Tüm alıştırma soruları

1462 soru

Tüm türler1,462 Çoktan seçmeli739 Çoklu seçim723

A company hosts a critical e-commerce web application at the apex domain `example.com`. The primary infrastructure is deployed behind an Application Load Balancer (ALB) in the `us-east-1` Region. To implement a disaster recovery plan, the company deploys a warm standby version of the application behind another ALB in the `us-west-2` Region. The company wants to configure Amazon Route 53 to route all traffic to `us-east-1` under normal conditions and automatically fail over to `us-west-2` if the primary application becomes unhealthy.

Which TWO configuration steps must a solutions architect take in Route 53 to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a Failover Alias record for the apex domain pointing to the primary ALB, configure it as Primary, and set Evaluate Target Health to Yes.

Create a Failover Alias record for the apex domain pointing to the standby ALB, configure it as Secondary, and set Evaluate Target Health to Yes.

Create a CNAME record for the apex domain pointing to the DNS name of the primary ALB, and configure a secondary CNAME record with a Failover policy pointing to the standby ALB.

Create Latency Alias records pointing to both ALBs, and configure Route 53 to route 100% of the traffic to the primary region during normal operations.

Create a Failover record for the primary ALB, and configure a Route 53 health check that monitors the RDS PostgreSQL read replica in us-west-2 to trigger failover upon database promotion.

Cevabı ve açıklamayı göster

Cevap: Create a Failover Alias record for the apex domain pointing to the primary ALB, configure it as Primary, and set Evaluate Target Health to Yes.; Create a Failover Alias record for the apex domain pointing to the standby ALB, configure it as Secondary, and set Evaluate Target Health to Yes.

Cevap

To configure active-passive failover at the apex domain, create a primary Failover Alias record pointing to the primary ALB, and a secondary Failover Alias record pointing to the standby ALB. For both records, set 'Evaluate Target Health' to 'Yes' to enable automatic health evaluation of the ALBs.

To set up active-passive failover for an apex domain pointing to Application Load Balancers, Route 53 requires two Failover Alias records (one Primary and one Secondary) sharing the same record name. The apex domain (example.com) cannot use CNAME records due to DNS specifications, so Alias records must be used. Setting 'Evaluate Target Health' to Yes on these Alias records allows Route 53 to automatically inherit the health status of the load balancers without requiring manual health check configurations.

Adım Adım Çözüm

Select the apex domain in the Route 53 hosted zone and create a new record set.

A record set configuration window is opened for the zone apex (example.com).

The apex domain requires direct configuration of Alias records since CNAME records cannot exist at the zone apex.

Configure the primary record as an Alias to the primary Application Load Balancer in us-east-1, set the routing policy to Failover, select Primary as the failover type, and enable 'Evaluate Target Health'.

The primary record is configured to route all traffic to the us-east-1 ALB under normal operating conditions and monitor its health.

This establishes the active path and ensures Route 53 is aware of the health of the primary region's ALB.

Configure the secondary record as an Alias to the standby Application Load Balancer in us-west-2, set the routing policy to Failover, select Secondary as the failover type, and enable 'Evaluate Target Health'.

The secondary record is configured to receive traffic only when the primary record is determined to be unhealthy.

This establishes the passive failover path to the warm standby region when the primary region is unavailable.

Anahtar Kavram

Route 53 active-passive DNS failover configuration at the zone apex requires Primary and Secondary Failover Alias records pointing to the respective regional resources, with health evaluation enabled.

Tahmini Süre:2m 0s

Soru 2Soru →

A financial services company hosts its customer-facing portal on AWS using a multi-tier architecture. The portal is fronted by an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances in private subnets. The security team needs to implement a solution to centrally monitor and aggregate security findings across all AWS accounts in the organization, continuously evaluate AWS resource configurations against security best practices (specifically checking for public S3 buckets and overly permissive security groups), and protect the web application from SQL injection attacks and HTTP flood attacks at the application layer. Which combination of AWS services should a solutions architect recommend to meet these requirements with the least operational overhead?

Deploy AWS Shield Standard on the Application Load Balancer to inspect incoming HTTP request bodies for SQL injection patterns and block request floods. Enable AWS Systems Manager to record security group changes, and configure AWS Config to aggregate findings across the organization.

Enable AWS Security Hub across all accounts in the AWS Organization to aggregate findings in a central security administrator account. Enable AWS Config in all accounts to continuously audit security group and Amazon S3 bucket configurations. Deploy AWS WAF on the Application Load Balancer with managed rules to block SQL injection and HTTP flood attacks.

Enable AWS Security Hub to aggregate findings across all accounts. Configure Network ACLs to statefully filter port 22 and port 3389 traffic at the subnet level, and configure AWS Config to track Security Groups applied to subnets. Deploy AWS WAF on the Application Load Balancer.

Deploy AWS Shield Standard on the Application Load Balancer to mitigate application-layer threat patterns. Configure stateless Security Groups at the subnet level to inspect and block unauthorized administrative traffic, and use AWS Config to record compliance findings.

Cevabı ve açıklamayı göster

Cevap: Enable AWS Security Hub across all accounts in the AWS Organization to aggregate findings in a central security administrator account. Enable AWS Config in all accounts to continuously audit security group and Amazon S3 bucket configurations. Deploy AWS WAF on the Application Load Balancer with managed rules to block SQL injection and HTTP flood attacks.

Cevap

The configuration that enables AWS Security Hub for centralized aggregation, AWS Config for configuration compliance auditing, and AWS WAF on the Application Load Balancer for application-layer protection.

The correct architecture uses AWS Security Hub to consolidate security findings across all AWS accounts in the organization, enabling a unified view of the security posture. AWS Config continuously records resource configuration changes and evaluates them against rules (such as checking for public S3 buckets and restricted ports in security groups). To protect the portal against SQL injection and HTTP flood attacks, AWS WAF is deployed on the Application Load Balancer to inspect incoming HTTP/HTTPS traffic at Layer 7.

Adım Adım Çözüm

Analyze requirements for application-layer threat protection, continuous resource configuration monitoring, and centralized security aggregation.

Identify that SQL injection and HTTP flood attacks require Layer 7 traffic inspection, configuration auditing requires continuous compliance checking, and centralization requires multi-account findings aggregation.

This establishes the functional boundary for selecting the correct AWS services.

Evaluate candidate services for Layer 7 web security.

Determine that AWS WAF is the correct service to block SQL injection and HTTP floods via managed rules, whereas AWS Shield Standard only handles Layer 3 and 4 DDoS protection.

This filters out distractors using Shield Standard for application-layer inspection.

Evaluate options for configuration auditing and multi-account compliance monitoring.

Determine that AWS Config audits resource configurations continuously, and AWS Security Hub integrates with AWS Organizations to aggregate these findings into a central administrator account.

This completes the required SAA architecture by leveraging AWS native integration features.

Anahtar Kavram

Centralized security monitoring and application-layer threat detection utilizing AWS Security Hub, AWS Config, and AWS WAF.

Soru 3Soru →

A company hosts its main portal at the apex domain `example.com`. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in the `us-east-1` Region. The company wants to implement an active-passive disaster recovery strategy. If the ALB or the primary application becomes unhealthy, users must be redirected to a static maintenance page hosted on an Amazon S3 bucket configured for website hosting in the `us-west-2` Region. The database backend requires manual failover, so DNS routing must strictly route all users to the primary ALB under normal operations and only to the S3 bucket during a failure. Which two configurations should the solutions architect implement to meet these requirements?

Geçerli olan tümünü seçin

Create a Route 53 Failover Alias record for `example.com` pointing to the Application Load Balancer in `us-east-1`, set the Failover Record Type to Primary, and set Evaluate Target Health to Yes.

Create a Route 53 Failover Alias record for `example.com` pointing to the Amazon S3 static website endpoint in `us-west-2`, set the Failover Record Type to Secondary, and set Evaluate Target Health to No.

Create a Route 53 Latency Alias record for `example.com` pointing to the Application Load Balancer in `us-east-1` and set Evaluate Target Health to Yes to dynamically route users.

Create a CNAME record for `example.com` pointing to the Application Load Balancer DNS name, and configure a Route 53 HTTP health check to monitor the backend instances.

Create a Route 53 Failover record pointing to the Amazon RDS Read Replica, allowing Route 53 to automatically promote the replica to primary if the master database fails.

Cevabı ve açıklamayı göster

Cevap: Create a Route 53 Failover Alias record for `example.com` pointing to the Application Load Balancer in `us-east-1`, set the Failover Record Type to Primary, and set Evaluate Target Health to Yes.; Create a Route 53 Failover Alias record for `example.com` pointing to the Amazon S3 static website endpoint in `us-west-2`, set the Failover Record Type to Secondary, and set Evaluate Target Health to No.

Cevap

Create a Route 53 Failover Alias record for the apex domain pointing to the Application Load Balancer in the primary region, set the record type as Primary, and enable Evaluate Target Health. Additionally, create a Route 53 Failover Alias record pointing to the S3 static website endpoint, set the record type as Secondary, and disable Evaluate Target Health.

To establish an active-passive failover for an apex domain, the solutions architect must configure Route 53 Failover Alias records. The Primary record points to the Application Load Balancer with Evaluate Target Health set to Yes. This configuration allows Route 53 to evaluate the health of the ALB and failover if the ALB is unhealthy. The Secondary record points to the S3 bucket website endpoint with Evaluate Target Health set to No, since the bucket serves as the static maintenance page and does not require further health validation.

Adım Adım Çözüm

Determine the apex domain record requirements

Identify that the zone apex (`example.com`) cannot use a CNAME record, necessitating the use of Route 53 Alias records.

DNS standards prevent mapping a CNAME record directly to the root of a domain.

Configure the primary routing policy

Create a Failover Alias record pointing to the primary Application Load Balancer (ALB) and enable Evaluate Target Health.

This allows Route 53 to determine the health of the ALB using its built-in health indicators and dynamically failover when necessary.

Configure the backup routing policy

Create a Secondary Failover Alias record pointing to the Amazon S3 static website endpoint and disable Evaluate Target Health.

Disabling Evaluate Target Health on the secondary endpoint ensures traffic is successfully directed to the maintenance page during a failover event, without checking the health of the static page itself.

Anahtar Kavram

Route 53 active-passive DNS failover using Alias records at the zone apex

Soru 4Soru →

A biotechnology company runs computational workflows that simulate molecular interactions. The simulations must be processed in the exact chronological order in which they are submitted to ensure data dependency integrity. Each simulation takes between $1$ and $2$ hours to execute. The simulation requests are highly irregular, with dozens of submissions occurring simultaneously followed by days of complete inactivity. The database must scale instantly to handle the write throughput when simulations complete, but must not incur compute costs during inactive periods. Which architecture is the most cost-effective and meets these requirements?

Queue the jobs in an Amazon SQS FIFO queue, execute the simulations as Amazon ECS tasks on AWS Fargate, and store the output in an Amazon DynamoDB table configured with on-demand capacity.

Queue the jobs in an Amazon SQS standard queue, execute the simulations as AWS Lambda functions, and store the output in an Amazon DynamoDB table configured with provisioned capacity.

Queue the jobs in an Amazon SQS standard queue, execute the simulations as Amazon ECS tasks on AWS Fargate, and store the output in an Amazon DynamoDB table configured with on-demand capacity.

Queue the jobs in an Amazon SQS FIFO queue, execute the simulations as Amazon ECS tasks on AWS Fargate, and store the output in an Amazon DynamoDB table configured with provisioned capacity.

Cevabı ve açıklamayı göster

Cevap: Queue the jobs in an Amazon SQS FIFO queue, execute the simulations as Amazon ECS tasks on AWS Fargate, and store the output in an Amazon DynamoDB table configured with on-demand capacity.

Cevap

Queue the jobs in an Amazon SQS FIFO queue, execute the simulations as Amazon ECS tasks on AWS Fargate, and store the output in an Amazon DynamoDB table configured with on-demand capacity.

The correct solution uses an Amazon SQS FIFO queue to enforce strict ordering of the jobs. For the compute layer, Amazon ECS on AWS Fargate is chosen because the simulation runtime of 1 to 2 hours exceeds the 15-minute limitation of AWS Lambda. Fargate is serverless and scales to zero, ensuring zero compute cost when idle. For the database, Amazon DynamoDB in on-demand capacity mode instantly scales to handle completion writes and avoids ongoing idle costs during periods of inactivity.

Adım Adım Çözüm

Analyze the ordering requirement.

Since the simulation jobs must be processed in the exact chronological order of submission, an Amazon SQS FIFO (First-In-First-Out) queue is required, eliminating standard SQS options.

Amazon SQS standard queues do not guarantee message ordering, whereas SQS FIFO queues ensure strict order-of-arrival processing.

Analyze the compute runtime and serverless scaling requirement.

AWS Fargate must be used instead of AWS Lambda.

Each simulation runs for 1 to 2 hours, which exceeds the 15-minute execution limit of AWS Lambda. Running containerized tasks on AWS Fargate allows execution times up to several days while remaining serverless and scaling to zero when idle.

Analyze the database capacity mode for the irregular workload.

Amazon DynamoDB must be configured with on-demand capacity mode.

On-demand capacity mode dynamically scales to handle instant write spikes and does not charge for idle capacity during inactive periods, whereas provisioned capacity mode would incur ongoing costs for idle resources.

Anahtar Kavram

Selecting cost-effective serverless compute and database capacity modes for irregular, long-running tasks requiring ordered processing.

Soru 5Soru →

A financial services firm hosts a customer-facing web application on AWS behind an Application Load Balancer (ALB). The security team needs to implement a solution to monitor for and automatically block SQL injection attacks at the application layer. Additionally, they must ensure that all administrative and management API actions across the entire AWS account are recorded and audited for regulatory compliance. Which combination of actions should a solutions architect recommend to meet these requirements?

Deploy AWS WAF on the Application Load Balancer with a rule group to detect and block SQL injection attacks, and configure AWS CloudTrail with a multi-region trail to log all API activity to a secure Amazon S3 bucket.

Enable AWS Shield Standard to inspect incoming requests and block SQL injection attacks on the Application Load Balancer, and enable AWS CloudTrail to log administrative API activity to an Amazon S3 bucket.

Deploy stateful rules in the subnet-level Network Access Control Lists (NACLs) to inspect HTTP payload content and block SQL injection traffic, and configure AWS Config to record all administrative API actions.

Deploy AWS WAF on the Application Load Balancer to mitigate SQL injection attacks, and use the AWS account root user credentials to configure a daily cron job that downloads and logs administrative activity.

Cevabı ve açıklamayı göster

Cevap: Deploy AWS WAF on the Application Load Balancer with a rule group to detect and block SQL injection attacks, and configure AWS CloudTrail with a multi-region trail to log all API activity to a secure Amazon S3 bucket.

Cevap

The correct answer combines AWS WAF, which inspects HTTP/S traffic at Layer 7 to block SQL injection attacks, with AWS CloudTrail, which logs API and management console activities for compliant security monitoring.

Adım Adım Çözüm

Determine the correct service to monitor and mitigate Layer 7 application exploits.

AWS WAF is selected because it is designed to analyze HTTP payloads and block SQL injection attacks at the Application Load Balancer.

Other services like AWS Shield Standard or Network ACLs operate at network layers and cannot perform application payload inspection.

Select the appropriate compliance logging mechanism for AWS account administrative API activity.

AWS CloudTrail is chosen to record API calls and management events.

CloudTrail provides standard auditing logs for all management console, CLI, and SDK operations.

Combine into a secure, Well-Architected solution.

WAF is attached to the ALB, and a multi-region CloudTrail logs all API activity to a secure Amazon S3 bucket.

This guarantees real-time mitigation of application exploits and audit records stored securely for compliance.

Anahtar Kavram

Application-layer threat detection and compliance logging on AWS

Tahmini Süre:2m 0s

Soru 6Soru →

A gaming company is launching a multiplayer game and expects highly unpredictable traffic spikes during promotional events. The application requires microsecond read latency for player profiles and must scale dynamically to handle sudden write surges. A solutions architect chooses to use Amazon DynamoDB to store the profile data. Which database configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure the DynamoDB table to use on-demand capacity mode.

Deploy Amazon DynamoDB Accelerator (DAX) to cache read requests.

Configure the DynamoDB table to use provisioned capacity mode and enable auto scaling.

Design the table's partition key using a monotonically increasing timestamp.

Migrate the data to Amazon RDS for MySQL and configure read replicas as the primary automatic failover target.

Cevabı ve açıklamayı göster

Cevap: Configure the DynamoDB table to use on-demand capacity mode.; Deploy Amazon DynamoDB Accelerator (DAX) to cache read requests.

Cevap

Configure the DynamoDB table to use on-demand capacity mode and deploy Amazon DynamoDB Accelerator (DAX) to cache read requests.

Configuring the DynamoDB table to use on-demand capacity mode ensures that DynamoDB scales instantly to handle sudden, unpredictable write spikes without throttling. Deploying Amazon DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read response times from milliseconds to microseconds, meeting the low-latency read requirements.

Adım Adım Çözüm

Analyze the read latency requirement.

The application requires microsecond read latency.

Standard DynamoDB read response times are in single-digit milliseconds. Implementing Amazon DynamoDB Accelerator (DAX) is required to reduce read response times to microseconds.

Analyze the write scaling and traffic pattern requirements.

The workload is highly unpredictable with sudden spikes.

DynamoDB on-demand capacity mode is designed for workloads with unpredictable traffic spikes, providing instant capacity scaling without the delay associated with provisioned capacity auto scaling.

Anahtar Kavram

To achieve microsecond read latency and handle highly unpredictable traffic spikes with Amazon DynamoDB, solutions architects should combine DynamoDB Accelerator (DAX) for caching and on-demand capacity mode for instant scaling.

Soru 7Soru →

A startup is launching a mobile game that stores user profile data. The game's traffic is highly unpredictable and spiky, with writes to the database increasing from 100 writes per second to over 12,000 writes per second within minutes when popular influencers stream the game. Outside of these events, traffic is minimal. The database must be highly available and scale automatically to handle these sudden spikes. Which database configuration meets these requirements most cost-effectively?

Amazon DynamoDB configured in on-demand capacity mode

Amazon DynamoDB configured in provisioned capacity mode with Auto Scaling enabled

Amazon RDS for MySQL in a Single-AZ deployment, utilizing a Read Replica in a different Availability Zone as the primary automated failover target to handle database recovery and accommodate write traffic spikes

Amazon DynamoDB configured in provisioned capacity mode with Write Capacity Units (WCUs) statically provisioned at 12,000

Cevabı ve açıklamayı göster

Cevap: Amazon DynamoDB configured in on-demand capacity mode

Cevap

Amazon DynamoDB configured in on-demand capacity mode

The correct answer is the option proposing Amazon DynamoDB in on-demand capacity mode. For highly unpredictable workloads with sudden, massive spikes followed by periods of inactivity, DynamoDB on-demand capacity mode is the most cost-effective choice. It scales automatically and instantly to accommodate write spikes up to 12,000 writes per second and incurs no charges when the database is idle, charging only for actual read and write requests.

Adım Adım Çözüm

Analyze workload characteristics

The workload has extreme write spikes (from 100 to 12,000 writes/sec) that occur rapidly (within minutes) and are highly unpredictable, with long periods of idle time.

Understanding the traffic pattern is critical to choosing the correct database capacity model.

Evaluate DynamoDB on-demand capacity mode against the workload profile

On-demand capacity mode instantly scales to accommodate sudden, unpredictable spikes in traffic and charges only for the actual requests consumed, making it highly cost-optimized for this pattern.

This mode avoids paying for idle resources while ensuring the database does not throttle during sudden spikes.

Compare with alternative configurations

Provisioned capacity with Auto Scaling cannot scale up quickly enough to handle sudden spikes from 100 to 12,000 writes per second, leading to database throttling. Statically provisioning for peak load is extremely expensive and wasteful during idle periods. Single-AZ RDS with a Read Replica is not a valid automated high availability option and cannot scale writes dynamically.

Confirming why the other options fail to meet the cost and performance requirements.

Anahtar Kavram

Selecting the optimal database capacity mode (on-demand vs. provisioned) based on workload predictability and scaling velocity to minimize cost while maintaining performance.

Tahmini Süre:1m 30s

Soru 8Soru →

An enterprise is migrating a legacy customer management API to AWS. The API runs on a cluster of Amazon EC2 instances in a private subnet, configured to listen on port 8080. An Application Load Balancer (ALB) is deployed in public subnets to distribute incoming traffic. The application needs to dynamically scale based on demand while maintaining high availability. Traffic to the backend instances must be securely restricted, and the load balancer must accurately determine target health. Which two configurations should the solutions architect implement to satisfy these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure the target group to route traffic to port 8080 and set the health check port to use the traffic port.

Configure the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the Application Load Balancer.

Configure the target group health check to query the default port 80 to ensure the web server is listening, while routing main traffic to port 8080.

Create a Network ACL on the private subnet that allows inbound traffic on port 8080 from the security group of the Application Load Balancer.

Configure an Amazon Route 53 latency-based routing policy to direct client requests directly to the private EC2 instances to handle the scaling load.

Cevabı ve açıklamayı göster

Cevap: Configure the target group to route traffic to port 8080 and set the health check port to use the traffic port.; Configure the security group of the EC2 instances to allow inbound traffic on port 8080 from the security group of the Application Load Balancer.

Cevap

To support an application running on port 8080, the target group must route traffic to port 8080 with the health check port matching the traffic port, and the EC2 instances' security group must allow inbound traffic on port 8080 from the security group of the Application Load Balancer.

To support an application running on port 8080, the target group must route traffic to port 8080 and its health checks must target the same port (or 'traffic-port') to ensure accurate status reporting. Additionally, to secure the architecture, the EC2 instances' security group should allow inbound traffic on port 8080 specifically from the security group of the Application Load Balancer.

Adım Adım Çözüm

Configure the ELB Target Group mapping.

The target group is set to route requests to backend instances on port 8080.

Since the legacy API is configured to listen on port 8080, the ALB needs to target that specific port.

Align target health check port configuration.

The target group health checks query port 8080 (the traffic port).

Matching the health check port to the traffic port ensures that the load balancer correctly detects application availability without causing false unhealthy states.

Configure instance security group rules.

The EC2 instances' security group is restricted to allow port 8080 traffic only from the ALB's security group.

This implements the principle of least privilege by securing the backend instances so they can only receive traffic originating from the load balancer.

Anahtar Kavram

Integrating Elastic Load Balancing (ELB) with backend EC2 targets requires matching application ports for routing and health checks, and establishing secure path communications via security group chaining.

Tahmini Süre:2m 0s

Soru 9Soru →

A digital music distribution company hosts its core streaming platform in a primary AWS Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, and an Amazon Aurora MySQL database. The company wants to set up a disaster recovery (DR) solution in a secondary AWS Region with a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes, while minimizing ongoing infrastructure costs.

Which combination of actions should the solutions architect implement to meet these requirements at the lowest cost? (Select TWO.)

Geçerli olan tümünü seçin

Configure an Amazon Aurora Global Database with the primary database cluster in the primary Region and a secondary database cluster in the secondary Region.

Deploy a Pilot Light environment in the secondary Region with an Auto Scaling group set to a minimum capacity of zero, and scale it up during a failover event.

Configure an Amazon Route 53 latency routing policy to route traffic between Regions without configuring health checks.

Back up the database daily to Amazon S3 Glacier Flexible Retrieval in the primary Region and copy the archives to the secondary Region.

Configure a standard Amazon RDS MySQL Multi-AZ deployment and use a read replica in the secondary Region as the main automatic failover target.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary database cluster in the primary Region and a secondary database cluster in the secondary Region.; Deploy a Pilot Light environment in the secondary Region with an Auto Scaling group set to a minimum capacity of zero, and scale it up during a failover event.

Cevap

Configure an Amazon Aurora Global Database with a secondary cluster in the secondary Region, and deploy a Pilot Light environment in the secondary Region with an Auto Scaling group minimum capacity of zero.

The correct combination implements Amazon Aurora Global Database for sub-second cross-region data replication (satisfying the 5-minute RPO) and a Pilot Light environment in the secondary Region with compute resources set to a minimum capacity of zero (satisfying the 15-minute RTO at the lowest cost).

Adım Adım Çözüm

Analyze the RPO requirement of 5 minutes to determine the database replication strategy.

Amazon Aurora Global Database provides sub-second cross-region replication, which easily satisfies the 5-minute RPO requirement.

Traditional backups or slower replication methods cannot meet a 5-minute recovery point objective.

Analyze the RTO requirement of 15 minutes and the goal of minimizing costs to determine the compute failover strategy.

A Pilot Light environment with an Auto Scaling group capacity set to zero ensures no running compute costs in the recovery Region while permitting new instances to spin up within 15 minutes.

A Warm Standby requires running active instances, which increases ongoing costs, while a Pilot Light meets both the recovery time and low-cost objectives.

Anahtar Kavram

Disaster Recovery (DR) strategies balancing RTO, RPO, and cost using Aurora Global Database and Pilot Light deployments.

Tahmini Süre:2m 0s

Soru 10Soru →

A financial technology startup recently deployed an application on AWS. The security team needs to establish continuous monitoring of resource configurations to ensure compliance with security standards. Specifically, they must detect when any Security Group allows unrestricted ingress traffic on port 22 or port 3389, and they must automatically remediate these non-compliant configurations by reverting the rules. Additionally, they need to centralize security alerts and compliance statuses across all AWS accounts in the organization. Which combination of AWS services and configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Implement AWS Config rules to monitor Security Group configurations and configure remediation using an AWS Systems Manager Automation document to remove non-compliant ingress rules.

Enable AWS Security Hub in the management account and configure it to aggregate compliance findings and security alerts from AWS Config across all accounts in the organization.

Deploy AWS WAF at the subnet level to inspect inbound traffic and automatically block unauthorized SSH and RDP connection attempts.

Configure stateful Network ACLs (NACLs) at the subnet level to monitor configuration changes and automatically block port 22 and port 3389 traffic.

Enable AWS Shield Advanced to continuously scan security group rules for compliance and automatically rotate security keys when unauthorized ports are open.

Cevabı ve açıklamayı göster

Cevap: Implement AWS Config rules to monitor Security Group configurations and configure remediation using an AWS Systems Manager Automation document to remove non-compliant ingress rules.; Enable AWS Security Hub in the management account and configure it to aggregate compliance findings and security alerts from AWS Config across all accounts in the organization.

Cevap

Implement AWS Config rules to monitor and automatically remediate security groups using Systems Manager Automation, and use AWS Security Hub to centralize the aggregated findings across the organization.

AWS Config rules evaluate the configuration settings of AWS resources, detecting open ports in security groups and triggering automated remediation via AWS Systems Manager Automation. AWS Security Hub aggregates compliance data and security findings from AWS Config and other services across the organization into a centralized dashboard.

Adım Adım Çözüm

Select AWS Config to track Security Group changes and configure automatic remediation.

AWS Config monitors configurations and triggers Systems Manager Automation to revert non-compliant rules.

AWS Config is the primary tool for monitoring configuration compliance, and AWS Systems Manager Automation provides remediation scripts.

Select AWS Security Hub to aggregate and centralize alerts.

AWS Security Hub acts as the centralized console to gather findings across the organization.

AWS Security Hub is designed to centralize and prioritize security alerts and compliance statuses across multiple AWS services and accounts.

Anahtar Kavram

Centralized compliance monitoring, configuration auditing, and automated remediation using AWS Config and AWS Security Hub.

Tahmini Süre:2m 0s

Soru 11Soru →

A global travel reservation platform hosts its application in the `us-east-1` Region. The architecture consists of an Amazon Aurora MySQL database cluster and a fleet of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The platform needs to establish a disaster recovery (DR) plan in the `us-west-2` Region. The DR solution must achieve a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $2$ minutes, while minimizing ongoing running costs in the secondary region.

Which combination of actions should a solutions architect perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create an Amazon Aurora Global Database with the primary cluster in `us-east-1` and a secondary cluster in `us-west-2`. In the event of a primary region outage, promote the secondary cluster to a standalone primary cluster.

Deploy an Application Load Balancer and an Auto Scaling group in `us-west-2` with minimum and desired capacities set to

1

. Configure Amazon Route 53 with failover routing and health checks to route traffic to the secondary load balancer.

Configure daily snapshots of the database cluster, copy them to Amazon S3 in `us-west-2`, and transition them to Amazon S3 Glacier Flexible Retrieval to minimize storage costs.

Configure Amazon Route 53 with latency-based routing to split client traffic equally between `us-east-1` and `us-west-2` without health checks, and maintain identical EC2 running capacity in both regions.

Deploy a standard Amazon RDS for MySQL database in `us-east-1` with a Read Replica in `us-west-2`, and rely on Amazon RDS to automatically fail over and redirect application write traffic to the Read Replica during a regional outage.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Aurora Global Database with the primary cluster in `us-east-1` and a secondary cluster in `us-west-2`. In the event of a primary region outage, promote the secondary cluster to a standalone primary cluster.; Deploy an Application Load Balancer and an Auto Scaling group in `us-west-2` with minimum and desired capacities set to $1$ . Configure Amazon Route 53 with failover routing and health checks to route traffic to the secondary load balancer.

Cevap

Create an Amazon Aurora Global Database to replicate the database, and maintain a scaled-down Pilot Light compute tier in the secondary region with Route 53 failover routing.

Aurora Global Database replicates data across regions with latency under

1

second, satisfying the

2

-minute RPO. In a disaster, the secondary cluster can be promoted to a standalone primary cluster in less than

1

minute. Maintaining a scaled-down Auto Scaling group (Pilot Light) with a capacity of

1

in the secondary region minimizes ongoing costs while ensuring the infrastructure is ready to scale up within the

15

-minute RTO when Route 53 routes traffic there.

Adım Adım Çözüm

Determine the database replication mechanism that meets the RPO of

2

minutes.

Aurora Global Database provides asynchronous replication with typical latency of less than

1

second, which fits the requirement.

Choosing a high-performing database replication technology is necessary to ensure data is constantly synchronized without violating the recovery point objective.

Determine the compute recovery strategy that meets the RTO of

15

minutes while minimizing running costs.

A Pilot Light strategy with an Auto Scaling group having a minimum/desired capacity of

1

keeps costs low while allowing rapid scaling when DNS failover is triggered.

Maintaining active but scaled-down services ensures that the endpoint infrastructure is online, which speeds up failover compared to building from backups.

Configure Amazon Route 53 failover routing with health checks.

DNS requests will resolve to the primary region under normal conditions and automatically redirect to the secondary region if the primary region becomes unhealthy.

Automatic failover requires health monitoring and dynamic DNS resolution routing policies to minimize manual intervention and meet the RTO.

Anahtar Kavram

Disaster Recovery (DR) strategies using Aurora Global Database and Pilot Light compute scaling across AWS Regions.

Soru 12Soru →

A company is designing a fleet management system that receives diagnostic alerts from vehicles. When an alert is received, it must be sent to two separate applications: a real-time notification service and a maintenance scheduling service. The system must decouple the alert reception from the processing services and handle traffic spikes without losing messages. Strict ordering of the alerts is not required.

Which combination of AWS services should a solutions architect choose to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Amazon Simple Notification Service (Amazon SNS) to fan out the alerts to multiple destination queues.

Amazon Simple Queue Service (Amazon SQS) standard queues to buffer the alerts for each processing service.

Amazon SQS FIFO queues to guarantee that all alerts are processed in the exact order they are received.

Amazon Route 53 with latency-based routing to distribute the alerts directly to the processing instances.

Cevabı ve açıklamayı göster

Cevap: Amazon Simple Notification Service (Amazon SNS) to fan out the alerts to multiple destination queues.; Amazon Simple Queue Service (Amazon SQS) standard queues to buffer the alerts for each processing service.

Cevap

Amazon Simple Notification Service (Amazon SNS) to fan out the alerts to multiple destination queues, and Amazon Simple Queue Service (Amazon SQS) standard queues to buffer the alerts for each processing service.

To send the same event to multiple downstream systems and decouple them, the solutions architect should use the SNS-to-SQS fan-out pattern. Amazon SNS publishes the event once, and standard Amazon SQS queues subscribed to the SNS topic receive a copy of the message. This decouples the services, buffers the messages to handle traffic spikes, and avoids the unnecessary complexity of FIFO queues since ordering is not required.

Adım Adım Çözüm

Analyze the requirements for decoupling and fan-out.

The alerts must be processed by two separate services independently (fan-out pattern) and decoupled to handle traffic spikes.

Identifying the patterns needed determines the correct architectural components.

Select the fan-out component.

Amazon SNS is selected to receive the alert and publish it to multiple destinations.

SNS is the standard AWS service for pub/sub messaging and fan-out patterns.

Select the buffering and queuing component.

Amazon SQS standard queues are selected to buffer the alerts for each subscriber service.

SQS standard queues provide message buffering, decoupling, and high throughput without requiring strict ordering.

Anahtar Kavram

The combination of Amazon SNS and Amazon SQS (fan-out pattern) allows messages to be sent to multiple destination queues, enabling decoupled, scale-resilient parallel processing without strict ordering requirements.

Soru 13Soru →

A global gaming platform is designing a network architecture to connect its on-premises development facility to multiple VPCs across different AWS Regions. The on-premises connection must be highly resilient, low-latency, and support a continuous simulation data stream of up to $5\text{ Gbps}$ . Additionally, the company hosts dynamic player APIs in both the `us-east-1` and `eu-west-1` Regions. Global players require the lowest possible network latency and high availability when accessing these dynamic endpoints. Which combination of AWS network architectures should a solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Establish an AWS Direct Connect connection to a Direct Connect gateway, and attach it to an AWS Transit Gateway to route traffic to the VPCs across multiple Regions.

Deploy AWS Global Accelerator to route dynamic player API traffic to the endpoints in both Regions using anycast IP addresses.

Set up a single AWS Site-to-Site VPN connection to a Transit Gateway to securely transport the

5\text{ Gbps}

simulation data stream over the internet.

Configure Amazon Route 53 latency-based routing policies to route dynamic API requests, relying on DNS caching to minimize latency for players.

Create a full mesh of VPC Peering connections between all Regions, and apply stateful Network Access Control Lists (NACLs) to manage access policies.

Cevabı ve açıklamayı göster

Cevap: Establish an AWS Direct Connect connection to a Direct Connect gateway, and attach it to an AWS Transit Gateway to route traffic to the VPCs across multiple Regions.; Deploy AWS Global Accelerator to route dynamic player API traffic to the endpoints in both Regions using anycast IP addresses.

Cevap

The correct architecture combination includes establishing an AWS Direct Connect connection to a Direct Connect gateway attached to an AWS Transit Gateway, and deploying AWS Global Accelerator to route dynamic player API traffic using anycast IP addresses.

Establishing an AWS Direct Connect connection connected to a Direct Connect gateway and attached to an AWS Transit Gateway is the correct solution for the hybrid network. Direct Connect provides high bandwidth (up to

100\text{ Gbps}

) and low latency. Utilizing AWS Global Accelerator is the correct solution for player API traffic because it assigns anycast IP addresses that route traffic over the fast, congestion-free AWS global backbone network directly to the healthy ALB endpoints, bypassing the public internet.

Adım Adım Çözüm

Analyze the on-premises throughput and multi-Region connection requirements.

Identify that the on-premises connection needs to support

5\text{ Gbps}

across multiple Regions with low latency.

Since a single VPN tunnel is limited to

1.25\text{ Gbps}

, AWS Direct Connect is required to meet the high bandwidth demand. Using a Direct Connect gateway with AWS Transit Gateway enables routing to multiple VPCs across different Regions.

Analyze the player API acceleration requirements for lowest latency and high availability.

Identify that the dynamic APIs are deployed in two Regions (`us-east-1` and `eu-west-1`) and require network acceleration.

AWS Global Accelerator uses anycast IP addresses to ingest traffic at edge locations and routes it over the high-performing AWS global network, which minimizes network hops and latency.

Evaluate and eliminate incorrect architectures.

Discard VPN due to bandwidth limits, Route 53 latency routing because it does not optimize TCP path latency, and stateful NACLs with VPC Peering because NACLs are stateless.

Eliminating invalid configurations ensures the proposed combination is both correct and optimal.

Anahtar Kavram

Designing high-performance, low-latency, and high-throughput hybrid and global network architectures using AWS Direct Connect, AWS Transit Gateway, and AWS Global Accelerator.

Soru 14Soru →

A global digital healthcare platform provides telehealth services through an Application Load Balancer (ALB) in the us-east-1 Region. The platform is experiencing intermittent latency due to a surge in malicious traffic, including distributed denial of service (DDoS) attempts at the network layer and SQL injection attempts at the application layer. The company needs to implement a solution that caches static healthcare resources at the edge, mitigates L3/L4 DDoS attacks, and blocks L7 malicious exploits before they reach the ALB. Which combination of configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache static assets and utilize built-in AWS Shield Standard for Layer 3 and Layer 4 protection.

Create an AWS WAF web ACL with SQL injection protection rules and associate it with the Amazon CloudFront distribution.

Enable AWS Shield Standard on the Application Load Balancer and configure it to inspect and block Layer 7 SQL injection attacks.

Configure stateless Network Access Control Lists (NACLs) at the subnet level to perform deep packet inspection and filter out SQL injection patterns.

Configure the Application Load Balancer security groups to block traffic originating from outside the local VPC CIDR block.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer to cache static assets and utilize built-in AWS Shield Standard for Layer 3 and Layer 4 protection.; Create an AWS WAF web ACL with SQL injection protection rules and associate it with the Amazon CloudFront distribution.

Cevap

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer and associate an AWS WAF web ACL with the CloudFront distribution.

Deploying an Amazon CloudFront distribution provides global edge caching and automatically includes AWS Shield Standard protection to mitigate Layer 3 and Layer 4 DDoS attacks. Associating an AWS WAF web ACL with the CloudFront distribution allows the inspection of incoming HTTP requests at the edge, blocking Layer 7 exploits such as SQL injection before they reach the origin Application Load Balancer.

Adım Adım Çözüm

Address caching and Layer 3/4 DDoS protection at the edge.

Amazon CloudFront is deployed to cache static content at edge locations. Traffic routed through CloudFront is automatically protected by AWS Shield Standard against infrastructure DDoS attacks.

This offloads traffic from the Application Load Balancer and mitigates L3/L4 network-layer threats before they hit internal systems.

Address Layer 7 SQL injection protection.

An AWS WAF web ACL is created with rules to detect SQL injection and is associated with the Amazon CloudFront distribution.

AWS WAF provides the deep packet inspection capabilities needed to inspect HTTP request bodies and block SQL injection attempts at the edge network.

Evaluate and eliminate incorrect firewall configurations.

Reject subnet Network ACLs and security groups as solutions for SQL injection protection.

NACLs and security groups operate at Layer 4 and cannot inspect Layer 7 payload content. Additionally, blocking external traffic via security groups would make the public platform inaccessible.

Anahtar Kavram

Combining Amazon CloudFront, AWS Shield Standard, and AWS WAF at the AWS edge to protect applications against Layer 3/4 DDoS and Layer 7 exploits.

Soru 15Soru →

A company is hosting a financial transaction processing application on Amazon EC2 instances in a private subnet (CIDR block $10.0.1.0/24$ ) within a VPC. The instances must meet the following network connectivity and security requirements:

1. Securely access Amazon S3 buckets to store transaction logs without traversing the public internet and without incurring data processing fees.
2. Establish outbound HTTPS connections to an external credit score API (destination IP address $203.0.113.50/32$ on TCP port $443$ ) while blocking all other outbound internet traffic.
3. Allow the return traffic from the external credit score API back to the EC2 instances.

A solutions architect has deployed a NAT gateway in a public subnet to handle internet egress. Which combination of network configuration steps must the solutions architect implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the private subnet.

Configure the private subnet's Network ACL with an outbound rule allowing TCP port

443

203.0.113.50/32

. Do not configure an inbound rule for the return traffic, as Network ACLs are stateful and will automatically permit the response traffic.

Route all outbound traffic, including requests to Amazon S3, through the NAT gateway, and configure an Amazon S3 Interface VPC Endpoint in the public subnet to eliminate data processing fees.

Configure the private subnet's Network ACL with an outbound rule allowing TCP port

443

203.0.113.50/32

, and an inbound rule allowing TCP ports

1024-65535

from

203.0.113.50/32

Configure the security group attached to the EC2 instances with an inbound rule allowing TCP ports

1024-65535

from

203.0.113.50/32

to permit return traffic from the external credit score API.

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the private subnet.; Configure the private subnet's Network ACL with an outbound rule allowing TCP port $443$ to $203.0.113.50/32$ , and an inbound rule allowing TCP ports $1024-65535$ from $203.0.113.50/32$ .

Cevap

To secure the VPC network configuration, the solutions architect must create a Gateway VPC Endpoint for Amazon S3 associated with the private subnet's route table, and configure the private subnet's Network ACL with an outbound rule allowing TCP port 443 to the target API IP and an inbound rule allowing TCP ports 1024-65535 from the target API IP.

The correct architecture combines a Gateway VPC Endpoint for Amazon S3 with a stateless Network ACL configuration. First, using a Gateway VPC Endpoint for S3 is a free service that prevents S3 traffic from routing through the NAT gateway, thereby avoiding NAT data processing fees. Second, because Network ACLs are stateless, they require both an outbound rule to permit the request to the third-party API on port

443

and an inbound rule to permit the return traffic on the client's ephemeral port range (

1024-65535

) from the API's IP address.

Adım Adım Çözüm

Address the S3 connectivity requirement by evaluating Gateway vs Interface endpoints.

Creating a Gateway VPC Endpoint for Amazon S3 is free, does not traverse the NAT gateway, and automatically updates the private subnet's route table to direct S3-destined traffic through the endpoint.

This satisfies the requirement to access Amazon S3 securely without using the internet or incurring data transfer costs.

Address the stateless filtering layer (Network ACLs) for the third-party API traffic.

An outbound Network ACL rule must allow traffic to

203.0.113.50/32

on port

443

. A corresponding inbound Network ACL rule must allow return traffic from

203.0.113.50/32

on ephemeral ports

1024-65535

Network ACLs are stateless; they do not track connection state, so return traffic must be explicitly permitted.

Address the stateful filtering layer (Security Groups) for the third-party API traffic.

The security group only needs an outbound rule allowing TCP port

443

203.0.113.50/32

. No inbound rule is needed.

Security groups are stateful; once outbound traffic is allowed, return traffic is dynamically permitted.

Anahtar Kavram

Stateless Network ACLs require explicit configuration for both outbound request traffic and inbound ephemeral return traffic, whereas stateful Security Groups handle return traffic automatically.

Tahmini Süre:3m 0s

Soru 16Soru →

A company has an on-premises Active Directory and is migrating its web application to AWS. The application runs on Amazon EC2 instances. The solutions architect must ensure that:
1. Corporate employees can access the AWS Management Console using their existing credentials, without creating individual IAM users.
2. The EC2 instances can securely access a private Amazon S3 bucket without using long-term credentials.
3. Administrative operations in the AWS account must be restricted to standard IAM administrative roles, ensuring the root user is not used for daily activities.

Which combination of steps should the solutions architect implement to meet these security requirements?

Create individual IAM users for each employee and run a script to synchronize passwords from Active Directory. Store the S3 access keys in a plaintext String parameter in AWS Systems Manager Parameter Store for the EC2 instances to retrieve. Use the AWS account root user credentials for daily administrative tasks.

Configure AWS IAM Identity Center to federate the on-premises Active Directory. Generate a dedicated IAM user with long-term credentials, configure S3 access permissions on this user, and distribute the access keys to the EC2 instances. Enable automatic key rotation for the customer managed KMS key encrypting the S3 bucket, assuming it will immediately re-encrypt all existing bucket data.

Configure AWS IAM Identity Center to federate the on-premises Active Directory. Attach an IAM role with an instance profile to the EC2 instances to grant temporary permissions to access the S3 bucket. Create a dedicated IAM role with administrative policies for daily cloud administration instead of using the AWS account root user.

Create individual IAM users for each employee in the AWS account. Attach an IAM role with an instance profile to the EC2 instances to grant temporary permissions to access the S3 bucket. Configure the AWS account root user to perform daily administrative tasks, ensuring Multi-Factor Authentication (MFA) is enabled on the root user.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate the on-premises Active Directory. Attach an IAM role with an instance profile to the EC2 instances to grant temporary permissions to access the S3 bucket. Create a dedicated IAM role with administrative policies for daily cloud administration instead of using the AWS account root user.

Cevap

Configure AWS IAM Identity Center to federate the Active Directory, use an IAM role with an instance profile for EC2 S3 access, and use a dedicated administrative IAM role for daily tasks instead of the root user.

The correct solution uses AWS IAM Identity Center to federate Active Directory identities, which fulfills the requirement of single sign-on without manual IAM user overhead. It employs an IAM role with an instance profile to supply temporary credentials to EC2 instances, adhering to credential management best practices. Finally, it uses a dedicated administrative IAM role for daily tasks rather than exposing the root user account.

Adım Adım Çözüm

Configure AWS IAM Identity Center to federate Active Directory.

Employees can log in with corporate credentials without creating duplicate IAM users in AWS.

Allows centralized identity management and avoids the creation of static IAM users.

Assign an IAM role with an instance profile to the EC2 instances.

The application automatically obtains temporary AWS security credentials to access S3.

Eliminates the risk of hardcoded, static credentials on the EC2 instances.

Deploy a dedicated IAM role for administrator duties.

Administrative operations are performed securely without using the AWS account root user.

Protects the root account by restricting daily administrative actions to standard IAM roles.

Anahtar Kavram

Identity Federation, IAM Roles, and Least Privilege Account Management

Soru 17Soru →

An enterprise is migrating its multi-account environment to AWS Organizations. The security team needs to enforce compliance by preventing any member account under the `Prod-Workloads` OU from deleting or modifying administrative IAM roles prefixed with `SecurityGov-`. Additionally, the enterprise requires centralized access management integrated with their Microsoft Entra ID identity provider. The solution must ensure that administrative tasks in member accounts do not require local IAM user credentials. Which strategy should a Solutions Architect implement to meet these requirements?

Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID. Attach an SCP to the `Prod-Workloads` OU that denies `iam:DeleteRole`, `iam:PutRolePolicy`, and `iam:AttachRolePolicy` actions for any resource prefixed with `SecurityGov-`, except when the principal is the IAM Identity Center administrative role.

Create individual IAM users in each member account under the `Prod-Workloads` OU to represent the enterprise directory users, configuring SAML federation for each user. Apply an SCP to the OU that denies all IAM role modifications for all principals.

Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID. Attach an SCP to the organization's root to restrict the management account and all member accounts from modifying any IAM roles prefixed with `SecurityGov-`.

Configure Entra ID integration by enabling SAML federation with the management account. Use the management account's root credentials to perform administrative tasks in the member accounts, and attach an SCP to the `Prod-Workloads` OU to deny all local role updates.

Cevabı ve açıklamayı göster

Cevap: Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID. Attach an SCP to the `Prod-Workloads` OU that denies `iam:DeleteRole`, `iam:PutRolePolicy`, and `iam:AttachRolePolicy` actions for any resource prefixed with `SecurityGov-`, except when the principal is the IAM Identity Center administrative role.

Cevap

Configure federated access using AWS IAM Identity Center integrated with Microsoft Entra ID, and attach an SCP to the target OU denying modification of security roles with an exception for the admin role.

The correct strategy integrates Microsoft Entra ID with AWS IAM Identity Center for centralized access without requiring local IAM users. Using an SCP applied to the `Prod-Workloads` OU enforces the security guardrails on member accounts while exempting the admin role to allow legitimate updates to the security roles.

Adım Adım Çözüm

Analyze identity requirements

Determine that centralized federation using AWS IAM Identity Center is required to integrate with Microsoft Entra ID and avoid local credentials.

This simplifies credential management and aligns with AWS best practices for identity federation.

Analyze guardrail requirements

Establish that an SCP (Service Control Policy) attached to the `Prod-Workloads` OU is the correct mechanism to restrict role modification globally across the target member accounts.

SCPs enforce controls across accounts in an OU regardless of local administrator permissions.

Define SCP exceptions

Write the SCP to deny IAM modifications on the `SecurityGov-` role prefix, adding a condition that exempts the IAM Identity Center administrative role to allow legitimate changes.

A strict deny would block all users, including the central administrators, from managing the resources.

Anahtar Kavram

Centralized identity federation and multi-account guardrail enforcement using Service Control Policies (SCPs).

Soru 18Soru →

A company has an application running on Amazon EC2 instances in AWS Account A (Development) that requires read-only access to an Amazon DynamoDB table located in AWS Account B (Production). According to security best practices, the application must not store long-term credentials on the EC2 instances. Which combination of actions should the solutions architect take to configure this access securely? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and attach a permissions policy that grants read-only access to the DynamoDB table.

Configure an IAM role in Account A, attach it to the EC2 instances as an instance profile, and authorize the role to perform the sts:AssumeRole action on the Account B role.

Create access keys for the AWS account root user of Account B, and configure the application to retrieve them using instance metadata.

Create an IAM user in Account B, and configure the application to retrieve the user's access keys from a plaintext Systems Manager Parameter Store parameter of type String.

Create individual IAM users in Account B for the EC2 instances in Account A to use for federated access to the DynamoDB table.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and attach a permissions policy that grants read-only access to the DynamoDB table.; Configure an IAM role in Account A, attach it to the EC2 instances as an instance profile, and authorize the role to perform the sts:AssumeRole action on the Account B role.

Cevap

Create an IAM role in Account B with a trust policy that allows Account A to assume the role, and configure an IAM role in Account A attached to the EC2 instances to authorize the sts:AssumeRole action on the Account B role.

The correct architecture uses cross-account role delegation. A role in Account B defines a trust relationship allowing Account A to assume it and carries the permission to read the DynamoDB table. The EC2 instances in Account A are assigned an instance profile with an IAM role that permits calling the sts:AssumeRole API on the role in Account B. This removes the need for long-term credentials on the instances.

Adım Adım Çözüm

Define cross-account access trust in the target account

An IAM role is created in Account B with a trust policy allowing Account A to assume it, and a permission policy granting DynamoDB read permissions.

This establishes the target permissions and delegates trust to the source account.

Grant the EC2 instances permission to assume the cross-account role

An IAM role is created in Account A, attached as an EC2 instance profile, with policies allowing sts:AssumeRole on the role in Account B.

This enables the EC2 instances to dynamically request temporary credentials from STS for Account B.

Anahtar Kavram

Cross-account IAM role assumption and delegate trust pattern

Tahmini Süre:2m 0s

Soru 19Soru →

A digital publishing company serves personalized web content to a global audience. The content is hosted on origin servers in an on-premises data center, which is connected to AWS via an AWS Direct Connect connection. During major news events, the platform experiences sudden HTTP flood attacks (Layer 7) that exhaust the bandwidth on the Direct Connect connection, causing severe outages for legitimate users. The company needs to implement a solution to block these attacks at the AWS network edge before they reach the Direct Connect connection and the on-premises infrastructure. Which solution will meet these requirements?

Deploy an Application Load Balancer in the VPC, and configure stateful Network Access Control Lists (NACLs) to automatically block the attacking IP addresses at the subnet level before the traffic is routed over the Direct Connect link.

Configure Amazon Route 53 with latency-based routing to resolve queries to the on-premises servers, and rely on AWS Shield Standard to automatically detect and mitigate Layer 7 HTTP flood attacks at the DNS layer.

Create an Amazon CloudFront distribution with the on-premises origin servers configured as the origin. Associate an AWS WAF web ACL with the CloudFront distribution, configure rate-based rules, and enable AWS Shield Advanced on the CloudFront distribution.

Enable AWS Shield Standard on the Direct Connect gateway, and configure AWS WAF rules to inspect and filter traffic directly on the on-premises origin servers.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon CloudFront distribution with the on-premises origin servers configured as the origin. Associate an AWS WAF web ACL with the CloudFront distribution, configure rate-based rules, and enable AWS Shield Advanced on the CloudFront distribution.

Cevap

Create an Amazon CloudFront distribution with the on-premises origin servers configured as the origin, associate an AWS WAF web ACL with rate-based rules, and enable AWS Shield Advanced.

The correct solution uses Amazon CloudFront to intercept traffic at the AWS edge, which prevents malicious HTTP requests from traversing the Direct Connect link and exhausting the bandwidth of the on-premises origin. Associating an AWS WAF web ACL with rate-based rules blocks the Layer 7 HTTP flood attacks, and enabling AWS Shield Advanced on the CloudFront distribution provides advanced monitoring and automated Layer 7 mitigation.

Adım Adım Çözüm

Analyze the entry point of the network traffic and identify where the bottleneck occurs.

The traffic traverses a Direct Connect connection to the on-premises origin, meaning any DDoS mitigation must happen at the AWS edge before entering the Direct Connect path.

This determines that resources inside the VPC or on-premises cannot protect the Direct Connect link bandwidth.

Select an AWS service that can act as a global entry point at the edge and integrate with layer 7 protection.

Amazon CloudFront can cache content, serve as the public entry point, and support AWS WAF and AWS Shield Advanced.

CloudFront routes traffic through the global AWS edge network, isolating the origin from direct internet exposure.

Apply Layer 7 mitigation to block HTTP flood attacks.

AWS WAF with rate-based rules blocks anomalous IP request rates, and AWS Shield Advanced provides automated Layer 7 protection.

Layer 7 attacks mimic real traffic, requiring application-layer analysis and rate-limiting to mitigate without blocking legitimate traffic.

Anahtar Kavram

Edge protection and DDoS mitigation for hybrid architectures

Tahmini Süre:2m 30s

Soru 20Soru →

An online retail application hosted on AWS Lambda requires access to an external payment gateway API key that must be rotated every 30 days. The application also requires access to several non-sensitive configuration settings, including timeout values and API endpoints. The architecture must minimize cost while ensuring that the sensitive API key is encrypted at rest and rotated automatically without manual intervention. Which parameter management strategy should a solutions architect implement to meet these requirements with the lowest operational overhead?

Store the non-sensitive parameters as Standard parameters in AWS Systems Manager Parameter Store. Store the payment gateway API key in AWS Secrets Manager, and configure automatic rotation using an AWS Lambda function.

Store the payment gateway API key as a SecureString parameter in AWS Systems Manager Parameter Store. Enable automatic key rotation on the associated AWS Key Management Service (AWS KMS) customer managed key to automatically rotate the payment gateway API key value every 30 days.

Store both the non-sensitive configuration settings and the payment gateway API key as Standard plaintext String parameters in AWS Systems Manager Parameter Store, using a scheduled AWS Lambda function to update the values.

Store all configuration settings and the payment gateway API key in AWS Systems Manager Parameter Store as StringList parameters, enabling AWS KMS encryption on the parameter path to secure the sensitive values without incurring Secrets Manager costs.

Cevabı ve açıklamayı göster

Cevap: Store the non-sensitive parameters as Standard parameters in AWS Systems Manager Parameter Store. Store the payment gateway API key in AWS Secrets Manager, and configure automatic rotation using an AWS Lambda function.

Cevap

Store the non-sensitive parameters as Standard parameters in AWS Systems Manager Parameter Store, store the payment gateway API key in AWS Secrets Manager, and configure automatic rotation using an AWS Lambda function.

The correct solution uses AWS Systems Manager Parameter Store for non-sensitive parameters, which is cost-effective, and AWS Secrets Manager for the sensitive API key. Secrets Manager supports automatic rotation natively through integration with AWS Lambda, ensuring that the 30-day rotation requirement is met with minimal custom development or operational maintenance.

Adım Adım Çözüm

Identify parameter types and security requirements.

Non-sensitive settings (timeout, endpoints) do not require encryption or rotation. The payment gateway API key requires encryption at rest and automatic rotation every 30 days.

This determines the appropriate service for each parameter class to optimize cost and security.

Select the parameter storage service based on cost and capability constraints.

Use Systems Manager Parameter Store Standard parameters for non-sensitive settings to avoid cost. Use AWS Secrets Manager for the API key to utilize its native rotation integration.

Parameter Store standard parameters are free, whereas Secrets Manager charges per secret but provides built-in rotation management.

Configure automatic rotation for the API key.

Configure AWS Secrets Manager to rotate the API key every 30 days using a rotation AWS Lambda function.

This automates the rotation lifecycle of the external API key, meeting the security mandate with the least operational overhead.

Anahtar Kavram

Secrets Manager vs Parameter Store Trade-offs

Tahmini Süre:1m 30s

Sayfa 1 / 74Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram