection limits from being reached.
3
Design the high-availability network layout for outbound internet access.
Deploy the Lambda function across three AZs and place a NAT Gateway in each AZ's public subnet.
To maintain high availability and prevent a single point of failure (SPOF), routing outbound traffic through a NAT Gateway in each AZ ensures that an AZ failure does not impact internet routing for other zones.
4
Address concurrency protection.
Set a reserved concurrency limit on the validation Lambda function.
This guarantees that the bursty passenger validation function does not consume the entire unreserved regional execution pool, preventing other microservices in the account from being throttled.
5
Implement the cross-account KMS key strategy.
Use a customer managed KMS key with a modified key policy.
AWS-managed KMS keys do not support policy modifications and cannot be shared across accounts. A customer managed key must be used to explicitly grant decrypt permissions to external AWS accounts.

Key Concept

Modernizing legacy relational workloads using serverless architectures requires orchestrating private endpoint integrations, database connection management, redundant NAT gateway configurations for outbound API calls, concurrency control for throttling mitigation, and customer managed KMS keys for cross-account security.
Estimated Time:3m 0s
Question 1957Question →

A research organization is launching a new data analytics application. The application components are deployed on Amazon EC2 instances in a production AWS account (Account A). The application must upload raw datasets to an Amazon S3 bucket located in a centralized data lake AWS account (Account B). Compliance standards require that all data uploaded to the S3 bucket must be encrypted at rest. The security team must manage the encryption key policies and rotation schedules, and the audit team in Account B must be able to read and decrypt the data. How should the solutions architect design the security and encryption controls to meet these requirements?

Show answer & explanation

Answer: Create a customer managed key (CMK) in Account B. Configure the CMK key policy in Account B to grant Account A's application IAM role permissions to perform the kms:GenerateDataKey and kms:Decrypt actions. Attach an IAM policy to the application role in Account A that allows these same KMS actions on the CMK in Account B.

Answer

Create a customer managed key (CMK) in Account B. Configure the CMK key policy in Account B to grant Account A's application IAM role permissions to perform the kms:GenerateDataKey and kms:Decrypt actions. Attach an IAM policy to the application role in Account A that allows these same KMS actions on the CMK in Account B.
The correct answer provides a solution that fulfills all security and cross-account requirements. Since AWS-managed keys (like aws/s3) do not support policy modification and cannot be shared across accounts, a customer managed key (CMK) must be used. Furthermore, cross-account access to a KMS key requires explicit permission in both the KMS key policy (acting as a resource policy in the destination account) and the IAM policy of the IAM role (identity policy in the source account).

Step-by-Step Solution

1
Determine the type of KMS key required for cross-account S3 access.
Identify that a Customer Managed Key (CMK) is required because AWS-managed keys (e.g., aws/s3) cannot be shared across accounts.
AWS-managed KMS keys do not support policy modification, which is necessary to trust an external AWS account.
2
Configure permissions on the resource policy (KMS key policy).
Configure the key policy of the CMK in Account B to grant the specific IAM role in Account A permissions to perform kms:GenerateDataKey and kms:Decrypt.
For cross-account access, the resource owner must explicitly allow the external principal to use the resource.
3
Configure permissions on the identity policy (IAM policy).
Attach an IAM policy to the application's role in Account A allowing the same KMS actions on the CMK in Account B.
Cross-account access requires authorization from both the resource owner (resource policy) and the consumer's account administrator (identity policy).

Key Concept

Cross-Account KMS Key Delegation and Policy Evaluation
Estimated Time:2m 0s
Question 1958Question →

A financial services firm is preparing to migrate its core transactional and analytical platforms from an on-premises VMware vSphere environment to a VMware Cloud on AWS SDDC. The transactional databases require live, zero-downtime replication and migration (hot migration) to prevent business disruption, while the batch processing engines can be cut over with minimal downtime during a scheduled window. All migrated virtual machines must preserve their original IP addresses to prevent breaking hardcoded database connection strings. A 2 Gbps AWS Direct Connect connection is available for the migration.

Which of the following components or migration methods should the solutions architect configure to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: VMware HCX Replication-Assisted vMotion (RAV) to migrate the transactional database virtual machines without downtime.; VMware HCX Network Extension to stretch the on-premises Layer 2 networks to the VMware Cloud on AWS SDDC.

Answer

Configure VMware HCX Replication-Assisted vMotion (RAV) to migrate database virtual machines without downtime and VMware HCX Network Extension to stretch the on-premises Layer 2 networks to the VMware Cloud on AWS SDDC.
The correct options are VMware HCX Replication-Assisted vMotion (RAV) and VMware HCX Network Extension. VMware HCX Network Extension allows extending Layer 2 networks so that virtual machines retain their IP addresses upon migration. VMware HCX Replication-Assisted vMotion (RAV) combines parallel replication with live vMotion switchover, meeting the zero-downtime migration requirement for the transactional databases.

Step-by-Step Solution

1
Analyze the business requirements for IP retention and zero-downtime migration.
Identify that the virtual machines must retain their IP addresses, and transactional database virtual machines require hot migrations (zero downtime).
This establishes that a Layer 2 network extension is needed and a live migration mechanism must be used.
2
Select the correct VMware HCX migration method for zero-downtime databases.
Choose VMware HCX Replication-Assisted vMotion (RAV) or HCX vMotion.
HCX RAV allows scheduling bulk migrations with zero-downtime switchovers, satisfying the live migration requirement for transactional databases.
3
Select the correct network configuration for IP retention.
Configure VMware HCX Network Extension (L2C) to stretch the on-premises network.
L2 extension allows virtual machines to move to the cloud without needing to change their IP addresses, preventing broken database connections.

Key Concept

Selecting proper VMware HCX migration profiles (Replication-Assisted vMotion vs Bulk Migration) and Layer 2 Network Extensions to meet RTO/RPO and IP retention requirements.
Estimated Time:2m 0s
Question 1959Question →

An online education provider is modernizing its student enrollment application by migrating to a serverless architecture on AWS. The application will use a regional Amazon API Gateway REST API and AWS Lambda functions. The Lambda functions must process incoming enrollment requests, verify payment status by calling an external third-party payment gateway over the internet, and write records to a PostgreSQL database hosted on an Amazon RDS DB instance inside a private subnet of a VPC.

During peak registration periods, the enrollment API experiences massive, unpredictable spikes in traffic. The solutions architect must design a highly available architecture that prevents database connection exhaustion and ensures that these sudden surges in enrollment requests do not exhaust the regional concurrency pool, which would throttle other critical Lambda functions in the same AWS account.

Which of the following architectures meets these requirements?

Show answer & explanation

Answer: Configure the Lambda functions to run in private subnets across multiple Availability Zones. Deploy a NAT Gateway in each Availability Zone to provide redundant outbound internet access to the external payment gateway. Deploy an Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Configure reserved concurrency on the enrollment Lambda function.

Answer

The architecture that configures the Lambda functions in private subnets with a NAT Gateway in each Availability Zone, deploys an Amazon RDS Proxy, and sets reserved concurrency on the enrollment Lambda function.
The correct architecture deploys Lambda functions across multiple Availability Zones inside private subnets, with internet egress handled by a NAT Gateway in each Availability Zone for fault tolerance. Database connections are managed efficiently using Amazon RDS Proxy to handle pooling, and reserved concurrency limits the execution pool of the enrollment function, preventing it from exhausting the regional account-level concurrency limit and throttling other workloads.

Step-by-Step Solution

1
Evaluate the egress networking requirements for outbound internet communication.
The Lambda functions must reside in private subnets across multiple Availability Zones, and outbound internet access must be provided through redundant NAT Gateways deployed in each Availability Zone to avoid a single point of failure.
Lambda functions inside a VPC require a NAT Gateway to access public internet endpoints like the payment gateway, and distributing NAT Gateways across Availability Zones ensures high availability.
2
Address database connection preservation during traffic surges.
Introduce Amazon RDS Proxy between the Lambda functions and the RDS PostgreSQL instance.
RDS Proxy maintains a pool of established database connections and shares them among concurrent Lambda executions, preventing the relational database from exhausting its connection limits during sudden surges.
3
Isolate the concurrency footprint of the enrollment function to protect other workloads in the account.
Configure reserved concurrency on the enrollment Lambda function.
Reserved concurrency sets a maximum limit on the number of concurrent executions for a specific function. This acts as a throttle for that function, preventing it from consuming the entire account's regional concurrency pool and thereby protecting other critical functions in the account.

Key Concept

Designing a scalable, highly available serverless architecture that integrates with relational databases and external endpoints while managing resource quotas (concurrency and connections).
Question 1960Question →

A global pharmaceutical corporation is building a multi-tenant clinical analytics platform on AWS. The platform allows external clinical research organizations (CROs) to upload sensitive clinical trial data directly into Amazon S3 buckets. The corporation uses an external SAML 2.0 compliant identity provider (IdP) to manage external researcher identities. To comply with strict data protection regulations, the solutions architect must design a secure federation solution. The design must ensure that external researchers can only assume their assigned IAM roles in the member accounts if the external IdP has validated their session using multi-factor authentication (MFA). Furthermore, to prevent accidental or malicious modification of these security configurations, local administrators in the member accounts must not be able to delete or modify the federated IAM roles or the SAML provider configuration. Which two actions should the solutions architect recommend to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the trust policy of the IAM roles in the member accounts with the principal set to the SAML provider ARN, specify the sts:AssumeRoleWithSAML action, and add a condition checking that the saml:AuthnMethodsReferences key contains the multi-factor authentication (MFA) context class reference.; Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the member accounts that denies the iam:DeleteRole, iam:UpdateRole, and iam:DeleteSAMLProvider actions when the resource matches the specific federated IAM roles and SAML provider ARNs.

Answer

Configure the trust policy of the IAM roles in the member accounts with the principal set to the SAML provider ARN, specifying the sts:AssumeRoleWithSAML action, and adding a condition checking that the saml:AuthnMethodsReferences key contains the multi-factor authentication (MFA) context class reference; and apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the member accounts that denies the iam:DeleteRole, iam:UpdateRole, and iam:DeleteSAMLProvider actions when the resource matches the specific federated IAM roles and SAML provider ARNs.
The correct options are configuring the trust policy with the principal set to the SAML provider ARN using the sts:AssumeRoleWithSAML action and verifying MFA with the saml:AuthnMethodsReferences key; and applying a Service Control Policy (SCP) at the OU level that denies deletion and updates of the federated IAM roles and SAML provider configurations. The trust policy configuration correctly handles SAML-based role assumption and validates that MFA was performed by the IdP. The SCP ensures that administrative users in the member accounts cannot bypass or delete these critical security controls.

Step-by-Step Solution

1
Configure SAML federation trust policies
The IAM roles in the member accounts are configured to trust the SAML identity provider ARN, use the correct federation action, and validate the MFA status via the saml:AuthnMethodsReferences context key.
This establishes a secure trust relationship with the external identity provider and ensures that only sessions verified with MFA can assume the role.
2
Enforce control guardrails across member accounts using SCPs
An SCP is applied at the OU level to deny update and delete operations on the federated roles and SAML provider configurations.
This prevents local administrators in the member accounts from bypassing compliance controls or tampering with the federation configuration.

Key Concept

Designing secure cross-account identity federation and organizational guardrails using SAML 2.0 and Service Control Policies (SCPs).
PreviousPage 98 / 99Next
All practice questions — AWS Certified Solutions Architect - Professional | Examkin