Examkin

Design Resilient Architectures

382 soru

Tüm türler382Çoktan seçmeli195Çoklu seçim187
Soru 241Soru →

A hospitality company manages its central reservation system using an Amazon Aurora MySQL-Compatible Edition database cluster in the us-east-1 Region. To ensure business continuity, the company requires a disaster recovery (DR) solution in the us-west-2 Region. The DR architecture must support a Recovery Point Objective (RPO) of less than 11 second and a Recovery Time Objective (RTO) of less than 11 minute. Which database configuration meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Aurora Global Database with the primary cluster in the us-east-1 Region and a secondary cluster in the us-west-2 Region, and promote the secondary cluster in the event of a disaster.

Cevap

Create an Amazon Aurora Global Database with the primary cluster in the us-east-1 Region and a secondary cluster in the us-west-2 Region, and promote the secondary cluster in the event of a disaster.
The correct option is to create an Amazon Aurora Global Database. Aurora Global Database uses storage-based, asynchronous replication that achieves a lag of less than 11 second. If the primary region experiences an outage, the secondary cluster in the target region can be promoted to a standalone primary cluster with read and write capabilities in less than 11 minute, satisfying both the RPO and RTO requirements.

Adım Adım Çözüm

1
Analyze recovery objectives and replication constraints.
The requirements dictate a Recovery Point Objective (RPO) of less than 11 second (near-real-time replication) and a Recovery Time Objective (RTO) of less than 11 minute (extremely fast failover or promotion).
Understanding the RTO and RPO limits helps filter out backup-and-restore or slow replication methods.
2
Evaluate cross-region replication technologies for Amazon Aurora.
Amazon Aurora Global Database utilizes dedicated infrastructure at the storage layer to replicate data to secondary regions with typical latencies of less than 11 second, and supporting promotion of the secondary cluster within 11 minute.
Selecting the native high-availability cross-region feature that directly maps to sub-second RPO and sub-minute RTO.
3
Eliminate incorrect options that fail the target recovery metrics or are architecturally invalid.
Route 53 latency routing cannot handle write synchronization; RDS MySQL read replicas do not support automated cross-region failover; hourly snapshots fail both the 11-second RPO and 11-minute RTO constraints.
Ensuring the selected solution is the only one that meets all constraints while avoiding common operational misconceptions.

Anahtar Kavram

Cross-Region Disaster Recovery with Amazon Aurora Global Database
Soru 242Soru →

A news agency hosts a dynamic web application on Amazon EC2 instances behind an Application Load Balancer (ALB). During breaking news events, traffic spikes significantly, occasionally causing backend database exhaustion and HTTP 503 Service Unavailable errors. The agency has created a static backup site in an Amazon S3 bucket. A solutions architect must design a highly resilient caching solution that automatically serves this static backup content globally with the lowest latency when the primary ALB is unavailable or failing. Which solution meets these requirements with the least operational complexity?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon CloudFront distribution with an origin group containing the ALB as the primary origin and the S3 bucket as the secondary origin. Set the origin group to fail over to the S3 bucket on 500, 502, 503, and 504 HTTP status codes.

Cevap

Configure an Amazon CloudFront distribution with an origin group containing the Application Load Balancer as the primary origin and the S3 bucket as the secondary origin, setting failover status codes to redirect traffic to the S3 bucket.
The correct solution uses an Amazon CloudFront origin group. By setting the Application Load Balancer as the primary origin and the Amazon S3 bucket as the secondary origin, CloudFront automatically catches HTTP server errors (such as 503 Service Unavailable) at the edge and routes requests to the backup S3 bucket. This provides automatic failover with minimal latency, leverages edge caching, and avoids client-side DNS propagation delays.

Adım Adım Çözüm

1
Identify the resilience and latency requirements.
The solution requires dynamic edge caching to minimize latency globally and automatic failover during origin outages without relying on slow DNS changes.
CloudFront distributions provide global edge caching, and CloudFront origin groups support active-passive origin failover.
2
Configure the CloudFront Origin Group.
An origin group is created with the Application Load Balancer as the primary origin and the Amazon S3 bucket as the secondary origin.
This allows CloudFront to fallback to the secondary origin if the primary origin is unreachable or returns error codes.
3
Define failover criteria based on HTTP response status codes.
CloudFront is configured to fail over when the primary origin returns 500, 502, 503, or 504 status codes.
This captures backend failures and database connection exhaustion issues immediately and serves static placeholder pages from the S3 bucket.

Anahtar Kavram

CloudFront Origin Groups allow solutions architects to configure origin failover for high availability and resilient content delivery.
Tahmini Süre:1m 30s
Soru 243Soru →

A pharmaceutical research company operates a clinical trial monitoring application. The application stores real-time patient telemetry data in an Amazon Aurora PostgreSQL DB cluster. The company requires a disaster recovery strategy across two AWS Regions. The database configuration must achieve a Recovery Point Objective (RPO) of less than 22 seconds and a Recovery Time Objective (RTO) of less than 22 minutes. Additionally, researchers in both regions need low-latency access to read the telemetry data. Which database configuration meets these requirements with the least operational complexity?

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora Global Database with the primary DB cluster in the main region and a secondary DB cluster in the recovery region.

Cevap

Deploy an Amazon Aurora Global Database with the primary DB cluster in the main region and a secondary DB cluster in the recovery region.
The correct database configuration is to deploy an Amazon Aurora Global Database. Aurora Global Databases use storage-based replication to copy data to secondary regions with a typical replication lag of less than 11 second, fulfilling the RPO constraint of less than 22 seconds. The secondary cluster allows read scaling with local low latency for remote users. In the event of a primary region outage, the secondary cluster can be promoted to a primary read-write cluster in less than 22 minutes, meeting the RTO constraint.

Adım Adım Çözüm

1
Analyze the disaster recovery constraints, specifically the Recovery Point Objective (RPO) of less than 22 seconds and the Recovery Time Objective (RTO) of less than 22 minutes.
The solution must support near real-time data replication (under 22 seconds) and rapid failover (under 22 minutes) between regions.
This filters out backup-and-restore or pilot-light strategies that introduce recovery delays.
2
Analyze the read scalability requirement for researchers in both regions to access data with low latency.
The target configuration must allow active read operations in the secondary region.
This requires a database engine that supports active read replicas or secondary active reader clusters in the remote region.
3
Compare Aurora Global Database capabilities against Amazon RDS cross-region replication.
Amazon Aurora Global Database provides storage-level replication with lag under 11 second and managed regional failover that takes less than 22 minutes, meeting all criteria with minimal operational overhead.
Aurora Global Database is the native AWS solution designed for low-latency multi-region read scaling and fast cross-region failover.

Anahtar Kavram

Amazon Aurora Global Database replication and regional failover capabilities.
Tahmini Süre:1m 30s
Soru 244Soru →

A company hosts a global web application in the us-east-1 Region. The application consists of static media assets stored in an Amazon S3 bucket and dynamic APIs served by Amazon EC2 instances behind an Application Load Balancer (ALB). To protect against regional outages and optimize performance, the company has duplicated its static assets to an S3 bucket in us-west-2 and deployed a standby backend service on EC2 instances behind an ALB in us-west-2. A solutions architect must design a content delivery and caching solution that ensures low latency for global users and automatically fails over to the standby resources in us-west-2 if the primary resources in us-east-1 fail or return server errors.

Which combination of actions should the solutions architect take to meet these requirements with the lowest latency and high resilience? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon CloudFront distribution with an origin group for static assets, specifying the us-east-1 S3 bucket as the primary origin and the us-west-2 S3 bucket as the secondary origin.; Configure an Amazon CloudFront distribution with an origin group for dynamic APIs, specifying the us-east-1 Application Load Balancer as the primary origin and the us-west-2 Application Load Balancer as the secondary origin.

Cevap

Configure an Amazon CloudFront distribution with an origin group for static assets (with us-east-1 S3 as primary and us-west-2 S3 as secondary) and configure an origin group for dynamic APIs (with us-east-1 ALB as primary and us-west-2 ALB as secondary).
To build a resilient and low-latency architecture, Amazon CloudFront should be deployed in front of the origin servers. By setting up CloudFront origin groups, you can specify a primary origin and a secondary (standby) origin for both static assets (Amazon S3 buckets) and dynamic content (Application Load Balancers). If the primary origin in us-east-1 returns configured HTTP error codes (such as 500, 502, 503, or 504), CloudFront automatically fails over and routes subsequent requests to the secondary origin in us-west-2, ensuring high availability and low latency via edge caching.

Adım Adım Çözüm

1
Set up CloudFront origin groups for both static assets and dynamic APIs.
Two separate origin groups are created within the CloudFront distribution: one containing the S3 buckets in us-east-1 and us-west-2, and another containing the Application Load Balancers (ALBs) in us-east-1 and us-west-2.
Origin groups allow CloudFront to automatically handle origin failover when the primary origin is unavailable or returns specific HTTP errors.
2
Configure the cache behaviors to map static and dynamic paths to their respective origin groups.
Traffic for static media assets is routed to the S3 origin group, and traffic for dynamic APIs is routed to the ALB origin group.
This separation ensures that caching policies and failover behaviors are optimized for each content type.
3
Configure failover criteria for the origin groups.
Failover triggers are established for HTTP status codes such as 500, 502, 503, and 504.
This guarantees that if the primary resources in us-east-1 fail or return server errors, CloudFront instantly forwards the user requests to the standby resources in us-west-2.

Anahtar Kavram

Amazon CloudFront origin groups allow solutions architects to configure automatic origin failover for both Amazon S3 and custom origins (such as Application Load Balancers) to ensure high resilience and low latency.
Soru 245Soru →

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are managed by an Auto Scaling group. The web application is configured to listen on custom port 8080. However, the ALB is currently marking all instances in the target group as unhealthy, preventing users from accessing the application. A solutions architect verifies that the application is running normally on the instances. Which action should the solutions architect take to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Update the ALB target group's health check configuration to use port 8080.

Cevap

Update the ALB target group's health check configuration to use port 8080.
Updating the health check port to 8080 allows the Application Load Balancer to perform health checks directly against the port where the web application is listening, correctly identifying the instances as healthy.

Adım Adım Çözüm

1
Identify the port on which the web application is listening on the EC2 instances.
The application listens on custom port 8080.
This is the actual port where health checks must be directed to confirm application availability.
2
Compare this with the load balancer health check configuration.
The default health check configuration queries port 80, which is not receiving any response from the instances.
This mismatch explains why the ALB is reporting the instances as unhealthy.
3
Modify the target group's health check settings.
The health checks are updated to query port 8080.
This ensures the ALB validates the application's actual listening port, restoring the healthy status of the instances.

Anahtar Kavram

Aligning Elastic Load Balancing health checks with custom application ports
Tahmini Süre:1m 0s
Soru 246Soru →

A logistics tracking application ingests real-time GPS telemetry data from fleet vehicles. The backend processing service runs on Amazon EC2 instances in an Auto Scaling group (ASG) located in private subnets behind an Application Load Balancer (ALB) in public subnets. The backend service listens on TCP port 9000. The ALB uses an HTTPS listener on port 443 and forwards requests to a target group configured to use port 9000.

To satisfy a new security policy, a network administrator modified the Network Access Control List (NACL) of the private subnets to allow inbound traffic from the public subnets only on port 9000. Shortly after this modification, the ALB marks all EC2 instances as unhealthy, and the ASG begins repeatedly terminating and replacing them. Local system logs show that the application is running and listening on port 9000 successfully on all instances.

Which configuration change will resolve this issue and restore high availability?

Cevabı ve açıklamayı göster

Cevap: Modify the network ACL of the private subnet to allow outbound traffic to the public subnets on ephemeral ports (1024-65535) to permit return traffic for the health checks.

Cevap

Modify the network ACL of the private subnet to allow outbound traffic to the public subnets on ephemeral ports (1024-65535) to permit return traffic for the health checks.
The correct configuration change is to modify the network ACL of the private subnet to allow outbound traffic to the ephemeral ports. Network Access Control Lists (NACLs) are stateless, which means that return traffic must be explicitly allowed by an outbound rule. When the Application Load Balancer performs health checks or forwards traffic to the EC2 instances on port 9000, the instances attempt to respond using a destination port from the ephemeral range (1024-65535). Since the outbound NACL is blocking this return traffic, the ALB receives no response and marks the targets as unhealthy, causing the Auto Scaling group to replace them.

Adım Adım Çözüm

1
Analyze the stateful vs. stateless nature of the security controls applied to the EC2 instances.
Recognize that security groups are stateful, meaning they track connection states and automatically allow return traffic. Network Access Control Lists (NACLs) are stateless, requiring explicit rules for both inbound and outbound directions.
Correctly identifying which security boundary is blocking the response traffic is essential for implementing the correct fix.
2
Determine the path of the Load Balancer health checks and how return traffic is routed.
The Application Load Balancer sends health check requests to the instances on port 9000. The EC2 instances attempt to return the response to the load balancer using a dynamic port within the ephemeral port range (1024-65535).
Understanding the source and destination ports of the return packets reveals why they are being dropped by the stateless network barrier.
3
Identify the missing rule in the subnet-level configuration.
The private subnet NACL only allows inbound traffic on port 9000 but lacks an outbound rule to allow return traffic back to the load balancer on the ephemeral ports.
This explains why the EC2 instances show the service is running locally, but the load balancer marks them as unhealthy.
4
Apply the outbound rule correction to the NACL.
Add an outbound rule to the private subnet NACL that allows traffic destined for the public subnets over ports 1024-65535.
This allows the return packets of the health check probes to pass through the NACL to the ALB, resolving the health check failures.

Anahtar Kavram

Stateless vs. Stateful Network Filtering in AWS VPC and ELB Health Checks
Soru 247Soru →

A software publisher distributes installer packages globally. The primary files are stored in an Amazon S3 bucket in the us-west-2 Region, and a backup replica is maintained in an S3 bucket in the eu-central-1 Region. The publisher requires a content delivery solution that ensures high availability and low latency for downloads, even if the primary S3 bucket becomes temporarily unavailable. The solution must minimize operational overhead. Which configuration should a solutions architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon CloudFront distribution with an origin group containing the primary S3 bucket as the primary origin and the backup S3 bucket as the secondary origin. Configure origin failover based on specific HTTP status codes such as 500, 502, 503, or 504.

Cevap

Configure an Amazon CloudFront distribution with an origin group containing the primary S3 bucket as the primary origin and the backup S3 bucket as the secondary origin. Configure origin failover based on specific HTTP status codes such as 500, 502, 503, or 504.
The correct configuration utilizes Amazon CloudFront origin groups to achieve both low-latency content delivery and high availability. By grouping the primary Amazon S3 bucket (in us-west-2) and the backup S3 bucket (in eu-central-1) into an origin group, CloudFront can automatically fail over to the backup origin when the primary origin returns specific HTTP status codes (such as 500, 502, 503, or 504). This provides seamless, resilient content delivery with minimal latency and zero manual intervention or complex routing overhead.

Adım Adım Çözüm

1
Identify the performance and availability requirements.
The solution requires low latency for global downloads (implying the use of a CDN like Amazon CloudFront) and high availability (implying multi-region storage failover).
CloudFront reduces latency by caching content at edge locations close to users, and S3 provides resilient storage across multiple regions.
2
Evaluate the mechanism for automatic failover under CloudFront.
Select Amazon CloudFront Origin Groups as the correct architectural feature to bind the two S3 buckets.
Origin Groups allow a primary and secondary origin to be grouped together, automatically failing over to the secondary origin if the primary origin returns configured HTTP error status codes.
3
Eliminate configurations that introduce high latency or misuse service scopes.
Discard Route 53 direct routing (no caching), AWS WAF routing (incorrect service scope), and setting TTL to 0 (bypasses caching).
These alternatives fail to meet the performance requirement or misapply AWS service capabilities.

Anahtar Kavram

Amazon CloudFront Origin Groups and Origin Failover
Tahmini Süre:1m 30s
Soru 248Soru →

A company hosts a simple web application on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ASG health check type is configured to use EC2 status checks. When the web application process crashes on an instance, the ALB marks that instance as unhealthy and stops routing traffic to it. However, the ASG does not terminate or replace the instance because the underlying EC2 instance status checks remain healthy. Which configuration change should a solutions architect implement to ensure that instances with failed web application processes are automatically replaced?

Cevabı ve açıklamayı göster

Cevap: Configure the Auto Scaling group health check type to use ELB health checks.

Cevap

Configure the Auto Scaling group health check type to use ELB health checks.
By default, an Auto Scaling group (ASG) only monitors EC2 status checks. If the application process crashes but the OS/hypervisor remains healthy, the ASG will not replace the instance. Configuring the ASG to use ELB health checks allows it to query the Application Load Balancer's target group status, triggering the automatic replacement of instances that fail application-level health checks.

Adım Adım Çözüm

1
Analyze the current health check configuration of the Auto Scaling group (ASG) and Application Load Balancer (ALB).
The ASG is configured to use EC2 health checks, which only monitor the hardware and hypervisor status, whereas the ALB is performing application-level health checks on the targets.
This explains why the ASG does not replace instances when the web application process crashes but the EC2 instance remains running.
2
Identify the mechanism required to link the ALB's health check results to the ASG's lifecycle management.
The health check type of the ASG must be updated from EC2 to ELB.
This configuration allows the ASG to receive health status updates from the ALB target group and take corrective action (termination and replacement) when the application health check fails.

Anahtar Kavram

Auto Scaling Group Health Check Configuration
Soru 249Soru →

A startup is deploying a microservices application using Amazon ECS with the Amazon EC2 launch type. The tasks run on EC2 instances managed by an Auto Scaling group (ASG) in private subnets. The application uses dynamic port mapping, where the container's port 8080 is mapped to a dynamically allocated host port in the range 32768−6100032768-61000 on the EC2 instances. An Application Load Balancer (ALB) in the public subnets routes external traffic from port 443443 to the target group associated with the ECS service.

The security team has configured custom Network ACLs (NACLs) and Security Groups to enforce strict traffic filtering:
1. Public Subnet NACL:
- Inbound: Allows TCP port 443443 from 0.0.0.0/0.
- Outbound: Allows all traffic.
2. Private Subnet NACL:
- Inbound: Allows TCP port 443443 and ephemeral ports 1024−655351024-65535 from the public subnets.
- Outbound: Allows all traffic.
3. EC2 Instance Security Group:
- Inbound: Allows TCP port 8080 from the ALB security group.
- Outbound: Allows all traffic.

The target group has its health check port configured to traffic-port. The ECS tasks fail to register successfully because the ALB marks the targets as unhealthy, causing the ASG to terminate and relaunch the EC2 instances.

Which action should the solutions architect take to resolve this issue and allow the health checks to pass?

Cevabı ve açıklamayı göster

Cevap: Update the security group of the EC2 instances to allow inbound TCP traffic on the dynamic port range 32768−6100032768-61000 from the ALB security group.

Cevap

Update the security group of the EC2 instances to allow inbound TCP traffic on the dynamic port range 32768−6100032768-61000 from the ALB security group.
The correct answer is to update the security group of the EC2 instances to allow inbound TCP traffic on the dynamic port range 32768−6100032768-61000 from the ALB security group. Because the ECS tasks use dynamic port mapping, the container port is mapped to a dynamic host port. The ALB health check is configured to use traffic-port, meaning it will query the dynamic host port. The security group of the EC2 instances must allow inbound traffic on this dynamic range from the load balancer's security group to allow the health checks to succeed.

Adım Adım Çözüm

1
Analyze the application architecture and port configurations.
The ECS tasks use dynamic port mapping, mapping container port 8080 to host ports in the range 32768−6100032768-61000. The ALB target group health check is set to traffic-port.
Understanding which ports are actively listening on the host EC2 instances is critical to determining where health check traffic is being sent.
2
Identify the destination port of the ALB health checks.
The ALB health checks are sent to the dynamically allocated host ports in the range 32768−6100032768-61000.
Since traffic-port is configured, the load balancer dynamically targets the host port registered for each container task.
3
Evaluate the network access control and security group rules for the destination ports.
The private subnet NACL allows inbound traffic on ephemeral ports 1024−655351024-65535 (which covers 32768−6100032768-61000). However, the EC2 instance security group only allows inbound traffic on port 8080.
Both NACLs and security groups must allow the traffic. The security group is currently blocking the health check traffic on the dynamic host ports.
4
Formulate the correct modification to allow the health checks to pass.
Updating the EC2 instance security group to allow inbound TCP traffic on the dynamic range 32768−6100032768-61000 from the ALB's security group allows the health checks to reach the containerized tasks.
This configuration allows the ALB to reach the dynamically mapped host ports while maintaining security group-level access control.

Anahtar Kavram

Auto Scaling and Elastic Load Balancing (ELB) integration with ECS dynamic port mapping
Tahmini Süre:3m 0s
Soru 250Soru →

A software development company is launching a new REST API deployed on Amazon EC2 instances within an Auto Scaling group. The API application is configured to listen on port 50005000. An Application Load Balancer (ALB) is deployed to distribute incoming traffic across the instances. The Solutions Architect needs to configure the load balancer and security settings to ensure the ALB can successfully perform health checks and route traffic to the application. Which TWO configurations should the Solutions Architect implement? (Select two).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the target group health check port to 'traffic-port' or explicitly define it as port 50005000.; Allow inbound TCP traffic on port 50005000 in the EC2 instance security group, sourcing from the Application Load Balancer's security group.

Cevap

The Solutions Architect must configure the target group health check port to use the traffic port (or explicitly port 5000) and update the EC2 instance security group to allow inbound TCP traffic on port 5000 from the Application Load Balancer's security group.
For an application listening on a custom port like port 5000, the Application Load Balancer must be configured to send health check requests to that specific port (or use the 'traffic-port' option). Additionally, the EC2 instances' security group must allow inbound traffic on port 5000 from the ALB's security group to permit health checks and application traffic to flow.

Adım Adım Çözüm

1
Identify the application port configuration.
The application listens on port 5000 on the EC2 instances.
This determines the target port for both health checks and application traffic.
2
Configure the health check port in the target group.
Set the health check port to 'traffic-port' or port 5000.
This ensures the Application Load Balancer performs health checks on the actual port where the API is running instead of defaulting to port 80.
3
Configure instance-level firewalls (security groups).
Allow inbound traffic on port 5000 from the ALB security group.
This permits the load balancer to successfully connect to the instances for health checks and traffic forwarding.

Anahtar Kavram

Configuring load balancer target groups and instance security groups for custom port applications to ensure proper health monitoring and routing.
Soru 251Soru →

A company hosts a specialized financial reporting API on Amazon EC2 instances managed by an Auto Scaling group. The API runs on a custom port 8000 and is positioned behind an Application Load Balancer (ALB). The EC2 instances run initialization scripts during startup that typically take 5 minutes to complete before the application can respond to requests. The solutions architect must secure the environment so that the EC2 instances accept traffic only from the ALB, and ensure that newly launched instances are not marked unhealthy and terminated prematurely during their initialization phase.

Which two actions should the solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the security group associated with the EC2 instances to allow inbound traffic on port 8000 only from the security group of the ALB.; Set the health check grace period on the Auto Scaling group to 360 seconds.

Cevap

Configure the security group associated with the EC2 instances to allow inbound traffic on port 8000 only from the security group of the ALB, and set the health check grace period on the Auto Scaling group to 360 seconds.
To secure the instances, the solutions architect must allow inbound traffic on port 8000 in the EC2 security group only from the security group of the ALB. To prevent premature termination of newly launched instances due to the 5-minute initialization period, the health check grace period of the Auto Scaling group must be configured to a duration longer than 300 seconds (e.g., 360 seconds).

Adım Adım Çözüm

1
Add a rule to the security group of the EC2 instances to allow TCP traffic on port 8000, setting the source as the security group ID of the Application Load Balancer.
Network access to the backend instances on the application port is locked down to traffic originating from the load balancer.
This implements the security requirement at the instance layer using stateful security groups.
2
Configure the health check grace period parameter on the Auto Scaling group to 360 seconds.
The Auto Scaling group waits for 360 seconds (6 minutes) before performing health checks on newly launched instances.
This accommodates the 5-minute (300-second) boot-up delay from initialization scripts, preventing premature instance termination.

Anahtar Kavram

Securing load-balanced target groups using security groups and configuring health check grace periods to allow for instance initialization.
Soru 252Soru →

A healthcare technology company hosts its patient check-in portal at the apex domain patientcheck.com. The primary environment runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. The company wants to implement an active-passive disaster recovery strategy. If the primary environment in us-east-1 experiences an outage, Route 53 must automatically redirect all incoming client traffic to a standby static maintenance website hosted in an Amazon S3 bucket in the us-west-2 Region. Which combination of Route 53 configurations will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a primary Failover Alias record for patientcheck.com pointing to the Application Load Balancer with Evaluate Target Health set to Yes, and configure a secondary Failover Alias record pointing to the Amazon S3 bucket website endpoint.

Cevap

Configure a primary Failover Alias record for patientcheck.com pointing to the Application Load Balancer with Evaluate Target Health set to Yes, and configure a secondary Failover Alias record pointing to the Amazon S3 bucket website endpoint.
The correct configuration uses a primary Failover Alias record pointing to the Application Load Balancer with Evaluate Target Health set to Yes, and a secondary Failover Alias record pointing to the Amazon S3 bucket website endpoint. Route 53 Alias records allow the zone apex to point directly to AWS resources without violating DNS standards. Enabling Evaluate Target Health ensures Route 53 monitors the health of the Application Load Balancer using the health of its targets, automatically failing over to the secondary S3 bucket when the load balancer becomes unhealthy.

Adım Adım Çözüm

1
Identify the DNS limitations for the zone apex domain (patientcheck.com).
Determine that CNAME records cannot be created for the zone apex, requiring the use of Route 53 Alias records instead.
Standard DNS specifications do not allow CNAME records at the zone apex, but Route 53 Alias records can map the zone apex directly to AWS resources.
2
Select the appropriate routing policy for the active-passive disaster recovery strategy.
Choose the Failover routing policy with primary and secondary record types.
Failover routing directs traffic to a primary resource when it is healthy, and to a secondary resource when the primary resource is unhealthy.
3
Enable health monitoring on the primary resource.
Set Evaluate Target Health to Yes on the primary Failover Alias record pointing to the Application Load Balancer.
Evaluate Target Health allows Route 53 to use the health checks configured on the Application Load Balancer's target groups to determine if the primary endpoint is healthy.

Anahtar Kavram

Active-passive DNS failover using Route 53 Failover Alias records at the zone apex.
Soru 253Soru →

A logistics company provides a web-based tracking dashboard containing static map tiles and a real-time tracking API. The static map tiles are stored in an Amazon S3 bucket in the eu-central-1 Region, and the API is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB) in the same Region. The company wants to reduce latency for global users and ensure the dashboard remains highly resilient to storage outages with minimal operational overhead.

Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon CloudFront distribution with an origin group that has the primary S3 bucket as the primary origin and a replicated S3 bucket in another Region as the failover origin.; Configure a cache behavior within the CloudFront distribution for the API path that forwards all headers and query strings to the Application Load Balancer and sets TTLs to zero.

Cevap

Configure an Amazon CloudFront distribution with an origin group that has the primary S3 bucket as the primary origin and a replicated S3 bucket in another Region as the failover origin, and configure a cache behavior within the CloudFront distribution for the API path that forwards all headers and query strings to the Application Load Balancer and sets TTLs to zero.
To achieve low latency and high resiliency for static assets (map tiles) and dynamic API requests, the solutions architect should use Amazon CloudFront. CloudFront caches static assets at edge locations close to users worldwide. By setting up a CloudFront origin group with the primary S3 bucket as the primary origin and a secondary replicated S3 bucket as the failover origin, CloudFront will automatically fail over if the primary S3 origin is unavailable. For the dynamic tracking API, a dedicated cache behavior should be created to forward all query strings and headers directly to the Application Load Balancer without caching, leveraging the AWS global network for optimized latency.

Adım Adım Çözüm

1
Set up a replicated Amazon S3 bucket in a secondary Region to store map tiles and configure a CloudFront distribution with an origin group containing both the primary and failover S3 buckets.
CloudFront handles requests for static map tiles, caching them at edge locations and automatically failing over to the secondary bucket if the primary bucket is unavailable.
To meet the reliability and performance constraints for static assets with minimal operational overhead.
2
Add a cache behavior for the API path (e.g., /api/*) that points to the Application Load Balancer as the origin.
Dynamic API requests are routed through CloudFront to the ALB while bypassing caching to ensure real-time tracking updates are delivered.
To optimize global routing for dynamic API queries and preserve the unified domain name.

Anahtar Kavram

Using Amazon CloudFront with origin groups for high availability of static assets and cache behaviors to route dynamic traffic to Application Load Balancers.
Soru 254Soru →

A SaaS company hosts its collaborative project management application at the apex domain projectcollab.com. The application's primary infrastructure runs in the us-west-2 Region, where an Application Load Balancer (ALB) routes traffic to a fleet of Amazon EC2 instances. The company maintains a warm standby disaster recovery environment in the eu-west-1 Region, which also uses an ALB. The company wants to implement an active-passive disaster recovery strategy where Amazon Route 53 automatically diverts all traffic to the warm standby environment in eu-west-1 only if the primary environment in us-west-2 experiences an outage.

Which combination of Route 53 configurations will meet these requirements? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a primary Failover Alias record for projectcollab.com that points to the Application Load Balancer in us-west-2 and configure Evaluate Target Health to Yes.; Create a secondary Failover Alias record for projectcollab.com that points to the Application Load Balancer in eu-west-1 and configure Evaluate Target Health to Yes.

Cevap

Create a primary Failover Alias record for the apex domain pointing to the us-west-2 ALB, and a secondary Failover Alias record pointing to the eu-west-1 ALB, both with Evaluate Target Health set to Yes.
To configure active-passive failover for an apex domain, you must use Route 53 Alias records because standard CNAME records are not allowed at the zone apex. The primary record must be configured as a Failover policy with the 'Primary' type, pointing to the primary ALB, and with 'Evaluate Target Health' set to 'Yes' so Route 53 can monitor the health of the primary ALB. The standby record must be configured as a Failover policy with the 'Secondary' type, pointing to the standby ALB, with 'Evaluate Target Health' also set to 'Yes' to ensure the secondary region's ALB health is verified before routing traffic to it.

Adım Adım Çözüm

1
Evaluate record requirements for the zone apex.
Determine that CNAME records cannot be used at the zone apex (projectcollab.com) due to DNS RFC limitations. Identify that Route 53 Alias records must be used to point to the Application Load Balancers.
Alias records allow mapping the zone apex to AWS resources like Application Load Balancers without violating DNS standards.
2
Configure the primary routing endpoint.
Configure a Failover routing policy record pointing to the primary ALB in us-west-2, set its failover type to Primary, and enable Evaluate Target Health.
This allows Route 53 to track the health of the primary ALB and stop routing traffic to it if the backend instances or ALB become unhealthy.
3
Configure the standby routing endpoint.
Configure a Failover routing policy record pointing to the standby ALB in eu-west-1, set its failover type to Secondary, and enable Evaluate Target Health.
This registers the standby environment as the target for traffic when the primary record is determined to be unhealthy.

Anahtar Kavram

Implementing Route 53 active-passive failover at the zone apex requires creating Primary and Secondary Failover Alias records pointing to the ALBs with health checks or Evaluate Target Health enabled.
Soru 255Soru →

A company hosts a web application on Amazon EC2 instances inside an Auto Scaling group behind an Application Load Balancer (ALB). The application on one of the EC2 instances becomes unresponsive, causing the ALB target group health check to mark that instance as unhealthy. However, the Auto Scaling group does not terminate or replace the unhealthy instance. Which action will ensure that the Auto Scaling group automatically replaces the unresponsive instance?

Cevabı ve açıklamayı göster

Cevap: Change the health check type of the Auto Scaling group from EC2 to ELB.

Cevap

Change the health check type of the Auto Scaling group from EC2 to ELB.
Changing the health check type of the Auto Scaling group from EC2 to ELB enables the group to utilize the load balancer's application-level health checks. When the Application Load Balancer target group marks the unresponsive instance as unhealthy, the Auto Scaling group detects this status, terminates the failed instance, and launches a new, healthy instance to maintain the desired capacity.

Adım Adım Çözüm

1
Diagnose why the Auto Scaling group fails to act on application-level failures.
Identify that the Auto Scaling group's default health check type is 'EC2', which only checks hardware and hypervisor status, leaving it unaware of application-level health check failures reported by the load balancer.
EC2 status checks do not monitor the status of the web application or service running on the instances.
2
Select the configuration that integrates Auto Scaling lifecycle events with Elastic Load Balancing health status.
Determine that changing the Auto Scaling group health check type to 'ELB' allows the group to consume target group health status.
When the health check type is set to 'ELB', the Auto Scaling group marks an instance as unhealthy and replaces it if either the EC2 status checks or the ELB target group health checks fail.

Anahtar Kavram

Auto Scaling Group Health Check Integration with Elastic Load Balancing
Soru 256Soru →

A gaming company hosts a multiplayer online battle arena (MOBA) game server backend on Amazon EC2 instances managed by an Auto Scaling group (ASG) in private subnets. The game server application communicates using UDP port 7777. To route incoming traffic with ultra-low latency, a solutions architect deploys a Network Load Balancer (NLB) in public subnets. The target group is configured to register the EC2 instances by Instance ID. The solutions architect has configured the security group of the EC2 instances to allow inbound UDP traffic on port 7777 from the client IP ranges. However, the NLB is marking all EC2 instances as unhealthy, and clients are unable to connect to the game servers. Which two actions should the solutions architect take to resolve the health check issues and allow client traffic? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the target group health check to use the TCP or HTTP protocol on a dedicated port, such as port 8080, and run a health status service on that port on the EC2 instances.; Add a rule to the EC2 instances' security group to allow inbound TCP traffic on the designated health check port from the private IP addresses of the NLB.

Cevap

To resolve the health check issues and allow client traffic, the solutions architect must configure the target group health check to use the TCP or HTTP protocol on a dedicated port, run a health status service on that port on the EC2 instances, and add a rule to the EC2 instances' security group to allow inbound TCP traffic on that designated health check port from the private IP addresses of the NLB.
To resolve the health check issues and allow client traffic, the solutions architect must configure a TCP- or HTTP-based health check on a dedicated port on the EC2 instances, and update the EC2 instances' security group to allow inbound TCP traffic on that health check port from the NLB's private IP addresses. Because Network Load Balancers (NLB) do not support UDP health checks, a separate TCP/HTTP listening service is required on the instances. Additionally, health checks originate directly from the NLB nodes' private IP addresses, requiring the security group to permit this traffic.

Adım Adım Çözüm

1
Analyze health check protocol limitations for Network Load Balancer (NLB) UDP target groups.
Identify that UDP-based health checks are unsupported; the target group health check protocol must be TCP, HTTP, or HTTPS.
Since UDP is stateless, it cannot verify target availability through standard handshakes, necessitating a TCP/HTTP listener for checks.
2
Determine the service configuration required on the EC2 instances.
Establish a separate TCP or HTTP service on a dedicated port (e.g., port 8080) on the EC2 instances to report health status.
The main game application uses UDP port 7777, so a separate port running a TCP/HTTP listener must respond to health checks.
3
Configure the security groups of the EC2 targets to allow health check traffic.
Add a rule to the EC2 instances' security group permitting inbound TCP traffic on the health check port from the NLB's private IP addresses.
Unlike client traffic (where client IP is preserved when registering by Instance ID), NLB health checks originate directly from the NLB's internal private IP addresses.

Anahtar Kavram

Network Load Balancer health checks for UDP target groups and target security group configuration.
Soru 257Soru →

A company hosts a high-traffic e-commerce application on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The ALB target group health check is configured to query an application endpoint `/health` on port 443, which verifies the application's connection to a backend Amazon RDS database. During a scheduled database maintenance window, the database becomes temporarily unavailable, causing the `/health` endpoint to return HTTP 500 errors. Consequently, the ALB target group marks all EC2 instances as unhealthy. Because the ASG is configured to use ELB health checks, it begins terminating all instances in the fleet and launching new ones. This results in a continuous loop of instance provisioning and termination, generating high costs and delaying recovery when the database comes back online. Which action should a Solutions Architect take to resolve this issue and prevent the unnecessary termination of EC2 instances during database outages?

Cevabı ve açıklamayı göster

Cevap: Configure the Auto Scaling group to use EC2 health checks instead of ELB health checks, allowing the Application Load Balancer to stop routing traffic to the instances while preventing the Auto Scaling group from terminating them.

Cevap

Configure the Auto Scaling group to use EC2 health checks instead of ELB health checks, allowing the Application Load Balancer to stop routing traffic to the instances while preventing the Auto Scaling group from terminating them.
Configuring the Auto Scaling group to use EC2 health checks instead of ELB health checks ensures that the Auto Scaling group only terminates instances if they fail EC2 status checks (hardware or hypervisor issues). The Application Load Balancer will still mark the instances as unhealthy and stop routing traffic to them when the database is unavailable, but the instances will not be terminated. Once the database becomes available again, the load balancer health checks will pass, and traffic will resume seamlessly.

Adım Adım Çözüm

1
Analyze the cause of the instance termination loop.
The Auto Scaling group is set to use ELB health checks, meaning any target group health check failure triggers instance termination and replacement.
To identify why the database outage results in instance termination rather than just traffic redirection.
2
Compare Auto Scaling group health check types (EC2 vs. ELB).
With EC2 health checks, the Auto Scaling group only replaces instances that fail hardware or system status checks. With ELB health checks, it also replaces instances that fail load balancer target group checks.
To determine how to decouple application-level dependencies (like the database) from instance lifecycle management.
3
Select the optimal configuration to handle temporary database maintenance.
By switching to EC2 health checks, the instances remain running during database downtime. The Application Load Balancer still marks them unhealthy and stops sending traffic, but the fleet is preserved, avoiding a high-cost provisioning loop.
To ensure high availability and cost-efficiency when the database recovers.

Anahtar Kavram

Decoupling Auto Scaling group health checks from Application Load Balancer health checks when downstream dependencies can cause transient failures.
Tahmini Süre:2m 0s
Soru 258Soru →

An architecture team is designing a global IoT telemetry solution. The system collects continuous status reports from millions of devices using a custom TCP-based protocol. The backend ingestion servers run on Amazon EC2 instances behind Application Load Balancers (ALBs) deployed in the us-east-1 and eu-west-1 regions. The solution must minimize packet latency, route device traffic to the nearest healthy region, and automatically failover within seconds during a regional outage. Which AWS service configuration meets these resilience and performance requirements?

Cevabı ve açıklamayı göster

Cevap: Provision AWS Global Accelerator and associate the Application Load Balancers (ALBs) in both regions as endpoints. Configure the accelerator to route custom TCP traffic over the AWS global network to the nearest healthy ALB, providing automatic failover.

Cevap

Provision AWS Global Accelerator and associate the Application Load Balancers (ALBs) in both regions as endpoints. Configure the accelerator to route custom TCP traffic over the AWS global network to the nearest healthy ALB, providing automatic failover.
AWS Global Accelerator is designed to optimize performance and availability for TCP and UDP traffic. It uses Anycast IP addresses to ingest traffic at the edge location closest to the user and routes it over the AWS global network to the nearest healthy regional endpoint. It performs continuous health checks and automatically redirects traffic to healthy endpoints in other regions within seconds if a regional failure occurs.

Adım Adım Çözüm

1
Analyze the protocol requirement.
The application uses a custom TCP-based protocol rather than standard HTTP/HTTPS.
This determines which edge services are compatible, as some services are limited to specific application layer protocols.
2
Evaluate Amazon CloudFront's protocol compatibility.
CloudFront is disqualified because it only supports HTTP, HTTPS, and WebSockets.
CloudFront cannot ingest or route raw custom TCP traffic.
3
Evaluate Route 53 latency routing for the failover time constraint.
Route 53 latency routing is disqualified because it cannot guarantee failover within seconds due to client DNS caching.
DNS-based failover is dependent on TTL expiration and client compliance, which often exceeds the desired outage recovery window.
4
Select AWS Global Accelerator as the optimal solution.
AWS Global Accelerator meets the requirements by supporting custom TCP traffic, using Anycast IP routing over the AWS global backbone, and automatically failing over to healthy endpoints in seconds.
This provides both the lowest latency routing and the resilient sub-minute failover required by the scenario.

Anahtar Kavram

AWS Global Accelerator vs. Amazon CloudFront for non-HTTP TCP traffic failover and optimization
Tahmini Süre:2m 0s
Soru 259Soru →

A solutions architect is deploying a web application on Amazon EC2 instances managed by an Auto Scaling group. The application runs on port 8080 and is registered with an Application Load Balancer (ALB) target group. The load balancer marks all EC2 instances as unhealthy, even though the application is running successfully on the instances. The security groups are already correctly configured to allow traffic on port 8080. Which two configurations should the solutions architect verify to resolve this health check issue? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Ensure that the target group health check port is explicitly configured to use port 8080 or the traffic port instead of defaulting to port 80.; Ensure that the stateless network access control list (network ACL) associated with the subnets allows outbound traffic on the ephemeral port range to permit health check responses.

Cevap

Verify that the target group health check port is explicitly configured to use port 8080 or the traffic port, and check that the stateless network ACLs allow outbound traffic on the ephemeral port range.
The correct configurations involve correcting the target group health check port and ensuring that stateless network ACLs allow the return traffic. By default, target group health checks may query port 80, but since the application runs on port 8080, the health check port must be set to port 8080 or configured as the 'traffic-port'. Additionally, since network ACLs are stateless, they require explicit outbound rules for the ephemeral port range to allow return traffic from the EC2 instances back to the load balancer.

Adım Adım Çözüm

1
Analyze the load balancer health check configuration and compare it to the port where the application is listening.
The application is running on port 8080, but default health checks might query port 80. The target group must be updated to query port 8080 or the traffic port.
Health checks fail if they query a port where no service is listening.
2
Examine the subnet-level network access control lists (network ACLs) for traffic restrictions.
Since network ACLs are stateless, verify that outbound rules permit traffic to the ephemeral ports (1024-65535) back to the load balancer.
Even if inbound traffic is allowed, stateless network ACLs will block the return health check responses if ephemeral outbound ports are not open.

Anahtar Kavram

Auto Scaling and Elastic Load Balancing health checks rely on matching port configurations and stateful/stateless firewall rules (security groups and network ACLs) to function correctly.
Soru 260Soru →

A logistics company is deploying a telemetry receiver API on Amazon EC2 instances. The instances are managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The API is configured to listen on TCP port 50051. The ALB is configured with an HTTPS listener that routes traffic to a target group associated with the ASG. After deploying the application, the solutions architect notices that the ALB target group shows all EC2 instances as unhealthy. The security group associated with the EC2 instances currently allows inbound traffic on port 50051 from the ALB security group, and outbound traffic to all destinations. Which combination of actions should the solutions architect take to resolve this issue and ensure the instances are marked healthy? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the target group's health check settings to use port 50051 instead of the default port.; Configure the Application Load Balancer's security group to allow outbound TCP traffic on port 50051 to the security group of the EC2 instances.

Cevap

Modify the target group's health check settings to use port 50051, and configure the Application Load Balancer's security group to allow outbound TCP traffic on port 50051 to the security group of the EC2 instances.
The target group must be configured to send health check requests to port 50051 because that is where the telemetry service is listening. Since the default health check port is port 80 (or the traffic port if not overridden, but here it defaults to HTTP/80), the load balancer was sending health checks to a port where no service was listening. Additionally, the Application Load Balancer's security group must be configured to allow outbound traffic to the EC2 instances on port 50051. While the EC2 instances' security group allowed inbound traffic, security groups on the load balancer must also permit the outbound connection to the targets.

Adım Adım Çözüm

1
Analyze the health check configuration of the target group.
Identify that the default target group health check port (or port 80) does not match the application's port of 50051.
Health check requests must be routed to the port where the service is active to determine its health status.
2
Check the outbound security group rules for the Application Load Balancer.
Identify that the ALB security group does not allow outbound TCP traffic to the EC2 instances on port 50051.
The ALB must be permitted to initiate connections to the EC2 instances on the traffic port to perform health checks and route client traffic.
3
Verify security group statefulness and Network ACL rules.
Confirm that security groups are stateful, meaning outbound response traffic is allowed automatically without modifying Network ACLs.
Avoids introducing unnecessary and overly permissive Network ACL rules based on statefulness misconceptions.

Anahtar Kavram

Auto Scaling and Elastic Load Balancing (ELB) health check configurations, port overrides, and secure security group communication paths.
Tahmini Süre:2m 0s
ÖncekiSayfa 13 / 20Sonraki
Design Resilient Architectures Alıştırma Soruları — AWS Certified Solutions Architect - Associate — Sayfa 13 | Examkin