All practice questions

An enterprise is designing a centralized logging solution to aggregate VPC Flow Logs from 80 member accounts in an AWS Organization. A solutions architect is tasking with configuring the delivery of these flow logs to a single Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted at rest. Which TWO of the following configurations are required to ensure the flow logs can be successfully delivered to the centralized S3 bucket?

A gaming platform is launching a new multiplayer architecture in the `us-west-2` Region. The platform architecture requires two application VPCs (`vpc-game-prod-a` and `vpc-game-prod-b`) and one administrative management VPC (`vpc-mgmt-prod`). The management VPC hosts a Route 53 Private Hosted Zone (PHZ) `backend.gaming.internal` containing service endpoints that the application VPCs must resolve privately. The application VPCs must also access the internet for software updates through a centralized egress VPC (`vpc-egress-prod`) to minimize costs, but the egress path must survive a single Availability Zone (AZ) outage without disrupting egress traffic from unaffected AZs. Additionally, the game VPCs and management VPC must communicate with an on-premises graphics rendering cluster via a 10 Gbps AWS Direct Connect connection. Which TWO options should the Solutions Architect implement to satisfy these networking and DNS requirements?

An enterprise deploys its core e-commerce application on Amazon EC2 instances within an Auto Scaling group (ASG) using AWS CloudFormation. Recently, engineers manually modified several security groups associated with the ASG, leading to configuration drift and subsequent deployment failures during CloudFormation stack updates. Additionally, during a rapid scale-out event, the ASG launched multiple instances that were immediately added to the Application Load Balancer (ALB) target group before their local bootstrapping scripts finished installing required packages, resulting in transient HTTP 502 errors for clients. A Solutions Architect must design an automated solution to remediate the configuration drift and ensure newly launched instances do not receive traffic until bootstrapping completes successfully. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

A solutions architect is planning the heterogeneous migration of a production on-premises MySQL database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration must minimize downtime, and the database experiences high write activity. The solutions architect has already run the AWS Schema Conversion Tool (SCT) to convert the database schema. To complete the migration, AWS Database Migration Service (DMS) will be used with Change Data Capture (CDC) enabled.

Which two actions must the solutions architect perform to prepare the source database and ensure successful CDC replication? (Select two.)

An enterprise needs to migrate $350\text{ TB}$ of data from an on-premises SMB file share to an Amazon FSx for Windows File Server file system. The company has a dedicated $150\text{ Mbps}$ internet connection. The migration must be completed within $21$ days. In addition, all transferred data must be encrypted at rest using an AWS KMS customer managed key (CMK). Any incremental updates made on-premises during the migration must be captured and synced to AWS. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

A manufacturing company is modernizing its warehouse inventory tracking system by refactoring a legacy monolithic application into a serverless architecture on AWS. The system must process barcode scanning events from multiple warehouses globally. These scans are ingested via Amazon API Gateway and processed by an AWS Lambda function that updates a central Amazon Aurora PostgreSQL database situated in a private VPC subnet. The volume of scans fluctuates significantly throughout the day, peaking at thousands of events per second during shift changes. During initial load testing, the application encounters database connection exhaustion errors, and other critical business functions in the same AWS account experience throttling. Which of the following actions should the Solutions Architect recommend to address these issues and ensure a reliable, scalable architecture? (Select TWO.)

A retail corporation is designing a new Point of Sale (POS) transaction processing pipeline across multiple accounts under AWS Organizations. The application tier runs on Amazon EC2 instances in a dedicated Ingestion VPC inside the Production Account (111122223333). These instances must upload transaction logs directly to an Amazon S3 bucket located in a centralized Compliance Account (444455556666). The compliance team requires that all uploaded logs be encrypted at rest using a Key Management Service (KMS) key managed exclusively by the compliance team. The ingestion application must be able to encrypt the logs during upload but must be strictly prevented from decrypting the logs once they are written. Furthermore, key administration must be restricted to the Compliance Account, and administrators in the Production Account must not have permissions to modify the key's configuration. Which combination of actions should the Solutions Architect take to design a compliant control structure? (Select TWO.)

An enterprise is modernizing a legacy, high-volume batch processing and reporting workload by migrating it to a serverless architecture on AWS. The solution uses an Amazon API Gateway Regional REST API backed by AWS Lambda functions that read from and write to an Amazon Aurora PostgreSQL database. During peak load tests, the Lambda functions throttle other critical applications in the same AWS region, and outbound calls from Lambda to external verification APIs occasionally fail due to NAT gateway availability issues in a single Availability Zone. Which combination of architectural modifications will resolve these issues while maintaining high availability and security best practices? (Select TWO.)

An electric vehicle (EV) charging network provider is designing a new global charging session management system. The system must process real-time telemetry and session initialization requests from $200,000$ charging stations. At the start of peak operational hours, session initialization requests spike from $2,000$ requests per second to $60,000$ requests per second within a $1$-minute window. The system must process these requests with sub-100ms latency, validate the user's account status, verify charger availability, and persist session records. The read-to-write ratio is $4:1$.

The architecture uses Amazon Route 53, an Application Load Balancer (ALB), and Amazon ECS on AWS Fargate for the API layer. The database layer is Amazon Aurora PostgreSQL.

Which two actions should the Solutions Architect recommend to ensure the platform scales efficiently and meets the performance requirements during peak traffic? (Select TWO.)

A company wants to consolidate application logs from Amazon CloudWatch Logs across multiple AWS accounts in an AWS Organization into a centralized Amazon S3 bucket located in a dedicated Security account. The security team wants to stream these logs in near-real-time using Amazon Kinesis Data Firehose in the Security account, and they need to ensure secure cross-account delivery. Which two steps must the solutions architect take to configure this cross-account log aggregation topology? (Select TWO.)

A media streaming company manages a multi-account environment containing $60$ AWS accounts under a single AWS Organization. The security operations team requires all VPC Flow Logs from all member accounts to be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) to satisfy compliance guidelines. The solution must minimize administrative overhead and enforce least privilege.

Which TWO configurations must a Solutions Architect implement to achieve this goal?

An international media broadcasting company is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of 50 spoke VPCs in a single AWS Region, which host various parts of a media processing pipeline. The company needs to establish a highly available, transitive connection between all VPCs and two on-premises sites: a primary production facility and a backup recovery center. The primary path must run over a 10 Gbps AWS Direct Connect connection. The backup path must use an IPsec VPN over the internet. The solution must minimize routing configuration complexity, automatically fail over to the backup path if the primary path is unavailable, and allow direct VPC-to-VPC communication. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

A technology enterprise is designing a centralized monitoring and auditing solution for its AWS Organization, which contains $40$ member accounts. The security team requires that VPC Flow Logs from all VPCs across all member accounts be consolidated into a single Amazon S3 bucket located in a dedicated Monitoring account. The logs must be encrypted at rest using an AWS KMS key, and the transmission of logs must be secure and isolated to the organization. Which TWO configurations are required to establish this centralized log delivery architecture?

An enterprise is designing a hybrid network architecture to connect $30$ spoke VPCs in a single AWS Region to its on-premises data center. The primary connectivity must be established over a $10\text{ Gbps}$ AWS Direct Connect connection, with a backup AWS Site-to-Site VPN connection over the public internet. All outbound internet traffic from the spoke VPCs must be routed through a centralized egress VPC for security inspection. The solution must minimize routing complexity, avoid single points of failure, and support transitive routing between the VPCs.

Which of the following configuration steps should the Solutions Architect implement to meet these requirements? (Select TWO.)

An organization has a multi-account AWS environment with $25$ VPCs deployed across two AWS Regions: `us-east-1` and `us-west-2`. The organization has established a hybrid network using two $10\text{ Gbps}$ AWS Direct Connect connections terminating at separate DX locations. To ensure resiliency, they want to configure a backup path using a Site-to-Site VPN over the internet. The Direct Connect connections terminate at an AWS Direct Connect Gateway associated with AWS Transit Gateways in each region. Under normal operating conditions, all hybrid traffic must use the Direct Connect connections. The Site-to-Site VPN should only be used if both Direct Connect connections fail. Which two routing configurations must the solutions architect implement on the on-premises router and within AWS to achieve this dynamic failover behavior?

An enterprise is designing a deployment pipeline for a legacy Java application hosted on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer. The deployment must achieve zero downtime and allow for a 1-hour verification window where the old version remains active but receives no traffic, enabling rapid rollback if issues are detected. If the validation succeeds, the old instances must be automatically terminated. The deployment process must be fully managed with minimal custom configuration. Which two configurations should the Solutions Architect include in the AWS CodeDeploy deployment group to meet these requirements? (Select two.)

A multinational financial enterprise is building a regulatory reporting data pipeline. The application tier runs on Amazon EC2 instances in an Application Account (Account A: $111122223333$). The reporting logs must be delivered to an Amazon S3 bucket in a Centralized Security Account (Account B: $444455556666$). The compliance requirements mandate that all logs must be encrypted at rest using a Key Management Service (KMS) key, and the Centralized Security Account must have full ownership of all uploaded objects to prevent access delegation issues. The application tier must only have permissions to write objects and must not be allowed to decrypt the logs once written. Which combination of actions must the solutions architect take to meet these security requirements? (Select TWO.)

A healthcare provider is designing a new digital medical imaging archive and diagnostic report system. The system must store structured patient metadata logs (OLTP workload) and unstructured medical images in DICOM format (Object storage). The metadata database must support high-volume write transactions and scale read traffic to handle sudden spikes from hospital clients. The disaster recovery requirements demand a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $1$ minute. Additionally, for regulatory compliance, the medical images must be securely archived and replicated to a destination bucket in a secondary, isolated AWS account in a different AWS region, encrypted at rest using AWS KMS. Which of the following database and storage configurations should the solutions architect choose to meet these requirements? (Select TWO.)

A global online retailer is launching a flash sale platform for limited-edition merchandise drops. The system expects sudden, extreme traffic surges where active users scale from $5,000$ to over $1,500,000$ within $60\text{ seconds}$ at the start of a sale. The current architecture consists of an Application Load Balancer (ALB), an Amazon ECS on AWS Fargate service, and an Amazon Aurora PostgreSQL database cluster. During testing, the sudden influx of connection requests led to HTTP $503$ Service Unavailable errors from the ALB, and database write latency spiked, causing the Fargate tasks to exhaust their connection pools. Which combination of architectural optimizations will best resolve these performance and scalability issues? (Select TWO)

A digital advertising company is designing a real-time bidding (RTB) platform that processes ad auction requests from global ad exchanges. The system must handle a baseline of $100,000$ requests per second (RPS) and scale to support sudden spikes of up to $800,000$ RPS with sub-$15$ millisecond response times. The current design proposes using an Application Load Balancer (ALB) routing traffic to Amazon ECS tasks running on AWS Fargate, with Amazon Aurora PostgreSQL as the persistent database.

Which two actions should the solutions architect take to meet the performance and latency requirements under peak traffic loads? (Select two.)