All practice questions

1964 questions

All types1,964 Multiple choice1,006 Multiple select931 Ordering27

Question 1961Question →

An enterprise is deploying a new version of a stateless Java-based web application to Amazon EC2 instances within an Auto Scaling group. The infrastructure is managed using AWS CloudFormation. The deployment strategy requires zero downtime, guarantees that new EC2 instances are fully booted and verified as healthy before older instances are terminated, and automatically rolls back to the previous stable version if the deployment fails.

Which two configurations should a solutions architect implement to meet these requirements? (Select two.)

Select all that apply

Configure an UpdatePolicy with the AutoScalingRollingUpdate attribute on the AWS::AutoScaling::AutoScalingGroup resource, setting both MinInstancesInService to a value greater than zero and WaitOnResourceSignals to true.

Include the cfn-signal helper script in the EC2 instance UserData, configured to signal success to the CloudFormation stack only after the application process is fully running and has passed local health checks.

Configure an UpdatePolicy with the AutoScalingReplacingUpdate attribute on the AWS::AutoScaling::AutoScalingGroup resource, and rely on the Application Load Balancer target group health check to automatically signal completion.

Define a CloudFormation parameter to trigger a rolling update of the Launch Template, setting the PauseTime to zero to allow the Application Load Balancer to immediately shift traffic using connection draining.

Deploy a second duplicate Auto Scaling group for the new launch template version, configure Route 53 weighted records to split traffic, and configure a CloudWatch alarm to trigger stack deletion on failure.

Show answer & explanation

Answer: Configure an UpdatePolicy with the AutoScalingRollingUpdate attribute on the AWS::AutoScaling::AutoScalingGroup resource, setting both MinInstancesInService to a value greater than zero and WaitOnResourceSignals to true.; Include the cfn-signal helper script in the EC2 instance UserData, configured to signal success to the CloudFormation stack only after the application process is fully running and has passed local health checks.

Answer

To meet the requirements, the solutions architect should configure the CloudFormation template to use the AutoScalingRollingUpdate update policy on the Auto Scaling group with WaitOnResourceSignals set to true, and use the cfn-signal helper script in the EC2 instance UserData to signal success after the application has fully initialized and passed health checks.

To achieve zero downtime and automatic rollbacks during a CloudFormation-managed Auto Scaling group update, the solutions architect must configure the AutoScalingRollingUpdate policy with WaitOnResourceSignals set to true. This forces CloudFormation to wait for a predefined number of success signals before moving to the next batch of instances. To generate these signals, the cfn-signal helper script must be executed within the EC2 instance's UserData after the application successfully starts and passes local verification. If the instances fail to signal within the PauseTime period, CloudFormation aborts the deployment and rolls back to the previous launch template version.

Step-by-Step Solution

Configure the CloudFormation template to use a rolling update strategy.

Add an UpdatePolicy with the AutoScalingRollingUpdate attribute to the AWS::AutoScaling::AutoScalingGroup resource, ensuring that MinInstancesInService is greater than zero to maintain capacity.

This guarantees zero downtime by updating the instances in batches rather than all at once.

Enable CloudFormation to wait for application-level readiness signals.

Set WaitOnResourceSignals to true in the AutoScalingRollingUpdate policy configuration.

This prevents CloudFormation from proceeding to the next batch of updates until it receives confirmation that the current batch is healthy.

Implement the signaling mechanism on the EC2 instances.

Add the cfn-signal helper script to the launch template's UserData, configuring it to execute and send a success signal only after the application has fully bootstrapped and passed local health checks.

This provides the actual readiness signal to CloudFormation, enabling automated rollback if the timeout is reached without receiving the signals.

Key Concept

AWS CloudFormation AutoScalingRollingUpdate deployment strategy with resource signaling

Question 1962Question →

A logistics company is designing a hybrid network connectivity solution for its AWS environment. The environment consists of $25$ spoke VPCs across two AWS accounts in the `us-east-1` region. The company has a $10\text{ Gbps}$ AWS Direct Connect connection at a co-location facility and needs to establish connectivity between the spoke VPCs and their on-premises data center. The solution must provide a backup path using an IPsec VPN over the internet with automated failover, and it must minimize administrative overhead for routing. Which TWO configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

Select all that apply

Create an AWS Transit Gateway, attach the

25

spoke VPCs to the Transit Gateway, and associate the Transit Gateway with a Direct Connect Gateway that connects to on-premises via a Transit Virtual Interface.

Configure an IPsec Site-to-Site VPN connection directly to the Transit Gateway, establishing a backup path that propagates routes via BGP.

Associate all

25

spoke VPCs directly with the Direct Connect Gateway using Virtual Private Gateways to establish the primary path, and configure a Site-to-Site VPN to each VPC for backup.

Deploy a single NAT Gateway in a central services VPC to route all hybrid traffic, and configure routing tables in all spoke VPCs to point to this NAT Gateway for backup paths.

Create a private hosted zone in one account and rely on the Direct Connect Gateway to automatically bridge DNS queries from the on-premises data center to the spoke VPCs.

Show answer & explanation

Answer: Create an AWS Transit Gateway, attach the $25$ spoke VPCs to the Transit Gateway, and associate the Transit Gateway with a Direct Connect Gateway that connects to on-premises via a Transit Virtual Interface.; Configure an IPsec Site-to-Site VPN connection directly to the Transit Gateway, establishing a backup path that propagates routes via BGP.

Answer

Establish the hybrid connectivity by deploying an AWS Transit Gateway to attach all spoke VPCs and associate the Transit Gateway with a Direct Connect Gateway using a Transit Virtual Interface for the primary path. For the backup path, configure an IPsec Site-to-Site VPN terminating directly on the Transit Gateway, enabling BGP to manage failover preference.

The correct solution involves deploying an AWS Transit Gateway to aggregate the 25 spoke VPCs and linking it to the on-premises network via a Direct Connect Gateway (using a Transit VIF) and a Site-to-Site VPN attachment. Transit Gateway supports up to 5000 VPC attachments and handles dynamic routing failover. For identical prefix advertisements, Transit Gateway naturally prefers the Direct Connect Gateway attachment path over the VPN attachment path, achieving automated failover with minimal routing overhead.

Step-by-Step Solution

Deploy AWS Transit Gateway to act as the centralized router for the multi-account spoke VPCs.

All 25 spoke VPCs are attached to the Transit Gateway, enabling hub-and-spoke connectivity.

Transit Gateway simplifies VPC-to-VPC and VPC-to-on-premises routing, eliminating the scale limitations of Direct Connect Gateway associations.

Configure a Direct Connect Gateway, associate it with the Transit Gateway, and connect it to the on-premises network using a Transit Virtual Interface.

A dedicated, high-bandwidth primary hybrid path is created that can scale to service all VPCs.

Transit Virtual Interfaces are required to connect AWS Direct Connect to a Transit Gateway through a Direct Connect Gateway.

Configure an IPsec Site-to-Site VPN connection from the customer gateway to the Transit Gateway, using BGP for route advertisements.

A secure backup connection is established over the public internet.

When both Direct Connect and VPN paths advertise the same BGP prefixes, Transit Gateway automatically prefers the Direct Connect Gateway path for inbound traffic, ensuring automatic failover if the Direct Connect link fails.

Key Concept

AWS Transit Gateway serves as a scalable hub for multi-account networking, routing traffic over both Direct Connect (via Direct Connect Gateway and Transit VIF) and Site-to-Site VPN, while natively prioritizing Direct Connect paths over VPN paths when identical prefixes are advertised.

Question 1963Question →

A pharmaceutical company is designing a new regulatory compliance document management system. The primary deployment will run in the us-east-1 Region. The system consists of an application tier hosted on Amazon EC2 instances in private subnets behind an Application Load Balancer (ALB), and a database tier using Amazon Aurora PostgreSQL. The company requires a multi-region disaster recovery (DR) architecture between us-east-1 and us-west-2. The solution must achieve a Recovery Time Objective (RTO) of 30 minutes, a Recovery Point Objective (RPO) of 5 minutes, and minimize ongoing running costs in the secondary region.

Which two actions should a solutions architect take to meet these requirements?

Select all that apply

Set up an Amazon Aurora Global Database with the primary database cluster in us-east-1 and a secondary database cluster in us-west-2.

Create an Auto Scaling group for the application tier in us-west-2 with the desired capacity set to 0, and configure a failover routing policy in Amazon Route 53 that points to the ALBs in both regions.

Configure an Amazon RDS PostgreSQL Read Replica in us-west-2 and use Amazon Route 53 Application Recovery Controller (ARC) to automate synchronous replication failover.

Configure a Route 53 failover routing policy pointing to both ALBs, but disable health checks on the primary record in us-east-1 to prevent accidental failover during brief latency spikes.

Configure the route tables of the private subnets in us-west-2 to route outbound internet traffic through an AWS Transit Gateway peering connection attached to a NAT Gateway in us-east-1.

Show answer & explanation

Answer: Set up an Amazon Aurora Global Database with the primary database cluster in us-east-1 and a secondary database cluster in us-west-2.; Create an Auto Scaling group for the application tier in us-west-2 with the desired capacity set to 0, and configure a failover routing policy in Amazon Route 53 that points to the ALBs in both regions.

Answer

Setting up an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, combined with creating an Auto Scaling group in us-west-2 with the desired capacity set to 0 and configuring Route 53 failover routing.

The correct answer combines Amazon Aurora Global Database for near-instant database replication and a cost-effective Pilot Light compute tier using an Auto Scaling group set to 0 capacity in the secondary region. Aurora Global Database ensures the RPO is well under 5 minutes by replicating data asynchronously with sub-second lag, and it can be promoted to a primary cluster within minutes. Keeping the EC2 instances in the secondary region turned off (desired capacity of 0) minimizes running costs, while allowing them to scale up and start serving traffic within the 30-minute RTO window when Route 53 failover is triggered.

Step-by-Step Solution

Select a database replication strategy that satisfies the RPO of 5 minutes.

Amazon Aurora Global Database provides database replication that completes in less than 1 second, meeting the RPO of 5 minutes.

Ensures that minimal data is lost during a regional failover.

Select a compute strategy that minimizes ongoing costs while meeting the RTO of 30 minutes.

Pre-configuring the Auto Scaling group in the recovery region (us-west-2) with a desired capacity of 0 ensures no EC2 instances are running during normal operations, minimizing costs. The instances can be launched and initialized in less than 30 minutes during a DR event.

Achieves the Pilot Light/Warm Standby hybrid pattern that satisfies the low-cost and time-bound requirements.

Establish network routing and failover automation.

Using Route 53 failover routing with health checks allows traffic to be automatically redirected to the secondary region's Application Load Balancer once the compute tier is scaled up and the secondary database is promoted.

Enables automated failover routing without manual DNS updates.

Key Concept

Multi-region disaster recovery design using Pilot Light patterns to balance recovery objectives (RTO/RPO) with operational costs.

Question 1964Question →

An enterprise is designing a disaster recovery (DR) solution for a critical customer portal application. The primary environment is located in the us-east-1 Region, and the DR environment will be in the us-west-2 Region. The application requires a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $1$ minute. The backend uses Amazon Aurora PostgreSQL, and the frontend/application tiers run on Amazon EC2 instances inside a private subnet. The EC2 instances must communicate with external payment gateways via the internet. The enterprise wants to adopt a cost-effective Warm Standby DR strategy.

Which TWO architecture decisions should the Solutions Architect implement to meet these requirements?

Select all that apply

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 containing a single database instance to serve as the warm standby, enabling sub-second replication.

Configure Amazon Route 53 with a failover routing policy, associating health checks with the primary Application Load Balancer (ALB) to automatically redirect client traffic to the secondary ALB in us-west-2 during an outage.

Deploy a single NAT Gateway in us-east-1's primary Availability Zone to handle outbound payment gateway traffic for all private subnets across all Availability Zones, and mirror this single NAT Gateway configuration in us-west-2 to minimize ongoing costs.

Implement daily Aurora DB cluster snapshots, copy them to us-west-2, and use AWS CloudFormation to restore the database and spin up the application tier from scratch upon detecting a primary region outage.

Configure a Private Hosted Zone (PHZ) in Route 53 for internal service discovery in us-east-1, relying on cross-Region VPC peering to automatically resolve these private DNS names in us-west-2 without additional hosted zone association.

Show answer & explanation

Answer: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 containing a single database instance to serve as the warm standby, enabling sub-second replication.; Configure Amazon Route 53 with a failover routing policy, associating health checks with the primary Application Load Balancer (ALB) to automatically redirect client traffic to the secondary ALB in us-west-2 during an outage.

Answer

Deploy an Amazon Aurora Global Database with a secondary cluster in us-west-2 containing a single database instance, and configure Amazon Route 53 with a failover routing policy and active health checks on the primary Application Load Balancer.

The correct solution involves deploying an Amazon Aurora Global Database with a secondary cluster containing a single replica in the warm standby region (providing sub-second RPO and under-minute promotion time) and setting up Route 53 with active-passive failover routing to automatically direct traffic to the secondary Application Load Balancer in the event of an outage in the primary region.

Step-by-Step Solution

Analyze RTO and RPO requirements.

An RPO of

1

minute requires continuous database replication (such as Aurora Global Database's sub-second replication), ruling out backup/restore options. An RTO of

15

minutes requires pre-provisioned or quickly provisioned resources in the DR region.

Ensures the selected disaster recovery strategy aligns with the business metrics.

Evaluate the database layer design.

Deploying Amazon Aurora Global Database with a single instance in the secondary region provides active-passive replication that satisfies the

1

-minute RPO. The secondary cluster can be promoted to write mode within minutes, satisfying the

15

-minute RTO.

Determines the appropriate replication and recovery mechanisms for data persistence.

Design the traffic routing and high availability layers.

Configure Route 53 failover routing based on active health checks of the primary Application Load Balancer to redirect traffic. Ensure NAT Gateways are deployed redundantly in each Availability Zone to prevent single points of failure for outbound internet traffic.

Ensures client access can failover automatically and external communications remain highly available.

Key Concept

Designing a multi-region Warm Standby disaster recovery architecture that balances RTO, RPO, and high availability requirements.

PreviousPage 99 / 99

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes