Tüm alıştırma soruları

1462 soru

Tüm türler1,462 Çoktan seçmeli739 Çoklu seçim723

A company is building a financial application that runs on AWS Lambda and stores transaction records in an Amazon DynamoDB table. The security policy requires database credentials used by the Lambda function to be stored securely and rotated every 30 days. Additionally, the DynamoDB table must be encrypted using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) that is rotated annually without requiring manual re-encryption of historical data. Which combination of actions should the solutions architect recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.

Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store and use a custom Lambda function to rotate the credentials.

Configure DynamoDB to use a customer managed key in AWS KMS and enable automatic key rotation for that key.

Configure DynamoDB to use a customer managed key in AWS KMS, enable automatic key rotation, and schedule an AWS Batch script to re-encrypt historical table records.

Create a new customer managed key in AWS KMS each year, update the DynamoDB table configuration to use the new key, and run a script to re-encrypt all existing table items.

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days.; Configure DynamoDB to use a customer managed key in AWS KMS and enable automatic key rotation for that key.

Cevap

Storing the database credentials in AWS Secrets Manager with automatic rotation enabled, and configuring DynamoDB to use a customer managed key in AWS KMS with automatic key rotation enabled.

Storing database credentials in AWS Secrets Manager ensures secure storage and supports automatic rotation via built-in integration. Enabling automatic rotation on the KMS customer managed key ensures that AWS KMS automatically rotates the key material annually. AWS KMS retains older key material so that existing data can still be decrypted without needing to re-encrypt any data manually, which perfectly fulfills the encryption and operational constraints.

Adım Adım Çözüm

Address credential security and rotation requirements.

Database credentials are secure and automatically rotated without downtime.

AWS Secrets Manager natively supports storing database secrets and integrates with Lambda to handle automatic 30-day rotation, satisfying the first security constraint.

Address database encryption and key rotation requirements.

The DynamoDB table is encrypted using a customer managed key that rotates automatically.

AWS KMS customer managed keys support automatic rotation. When automatic rotation is enabled, AWS KMS generates new key material annually and keeps older key material to decrypt historical data without requiring manual re-encryption of the data.

Anahtar Kavram

AWS KMS automatic key rotation preserves previous key material to decrypt existing data, eliminating the need for manual re-encryption. For sensitive secrets, AWS Secrets Manager provides built-in rotation capabilities, unlike SSM Parameter Store plaintext parameters.

Soru 182Soru →

A retail company stores sensitive customer profile data in an Amazon DynamoDB table. The security team requires that the data be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS to allow full audit logging of key usage. The company also requires that the encryption key be rotated automatically every year, and they must ensure that DynamoDB can continue to read and write existing and new data seamlessly after key rotation without any manual re-encryption or table configuration changes. How should the solutions architect configure this to meet these requirements?

Configure the DynamoDB table to use the default AWS owned key. To meet the audit logging requirement, store the sensitive database attributes as plaintext parameters in AWS Systems Manager Parameter Store and reference them in the application.

Configure the DynamoDB table to use a Customer Managed Key for encryption. Enable automatic annual rotation on the Customer Managed Key in AWS KMS.

Configure the DynamoDB table to use a Customer Managed Key. Enable automatic annual key rotation, and schedule a monthly AWS Batch job to read all DynamoDB items and write them back to force immediate re-encryption of all historical records under the new key version.

Manually create a new Customer Managed Key in AWS KMS each year. Update the DynamoDB table encryption settings to use the new key identifier, then execute an AWS Lambda function to scan the table and update every item to ensure it is encrypted with the new key version.

Cevabı ve açıklamayı göster

Cevap: Configure the DynamoDB table to use a Customer Managed Key for encryption. Enable automatic annual rotation on the Customer Managed Key in AWS KMS.

Cevap

Configure the DynamoDB table to use a Customer Managed Key for encryption, and enable automatic annual rotation on the Customer Managed Key in AWS KMS.

Configuring the DynamoDB table with a Customer Managed Key (CMK) ensures that all key usage is logged in AWS CloudTrail, satisfying the audit logging requirement. Enabling automatic annual key rotation on the CMK allows AWS KMS to generate new key material every year while keeping the same key ID. KMS automatically retains older key versions to decrypt historical data and uses the new key version to encrypt new writes, providing seamless access without any application downtime, table configuration changes, or manual re-encryption.

Adım Adım Çözüm

Enable AWS KMS Customer Managed Key encryption for the Amazon DynamoDB table to generate detailed key usage logs in AWS CloudTrail.

The table encryption is managed by a customer controlled key, satisfying the audit logging requirement.

AWS owned keys do not write key usage events to CloudTrail, whereas Customer Managed Keys do.

Enable automatic key rotation for the Customer Managed Key in AWS KMS.

The key material is automatically rotated annually while retaining the same Key ID.

This satisfies the requirement for annual rotation without modifying table configurations or application code.

Allow AWS KMS to manage historical key versions for decryption.

Existing items can be decrypted seamlessly, and new items are encrypted using the rotated key material.

AWS KMS automatically retains previous versions of key material to decrypt existing data, removing the need for manual re-encryption.

Anahtar Kavram

KMS Key Rotation Mechanics and Customer Managed Keys

Soru 183Soru →

A solutions architect is migrating an on-premises application to AWS. The application requires access to a database password and a third-party partner's API token. These credentials must be encrypted at rest and rotated automatically every 60 days. Additionally, the application writes audit logs to an Amazon EBS volume, which must be encrypted using a customer managed KMS key that is rotated every year. The historical audit logs must remain readable after key rotation without manual intervention.

Which combination of actions should the solutions architect take to meet these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Store the database password and API token in AWS Secrets Manager, and configure a custom AWS Lambda function to rotate the secrets every 60 days.

Enable automatic key rotation for the customer managed KMS key used for the EBS volume.

Store the database password and API token as String parameters in AWS Systems Manager Parameter Store, and write an Amazon EventBridge rule to update the plaintext values every 60 days.

Enable automatic key rotation for the customer managed KMS key, and schedule an AWS Lambda function to decrypt and re-encrypt all existing EBS volume snapshots with the new key version immediately after rotation.

Create a new customer managed KMS key annually, update the EBS volume configuration to use the new key, and delete the old KMS key to ensure only the active key is used.

Cevabı ve açıklamayı göster

Cevap: Store the database password and API token in AWS Secrets Manager, and configure a custom AWS Lambda function to rotate the secrets every 60 days.; Enable automatic key rotation for the customer managed KMS key used for the EBS volume.

Cevap

The correct solutions are to store the credentials in AWS Secrets Manager with a custom Lambda function for rotation, and to enable automatic key rotation on the customer managed KMS key used for the EBS volume.

To secure credentials and meet the 60-day rotation requirement, AWS Secrets Manager should be used with a custom AWS Lambda function to rotate the database password and third-party API token. To secure the EBS volume and meet the annual rotation requirement without manual re-encryption or interrupting access to historical data, automatic key rotation should be enabled on the customer managed KMS key. AWS KMS automatically manages the rotation and retains the older key versions to decrypt existing data when needed.

Adım Adım Çözüm

Analyze the credentials requirement.

The database password and API token must be encrypted and rotated every 60 days.

AWS Secrets Manager supports encrypting and rotating secrets. Since a third-party partner's API key is involved, a custom Lambda function is required to perform the rotation logic.

Analyze the storage encryption requirement.

The EBS volume must be encrypted using a customer managed KMS key that is rotated annually without manual key management or re-encryption.

Enabling automatic key rotation for the customer managed KMS key satisfies the annual rotation requirement. AWS KMS automatically retains the old key versions for decryption of older snapshots and volume blocks, removing the need for manual re-encryption.

Evaluate the distractors.

Identify insecure configurations (plaintext Parameter Store) and incorrect KMS rotation mechanics (unnecessary re-encryption or deletion of old keys).

Parameter Store String parameters do not encrypt data. Deleting retired KMS keys prevents decrypting existing logs. Re-encrypting historical data is an unnecessary operational overhead since KMS handles decryption of older data automatically.

Anahtar Kavram

Data Encryption and Key Management

Soru 184Soru →

An architectural design for a secure application separates the processing service (deployed in subnet $172.16.1.0/24$ ) and the database cluster (deployed in subnet $172.16.2.0/24$ ). The database listens on custom TCP port $8000$ . A solutions architect is configuring a Network Access Control List (Network ACL) for the database subnet to restrict traffic. The database instances are already associated with a security group that allows inbound traffic on port $8000$ from the processing service's security group. Which configuration must be applied to the database subnet's Network ACL to allow successful communication between the services?

An inbound rule allowing TCP port

8000

from the processing service's security group ID and an outbound rule allowing TCP ports

1024 - 65535

to the processing service's security group ID.

An inbound rule allowing TCP port

8000

from

172.16.1.0/24

and an outbound rule allowing TCP ports

1024 - 65535

172.16.1.0/24

An inbound rule allowing TCP port

8000

from

172.16.1.0/24

, with no outbound rule required because Network ACLs automatically track connection states.

An inbound rule allowing TCP ports

1024 - 65535

from

172.16.1.0/24

and an outbound rule allowing TCP port

8000

172.16.1.0/24

Cevabı ve açıklamayı göster

Cevap: An inbound rule allowing TCP port $8000$ from $172.16.1.0/24$ and an outbound rule allowing TCP ports $1024 - 65535$ to $172.16.1.0/24$ .

Cevap

An inbound rule allowing TCP port

8000

from

172.16.1.0/24

and an outbound rule allowing TCP ports

1024 - 65535

172.16.1.0/24

The correct option correctly configures the stateless Network ACL. The inbound rule allows the processing service's subnet (

172.16.1.0/24

) to connect to the database subnet on port

8000

. Since Network ACLs do not track connection states, a corresponding outbound rule is required to allow return traffic from the database back to the processing service's client instances. Because client instances initiate connections from random ports within the ephemeral port range (

1024 - 65535

), the outbound rule must allow traffic to those ports.

Adım Adım Çözüm

Analyze the state tracking characteristics of Network ACLs vs Security Groups.

Security groups are stateful, but Network ACLs are stateless. Therefore, the database subnet Network ACL must contain explicit rules for both inbound request traffic and outbound return traffic.

This establishes that both an inbound rule and an outbound rule are required for successful network communication.

Determine the correct source and destination targets for Network ACLs.

Identify that Network ACL rules must use CIDR blocks (such as

172.16.1.0/24

), because Network ACLs do not support security group references.

This rules out options that attempt to reference security group IDs inside Network ACL rules.

Map the ports for the inbound and outbound traffic directions.

The inbound rule must allow target port

8000

from the client's subnet CIDR. The outbound rule must allow return traffic to the client's ephemeral ports (

1024 - 65535

) on the client's subnet CIDR.

When a client connects to a server, it uses a random ephemeral port as its source port. Return traffic must be allowed back to this ephemeral port range.

Anahtar Kavram

Stateless nature of Network ACLs and the requirement for ephemeral port rules.

Soru 185Soru →

A company hosts a secure API on Amazon EC2 instances in a private subnet ( $10.0.2.0/24$ ). The instances receive incoming HTTPS requests forwarded by an Application Load Balancer (ALB) located in the public subnets ( $10.0.1.0/24$ ). The instances also initiate outbound HTTPS connections to an external payment processor's API on the internet ( $0.0.0.0/0$ ). The solutions architect is configuring a custom Network Access Control List (NACL) for the private subnet. Which TWO rule configurations must be added to the custom NACL to allow this traffic while maintaining the principle of least privilege? (Select TWO.)

Geçerli olan tümünü seçin

Inbound rule: Allow TCP port

443

from source

10.0.1.0/24

. Outbound rule: Allow TCP ports

1024

65535

to destination

10.0.1.0/24

Outbound rule: Allow TCP port

443

to destination

0.0.0.0/0

. Inbound rule: Allow TCP ports

1024

65535

from source

0.0.0.0/0

Inbound rule: Allow TCP port

443

from source

10.0.1.0/24

. Outbound rule: None required, as Network ACLs are stateful and return traffic is allowed automatically.

Outbound rule: Allow TCP port

443

to destination

0.0.0.0/0

. Inbound rule: None required, as the stateful Security Group associated with the instances overrides Network ACL statelessness.

Inbound rule: Configure AWS Shield Standard to inspect Layer

7

headers from source

10.0.1.0/24

. Outbound rule: Allow TCP port

443

to destination

0.0.0.0/0

Cevabı ve açıklamayı göster

Cevap: Inbound rule: Allow TCP port $443$ from source $10.0.1.0/24$ . Outbound rule: Allow TCP ports $1024$ - $65535$ to destination $10.0.1.0/24$ .; Outbound rule: Allow TCP port $443$ to destination $0.0.0.0/0$ . Inbound rule: Allow TCP ports $1024$ - $65535$ from source $0.0.0.0/0$ .

Cevap

The correct configurations are the rules allowing inbound TCP port

443

from the public subnet with outbound ephemeral port access to the public subnet, and outbound TCP port

443

to the internet with inbound ephemeral port access from the internet.

Because Network ACLs are stateless, rules must be explicitly configured for both request and response paths. For the inbound flow from the ALB, the request arrives on destination port

443

and the response returns to the ALB's ephemeral source ports (

1024

65535

). For the outbound flow to the external gateway, the request goes to destination port

443

and the response returns to the instances' ephemeral source ports (

1024

65535

). Thus, both options representing these configurations must be selected.

Adım Adım Çözüm

Analyze the direction of traffic for the inbound requests from the ALB.

The ALB in

10.0.1.0/24

communicates with the application instances on TCP port

443

. Because Network ACLs are stateless, both inbound and outbound paths must be explicitly allowed.

To allow the inbound request, an inbound rule permitting TCP port

443

from source

10.0.1.0/24

is needed. To allow the response back to the ALB's ephemeral ports, an outbound rule permitting TCP ports

1024

65535

to destination

10.0.1.0/24

must be created.

Analyze the direction of traffic for the outbound connections to the external payment processor.

The application instances initiate outbound connections on TCP port

443

to destination

0.0.0.0/0

. Because Network ACLs are stateless, both outbound and inbound paths must be explicitly allowed.

To allow the outbound request, an outbound rule permitting TCP port

443

to destination

0.0.0.0/0

is needed. To allow the response back from the external gateway, an inbound rule permitting TCP ports

1024

65535

from source

0.0.0.0/0

must be created.

Evaluate the other options to verify why they are incorrect.

Options suggesting Network ACLs are stateful, or that Security Groups override Network ACLs, or that AWS Shield Standard provides Layer

7

inspection at the NACL level are invalid.

Network ACLs are strictly stateless, whereas Security Groups are stateful. Both are evaluated, and one cannot override the other. AWS Shield Standard operates at layers

3

and

4

for DDoS protection and is not configured in NACL rules.

Anahtar Kavram

Network Access Control Lists (NACLs) are stateless firewall rules applied at the subnet level, meaning that outbound response traffic must be explicitly permitted for allowed inbound requests, and inbound response traffic must be explicitly permitted for allowed outbound requests.

Tahmini Süre:2m 0s

Soru 186Soru →

A company is designing a secure architecture for a web application. The application requires access to a database password for an Amazon RDS for PostgreSQL DB instance. The security policy requires database credentials to be rotated every 30 days. In addition, the application stores transactional logs in an Amazon S3 bucket. The logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) that is automatically rotated every year. The solutions architect must ensure that previously encrypted logs can still be decrypted after key rotation.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Store the database credentials in AWS Secrets Manager, and configure automatic rotation every 30 days using the database-specific AWS Lambda rotation function.

Enable automatic key rotation for the KMS CMK. AWS KMS automatically retains the older backing keys to decrypt logs that were encrypted prior to rotation.

Store the database credentials in AWS Systems Manager Parameter Store as a plaintext String parameter to simplify rotation scripts.

Manually create a new KMS CMK each year, delete the old CMK, and re-encrypt all existing log files in the S3 bucket using the new CMK.

Enable automatic key rotation for the KMS CMK, and configure a scheduled task to re-encrypt all historical log files under the new key version immediately after rotation.

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager, and configure automatic rotation every 30 days using the database-specific AWS Lambda rotation function.; Enable automatic key rotation for the KMS CMK. AWS KMS automatically retains the older backing keys to decrypt logs that were encrypted prior to rotation.

Cevap

Store the database credentials in AWS Secrets Manager with automatic Lambda rotation, and enable automatic key rotation for the KMS CMK.

The correct combination of actions involves using AWS Secrets Manager to store and automatically rotate database credentials every 30 days, and enabling automatic key rotation for the KMS CMK. AWS Secrets Manager provides native database credential rotation using Lambda, which simplifies configuration. AWS KMS automatic key rotation keeps old key material active for decryption, ensuring historical logs remain readable without any manual re-encryption or key management.

Adım Adım Çözüm

Address the requirement to securely store and automatically rotate database credentials every 30 days.

Database credentials should be stored in AWS Secrets Manager, which natively integrates with RDS databases to automate credential rotation using built-in AWS Lambda rotation templates.

Secrets Manager allows for secure storage and provides out-of-the-box support for rotating RDS database credentials without manual scripting.

Address the requirement to encrypt S3 logs using a KMS CMK with annual rotation, ensuring historical logs remain decryptable.

Enable automatic annual key rotation on the Customer Managed Key (CMK) in AWS KMS.

AWS KMS automatic key rotation generates a new backing key every year but retains the historical backing keys. This allows KMS to automatically decrypt historical data encrypted under previous versions of the key without requiring re-encryption of existing logs.

Anahtar Kavram

AWS KMS Customer Managed Key automatic rotation retains older key versions for decryption, and AWS Secrets Manager provides built-in rotation integration for Amazon RDS.

Soru 187Soru →

A company stores historical compliance reports in an Amazon S3 bucket. The reports are encrypted at rest using Server-Side Encryption with an AWS KMS customer managed key (SSE-KMS). To satisfy new security standards, a solutions architect enables automatic annual key rotation for this KMS key. Which of the following describes the impact of this configuration on the historical reports and future write operations?

AWS KMS retains the previous backing key material to seamlessly decrypt historical reports, while any newly uploaded reports are encrypted using the new backing key material under the same KMS key ARN.

AWS KMS automatically schedules a background job to decrypt and re-encrypt all existing S3 objects with the new backing key material to ensure consistent encryption across all historical reports.

The solutions architect must manually download, decrypt, and re-upload the historical reports to re-encrypt them, because the previous backing key material is permanently deleted upon rotation.

The solutions architect must export the legacy backing key material and save it as a plaintext parameter of type String in Systems Manager Parameter Store to allow historical reports to be decrypted.

Cevabı ve açıklamayı göster

Cevap: AWS KMS retains the previous backing key material to seamlessly decrypt historical reports, while any newly uploaded reports are encrypted using the new backing key material under the same KMS key ARN.

Cevap

The correct answer correctly states that AWS KMS retains historical backing key material to seamlessly decrypt legacy objects. S3 reads are transparently decrypted using the appropriate historical key version, whereas all new uploads are encrypted with the newly generated backing key material. The external KMS key metadata, including its ARN and Key ID, remains unchanged, meaning no updates to bucket policies or application code are needed.

Adım Adım Çözüm

Analyze the automatic key rotation behavior of AWS KMS customer managed keys.

Automatic rotation generates new cryptographic backing key material annually, while keeping the key's metadata (Key ID, ARN, and policies) unchanged.

This allows applications to continue referencing the same KMS key without code modifications.

Determine the impact of rotation on existing (historical) encrypted data.

AWS KMS preserves the older backing key material versions to decrypt data that was encrypted under those versions.

Rotating the key does not automatically re-encrypt existing data, as doing so would be resource-intensive and expensive.

Determine the impact of rotation on new write operations.

New data write requests (such as new S3 uploads) will automatically be encrypted using the newly generated backing key material.

This ensures that all future data writes use the latest, rotated key material.

Anahtar Kavram

AWS KMS automatic key rotation preserves legacy backing key versions to decrypt historical data while using the new backing key version for new encryption operations, keeping the key's metadata unchanged.

Tahmini Süre:1m 30s

Soru 188Soru →

A company is hosting a secure data processing application on Amazon EC2 instances within a private subnet. The instances must retrieve training datasets from a specific Amazon S3 bucket. Security policies dictate that the VPC must not have an Internet Gateway or a NAT Gateway, and the EC2 instances must be restricted from accessing any other S3 buckets in AWS. A solutions architect deploys a Gateway VPC Endpoint for Amazon S3 to enable private connectivity. Which configuration should the solutions architect implement to restrict the instances to only access the specified S3 bucket?

Configure the Security Group associated with the EC2 instances to restrict outbound traffic to the Amazon Resource Name (ARN) of the specific S3 bucket.

Add a route to the private subnet's route table that maps the specific S3 bucket's IP addresses to the S3 Gateway VPC endpoint.

Attach a custom VPC endpoint policy to the S3 Gateway VPC endpoint that allows S3 actions only when the resource matches the specific S3 bucket's ARN.

Deploy an AWS WAF Web ACL on the subnet's network interfaces to inspect and deny outbound requests destined for unauthorized S3 buckets.

Cevabı ve açıklamayı göster

Cevap: Attach a custom VPC endpoint policy to the S3 Gateway VPC endpoint that allows S3 actions only when the resource matches the specific S3 bucket's ARN.

Cevap

Attach a custom VPC endpoint policy to the S3 Gateway VPC endpoint that allows S3 actions only when the resource matches the specific S3 bucket's ARN.

A VPC endpoint policy is an IAM resource policy that you attach to a VPC endpoint to control access to the service. By default, endpoints have full access. A custom policy can restrict access to specific S3 buckets by specifying their ARNs in the 'Resource' block, ensuring that EC2 instances using the endpoint can only interact with the approved bucket.

Adım Adım Çözüm

Analyze the constraint that EC2 instances must access a specific S3 bucket privately without traversing the internet or NAT gateways.

Confirm that a Gateway VPC Endpoint for S3 is the correct private networking route, but by default, it permits access to all S3 buckets.

This sets the foundation for understanding where the access restriction must be applied.

Evaluate the capabilities of Security Groups and Route Tables to restrict access to a specific S3 bucket.

Determine that Security Groups and Route Tables operate at the network layers (IP/port) and cannot inspect or filter S3 traffic by bucket ARN.

This rules out standard subnet and interface-level network configurations.

Select the correct policy enforcement mechanism for VPC Endpoints.

Apply a custom VPC endpoint policy to the S3 Gateway endpoint that specifies the S3 bucket's ARN in the resource block of the policy.

VPC endpoint policies act as a network perimeter filter, allowing fine-grained IAM controls at the VPC boundary.

Anahtar Kavram

VPC Endpoint Policies

Tahmini Süre:1m 30s

Soru 189Soru →

A company stores historical financial reports in an Amazon S3 bucket. The reports are encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key. To comply with regulatory standards, the company must rotate the encryption key every year. A solutions architect must implement a key rotation strategy that ensures all existing reports remain accessible for read operations while minimizing administrative overhead. Which strategy meets these requirements?

Enable automatic key rotation for the customer managed key, which automatically generates a new key version annually while keeping the older key versions available to decrypt historical data.

Enable automatic key rotation for the customer managed key, and run an Amazon S3 Batch Operations job to re-encrypt all existing S3 objects with the new key version immediately after rotation.

Create a new customer managed key manually each year, update the S3 bucket configuration, and delete the previous customer managed key to maintain security hygiene.

Store the current key version ID in AWS Systems Manager Parameter Store as a standard String parameter, and update the application logic to retrieve this value to encrypt new reports.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation for the customer managed key, which automatically generates a new key version annually while keeping the older key versions available to decrypt historical data.

Cevap

Enable automatic key rotation for the customer managed key, which automatically generates a new key version annually while keeping the older key versions available to decrypt historical data.

Enabling automatic key rotation for customer managed keys in AWS KMS automatically creates a new backing key version every year. Because AWS KMS retains all historical backing keys, it can seamlessly decrypt older objects when they are accessed. This requires no manual intervention, configuration changes, or re-encryption of existing data, satisfying the compliance requirement with the lowest administrative overhead.

Adım Adım Çözüm

Identify the rotation frequency and decryption requirements for S3 objects encrypted with AWS KMS.

The requirement is annual key rotation while ensuring all older data remains readable without manual intervention.

This establishes the constraints: automatic execution and zero-downtime read access to historical objects.

Evaluate AWS KMS automatic key rotation capabilities.

Automatic key rotation creates a new backing key version every year but retains the metadata (ARN/ID) and the older backing keys.

By retaining the older backing keys, AWS KMS can automatically decrypt historical data encrypted with those older versions.

Select the option that matches KMS best practices with the lowest administrative overhead.

Enabling automatic rotation satisfies the compliance requirement without requiring any code changes, key policy updates, or data re-encryption.

This avoids manual re-encryption tasks and prevents data loss from deleting older keys.

Anahtar Kavram

AWS KMS Automatic Key Rotation

Soru 190Soru →

A company is building a document processing application that stores PDF files in an Amazon S3 bucket. The company's compliance policy requires all files to be encrypted at rest using a customer managed key in AWS Key Management Service (AWS KMS). The policy also mandates that the cryptographic key material must be rotated every year. After the key is rotated, the application must still be able to decrypt and access historical documents immediately without any manual intervention or decryption downtime. Which configuration should the solutions architect choose to meet these requirements?

Enable automatic key rotation for the customer managed key, which automatically rotates the key material annually while retaining the old key material to decrypt existing documents.

Enable automatic key rotation for the customer managed key, and immediately run a batch job to decrypt and re-encrypt all existing PDF files with the new key material version.

Manually rotate the key by creating a new customer managed key each year, configure the S3 bucket to use the new key, and delete the old customer managed key.

Generate custom encryption key material annually, store it as a plaintext string parameter in AWS Systems Manager Parameter Store, and configure a scheduled Lambda function to update the S3 bucket's default encryption configuration.

Cevabı ve açıklamayı göster

Cevap: Enable automatic key rotation for the customer managed key, which automatically rotates the key material annually while retaining the old key material to decrypt existing documents.

Cevap

Enable automatic key rotation for the customer managed key, which automatically rotates the key material annually while retaining the old key material to decrypt existing documents.

Enabling automatic key rotation for a customer managed key in AWS KMS automatically creates a new version of the key material every year. AWS KMS retains the older versions of the key material indefinitely, allowing the application to decrypt historical documents transparently without any manual intervention or decryption downtime.

Adım Adım Çözüm

Evaluate the encryption requirements and identify the correct key type.

A customer managed key in AWS KMS is required to support the custom rotation policies and metadata management.

AWS managed keys do not support manual rotation configuration changes or cross-account access controls that might be required under strict compliance policies.

Determine the mechanism for key rotation.

Enable automatic key rotation on the customer managed key.

AWS KMS automatically rotates the key material every year (365 days) for customer managed keys when enabled.

Verify historical data access behavior after key rotation.

AWS KMS retains the older key material versions to seamlessly decrypt historical data that was encrypted under previous versions.

This avoids the need to decrypt and re-encrypt existing S3 objects, saving cost and preventing decryption downtime.

Anahtar Kavram

AWS KMS automatic key rotation rotates the backing key material while preserving older versions of the key material to decrypt historical data.

Soru 191Soru →

A company is designing a secure network architecture for a high-throughput processing application hosted on Amazon EC2 instances in a private subnet. The application must securely transfer large volumes of data to Amazon S3 and access secrets stored in AWS Secrets Manager. The network architecture must prevent any data from traversing the public internet, minimize data transfer charges, and enforce strict network boundaries. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnet.

Create an interface VPC endpoint for AWS Secrets Manager in the private subnet, and associate a security group with the endpoint that allows inbound HTTPS (port 443) traffic from the application security group.

Deploy a NAT gateway in a public subnet, configure the private subnet's route table to point all outbound traffic to the NAT gateway, and access both services via their public endpoints.

Configure a stateless Network ACL on the private subnet to permit outbound HTTPS traffic to Secrets Manager public IP addresses, as security groups cannot filter traffic directed to interface endpoints.

Deploy AWS Shield Advanced at the subnet boundary to inspect traffic and protect the Secrets Manager endpoint from Layer 7 application exploits.

Cevabı ve açıklamayı göster

Cevap: Create a gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnet.; Create an interface VPC endpoint for AWS Secrets Manager in the private subnet, and associate a security group with the endpoint that allows inbound HTTPS (port 443) traffic from the application security group.

Cevap

Create a gateway VPC endpoint for Amazon S3 associated with the private subnet's route tables, and create an interface VPC endpoint for AWS Secrets Manager with a security group allowing inbound HTTPS traffic from the application security group.

The correct architecture uses a Gateway VPC Endpoint for Amazon S3 and an Interface VPC Endpoint for AWS Secrets Manager. S3 Gateway Endpoints are free and route traffic via VPC route tables. Interface Endpoints use Elastic Network Interfaces (ENIs) inside the VPC and are secured using stateful security groups that limit inbound HTTPS traffic to the application's security group.

Adım Adım Çözüm

Analyze connectivity and cost requirements for Amazon S3 traffic.

Determine that a Gateway VPC Endpoint is the most secure and cost-effective method to connect to Amazon S3, as it does not incur data processing fees and routes traffic privately using route table entries.

Routing high-volume data to S3 via a NAT gateway results in high data transfer costs.

Analyze connectivity and security requirements for AWS Secrets Manager.

Identify that AWS Secrets Manager requires an Interface VPC Endpoint (AWS PrivateLink) for private VPC access because Secrets Manager does not support Gateway VPC Endpoints.

Interface endpoints use Elastic Network Interfaces (ENIs) inside the subnet and allocate private IP addresses from the subnet range.

Configure security group rules for the interface endpoint to restrict access.

Create a security group for the Secrets Manager interface endpoint that allows inbound HTTPS (port 443) traffic only from the security group associated with the application EC2 instances.

Security groups are stateful, apply at the interface level, and enforce the principle of least privilege.

Anahtar Kavram

VPC endpoints (Gateway vs Interface) allow private connectivity to AWS services without internet traversal, utilizing route tables and security groups to manage security and optimize costs.

Soru 192Soru →

A developer is deploying a data processing application on Amazon EC2 instances in private subnets. The application needs to securely access Amazon Kinesis Data Streams to publish streaming data. Corporate security policies dictate that the EC2 instances must not have any route to the public internet, and all AWS API traffic must remain within the AWS network. The solutions architect creates an interface VPC endpoint for Kinesis in the same VPC. Which configuration steps must the solutions architect perform to enable the application to communicate with Kinesis?

Enable Private DNS for the VPC endpoint, and associate a security group with the VPC endpoint that allows inbound HTTPS traffic from the security group of the EC2 instances.

Add a route in the private subnet route table with the destination pointing to the Kinesis service prefix list and the target as the interface VPC endpoint ID.

Deploy a NAT Gateway in a public subnet, configure the private subnet route table to target the NAT Gateway, and configure a security group to restrict access to Kinesis.

Configure the private subnet's Network ACL to allow outbound traffic to the VPC endpoint, and disable the 'Enable DNS hostnames' setting in the VPC.

Cevabı ve açıklamayı göster

Cevap: Enable Private DNS for the VPC endpoint, and associate a security group with the VPC endpoint that allows inbound HTTPS traffic from the security group of the EC2 instances.

Cevap

Enable Private DNS for the VPC endpoint, and associate a security group with the VPC endpoint that allows inbound HTTPS traffic from the security group of the EC2 instances.

The correct option addresses the requirements by enabling Private DNS for the interface VPC endpoint, which ensures Kinesis API requests resolve to the private endpoint ENIs. It also configures the stateful security group on the interface endpoint to allow inbound HTTPS traffic from the EC2 security group, completing the secure private path.

Adım Adım Çözüm

Configure DNS settings for PrivateLink

Enabling the Private DNS option ensures that standard Amazon Kinesis endpoint DNS queries resolve to the private IP addresses of the interface endpoint's ENIs within the VPC.

This allows the application to use the default AWS SDK configurations without modifying the API endpoint URL in the code.

Configure the VPC Endpoint Security Group

Associate a security group with the interface VPC endpoint and add an inbound rule allowing TCP port 443 (HTTPS) traffic from the security group assigned to the EC2 instances.

Interface endpoints use ENIs which are secured by security groups. Traffic must be allowed inbound to these interfaces.

Configure the EC2 Instance Security Group

Ensure the EC2 instances' security group allows outbound TCP port 443 traffic to the VPC endpoint's security group.

Since security groups are stateful, allowing outbound HTTPS traffic from the instances to the endpoint enables the outbound request, and the return traffic is automatically allowed.

Anahtar Kavram

Interface VPC Endpoints (AWS PrivateLink) require Private DNS hostnames and proper Security Group configurations to allow private communication with AWS services without traversing the public internet.

Soru 193Soru →

A company hosts a reporting application on Amazon EC2 instances within private subnets. The application is required to query Amazon DynamoDB to fetch user profiles and must also securely call an external SaaS provider's HTTPS endpoint to retrieve currency exchange rates. Company security policies dictate that all traffic to DynamoDB must remain within the AWS network and must not traverse the public internet, while keeping data transfer costs minimized. Additionally, the EC2 instances must be able to securely connect to the external SaaS provider's endpoint.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a Gateway VPC Endpoint for Amazon DynamoDB, and add a route directing DynamoDB traffic to the endpoint in the private subnet route tables.

Deploy a NAT Gateway in a public subnet, and configure a route in the private subnet route tables directing internet-bound traffic (

0.0.0.0/0

) to the NAT Gateway.

Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon DynamoDB, and configure the security groups to route all database traffic through it.

Configure a route in the private subnet route tables directing outbound traffic (

0.0.0.0/0

) directly to the Internet Gateway.

Modify the security groups associated with the EC2 instances to allow outbound HTTPS traffic to the SaaS endpoint, and add inbound rules to allow return traffic on ephemeral ports.

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC Endpoint for Amazon DynamoDB, and add a route directing DynamoDB traffic to the endpoint in the private subnet route tables.; Deploy a NAT Gateway in a public subnet, and configure a route in the private subnet route tables directing internet-bound traffic ( $0.0.0.0/0$ ) to the NAT Gateway.

Cevap

To secure and cost-effectively route the traffic, create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables. In addition, deploy a NAT Gateway in a public subnet and add a route in the private subnet route tables directing all internet-bound traffic to the NAT Gateway.

Creating a Gateway VPC Endpoint for Amazon DynamoDB ensures that database traffic remains within the AWS network without traversing the public internet. Because Gateway VPC Endpoints are free of charge, they satisfy the requirement to minimize data transfer costs. Additionally, deploying a NAT Gateway in a public subnet allows EC2 instances in private subnets to securely initiate outbound HTTPS requests to the external SaaS provider's endpoint.

Adım Adım Çözüm

Address private DynamoDB access and cost goals.

Identify Gateway VPC Endpoints as the optimal solution for DynamoDB because they route traffic entirely within the AWS network and do not incur data processing or hourly fees.

This satisfies the requirement to prevent traffic from traversing the public internet while keeping data transfer costs minimized.

Address external SaaS provider connectivity.

Determine that private EC2 instances require a NAT translation device in a public subnet to reach the public internet.

Private subnets cannot route directly to an Internet Gateway, so a NAT Gateway must be provisioned in a public subnet to handle outbound egress traffic.

Evaluate security group and routing rules.

Confirm that security groups are stateful and require no inbound configurations for return traffic, and ensure that route tables are updated with appropriate routes for the NAT Gateway and the DynamoDB endpoint.

To ensure correct traffic routing and maintain a secure infrastructure configuration.

Anahtar Kavram

VPC Network Security and Egress Routing

Soru 194Soru →

An enterprise energy grid monitoring company runs its real-time telemetry processing application on AWS. The application consists of Amazon ECS Fargate tasks in a private VPC subnet in us-east-1 behind an Application Load Balancer (ALB). The database tier stores state in an Amazon Aurora PostgreSQL DB cluster. The data ingest rate is highly critical, and the company requires a cross-region disaster recovery (DR) solution in us-west-2 with a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $1$ minute. The solution must minimize operational costs during normal operations. Which TWO actions should a solutions architect recommend to implement this DR strategy?

Geçerli olan tümünü seçin

Create an Amazon Aurora Global Database from the primary database cluster. In us-west-2, deploy a secondary DB cluster containing an Amazon Aurora Serverless v2 reader instance configured with a minimum capacity of

0.5

Aurora Capacity Units (ACUs).

In us-west-2, provision the network infrastructure, the Application Load Balancer, and the Amazon ECS service with the desired task count set to 0. Create an automation workflow to scale the ECS service to the required production capacity during a failover.

In us-west-2, deploy a scaled-down Amazon ECS service running at 50% capacity, and configure an Amazon Route 53 latency-based routing policy to automatically distribute incoming traffic across both Regions during normal operations.

Configure Amazon Aurora to export hourly database snapshots to Amazon S3. Use S3 Cross-Region Replication (CRR) to replicate these snapshots to an S3 Glacier Flexible Retrieval vault in us-west-2, and write a script to restore the cluster during failover.

Create a cross-region Amazon RDS PostgreSQL read replica in us-west-2. Configure an AWS Lambda function to automatically promote this replica to a standalone primary database cluster using the RDS API during a primary Region outage.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Aurora Global Database from the primary database cluster. In us-west-2, deploy a secondary DB cluster containing an Amazon Aurora Serverless v2 reader instance configured with a minimum capacity of $0.5$ Aurora Capacity Units (ACUs).; In us-west-2, provision the network infrastructure, the Application Load Balancer, and the Amazon ECS service with the desired task count set to 0. Create an automation workflow to scale the ECS service to the required production capacity during a failover.

Cevap

Configure an Amazon Aurora Global Database with an Aurora Serverless v2 reader in the secondary Region, and deploy the secondary ECS infrastructure with a task count of 0, scaling up only during failover.

Using an Amazon Aurora Global Database secondary cluster with a Serverless v2 reader instance allows replication to proceed with sub-second latency, ensuring the 1-minute RPO is met while keeping idle compute costs very low (

0.5

ACUs). Setting the ECS service's desired task count to 0 in the secondary Region implements a Pilot Light pattern, which eliminates active ECS compute costs during normal operations. The infrastructure can be scaled up to target capacity within the 15-minute RTO during a failover event.

Adım Adım Çözüm

Determine the database configuration required to meet the 1-minute RPO across regions.

An Amazon Aurora Global Database secondary cluster in the target Region.

Aurora Global Database replication has typical latencies of under 1 second, meeting the 1-minute RPO requirement. To minimize idle cost, deploying an Aurora Serverless v2 reader with a minimum capacity of

0.5

ACUs provides replication support without paying for full-scale provisioned instances.

Determine the application compute configuration required to meet the 15-minute RTO while minimizing running costs.

An ECS service configured in the secondary Region with desired task count set to 0 (Pilot Light strategy).

Because ECS tasks can scale up from 0 to full capacity in under 5 minutes, keeping the ECS service task count at 0 during normal operations saves compute costs while easily fitting within the 15-minute recovery timeline.

Evaluate and rule out standard backup/restore or RDS replica promotion solutions.

Reject database snapshots replicated to S3 Glacier and standard RDS read replicas.

Snapshot restore times and Glacier retrieval delays exceed the 15-minute RTO, and snapshots fail the 1-minute RPO. Standard RDS read replicas are incompatible with Aurora clusters and lack the seamless managed global database failover mechanism.

Anahtar Kavram

Disaster recovery (DR) strategies, specifically Pilot Light database replication and scaled-down ECS Fargate deployments, to meet strict RTO/RPO targets while minimizing idle costs.

Soru 195Soru →

A healthcare provider is designing a medical imaging pipeline. When a clinic uploads a raw MRI scan ( $50 \text{ MB}$ to $200 \text{ MB}$ ) to an Amazon S3 bucket, the scan must be processed by a cluster of CPU-intensive workers. The processing tasks must be handled asynchronously. Due to compliance requirements, the scans must be processed in the exact order they are received by the system to ensure correct chronological correlation, and no scan should be processed more than once. The upload volume can peak unexpectedly, and processing can take up to $12$ minutes per scan.

Which solution meets these requirements with the least operational overhead?

Configure an Amazon S3 event notification to publish ObjectCreated events directly to an Amazon SQS FIFO queue. Configure the workers to consume messages from the FIFO queue.

Configure an Amazon S3 event notification to publish ObjectCreated events directly to an Amazon SQS standard queue. Configure the workers to consume messages from the standard queue.

Enable Amazon EventBridge notifications on the Amazon S3 bucket. Create an EventBridge rule that routes S3 ObjectCreated events to an Amazon SQS FIFO queue, and configure the workers to consume messages from the FIFO queue.

Configure an Amazon S3 event notification to trigger an AWS Lambda function that downloads the scan, performs the CPU-intensive processing directly within the function, and saves the result to another S3 bucket.

Cevabı ve açıklamayı göster

Cevap: Enable Amazon EventBridge notifications on the Amazon S3 bucket. Create an EventBridge rule that routes S3 ObjectCreated events to an Amazon SQS FIFO queue, and configure the workers to consume messages from the FIFO queue.

Cevap

The correct solution uses Amazon S3 EventBridge integration. Because Amazon S3 cannot publish events directly to an Amazon SQS FIFO queue, enabling EventBridge notifications on the bucket allows S3 to emit events to the default event bus. An EventBridge rule can then match these events and route them to an SQS FIFO queue. The SQS FIFO queue guarantees that the messages are processed in the order they were uploaded (first-in, first-out) and prevents duplicate processing (exactly-once processing) through deduplication. This architecture is asynchronous and serverless, minimizing operational overhead.

Adım Adım Çözüm

Enable Amazon EventBridge notifications on the source Amazon S3 bucket.

S3 events are sent to the default EventBridge event bus.

S3 event notifications cannot target SQS FIFO queues directly, so EventBridge must be used as an intermediary.

Create an Amazon EventBridge rule that filters for ObjectCreated events on the specific S3 bucket and targets the SQS FIFO queue.

Object upload events are successfully formatted and routed to the FIFO queue.

EventBridge supports SQS FIFO queues as a target and retains metadata necessary for deduplication and ordering.

Configure the workers to consume messages from the SQS FIFO queue and delete them after successful processing.

The scans are processed in order, and the message visibility timeout prevents duplicate processing.

The SQS FIFO queue enforces first-in, first-out delivery and exactly-once processing by utilizing message deduplication IDs.

Anahtar Kavram

Using Amazon EventBridge to bridge S3 event notifications with Amazon SQS FIFO queues for strict ordering and deduplication.

Soru 196Soru →

An online auction application uses Amazon DynamoDB to store bids. The table uses AuctionDate (formatted as YYYY-MM-DD) as the partition key and BidTime as the sort key. During the final minutes of popular auctions, the application experiences write throttling and ProvisionedThroughputExceededException errors, even though the total write capacity is well below the table's provisioned limit. In addition, users experience high read latency when retrieving the current highest bid for an auction. Which two database configurations or architectural changes will resolve these performance issues?

Geçerli olan tümünü seçin

Redesign the table schema to use a high-cardinality partition key, such as AuctionID, to distribute write requests more evenly across multiple physical partitions.

Deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache read requests, reducing read latency for the highest bids to microseconds.

Keep the existing schema and switch the DynamoDB table to on-demand capacity mode to automatically scale throughput to resolve the hot partition throttling.

Configure an Amazon RDS Read Replica to handle the high volume of read queries and set up automatic failover to the replica if the primary database becomes throttled.

Cevabı ve açıklamayı göster

Cevap: Redesign the table schema to use a high-cardinality partition key, such as AuctionID, to distribute write requests more evenly across multiple physical partitions.; Deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache read requests, reducing read latency for the highest bids to microseconds.

Cevap

Redesign the table schema to use a high-cardinality partition key like AuctionID to distribute writes, and deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache reads.

The correct configurations are to redesign the schema to use a high-cardinality partition key (such as AuctionID) and to deploy Amazon DynamoDB Accelerator (DAX). Changing to a high-cardinality partition key ensures writes are evenly distributed across physical partitions, preventing hot partition throttling. DAX provides an in-memory cache that reduces read latency to microseconds and offloads read traffic from the partition.

Adım Adım Çözüm

Analyze the database schema and identify the cause of the write throttling.

The partition key AuctionDate is low-cardinality and causes all write operations on a given day to target the same physical partition, leading to hot partition throttling.

DynamoDB partitions have individual throughput limits (1,000 WCUs), which can be exceeded even if the table-level provisioned capacity is not fully utilized.

Choose a new partition key that distributes the workload evenly.

Using a high-cardinality attribute like AuctionID distributes concurrent bids across different partitions.

High-cardinality keys ensure that partition-level throughput limits are not breached during peak traffic.

Address the read latency requirement for retrieval of the highest bids.

Deploy DynamoDB Accelerator (DAX).

DAX provides microsecond latency for read operations by caching read requests, offloading the database table.

Anahtar Kavram

Designing high-performing DynamoDB architectures by using high-cardinality partition keys to prevent hot partitions, and utilizing DynamoDB Accelerator (DAX) for microsecond read latencies.

Soru 197Soru →

A company hosts an internal inventory management service on Amazon EC2 instances within an Auto Scaling group (ASG). The service runs behind an internal Application Load Balancer (ALB) and is configured to listen on custom TCP port 5000. The solutions architect must ensure that the ALB can successfully monitor the health of the application on the instances and route traffic to them securely.

Which combination of actions should the solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure the target group to perform health checks on the traffic port or explicitly on port 5000.

Configure the security group attached to the EC2 instances to allow inbound TCP traffic on port 5000 from the security group of the ALB.

Configure the target group health check to query the default HTTP port 80 to separate health check traffic from client traffic.

Configure stateless Network Access Control Lists (NACLs) at the subnet level to permit inbound traffic on port 5000, relying on NACL statefulness for return traffic.

Configure an Amazon Route 53 latency routing policy pointing to the load balancer to automatically route users away from unhealthy targets without setting up active health checks.

Cevabı ve açıklamayı göster

Cevap: Configure the target group to perform health checks on the traffic port or explicitly on port 5000.; Configure the security group attached to the EC2 instances to allow inbound TCP traffic on port 5000 from the security group of the ALB.

Cevap

The solutions architect should configure the target group to perform health checks on port 5000 and configure the security group of the EC2 instances to allow inbound traffic on port 5000 from the security group of the Application Load Balancer.

To ensure that the Application Load Balancer can route traffic to and verify the health of the custom service, the target group health checks must query the port where the application is running, which is port 5000. Additionally, the security group of the EC2 instances must permit inbound traffic on port 5000 specifically from the security group of the load balancer to secure the network path and allow traffic flow.

Adım Adım Çözüm

Determine the application port configuration.

The application listens on custom port 5000.

Health checks must be sent to the port where the application is actually running (port 5000) so that the load balancer does not falsely mark the targets as unhealthy.

Configure instance-level security.

Allow inbound traffic on port 5000 from the ALB's security group.

Since the ALB routes requests to the instances on port 5000, the instances' security group must permit this inbound traffic. Referencing the ALB's security group directly ensures least-privilege access.

Anahtar Kavram

Auto Scaling and Application Load Balancer custom port routing and health check configuration

Soru 198Soru →

A financial technology company is designing a transaction processing application. When a customer initiates a fund transfer, the transaction must be processed asynchronously in the exact order it was received to prevent account balance discrepancies. The architecture must decouple the frontend web portal from the backend processing servers to handle traffic peaks without losing messages. Which TWO components should a solutions architect recommend to satisfy these requirements? (Select TWO).

Geçerli olan tümünü seçin

Amazon SQS FIFO queue to store the incoming transactions in strict order.

An Auto Scaling group of EC2 instances acting as backend workers that poll the queue.

Amazon SQS Standard queue to buffer the transaction requests.

Amazon RDS Read Replicas configured as the primary write target for failover.

Amazon DynamoDB configured with Provisioned Capacity Mode to scale dynamically for unpredictable traffic spikes.

Cevabı ve açıklamayı göster

Cevap: Amazon SQS FIFO queue to store the incoming transactions in strict order.; An Auto Scaling group of EC2 instances acting as backend workers that poll the queue.

Cevap

The correct architecture uses an Amazon SQS FIFO queue to store and sequence transaction requests, combined with an Auto Scaling group of EC2 worker instances that poll the queue to process messages asynchronously.

The correct solution leverages an Amazon SQS FIFO queue to guarantee first-in, first-out message sequencing and prevent duplicate processing, ensuring the transaction order is maintained. To handle the asynchronous processing and scaling requirements, an Auto Scaling group of EC2 worker instances polls the SQS queue and scales dynamically based on workload demand.

Adım Adım Çözüm

Identify the ordering constraint for the asynchronous transaction requests.

Since messages must be processed in the exact order they are received, an Amazon SQS FIFO queue is required instead of a Standard queue.

Standard queues do not guarantee message ordering, whereas FIFO queues preserve order and prevent duplicate delivery.

Determine the mechanism for decoupling and processing messages asynchronously.

Backend workers hosted on EC2 instances can be grouped in an Auto Scaling group to poll the SQS queue.

This allows the backend to scale independently based on the number of messages in the queue (queue depth), decoupling the front-end submission from the backend processing.

Anahtar Kavram

Decoupling message-driven architectures while guaranteeing strict message ordering using Amazon SQS FIFO queues.

Soru 199Soru →

A solutions architect is configuring an Application Load Balancer (ALB) to distribute traffic to a fleet of Amazon EC2 instances managed by an Auto Scaling group (ASG). The transit tracking application running on the EC2 instances listens on TCP port 3000. The target group is configured to route traffic to port 3000. However, the health check port in the target group configuration is set to port 80. The ALB marks all EC2 instances as unhealthy, even though the application is responsive when accessed directly on port 3000 from within the VPC. Which action should the solutions architect take to resolve this issue and restore healthy status?

Add an outbound rule to the security group of the EC2 instances to allow return traffic on port 80 to the ALB.

Configure a Route 53 latency routing policy to bypass target group health checks and route client traffic directly to the instances.

Modify the target group's health check configuration to query the traffic port or explicitly set it to port 3000.

Add an outbound rule to the subnet Network ACL to allow traffic from the EC2 instances to the ALB on ephemeral ports, since security groups are stateless.

Cevabı ve açıklamayı göster

Cevap: Modify the target group's health check configuration to query the traffic port or explicitly set it to port 3000.

Cevap

Modify the target group's health check configuration to query the traffic port or explicitly set it to port 3000.

The correct answer is to modify the target group's health check configuration to query the traffic port or port 3000. When an Application Load Balancer target group is configured with a health check port that does not match the port where the application is listening (for example, port 80 instead of port 3000), the health check probes will fail, leading the load balancer to mark all targets as unhealthy even if the application itself is fully operational.

Adım Adım Çözüm

Identify the mismatch between the application listening port (port 3000) and the health check port (port 80) configured in the target group.

The ALB is attempting to perform health checks on port 80, which fails because the application is not listening on that port.

Understanding where the application is listening and how the health checks are configured is the first step in diagnosing ELB target health issues.

Update the target group health check settings to use the traffic port or port 3000.

The ALB successfully connects to the application on port 3000 during health checks.

Matching the health check port to the port where the service is active allows the ALB to accurately determine the health of the targets.

Anahtar Kavram

Target Group Health Checks and Port Configuration

Soru 200Soru →

An international smart grid utility corporation hosts its core telemetry visualization application on AWS. The application tier runs on Amazon EC2 instances inside an Auto Scaling group behind an Application Load Balancer (ALB). The relational database tier is deployed as an Amazon RDS for MySQL DB instance. The company needs to design a cross-region disaster recovery (DR) solution that achieves a Recovery Time Objective (RTO) of 45 minutes and a Recovery Point Objective (RPO) of 15 minutes, while minimizing compute costs and operational overhead during normal operations. Which architecture should a solutions architect recommend to meet these requirements?

Create a cross-region read replica of the RDS DB instance in the secondary Region. Deploy the Application Load Balancer and the Auto Scaling group in the secondary Region with the desired capacity set to 0. During failover, promote the read replica, scale up the Auto Scaling group, and update Route 53 DNS records.

Create a cross-region read replica of the RDS DB instance in the secondary Region. Configure the Application Load Balancer in the primary Region to automatically route write traffic to the read replica if the primary DB instance becomes unavailable.

Deploy the EC2 instances and ALB in the secondary Region. Configure Amazon Route 53 with a latency routing policy to dynamically direct all client traffic to the secondary Region to achieve automatic failover if the primary Region becomes unhealthy.

Back up the primary RDS DB instance to Amazon S3 daily, and copy the backups to the secondary Region using S3 Cross-Region Replication with an S3 Lifecycle policy that immediately transitions them to Amazon S3 Glacier Flexible Retrieval. Restore the database from the Glacier archives during a disaster.

Cevabı ve açıklamayı göster

Cevap: Create a cross-region read replica of the RDS DB instance in the secondary Region. Deploy the Application Load Balancer and the Auto Scaling group in the secondary Region with the desired capacity set to 0. During failover, promote the read replica, scale up the Auto Scaling group, and update Route 53 DNS records.

Cevap

The correct strategy uses the Pilot Light pattern to achieve the recovery targets while keeping costs minimal. An Amazon RDS cross-region read replica satisfies the 15-minute RPO through asynchronous replication, which usually lags by only a few seconds. Deploying the application tier with an Auto Scaling group set to 0 capacity ensures that you only pay for storage and metadata rather than active compute instances during normal operations. During failover, the replica is promoted, the Auto Scaling group is scaled up to handle the load, and Amazon Route 53 points traffic to the new ALB, easily completing the process within the 45-minute RTO.

Adım Adım Çözüm

Analyze RTO and RPO limits against workload characteristics.

An RPO of 15 minutes mandates continuous database replication to the secondary Region. An RTO of 45 minutes permits compute resources to be scaled up dynamically during failover rather than running continuously.

This establishes that a Pilot Light strategy is the most cost-effective approach for satisfying the disaster recovery objectives.

Configure the database tier for cross-region replication.

Create an Amazon RDS for MySQL cross-region read replica in the destination Region.

Asynchronous replication to the replica keeps the data recovery point within seconds or minutes, safely meeting the 15-minute RPO requirement.

Configure the compute and network tiers in the secondary Region.

Deploy the Application Load Balancer and Auto Scaling group with the desired capacity set to 0.

This avoids incurring compute costs for running idle EC2 instances during normal operations, while ensuring that the infrastructure is ready to scale up immediately during a disaster.

Execute the disaster recovery failover workflow.

Promote the read replica to a standalone primary database, scale up the Auto Scaling group instances, and update Route 53 records to route traffic to the secondary ALB.

These steps can be fully automated or executed manually within 10 to 15 minutes, well within the 45-minute RTO.

Anahtar Kavram

Disaster recovery strategies differ by Recovery Time Objective (RTO), Recovery Point Objective (RPO), and cost. A Pilot Light strategy keeps critical data replicated while keeping compute resources off or scaled to zero, minimizing cost while enabling recovery within minutes.

ÖncekiSayfa 10 / 74Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram