Examkin

Tüm alıştırma soruları

1462 soru

Tüm türler1,462Çoktan seçmeli739Çoklu seçim723
Soru 61Soru →

A financial services company is setting up a development AWS account. The company wants to allow the development team leads to create and manage IAM roles for their applications' Amazon EC2 instances. However, the security team must ensure that the team leads cannot create roles that grant access to sensitive S3 buckets, even though the team leads themselves have administrative permissions in the account. Which solution meets these security requirements with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Configure an IAM permissions boundary that defines the maximum allowed permissions, excluding access to the sensitive S3 buckets. Attach an IAM policy to the team leads that allows role creation only if this permissions boundary is applied to the new role.

Cevap

Configure an IAM permissions boundary that defines the maximum allowed permissions, excluding access to the sensitive S3 buckets. Attach an IAM policy to the team leads that allows role creation only if this permissions boundary is applied to the new role.
The correct solution is to use an IAM permissions boundary. A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity (user or role). When a permissions boundary is set on a role, the role can only perform actions that are allowed by both its identity-based policy and its permissions boundary. By requiring the team leads to specify this boundary when creating new roles (using the 'iam:PermissionsBoundary' condition key in their own IAM policy), the security team can safely delegate role creation without risking privilege escalation.

Adım Adım Çözüm

1
Define the maximum allowable permissions for any application role by creating an IAM permissions boundary policy that denies access to the sensitive S3 buckets.
An IAM policy is created representing the boundary, which sets the maximum ceiling of permissions for roles created under it.
This establishes the hard security limit that delegated administrators cannot exceed.
2
Create an IAM policy for the team leads that allows the 'iam:CreateRole' and 'iam:PutRolePolicy' actions.
The team leads gain the permissions to create roles and attach policies locally within the development account.
This enables delegation of administrative tasks to the team leads.
3
Add a condition to the team leads' IAM policy that requires the 'iam:PermissionsBoundary' key to match the ARN of the permissions boundary policy created in step 1.
The team leads can only create roles if they specify the approved permissions boundary during creation.
This prevents privilege escalation by ensuring that any role they create is constrained by the security baseline.

Anahtar Kavram

IAM Permissions Boundary
Soru 62Soru →

An enterprise has a legacy payroll application running on physical servers in an on-premises data center. The application must securely upload daily transaction logs to an Amazon S3 bucket. The company's security policy strictly prohibits the storage of long-term AWS credentials on physical on-premises servers. The company already maintains an internal Public Key Infrastructure (PKI) and a private Certificate Authority (CA). Which solution meets these security requirements with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Roles Anywhere by defining a trust anchor linked to the internal Certificate Authority. Configure the application to exchange its X.509 digital certificate for temporary AWS credentials using an IAM role.

Cevap

Configure AWS IAM Roles Anywhere by defining a trust anchor linked to the internal Certificate Authority, and configure the application to exchange its X.509 digital certificate for temporary AWS credentials.
The correct solution involves configuring AWS IAM Roles Anywhere. Since the company already maintains a private Certificate Authority (CA), they can establish a trust anchor in IAM Roles Anywhere. The on-premises application can then use its X.509 digital certificate to authenticate and request short-lived, temporary AWS credentials from the AWS Security Token Service (STS) using an IAM role. This eliminates the need to store long-term AWS credentials on-premises, satisfying the security policy.

Adım Adım Çözüm

1
Analyze the requirements for accessing the Amazon S3 bucket from an on-premises environment.
Identify that the application needs to upload logs to Amazon S3, but storing long-term credentials (like IAM access keys) on-premises is strictly prohibited.
This rules out solutions that rely on creating static IAM users and distributing access keys to physical servers.
2
Evaluate the available identity federation and credential management options.
Since the company has an established PKI with an internal Certificate Authority (CA), they can leverage AWS IAM Roles Anywhere.
AWS IAM Roles Anywhere uses X.509 digital certificates to establish trust between the on-premises environment and AWS, enabling workloads to obtain temporary credentials.
3
Select the option that conforms to security best practices and has the least administrative overhead.
Establishing a trust anchor with the CA and mapping certificates to an IAM role is the standard, secure pattern that avoids long-term credentials.
This satisfies the security policy without requiring complex custom identity brokering or storing keys in plain text.

Anahtar Kavram

AWS IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers, to use digital certificates to exchange for temporary AWS credentials, avoiding the risk of long-term credentials.
Tahmini Süre:1m 30s
Soru 63Soru →

An airline is designing an application to process loyalty rewards points accrual events. For each passenger, events must be processed in the exact chronological sequence they are generated to ensure loyalty tiers are calculated accurately. If an event fails to process after five attempts, it must be isolated for investigation without blocking the processing of events for other passengers.

Which solution meets these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon SQS FIFO queue with a dead-letter queue. Set the passenger ID as the message group ID to ensure in-order processing per passenger.

Cevap

Configure an Amazon SQS FIFO queue with a dead-letter queue. Set the passenger ID as the message group ID to ensure in-order processing per passenger.
The correct solution uses an Amazon SQS FIFO queue. SQS FIFO queues guarantee that messages within the same message group (using the passenger ID as the MessageGroupId) are processed in the exact order they are received. An associated dead-letter queue (DLQ) isolates messages that fail to process after five attempts, allowing other message groups (other passengers) to continue processing without interruption.

Adım Adım Çözüm

1
Evaluate the ordering requirement.
Identified that events must be processed in the exact sequence they are generated on a per-passenger basis.
This requires a messaging mechanism that guarantees ordering based on a unique identifier (passenger ID) rather than requiring global ordering across all passengers.
2
Evaluate the failure isolation requirement.
Identified that failed events must be isolated after 5 retries without blocking other messages.
This indicates the need for a dead-letter queue (DLQ) with a maxReceiveCount of 5 configured on the source queue.
3
Compare SQS FIFO, SQS Standard, SNS standard, and Kinesis Data Streams capabilities.
SQS FIFO with a DLQ and a MessageGroupId of passenger ID satisfies all constraints with minimal configuration.
SQS Standard does not guarantee order, SNS Standard loses ordering before reaching the queues, and Kinesis with a single shard introduces scale limits and higher operational overhead.

Anahtar Kavram

Decoupling message processing using Amazon SQS FIFO queues to guarantee ordered processing within groups (using MessageGroupId) and utilizing dead-letter queues to handle processing failures without blocking other groups.
Soru 64Soru →

A financial services firm is deploying a containerized risk analysis platform on Amazon Elastic Kubernetes Service (Amazon EKS) across two Availability Zones. The platform's pods require concurrent, shared read and write access to a persistent storage volume that supports standard POSIX file systems, permissions, and locking. The storage must handle up to 15,000 IOPS15,000\text{ IOPS} during peak processing times, and must scale throughput and capacity automatically without manual provisioning or downtime.

Which of the following configurations should a solutions architect recommend? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon EFS file system configured with Elastic throughput mode and mount it using the Amazon EFS CSI driver.; Deploy an Amazon FSx for NetApp ONTAP Multi-AZ file system and mount the volumes using the NFS protocol.

Cevap

The correct configurations are to use an Amazon EFS file system configured with Elastic throughput mode mounted via the Amazon EFS CSI driver, and to deploy an Amazon FSx for NetApp ONTAP Multi-AZ file system mounted via NFS.
The correct configurations are the option to use Amazon EFS with Elastic throughput mode and the option to use Amazon FSx for NetApp ONTAP Multi-AZ file system. Amazon EFS is built to scale automatically and supports concurrent access from multiple pods across different Availability Zones with full POSIX compatibility. Amazon FSx for NetApp ONTAP Multi-AZ provides a fully managed shared file system that supports POSIX compliance, NFS access, and scales performance and capacity seamlessly to meet the 15,000 IOPS15,000\text{ IOPS} demand.

Adım Adım Çözüm

1
Analyze the workload requirements: multi-AZ containerized platform (EKS), concurrent read/write access (shared storage), POSIX compliance (file system, permissions, locking), high IOPS, and automated scaling.
Identified that standard single-instance block storage (EBS gp3/io2 without multi-AZ support) and object storage (S3) are unsuitable.
This narrows down the selection to shared file storage solutions that natively support POSIX and multi-AZ deployments.
2
Evaluate Amazon EFS with Elastic throughput mode.
Amazon EFS satisfies the POSIX file system and concurrent access requirements across multiple Availability Zones, and Elastic throughput mode ensures automatic performance scaling.
Elastic throughput mode matches the requirement of scaling throughput automatically without manual provisioning.
3
Evaluate Amazon FSx for NetApp ONTAP Multi-AZ deployment.
FSx for NetApp ONTAP is fully POSIX-compliant, supports NFS, can be deployed across multiple Availability Zones, and offers high-performance throughput scaling.
It matches the high performance, multi-AZ access, and POSIX compliance requirements.

Anahtar Kavram

Selecting and configuring shared, POSIX-compliant, high-performing storage solutions (such as Amazon EFS and Amazon FSx) that support concurrent access across multiple Availability Zones and scale automatically.
Soru 65Soru →

A solutions architect is designing the network security for a two-tier application in a VPC. The database tier runs on Amazon EC2 instances in a private subnet, and the web tier runs in a public subnet. The database instances must accept incoming database connections on TCP port 3306 from the web tier. Additionally, the database instances must be able to download software updates from the internet over HTTPS (TCP port 443) via a NAT Gateway. No other outbound connections from the database instances should be allowed. The architect wants to implement these controls using both Security Groups and Network Access Control Lists (Network ACLs) under the principle of least privilege. Which combination of configurations will satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the database security group with an inbound rule that allows TCP port 3306 from the web security group, and an outbound rule that allows TCP port 443 to 0.0.0.0/0.; Configure the database subnet Network ACL with inbound rules allowing TCP port 3306 from the web subnet CIDR and TCP ports 1024-65535 from 0.0.0.0/0, and outbound rules allowing TCP ports 1024-65535 to the web subnet CIDR and TCP port 443 to 0.0.0.0/0.

Cevap

To secure the database tier, configure the database security group to statefully allow inbound TCP port 3306 from the web security group and outbound TCP port 443 to the internet. Additionally, configure the stateless Network ACL on the database subnet to allow inbound TCP port 3306 and ephemeral ports (1024-65535) for return traffic, and outbound TCP port 443 and ephemeral ports for return traffic.
The correct configurations properly apply stateful rules to the security group and stateless rules (including ephemeral ports) to the subnet Network ACL. The security group needs inbound port 3306 and outbound port 443, as it automatically tracks connections. The Network ACL requires inbound port 3306 and outbound port 443, along with outbound ephemeral ports (for database query responses) and inbound ephemeral ports (for software patch download responses).

Adım Adım Çözüm

1
Determine the stateful security requirements at the instance level.
The database instances require a security group that allows inbound traffic on port 3306 from the web tier security group and outbound traffic on port 443 to the internet. Because security groups are stateful, return traffic is tracked and allowed automatically without requiring ephemeral port rules.
This satisfies the requirement to filter traffic at the instance level statefully.
2
Determine the stateless security requirements at the subnet level.
The database subnet Network ACL (NACL) must be configured to allow inbound queries (port 3306) and outbound patches (port 443). Because NACLs are stateless, we must also add rules to allow return traffic on ephemeral ports (1024-65535) for both directions.
This satisfies the requirement to filter traffic at the subnet level statelessly.

Anahtar Kavram

Stateful Security Groups vs Stateless Network ACLs
Soru 66Soru →

An enterprise architecture team is reviewing the security posture of an analytics application that processes sensitive financial data. The application requires access to a database password, and all associated Amazon EBS volumes must be encrypted. To comply with internal security policies, the database password must be rotated every 30 days without manual intervention, and the KMS keys used for EBS volume encryption must be automatically rotated annually. Which strategy should a solutions architect implement to meet these requirements with the least operational effort?

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.

Cevap

Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.
The correct solution stores database passwords securely in AWS Secrets Manager, which natively orchestrates rotation using AWS Lambda. It also encrypts EBS volumes using a Customer Managed Key (CMK) and leverages AWS KMS's native automatic rotation feature. This ensures that new data is encrypted with the new key version, while the previous key versions are retained to decrypt existing data without manual re-encryption overhead.

Adım Adım Çözüm

1
Identify the secure storage and rotation mechanism for database credentials.
AWS Secrets Manager is selected because it natively supports automated rotation of database credentials using AWS Lambda, unlike Systems Manager Parameter Store standard String parameters.
Securing database credentials requires encryption at rest and automated lifecycle management.
2
Identify the encryption and rotation mechanism for EBS volumes.
Use a Customer Managed Key (CMK) with automatic annual key rotation enabled.
AWS KMS supports automatic annual rotation for CMKs without requiring existing data to be re-encrypted.
3
Combine the components into a single architecture that minimizes operational overhead and adheres to best practices.
The database credentials are managed by Secrets Manager and the EBS volumes are encrypted using KMS CMKs with rotation enabled, without root account usage or manual re-encryption scripts.
This combination meets all compliance requirements with native AWS capabilities.

Anahtar Kavram

Database credential rotation using Secrets Manager and KMS Customer Managed Key automatic rotation mechanics.
Tahmini Süre:1m 30s
Soru 67Soru →

A company hosts its static website assets in an Amazon S3 bucket located in the us-east-1 Region. To ensure high availability and resiliency, the company replicates these assets to a secondary S3 bucket in the us-west-2 Region. A solutions architect needs to configure Amazon CloudFront to deliver these assets with low latency and automatically serve files from the backup S3 bucket if the primary S3 bucket returns an HTTP 503 Service Unavailable error. Which configuration should the solutions architect use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a CloudFront origin group with the primary S3 bucket as the primary origin and the secondary S3 bucket as the failover origin, selecting the 503 status code in the failover criteria.

Cevap

Configure a CloudFront origin group with the primary S3 bucket as the primary origin and the secondary S3 bucket as the failover origin, selecting the 503 status code in the failover criteria.
Configuring a CloudFront origin group provides a native, seamless way to implement high availability for static content. By setting up an origin group with a primary S3 bucket and a failover S3 bucket, CloudFront automatically retries the request against the secondary origin when the primary origin returns specific HTTP status codes such as 503.

Adım Adım Çözüm

1
Identify the primary requirement for origin failover and low-latency content delivery.
Amazon CloudFront is selected as the content delivery network (CDN) to cache content at edge locations.
CloudFront caches content globally to reduce latency for end users.
2
Configure high availability for the S3 origin within CloudFront.
Create a CloudFront origin group containing both S3 buckets as origins.
An origin group is the native CloudFront feature designed to handle failover between two origins.
3
Define failover conditions for the origin group.
Specify the 503 HTTP status code as a trigger to failover from the primary bucket to the secondary bucket.
This ensures that if the primary S3 bucket experiences issues and returns a 503 error, CloudFront automatically retrieves the requested asset from the backup bucket without impacting the client.

Anahtar Kavram

CloudFront Origin Groups and Origin Failover
Tahmini Süre:50s
Soru 68Soru →

An international logistics provider runs a critical tracking application using Amazon RDS for PostgreSQL in the us-east-1 Region. The company requires a disaster recovery (DR) solution in the us-west-2 Region with a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 15 minutes. Additionally, the secondary region must serve read-only reporting workloads during normal operations to offload the primary database. Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a cross-region read replica of the primary database in the us-west-2 Region.; Promote the cross-region read replica to a standalone DB instance in the us-west-2 Region during a disaster recovery event, and update the application connection settings.

Cevap

To meet the requirements, the company should create a cross-region read replica in the secondary region to handle reporting workloads and maintain low replication lag, and then promote that replica to a standalone DB instance during a DR event.
The correct actions are to create a cross-region read replica in the secondary region and to promote this replica to a standalone instance during a failover. The cross-region read replica satisfies the RPO of less than 5 minutes due to continuous asynchronous replication and allows read-only reporting queries to run in the secondary region. Promoting the read replica takes only a few minutes, which satisfies the 15-minute RTO.

Adım Adım Çözüm

1
Select a replication method that meets the RPO and read workload requirements.
Creating an Amazon RDS cross-region read replica provides near-continuous asynchronous replication (meeting the 5-minute RPO) and can serve read-only reporting traffic during normal operations.
Asynchronous replication to a read replica offloads reads and replicates changes without synchronous write latency across regions.
2
Select a failover method that meets the 15-minute RTO requirement.
Promoting the read replica to a standalone instance takes only a few minutes.
Promoting an existing read replica is significantly faster than restoring from backups or setting up new instances, keeping RTO well under the 15-minute threshold.
3
Identify and eliminate options that are technically impossible or violate constraints.
Eliminated Multi-AZ spanning regions (not supported), Route 53 database promotion (DNS only), and 4-hour backup restore (violates RPO).
Multi-AZ is single-region, Route 53 cannot perform database operations, and snapshot restores from 4-hour intervals violate the RPO constraint.

Anahtar Kavram

Cross-Region Disaster Recovery using RDS Read Replicas
Soru 69Soru →

A global agricultural logistics company is migrating its telemetry archiving system to AWS. The system must store critical supply chain data with an RPO of 1515 minutes and an RTO of 3030 minutes. The architecture must ensure the data is resilient to regional disasters and remains immediately readable from a secondary destination region for localized reporting. Which two configurations should the solutions architect combine to meet these resilience and recovery requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Amazon S3 Cross-Region Replication (CRR) to automatically copy telemetry data to a destination bucket in the secondary region.; Enable S3 Replication Time Control (RTC) on the replication rule configured for the telemetry data bucket.

Cevap

To meet the requirements, the solutions architect should configure Amazon S3 Cross-Region Replication (CRR) to copy telemetry data to the destination bucket and enable S3 Replication Time Control (RTC) to ensure replication is completed within the 1515-minute RPO.
Configuring Amazon S3 Cross-Region Replication (CRR) copies objects to a secondary region automatically, keeping the data immediately readable. Enabling S3 Replication Time Control (RTC) enforces replication within 1515 minutes, satisfying the 1515-minute RPO requirement.

Adım Adım Çözüm

1
Select the appropriate storage service for storing raw telemetry objects across regions.
Amazon S3 with Cross-Region Replication (CRR) is selected, ensuring durability and cross-region disaster recovery.
This establishes a replicated object repository that supports immediate, active read access in the destination region.
2
Configure Replication Time Control (RTC) on the S3 replication rule.
RTC guarantees that 99.99%99.99\% of objects replicate within 1515 minutes.
This configuration directly aligns with the strict RPO constraint of 1515 minutes.

Anahtar Kavram

Amazon S3 Cross-Region Replication with Replication Time Control (RTC) to guarantee strict RPO/RTO constraints.
Soru 70Soru →

An insurance company manages a multi-account environment on AWS using AWS Organizations. The company wants to allow its on-premises Active Directory users to access resources across these accounts using their existing corporate credentials. The solution must minimize operational overhead, avoid user data replication, and allow central management of permissions. Which of the following actions should the solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.; Create permission sets within AWS IAM Identity Center and associate them with the Active Directory groups mapping to the target AWS accounts.

Cevap

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector, then create permission sets within AWS IAM Identity Center and associate them with the Active Directory groups mapping to the target AWS accounts.
The correct solution involves configuring AWS IAM Identity Center with AWS Directory Service AD Connector to link the on-premises Active Directory to AWS without replicating credentials. Additionally, permission sets must be created in AWS IAM Identity Center and assigned to the AD groups to grant access to the member accounts in the organization. This fulfills all requirements of centralized management, zero data replication, and low operational overhead.

Adım Adım Çözüm

1
Establish connectivity between AWS and the on-premises directory.
AWS Directory Service AD Connector is deployed, redirecting directory authentication requests to the on-premises Active Directory without copying credentials.
This establishes directory integration without user database replication and minimizes operational overhead.
2
Configure AWS IAM Identity Center to use the AD Connector as its identity source.
AWS IAM Identity Center points to the Active Directory, allowing it to read groups and users directly.
This enables centralized login portal access for Active Directory users.
3
Create permission sets and assign them to the mapped groups.
Permissions are centrally defined as permission sets and linked to the corresponding AD groups inside the target AWS accounts.
This satisfies the requirement for central management of permissions.

Anahtar Kavram

AWS IAM Identity Center federation with on-premises Active Directory via AD Connector enables seamless single sign-on while keeping user credentials within the local directory and allowing centralized permission control via permission sets.
Tahmini Süre:2m 0s
Soru 71Soru →

A software development company runs nightly build integration tests. The build artifacts, which average 4 MB4\text{ MB} each, are uploaded to an Amazon S3 Standard bucket. The developers access these build artifacts frequently for the first 1212 days to debug any integration issues. After 1212 days, the artifacts are rarely accessed, but the company's compliance policy requires that they be retained for a total of 2727 days before being permanently deleted. Millisecond retrieval times are required if an older artifact needs to be inspected. Which of the following lifecycle configurations is the most cost-effective?

Cevabı ve açıklamayı göster

Cevap: Store the artifacts in Amazon S3 Standard for the entire 2727 days, and then use an S3 Lifecycle rule to delete them.

Cevap

Store the artifacts in Amazon S3 Standard for the entire 27 days, and then use an S3 Lifecycle rule to delete them.
Keeping the artifacts in S3 Standard for the entire 27 days is the most cost-effective approach. Transitioning the objects to S3 Standard-IA after 12 days would keep them in that tier for only 15 days before deletion. Since S3 Standard-IA has a minimum storage duration of 30 days, the company would be billed for 30 days of storage, incurring an early deletion charge that negates the lower storage rate.

Adım Adım Çözüm

1
Analyze the retrieval performance requirements.
The requirements demand millisecond retrieval times, which means cold storage classes like Amazon S3 Glacier Flexible Retrieval cannot be used.
S3 Glacier Flexible Retrieval requires minutes to hours for data retrieval, violating the retrieval time constraint.
2
Determine the storage duration in the transitioned tier.
The files are transitioned after 1212 days and deleted at 2727 days, meaning they would spend 1515 days in the secondary tier.
Evaluating the exact duration the files spend in the secondary tier is necessary to check for minimum storage duration penalties.
3
Evaluate S3 Standard-IA billing rules.
S3 Standard-IA has a 3030-day minimum storage duration. A 1515-day residency incurs a 1515-day billing penalty.
Understanding the minimum storage duration rule allows us to calculate that transitioning to S3 Standard-IA is not cost-effective due to the early deletion charge.

Anahtar Kavram

S3 Standard-IA storage class has a minimum storage duration of 30 days, which makes transitioning short-lived data to this tier financially suboptimal due to early deletion charges.
Soru 72Soru →

A smart grid utility company collects electricity consumption readings from 1 million1\text{ million} smart meters every 15 minutes15\text{ minutes}. The total data volume during peak hours reaches 15 MB/s15\text{ MB/s} of XML data. The company needs to ingest this data, convert the format from XML to JSON in near-real-time, and store the output in Amazon S3 for downstream analytics. The ingestion pipeline must scale automatically to handle load fluctuations and require minimal operational overhead. Which combination of actions should the solutions architect recommend to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use Amazon Kinesis Data Firehose to ingest the data and invoke an AWS Lambda function to transform the format from XML to JSON.; Deliver the transformed JSON records from Amazon Kinesis Data Firehose directly to the target Amazon S3 bucket.

Cevap

The correct combination of actions is to use Amazon Kinesis Data Firehose to ingest the data and invoke an AWS Lambda function to transform the format from XML to JSON, and to deliver the transformed JSON records from Amazon Kinesis Data Firehose directly to the target Amazon S3 bucket.
Amazon Kinesis Data Firehose is a fully managed service that scales automatically to match stream throughput, satisfying the high performance and low operational overhead criteria. It features built-in integration with AWS Lambda to execute data transformation synchronously as data passes through the delivery stream. Delivering the results directly to Amazon S3 completes a robust, scalable, and serverless ingestion pipeline.

Adım Adım Çözüm

1
Identify the scaling and operational requirements.
The pipeline must handle up to 15 MB/s15\text{ MB/s} peak traffic, scale automatically, and require minimal operational overhead.
This points toward a serverless managed ingestion service rather than provisioned streams or custom self-managed consumers.
2
Evaluate the ingestion and transformation mechanism.
Amazon Kinesis Data Firehose can ingest the data stream and trigger an inline AWS Lambda function to handle format transformation (XML to JSON) before delivery.
Firehose handles buffering, scaling, and transformation invocation serverlessly, eliminating the need to write custom scaling logic.
3
Select the destination delivery target.
Configure Amazon S3 as the target delivery destination within the Kinesis Data Firehose stream.
Firehose directly writes the output JSON files to S3, completing the end-to-end data flow with zero additional components.

Anahtar Kavram

Serverless streaming ingestion and transformation using Amazon Kinesis Data Firehose and AWS Lambda.
Soru 73Soru →

A company is deploying a high-performance clustered database application on 55 Amazon EC2 instances located in a single Availability Zone. The application requires shared block-level access to a single storage volume that will be formatted with a cluster-aware file system. The storage volume must deliver a consistent performance of 15,000 IOPS15,000\text{ IOPS} with sub-millisecond latencies.

Which storage configuration will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Provision an Amazon EBS io2 volume, enable EBS Multi-Attach, and attach the volume to all 55 EC2 instances.

Cevap

Provision an Amazon EBS io2 volume, enable EBS Multi-Attach, and attach the volume to all 55 EC2 instances.
The correct configuration is to provision an Amazon EBS io2 volume and enable EBS Multi-Attach. Multi-Attach allows attaching a single Provisioned IOPS volume to multiple Nitro-based EC2 instances within the same Availability Zone. This meets the requirement for shared block-level access with consistent performance and sub-millisecond latency. Since the database application is deployed in a single Availability Zone, this solution is fully compatible.

Adım Adım Çözüm

1
Identify the architectural requirements: shared block-level storage, a single Availability Zone, 15,000 IOPS15,000\text{ IOPS}, and sub-millisecond latency.
The solution must support attaching a single block volume to multiple EC2 instances concurrently.
Standard block storage (EBS) only allows a one-to-one attachment unless Multi-Attach is enabled.
2
Evaluate the block storage options that support Multi-Attach.
Only Provisioned IOPS SSD volumes (io1 and io2) support EBS Multi-Attach; General Purpose SSD (gp3) volumes do not support this feature.
AWS restricts Multi-Attach to high-performance provisioned IOPS workloads.
3
Determine if file or object storage options are suitable.
Amazon EFS and Amazon S3 are file-level and object-level storage systems, respectively, and cannot be formatted with a block-level cluster-aware file system.
The requirement explicitly calls for block-level access for a cluster file system.

Anahtar Kavram

EBS Multi-Attach allows mounting a single Provisioned IOPS volume to multiple EC2 instances in the same Availability Zone for shared block storage.
Soru 74Soru →

A digital ticketing platform plans to migrate its database to Amazon Aurora MySQL. The database must sustain high availability during an Availability Zone outage with a recovery time objective (RTO) of less than 60 seconds and zero data loss (recovery point objective or RPO of 0). In addition, the database must dynamically scale to support a large, unpredictable volume of read queries. Which two configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the database as an Amazon Aurora cluster with a primary instance and one or more Aurora Replicas in different Availability Zones.; Configure the application to use the Aurora reader endpoint and enable Aurora Auto Scaling for the reader instances.

Cevap

Deploy the database as an Amazon Aurora cluster with a primary instance and Aurora Replicas in different Availability Zones, and configure the application to use the Aurora reader endpoint while enabling Aurora Auto Scaling.
Deploying the database as a Multi-AZ Amazon Aurora cluster with replicas in multiple Availability Zones ensures that if the primary instance fails, Aurora automatically promotes a replica within 30 seconds with no data loss because all replicas share the cluster's distributed storage volume. Routing read traffic to the reader endpoint and enabling Aurora Auto Scaling ensures the database dynamically handles spikes in read queries by automatically scaling the number of read replicas.

Adım Adım Çözüm

1
Analyze high availability (RTO/RPO) requirements.
Identified that RTO must be under 60 seconds and RPO must be 0 (no data loss) in case of an Availability Zone outage.
This necessitates automatic failover and synchronous-like storage replication within the region.
2
Evaluate the database deployment model.
Selecting a Multi-AZ cluster deployment with Aurora Replicas across different Availability Zones guarantees automatic failover and shared storage replication.
Aurora storage is automatically replicated across three Availability Zones. Failover to an Aurora Replica in another AZ takes less than 30 seconds.
3
Analyze the read scaling requirements.
Determined that read scaling must be dynamic and handled automatically.
By connecting the application to the reader endpoint and configuring Aurora Auto Scaling, instances are provisioned or terminated dynamically to handle load changes.

Anahtar Kavram

High Availability and Read Scaling in Amazon Aurora
Soru 75Soru →

A startup runs a public web application on Amazon EC2 instances that requires a baseline capacity of four instances running 24/7 to handle steady-state traffic. The application writes to an Amazon DynamoDB table that experiences sudden, highly unpredictable spikes in database traffic. In addition, the startup runs daily batch processing jobs on AWS Fargate that are fault-tolerant and can be interrupted at any time.

Which combination of purchasing strategies should a solutions architect recommend to minimize compute costs for these workloads? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Purchase a Compute Savings Plan to cover the steady-state EC2 instances.; Use AWS Fargate Spot for the batch processing workloads.

Cevap

The solutions architect should purchase a Compute Savings Plan to cover the steady-state EC2 instances and use AWS Fargate Spot for the batch processing workloads.
Purchasing a Compute Savings Plan provides significant savings for the steady-state Amazon EC2 instances since they run continuously 24/7. Using AWS Fargate Spot is the most cost-effective choice for the batch processing workloads because they are fault-tolerant and can tolerate interruptions.

Adım Adım Çözüm

1
Analyze the steady-state EC2 workload running 24/7.
Identify that a Compute Savings Plan offers the best discount for continuous, predictable EC2 compute usage over a 1-year or 3-year term.
Compute Savings Plans provide significant savings for steady-state workloads compared to On-Demand rates.
2
Analyze the batch processing Fargate workload.
Identify that AWS Fargate Spot is the most cost-effective option since the jobs are fault-tolerant and can tolerate interruptions.
Spot pricing provides the deepest discounts for interruptible workloads.
3
Evaluate the database and capacity configurations for other components.
Exclude Compute Savings Plans for RDS database instances and eliminate Lambda for continuous 24/7 workloads to prevent high costs.
Compute Savings Plans do not cover RDS, and Lambda is not cost-effective for continuous 24/7 processing.

Anahtar Kavram

Selecting the most cost-effective compute purchasing model based on workload characteristics (steady-state vs. interruptible) and service boundaries.
Soru 76Soru →

A manufacturing company is migrating its workloads to a multi-account environment on AWS managed by AWS Organizations. The company maintains an on-premises Microsoft Active Directory containing all employee accounts. The company wants to allow its security administrators to log in to the AWS Management Console and access the AWS CLI using their existing corporate credentials. The solution must minimize operational overhead, avoid replicating Active Directory passwords to the cloud, and support centralized permission management. Which combination of actions should the solutions architect recommend to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center in the Organizations management account and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.; Create permission sets in AWS IAM Identity Center and assign them to the mapped Active Directory groups to control access to AWS resources.

Cevap

The correct configuration involves enabling AWS IAM Identity Center in the Organizations management account, connecting it to the on-premises directory via an AD Connector, and creating permission sets mapped to Active Directory groups.
Enabling AWS IAM Identity Center and using an AD Connector provides a secure, low-overhead gateway to redirect authentication requests to the on-premises directory without replicating passwords or credentials to AWS. Mapping permission sets centrally to Active Directory groups allows administrators to govern access across all member accounts from a single location.

Adım Adım Çözüm

1
Identify the correct federation service for multi-account management.
AWS IAM Identity Center is selected over individual IAM configurations to provide single sign-on capabilities across the AWS Organization.
IAM Identity Center is the modern AWS recommendation for centralizing multi-account access.
2
Establish connectivity to the on-premises Active Directory without password replication.
Deploy an AWS Directory Service AD Connector to act as a directory gateway.
AD Connector redirects authentication requests directly to the on-premises Active Directory, ensuring no passwords or hashes are replicated to the cloud.
3
Map Active Directory groups to AWS permissions.
Create permission sets in AWS IAM Identity Center and associate them with mapped AD groups.
This allows group-based authorization, matching existing corporate governance structures.

Anahtar Kavram

Centralized multi-account access management using AWS IAM Identity Center integrated with an on-premises Active Directory via AD Connector.
Soru 77Soru →

A healthcare software provider is deploying a critical patient portal application on AWS. The application database tier requires high availability within the primary Region (us-east-1) to survive the loss of an Availability Zone with a Recovery Time Objective (RTO) of under 60 seconds. Additionally, the provider requires a cross-region disaster recovery (DR) solution in the us-west-2 Region with a Recovery Point Objective (RPO) of under 1 minute and a Recovery Time Objective (RTO) of under 15 minutes. Which combination of database configurations will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora PostgreSQL DB cluster in us-east-1 with at least one Aurora Replica in a different Availability Zone.; Use Amazon Aurora Global Databases to replicate data from us-east-1 to a secondary Aurora DB cluster in us-west-2.

Cevap

Deploy an Amazon Aurora PostgreSQL DB cluster in us-east-1 with at least one Aurora Replica in a different Availability Zone, and use Amazon Aurora Global Databases to replicate data from us-east-1 to a secondary Aurora DB cluster in us-west-2.
Deploying an Amazon Aurora DB cluster with an Aurora Replica in a different Availability Zone provides automatic failover in under 30 seconds, satisfying the regional high availability RTO requirement of under 60 seconds. Combining this with Amazon Aurora Global Databases allows storage-level, low-latency replication to a secondary Region with a lag of less than 1 second (satisfying the 1-minute RPO) and enabling promotion of the secondary cluster in less than 1 minute (satisfying the 15-minute RTO).

Adım Adım Çözüm

1
Analyze the regional high availability constraint (RTO < 60 seconds in us-east-1).
Identify that a Multi-AZ deployment is required. An Amazon Aurora PostgreSQL DB cluster with at least one replica in a separate Availability Zone provides automatic failover in under 30 seconds, meeting the target.
Single-AZ deployments or manual replica promotions do not meet the low RTO requirement for regional Availability Zone failures.
2
Analyze the cross-region disaster recovery constraints (RPO < 1 minute, RTO < 15 minutes in us-west-2).
Select Amazon Aurora Global Databases, which use fast storage-level replication with lag under 1 second (meeting the RPO of under 1 minute) and support failover/promotion in minutes (meeting the RTO of under 15 minutes).
Daily snapshot replication (Pilot Light) results in an RPO of 24 hours, which violates the 1-minute RPO limit.

Anahtar Kavram

High availability and disaster recovery design using Amazon Aurora Multi-AZ and Aurora Global Databases
Tahmini Süre:2m 0s
Soru 78Soru →

A company runs a high-performance web application on a fleet of Amazon EC2 instances distributed across two Availability Zones. The instances require concurrent read/write access to a shared, POSIX-compliant file system to store and retrieve media assets. The storage must scale throughput automatically to handle unpredictable traffic spikes while maintaining low latency.

Which storage solution should a solutions architect recommend to meet these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Amazon EFS configured with Elastic throughput

Cevap

Amazon EFS configured with Elastic throughput
The correct answer is the option proposing Amazon EFS with Elastic throughput. Amazon EFS is designed as a serverless, shared, POSIX-compliant file system that can be accessed concurrently by EC2 instances in multiple Availability Zones. Elastic throughput ensures that the storage scales dynamically to handle unpredictable spikes in traffic without operational management.

Adım Adım Çözüm

1
Identify the storage requirements of the application: concurrent access, multi-AZ deployment, POSIX compliance, automatic scaling of throughput, and low operational overhead.
Amazon EFS is selected as the primary candidate because it natively provides a shared POSIX-compliant file system that spans multiple Availability Zones and supports concurrent access.
Eliminating block-based storage options (EBS) which are locked to a single Availability Zone and do not natively support standard concurrent file sharing across multiple instances.
2
Evaluate EFS throughput modes to address unpredictable spikes in traffic.
Elastic throughput mode is selected because it dynamically scales throughput based on workload demands, eliminating the need to provision or manage throughput limits manually.
Ensuring the system handles performance spikes cost-effectively and with minimal operational effort.

Anahtar Kavram

Shared file storage using Amazon EFS with Elastic throughput mode across multiple Availability Zones.
Soru 79Soru →

A maritime fleet management company is designing a high-availability telemetry processing system on AWS. The application runs on Amazon ECS containers across multiple Availability Zones in the primary region (`eu-west-1`). The containers require concurrent read/write access to a shared POSIX-compliant file system. The architecture must support a multi-region disaster recovery (DR) plan in `eu-central-1` with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 10 minutes. During failover, the file system in the recovery region must be immediately writable without latency or performance degradation. Which combination of configurations will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Elastic File System (Amazon EFS) file system in `eu-west-1` using the Regional storage class, and configure Amazon EFS Replication to a destination file system in `eu-central-1`.; In the disaster recovery region (`eu-central-1`), configure the ECS task definitions to mount the replica EFS file system using its native mount target when initiating failover.

Cevap

Deploying an Amazon EFS file system in the primary region with replication configured to the secondary region, and configuring the secondary region's ECS tasks to mount the replicated EFS file system.
Deploying Amazon EFS with native replication guarantees that files are automatically copied across regions with low latency, satisfying the 15-minute RPO. In the event of a failover, mounting the local replicated file system in the secondary region allows ECS containers to start up and begin executing operations instantly, comfortably staying within the 10-minute RTO.

Adım Adım Çözüm

1
Determine the storage access requirement.
The application requires concurrent read/write POSIX-compliant access, which makes Amazon Elastic File System (EFS) the ideal choice over object storage or block storage.
Amazon EFS supports concurrent access from multiple container instances and complies with standard POSIX directory structures and permissions.
2
Assess replication and RPO compliance.
Enable Amazon EFS Replication from the primary region to the disaster recovery region.
EFS Replication transfers data asynchronously across regions and typically updates the replica within minutes, satisfying the 15-minute RPO.
3
Determine recovery procedures to meet the RTO.
Configure ECS container tasks in the secondary region to mount the replicated EFS file system.
When a failover occurs, the secondary EFS is immediately available for read and write operations. The ECS tasks can mount the local replica with minimal latency, ensuring the 10-minute RTO is met.

Anahtar Kavram

Multi-Region shared storage resilience utilizing Amazon EFS Replication to achieve low recovery metrics.
Soru 80Soru →

A company hosts a latency-sensitive application across two AWS Regions: us-east-1 and us-west-2. The company needs to route global user traffic to the Region that offers the lowest latency, with automatic failover if a Region becomes unhealthy. Additionally, the company must establish a secure hybrid network connection to replicate database backups from their on-premises data center to both AWS Regions. The replication traffic requires a consistent bandwidth of 2.52.5 Gbps. Which architecture should a solutions architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy AWS Global Accelerator to route user traffic to the application endpoints in both Regions. Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing across multiple VPN tunnels to handle the database replication traffic.

Cevap

Deploy AWS Global Accelerator to route user traffic to the application endpoints in both Regions. Establish an AWS Site-to-Site VPN connection to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing across multiple VPN tunnels to handle the database replication traffic.
The correct architecture uses AWS Global Accelerator to route user traffic using the low-latency AWS global network and automatically redirects traffic around unhealthy endpoints. For the hybrid database replication, because a single AWS Site-to-Site VPN tunnel is limited to 1.251.25 Gbps, configuring multiple VPN tunnels with ECMP enabled on an AWS Transit Gateway allows the connection to scale to 2.52.5 Gbps.

Adım Adım Çözüm

1
Address the user latency and failover requirements.
Using AWS Global Accelerator directs users to the nearest application endpoint using the AWS edge network and provides automatic health-check-based failover.
Global Accelerator uses Anycast IP addresses and the AWS global backbone network to minimize latency and automatically route around unhealthy endpoints.
2
Address the hybrid database replication throughput requirement.
Establish a Site-to-Site VPN with multiple tunnels attached to an AWS Transit Gateway, enabling Equal-Cost Multi-Path (ECMP) routing.
Since a single AWS VPN tunnel has a hard limit of 1.251.25 Gbps, ECMP routing across multiple active tunnels is required to aggregate bandwidth and support the 2.52.5 Gbps throughput requirement.

Anahtar Kavram

AWS Transit Gateway ECMP routing scales VPN bandwidth beyond the 1.251.25 Gbps tunnel limit, and AWS Global Accelerator optimizes user latency with automatic failover.
Tahmini Süre:1m 30s
ÖncekiSayfa 4 / 74Sonraki