Tüm alıştırma soruları

1462 soru

Tüm türler1,462 Çoktan seçmeli739 Çoklu seçim723

A credit scoring company hosts its core risk evaluation platform on AWS. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer in the us-east-1 Region. The database tier uses an Amazon Aurora PostgreSQL DB cluster. The company needs to design a disaster recovery (DR) plan in the us-west-2 Region to handle a full region outage. The DR solution must achieve a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 30 minutes while minimizing ongoing running costs.

Which solution meets these requirements with the lowest cost?

Create an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 containing zero DB instances. Copy the application AMIs to us-west-2. Deploy an AWS CloudFormation template that provisions the Application Load Balancer and the Auto Scaling group in us-west-2, and add a DB instance to the secondary Aurora cluster during a failover event.

Create an Amazon Aurora Global Database with a secondary DB cluster in us-west-2 containing a running DB instance of the same size. Deploy the Application Load Balancer and a scaled-down Auto Scaling group running at minimum capacity in us-west-2 to enable rapid traffic redirection during a failover event.

Configure an Amazon RDS for PostgreSQL cross-region read replica in us-west-2. Set up Amazon Route 53 latency-based routing to automatically promote the read replica to primary and redirect all client application traffic to us-west-2 if the primary region becomes unavailable.

Configure daily Amazon Aurora DB cluster snapshots and copy them to an Amazon S3 bucket in us-west-2, transitioning them immediately to S3 Glacier Flexible Retrieval. In the disaster recovery region, write an automation script to retrieve the snapshot, restore the DB cluster, and launch the compute tier.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 containing zero DB instances. Copy the application AMIs to us-west-2. Deploy an AWS CloudFormation template that provisions the Application Load Balancer and the Auto Scaling group in us-west-2, and add a DB instance to the secondary Aurora cluster during a failover event.

Cevap

The correct option implements a Pilot Light strategy using Amazon Aurora Global Database. Aurora Global Database replicates storage updates with typical replication lag of less than one second, satisfying the 5-minute RPO. By configuring the secondary cluster in the recovery region with zero DB instances, the compute cost is zero during normal operations. The 30-minute RTO provides ample time to add a DB instance to the secondary cluster and deploy the load balancer and Auto Scaling group via AWS CloudFormation templates.

Adım Adım Çözüm

Analyze RPO requirements and select replication technology.

Amazon Aurora Global Database provides physical, storage-level replication with lag under 1 second, meeting the 5-minute RPO.

Standard daily backups or manual cross-region copies could violate the low RPO under peak write workloads.

Analyze RTO requirements and determine the pilot light compute state.

An RTO of 30 minutes allows sufficient time to provision compute resources dynamically rather than keeping them active.

Starting an Aurora DB instance in a headless secondary cluster and deploying EC2 instances via CloudFormation takes approximately 10 to 15 minutes, well within the 30-minute limit.

Evaluate costs of different active states in the secondary region.

Maintaining a secondary cluster with zero DB instances and using on-demand infrastructure provisioning via templates minimizes compute costs.

Warm Standby solutions require running continuous standby compute resources, which increases ongoing operational costs unnecessarily.

Anahtar Kavram

Pilot Light Disaster Recovery with Aurora Global Database

Soru 202Soru →

A gaming company runs an application on Amazon EC2 instances in a private subnet. The security team needs to implement a solution to monitor network traffic for threats, specifically detecting if any EC2 instance has been compromised and is communicating with external command-and-control (C&C) servers. Additionally, they must monitor the configuration of their security groups to detect and alert on unauthorized changes. Which combination of AWS services should a solutions architect recommend to meet these requirements with the least operational overhead?

Configure stateless Network ACLs to inspect outbound packets for malicious signatures and automatically block command-and-control servers, and use stateful Security Groups at the subnet level to monitor configuration changes.

Enable Amazon GuardDuty to analyze VPC Flow Logs for malicious outbound communications, and use AWS Config to track and alert on changes to the security groups.

Deploy AWS Shield Standard on the EC2 instances to monitor network payloads for command-and-control traffic, and use AWS WAF to monitor configuration changes to the security groups.

Configure AWS WAF on the private EC2 instances to analyze network flow logs for command-and-control threats, and use AWS Shield Standard to monitor security group configuration drift.

Cevabı ve açıklamayı göster

Cevap: Enable Amazon GuardDuty to analyze VPC Flow Logs for malicious outbound communications, and use AWS Config to track and alert on changes to the security groups.

Cevap

Enable Amazon GuardDuty to analyze VPC Flow Logs for malicious outbound communications, and use AWS Config to track and alert on changes to the security groups.

The correct answer combines Amazon GuardDuty and AWS Config. Amazon GuardDuty uses machine learning and threat intelligence to analyze VPC Flow Logs and detect compromised EC2 instances talking to malicious command-and-control servers. AWS Config records configurations of AWS resources and detects when rules change, satisfying the compliance tracking requirement with minimum operational overhead.

Adım Adım Çözüm

Select a managed service for threat detection in network traffic.

Amazon GuardDuty is selected.

GuardDuty automatically analyzes metadata sources such as VPC Flow Logs, DNS query logs, and CloudTrail management events to identify compromised instances communicating with malicious command-and-control endpoints.

Select a service for tracking AWS resource configuration and compliance.

AWS Config is selected.

AWS Config continuously monitors and records configuration details of AWS resources, allowing the creation of compliance rules to detect unauthorized changes in security groups.

Evaluate the operational overhead and capability limits of alternative services.

Incorrect options are eliminated.

Stateless Network ACLs and stateful Security Groups cannot be used to audit configuration changes or perform deep packet threat inspection. AWS WAF and AWS Shield Standard operate at the web and edge layers for DDoS/Web exploits and cannot be used for internal configuration auditing or VPC-level threat monitoring.

Anahtar Kavram

Continuous security monitoring and threat detection in AWS requires combining GuardDuty for behavior-based threat analysis and AWS Config for resource configuration tracking.

Soru 203Soru →

A solutions architect is designing the database tier for an e-commerce platform that hosts short-duration flash sales events. During these events, write traffic spikes suddenly from a few requests per minute to over $12,000$ transactions per second. The application requires database write latency of less than $10$ milliseconds. The orders are processed using sequentially generated order IDs. Which database configuration will meet these performance requirements under sudden spikes while remaining cost-effective?

Deploy an Amazon DynamoDB table in on-demand capacity mode, using the sequentially generated order ID as the partition key to preserve the order sequence.

Deploy an Amazon RDS for MySQL database in a single Availability Zone, and configure three read replicas in different Availability Zones to handle the high write throughput and serve as primary failover targets.

Deploy an Amazon DynamoDB table in on-demand capacity mode, and design the partition key using a high-cardinality attribute such as a UUID or a hashed combination of the order ID and timestamp.

Deploy an Amazon DynamoDB table with a UUID partition key in provisioned capacity mode, using static write capacity units calculated based on the average daily traffic to minimize operating costs.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon DynamoDB table in on-demand capacity mode, and design the partition key using a high-cardinality attribute such as a UUID or a hashed combination of the order ID and timestamp.

Cevap

Deploy an Amazon DynamoDB table in on-demand capacity mode, and design the partition key using a high-cardinality attribute such as a UUID or a hashed combination of the order ID and timestamp.

The correct architecture uses Amazon DynamoDB in on-demand capacity mode with a partition key designed around a high-cardinality attribute (like a UUID or hashed key). DynamoDB easily delivers sub-

10

millisecond write latencies. On-demand mode dynamically adjusts to sudden, unpredictable traffic spikes without manual scaling or throttling. Using a high-cardinality partition key distributes write operations evenly across physical partitions, avoiding write bottlenecks.

Adım Adım Çözüm

Analyze the performance requirements: high write throughput (

12,000

writes per second), sub-

10

millisecond latency, and sudden spikes in traffic.

DynamoDB is identified as the database capable of meeting sub-

10

millisecond write latencies at scale, while on-demand capacity mode is required to handle sudden, unpredictable spikes without throttling.

To select the database service and capacity management strategy that matches the throughput and performance constraints.

Analyze the partition key design based on the access patterns and sequentially generated order IDs.

Using sequential keys would direct consecutive writes to the same partition, causing a hot partition. A high-cardinality partition key, such as a UUID or hashed order ID, is required to distribute writes evenly.

To avoid partition throttling and ensure high write throughput is distributed across the database nodes.

Evaluate the suitability of relational databases with read replicas.

Relational read replicas do not accept write operations and cannot resolve write bottlenecks. Manual failover scripts on read replicas do not replace the automated failover capability of Multi-AZ.

To eliminate architectures that cannot scale write performance or provide automated resilience.

Anahtar Kavram

High-Performing DynamoDB Partitioning and Capacity Planning

Soru 204Soru →

A company hosts an internal dashboard on Amazon EC2 instances managed by an Auto Scaling group (ASG). The dashboard application runs on custom port 8090. The ASG is registered with a target group behind an Application Load Balancer (ALB). The EC2 instances' security group is configured to allow inbound traffic from the ALB's security group on port 8090. However, the ALB marks all instances as unhealthy and returns a 502 Bad Gateway error to users. Local verification shows that the application is running and responding normally on port 8090 on each instance.

Which of the following actions should a solutions architect take to resolve this issue?

Add an inbound rule to the subnet's network ACL to allow traffic from the security group of the Application Load Balancer on port 8090.

Configure an Amazon Route 53 latency routing policy to route traffic directly to the public IP addresses of the EC2 instances, bypassing the Application Load Balancer.

Configure the target group's health check port to use port 8090 instead of the default port 80.

Add an outbound rule to the security group of the EC2 instances to explicitly allow ephemeral port range traffic to the Application Load Balancer for health check responses.

Cevabı ve açıklamayı göster

Cevap: Configure the target group's health check port to use port 8090 instead of the default port 80.

Cevap

Configure the target group's health check port to use port 8090 instead of the default port 80.

The correct action is to configure the target group's health check port to use port 8090 instead of the default port 80. The Application Load Balancer marks the EC2 instances as unhealthy because the health check configuration is querying the default port 80, whereas the application is only listening and responding on the custom port 8090. Updating the health check port ensures the load balancer checks the correct application endpoint.

Adım Adım Çözüm

Diagnose the source of the 502 Bad Gateway error and unhealthy targets.

The Application Load Balancer (ALB) reports the targets as unhealthy because its health checks are failing. Since the application runs on custom port 8090 but local tests show it is healthy, the ALB is likely querying the wrong port.

By default, target group health checks query the default HTTP port (port 80) unless overridden or configured to use the traffic port.

Evaluate the target group configuration parameters.

Configuring the health check port to explicitly use port 8090 (or the traffic port) directs the ALB to query the correct port on which the service is listening.

This aligns the health check destination with the actual application port, allowing the health check requests to succeed.

Assess security and routing rules to rule out incorrect configurations.

Security groups are stateful, so outbound rules for return traffic are unnecessary. Network ACLs do not support security group references. Latency-based routing does not fix target group health failures.

Ensures the solution adheres to core AWS networking principles without introducing security group or network ACL misconfigurations.

Anahtar Kavram

ELB Health Check Port Configuration and Security Group Statefulness

Soru 205Soru →

An enterprise is migrating its multi-tier workloads to AWS and has established an organization in AWS Organizations. The enterprise has created separate OUs for development, testing, and production workloads. The security team mandates that employees must use their existing corporate IdP to access AWS resources. Additionally, the team requires that no administrator in any member account can disable or modify Amazon GuardDuty or AWS CloudTrail in their respective accounts. Which combination of actions should a solutions architect recommend to meet these requirements with the least operational overhead?

Configure AWS IAM Identity Center to federate with the corporate IdP. Create an SCP at the organization root that denies permissions to delete or modify GuardDuty and CloudTrail resources, which automatically applies to all member accounts.

Create individual IAM users in each member account for all employees and configure SAML 2.0 federation for each user. Apply local IAM policies in each account to deny permissions to modify GuardDuty and CloudTrail.

Require administrators to use the root user credentials of the organization's management account to centrally manage all member accounts. Store the root access keys in a central repository to run daily automated verification scripts.

Configure AWS IAM Identity Center for user federation. Store the sensitive API keys and configurations of GuardDuty and CloudTrail as plaintext parameters in AWS Systems Manager Parameter Store using standard String parameters to simplify cross-account validation.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with the corporate IdP. Create an SCP at the organization root that denies permissions to delete or modify GuardDuty and CloudTrail resources, which automatically applies to all member accounts.

Cevap

Configure AWS IAM Identity Center to federate with the corporate IdP, and apply an SCP at the organization root to deny permissions to delete or modify GuardDuty and CloudTrail resources.

The correct option addresses the requirements by configuring AWS IAM Identity Center to federate with the corporate IdP, which provides single sign-on access across all member accounts without the overhead of individual IAM users. It then applies an SCP at the organization root, which prevents administrators in member accounts from deleting or modifying GuardDuty and CloudTrail configurations, ensuring governance compliance.

Adım Adım Çözüm

Address the centralized access requirement by setting up federation using AWS IAM Identity Center linked to the corporate IdP.

Users can authenticate via the corporate IdP and access their designated AWS accounts and resources using single sign-on (SSO) without managing individual IAM user credentials in each account.

This meets the security team's requirement for centralized corporate identity integration while minimizing operational overhead.

Address the guardrail requirement by creating an SCP in AWS Organizations.

The SCP is defined to deny actions like guardduty:DeleteDetector, guardduty:UpdateDetector, cloudtrail:StopLogging, and cloudtrail:DeleteTrail.

SCPs act as permission boundaries that apply to all users and roles in member accounts, including the root user of those accounts.

Attach the SCP to the organization root or target OUs.

The restriction is enforced globally across all member accounts under those OUs, preventing administrators from bypassing or disabling these security services.

Centralized enforcement at the OU or organization root level ensures consistent governance and compliance.

Anahtar Kavram

Centralized multi-account governance using AWS Organizations Service Control Policies (SCPs) combined with AWS IAM Identity Center for federated identity management.

Soru 206Soru →

An e-learning enterprise hosts its online classroom application in the us-east-1 Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group and an Amazon RDS for PostgreSQL DB instance. The company needs to implement a cost-effective cross-Region disaster recovery (DR) solution in the us-west-2 Region. The DR solution must achieve a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure an Amazon RDS cross-Region read replica in the secondary Region, and promote the read replica to a primary DB instance during failover.

Deploy a scaled-down, active Auto Scaling group of EC2 instances behind an Application Load Balancer in the secondary Region.

Configure Amazon Route 53 with latency-based routing to automatically redirect application traffic to the secondary Region read replica in the event of an outage.

Deploy a pilot light environment in the secondary Region where EC2 instances are stopped, and copy RDS daily snapshots to Amazon S3 Glacier Flexible Retrieval in the secondary Region.

Configure Amazon RDS Multi-AZ replication to synchronize data between the primary Region and the secondary Region, enabling automatic database failover.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon RDS cross-Region read replica in the secondary Region, and promote the read replica to a primary DB instance during failover.; Deploy a scaled-down, active Auto Scaling group of EC2 instances behind an Application Load Balancer in the secondary Region.

Cevap

Configure an Amazon RDS cross-Region read replica in the secondary Region and promote it during failover, combined with deploying a scaled-down, active Auto Scaling group of EC2 instances behind an Application Load Balancer in the secondary Region.

To meet the RPO of 5 minutes, database replication must be continuous. An Amazon RDS cross-Region read replica uses asynchronous replication to keep data synchronized with very low replication lag (usually seconds). Promoting this replica to a primary database instance takes a few minutes, which fits within the 15-minute RTO. To meet the RTO of 15 minutes for the compute tier, a Warm Standby environment is required. Deploying a scaled-down but active Auto Scaling group of EC2 instances behind an Application Load Balancer ensures that resources are already online and ready to quickly scale up to meet production demands without the boot latency associated with starting stopped instances.

Adım Adım Çözüm

Analyze the RTO and RPO requirements.

The target RPO is 5 minutes and the RTO is 15 minutes, requiring a dynamic replication mechanism and an active or near-active computing environment.

Establishing these targets helps eliminate strategies with high recovery time (such as backup and restore from S3 Glacier) or high data loss.

Select the database replication strategy.

Identify that an Amazon RDS cross-Region read replica provides continuous asynchronous replication, keeping the data lag under 5 minutes (RPO), and can be promoted to primary within minutes (RTO).

RDS cross-Region read replicas are the standard way to replicate RDS PostgreSQL databases across Regions asynchronously.

Select the application compute strategy.

Determine that a Warm Standby strategy (deploying a scaled-down, active Auto Scaling group behind an ALB in the secondary Region) satisfies the 15-minute RTO because compute instances are already running and can be scaled up immediately.

A Pilot Light strategy with stopped instances would introduce startup delays that could risk breaching the strict 15-minute RTO under load.

Anahtar Kavram

Disaster Recovery strategies (Warm Standby vs. Pilot Light) and cross-Region database replication (RDS Read Replicas vs. Multi-AZ).

Tahmini Süre:2m 0s

Soru 207Soru →

A digital media corporation is migrating its workflows to a multi-account environment managed by AWS Organizations. The company utilizes Microsoft Entra ID as its central identity provider. The security team requires that access to the AWS Management Console be authenticated against Entra ID, and that group memberships in Entra ID automatically determine the AWS permissions granted to users without manually creating IAM users in individual accounts. The solution must minimize operational overhead. Which two actions should a solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Enable AWS IAM Identity Center in the organization's management account and configure an external identity provider using SAML 2.0 federation.

Configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol between Microsoft Entra ID and AWS IAM Identity Center.

Deploy an AD Connector in a transit VPC to bridge Microsoft Entra ID, then configure AWS IAM Identity Center to query user groups via LDAP.

Create a custom SAML 2.0 identity provider in the IAM console of each AWS account, and write a synchronization script to replicate users into local IAM groups.

Establish an AWS Managed Microsoft AD domain and configure a two-way active directory forest trust directly to the Microsoft Entra ID tenant.

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center in the organization's management account and configure an external identity provider using SAML 2.0 federation.; Configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol between Microsoft Entra ID and AWS IAM Identity Center.

Cevap

The correct actions are enabling AWS IAM Identity Center with SAML 2.0 federation to an external identity provider, and configuring automatic provisioning via the System for Cross-domain Identity Management (SCIM) v2.0 protocol.

AWS IAM Identity Center simplifies multi-account access management by allowing centralized single sign-on. By configuring Microsoft Entra ID as an external SAML 2.0 identity provider, users can authenticate using their existing credentials. Using SCIM v2.0 automates the provisioning of users and groups from Microsoft Entra ID to AWS IAM Identity Center, mapping Entra ID groups directly to permission sets in AWS without manual intervention.

Adım Adım Çözüm

Determine the identity source and centralized portal requirement.

AWS IAM Identity Center is selected as the recommended service for centralized access across multiple AWS accounts.

IAM Identity Center integrates with AWS Organizations to manage multi-account permissions from a single place, minimizing operational overhead.

Establish trust between AWS IAM Identity Center and Microsoft Entra ID.

SAML 2.0 federation is configured to delegate authentication to Microsoft Entra ID as the external Identity Provider.

This allows users to authenticate using their existing Entra ID credentials without storing or replicating passwords in AWS.

Automate user and group provisioning.

SCIM v2.0 is enabled to automatically synchronize user accounts and group memberships into IAM Identity Center.

SCIM enables automatic synchronization of identity changes and group mappings, eliminating the need to manually create local IAM users.

Anahtar Kavram

Centralized multi-account identity federation using AWS IAM Identity Center and external SAML/SCIM providers.

Soru 208Soru →

A SaaS company provides a travel booking platform hosted in the us-east-1 Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer, and an Amazon RDS for PostgreSQL DB instance. The company wants to establish a disaster recovery (DR) site in the us-west-2 Region using a Warm Standby pattern. The DR solution must achieve a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $5$ minutes, while minimizing ongoing costs.

Which TWO actions should a solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Deploy a scaled-down Auto Scaling group of EC2 instances and an Application Load Balancer in the secondary Region, and configure the Auto Scaling group to scale up in response to traffic during failover.

Create an Amazon RDS Cross-Region Read Replica in the secondary Region, and write a script to promote the replica to a primary DB instance in a disaster recovery event.

Configure the Amazon RDS DB instance in Multi-AZ mode, selecting a subnet in the secondary Region as the standby zone to enable automatic cross-Region failover.

Configure an Amazon Route 53 latency-based routing policy to automatically redirect application traffic to the secondary Region during a primary Region outage.

Configure database backups to be stored in Amazon S3, transition them to S3 Glacier Deep Archive, and retrieve them in the secondary Region during failover.

Cevabı ve açıklamayı göster

Cevap: Deploy a scaled-down Auto Scaling group of EC2 instances and an Application Load Balancer in the secondary Region, and configure the Auto Scaling group to scale up in response to traffic during failover.; Create an Amazon RDS Cross-Region Read Replica in the secondary Region, and write a script to promote the replica to a primary DB instance in a disaster recovery event.

Cevap

The correct configurations are deploying a scaled-down Auto Scaling group of EC2 instances and an Application Load Balancer in the secondary Region (scaling up during failover) and creating an Amazon RDS Cross-Region Read Replica in the secondary Region (promoting it during failover).

To satisfy a

15

-minute RTO and

5

-minute RPO under a Warm Standby pattern at a minimal cost, the solutions architect must maintain a running but scaled-down compute tier and configure active database replication. Deploying a scaled-down Auto Scaling group in the secondary Region ensures compute instances are already running and can immediately scale up to handle full traffic when a failover occurs, meeting the RTO. Creating an Amazon RDS Cross-Region Read Replica provides continuous, asynchronous replication to the secondary Region with a lag typically under a few minutes, meeting the RPO. In a failover scenario, this replica is promoted to a standalone primary database to accept write operations.

Adım Adım Çözüm

Select a database replication technology that meets the RPO constraint.

An Amazon RDS Cross-Region Read Replica provides asynchronous replication to the secondary Region with very low replication lag, satisfying the

5

-minute RPO.

Standard backups or snapshots cannot reliably meet a

5

-minute RPO without significant cost, while synchronous Multi-AZ does not cross Regions.

Select a compute standby strategy that meets the RTO constraint at a minimal cost.

Deploying a scaled-down Auto Scaling group of EC2 instances in the secondary Region ensures compute instances are already running and can scale up quickly, satisfying the

15

-minute RTO.

A Pilot Light strategy (zero instances running) may take too long to bootstrap and pass health checks, failing the

15

-minute RTO. An active-active setup is too costly.

Establish failover automation for database promotion.

Create a script to promote the read replica to a primary standalone DB instance during failover.

Promotion changes the replica to a primary instance capable of accepting write operations in the recovery Region.

Anahtar Kavram

Disaster recovery strategies differ by Recovery Time Objective (RTO), Recovery Point Objective (RPO), and cost. A Warm Standby deployment maintains scaled-down but running compute resources in the recovery Region along with active database replication (such as a Cross-Region Read Replica) to support rapid recovery while minimizing idle resource costs.

Tahmini Süre:2m 0s

Soru 209Soru →

A Solutions Architect is designing a multi-account governance strategy for a media company that manages its workloads using AWS Organizations. The company's security policy requires that all administrative access to member accounts in the Production OU must be federated using the corporate identity provider. Additionally, member account administrators must be prevented from creating local IAM users or generating long-term IAM access keys. Which combination of actions should the Solutions Architect recommend to meet these requirements?

Enable AWS IAM Identity Center in the management account and link it to the corporate identity provider. Configure administrative permission sets, and apply an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.

Create individual IAM users in each member account with administrative policies attached, configure a SAML 2.0 identity provider in each account, and have corporate users federate directly to their corresponding local IAM user credentials.

Require administrators to use the root user credentials of each member account to perform administrative tasks, and write an SCP at the root level of the organization to deny standard IAM user creation across the OU.

Configure Active Directory Connector in each member account to sync corporate identities, and write a script to automatically provision local IAM users with access keys for each synchronized user in the member accounts.

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center in the management account and link it to the corporate identity provider. Configure administrative permission sets, and apply an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.

Cevap

Enable AWS IAM Identity Center in the management account and link it to the corporate identity provider, configure administrative permission sets, and apply an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.

Enabling AWS IAM Identity Center and linking it to the corporate identity provider centralizes federated identity management across all member accounts in the organization. Combining this with an SCP applied to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions enforces compliance by preventing administrators from creating local users or using long-term credentials.

Adım Adım Çözüm

Centralize identity federation

Enable AWS IAM Identity Center in the management account of AWS Organizations and integrate it with the corporate identity provider (IdP).

This allows centralized login and access control without having to manage credentials or users locally in member accounts.

Configure permissions centrally

Create administrative permission sets in AWS IAM Identity Center and assign them to the appropriate corporate identity provider groups/users for the member accounts.

This grants the necessary administrative permissions in member accounts via short-term security credentials instead of long-term keys.

Enforce credentials and user restrictions

Create and attach an SCP to the Production OU that denies the iam:CreateUser and iam:CreateAccessKey actions.

This policy ensures that even administrators within the member accounts cannot create local users or long-term credentials, enforcing the compliance rule.

Anahtar Kavram

Centralized federation with AWS IAM Identity Center and governance enforcement via Service Control Policies (SCPs) in AWS Organizations

Soru 210Soru →

A company is integrating its AWS environment with a third-party SaaS monitoring tool. The SaaS vendor requires read-only access to the company's AWS resources to collect performance metrics. The security team mandates that the integration must prevent the 'confused deputy' problem and avoid the use of long-term credentials. Which combination of actions should a solutions architect recommend to configure this access? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role in the company's AWS account with a trust policy that specifies the SaaS vendor's AWS account ID as the principal and includes a condition requiring a unique external ID.

Attach an IAM permissions policy to the role that grants read-only access to the required AWS services.

Create an IAM user in the company's AWS account, assign the ReadOnlyAccess managed policy, and share the access keys with the SaaS vendor.

Share the AWS account root user credentials with the SaaS vendor to enable read-only access across the entire AWS Organization.

Configure the SaaS vendor's application to store its authentication parameters as plaintext String parameters in AWS Systems Manager Parameter Store.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role in the company's AWS account with a trust policy that specifies the SaaS vendor's AWS account ID as the principal and includes a condition requiring a unique external ID.; Attach an IAM permissions policy to the role that grants read-only access to the required AWS services.

Cevap

Create an IAM role in the company's AWS account with a trust policy specifying the SaaS vendor's AWS account ID and a unique external ID condition, and attach a read-only permissions policy to this role.

The correct configuration is to create an IAM role that delegates access to the SaaS vendor's AWS account while validating a unique external ID in the trust policy's condition block. This allows the vendor's application to assume the role securely without requiring long-term AWS credentials. In addition, attaching a read-only permissions policy to this role ensures that the vendor has only the permissions required to gather metrics, adhering to the principle of least privilege.

Adım Adım Çözüm

Define the trust relationship for the cross-account IAM role.

An IAM role is created with a trust policy that designates the SaaS vendor's AWS account ID as the trusted entity and specifies a unique external ID in the condition block.

This establishes cross-account delegation and mitigates the confused deputy problem by verifying the unique external ID during the role assumption process.

Define and attach the permissions policy to the IAM role.

A read-only permissions policy is attached to the IAM role, restricting the actions the SaaS vendor can perform to only what is required.

This enforces the principle of least privilege, preventing the SaaS vendor from making unauthorized modifications or accessing unrelated resources.

Anahtar Kavram

Cross-account IAM roles with external IDs are used to securely delegate access to third-party SaaS vendors while mitigating the confused deputy vulnerability.

Tahmini Süre:2m 0s

Soru 211Soru →

A company hosts a two-tier web application in a VPC. The web servers are deployed in a public subnet ( $10.0.1.0/24$ ) and receive HTTPS traffic from the internet. The database servers are deployed in a private subnet ( $10.0.2.0/24$ ) and accept MySQL connections from the web servers on TCP port 3306.

A security architect configures custom network ACLs (NACLs) to secure both subnets.
The public subnet NACL is configured with the following rules:
* Inbound: Allow TCP port 443 from $0.0.0.0/0$
* Outbound: Allow TCP port 443 to $0.0.0.0/0$ , and allow TCP port 3306 to $10.0.2.0/24$

The private subnet NACL is configured with the following rules:
* Inbound: Allow TCP port 3306 from $10.0.1.0/24$
* Outbound: Allow TCP ports $1024-65535$ to $10.0.1.0/24$

The security groups for both the web servers and database servers are already correctly configured to allow the necessary inbound and outbound traffic. Currently, external clients cannot establish HTTPS connections to the web servers, and the web servers are unable to connect to the database.

Which combination of NACL modifications will resolve these connectivity issues?

In the public subnet NACL, add an inbound rule allowing TCP ports

1024-65535

from

10.0.2.0/24

, and update the outbound rule to allow TCP ports

1024-65535

0.0.0.0/0

instead of TCP port 443.

In the private subnet NACL, add an inbound rule allowing TCP ports

1024-65535

from

10.0.1.0/24

, and in the public subnet NACL, update the inbound rule to allow TCP ports

1024-65535

from

0.0.0.0/0

In the public subnet security group, add an inbound rule allowing TCP ports

1024-65535

from the private subnet, and in the private subnet NACL, change the outbound rule to allow TCP port 3306 to

10.0.1.0/24

In the public subnet NACL, add an outbound rule allowing TCP port 3306 to

0.0.0.0/0

, and in the private subnet NACL, remove the outbound rule for ephemeral ports since security groups are stateful and will automatically track return traffic.

Cevabı ve açıklamayı göster

Cevap: In the public subnet NACL, add an inbound rule allowing TCP ports $1024-65535$ from $10.0.2.0/24$ , and update the outbound rule to allow TCP ports $1024-65535$ to $0.0.0.0/0$ instead of TCP port 443.

Cevap

In the public subnet NACL, add an inbound rule allowing TCP ports

1024-65535

from

10.0.2.0/24

, and update the outbound rule to allow TCP ports

1024-65535

0.0.0.0/0

instead of TCP port 443.

The correct option correctly addresses the stateless nature of Network ACLs. When a client establishes an HTTPS connection to the web server, the inbound rule allows port 443, but the return response from the web server must be allowed to go to the client's ephemeral ports (

1024-65535

). Therefore, the public subnet outbound rule must allow TCP ports

1024-65535

0.0.0.0/0

. Additionally, when the web server initiates a connection to the database on port 3306, the database responses return to the web server's ephemeral ports. Thus, the public subnet NACL must allow inbound traffic on TCP ports

1024-65535

from the private subnet (

10.0.2.0/24

Adım Adım Çözüm

Analyze client-to-web server HTTPS traffic flow.

Inbound HTTPS traffic to the web server targets port 443. The return traffic sent back to the client targets the client's ephemeral ports (range

1024-65535

NACLs are stateless, so the outbound path must explicitly allow the response traffic to client ephemeral ports.

Analyze web server-to-database MySQL traffic flow.

The web server initiates connection to the database on port 3306. The database responds back to the web server's ephemeral ports (range

1024-65535

Since the web server is in the public subnet and the database is in the private subnet, the public subnet NACL must explicitly allow inbound traffic from the database subnet on destination ports

1024-65535

Determine the necessary modifications on the public subnet NACL.

Update the outbound rule to allow TCP ports

1024-65535

0.0.0.0/0

(instead of restricting to port 443), and add an inbound rule to allow TCP ports

1024-65535

from the private subnet CIDR (

10.0.2.0/24

These changes ensure that both HTTPS client responses and database responses can bypass the stateless boundaries of the public subnet NACL.

Anahtar Kavram

Stateless Network ACLs (NACLs) require explicit rules for both request and response traffic, including accounting for client and initiator ephemeral ports.

Soru 212Soru →

A company is deploying an in-memory caching tier in a private subnet within an Amazon VPC. The caching nodes run on Amazon EC2 instances and use port $6379$ . Only the application servers running in the web subnet should be allowed to read from and write to the cache nodes. A solutions architect needs to restrict network access to the caching tier.

Which two configuration steps should the solutions architect perform to secure the caching tier? (Select TWO.)

Geçerli olan tümünü seçin

Create a security group for the caching instances that allows inbound TCP traffic on port

6379

from the security group associated with the application instances.

Rely on the stateful behavior of the caching instances' security group to automatically allow the outbound return traffic back to the application instances.

Configure an outbound rule in the caching instances' security group that explicitly allows TCP traffic on ephemeral ports to the application instances, since security groups are stateless.

Deploy AWS WAF at the caching subnet level to inspect and block unauthorized layer

7

commands sent to the caching instances.

Create a network ACL for the caching subnet that allows inbound TCP traffic on port

6379

but blocks outbound traffic on all ephemeral ports to keep the subnet private.

Cevabı ve açıklamayı göster

Cevap: Create a security group for the caching instances that allows inbound TCP traffic on port $6379$ from the security group associated with the application instances.; Rely on the stateful behavior of the caching instances' security group to automatically allow the outbound return traffic back to the application instances.

Cevap

The solutions architect should create a security group for the caching instances allowing inbound traffic on port

6379

from the application security group, and rely on the stateful nature of security groups to permit return traffic.

To secure the caching tier, the caching instances must have a security group that explicitly allows inbound traffic on port

6379

from the application instances' security group. Because security groups are stateful, outbound response traffic from the caching instances to the application instances is permitted automatically, without requiring explicit outbound rules.

Adım Adım Çözüm

Identify the resource-level firewall requirements.

Determine that security groups should be used for fine-grained instance-level traffic control.

Security groups act as a firewall for associated EC2 instances, allowing traffic to be restricted by port and source security group.

Configure the inbound security group rules for the caching instances.

Allow TCP port

6379

from the application security group ID.

This establishes least-privilege access, ensuring only application instances can communicate with the caching tier.

Leverage the stateful nature of security groups for return traffic.

Do not configure any additional inbound or outbound rules for the return traffic.

Because security groups are stateful, allowing inbound request traffic automatically allows the outbound response traffic.

Anahtar Kavram

Security groups are stateful, resource-level firewalls that can reference other security groups as sources, whereas network ACLs are stateless, subnet-level firewalls.

Soru 213Soru →

A fleet management company collects vehicle telematics data. The data is uploaded daily as log files (average size $250\text{ KB}$ ) to an Amazon S3 Standard bucket. The files are accessed frequently during the first $10\text{ days}$ for immediate driver behavior analysis. Between day $10$ and day $40$ , the files are accessed occasionally for monthly reports. After $40\text{ days}$ , the files are rarely accessed but must be retained for an additional $90\text{ days}$ for regulatory auditing, where a retrieval time of $3\text{ to }5\text{ hours}$ is acceptable. After $130\text{ days}$ , the files should be deleted.

Which TWO lifecycle actions should a solutions architect configure to minimize storage costs without incurring minimum storage duration penalties? (Select TWO.)

Geçerli olan tümünü seçin

Configure a lifecycle rule to transition objects from S3 Standard to S3 Standard-IA after

10\text{ days}

Configure a lifecycle rule to transition objects to S3 Glacier Flexible Retrieval after

40\text{ days}

and expire the objects after

130\text{ days}

Configure a lifecycle rule to transition objects from S3 Standard to S3 Standard-IA after

10\text{ days}

and transition to S3 Glacier Flexible Retrieval after

25\text{ days}

Configure a lifecycle rule to transition objects from S3 Standard to S3 Glacier Flexible Retrieval after

10\text{ days}

Configure a lifecycle rule to transition objects to S3 Standard-IA after

10\text{ days}

and expire the objects after

30\text{ days}

Cevabı ve açıklamayı göster

Cevap: Configure a lifecycle rule to transition objects from S3 Standard to S3 Standard-IA after $10\text{ days}$ .; Configure a lifecycle rule to transition objects to S3 Glacier Flexible Retrieval after $40\text{ days}$ and expire the objects after $130\text{ days}$ .

Cevap

Transitioning the objects from S3 Standard to S3 Standard-IA after 10 days, and transitioning them to S3 Glacier Flexible Retrieval after 40 days while expiring them after 130 days.

Transitioning objects to S3 Standard-IA after 10 days aligns with the end of the high-frequency access period. Since the objects are kept in S3 Standard-IA until day 40 (a duration of exactly 30 days), this complies with the 30-day minimum storage duration requirement for S3 Standard-IA. Transitioning the objects to S3 Glacier Flexible Retrieval after 40 days matches the regulatory storage phase where immediate access is no longer required and a 3 to 5 hour retrieval time is acceptable. Expiring the objects after 130 days ensures they are deleted after the required 90 days in S3 Glacier Flexible Retrieval, satisfying the 90-day minimum storage duration of S3 Glacier Flexible Retrieval without paying early deletion penalties.

Adım Adım Çözüm

Analyze the access pattern and durations for each storage tier.

S3 Standard is used for days 0-10 (10 days). S3 Standard-IA is used for days 10-40 (30 days). S3 Glacier Flexible Retrieval is used for days 40-130 (90 days).

Mapping the lifecycle phases ensures we select tiers matching the access frequency and minimum duration requirements.

Validate the S3 Standard-IA transition timing against its billing constraints.

Transitioning to S3 Standard-IA on day 10 and transitioning out on day 40 keeps the objects in S3 Standard-IA for exactly 30 days.

S3 Standard-IA has a minimum storage duration of 30 days; transitioning objects earlier results in early transition billing penalties.

Validate the S3 Glacier Flexible Retrieval transition and expiration timing.

Transitioning to S3 Glacier Flexible Retrieval on day 40 and expiring them on day 130 keeps them in S3 Glacier Flexible Retrieval for 90 days.

S3 Glacier Flexible Retrieval has a minimum storage duration of 90 days; deleting the objects before day 130 would incur early deletion penalties.

Anahtar Kavram

Cost-Optimized Storage Tiering and Lifecycle Management

Soru 214Soru →

A healthcare analytics company is deploying a compliant application on Amazon EC2 instances in private subnets. The application must retrieve database credentials from AWS Secrets Manager and write processed records to Amazon DynamoDB. The company's security policy dictates that no traffic from the private subnets is allowed to traverse the public internet. Which two actions should a solutions architect take to meet these security requirements in a cost-effective manner? (Select TWO.)

Geçerli olan tümünü seçin

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables.

Create an Interface VPC Endpoint for AWS Secrets Manager, and configure its security group to allow inbound HTTPS traffic on port 443 from the EC2 security group.

Create a Gateway VPC Endpoint for AWS Secrets Manager and update the route tables of the private subnets.

Route Amazon DynamoDB traffic through a NAT Gateway located in a public subnet to ensure secure transit over the AWS backbone.

Configure a Network ACL on the private subnet to allow inbound traffic from the public IP address ranges of AWS Secrets Manager.

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables.; Create an Interface VPC Endpoint for AWS Secrets Manager, and configure its security group to allow inbound HTTPS traffic on port 443 from the EC2 security group.

Cevap

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables; and create an Interface VPC Endpoint for AWS Secrets Manager, and configure its security group to allow inbound HTTPS traffic on port 443 from the EC2 security group.

To securely access AWS services without traversing the public internet, VPC Endpoints are utilized. For Amazon DynamoDB, a Gateway VPC Endpoint is the most cost-effective and secure option, as it is free and functions by adding a route to the subnet route tables. For AWS Secrets Manager, an Interface VPC Endpoint is required. Because Interface Endpoints use Elastic Network Interfaces (ENIs) within the VPC, access must be secured by attaching a security group to the endpoint that permits inbound HTTPS traffic from the backend application instances.

Adım Adım Çözüm

Identify the type of VPC endpoint required for Amazon DynamoDB.

Amazon DynamoDB supports Gateway VPC Endpoints, which are free and update subnet route tables directly.

This allows EC2 instances in private subnets to communicate with DynamoDB without leaving the AWS network or incurring NAT Gateway costs.

Identify the type of VPC endpoint required for AWS Secrets Manager.

AWS Secrets Manager supports Interface VPC Endpoints (AWS PrivateLink), which deploy elastic network interfaces (ENIs) inside the subnets.

This enables private access to AWS Secrets Manager using private IP addresses from the VPC.

Configure the security access rules for the Interface VPC Endpoint.

Attach a security group to the Secrets Manager interface endpoint that allows inbound HTTPS (port 443) traffic from the security group of the EC2 instances.

Security groups on Interface VPC Endpoints act as stateful firewalls controlling which resources can access the endpoint.

Anahtar Kavram

Selecting the correct VPC endpoint type (Gateway vs. Interface) and configuring its associated security controls (route tables or security groups) to establish secure, private, and cost-effective communication with AWS services.

Soru 215Soru →

A solutions architect is designing the database tier for a critical web application. The application will use an Amazon RDS for PostgreSQL DB instance and requires high availability with automatic failover within a single AWS Region.

Which two options should the solutions architect implement to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Deploy the RDS DB instance in a Multi-AZ configuration to enable synchronous replication to a standby instance in a different Availability Zone.

Configure the application to connect using the primary DB instance DNS endpoint, which AWS automatically updates to point to the standby instance during failover.

Configure an RDS Read Replica in a different Availability Zone and update the application connection string to write to the replica if the primary instance fails.

Set up a Warm Standby DB instance in another AWS Region and use Route 53 latency-based routing to automatically redirect write traffic if the primary region goes offline.

Deploy the database in a Pilot Light configuration with a second scaled-down standby DB instance in another Availability Zone that is manually turned on during a failure.

Cevabı ve açıklamayı göster

Cevap: Deploy the RDS DB instance in a Multi-AZ configuration to enable synchronous replication to a standby instance in a different Availability Zone.; Configure the application to connect using the primary DB instance DNS endpoint, which AWS automatically updates to point to the standby instance during failover.

Cevap

Deploy the RDS DB instance in a Multi-AZ configuration to enable synchronous replication, and configure the application to connect using the primary DB instance DNS endpoint.

The correct options are deploying the RDS DB instance in a Multi-AZ configuration and configuring the application to connect using the primary DB instance DNS endpoint. Multi-AZ configurations provide synchronous replication and automatic failover to a standby instance in another Availability Zone. During failover, AWS automatically updates the DNS record of the DB instance endpoint, allowing the application to connect to the new primary instance without code or configuration changes.

Adım Adım Çözüm

Identify the high availability (HA) and automatic failover requirements for Amazon RDS.

Amazon RDS Multi-AZ deployments satisfy this by creating a synchronous standby replica in another Availability Zone.

Multi-AZ provides automatic failover, synchronous data replication, and high availability within a single AWS Region.

Determine how the application should handle connection redirection during a database failover.

Use the standard RDS DB instance DNS endpoint, which AWS automatically updates to point to the newly promoted primary standby.

This avoids having to modify the application's connection string when a failover occurs, keeping failover seamless.

Anahtar Kavram

Amazon RDS Multi-AZ High Availability and Failover Mechanics

Soru 216Soru →

A company hosts a global web application in a single AWS Region. Users in remote locations report high latency during the TCP connection setup phase. Additionally, the company wants to implement a DNS-level routing mechanism to ensure high availability.

Which TWO solutions should a solutions architect recommend to improve network performance and availability? (Select TWO.)

Geçerli olan tümünü seçin

Deploy AWS Global Accelerator to route user traffic over the AWS global network and reduce TCP connection latency.

Configure Amazon Route 53 with latency-based routing combined with health checks to steer traffic to healthy, low-latency endpoints.

Establish an AWS Site-to-Site VPN connection and route all global client web traffic through a single VPN tunnel to guarantee high-throughput access.

Configure stateful Network ACLs at the subnet level to dynamically route incoming requests to the closest application endpoint.

Use Amazon Route 53 latency-based routing without health checks as the primary failover mechanism during an outage.

Cevabı ve açıklamayı göster

Cevap: Deploy AWS Global Accelerator to route user traffic over the AWS global network and reduce TCP connection latency.; Configure Amazon Route 53 with latency-based routing combined with health checks to steer traffic to healthy, low-latency endpoints.

Cevap

Deploy AWS Global Accelerator to route user traffic over the AWS global network, and configure Amazon Route 53 with latency-based routing combined with health checks.

AWS Global Accelerator utilizes the AWS global network and Anycast IP addresses to terminate TCP connections closer to users, significantly reducing the TCP handshake latency. Amazon Route 53 latency-based routing, when integrated with health checks, ensures that traffic is dynamically routed to the healthiest and lowest-latency endpoints, meeting the high availability and performance requirements.

Adım Adım Çözüm

Analyze client latency reports

Identify that remote users experience latency during the TCP connection setup phase.

This helps determine that a global traffic accelerator is needed to terminate TCP connections closer to the users.

Select AWS Global Accelerator for latency reduction

Using Anycast IPs, user connections are routed to the nearest AWS edge location and then via the AWS private network.

This reduces TCP handshake times and improves overall network performance for global clients.

Configure Route 53 with health checks

Enable latency-based routing combined with health checks.

This provides high availability by ensuring traffic is only routed to active and healthy endpoints.

Anahtar Kavram

AWS Global Accelerator improves TCP connection speeds for global users by utilizing AWS edge locations and Anycast IPs, while Amazon Route 53 latency routing combined with health checks ensures high availability.

Soru 217Soru →

A retail company wants to design a serverless ingestion pipeline to collect real-time JSON clickstream data from its web application at a rate of $500\text{ KB/s}$ . The data must be converted into Apache Parquet format and saved in Amazon S3 for subsequent analysis. The solution should require minimal administration and operational overhead.

Which two AWS services or features should be used together to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Amazon Kinesis Data Firehose to ingest the clickstream data and deliver it directly to Amazon S3.

AWS Glue integration within Amazon Kinesis Data Firehose to perform format conversion from JSON to Apache Parquet.

Amazon SQS standard queues to ingest and buffer the raw clickstream data while maintaining strict chronological message ordering.

Amazon Kinesis Data Streams configured with a single provisioned shard to automatically handle throughput peaks up to

10\text{ MB/s}

AWS Lambda functions running continuously on a 24/7 schedule to poll a web server and handle the stream ingestion.

Cevabı ve açıklamayı göster

Cevap: Amazon Kinesis Data Firehose to ingest the clickstream data and deliver it directly to Amazon S3.; AWS Glue integration within Amazon Kinesis Data Firehose to perform format conversion from JSON to Apache Parquet.

Cevap

To ingest and transform JSON clickstream data with minimal operational overhead, use Amazon Kinesis Data Firehose to receive and write the stream directly to Amazon S3, and configure AWS Glue integration within the Firehose stream to handle the inline transformation to Apache Parquet.

Using Amazon Kinesis Data Firehose simplifies the ingestion pipeline by automatically writing stream data to Amazon S3. Its native integration with AWS Glue allows for serverless, zero-code format conversion from JSON to Apache Parquet before S3 storage, keeping operational overhead to a minimum.

Adım Adım Çözüm

Identify the service that can ingest real-time streaming data and deliver it directly to Amazon S3 with minimal administration.

Amazon Kinesis Data Firehose is selected as it is a fully managed, serverless delivery stream.

It removes the need to manage custom consumer applications or polling infrastructure.

Determine the transformation mechanism for converting JSON to Apache Parquet within the ingestion pipeline.

Configure Kinesis Data Firehose to use the AWS Glue Data Catalog schema to convert JSON to Parquet inline before writing to S3.

This provides a serverless, no-code transformation mechanism that aligns with the requirement of minimal operational overhead.

Anahtar Kavram

Serverless data ingestion and inline transformation using Kinesis Data Firehose and AWS Glue.

Soru 218Soru →

A retail company is designing a hybrid network architecture to replicate real-time transactional data from their on-premises database to AWS. The primary connection is an AWS Direct Connect connection. The replication throughput can reach up to $3\text{ Gbps}$ during peak hours. The company requires a secure, encrypted backup path over the internet that can handle the full peak replication throughput in the event of a Direct Connect outage. Which two actions should the solutions architect take to meet these performance and backup requirements?

Geçerli olan tümünü seçin

Create an AWS Transit Gateway and ensure Equal-Cost Multi-Path (ECMP) support is enabled.

Establish multiple AWS Site-to-Site VPN connections terminating on the AWS Transit Gateway, and configure dynamic Border Gateway Protocol (BGP) routing.

Establish a single AWS Site-to-Site VPN connection terminating on a Virtual Private Gateway (VGW) attached to the VPC.

Configure an Amazon Route 53 latency-based routing policy to automatically fail over database replication endpoints between the Direct Connect and the backup VPN connection.

Configure stateless Network Access Control Lists (NACLs) to automatically track and allow return traffic from the backup VPN connection without explicit rule definition.

Cevabı ve açıklamayı göster

Cevap: Create an AWS Transit Gateway and ensure Equal-Cost Multi-Path (ECMP) support is enabled.; Establish multiple AWS Site-to-Site VPN connections terminating on the AWS Transit Gateway, and configure dynamic Border Gateway Protocol (BGP) routing.

Cevap

Create an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) support enabled, and establish multiple AWS Site-to-Site VPN connections terminating on the Transit Gateway configured with dynamic Border Gateway Protocol (BGP) routing.

To achieve a secure backup over the internet that scales beyond the default limit of a single VPN tunnel (

1.25\text{ Gbps}

) to handle

3\text{ Gbps}

of traffic, a Transit Gateway with ECMP enabled must be used. Combining this with multiple Site-to-Site VPN connections using dynamic BGP routing allows traffic to load-balance across multiple tunnels, successfully scaling the total bandwidth.

Adım Adım Çözüm

Analyze the peak replication bandwidth requirements for the backup network connection.

Identify that the backup connection must support up to

3\text{ Gbps}

of throughput, which exceeds the

1.25\text{ Gbps}

capacity limit of a single AWS VPN tunnel.

Determining the performance constraint ensures that the architecture incorporates a multi-tunnel solution.

Select the appropriate routing and gateway architecture to scale the VPN throughput.

Choose AWS Transit Gateway with ECMP enabled to allow load balancing across multiple active VPN tunnels.

Transit Gateway supports ECMP, which allows traffic to be distributed across multiple paths, effectively scaling VPN throughput beyond the limit of a single tunnel.

Configure routing on the VPN connections.

Establish multiple VPN connections and configure dynamic Border Gateway Protocol (BGP) routing.

BGP is required for ECMP to advertise the same routes across multiple tunnels, enabling active-active load balancing.

Anahtar Kavram

Scaling VPN throughput using AWS Transit Gateway and Equal-Cost Multi-Path (ECMP) routing.

Soru 219Soru →

An engineering team is deploying a parallel financial simulation workload on a fleet of clustered Amazon EC2 instances in a single Availability Zone. The application requires a POSIX-compliant shared file system capable of delivering sub-millisecond latencies, at least $85,000$ random IOPS, and $2\text{ GB/s}$ of throughput. The file system must dynamically load initial input datasets from an Amazon S3 bucket at startup and automatically write output results back to the same S3 bucket. Which storage configuration meets these requirements with the lowest operational complexity?

An Amazon FSx for Lustre persistent file system integrated with the Amazon S3 bucket using a Data Repository Association (DRA).

An Amazon Elastic File System (Amazon EFS) file system configured in Max I/O performance mode with Elastic throughput enabled.

An Amazon EBS Multi-Attach cluster of io2 Block Express volumes formatted with an ext4 file system across the EC2 fleet.

An Amazon FSx for OpenZFS file system configured with multiple NFS user shares and AWS DataSync for continuous S3 replication.

Cevabı ve açıklamayı göster

Cevap: An Amazon FSx for Lustre persistent file system integrated with the Amazon S3 bucket using a Data Repository Association (DRA).

Cevap

An Amazon FSx for Lustre persistent file system integrated with the Amazon S3 bucket using a Data Repository Association (DRA).

The configuration utilizing Amazon FSx for Lustre with a Data Repository Association (DRA) is correct because FSx for Lustre is optimized for compute-heavy, parallel workloads. It provides the required sub-millisecond latencies, massive scale-out IOPS and throughput, and natively handles bidirectional data synchronization with Amazon S3 automatically, which minimizes operational complexity.

Adım Adım Çözüm

Evaluate the latency and throughput requirements of the workload (

85,000

IOPS,

2\text{ GB/s}

throughput, sub-millisecond latencies).

Identify that general-purpose shared storage like Amazon EFS does not meet the sub-millisecond latency profile for intensive random IOPS workloads.

This narrows down the choices to high-performance block storage (EBS io2) or dedicated parallel file systems (FSx for Lustre).

Assess the shared access and file system requirements (POSIX-compliant, shared across multiple instances).

Recognize that utilizing Amazon EBS Multi-Attach with standard file systems (such as ext4) is invalid because standard file systems lack the locking mechanism needed to prevent data corruption.

This rules out the EBS option unless a complex cluster-aware file system (like GFS2) is deployed and configured, which contradicts the lowest operational complexity constraint.

Examine the integration with Amazon S3 for dynamic data loading and writing back.

Determine that Amazon FSx for Lustre natively supports Data Repository Associations (DRA) to bi-directionally sync with S3, while FSx for OpenZFS or EBS would require manual scripts or AWS DataSync configurations.

FSx for Lustre satisfies all performance, shared access, and S3 integration requirements with the lowest operational overhead.

Anahtar Kavram

High-Performance Shared Storage with S3 Integration

Tahmini Süre:3m 0s

Soru 220Soru →

A company is deploying a media rendering application on a fleet of Amazon EC2 Linux instances. The instances must concurrently access a shared file system to read raw media files and write rendered outputs. The workload is highly unpredictable, with rapid spikes in throughput requirements.

Which storage solutions will meet these requirements while providing the necessary shared access? (Select TWO.)

Geçerli olan tümünü seçin

Amazon Elastic File System (Amazon EFS) configured with Elastic Throughput

Amazon FSx for Lustre

Amazon EBS gp3 volumes configured with Amazon EBS Multi-Attach

Amazon EBS io2 volumes formatted with an EXT4 file system and attached to multiple instances

Amazon S3 Glacier Flexible Retrieval with S3 Select

Cevabı ve açıklamayı göster

Cevap: Amazon Elastic File System (Amazon EFS) configured with Elastic Throughput; Amazon FSx for Lustre

Cevap

Amazon Elastic File System (Amazon EFS) configured with Elastic Throughput and Amazon FSx for Lustre

Amazon Elastic File System (Amazon EFS) with Elastic Throughput and Amazon FSx for Lustre both support concurrent POSIX-compliant read and write access across multiple Linux instances. Amazon EFS with Elastic Throughput dynamically scales throughput to handle unpredictable spikes. Amazon FSx for Lustre is specifically optimized for high-performance workloads like media rendering, providing sub-millisecond latencies and high throughput.

Adım Adım Çözüm

Identify the shared access and performance requirements of the workload.

The workload requires concurrent read/write access from multiple EC2 Linux instances with sub-millisecond latency and the ability to scale throughput for unpredictable spikes.

This establishes that the solution must be a shared file system rather than standard block storage, and it must support auto-scaling throughput.

Evaluate the AWS shared file storage options.

Amazon EFS and Amazon FSx for Lustre are native shared file systems that support concurrent access from Linux instances. EFS with Elastic Throughput handles unpredictable spikes, while FSx for Lustre is designed for high-performance workloads like media rendering.

This identifies the correct services that meet all specified requirements.

Analyze why EBS Multi-Attach and S3 Glacier options are incorrect.

EBS gp3 does not support Multi-Attach. EBS io2 with a standard EXT4 file system will lead to data corruption as it is not a clustered file system. S3 Glacier is for cold archiving and cannot provide the necessary performance or file interface.

This eliminates the incorrect storage configurations.

Anahtar Kavram

Identifying correct high-performance AWS shared file systems (Amazon EFS and Amazon FSx) over block storage (Amazon EBS) or archive storage (Amazon S3 Glacier) for concurrent Linux instance access.

ÖncekiSayfa 11 / 74Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram