Tüm alıştırma soruları

1462 soru

Tüm türler1,462 Çoktan seçmeli739 Çoklu seçim723

A global financial services enterprise uses AWS Organizations to manage its multi-account environment. The security team needs to implement governance controls with the following requirements:
- Security audit teams require read-only access across all member accounts without managing local IAM credentials.
- No member account administrator can disable CloudTrail or delete the S3 buckets containing audit logs.
- Developers in sandbox accounts must have administrative privileges but must be prevented from launching GPU-based instance types (such as `p*` or `g*`) or creating resources outside of approved regions (`us-east-1` and `us-west-2`).
- Day-to-day administration of the AWS Organization must be delegated to administrators using temporary credentials, preventing the use of the management account's root credentials for routine tasks.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS IAM Identity Center integrated with the enterprise identity provider (IdP). Create a read-only permission set and assign it to the security audit team's group across the organization. Create administrative permission sets for day-to-day organization management in the management account.

Attach a Service Control Policy (SCP) at the organization root that denies log deletion and CloudTrail modification API calls. Attach a separate SCP to the Sandbox Organizational Unit (OU) that denies the `ec2:RunInstances` action for non-approved regions and GPU instance types.

Create individual IAM users in each member account for the security auditors, generating access keys and secret keys. Set up an IAM policy on the management account root user that denies organization modifications to prevent routine root user access.

Create a Service Control Policy (SCP) and attach it directly to the management account to restrict its root user from performing routine administration. Implement a custom IAM policy in the management account to block GPU instances and replicate it to all member accounts.

Attach an SCP to the Sandbox OU that allows GPU instances only in approved regions. For the audit access, configure a cross-account IAM role in each member account that trusts individual IAM user credentials created specifically for the audit team in the management account.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center integrated with the enterprise identity provider (IdP). Create a read-only permission set and assign it to the security audit team's group across the organization. Create administrative permission sets for day-to-day organization management in the management account.; Attach a Service Control Policy (SCP) at the organization root that denies log deletion and CloudTrail modification API calls. Attach a separate SCP to the Sandbox Organizational Unit (OU) that denies the `ec2:RunInstances` action for non-approved regions and GPU instance types.

Cevap

The correct strategy combines configuring AWS IAM Identity Center integrated with the enterprise identity provider to govern administrative and audit access, along with deploying Service Control Policies (SCPs) at the organization root and organizational unit levels to enforce log protection and developer resource constraints.

The correct solution uses AWS IAM Identity Center to federate user access, allowing administrative and audit teams to log in using temporary credentials, which complies with the mandate to avoid root credentials. The application of SCPs at the organization root secures CloudTrail and S3 logs against member account admin modifications, and applying another SCP to the Sandbox OU isolates resource constraints to the developer environments.

Adım Adım Çözüm

Address the centralized access and root credential requirements by setting up AWS IAM Identity Center.

Federation is established with the enterprise identity provider, mapping the audit group to a read-only permission set and the admin group to administrative permission sets. This avoids local credentials and management account root user usage.

AWS IAM Identity Center provides centralized access management with temporary credentials, adhering to compliance and least-privilege mandates.

Address the log protection requirement by writing a Service Control Policy (SCP) that restricts S3 bucket deletion and CloudTrail modifications.

An SCP containing deny actions for S3 and CloudTrail is applied at the root of the AWS Organization.

SCPs apply to all member accounts in the organization, preventing even local administrators from disabling logs or deleting audit trails.

Address the sandbox constraints by writing an SCP that restricts regions and instance types.

An SCP is attached directly to the Sandbox Organizational Unit (OU), preventing developers from running unauthorized instance types or operating in unauthorized regions.

Applying the SCP at the OU level ensures sandbox constraints do not affect production workloads or core security operations.

Anahtar Kavram

Centralized multi-account governance using AWS Organizations SCPs for policy guardrails combined with AWS IAM Identity Center for federated identity control.

Tahmini Süre:3m 0s

Soru 302Soru →

A financial services startup is establishing its AWS cloud architecture. The organization needs to centralize authentication using its external Okta directory and restrict member accounts from modifying or deleting baseline security auditing configurations. Additionally, the security policy prohibits the use of long-term credentials for daily operations. Which two actions should be performed to establish this administrative governance model? (Select TWO.)

Geçerli olan tümünü seçin

Integrate AWS IAM Identity Center with the Okta directory to allow users to sign in and assume permission sets using temporary security credentials.

Deploy a Service Control Policy (SCP) at the root level of the organization to prevent member accounts from stopping or modifying CloudTrail logging configurations.

Create individual IAM users in each member account with long-term security credentials and configure local trust policies for Okta integration.

Configure the daily administrative tasks to be run directly by using the management account's root user credentials to ensure complete oversight.

Configure the API access keys for the external identity provider by storing them as plaintext String parameters in Systems Manager Parameter Store across all member accounts.

Cevabı ve açıklamayı göster

Cevap: Integrate AWS IAM Identity Center with the Okta directory to allow users to sign in and assume permission sets using temporary security credentials.; Deploy a Service Control Policy (SCP) at the root level of the organization to prevent member accounts from stopping or modifying CloudTrail logging configurations.

Cevap

Integrating AWS IAM Identity Center with Okta for temporary credential generation, and deploying an organization-level Service Control Policy to protect CloudTrail logging configurations.

Integrating AWS IAM Identity Center with the external directory allows federated users to obtain short-term credentials, eliminating static credential storage. Implementing a Service Control Policy at the organization root enforces compliance and protects logging systems from modifications by administrators in individual member accounts.

Adım Adım Çözüm

Centralize identity governance and single sign-on access.

Integrate Okta with AWS IAM Identity Center using SAML and SCIM protocols.

This allows users to authenticate using their existing enterprise credentials and obtain temporary security credentials for AWS access, satisfying the requirement to avoid long-term credentials.

Enforce organization-wide audit policies.

Create and attach a Service Control Policy (SCP) to the organization's root OU that denies the cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.

SCPs define permission guardrails across all member accounts, ensuring that local administrators in member accounts cannot modify the auditing configurations.

Anahtar Kavram

Centralized identity federation and multi-account security guardrails using Service Control Policies.

Soru 303Soru →

A Solutions Architect is designing the governance strategy for a company's multi-account environment managed by AWS Organizations. The company requires central control over user access using an external identity provider. Additionally, they must ensure that CloudTrail logging cannot be disabled in any member account. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure AWS IAM Identity Center to federate access with the company's external identity provider.

Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.

Create IAM users in each member account and share long-term credentials with users in the external directory.

Use the management account root credentials to configure daily security policies and perform user authorization.

Attach a Service Control Policy (SCP) to the management account to prevent its own administrator users from stopping CloudTrail logging.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate access with the company's external identity provider.; Create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.

Cevap

Configure AWS IAM Identity Center to federate access with the company's external identity provider, and create a Service Control Policy (SCP) that denies the cloudtrail:StopLogging action and attach it to the organization root.

Centralized access control is best achieved by integrating AWS IAM Identity Center with the external identity provider. Enforcing organization-wide security boundaries (such as preventing the disabling of CloudTrail) is done via Service Control Policies (SCPs) attached to the organization's root or organizational units (OUs), which restrict actions in all member accounts.

Adım Adım Çözüm

Set up centralized identity federation.

AWS IAM Identity Center is connected to the external identity provider, allowing users to log into member accounts without needing local credentials.

This simplifies governance and complies with single sign-on security standards.

Establish guardrails against disabling logging.

A Service Control Policy denying the cloudtrail:StopLogging action is created and attached to the root of the organization.

SCPs allow centralized restriction of actions across all member accounts in the organization, preventing users from altering vital security logging.

Anahtar Kavram

Centralized multi-account governance using AWS Organizations Service Control Policies (SCPs) and federated access with AWS IAM Identity Center.

Soru 304Soru →

A retail company hosts a web application on AWS. The solutions architect needs to configure a security solution that blocks malicious SQL injection payloads in incoming HTTP requests before they reach the backend application. Which AWS service should the solutions architect deploy to meet this requirement?

AWS WAF

AWS Shield Standard

Network Access Control Lists (NACLs)

Security Groups

Cevabı ve açıklamayı göster

Cevap: AWS WAF

Cevap

AWS WAF

AWS WAF (Web Application Firewall) operates at the application layer (Layer 7) and allows you to monitor HTTP and HTTPS requests that are forwarded to protected resources, such as an Application Load Balancer or Amazon CloudFront. It includes built-in managed rules to detect and block common exploits, including SQL injection payloads, before they reach backend servers.

Adım Adım Çözüm

Identify the target layer of the threat.

The threat is SQL injection, which occurs at the application layer (Layer 7) of the OSI model.

Security controls must be chosen based on the network layer they operate on.

Evaluate the capabilities of the proposed services.

Only AWS WAF operates at Layer 7 and is capable of inspecting HTTP/HTTPS payloads to block SQL injection patterns.

Layer 3/4 controls like Shield Standard, Network ACLs, and Security Groups do not have visibility into HTTP payload contents.

Anahtar Kavram

AWS WAF protects applications at the application layer (Layer 7) from web exploits like SQL injection, whereas AWS Shield Standard and VPC security controls operate at lower layers (Layer 3/4) to mitigate network-level attacks.

Tahmini Süre:45s

Soru 305Soru →

An enterprise uses AWS IAM Identity Center to federate identity provider users into their AWS development account. The junior solutions architects in this account need the ability to create and manage IAM roles for Amazon EC2 instances. However, the senior security team requires that these junior architects must not be able to elevate their own permissions or assign administrative permissions to the EC2 instances they configure. Which TWO actions should the solutions architect take to meet these requirements?

Geçerli olan tümünü seçin

Create a permissions boundary IAM policy that defines the maximum permissions that the junior architects can delegate to the EC2 roles.

Attach an IAM policy to the junior architects' federated role that permits role creation only when the request includes the permissions boundary condition referencing the boundary policy.

Create individual IAM users with long-term access keys for each junior architect to bypass identity federation and assign them direct administrative access.

Provide the junior architects with temporary access to the AWS account root user credentials to perform administrative role creation tasks.

Store the role permissions as a plaintext String in an AWS Systems Manager Parameter Store parameter, and configure the EC2 instances to retrieve and apply the permissions at startup.

Cevabı ve açıklamayı göster

Cevap: Create a permissions boundary IAM policy that defines the maximum permissions that the junior architects can delegate to the EC2 roles.; Attach an IAM policy to the junior architects' federated role that permits role creation only when the request includes the permissions boundary condition referencing the boundary policy.

Cevap

To secure delegated role creation, the solutions architect should create a permissions boundary policy to define the maximum delegated permissions and require the junior architects to apply this boundary policy whenever they create an IAM role.

Delegating the creation of IAM roles to non-administrator users without risk of privilege escalation is achieved using IAM Permissions Boundaries. First, a permissions boundary policy defines the upper limit of permissions. Second, the policy governing the creators (junior architects) is configured to require this permissions boundary when executing role creation commands. This prevents them from granting administrative rights or access they do not possess.

Adım Adım Çözüm

Define the boundaries of delegation.

A permissions boundary policy is created in IAM that outlines the maximum set of permissions a junior architect can assign.

This establishes a hard limit on what the newly created roles can do, regardless of the policies attached to them.

Enforce boundary usage on role creation.

An IAM policy is attached to the junior architects' role containing a condition that permits iam:CreateRole and iam:PutRolePolicy/iam:AttachRolePolicy only if the iam:PermissionsBoundary matches the boundary policy ARN.

This prevents junior architects from creating unmanaged or administrative roles that could bypass security limits.

Anahtar Kavram

Delegated Administration with IAM Permissions Boundaries

Soru 306Soru →

A media streaming company is organizing its cloud footprint using AWS Organizations. To enforce compliance, the security team must restrict specific activities within member accounts without affecting the management account. The environment consists of a Production OU and a Sandbox OU. The compliance rules are:

1. Production accounts must not be able to disable AWS Security Hub or modify resource-tagging policies.
2. Sandbox accounts must be prohibited from launching EC2 instances that are not of the 't3' or 'm5' instance families.

Which combination of actions should a Solutions Architect implement to meet these governance requirements? (Select TWO.)

Geçerli olan tümünü seçin

Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes.

Attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.

Attach the compliance SCPs directly to the Organization Root to ensure they inherit down to the management account and all member OUs.

Create individual IAM users in each member account for developers and administrators, and configure IAM inline policies to restrict these actions.

Configure the root credentials of the management account to run a daily scheduled script that terminates non-compliant EC2 instances and recreates deleted tag policies in all member accounts.

Cevabı ve açıklamayı göster

Cevap: Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes.; Attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.

Cevap

Attach a Service Control Policy (SCP) to the Production OU that denies Security Hub configuration modifications and tag-policy changes, and attach a Service Control Policy (SCP) to the Sandbox OU that denies the ec2:RunInstances action unless the ec2:InstanceType condition key matches t3.* or m5.*.

The correct strategy combines target-specific Service Control Policies (SCPs) attached directly to the respective Organizational Units (OUs). Attaching a policy to prevent disabling Security Hub and modifying tag policies directly to the Production OU ensures that compliance is enforced only for production resources. Similarly, attaching an SCP restricting instance types to the Sandbox OU ensures developers have freedom to experiment within cost-effective boundaries. In both cases, the policies do not affect the management account, which satisfies the requirement to exclude it from the restrictions.

Adım Adım Çözüm

Analyze the scope of the governance requirements for the Production OU and the Sandbox OU.

Identified that the Production OU requires restriction of Security Hub and tag policy modifications, while the Sandbox OU requires restricting EC2 instance types to t3 and m5 families. The management account must remain unaffected.

To design the correct AWS Organizations structure and policy placement without causing unintended policy inheritance across OUs.

Select the appropriate mechanism to enforce governance across member accounts centrally.

Determined that Service Control Policies (SCPs) are the native tool in AWS Organizations to restrict actions at the member account level, and they do not apply to the management account.

SCPs act as guardrails that define the maximum permissions for member accounts without affecting the management account's administrative access.

Formulate the SCPs and attach them to their target Organizational Units.

Created one SCP targeting Security Hub and tagging controls, attaching it to the Production OU. Created a second SCP targeting EC2 instance type restrictions using the ec2:InstanceType condition key, attaching it to the Sandbox OU.

Attaching the policies directly to the specific OUs applies the rules target-selectively, preventing policies from bleeding over to unintended OUs (e.g. preventing sandbox restrictions from affecting production).

Anahtar Kavram

AWS Organizations Service Control Policies (SCPs) and Organizational Unit (OU) policy inheritance.

Soru 307Soru →

A company is migrating its on-premises web application to AWS. The application will run on Amazon ECS containers. The solutions architect must design a security strategy to grant database administrators (DBAs) administrative access to the Amazon RDS DB instances using their existing corporate identity provider (IdP). Furthermore, the ECS application containers must securely access the database credentials, which must be rotated every 30 days without hardcoding them in the application or storing them in plaintext.

Which combination of actions should the solutions architect take to meet these security requirements?

Configure AWS IAM Identity Center to federate the corporate identity provider, granting DBAs federated access to manage RDS. Store the database credentials in AWS Secrets Manager, enable automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.

Create individual IAM users for each DBA in the AWS account, configure long-term credentials for AWS Management Console access, and manually synchronize their passwords with the corporate identity provider. Store the database credentials in AWS Secrets Manager with automatic 30-day rotation.

Configure AWS IAM Identity Center to federate the corporate identity provider for DBA access. Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to avoid KMS encryption overhead, and reference the parameter in the ECS task definition.

Instruct DBAs to use the AWS account root user credentials to perform administrative database tasks to ensure uninterrupted access. Store the database credentials in AWS Secrets Manager, and rely on AWS KMS automatic key rotation to automatically update the database password.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate the corporate identity provider, granting DBAs federated access to manage RDS. Store the database credentials in AWS Secrets Manager, enable automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.

Cevap

Configure AWS IAM Identity Center to federate the corporate identity provider for DBA access, store the database credentials in AWS Secrets Manager with automatic 30-day rotation, and grant the ECS task execution role permissions to retrieve the secret.

The correct solution integrates AWS IAM Identity Center with the existing corporate identity provider to handle DBA access securely without creating long-term IAM users. It also utilizes AWS Secrets Manager to encrypt, store, and automatically rotate database credentials every 30 days, while using the ECS task execution role to dynamically retrieve the secret at runtime.

Adım Adım Çözüm

Integrate the corporate identity provider with AWS IAM Identity Center.

Database administrators can log in to the AWS Management Console using their existing corporate credentials, eliminating the need to manage individual IAM users with long-term keys.

Aligns with the principle of least privilege and simplifies identity management via single sign-on.

Store the database credentials in AWS Secrets Manager.

The sensitive database password is encrypted at rest and stored securely.

Allows AWS Secrets Manager to manage the lifecycle of the credentials, preventing exposure in plaintext parameter store parameters or container images.

Configure AWS Secrets Manager to automatically rotate the secret every 30 days and update the Amazon RDS database.

Automatic rotation of the password is handled natively by AWS Secrets Manager via an integration with Amazon RDS.

Meets the security requirement for monthly credential rotation without manual intervention or custom script scheduling.

Grant retrieval permissions to the ECS task execution role and inject the secret into the container task definition.

The application container retrieves the credentials at startup without hardcoding the password in the image or exposing it in task environment variables.

Ensures secure, runtime access to the database credentials using IAM role-based authorization.

Anahtar Kavram

Centralized identity federation and secure, automated secrets management

Soru 308Soru →

An enterprise is designing a secure multi-account AWS environment using AWS Organizations to comply with regulatory standards. The architecture contains a management account and multiple member accounts grouped into OUs, including a Production OU and a Development OU.

The security team has specified the following requirements:
1. Centralize administrative access management by integrating with the enterprise's corporate Active Directory.
2. Prevent administrators in any member account from deleting or modifying a specific compliance auditing IAM role named SecurityAuditRole.
3. Restrict member accounts under the Development OU to only run Amazon EC2 and Amazon S3 workloads, while ensuring that the management account is never blocked from performing administrative recovery actions.

Which combination of actions will meet these requirements with the least operational overhead?

Create individual IAM users in the management account for all corporate directory users and configure cross-account roles in each member account. Apply local IAM policies in each member account that prevent administrators from deleting or modifying the SecurityAuditRole. Create an SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.

Enable AWS IAM Identity Center and configure Active Directory synchronization. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. In the SCP's condition block, explicitly exclude the root user of the management account from the deny statement, and use the management account's root user credentials for daily administrative tasks to bypass the SCP limits.

Enable AWS IAM Identity Center and configure Active Directory synchronization for user federation. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. Create a second SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.

Create individual IAM users in each member account and synchronize them with the corporate Active Directory using an identity agent. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. To bypass the SCP restrictions in the Development OU, instruct developers to log in using the member account root user credentials, which are exempt from SCP policies.

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center and configure Active Directory synchronization for user federation. Create an SCP that denies the deletion or modification of the SecurityAuditRole and attach it to the organization root. Create a second SCP that denies access to all services except Amazon EC2 and Amazon S3, and attach it to the Development OU.

Cevap

The correct answer uses AWS IAM Identity Center to federate user identity from the on-premises Active Directory, matching AWS best practices for centralized identity management. To protect the auditing IAM role across all member accounts, a Service Control Policy (SCP) is attached to the root of the organization. Because SCPs do not apply to the management account, the management account administrators can still manage the role if necessary for recovery. Restricting services via a separate SCP attached to the Development OU ensures only the workloads within that OU are constrained, satisfying the requirements with minimal operational overhead.

Adım Adım Çözüm

Identify the proper service for centralizing authentication with corporate identity providers in a multi-account setup.

AWS IAM Identity Center is selected over manual IAM user creation.

Reduces operational overhead and eliminates long-term credentials.

Determine the mechanism to protect the auditing IAM role across all member accounts.

An SCP denying modifications to the role is attached to the organization root.

SCPs apply to all member accounts but naturally do not restrict the management account, preserving recovery access.

Apply service restrictions specifically to the Development OU.

A separate SCP denying unauthorized services is attached directly to the Development OU.

Ensures developers are restricted to EC2 and S3 without affecting accounts in other OUs or the management account.

Anahtar Kavram

Centralized multi-account identity federation and Service Control Policy scoping rules

Soru 309Soru →

A Solutions Architect is designing a secure multi-account environment for a growing enterprise. The company's security policy requires centralized access management for employee identities, enforcement of compliance guardrails across all member accounts in the organization, and preventing individual account administrators from disabling logging or modifying centralized security resources. Which architectural strategy best meets these requirements?

Configure AWS IAM Identity Center for centralized single sign-on access, and use AWS Organizations to apply a Service Control Policy (SCP) at the organizational unit level that denies CloudTrail deletion and S3 log bucket modifications.

Create individual IAM users in each member account with long-term credentials synchronized to the corporate directory, and use IAM policies in each account to restrict access to log settings.

Use the management account root credentials to configure administrative access across member accounts, and attach an IAM policy to the root user to enforce logging compliance.

Configure federated access using individual IAM users in the management account, and store administrative access keys as plaintext in Systems Manager Parameter Store parameters for automated compliance checking.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center for centralized single sign-on access, and use AWS Organizations to apply a Service Control Policy (SCP) at the organizational unit level that denies CloudTrail deletion and S3 log bucket modifications.

Cevap

The correct strategy combines AWS IAM Identity Center for centralized, federated access (avoiding individual IAM users and long-term credentials) with AWS Organizations SCPs applied at the OU level to prevent member account administrators from disabling CloudTrail or altering S3 logging resources.

Adım Adım Çözüm

Implement centralized identity management.

Enable AWS IAM Identity Center, integrating it with the enterprise identity provider to allow centralized authentication and role assignment without provisioning long-term IAM user credentials.

This establishes federated access control in line with security best practices.

Enforce multi-account governance guardrails.

Use AWS Organizations to define a Service Control Policy (SCP) that explicitly denies actions like `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteBucket` on the centralized log repository.

SCPs act as organizational guardrails that apply to all principal identities in member accounts, including the root user of those accounts.

Apply the policy to the organization structure.

Attach the SCP to the relevant Organizational Units (OUs) containing the member accounts.

This ensures the guardrails are inherited by all accounts within the targeted OUs without manually configuring permissions in each individual account.

Anahtar Kavram

Centralized multi-account governance using Service Control Policies and federated identity integration via AWS IAM Identity Center.

Soru 310Soru →

A logistics company is designing a multi-account environment on AWS using AWS Organizations. The company has several business units, each requiring separate development and production environments. To comply with corporate security standards, the solutions architect must implement a solution that enforces federated identity management via the company's external identity provider. Additionally, the solution must guarantee that security auditing cannot be disabled by stopping or deleting AWS CloudTrail trails in any member account. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure AWS IAM Identity Center to federate with the external identity provider, and assign permission sets to centralized groups.

Implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the Organizational Units (OUs) containing the member accounts.

Provision individual IAM users with long-term security credentials in each member account to map to external directory accounts, and delegate administrative roles.

Use the management account root user credentials to deploy inline policies directly to all accounts to restrict CloudTrail modifications.

Establish federated access by creating matching IAM users in the management account and using cross-account roles to access member accounts.

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center to federate with the external identity provider, and assign permission sets to centralized groups.; Implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions, and attach it to the Organizational Units (OUs) containing the member accounts.

Cevap

Configure AWS IAM Identity Center to federate with the external identity provider, and implement a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail actions attached to the Organizational Units (OUs) containing the member accounts.

Centralizing identity access using AWS IAM Identity Center federated with an external identity provider allows administrative access without managing individual IAM users. Additionally, creating and applying a service control policy (SCP) that denies CloudTrail modification/deletion actions (cloudtrail:StopLogging and cloudtrail:DeleteTrail) at the Organizational Unit level prevents member account administrators from disabling auditing, satisfying the compliance requirements securely.

Adım Adım Çözüm

Set up centralized identity federation.

AWS IAM Identity Center is configured to synchronize and authenticate users against the external identity provider.

This removes the need to create static IAM users in individual member accounts and enables single sign-on using temporary security credentials.

Enforce auditing compliance across the Organization.

A service control policy (SCP) is drafted with explicit Deny rules for cloudtrail:StopLogging and cloudtrail:DeleteTrail.

SCPs allow the organization's administration to set guardrails that member account administrators cannot override.

Apply the guardrails to the appropriate scope.

The SCP is attached to the OUs containing the member accounts.

This ensures the guardrails are inherited by all existing and future accounts under those OUs without impacting the management account itself.

Anahtar Kavram

AWS multi-account governance using AWS Organizations, Service Control Policies (SCPs), and AWS IAM Identity Center.

Alternatif Yöntem

An alternative method is to use AWS Control Tower to set up the landing zone, which automatically configures AWS IAM Identity Center and applies default guardrails (implemented as SCPs) that prevent disabling CloudTrail across the managed accounts.

Tahmini Süre:2m 0s

Soru 311Soru →

A solutions architect is configuring baseline security controls for a new AWS account. The company wants to secure administrative access and protect resources in accordance with AWS Identity and Access Management (IAM) best practices. Which of the following security practices should the solutions architect implement? (Select TWO.)

Geçerli olan tümünü seçin

Enable Multi-Factor Authentication (MFA) for the AWS account root user and all administrative identities.

Apply the principle of least privilege by granting only the minimum permissions necessary to perform a task.

Use the AWS account root user access keys for daily administrative tasks to avoid authorization issues.

Create individual IAM users with long-term passwords for corporate directory users who need AWS Console access.

Store sensitive database credentials as plaintext parameters in Systems Manager Parameter Store to simplify configuration.

Cevabı ve açıklamayı göster

Cevap: Enable Multi-Factor Authentication (MFA) for the AWS account root user and all administrative identities.; Apply the principle of least privilege by granting only the minimum permissions necessary to perform a task.

Cevap

Enable Multi-Factor Authentication (MFA) for the AWS account root user and all administrative identities, and apply the principle of least privilege by granting only the minimum permissions necessary to perform a task.

The correct practices are to enable Multi-Factor Authentication (MFA) on the root user and administrative accounts to prevent unauthorized access, and to apply the principle of least privilege so that users only have the permissions necessary to do their job.

Adım Adım Çözüm

Analyze administrative account security.

Identify that the root user and other administrative accounts represent high-privilege entry points requiring MFA.

MFA adds an extra layer of protection beyond a standard password, which is essential for administrative credentials.

Analyze standard credential management guidelines.

Confirm that permission policies should follow the least privilege model, while avoiding root credentials and individual IAM users for federated employees.

Applying least privilege limits security exposure, while using identity federation avoids creating unnecessary long-term IAM credentials.

Anahtar Kavram

AWS Identity and Access Management (IAM) Best Practices

Soru 312Soru →

A logistics firm hosts its web portal on AWS. The firm requires advanced DDoS protection, direct access to the AWS Shield Response Team (SRT) during an active event, and financial protection to mitigate scaling costs associated with a DDoS attack. Which AWS service should the solutions architect recommend to meet these requirements?

AWS Shield Advanced

AWS Shield Standard

AWS WAF

Amazon VPC Security Groups

Cevabı ve açıklamayı göster

Cevap: AWS Shield Advanced

Cevap

AWS Shield Advanced

The correct answer is AWS Shield Advanced. This subscription-based service provides enhanced DDoS protection for resource types such as Elastic IP, CloudFront, Route 53, and Elastic Load Balancing. It features 24/7 access to the AWS Shield Response Team (SRT) and provides cost protection to mitigate billing spikes resulting from DDoS attacks.

Adım Adım Çözüm

Analyze the requirements: advanced DDoS protection, specialized team support (SRT), and billing protection for scaling costs.

Identify that the requirements point to a paid tier of AWS DDoS protection.

Standard services or firewalls do not include human support or financial guarantees.

Compare Shield tiers and related security services.

Confirm Shield Advanced covers all three criteria.

AWS Shield Advanced is specifically designed to provide cost protection and SRT support.

Anahtar Kavram

AWS Shield Advanced Features

Soru 313Soru →

A global e-learning platform delivers video-on-demand content and user profile APIs using Amazon CloudFront, an Application Load Balancer (ALB), and Amazon EC2 instances. Recently, the platform experienced a distributed denial of service (DDoS) attack targeting the application layer (Layer 7) with a flood of HTTP POST requests, which overwhelmed the backend EC2 instances. A solutions architect must design a secure architecture to mitigate future Layer 7 DDoS attacks and prevent unauthorized traffic from bypassing CloudFront to access the ALB directly.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule.

Configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Enable AWS Shield Standard on the Application Load Balancer and configure a rate-limiting rule.

Configure stateless Network ACLs on the public subnets to block all traffic except for the specific IP addresses of the application users.

Associate an AWS WAF Web ACL directly with the Amazon EC2 instances and configure an HTTP header validation rule.

Cevabı ve açıklamayı göster

Cevap: Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule.; Configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Cevap

Associate AWS WAF with the Amazon CloudFront distribution and configure a rate-based rule, and configure the Application Load Balancer security group to allow inbound traffic only from the Amazon CloudFront IP ranges using the AWS-managed prefix list.

To mitigate Layer 7 HTTP floods, AWS WAF rate-based rules must be deployed on the CloudFront distribution. To prevent users from bypassing CloudFront and accessing the Application Load Balancer directly, the ALB's security group must restrict inbound traffic using the AWS-managed prefix list for CloudFront.

Adım Adım Çözüm

Address the Layer 7 DDoS requirement.

Identify that AWS WAF associated with Amazon CloudFront supports rate-based rules to limit incoming HTTP flood requests at the edge.

AWS WAF inspects HTTP/HTTPS traffic and can dynamically rate-limit traffic exceeding thresholds to prevent origin exhaustion.

Address the bypass prevention requirement.

Configure the ALB's security group to only permit inbound traffic originating from CloudFront's edge servers.

Using the AWS-managed prefix list for CloudFront ensures that only traffic coming from CloudFront's IP space is allowed into the ALB, preventing direct internet access.

Anahtar Kavram

Securing web applications at the edge using Amazon CloudFront IP range security groups and AWS WAF rate-limiting.

Tahmini Süre:2m 0s

Soru 314Soru →

A company hosts its core transactional platform on Amazon EC2 instances behind an Application Load Balancer (ALB) in us-east-1 as the primary region. The company maintains a fully functional but scaled-down warm standby environment behind an ALB in us-west-2 as the secondary region. The database layer is replicated across both regions. A solutions architect must design a DNS routing strategy using Amazon Route 53 to automatically redirect user traffic from the primary region to the secondary region if the primary region's ALB or backend instances fail. Which configuration should the solutions architect implement to meet these requirements?

Create Route 53 Failover Alias records for the application's domain. Point the primary record to the us-east-1 ALB and the secondary record to the us-west-2 ALB, with 'Evaluate Target Health' set to Yes for both records.

Create Route 53 Latency routing records pointing to the primary and secondary ALBs, relying on Route 53 to naturally steer traffic to the secondary region when the primary region's latency increases during an outage.

Create Route 53 Failover records where the primary record points to the us-east-1 ALB, and the secondary record points directly to the Amazon RDS Read Replica endpoint in us-west-2 to automatically promote it and accept write traffic.

Create Route 53 Failover records where the secondary record points to a shut-down pilot light EC2 environment, relying on the Route 53 health check failure to automatically start the EC2 instances in us-west-2 without administrative intervention.

Cevabı ve açıklamayı göster

Cevap: Create Route 53 Failover Alias records for the application's domain. Point the primary record to the us-east-1 ALB and the secondary record to the us-west-2 ALB, with 'Evaluate Target Health' set to Yes for both records.

Cevap

The correct configuration is to create Route 53 Failover Alias records pointing to the primary and secondary Application Load Balancers (ALBs) and to enable 'Evaluate Target Health'. Route 53 Failover routing is designed specifically for active-passive disaster recovery setups. By using Alias records and enabling 'Evaluate Target Health', Route 53 utilizes the health check configuration of the ALBs. If the primary ALB or all backend EC2 instances registered to it fail their health checks, Route 53 automatically detects this and redirects traffic to the secondary ALB in the warm standby region.

Adım Adım Çözüm

Select Route 53 Failover routing policy for the domain's record set.

Defines an active-passive configuration where traffic is directed to the primary resource by default and to the secondary resource when the primary is unhealthy.

This matches the requirement to redirect traffic to the warm standby in us-west-2 only if the primary us-east-1 environment becomes unavailable.

Configure the primary Failover record as an Alias record pointing to the primary ALB, and the secondary Failover record as an Alias record pointing to the secondary ALB.

Allows Route 53 to map the domain name directly to the AWS ALB DNS names without incurring CNAME lookup costs or delays.

Alias records are the recommended way to integrate Route 53 with AWS load balancers.

Enable 'Evaluate Target Health' on both the primary and secondary Alias records.

Route 53 actively monitors the health of the underlying ALB target groups using the load balancer's configured health checks.

If target health evaluation is disabled, Route 53 will continue to route traffic to the primary ALB even if all backend instances behind it are unhealthy.

Anahtar Kavram

Route 53 Routing Policies and DNS Failover Strategies

Soru 315Soru →

A financial technology startup has multiple AWS accounts managed under an AWS Organizations organization. The startup needs to implement a centralized logging and threat detection strategy. The security team must be alerted within minutes of any unauthorized IAM privilege escalation attempts or modifications to critical network infrastructure across all accounts. Additionally, they must ensure that all API activity log files are protected against modification or deletion, even by administrative users. Which combination of steps should the solutions architect recommend to meet these security monitoring and threat detection requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable an AWS CloudTrail organization trail in the management account, configure it to deliver log files to a centralized Amazon S3 bucket in a dedicated security account, and enable CloudTrail log file integrity validation.

Designate a security account as the Amazon GuardDuty delegated administrator, enable GuardDuty across all organization member accounts, and configure Amazon EventBridge to route GuardDuty findings to the security team.

Deploy AWS Shield Advanced across all accounts to monitor AWS CloudTrail logs for threat patterns and automatically block unauthorized IAM API calls.

Configure stateful Network ACLs at the subnet level to block any administrative users from performing API actions that modify S3 buckets containing CloudTrail logs.

Deploy AWS WAF at the VPC level for all EC2 instances to monitor AWS CloudTrail API calls for privilege escalation and block traffic from administrative users.

Cevabı ve açıklamayı göster

Cevap: Enable an AWS CloudTrail organization trail in the management account, configure it to deliver log files to a centralized Amazon S3 bucket in a dedicated security account, and enable CloudTrail log file integrity validation.; Designate a security account as the Amazon GuardDuty delegated administrator, enable GuardDuty across all organization member accounts, and configure Amazon EventBridge to route GuardDuty findings to the security team.

Cevap

The correct options are: enabling an AWS CloudTrail organization trail with log file integrity validation delivered to a centralized S3 bucket, and designating a delegated administrator for Amazon GuardDuty to monitor the logs and route findings via Amazon EventBridge.

Centralizing CloudTrail logs in a dedicated security account under an Organization trail provides a tamper-resistant architecture. Enabling CloudTrail log file integrity validation allows the detection of unauthorized modifications. Amazon GuardDuty analyses CloudTrail logs across accounts to identify privilege escalation and other security threats, and EventBridge provides the routing mechanism for alerts.

Adım Adım Çözüm

Address log security and auditing requirements.

Create a centralized AWS CloudTrail trail across the entire organization that deposits logs into a secure Amazon S3 bucket within a designated security account. Enable log file integrity validation to detect unauthorized modifications.

This establishes a tamper-evident audit trail of all API activity across the organization, satisfying the requirement to protect logs from deletion or modification by administrative users.

Address real-time threat detection and alerting requirements.

Enable Amazon GuardDuty in all accounts by delegating administration to the security account, and set up an Amazon EventBridge rule to route GuardDuty findings to the security team.

GuardDuty natively analyzes CloudTrail logs to detect anomalous IAM activity and potential privilege escalation. EventBridge allows automated routing of these findings for rapid alerting.

Anahtar Kavram

Centralized security monitoring, log integrity, and multi-account threat detection in AWS Organizations using CloudTrail and GuardDuty.

Soru 316Soru →

A company is designing a serverless architecture to process data files uploaded to Amazon S3. The processing of each file is CPU-intensive and takes between 20 to 25 minutes to complete. The metadata and processing results must be saved to a database. The file uploads occur in highly unpredictable bursts throughout the day, with long periods of complete inactivity. The company wants to minimize costs and avoid paying for idle compute resources. Which two options should the solutions architect recommend to meet these requirements in a cost-optimized manner? (Select two.)

Geçerli olan tümünü seçin

Run the processing application as containerized tasks using Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.

Use Amazon DynamoDB with On-Demand capacity mode to store the metadata and results.

Use AWS Lambda functions to execute the file processing logic directly.

Configure the database table in Amazon DynamoDB with a high Provisioned Capacity mode to handle peak processing bursts.

Cevabı ve açıklamayı göster

Cevap: Run the processing application as containerized tasks using Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.; Use Amazon DynamoDB with On-Demand capacity mode to store the metadata and results.

Cevap

Deploy the processing application as containerized tasks on Amazon Elastic Container Service (Amazon ECS) running on AWS Fargate, and store the metadata and results in Amazon DynamoDB configured with On-Demand capacity mode.

The correct architecture uses Amazon ECS on AWS Fargate for computing because Fargate tasks can run for up to 24 hours, easily accommodating the 20 to 25-minute execution duration while remaining serverless and charging only for active runtime. For storage, using Amazon DynamoDB with On-Demand capacity mode ensures that database costs automatically scale to zero during idle periods and immediately scale up to meet processing spikes without manual intervention or over-provisioning.

Adım Adım Çözüm

Analyze the compute requirements, specifically the job execution duration.

The processing jobs run for 20 to 25 minutes, which exceeds the AWS Lambda maximum execution timeout of 15 minutes.

This rules out AWS Lambda for hosting the file processing logic directly, pointing to Amazon ECS on AWS Fargate as the serverless container compute choice.

Analyze the database capacity needs and traffic patterns.

The workload is highly unpredictable with spikes and long periods of complete inactivity.

This rules out Provisioned Capacity mode for Amazon DynamoDB due to high idle costs, and dictates using On-Demand capacity mode to align cost directly with actual usage.

Anahtar Kavram

Selecting cost-optimized serverless compute and database capacity modes based on workload duration and traffic patterns.

Soru 317Soru →

A company hosts a web application on Amazon EC2 instances within an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The solutions architect notices that when the application on an EC2 instance crashes and returns HTTP 5xx errors, the ALB marks the instance as unhealthy, but the ASG does not terminate or replace the instance. What configuration change should the solutions architect make to ensure that the ASG automatically replaces instances that fail the application-level health checks?

Change the target group health check port settings to query port 80, while the application server remains bound to port 8080.

Configure a stateful rule in the subnet's Network Access Control List (NACL) to track and automatically allow return traffic for the health check requests.

Configure the Auto Scaling group to use ELB health checks instead of EC2 health checks.

Replace the Application Load Balancer with an Amazon Route 53 latency routing policy configured with health checks to route user traffic directly to the EC2 instances.

Cevabı ve açıklamayı göster

Cevap: Configure the Auto Scaling group to use ELB health checks instead of EC2 health checks.

Cevap

Configure the Auto Scaling group to use ELB health checks instead of EC2 health checks.

The correct action is to configure the Auto Scaling group (ASG) to use Elastic Load Balancing (ELB) health checks. By default, an ASG only monitors EC2 status checks (system and instance status). When the ELB health check type is enabled, the ASG monitors the health status of the instances in the target group. If the Application Load Balancer (ALB) marks an instance as unhealthy (e.g., due to failing application-level HTTP health checks), the ASG will automatically terminate and replace that instance, maintaining application availability.

Adım Adım Çözüm

Analyze why the Auto Scaling group is not replacing the instances.

By default, the Auto Scaling group uses EC2 status checks (hardware and hypervisor checks), which show the instances as healthy even if the application running on them has crashed.

To fix this, the ASG must be configured to check the application health rather than just the instance status.

Select the appropriate health check mechanism.

The Application Load Balancer already performs application-level health checks and marks instances as unhealthy when they return 5xx errors.

By changing the ASG's health check type to ELB, the ASG will query the target group's health status and replace instances that fail ELB health checks.

Anahtar Kavram

Auto Scaling Group Health Check Configuration

Soru 318Soru →

A company is deploying a distributed telemetry processing system on a fleet of Amazon EC2 instances. The system requires sub-millisecond node-to-node network latency to synchronize internal state variables. The instances receive external ingest traffic from an Application Load Balancer (ALB) on TCP port 8090. Which two configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Deploy the EC2 instances in a spread placement group to distribute the instances across distinct underlying hardware.

Launch the EC2 instances in a cluster placement group within a single Availability Zone.

Configure the ALB target group health check to use the traffic port or explicitly specify port 8090.

Deploy the EC2 instances in a partition placement group with a partition count of seven.

Configure the target group to perform health checks on the default HTTP port 80 to offload health check traffic from the application.

Cevabı ve açıklamayı göster

Cevap: Launch the EC2 instances in a cluster placement group within a single Availability Zone.; Configure the ALB target group health check to use the traffic port or explicitly specify port 8090.

Cevap

To meet the requirements, the solutions architect should launch the EC2 instances in a cluster placement group within a single Availability Zone and configure the Application Load Balancer target group health check to use the traffic port or explicitly specify port 8090.

To achieve the required sub-millisecond node-to-node latency, the instances must be launched in a cluster placement group within a single Availability Zone. Additionally, because the application listens on custom port 8090, the target group health check port must be configured to check the traffic port or port 8090 directly to avoid false negatives where healthy instances are marked as unhealthy.

Adım Adım Çözüm

Analyze the node-to-node communication latency requirement.

Identify that sub-millisecond latency is required for state synchronization, pointing to a cluster placement group.

Cluster placement groups position instances physically close to each other in a single Availability Zone to maximize network performance and minimize latency.

Evaluate and eliminate incorrect placement group strategies.

Rule out spread and partition placement groups.

Spread and partition placement groups are designed to reduce correlated hardware failures by separating instances, which inherently increases latency between instances.

Analyze the load balancer health check port requirements.

Identify that the application is running on custom port 8090, which requires matching target group health checks.

If the health check port is left at default values (like port 80), the load balancer will try to reach a service that is not listening, resulting in failed health checks and healthy nodes being marked as unhealthy.

Anahtar Kavram

Selecting cluster placement groups for low-latency node-to-node communication and aligning load balancer health check ports with custom application ports.

Tahmini Süre:2m 0s

Soru 319Soru →

A financial services company hosts a critical transaction application on Amazon EC2 instances within a private subnet. The security team must implement a solution to monitor all inbound and outbound network traffic at the subnet level to detect network anomalies, such as active port scanning and unauthorized SSH connection attempts, without impacting application performance. Which solution meets these requirements?

Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.

Configure stateful Network ACLs at the subnet level to log all rejected traffic, and use AWS Shield Standard to analyze the logs for network anomalies.

Deploy AWS WAF at the subnet level to inspect all inbound TCP packets, and configure a custom rule to detect and block port scanning.

Configure Security Groups to statelessly log traffic at the subnet level, and use Amazon CloudWatch Logs to trigger alerts for unauthorized SSH attempts.

Cevabı ve açıklamayı göster

Cevap: Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.

Cevap

Enable VPC Flow Logs on the subnet to capture traffic data, and enable Amazon GuardDuty to analyze the flow logs and generate security findings.

The correct solution involves enabling VPC Flow Logs and Amazon GuardDuty. VPC Flow Logs capture network traffic data at the subnet level without introducing any performance overhead on the EC2 instances. Amazon GuardDuty automatically processes these flow logs out-of-band to identify malicious activity, such as port scanning or unauthorized SSH brute-force attempts.

Adım Adım Çözüm

Enable VPC Flow Logs for the target subnet.

Network traffic metadata (source, destination, protocol, port, action) is captured out-of-band and published to Amazon CloudWatch Logs or Amazon S3.

This establishes subnet-level traffic visibility without installing agent software or introducing CPU/memory latency on the EC2 instances.

Enable Amazon GuardDuty in the AWS account.

GuardDuty automatically reads VPC Flow Logs, Route 53 resolver query logs, and CloudTrail events at the platform level.

This offloads threat detection analysis to a managed service that uses threat intelligence feeds to identify signatures like port scanning.

Process GuardDuty findings.

Alerts and findings are generated inside the GuardDuty console and can be sent to Amazon EventBridge for automated notification or remediation.

This ensures the security team receives immediate notification of anomalous activity.

Anahtar Kavram

Out-of-band network threat detection using VPC Flow Logs and Amazon GuardDuty

Tahmini Süre:2m 0s

Soru 320Soru →

A logistics company runs a fleet tracking application on AWS. The application database is hosted on Amazon RDS for PostgreSQL in a Multi-AZ deployment within the primary Region. The company requires a disaster recovery (DR) strategy in a secondary Region with a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of 15 minutes, while minimizing ongoing costs. Which architecture will meet these requirements at the lowest cost?

Configure a cross-region Amazon RDS read replica and a duplicate application tier in the secondary Region. Implement Amazon Route 53 Latency routing without health checks to automatically redirect traffic to the secondary Region when the primary Region experiences an outage.

Configure a Pilot Light environment with application servers running at a minimal scale in the secondary Region. Rely on the Pilot Light servers to handle the immediate full production traffic load with zero startup or scaling latency during a failover event.

Configure a cross-region Amazon RDS read replica in the secondary Region. Deploy a Pilot Light environment for the application tier in the secondary Region with Auto Scaling group capacity set to zero. Upon failover, promote the read replica to a standalone DB instance, scale up the Auto Scaling groups, and update Route 53 failover records.

Configure a cross-region Amazon RDS read replica in the secondary Region. If a disaster occurs, redirect all application write traffic directly to the read replica without promoting it, assuming the database will automatically promote itself to a primary instance upon receiving write requests.

Cevabı ve açıklamayı göster

Cevap: Configure a cross-region Amazon RDS read replica in the secondary Region. Deploy a Pilot Light environment for the application tier in the secondary Region with Auto Scaling group capacity set to zero. Upon failover, promote the read replica to a standalone DB instance, scale up the Auto Scaling groups, and update Route 53 failover records.

Cevap

Configure a cross-region Amazon RDS read replica in the secondary Region, deploy a Pilot Light environment for the application tier with Auto Scaling group capacity set to zero, and promote the replica and scale the instances during failover.

The configuration utilizing a cross-region RDS read replica satisfies the 15-minute RPO requirement because data is continuously replicated asynchronously. Using a Pilot Light strategy with Auto Scaling groups set to zero instances minimizes running compute costs during normal operations while allowing the servers to boot and scale within the 30-minute RTO during a disaster scenario.

Adım Adım Çözüm

Set up a cross-region Amazon RDS read replica in the secondary Region.

Asynchronous replication is established, achieving an RPO of under 15 minutes.

Ensures that database changes in the primary Region are continually replicated to the recovery Region.

Deploy a Pilot Light environment for the application servers in the secondary Region, configuring the Auto Scaling groups with a desired capacity of zero.

Compute costs are minimized since no instances run during normal operations, but launch configurations/templates are prepared.

Allows quick provisioning of the compute layer within the 30-minute RTO window when a disaster is declared.

Configure a Route 53 routing policy with health checks to manage failover.

Traffic can be redirected to the secondary Region after promotion and scaling are complete.

Ensures client traffic is pointed to the promoted infrastructure in the disaster recovery Region.

Anahtar Kavram

Disaster recovery strategies involving Pilot Light environments and RDS cross-region replication to balance RTO, RPO, and cost.

ÖncekiSayfa 16 / 74Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Alternatif Yöntem

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm