Examkin

Tüm alıştırma soruları

1462 soru

Tüm türler1,462Çoktan seçmeli739Çoklu seçim723
Soru 1021Soru →

A company hosts a global web application in the us-east-1 Region. The application consists of static media assets stored in an Amazon S3 bucket and dynamic APIs served by Amazon EC2 instances behind an Application Load Balancer (ALB). To protect against regional outages and optimize performance, the company has duplicated its static assets to an S3 bucket in us-west-2 and deployed a standby backend service on EC2 instances behind an ALB in us-west-2. A solutions architect must design a content delivery and caching solution that ensures low latency for global users and automatically fails over to the standby resources in us-west-2 if the primary resources in us-east-1 fail or return server errors.

Which combination of actions should the solutions architect take to meet these requirements with the lowest latency and high resilience? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon CloudFront distribution with an origin group for static assets, specifying the us-east-1 S3 bucket as the primary origin and the us-west-2 S3 bucket as the secondary origin.; Configure an Amazon CloudFront distribution with an origin group for dynamic APIs, specifying the us-east-1 Application Load Balancer as the primary origin and the us-west-2 Application Load Balancer as the secondary origin.

Cevap

Configure an Amazon CloudFront distribution with an origin group for static assets (with us-east-1 S3 as primary and us-west-2 S3 as secondary) and configure an origin group for dynamic APIs (with us-east-1 ALB as primary and us-west-2 ALB as secondary).
To build a resilient and low-latency architecture, Amazon CloudFront should be deployed in front of the origin servers. By setting up CloudFront origin groups, you can specify a primary origin and a secondary (standby) origin for both static assets (Amazon S3 buckets) and dynamic content (Application Load Balancers). If the primary origin in us-east-1 returns configured HTTP error codes (such as 500, 502, 503, or 504), CloudFront automatically fails over and routes subsequent requests to the secondary origin in us-west-2, ensuring high availability and low latency via edge caching.

Adım Adım Çözüm

1
Set up CloudFront origin groups for both static assets and dynamic APIs.
Two separate origin groups are created within the CloudFront distribution: one containing the S3 buckets in us-east-1 and us-west-2, and another containing the Application Load Balancers (ALBs) in us-east-1 and us-west-2.
Origin groups allow CloudFront to automatically handle origin failover when the primary origin is unavailable or returns specific HTTP errors.
2
Configure the cache behaviors to map static and dynamic paths to their respective origin groups.
Traffic for static media assets is routed to the S3 origin group, and traffic for dynamic APIs is routed to the ALB origin group.
This separation ensures that caching policies and failover behaviors are optimized for each content type.
3
Configure failover criteria for the origin groups.
Failover triggers are established for HTTP status codes such as 500, 502, 503, and 504.
This guarantees that if the primary resources in us-east-1 fail or return server errors, CloudFront instantly forwards the user requests to the standby resources in us-west-2.

Anahtar Kavram

Amazon CloudFront origin groups allow solutions architects to configure automatic origin failover for both Amazon S3 and custom origins (such as Application Load Balancers) to ensure high resilience and low latency.
Soru 1022Soru →

A mobile gaming application requires a database backend to store real-time player session state. The application must support millions of concurrent users with sub-millisecond read latency and single-digit millisecond write latency. The session keys are generated sequentially using epoch timestamps. Which combination of database design choices will meet these requirements while preventing performance bottlenecks? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use Amazon DynamoDB with a composite primary key consisting of a partition key based on a hashed player ID and a sort key based on the sequential epoch timestamp.; Deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache frequently accessed read requests for player sessions.

Cevap

Use Amazon DynamoDB with a composite partition key using a hashed player ID and a sort key using the epoch timestamp, and deploy an Amazon DynamoDB Accelerator (DAX) cluster to cache read requests.
To achieve a high-performing database solution that handles millions of concurrent users with low latency, Amazon DynamoDB is the appropriate choice. Designing a composite primary key with a hashed player ID as the partition key distributes the database writes evenly across physical partitions, preventing write throttling and avoiding the hot partition issue caused by sequential keys. Deploying DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read latency from single-digit milliseconds to microseconds, satisfying the sub-millisecond read latency requirement.

Adım Adım Çözüm

1
Analyze the workload requirements and identify performance constraints.
The application requires millions of concurrent operations with sub-millisecond read latency, single-digit millisecond write latency, and must prevent write throttling from sequential keys.
Sequential keys (epoch timestamps) are monotonically increasing and will cause hot partition bottlenecks in DynamoDB if used as partition keys.
2
Select a primary key structure that distributes writes across partitions.
A composite key with a hashed partition key (player ID) and a sequential sort key (epoch timestamp) is selected.
Hashing the partition key ensures write operations are distributed uniformly across multiple partitions, preventing hot partition throttling, while the sort key maintains the chronological ordering of the sessions.
3
Address the sub-millisecond read latency requirement.
Amazon DynamoDB Accelerator (DAX) is selected for read caching.
DynamoDB native latency is single-digit milliseconds. To achieve microsecond (sub-millisecond) read latency, an in-memory cache like DAX is required.

Anahtar Kavram

High-performing database architectures utilizing Amazon DynamoDB partition design and DynamoDB Accelerator (DAX) caching to handle high-throughput, low-latency workloads.
Soru 1023Soru →

A company is deploying a serverless mobile application backend on AWS. The application database experiences sudden, unpredictable spikes in write traffic during promotional events, followed by long periods of complete inactivity. The company wants to minimize costs and ensure they do not pay for database throughput during idle periods. Which Amazon DynamoDB configuration is the most cost-effective for this workload?

Cevabı ve açıklamayı göster

Cevap: Configure the DynamoDB table to use On-Demand capacity mode.

Cevap

Configure the DynamoDB table to use On-Demand capacity mode.
Configuring the table in On-Demand capacity mode is the most cost-effective choice. It automatically handles unpredictable spikes without requiring capacity planning and scales down to zero throughput charges during idle periods, matching the pay-per-request pricing model.

Adım Adım Çözüm

1
Analyze the workload characteristics: unpredictable spikes in traffic followed by long periods of complete inactivity.
Determine that the database must scale instantly to handle spikes and scale to zero (incurring no throughput costs) when idle.
This establishes the requirements for a cost-effective database scaling mechanism.
2
Evaluate Amazon DynamoDB capacity modes against these characteristics.
On-Demand capacity mode automatically scales to accommodate spikes and charges only for actual read and write requests, incurring zero throughput costs when idle.
Comparing On-Demand and Provisioned modes determines the most cost-effective option.

Anahtar Kavram

Amazon DynamoDB On-Demand capacity mode provides pay-per-request pricing and automatically scales up and down to zero, making it ideal for unpredictable workloads with idle periods.
Tahmini Süre:45s
Soru 1024Soru →

A company is deploying a media-processing web application on a fleet of Amazon EC2 instances distributed across three Availability Zones. The application requires a shared file system to store and process uploaded media files. The storage solution must support concurrent read and write operations from all EC2 instances, scale throughput dynamically to handle unpredictable spikes of up to 2 GB/s2\text{ GB/s}, and maintain low, consistent latency. Which storage solution should a solutions architect recommend to meet these requirements with the lowest operational overhead?

Cevabı ve açıklamayı göster

Cevap: Create an Amazon EFS file system configured with Elastic throughput mode, and mount it on each EC2 instance.

Cevap

Create an Amazon EFS file system configured with Elastic throughput mode, and mount it on each EC2 instance.
The correct option (creating an Amazon EFS file system with Elastic throughput) is correct because Amazon EFS natively supports multi-AZ concurrent access and automatically scales throughput dynamically up to several gigabytes per second to match application demands, minimizing administrative overhead.

Adım Adım Çözüm

1
Analyze the sharing and distribution requirements of the workload.
The file system must be accessed concurrently by EC2 instances distributed across three Availability Zones.
This requirement rules out standard Amazon EBS volumes, which are single-AZ resources and cannot be shared across multiple Availability Zones.
2
Evaluate throughput scale and operational characteristics.
The workload exhibits unpredictable spikes up to 2 GB/s2\text{ GB/s}.
Amazon EFS with Elastic throughput is designed specifically for unpredictable workloads, scaling throughput automatically without manual provisioning or management.
3
Select the fully managed solution with the lowest operational overhead.
Amazon EFS meets all structural, performance, and scaling requirements as a managed service.
Setting up custom NFS shares on EC2 instances or attempting to use EBS Multi-Attach across zones either fails to meet the multi-AZ requirement or introduces significant administrative overhead and single points of failure.

Anahtar Kavram

Amazon EFS provides managed, shared, elastic-scale file storage across multiple Availability Zones, whereas Amazon EBS volumes are localized to a single Availability Zone and cannot natively serve as multi-AZ shared file systems.
Tahmini Süre:1m 30s
Soru 1025Soru →

A local events ticketing company is designing a booking system on AWS. The system receives booking confirmations that must be written to a database. The booking requests are highly spiky, reaching up to 5,0005,000 writes per second during the first 1515 minutes of a popular event launch. For the rest of the week, the booking rate is less than 1010 writes per second. The booking confirmations do not need to be processed in real-time but must be saved reliably within a few hours. The company wants to design a cost-optimized database tier. Which database design and capacity configuration is the most cost-effective?

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon SQS queue to buffer the incoming booking requests. Implement a fleet of consumer instances to retrieve the messages and write them to a smaller Amazon RDS database with General Purpose SSD (gp3) storage configured for the average write rate.

Cevap

Deploying an Amazon SQS queue to buffer incoming booking requests and writing them to a smaller Amazon RDS database with gp3 storage configured for the average write rate.
Decoupling the database write workload using an Amazon SQS queue allows the application to ingest the peak traffic (5,0005,000 writes per second) immediately without throttling. The messages can then be processed asynchronously over a longer period, enabling the Amazon RDS database instance and its General Purpose SSD (gp3) storage to be provisioned for the average throughput (closer to the 1010 writes per second baseline) rather than the peak, resulting in significant cost savings.

Adım Adım Çözüm

1
Analyze the workload characteristics and requirements.
The workload has an extremely high peak (5,0005,000 writes/sec) for a very short duration (1515 minutes), with a very low baseline (1010 writes/sec). The processing is not time-critical (can be delayed by a few hours).
Understanding performance limits and SLA requirements determines whether synchronous scaling or asynchronous decoupling is appropriate.
2
Evaluate the cost of scaling database resources dynamically vs. decoupling.
Scaling a database (RDS or DynamoDB) to handle 5,0005,000 writes/sec is expensive and prone to throttling due to slow auto-scaling response times. Decoupling using an Amazon SQS queue allows buffering the load.
SQS is highly cost-effective for message ingestion and handles arbitrary spikes without throttling, enabling the downstream database to be sized for the average rate.
3
Assess the cost-optimization options for storage and purchasing models.
Using gp3 storage on a downsized RDS database provides a low-cost, independently scalable storage option. Compute Savings Plans cannot be used to discount RDS costs.
Correctly applying AWS billing concepts (Savings Plans scope) and storage types (gp3 vs io2) ensures maximum cost optimization.

Anahtar Kavram

Decoupling database writes with SQS to optimize database instance sizing and storage costs.
Tahmini Süre:2m 0s
Soru 1026Soru →

A media streaming platform runs a real-time video transcoding service on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The transcoding application is highly CPU-intensive, and each instance takes approximately 10 minutes to boot, initialize the transcoding software, and download heavy model files from Amazon S3 before it can begin processing traffic. During sudden traffic spikes, users experience severe playback delays because the Auto Scaling group cannot provision new instances fast enough to handle the load.

Which combination of actions will provide the most elastic and high-performing architecture to handle these spikes? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Auto Scaling group warm pool with instances in a Stopped state to maintain a pool of pre-initialized instances.; Configure a lifecycle hook on the Auto Scaling group to pause the instance launch and keep it in the Pending:Wait state while initialization scripts run.

Cevap

Configure an Auto Scaling group warm pool with instances in a Stopped state to maintain a pool of pre-initialized instances, and configure a lifecycle hook on the Auto Scaling group to pause the instance launch and keep it in the Pending:Wait state while initialization scripts run.
To handle sudden traffic spikes for an application with a long initialization time, we must reduce the time it takes for new instances to become ready. Configuring an Auto Scaling warm pool allows instances to be pre-initialized and kept in a Stopped state, which reduces the scale-out time to under a minute because the boot and initialization processes have already occurred. Combining this with a lifecycle hook ensures that the instance remains in a Pending:Wait state while its startup scripts complete, preventing the load balancer from sending traffic to the instance before it is ready to process it.

Adım Adım Çözüm

1
Analyze the scaling bottleneck.
Identify that the 10-minute boot and initialization duration is the root cause of the latency during traffic spikes.
Before deciding on a solution, we must pinpoint why the Auto Scaling group fails to handle sudden load changes in a timely manner.
2
Select a mechanism to pre-provision and pre-initialize compute capacity.
Choose Auto Scaling warm pools with Stopped instances.
Warm pools keep a pool of stopped, pre-initialized instances ready. This bypasses the 10-minute setup overhead when scaling out, as the instances only need to be started rather than booted from scratch.
3
Implement a lifecycle hook to synchronize state initialization.
Use a lifecycle hook to hold the instance in a Pending:Wait state.
This guarantees that the instance does not prematurely receive client traffic before the transcoding software and models are fully loaded.

Anahtar Kavram

Auto Scaling Warm Pools and Lifecycle Hooks for Speeding Up Instance Provisioning
Soru 1027Soru →

A logistics company runs a fleet tracking application on AWS. The application consists of a backend data ingestion service deployed on Amazon ECS with AWS Fargate, which runs continuously 24/7 to process telemetry from vehicles. The application also uses an Amazon RDS for MySQL database to store tracking history. A solutions architect needs to recommend a purchasing strategy to minimize the costs of both Fargate and RDS, while maintaining the required availability. Which combination of purchasing options will achieve this goal most cost-effectively?

Cevabı ve açıklamayı göster

Cevap: Purchase a Compute Savings Plan to cover the Amazon ECS on AWS Fargate tasks, and purchase an Amazon RDS Reserved Instance for the database.

Cevap

Purchase a Compute Savings Plan to cover the Fargate tasks and an Amazon RDS Reserved Instance for the database.
The correct option combines a Compute Savings Plan to cover the AWS Fargate tasks (as Compute Savings Plans are the only plans that apply to Fargate) with an Amazon RDS Reserved Instance to cover the 24/7 database workload. This represents the most cost-effective combination of commitment-based discounts for the described services.

Adım Adım Çözüm

1
Analyze the compute requirements for the ingestion service.
The ingestion service runs continuously 24/7 on Amazon ECS with AWS Fargate.
Identifying the hosting model and runtime profile helps determine the correct savings plan type.
2
Select the appropriate purchasing option for AWS Fargate.
Select Compute Savings Plans because they apply to Fargate (unlike EC2 Instance Savings Plans or EC2 Reserved Instances).
Compute Savings Plans offer up to 66% savings on EC2, Fargate, and Lambda usage.
3
Identify the database hosting model and purchasing options.
The database runs continuously on Amazon RDS for MySQL, which requires RDS Reserved Instances for reservation discounts.
Compute Savings Plans do not cover database engines like Amazon RDS.

Anahtar Kavram

Applying different AWS purchasing models to compute and database resources depending on their compatibility and scope.
Soru 1028Soru →

A company is designing a secure web application that will run on Amazon EC2 instances in a private subnet. The application needs to retrieve database credentials and encrypt sensitive files before storing them in an Amazon S3 bucket. The security policy mandates that database credentials must be rotated every 30 days, the encryption keys must be rotated annually, and the EC2 instances must access these resources securely using temporary credentials. Which TWO actions should the solutions architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with permissions to retrieve the credentials and decrypt with the AWS KMS key, associate the role with an EC2 instance profile, and attach it to the EC2 instances.; Store the database credentials in AWS Secrets Manager with automatic rotation enabled, and enable automatic annual rotation for the customer managed KMS key.

Cevap

To meet the security requirements, the solutions architect should store the database credentials in AWS Secrets Manager with automatic rotation, enable annual key rotation for the customer managed KMS key, and use an IAM role associated with an EC2 instance profile to grant the EC2 instances secure access to those resources.
The correct solution involves storing the credentials in AWS Secrets Manager and enabling automatic 30-day rotation, enabling automatic annual key rotation for the customer managed KMS key, and creating an IAM role attached to an EC2 instance profile to provide temporary credentials to the instances. This configuration ensures credentials and keys are rotated securely, and the EC2 instances access resources without hardcoded credentials.

Adım Adım Çözüm

1
Configure secure credential management and key rotation.
Store the database credentials in Secrets Manager with a 30-day rotation schedule, and enable automatic annual rotation on the KMS key.
This satisfies the operational requirement to periodically rotate secrets and keys automatically.
2
Provide secure access to EC2 instances using IAM roles.
Create an IAM role with policy permissions to retrieve the secret and decrypt using the KMS key, associate it with an instance profile, and attach it to the EC2 instances.
This allows the application to authenticate using temporary security credentials rather than hardcoded long-term credentials.

Anahtar Kavram

Secure credential management, encryption key rotation, and IAM role association for EC2 instances.
Tahmini Süre:2m 0s
Soru 1029Soru →

A company needs to grant temporary access to an Amazon S3 bucket in its AWS production account to external, third-party contractors. The contractors authenticate through an external OpenID Connect (OIDC) compliant identity provider and do not have their own AWS accounts. The company's security policy strictly prohibits the use of long-term credentials for external access. Which combination of actions should a solutions architect recommend to configure this access securely? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM identity provider for the OIDC-compliant identity provider in the AWS account.; Create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action, and attach an IAM policy that allows read and write permissions to the target S3 bucket.

Cevap

Establish trust with the external OpenID Connect (OIDC) identity provider by creating an IAM identity provider, and configure an IAM role with a trust policy that permits the sts:AssumeRoleWithWebIdentity action combined with an S3 access policy.
The correct solution involves configuring web identity federation. By creating an IAM identity provider for the OIDC-compliant IdP, AWS can validate external tokens. Creating an IAM role that allows the 'sts:AssumeRoleWithWebIdentity' action in its trust policy enables the external contractors to dynamically exchange their OIDC token for temporary AWS security credentials, conforming to the least privilege principle and the requirement to avoid long-term credentials.

Adım Adım Çözüm

1
Register the external identity provider (IdP) in IAM.
Trust is established between AWS and the OIDC-compliant provider.
This allows AWS to recognize and validate OIDC authentication tokens presented by the contractors.
2
Create an IAM role with a trust policy that specifies the OIDC identity provider as the principal.
The role can be assumed by external users via the web identity token exchange.
The trust policy must permit the action 'sts:AssumeRoleWithWebIdentity' to allow the OIDC provider's users to trade identity tokens for temporary AWS security credentials.
3
Attach a policy to the IAM role that grants permissions to the specific S3 bucket.
Temporary credentials obtained from assuming the role only possess read and write access to the targeted S3 bucket.
This enforces the principle of least privilege by scoping the temporary credentials to only the necessary resources.

Anahtar Kavram

Web Identity Federation (OIDC) and IAM Roles
Soru 1030Soru →

A company is deploying a containerized application on Amazon EC2 instances. The application requires access to an Amazon DynamoDB table to retrieve configuration settings. The developer proposes creating a new IAM user, generating long-term access keys, and embedding them in the application's configuration file. Which solution should a solutions architect recommend to establish secure access while adhering to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a permissions policy that allows access to the DynamoDB table, attach this role to the EC2 instances using an instance profile, and configure the application to use the AWS SDK to retrieve temporary credentials automatically.

Cevap

Create an IAM role with a permissions policy that allows access to the DynamoDB table, attach this role to the EC2 instances using an instance profile, and configure the application to use the AWS SDK to retrieve temporary credentials automatically.
The correct solution uses an IAM role attached to the EC2 instances via an instance profile. This is the recommended security best practice because it eliminates the need to manage, store, or rotate long-term AWS credentials. The AWS SDK running inside the EC2 instances automatically retrieves temporary security credentials from the Instance Metadata Service (IMDS) to perform the authorized actions on DynamoDB.

Adım Adım Çözüm

1
Define an IAM policy outlining the least privilege permissions required to access the target DynamoDB table.
An IAM policy document specifying permissions for DynamoDB actions.
Ensures the application has only the necessary access permissions.
2
Create an IAM role and attach the DynamoDB permissions policy to it.
An IAM role configured with the specific permissions.
Allows AWS resources or services to assume the identity and use the permissions of this role.
3
Attach the IAM role to the EC2 instances using an EC2 instance profile.
The EC2 instances now have access to retrieve security credentials for the assumed IAM role via the Instance Metadata Service (IMDS).
Enables the application to fetch temporary credentials automatically through the AWS SDK without hardcoding keys.

Anahtar Kavram

EC2 Instance Profiles and IAM Roles
Tahmini Süre:1m 30s
Soru 1031Soru →

An enterprise has an on-premises data processing application that runs on physical servers in a local data center. The application needs to upload large volumes of processed transaction logs to an Amazon S3 bucket in the company's AWS production account. The company's security policy strictly prohibits the use of long-term credentials, such as IAM access keys, stored on local servers. A solutions architect must design a secure authentication and authorization mechanism for this application. Which combination of actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS Identity and Access Management (IAM) Roles Anywhere by establishing a trust anchor with an on-premises Certificate Authority (CA).; Create an IAM role with a trust policy that allows the IAM Roles Anywhere service principal to assume the role, and attach the necessary permissions for Amazon S3.

Cevap

Establish a trust anchor using an on-premises Certificate Authority (CA) in AWS IAM Roles Anywhere, and create an IAM role trusting the IAM Roles Anywhere service principal with the necessary Amazon S3 permissions.
The correct strategy relies on AWS IAM Roles Anywhere. First, establishing a trust anchor with the company's Certificate Authority allows IAM Roles Anywhere to authenticate local servers using digital certificates. Second, creating an IAM role that trusts the IAM Roles Anywhere service principal allows the authenticated servers to acquire temporary security credentials to write to the Amazon S3 bucket, meeting all requirements without storing long-term credentials.

Adım Adım Çözüm

1
Select a mechanism to authenticate non-AWS workloads securely without static credentials.
Identify AWS IAM Roles Anywhere as the ideal solution to issue short-term AWS credentials to on-premises servers using public key infrastructure (PKI).
IAM Roles Anywhere eliminates the security risks associated with storing long-term credentials on local physical servers.
2
Establish trust between the local CA and AWS.
Create a trust anchor in IAM Roles Anywhere pointing to the on-premises Certificate Authority (CA).
This allows AWS to verify the identity of the physical servers when they present their certificates signed by the local CA.
3
Authorize the authenticated servers to write to Amazon S3.
Configure an IAM role with a trust policy allowing the service principal 'rolesanywhere.amazonaws.com' to assume the role, and attach the required S3 bucket policies or permissions.
When the servers successfully authenticate, IAM Roles Anywhere will return temporary credentials by assuming this role.

Anahtar Kavram

AWS IAM Roles Anywhere enables on-premises workloads to obtain temporary security credentials using X.509 digital certificates, eliminating the need to store long-term IAM access keys on local hardware.
Soru 1032Soru →

A Solutions Architect is setting up a new multi-account AWS environment using AWS Organizations. The company's security policy requires centralized management of user access across all AWS accounts, allowing employees to log in using their existing corporate credentials. Which approach should the Solutions Architect recommend to meet these requirements securely?

Cevabı ve açıklamayı göster

Cevap: Enable AWS IAM Identity Center in the organization, and integrate it with the corporate identity provider for centralized user access.

Cevap

Enable AWS IAM Identity Center in the organization, and integrate it with the corporate identity provider for centralized user access.
Enabling AWS IAM Identity Center and integrating it with the corporate identity provider is the AWS-recommended best practice for managing centralized user access across a multi-account organization. It allows employees to use their existing credentials and supports role-based access control with temporary credentials.

Adım Adım Çözüm

1
Identify the primary requirement: centralized management of user access across multiple AWS accounts in an organization using corporate credentials.
Requires a federated single sign-on (SSO) solution.
Centralized federation avoids managing individual credentials per account.
2
Evaluate AWS services suitable for centralized federation across AWS Organizations.
AWS IAM Identity Center provides built-in integration with external identity providers and centralized permission management.
It natively supports multi-account environments under AWS Organizations.
3
Eliminate options that require creating individual IAM users or using root credentials.
Options proposing individual IAM users or root user credentials are secure-practice violations.
They violate the principle of least privilege and represent management overhead.

Anahtar Kavram

Centralized Multi-Account Identity Federation
Tahmini Süre:45s
Soru 1033Soru →

A corporation uses an external identity provider (IdP) to manage its workforce identities. A solutions architect must configure access to the AWS Management Console for 200200 developers. Which strategy aligns with AWS security best practices to grant this access?

Cevabı ve açıklamayı göster

Cevap: Configure identity federation using AWS IAM Identity Center to allow the developers to sign in using their existing corporate credentials.

Cevap

Configure identity federation using AWS IAM Identity Center to leverage existing corporate credentials and centralize management.
Configuring identity federation using AWS IAM Identity Center allows developers to sign in with their existing corporate credentials. This approach centralizes access management, avoids the creation of long-term credentials like IAM passwords or access keys, and scales efficiently as the organization grows.

Adım Adım Çözüm

1
Analyze the request: grant AWS console access to 200200 developers already managed in an external corporate identity provider.
Identified that managing 200200 local IAM users manually is inefficient and insecure compared to federating the existing identity provider.
AWS security best practices advocate for federated access over creating long-term IAM credentials for workforce users.
2
Select AWS IAM Identity Center as the correct AWS service for managing SSO access to AWS accounts.
Developers can log in with their corporate credentials without new IAM users being generated.
AWS IAM Identity Center simplifies access management by delegating authentication to the corporate IdP.

Anahtar Kavram

Workforce identity federation is the AWS-recommended method for granting corporate directory users access to AWS resources, minimizing credential management overhead.
Tahmini Süre:45s
Soru 1034Soru →

A financial services firm hosts a banking API on AWS using an Application Load Balancer (ALB) and Amazon EC2 instances in a private subnet. The API has recently been targeted by sudden HTTP flood attacks consisting of a high volume of HTTP POST requests, which exhaust the CPU resources of the backend EC2 instances. The firm needs to mitigate these application-layer (Layer 7) attacks at the network edge before they reach the ALB. Which solution should a solutions architect recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate AWS WAF with the CloudFront distribution using a rate-based rule.

Cevap

Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate AWS WAF with the CloudFront distribution using a rate-based rule.
The correct solution uses Amazon CloudFront as a caching and distribution layer at the AWS edge to act as the first line of defense. By associating AWS WAF with the CloudFront distribution, the architecture can inspect Layer 7 HTTP traffic. A WAF rate-based rule counts requests from individual IP addresses and temporarily blocks them if they exceed a defined threshold (e.g., 100 requests per 5 minutes). This prevents the HTTP flood from reaching the regional Application Load Balancer and overloading the backend EC2 instances.

Adım Adım Çözüm

1
Analyze the attack vector and mitigation requirements.
The attack is a Layer 7 HTTP flood (POST requests) causing CPU exhaustion on backend servers, which must be blocked at the edge before hitting the ALB.
Identifying the layer of the attack (Layer 7) determines the tool needed (AWS WAF) rather than network-level firewalls (Security Groups or NACLs).
2
Evaluate the architectural entry point for edge protection.
Amazon CloudFront distributes traffic across AWS edge locations, absorbing Layer 3 and 4 traffic globally.
Deploying CloudFront allows the security controls to be evaluated close to the client, preventing malicious traffic from reaching the regional VPC resources.
3
Select the appropriate security service and rule type for Layer 7 rate limiting.
AWS WAF with a rate-based rule is associated with the CloudFront distribution.
AWS WAF rate-based rules automatically track request rates from individual IP addresses and apply a block action once the configured threshold is breached, mitigating HTTP floods dynamically.

Anahtar Kavram

Layer 7 DDoS mitigation at the AWS network edge using Amazon CloudFront and AWS WAF rate-based rules.
Tahmini Süre:1m 30s
Soru 1035Soru →

A solutions architect is designing a high-performance database tier for a real-time ride-sharing dispatch application. The application must ingest up to 15,00015,000 write operations per second to continuously record coordinate updates from active drivers. At the same time, the system must support high-frequency read queries to locate nearby drivers with sub-millisecond latency. The application workload is highly unpredictable, with sudden traffic surges occurring during rush hours.

Which combination of database configurations will meet these performance and scaling requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Amazon DynamoDB table with a partition key of driver_id to distribute the write throughput evenly across multiple physical partitions.; Deploy Amazon DynamoDB Accelerator (DAX) to cache read requests for driver coordinates, reducing read latency to microseconds.

Cevap

Configure the Amazon DynamoDB table with a partition key of driver_id to distribute write throughput, and deploy Amazon DynamoDB Accelerator (DAX) to cache read requests for driver coordinates.
Configuring the Amazon DynamoDB table with a high-cardinality partition key like driver ID ensures that writes are distributed evenly across physical partitions, avoiding hot partitions and write bottlenecks. Utilizing Amazon DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read latencies for driver coordinates to the microsecond range, fulfilling the requirement for sub-millisecond reads.

Adım Adım Çözüm

1
Analyze write performance and partition design requirements.
Identify that the system requires up to 15,00015,000 writes per second. A partition key with high cardinality (such as driver_id) is necessary to distribute write operations across multiple physical partitions and prevent hot partitions.
High cardinality keys prevent write throughput throttling and optimize DynamoDB partition usage.
2
Analyze read latency requirements.
Identify that the application needs sub-millisecond read latency. Adding Amazon DynamoDB Accelerator (DAX) caches read operations and brings read latency down to microseconds.
DAX acts as an in-memory write-through cache designed specifically to accelerate DynamoDB reads.
3
Evaluate workload predictability and scaling.
Understand that the workload is highly unpredictable. Provisioned capacity with fixed units or using standard relational databases with read replicas for write scaling is incorrect or inefficient.
Ensures the architecture choice scales dynamically with unpredictable spikes and avoids throttling.

Anahtar Kavram

Selecting and configuring high-performing databases to support high write throughput and sub-millisecond read latencies under unpredictable workloads.
Soru 1036Soru →

A gaming company is deploying a new multiplayer gaming lobby API on AWS. The company needs to protect the API endpoint against distributed denial of service (DDoS) attacks at the network layer, and block malicious Layer 7 request patterns such as HTTP floods. Which combination of AWS services should a Solutions Architect recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS WAF to analyze and block malicious application-layer (Layer 7) web requests.; AWS Shield Advanced to provide automatic mitigation against distributed denial of service (DDoS) attacks at the network and transport layers (Layer 3 and 4).

Cevap

The correct services are AWS WAF and AWS Shield Advanced.
To satisfy both requirements, the Solutions Architect should recommend AWS WAF and AWS Shield Advanced. AWS WAF protects the API endpoint at the application layer (Layer 7) by inspecting incoming request characteristics and implementing rate limits. AWS Shield Advanced protects resources against Layer 3 and Layer 4 volumetric attacks, ensuring infrastructure-level availability.

Adım Adım Çözüm

1
Analyze the requirement for blocking application-layer (Layer 7) attacks, such as HTTP floods.
Identify AWS WAF as the service designed to inspect HTTP/HTTPS payloads and execute rate-based blocking.
AWS WAF operates at Layer 7 and can inspect headers, query strings, and request rates.
2
Analyze the requirement for blocking infrastructure-layer (Layer 3 and 4) DDoS attacks.
Identify AWS Shield Advanced as the service designed to mitigate volumetric network-layer attacks.
AWS Shield Advanced offers tailored detection and automatic mitigation against L3/L4 DDoS attacks on endpoints.

Anahtar Kavram

AWS Edge Security and DDoS Mitigation Layer Separation
Soru 1037Soru →

A company's security team identifies malicious traffic originating from a single public IP address (198.51.100.45198.51.100.45). A solutions architect must immediately block all incoming traffic from this specific IP address to an entire public subnet. Which of the following actions should the solutions architect take to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Add an inbound deny rule for the malicious IP address in the Network Access Control List (Network ACL) associated with the public subnet.

Cevap

Add an inbound deny rule for the malicious IP address in the Network Access Control List (Network ACL) associated with the public subnet.
The correct answer describes adding an inbound deny rule to the Network ACL associated with the public subnet. Network ACLs operate at the subnet level and are stateless, allowing Solutions Architects to define both allow and deny rules. This allows for blocking a single malicious IP address from reaching any resource inside the subnet.

Adım Adım Çözüm

1
Determine the scope of the restriction.
The requirement is to block traffic at the subnet level, rather than individual instances.
This helps determine whether to use an instance-level control (Security Group) or a subnet-level control (Network ACL).
2
Evaluate filtering rules capability.
To block a specific IP address, an explicit deny rule is required. Security Groups only support allow rules, while Network ACLs support both allow and deny rules.
Since the goal is to deny traffic, the solutions architect must use a Network ACL.
3
Apply the configuration.
Add an inbound rule in the Network ACL with a rule number lower than the default allow rule, targeting the IP address 198.51.100.45/32198.51.100.45/32 with a DENY action.
Network ACL rules are evaluated in order of rule numbers, so placing the deny rule first ensures that the traffic is rejected before hitting generic allow rules.

Anahtar Kavram

Subnet-level traffic filtering using Network ACLs
Soru 1038Soru →

An enterprise is designing a multi-account strategy using AWS Organizations. An application running on Amazon ECS tasks in the Production Account (Account A) must retrieve database credentials from AWS Secrets Manager in the Security Account (Account B). The secret in Account B is encrypted using a customer managed KMS key. The development team must also be federated into both accounts using their corporate Identity Provider (IdP) to manage these workloads. The architecture must satisfy security audits, enforce automatic rotation of credentials, and adhere to the principle of least privilege. Which combination of actions should the solutions architect take to meet these requirements securely? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure AWS IAM Identity Center integrated with the corporate SAML 2.0 Identity Provider (IdP) to manage console access, and assign developers to appropriate permission sets in both Account A and Account B.; Attach an IAM role to the ECS task definition in Account A that grants permissions to retrieve the secret and decrypt with the KMS key. In Account B, update the resource-based policy of the secret and the key policy of the KMS key to permit access from the ECS task IAM role.

Cevap

To meet the requirements, the solutions architect should configure AWS IAM Identity Center integrated with the corporate SAML 2.0 Identity Provider (IdP) to manage console access, and attach an IAM role to the ECS task definition in Account A that has permission to retrieve the secret and decrypt using the KMS key, while configuring the resource-based policy of the secret and the KMS key policy in Account B to trust the ECS task role.
The correct solution involves setting up AWS IAM Identity Center for federated single sign-on access to eliminate the need for local IAM users, and establishing cross-account access by combining identity-based policies (ECS task role) in the source account with resource-based policies (the secret and KMS key policies) in the target account.

Adım Adım Çözüm

1
Configure AWS IAM Identity Center integrated with the corporate SAML 2.0 IdP.
Developers can single sign-on to multiple AWS accounts (Account A and Account B) using temporary credentials instead of long-term IAM user access keys.
This satisfies security audits and complies with the best practice of avoiding long-term access credentials.
2
Create an IAM role in Account A, attach permissions to access Secrets Manager and KMS decrypt, and assign this role as the ECS Task Role in the task definition.
The application containers run with the specific IAM identity containing only the permissions required to retrieve the secret.
This adheres to the principle of least privilege by avoiding giving permissions to the ECS container instance profile.
3
Configure resource-based policies in Account B for the Secrets Manager secret and the Customer Managed KMS Key to trust the ECS Task Role ARN from Account A.
The ECS Task in Account A is authorized to read the secret in Account B and decrypt the ciphertext.
Cross-account access requires permissions to be granted on both the identity-based policy (ECS task role) and the resource-based policies (KMS key policy and Secrets Manager secret policy).

Anahtar Kavram

Cross-account access delegation using IAM roles, resource policies, KMS key policies, and IAM Identity Center federation.
Soru 1039Soru →

An enterprise architecture consists of a primary production workload running on Amazon ECS in the us-east-1 region, and a testing suite running in a secondary development AWS account. The production ECS tasks must connect to a Multi-AZ Amazon Aurora PostgreSQL database. The security policy mandates that database credentials must be rotated every 30 days without application downtime, and all sensitive data at rest must be encrypted using a customer managed key (CMK). Additionally, a non-sensitive configuration file containing public API endpoints must be shared with the testing suite in the development account. The operations team wants to implement these requirements while minimizing ongoing AWS costs and administrative overhead. Which design meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days using the AWS-provided rotation Lambda function. Encrypt the secret using a KMS customer managed key (CMK). Store the non-sensitive public API endpoints as standard String parameters in Systems Manager Parameter Store, and allow the development account to access them by assuming a cross-account IAM role in the production account.

Cevap

Store the database credentials in AWS Secrets Manager with automatic rotation enabled using the AWS-provided rotation Lambda function, and encrypt them with a KMS customer managed key (CMK). Store the non-sensitive public API endpoints as standard String parameters in Systems Manager Parameter Store, and share them with the development account using a cross-account IAM role.
The correct solution uses AWS Secrets Manager for the database credentials, which supports native, automated rotation via Lambda for Aurora PostgreSQL and integrates with KMS for encryption at rest. For the non-sensitive public API endpoints, using Systems Manager Parameter Store standard String parameters is the most cost-effective approach since standard parameters are free. Since Parameter Store does not support resource-based policies, sharing them with the development account is securely accomplished by having the development account assume a cross-account IAM role.

Adım Adım Çözüm

1
Select the appropriate storage for database credentials.
Database credentials must be stored in AWS Secrets Manager to support automated rotation using the built-in RDS/Aurora rotation Lambda templates.
Systems Manager Parameter Store does not natively support automated database credential rotation templates, and using Secrets Manager meets the 30-day rotation security requirement with minimal operational overhead.
2
Ensure encryption of the sensitive credentials.
Encrypt the Secrets Manager secret using an AWS KMS customer managed key (CMK) to comply with the encryption at rest mandate.
Customer managed keys provide granular control over key rotation and access policies.
3
Optimize costs for non-sensitive data and share it cross-account.
Store public API endpoints as standard String parameters in Systems Manager Parameter Store, and allow cross-account access by assuming an IAM role.
Standard String parameters in Systems Manager Parameter Store are free, avoiding the cost of storing non-sensitive data in Secrets Manager. Since Parameter Store does not support resource-based policies, a cross-account IAM role in the production account must be assumed by the dev account.

Anahtar Kavram

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on rotation capabilities, cost optimization, and cross-account access mechanisms.
Soru 1040Soru →

A company is transitioning to a multi-account environment managed by AWS Organizations. The solutions architect is designing a centralized identity and governance strategy. The company plans to federate its corporate identity provider with AWS IAM Identity Center. The security team requires that no local IAM users or programmatic access keys be created within any member accounts, except for a pre-authorized emergency break-glass role. The management account must remain unaffected to ensure emergency access is not locked out. Which strategy should the solutions architect recommend to meet these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Create a Service Control Policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions unless the caller is the emergency break-glass role, and attach this SCP to the Organizational Units containing the member accounts.

Cevap

Create a Service Control Policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions unless the caller is the emergency break-glass role, and attach this SCP to the Organizational Units containing the member accounts.
The correct strategy uses AWS Organizations Service Control Policies (SCPs) to establish permission guardrails across Organizational Units (OUs) containing member accounts. By applying a condition that excludes the emergency break-glass role, the exception is maintained. Because SCPs do not restrict the management account, it remains unaffected by design, ensuring emergency access is preserved.

Adım Adım Çözüm

1
Identify the governance requirement to restrict local IAM user and credential creation across member accounts while leaving the management account unaffected.
Realized that Service Control Policies (SCPs) applied at the Organizational Unit (OU) level are the standard mechanism to restrict permissions globally across target accounts without impacting the management account.
SCPs cannot restrict the management account itself, making them ideal to enforce policies on member accounts while leaving the management account unrestricted.
2
Formulate the policy rule to deny the specific IAM actions (iam:CreateUser and iam:CreateAccessKey).
Created a deny statement targeting the specific creation APIs.
This directly prevents the creation of local IAM users and long-term credentials.
3
Apply a condition to allow an exception for the emergency break-glass role.
Added a StringNotLike or StringNotEquals condition checking the caller's ARN against the break-glass role ARN.
This ensures the emergency recovery path remains functional even when the policy is active.

Anahtar Kavram

Enforcing security guardrails across multiple AWS accounts in an organization using Service Control Policies (SCPs) combined with AWS IAM Identity Center for centralized federation.
ÖncekiSayfa 52 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Associate | Examkin