Examkin

Tüm alıştırma soruları

1462 soru

Tüm türler1,462Çoktan seçmeli739Çoklu seçim723
Soru 121Soru →

A company manages a multi-account environment under AWS Organizations. During a monthly billing cycle review, the operations team discovered that a development team had accidentally left high-cost Amazon EC2 instances running over the weekend, resulting in a significant cost overrun. The company needs a solution that automatically detects unusual or sudden cost spikes and alerts the team within 24 hours of occurrence, without requiring manual configuration of static thresholds for every AWS service.

Which solution should a Solutions Architect implement to meet these requirements with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Configure AWS Cost Anomaly Detection with an AWS Organization monitor type, and define an alert subscription to notify the operations team via an Amazon SNS topic.

Cevap

Configure AWS Cost Anomaly Detection with an AWS Organization monitor type, and define an alert subscription to notify the operations team via an Amazon SNS topic.
The correct solution uses AWS Cost Anomaly Detection, which leverages machine learning to dynamically monitor cost patterns across the entire AWS Organization. This requires minimal administrative effort because it does not require defining static budget thresholds for each service or account. Alerts are sent automatically via Amazon SNS within 24 hours of anomaly detection.

Adım Adım Çözüm

1
Evaluate the need for dynamic anomaly detection.
Identify that static budgets (AWS Budgets) are not requested because the scenario requires detection without manual configuration of static thresholds.
Static budgets require defining fixed thresholds, which increases administrative effort and might miss anomalies that do not exceed the overall budget.
2
Compare proactive alert capabilities of cost tools.
Select AWS Cost Anomaly Detection over AWS Cost Explorer reports.
AWS Cost Anomaly Detection uses machine learning to automatically detect unexpected spikes and send alerts within 24 hours. AWS Cost Explorer is meant for retrospective analysis and does not support real-time proactive alerting.
3
Ensure organization-wide coverage with minimal overhead.
Use the AWS Organization monitor type linked to Amazon SNS.
This configuration monitors all member accounts automatically, alerting the operations team via SNS without needing custom polling scripts or lambda functions.

Anahtar Kavram

AWS Cost Anomaly Detection uses machine learning to dynamically detect unusual spending patterns across all AWS accounts in an organization and proactively alert teams without the administrative overhead of setting up static budgets.
Soru 122Soru →

An IoT fleet management company is deploying a new tracking solution where thousands of vehicles send location telemetry data every second. The database must ingest this write-heavy workload with low latency. Which two strategies should a solutions architect recommend to optimize write performance and prevent database throttling? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use the vehicle ID as the partition key and the timestamp as the sort key for the Amazon DynamoDB table.; Configure Amazon DynamoDB on-demand capacity mode or enable auto-scaling for provisioned write capacity.

Cevap

The solutions architect should use the vehicle ID as the partition key and the timestamp as the sort key to distribute partition traffic, and configure on-demand capacity or auto-scaling to dynamically scale write capacity.
Using the vehicle ID as the partition key distributes write operations evenly across multiple partitions. Combined with on-demand capacity or auto-scaling, the database adapts to traffic changes dynamically, maintaining high performance under heavy load.

Adım Adım Çözüm

1
Analyze write distribution requirements.
Identify that using a high-cardinality key like vehicle ID prevents hot partitions.
DynamoDB partitions data based on the partition key; even distribution of partition keys prevents single-partition bottlenecks.
2
Evaluate scaling mechanisms for write capacity.
Select auto-scaling or on-demand mode to dynamically adjust write throughput.
Static capacity mode fails to adapt to fluctuating traffic levels, causing throttled requests during peaks.

Anahtar Kavram

High-performing write workloads in DynamoDB require high-cardinality partition keys and elastic scaling modes (auto-scaling or on-demand) to avoid partition-level bottlenecks and capacity-based throttling.
Soru 123Soru →

A software-as-a-service (SaaS) company hosts its customer relationship management (CRM) application on AWS, utilizing an Amazon RDS for PostgreSQL DB instance for the transactional database. The company needs to design a database architecture that ensures high availability within the region to survive an Availability Zone (AZ) outage with a Recovery Time Objective (RTO) of less than 2 minutes and a Recovery Point Objective (RPO) of 0. Additionally, the database must be able to scale to handle a high volume of read-only reporting queries during business hours without impacting write performance. Which database configuration meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the RDS DB instance as a Multi-AZ deployment, and create one or more RDS Read Replicas in different Availability Zones to handle the read-only reporting traffic.

Cevap

Configure the RDS DB instance as a Multi-AZ deployment, and create one or more RDS Read Replicas in different Availability Zones to handle the read-only reporting traffic.
The correct configuration uses RDS Multi-AZ to achieve high availability with synchronous replication to a standby instance in another AZ, enabling automatic failover with zero data loss (RPO of 0) and low downtime (RTO of less than 2 minutes). Creating Read Replicas offloads read traffic to separate endpoints, scaling read performance without affecting the primary writer instance.

Adım Adım Çözüm

1
Evaluate the high availability (HA) requirements.
To meet an RTO of less than 2 minutes and an RPO of 0 (no data loss) during an AZ outage, a Multi-AZ deployment is required because it uses synchronous replication to a standby instance in another AZ and performs automatic failover.
Single-AZ deployments or asynchronous read replicas cannot guarantee zero data loss or automatic failover within the required RTO.
2
Evaluate the read-scaling requirements.
To scale read-only reporting queries without affecting the primary writer instance, RDS Read Replicas must be deployed.
Read replicas utilize asynchronous replication to process read-only queries, freeing up resources on the primary DB instance.
3
Combine the HA and read-scaling configurations.
The final architecture requires a Multi-AZ deployment for HA and automatic failover, coupled with Read Replicas to offload read-only queries.
This combination successfully satisfies both resilience and performance scaling constraints.

Anahtar Kavram

Amazon RDS Multi-AZ deployments provide high availability and automatic failover, while Read Replicas provide horizontal scaling for read-heavy workloads.
Tahmini Süre:1m 30s
Soru 124Soru →

A company has configured an AWS Organizations environment with a production account and a security auditing account. A solutions architect is setting up secure, cross-account access for a containerized application running on Amazon Elastic Container Service (Amazon ECS) in the production account. The application must read compliance report files stored in a private Amazon S3 bucket within the security auditing account. The architect needs to implement a solution that adheres to the principle of least privilege and avoids the use of long-term credentials. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the ECS task role in the production account that allows the s3:GetObject action on the S3 bucket in the security auditing account.; Modify the bucket policy of the S3 bucket in the security auditing account to allow the s3:GetObject action for the Amazon Resource Name (ARN) of the ECS task role in the production account.

Cevap

To securely implement cross-account access, the solutions architect should attach an IAM policy to the ECS task role in the production account allowing s3:GetObject, and modify the destination S3 bucket's resource policy in the auditing account to allow the s3:GetObject action for the production account's ECS task role ARN.
For cross-account access to Amazon S3, both the IAM identity policy (attached to the ECS task role in the source account) and the S3 bucket policy (resource policy in the destination account) must explicitly allow the operation. This avoids the use of long-term credentials by leveraging temporary credentials generated when the ECS task assumes its execution role.

Adım Adım Çözüm

1
Configure the identity-based policy in the source account.
Attach an IAM policy to the ECS task role in the production account that allows the s3:GetObject action on the target S3 bucket.
The IAM principal in the production account must have outbound permission to access the destination resource.
2
Configure the resource-based policy in the destination account.
Add a bucket policy to the S3 bucket in the security auditing account that allows the s3:GetObject action, specifying the ECS task role ARN from the production account as the Principal.
Since S3 cross-account access is being set up, the resource-based policy in the destination account must explicitly permit the access from the external account's principal.

Anahtar Kavram

Cross-account access to S3 resources requires explicit permissions on both the identity-based policy in the source account and the resource-based bucket policy in the destination account, utilizing temporary security credentials.
Soru 125Soru →

A company has two AWS accounts: Account A for application workloads and Account B for centralized data storage. An application running on Amazon ECS tasks in Account A needs to write logs and data to an Amazon S3 bucket in Account B. The S3 bucket is encrypted using an AWS Key Management Service (AWS KMS) customer managed key also located in Account B. The company's security policy requires that all access must follow the principle of least privilege, and no long-term credentials can be stored. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the ECS task role in Account A that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the KMS key in Account B.; In Account B, configure the S3 bucket policy to allow the ECS task role from Account A to perform the s3:PutObject action, and update the KMS key policy to allow the same role to perform the kms:GenerateDataKey action.

Cevap

Attach an IAM policy to the ECS task role in Account A that allows the required S3 and KMS actions, and in Account B, update the S3 bucket policy and KMS key policy to explicitly trust the ECS task role ARN from Account A.
To establish secure cross-account access without long-term credentials, the ECS task role in Account A must be granted permissions via an IAM policy to write to the S3 bucket and generate data keys. Simultaneously, the resource policies (the S3 bucket policy and the KMS customer managed key policy) in Account B must be configured to trust the specific ECS task role ARN and permit the same actions. This bi-directional permission setup allows direct cross-account access using temporary security credentials.

Adım Adım Çözüm

1
Identify the proper IAM role for ECS containerized application runtime permissions.
Select the ECS task role as the identity to attach access permissions to.
The ECS task role is utilized by the application running inside the container, whereas the task execution role is used only by the ECS container agent for infrastructure tasks.
2
Configure the client-side IAM policy in Account A.
Attach a policy to the ECS task role in Account A permitting `s3:PutObject` on the S3 bucket in Account B and `kms:GenerateDataKey` on the Customer Managed Key (CMK) in Account B.
The initiating IAM identity must have explicit permission to access the target cross-account resources.
3
Configure the resource-based policies in Account B.
Modify the S3 bucket policy and the KMS key policy in Account B to allow the ECS task role ARN from Account A to write data and generate data keys.
Cross-account access requires authorization from both the identity policy in the source account and the resource policies in the destination account. AWS Managed Keys cannot be modified for cross-account access, necessitating a Customer Managed Key.

Anahtar Kavram

Cross-account access to S3 and KMS requires configuration of both the IAM identity policies in the source account and resource policies (bucket and key policies) in the destination account, using temporary role credentials instead of long-term credentials.
Soru 126Soru →

A company is setting up a new multi-account AWS environment using AWS Organizations. The company wants to implement centralized user authentication that integrates with their existing corporate identity provider. Additionally, they need to enforce a security policy that prevents any administrator in the member accounts from deleting Amazon S3 buckets that store access logs.

Which combination of AWS services or features will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: AWS IAM Identity Center federated with the corporate identity provider for centralized user access; Service Control Policies (SCPs) in AWS Organizations to deny the deletion of the log buckets across member accounts

Cevap

Configure AWS IAM Identity Center federated with the corporate identity provider for centralized user access, and apply Service Control Policies (SCPs) in AWS Organizations to deny the deletion of the log buckets across member accounts.
Centralized user access across multiple AWS accounts should be implemented using AWS IAM Identity Center federated with the external identity provider. To enforce administrative compliance and prevent critical resource deletion (such as S3 access log buckets) across member accounts, Service Control Policies (SCPs) must be attached to the appropriate Organizational Units (OUs) or accounts in AWS Organizations.

Adım Adım Çözüm

1
Identify the requirement for centralized identity management and federation.
Determine that AWS IAM Identity Center is the standard service for federating an external identity provider with multiple AWS accounts.
This centralizes authentication control and avoids the need to manage individual credentials in each account.
2
Identify the requirement to restrict actions (bucket deletion) across all member accounts, including for administrators.
Determine that Service Control Policies (SCPs) in AWS Organizations can enforce maximum permission limits (guardrails) across accounts.
SCPs apply to all users and roles in the member accounts, including the root user, ensuring administrative compliance.

Anahtar Kavram

Centralized multi-account governance is achieved by combining federated access management via AWS IAM Identity Center with Organization-level guardrails using Service Control Policies (SCPs).
Soru 127Soru →

A logistics company runs a fleet tracking application on Amazon EC2 instances in AWS Account A. The application must write daily transaction logs to an Amazon S3 bucket located in AWS Account B. The S3 bucket is configured with default encryption using an AWS KMS customer managed key (CMK) owned by Account B. The solutions architect must implement a secure, cross-account access solution that adheres to the principle of least privilege and avoids long-term security credentials. Which combination of steps will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role to the EC2 instances in Account A. Grant the role permissions to perform s3:PutObject on the S3 bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B. In Account B, configure the S3 bucket policy to allow the IAM role to perform s3:PutObject, and configure the CMK key policy to allow the IAM role to perform kms:GenerateDataKey.

Cevap

Attach an IAM role to the EC2 instances in Account A. Grant the role permissions to perform s3:PutObject on the S3 bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B. In Account B, configure the S3 bucket policy to allow the IAM role to perform s3:PutObject, and configure the CMK key policy to allow the IAM role to perform kms:GenerateDataKey.
The correct solution involves attaching an IAM role to the EC2 instances in Account A to provide temporary security credentials. The role is granted permission to write to Account B's bucket and generate data keys from Account B's customer managed key (CMK). In Account B, both the S3 bucket policy and the KMS key policy must trust the specific IAM role from Account A to allow the cross-account upload and encryption operations.

Adım Adım Çözüm

1
Create and attach an IAM role to the Amazon EC2 instances in Account A to generate temporary security credentials.
The EC2 instances obtain temporary AWS credentials with the identity of the assumed role.
This avoids using long-term credentials (like IAM user access keys) and conforms to security best practices.
2
Assign IAM permissions to the role in Account A to write to the S3 bucket and to use the KMS key in Account B.
The local IAM role has the necessary permissions to initiate the upload and request key generation.
For cross-account access, the requesting account must grant the permission locally, in addition to the resource-level permissions in the destination account.
3
Update the S3 bucket policy in Account B to allow the IAM role in Account A to execute s3:PutObject.
Account B explicitly trusts the Account A IAM role to write objects to the S3 bucket.
Cross-account access to S3 requires the bucket owner to trust the external IAM principal via a bucket policy.
4
Configure the KMS key policy on the CMK in Account B to allow the IAM role in Account A to call kms:GenerateDataKey.
Account B allows the Account A IAM role to request a data key from KMS to encrypt the log files.
Since the bucket uses default KMS CMK encryption, the external role must have permissions on the KMS key policy to perform key operations.

Anahtar Kavram

Cross-account access to S3 buckets encrypted with a KMS Customer Managed Key requires IAM policies, S3 bucket policies, and KMS key policies to align and explicitly trust the calling IAM principal using temporary credentials.
Soru 128Soru →

A technology company hosts a containerized catalog API on Amazon EC2 instances within a private subnet. The instances are managed by an Auto Scaling group and are registered with an Application Load Balancer (ALB) that resides in a public subnet. The API service runs on port 8080. The target group is configured to perform health checks on port 8080. The security group of the EC2 instances is configured to allow inbound traffic on port 8080 from the ALB's security group. To meet security requirements, a network administrator applied a custom Network ACL to the private subnet, adding an inbound rule that allows traffic on port 8080 from the ALB's subnet. However, the health checks are now failing, and the ALB reports all EC2 instances as unhealthy. Which action should the solutions architect take to resolve the health check failure?

Cevabı ve açıklamayı göster

Cevap: Add an outbound rule to the private subnet's Network ACL to allow traffic to the ephemeral ports of the Application Load Balancer's subnet.

Cevap

Add an outbound rule to the private subnet's Network ACL to allow traffic to the ephemeral ports of the Application Load Balancer's subnet.
The correct option is to add an outbound rule to the private subnet's Network ACL. Since Network ACLs are stateless, allowing inbound traffic on port 8080 is not sufficient; the return traffic from the EC2 instances (source port 8080) to the ALB (destination ephemeral ports 1024-65535) must be explicitly permitted by an outbound rule on the private subnet's Network ACL.

Adım Adım Çözüm

1
Analyze the network configuration of the Application Load Balancer (ALB) and EC2 instances.
The ALB is in a public subnet, and the EC2 instances are in a private subnet. The EC2 instances listen on port 8080, which is also the target group port and the health check port.
Understanding the traffic flow helps locate where the network packet is blocked.
2
Evaluate the stateful and stateless components in the communication path.
Security groups are stateful, so inbound traffic allowed on port 8080 will automatically allow outbound return traffic. Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed.
Since a custom Network ACL was applied, both incoming requests and outgoing responses must have matching rules.
3
Determine the required outbound rule for the Network ACL.
The load balancer sends health check requests from ephemeral ports (1024-65535) to port 8080 on the instances. When the instances reply, the return traffic is sent from port 8080 back to the load balancer's ephemeral ports. Therefore, the private subnet's Network ACL needs an outbound rule allowing traffic to the ALB subnet on ephemeral ports.
This completes the stateless return path, allowing the health check to succeed.

Anahtar Kavram

Network ACLs are stateless firewall rules at the subnet level, meaning that return traffic must be explicitly allowed via outbound rules, whereas Security Groups are stateful and allow return traffic automatically.
Tahmini Süre:1m 30s
Soru 129Soru →

A retail company hosts a customer-facing e-commerce application on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. For disaster recovery (DR), the company has deployed a scaled-down standby environment in the us-west-2 Region with a standby ALB. The company wants to implement an active-passive disaster recovery strategy where Route 53 automatically redirects all incoming traffic to the standby ALB in us-west-2 only if the application in us-east-1 is unhealthy. The target Recovery Time Objective (RTO) is less than 2 minutes. Which TWO configurations must the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Route 53 Failover Alias record for the primary ALB, setting the routing policy to Primary and Evaluate Target Health to Yes.; Create a Route 53 Failover Alias record for the standby ALB, setting the routing policy to Secondary and Evaluate Target Health to Yes.

Cevap

Create a Route 53 Failover Alias record for the primary ALB, setting the routing policy to Primary and Evaluate Target Health to Yes; and create a Route 53 Failover Alias record for the standby ALB, setting the routing policy to Secondary and Evaluate Target Health to Yes.
To configure active-passive failover with Amazon Route 53, a solutions architect should create two failover records: one primary and one secondary. By using Alias records pointing to the Application Load Balancers (ALBs) and enabling the 'Evaluate Target Health' option, Route 53 automatically monitors the health of the targets in the target groups. If the targets behind the primary ALB fail their health checks, Route 53 will automatically stop routing traffic to the primary ALB and begin routing it to the secondary standby ALB, keeping failover time minimal and meeting the recovery time objective.

Adım Adım Çözüm

1
Analyze the disaster recovery requirement.
The requirements demand an active-passive cross-region failover strategy with an RTO of less than 2 minutes.
This establishes that we need a fast DNS-based failover mechanism using Route 53 and a warm standby environment that is ready to accept traffic immediately.
2
Select the appropriate routing policy.
Amazon Route 53 Failover routing policy is designed specifically for active-passive configurations.
Other routing policies like Latency routing are intended for active-active configurations rather than strict active-passive failover.
3
Configure health checks and target evaluation.
Configure Primary and Secondary Failover Alias records pointing to the respective ALBs with 'Evaluate Target Health' set to Yes.
Setting 'Evaluate Target Health' to Yes on the Alias records allows Route 53 to check the health of the backend EC2 targets behind the ALBs directly, enabling rapid failover within the RTO budget without requiring manually created external health checks.

Anahtar Kavram

Amazon Route 53 Active-Passive Failover Routing
Soru 130Soru →

A media streaming company is designing a cost-optimized architecture on AWS. The application consists of a web portal and API tier running on Amazon EC2 instances 24/7 with a predictable resource baseline, a video transcoding service on EC2 instances that processes user uploads dynamically and is fault-tolerant, and an Amazon RDS for PostgreSQL database. The transcoding service transfers large volumes of video data to and from Amazon S3. Which combination of strategies will provide the most cost-effective compute and data transfer architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Purchase a Compute Savings Plan to cover the baseline EC2 instances running the web portal and API tier.; Deploy the video transcoding service on EC2 Spot Instances managed by an Auto Scaling group.

Cevap

Deploying the video transcoding service on EC2 Spot Instances and purchasing a Compute Savings Plan to cover the baseline EC2 instances running the web portal and API tier.
The correct strategy combines a Compute Savings Plan for the predictable 24/7 web portal and API tier with EC2 Spot Instances for the stateless, fault-tolerant transcoding service. Compute Savings Plans provide automatic discounts on EC2 instances, while Spot Instances offer the highest discounts for workloads that can handle interruptions.

Adım Adım Çözüm

1
Analyze the web portal and API workload characteristics.
Identified as a 24/7 running compute workload with a predictable baseline.
This steady-state compute requirement makes it eligible and optimal for a Compute Savings Plan, which offers a discount in exchange for a continuous usage commitment.
2
Analyze the video transcoding workload characteristics.
Identified as a stateless, fault-tolerant, and dynamically scaling workload.
Because the transcoding service can handle interruptions, it is an ideal candidate for EC2 Spot Instances, which provide the maximum discount rate.
3
Evaluate the database and data transfer components for cost optimization.
Determined that RDS cannot be covered by Compute Savings Plans and that NAT Gateways introduce unnecessary data processing fees for high-volume S3 transfers.
This rules out the incorrect options and confirms that a S3 Gateway Endpoint and RDS Reserved Instances should be used for those specific components.

Anahtar Kavram

Selecting cost-optimized compute purchasing models (Savings Plans, Spot Instances) and avoiding expensive data transfer paths for predictable and interruptible workloads.
Tahmini Süre:2m 0s
Soru 131Soru →

A company operates a smart home IoT platform where millions of devices send status updates to an Amazon DynamoDB table. Users query their device's latest status through a mobile dashboard, leading to high-volume, repetitive read queries on the same partition keys. During peak hours, these queries cause hot partition throttling and increase read latency. The company needs to resolve the performance bottleneck and reduce read response times to microseconds without changing the database query code. Which solution should a solutions architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon DynamoDB Accelerator (DAX) cluster and update the application client to route requests to the cluster.

Cevap

The correct solution is to deploy an Amazon DynamoDB Accelerator (DAX) cluster and update the application client to route requests to the cluster.
Deploying Amazon DynamoDB Accelerator (DAX) provides an in-memory cache that reduces DynamoDB response times to microseconds. Because DAX is API-compatible, the application only needs to update its client initialization rather than its query logic, fulfilling all constraints.

Adım Adım Çözüm

1
Identify the performance bottleneck and key requirements: microsecond response times and no changes to database query code.
The target is a caching solution that is transparent/API-compatible with DynamoDB.
We must reduce latency from milliseconds to microseconds without rewriting application query code.
2
Evaluate Amazon DynamoDB Accelerator (DAX) against these requirements.
DAX is an in-memory cache for DynamoDB that requires only a client SDK change, not a query logic rewrite.
DAX meets the API-compatibility and performance requirements directly.
3
Rule out sub-optimal configurations and anti-patterns such as monotonic keys, over-provisioning RCUs, or CloudFront bypass.
Alternative options either worsen the partition heat, increase cost needlessly, or bypass caching entirely.
This confirms DAX as the only correct architectural choice.

Anahtar Kavram

Database query caching using Amazon DynamoDB Accelerator (DAX) for sub-millisecond latencies.
Soru 132Soru →

A company hosts a web application on Amazon EC2 instances managed by an Auto Scaling group. The instances are registered as targets under an Application Load Balancer (ALB) that handles SSL termination. Users intermittently report receiving "502 Bad Gateway" errors when accessing the application. A solutions architect discovers that the ALB target group has marked several EC2 instances as unhealthy, but the Auto Scaling group still shows the instances as healthy and continues to route traffic to them. Which configuration change will ensure that the Auto Scaling group automatically terminates and replaces the unhealthy instances?

Cevabı ve açıklamayı göster

Cevap: Update the Auto Scaling group's health check type configuration from EC2 to ELB.

Cevap

Update the Auto Scaling group's health check type configuration from EC2 to ELB.
The correct answer is to update the Auto Scaling group's health check type configuration from EC2 to ELB. By default, an Auto Scaling group only performs EC2 status checks (system and instance status checks). If the application server fails but the OS remains running, the Auto Scaling group will consider the instance healthy. Setting the health check type to ELB configures the Auto Scaling group to also check the health of the instances in the Application Load Balancer target group, causing it to automatically terminate and replace instances that fail the ALB health check.

Adım Adım Çözüm

1
Analyze the mismatch between the load balancer target group health status and the Auto Scaling group health status.
By default, an Auto Scaling group only monitors EC2 status checks (the health check type is set to EC2). It does not monitor the health of the application running behind the Application Load Balancer.
This explains why the Auto Scaling group considers the instances healthy even though the ALB target group has marked them as unhealthy due to application-level failures.
2
Identify the correct configuration update to bind the Auto Scaling group health checks to the load balancer target group health checks.
Changing the Auto Scaling group health check type to ELB ensures the Auto Scaling group monitors the target group's health checks.
This configuration allows the Auto Scaling group to detect when an instance fails the target group's application-level health check, prompting it to replace the instance.

Anahtar Kavram

Auto Scaling Group Health Checks (EC2 vs. ELB)
Tahmini Süre:1m 30s
Soru 133Soru →

An enterprise is deploying a microservices application on Amazon ECS using the AWS Fargate launch type. The application requires access to two sensitive values: a database password for an Amazon Aurora PostgreSQL DB cluster, and a static API key for a third-party payment provider. The security requirements mandate that: 1. The database password must be rotated automatically every 30 days. 2. The third-party API key must be encrypted at rest and retrieved securely by the ECS tasks at startup, but it does not require rotation. 3. Access to all credentials must be monitored and audited. 4. The architecture must minimize operational complexity and cost. Which approach meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS. Store the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter, and reference this parameter in the container definition of the Amazon ECS task definition.

Cevap

Store the database password in AWS Secrets Manager with built-in RDS rotation, and store the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter injected into the ECS tasks at startup.
The correct architecture uses AWS Secrets Manager for the Aurora PostgreSQL password because it natively integrates with RDS to handle database credential rotation automatically without code changes or operational overhead. It uses AWS Systems Manager Parameter Store with a SecureString parameter for the payment provider API key because it does not require rotation, making Parameter Store a more cost-effective solution. Referencing the Parameter Store SecureString in the ECS task definition ensures the secret is fetched at task startup and injected as an environment variable, minimizing runtime API costs and latency.

Adım Adım Çözüm

1
Select the storage and rotation mechanism for the database password.
AWS Secrets Manager is selected.
Secrets Manager provides native, out-of-the-box integration with Amazon RDS and Aurora for automated 30-day password rotation, eliminating the need to write and maintain custom Lambda functions.
2
Select the storage and retrieval mechanism for the static third-party API key.
AWS Systems Manager Parameter Store with a SecureString parameter is selected.
Parameter Store SecureString encrypts data at rest using AWS KMS. Since the API key does not require rotation, Parameter Store is a highly cost-effective choice compared to Secrets Manager.
3
Configure the retrieval pattern for the API key to optimize ECS task performance and costs.
Inject the Parameter Store parameter as an environment variable in the ECS task definition.
By referencing the parameter in the ECS task definition container properties, Fargate retrieves the value during container initialization. This prevents the application from making repeated, costly runtime API calls to Parameter Store for every transaction.

Anahtar Kavram

Selecting and integrating Secrets Manager and Systems Manager Parameter Store based on automatic rotation needs, cost, and security.
Tahmini Süre:2m 0s
Soru 134Soru →

A company hosts a global online training platform on AWS. The platform serves static video lectures stored in an Amazon S3 bucket, and a daily course catalog and real-time student enrollment dashboard stored in an Amazon DynamoDB table. During peak registration periods, the application experiences high read latency when retrieving the course catalog, and origin S3 traffic is causing high data egress costs. Which combination of actions should the solutions architect take to deliver the content and queries with the lowest latency possible? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon CloudFront distribution with the Amazon S3 bucket as the origin, and configure a cache behavior for video assets with a long Time to Live (TTL).; Implement Amazon DynamoDB Accelerator (DAX) to cache read queries for the daily course catalog.

Cevap

The correct actions are deploying an Amazon CloudFront distribution with the S3 bucket as the origin and a long cache TTL for video assets, and implementing Amazon DynamoDB Accelerator (DAX) to cache read queries for the daily course catalog.
Deploying Amazon CloudFront in front of Amazon S3 allows caching of static video assets at the edge, reducing latency and egress costs. Implementing Amazon DynamoDB Accelerator (DAX) provides an in-memory cache that reduces query latency to microseconds for read-heavy tables.

Adım Adım Çözüm

1
Analyze the access patterns and latency requirements for static video content.
Determine that static assets should be cached at edge locations.
Caching videos at CloudFront edge locations with a non-zero TTL minimizes latency and avoids recurring S3 data transfer out costs.
2
Analyze the access patterns and latency requirements for the database queries.
Identify that the daily course catalog is a read-heavy workload.
Implementing an in-memory cache like DAX for DynamoDB queries resolves read latency issues without changing database schemas.
3
Evaluate and eliminate sub-optimal options such as setting TTL to 0, using hot keys, or using S3 Standard-IA with high churn.
Confirm that the selected options are the only high-performing and cost-effective designs.
This ensures optimal caching configuration and prevents performance degradation or unexpected cost penalties.

Anahtar Kavram

Caching and Content Delivery Optimization for High-Performing Architectures
Tahmini Süre:2m 0s
Soru 135Soru →

An online ticketing platform serves event detail pages and seat map images to a global audience. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in the ap-southeast-1 Region. To reduce latency, the platform uses an Amazon CloudFront distribution. The company wants to implement a highly resilient architecture that automatically serves a static maintenance page from an Amazon S3 bucket in the us-west-2 Region if the ALB returns gateway errors (502, 503, or 504) during high-traffic events.

Which two actions should a solutions architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a CloudFront origin group with the ALB as the primary origin and the S3 bucket as the secondary origin.; Configure the origin group's failover criteria to include HTTP status codes 502, 503, and 504.

Cevap

Create a CloudFront origin group with the ALB as the primary origin and the S3 bucket as the secondary origin, and configure the origin group's failover criteria to include HTTP status codes 502, 503, and 504.
To build a resilient edge architecture that handles backend failures automatically, a CloudFront origin group must be configured. Placing the Application Load Balancer as the primary origin and the Amazon S3 bucket as the secondary origin allows CloudFront to manage the traffic routing. Configuring the origin group's failover criteria to trigger on HTTP status codes 502, 503, and 504 ensures that CloudFront switches to the static maintenance page hosted on Amazon S3 without any user-perceived downtime or DNS propagation delay.

Adım Adım Çözüm

1
Configure the two distinct destinations as CloudFront origins.
The Application Load Balancer and the Amazon S3 bucket are defined as origins within the CloudFront distribution.
This registers the primary application stack and the backup static storage as valid backend targets.
2
Group the origins into an origin group.
An origin group is established with the ALB designated as the primary origin and the S3 bucket as the secondary origin.
An origin group is the CloudFront configuration wrapper required to enable origin-level resilience and automatic failover.
3
Define the origin failover criteria.
The origin group is configured to failover when the primary origin returns HTTP status codes 502, 503, or 504.
This tells CloudFront to automatically query the backup S3 bucket instead of the ALB when those gateway error codes are returned.

Anahtar Kavram

Amazon CloudFront Origin Groups and Origin Failover
Soru 136Soru →

A global event ticketing platform hosts its web application on AWS. The static frontend assets, such as seating charts and promotional banners, are stored in an Amazon S3 bucket. The dynamic backend application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) and reads ticket availability data from an Amazon RDS for PostgreSQL database. During popular ticket launches, the platform experiences massive traffic spikes, leading to increased latency and high CPU utilization on the RDS database.

Which combination of actions should a solutions architect recommend to reduce latency and improve the application's overall performance? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon CloudFront distribution with the Amazon S3 bucket as the origin to serve the static seating charts and promotional banners.; Deploy an Amazon ElastiCache cluster to cache frequent read queries for ticket availability, reducing the query load on the Amazon RDS database.

Cevap

Configure an Amazon CloudFront distribution with the Amazon S3 bucket as the origin to serve static assets, and deploy an Amazon ElastiCache cluster to cache database read queries.
The correct architecture leverages Amazon CloudFront to cache static assets (like seating charts and banners) at edge locations close to users, reducing latency and origin request volume. For database queries, Amazon ElastiCache stores the results of ticket availability queries in memory, preventing redundant reads from reaching the Amazon RDS PostgreSQL database and lowering CPU consumption during high-traffic events.

Adım Adım Çözüm

1
Analyze the caching requirements for static and dynamic data components.
Identify seating charts and banners as static assets, and ticket availability queries as dynamic, database-driven reads.
To build a high-performing architecture, distinct caching strategies must be applied to static content and dynamic database query results.
2
Deploy Amazon CloudFront to optimize static content delivery.
Configure CloudFront with the S3 bucket as the origin and set appropriate non-zero TTL values.
CloudFront caches static files at edge locations globally, lowering latency for users and reducing the load on the S3 origin.
3
Implement Amazon ElastiCache in front of the Amazon RDS database.
Introduce a cache-aside layer to query ElastiCache before querying RDS.
Caching database query responses in memory reduces CPU utilization on the RDS instance and speeds up dynamic page rendering.

Anahtar Kavram

Multi-tiered caching in AWS involves caching static media assets at the edge using Amazon CloudFront and caching database read queries in-memory using Amazon ElastiCache, which together minimize latency and protect origin databases and storage from overload during traffic spikes.
Soru 137Soru →

A company is designing a cost-optimization strategy for its application on AWS. The application consists of the following components:
- A fleet of Amazon EC2 instances running a web backend that operates 24/724/7 with a steady-state requirement of 1010 instances, scaling up during peak hours.
- An Amazon RDS for PostgreSQL database instance that operates 24/724/7.
- A data transformation batch job running on EC2 instances in a private subnet. The job runs daily, is fault-tolerant, and downloads massive amounts of daily transaction logs from Amazon S3.

Which combination of options is the MOST cost-effective for these requirements?

Cevabı ve açıklamayı göster

Cevap: Purchase a Compute Savings Plan to cover the baseline EC2 instances, use Spot Instances for the batch job EC2 instances, purchase RDS Reserved Instances for the database, and create a Gateway VPC endpoint for Amazon S3.

Cevap

The most cost-effective option is to purchase a Compute Savings Plan for the baseline EC2 instances, use Spot Instances for the batch job, purchase RDS Reserved Instances for the database, and create a Gateway VPC endpoint for Amazon S3.
The correct strategy combines a Compute Savings Plan for the baseline EC2 instances, Spot Instances for the interruptible batch job, RDS Reserved Instances for the 24/7 database, and a Gateway VPC endpoint to avoid NAT Gateway data processing charges for S3 traffic.

Adım Adım Çözüm

1
Analyze compute baseline optimization
Identify that the 24/7 steady-state EC2 instances can be covered by a Compute Savings Plan to maximize savings.
Compute Savings Plans provide a significant discount for consistent, steady-state compute usage over a 1-year or 3-year term.
2
Select purchasing model for the batch job
Select Spot Instances for the EC2 instances running the data transformation batch job.
Since the batch job is fault-tolerant and can run at any time, Spot Instances offer the lowest cost (up to 90% off On-Demand) and can handle interruptions.
3
Optimize the database costs
Select RDS Reserved Instances for the 24/7 PostgreSQL database.
Reserved Instances provide a significant discount for database instances that run continuously 24/7.
4
Minimize data transfer costs to S3
Choose a Gateway VPC endpoint for Amazon S3 instead of routing traffic through a NAT Gateway.
A Gateway VPC endpoint is free and allows traffic to traverse privately directly to S3, avoiding expensive NAT Gateway data processing charges.

Anahtar Kavram

Selecting cost-optimized purchasing strategies (Compute Savings Plans, Spot, Reserved Instances) and optimizing network traffic pathways to avoid NAT Gateway charges.
Soru 138Soru →

A company has a distributed data processing application running on Amazon EC2 instances. The instances are deployed across two Availability Zones (us−east−1aus-east-1a and us−east−1bus-east-1b) in a single VPC. The application nodes constantly exchange intermediate data, totaling approximately 80 TB80\text{ TB} of data transfer monthly. The nodes currently communicate using their auto-assigned public IP addresses. Which two recommendations should a solutions architect make to reduce the monthly network data transfer charges? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the application nodes to communicate using their private IP addresses instead of public IP addresses; Launch the EC2 instances in a single Availability Zone using a cluster placement group

Cevap

The correct recommendations are to configure the application nodes to use private IP addresses for communication and to deploy the instances in a single Availability Zone using a cluster placement group.
Configuring nodes to communicate using private IP addresses is highly cost-effective because data transfer using private IPs within the same Availability Zone is free of charge. Launching the instances in a single Availability Zone using a cluster placement group eliminates cross-Availability Zone data transfer charges entirely while maintaining the low-latency network performance required for distributed data processing.

Adım Adım Çözüm

1
Identify the current network path and IP usage for node communication.
The nodes currently use public IP addresses, which routes traffic through public AWS endpoints and incurs data transfer out and in charges.
To begin optimization, we must determine the cheapest IP addressing scheme available within a VPC.
2
Evaluate the impact of switching to private IP addresses.
Switching to private IP addresses makes traffic within the same Availability Zone free ($0.00 per GB\$0.00\text{ per GB}) and reduces cross-Availability Zone traffic cost to standard internal rates.
Private IP communication within a VPC avoids public IP data transfer pricing.
3
Evaluate the impact of consolidation into a single Availability Zone.
Placing all nodes in the same Availability Zone eliminates cross-Availability Zone data transfer charges ($0.01 per GB\$0.01\text{ per GB} in each direction). Using a cluster placement group ensures the low-latency network performance is maintained.
Distributed applications with high inter-node communication are most cost-effective when consolidated within a single Availability Zone.

Anahtar Kavram

AWS data transfer charges vary based on the IP address type (public vs. private) and network boundaries (same Availability Zone vs. cross-Availability Zone). Using private IPs and single-AZ cluster placement groups optimizes both cost and performance for high-throughput distributed workloads.
Soru 139Soru →

A solutions architect is designing a secure credential storage solution for a legacy application hosted on Amazon EC2 instances. The application requires access to database credentials for an Amazon RDS for PostgreSQL database, which must be rotated automatically every 30 days. Additionally, the application requires access to a static third-party API token that must be encrypted at rest but does not require automatic rotation. The solution must minimize monthly operational costs and configuration complexity. Which combination of actions should the solutions architect take to meet these requirements? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.; Store the external API token as a SecureString parameter in AWS Systems Manager Parameter Store.

Cevap

Store the database credentials in AWS Secrets Manager with built-in RDS rotation, and store the external API token as a SecureString parameter in AWS Systems Manager Parameter Store.
Storing database credentials in AWS Secrets Manager is the best approach because it natively supports automatic rotation for RDS databases. Storing the static API token as a SecureString parameter in AWS Systems Manager Parameter Store provides encryption-at-rest at lower operational cost and complexity since the token does not require automatic rotation.

Adım Adım Çözüm

1
Analyze the database credentials requirements.
The database credentials need to be rotated automatically every 30 days.
AWS Secrets Manager is the correct service for secrets requiring automatic rotation because it provides built-in integration and Lambda rotation templates for Amazon RDS databases.
2
Analyze the static API token requirements.
The token is static, does not require rotation, but must be encrypted at rest.
AWS Systems Manager Parameter Store with SecureString parameters provides secure, KMS-encrypted parameter storage with no additional cost for standard parameters, making it highly cost-effective for static secrets.
3
Evaluate the distractors against security and operational rules.
Reject plaintext storage options and options that misinterpret KMS key rotation mechanics.
String parameters and plaintext S3 files lack required encryption. KMS key rotation does not update the underlying database credentials or parameter values.

Anahtar Kavram

Selecting the appropriate secrets management service based on rotation capabilities, encryption needs, and cost profiles.
Soru 140Soru →

A company runs a high-traffic e-commerce platform where a fleet of Amazon EC2 instances in an Auto Scaling group (ASG) serves traffic behind an Application Load Balancer (ALB). During a peak shopping event, several instances experience application-level crashes and stop responding to HTTP requests, but the EC2 status checks show the instances are healthy. The ALB marks the instances as unhealthy and stops sending them traffic, but the Auto Scaling group does not replace them. Which configuration change should the solutions architect make to ensure unhealthy instances are automatically replaced?

Cevabı ve açıklamayı göster

Cevap: Update the Auto Scaling group health check type from EC2 to ELB.

Cevap

Update the Auto Scaling group health check type from EC2 to ELB.
By default, an Auto Scaling group (ASG) only monitors EC2 status checks. If an application crashes but the operating system and VM remain responsive, the EC2 status checks will pass, and the ASG will not replace the instance. Changing the health check type of the ASG to ELB allows the ASG to use the Application Load Balancer's target group health checks. When the ALB marks an instance as unhealthy, the ASG will automatically terminate and replace it.

Adım Adım Çözüm

1
Analyze the health check configuration of the Auto Scaling group (ASG) and the Application Load Balancer (ALB).
The ASG is currently using the default EC2 health check, which only monitors the hypervisor and OS-level status, while the ALB performs application-level HTTP health checks.
This explains why the ASG does not terminate the instances despite the ALB marking them as unhealthy.
2
Change the health check type of the ASG to ELB.
The ASG will now monitor both EC2 status checks and the ALB target group health checks.
To ensure that application-level failures detected by the ALB trigger instance replacement by the ASG.

Anahtar Kavram

Auto Scaling Group Health Check Type
Tahmini Süre:45s
ÖncekiSayfa 7 / 74Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Associate | Examkin