Tüm alıştırma soruları

1964 soru

Tüm türler1,964 Çoktan seçmeli1,006 Çoklu seçim931 Sıralama27

An enterprise is designing a centralized auditing solution for its AWS Organization, which contains $85$ member accounts. The security team wants to enable AWS CloudTrail for all accounts to log all read and write API activity across all AWS Regions. The log files must be consolidated in a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted using a KMS key, and the security team must prevent any member account administrators from disabling or modifying the trail. Which combination of actions should the Solutions Architect take to implement this solution? (Select TWO.)

Geçerli olan tümünü seçin

Create an AWS CloudTrail organization trail in the Organization management account that sends logs to the central Amazon S3 bucket in the Security account, and apply a Service Control Policy (SCP) to the root of the organization that denies member accounts the ability to delete or modify CloudTrail configurations.

Create a KMS customer managed key in the Security account, configure its key policy to allow the CloudTrail service principal to perform key generation and description operations, and update the Amazon S3 bucket policy in the Security account to allow the CloudTrail service principal to write logs.

Enable encryption on the organization trail using the default AWS-managed KMS key (aws/s3) to ensure all log files deposited into the Security account S3 bucket are encrypted at rest without administrative overhead.

Create a Service Control Policy (SCP) that grants the s3:PutObject permission to the CloudTrail service principal and apply it to the member accounts' Organizational Units (OUs) to authorize log delivery to the Security account's S3 bucket.

Configure the S3 bucket policy on the Security account's log bucket to allow the root IAM users of each individual member account permission to perform s3:PutObject actions, specifying each account ID explicitly in the Principal element.

Cevabı ve açıklamayı göster

Cevap: Create an AWS CloudTrail organization trail in the Organization management account that sends logs to the central Amazon S3 bucket in the Security account, and apply a Service Control Policy (SCP) to the root of the organization that denies member accounts the ability to delete or modify CloudTrail configurations.; Create a KMS customer managed key in the Security account, configure its key policy to allow the CloudTrail service principal to perform key generation and description operations, and update the Amazon S3 bucket policy in the Security account to allow the CloudTrail service principal to write logs.

Cevap

Create an AWS CloudTrail organization trail in the Organization management account combined with a Service Control Policy (SCP) to prevent modification, and use a KMS customer managed key in the Security account with policies configured to allow the CloudTrail service principal access.

Centralizing CloudTrail logs requires creating an organization trail, which automatically logs events for all AWS accounts in the organization. To protect the logging configuration, a Service Control Policy (SCP) is applied at the organization root to deny deletion or modification of CloudTrail resources by member accounts. For encryption, a customer managed key is required because AWS-managed keys cannot be shared cross-account or support policy changes. Both the S3 bucket policy and the KMS key policy must explicitly allow the CloudTrail service principal to perform write and key generation operations.

Adım Adım Çözüm

Deploy an AWS CloudTrail organization trail from the management account.

Configures API logging across all current and future member accounts in the organization, sending logs to the central Security account's S3 bucket.

This avoids manual setup in individual member accounts and ensures organizational compliance.

Apply an SCP to block CloudTrail modification API calls for member accounts.

Prevents member account administrators from stopping logging or deleting the centralized trail.

This guarantees the integrity of the audit trails.

Use a Customer Managed KMS Key (CMK) in the Security account for log encryption, and configure both the KMS key policy and S3 bucket policy to trust the CloudTrail service principal.

CloudTrail is authorized to write encrypted log files directly to the target S3 bucket in the Security account.

AWS-managed KMS keys do not support policy modification and cannot be shared cross-account, making a customer managed key necessary.

Anahtar Kavram

Centralized auditing using AWS CloudTrail Organization Trails, S3 bucket policies, and cross-account Customer Managed KMS Keys.

Soru 222Soru →

An enterprise operates a high-performance web application deployed across two AWS Regions: us-east-1 and eu-west-1. Traffic is routed to the application endpoints via Amazon Route 53 using latency-based routing. The infrastructure team is designing a deployment strategy to release a major application update. The release requirements are:

1. The update must be rolled out to us-east-1 first, routing exactly 5% of the region's live traffic to the new version (the canary) to evaluate performance and error rates.
2. The remaining 95% of traffic in us-east-1 and 100% of traffic in eu-west-1 must continue to access the stable version.
3. If the canary deployment meets health metrics after 1 hour, traffic must be gradually shifted to 100% in us-east-1, followed by a similar rollout in eu-west-1.
4. If health metrics are violated, the canary traffic must be immediately redirected to the stable version without affecting latency-based routing for other users.

Which Route 53 configuration should a Solutions Architect recommend to implement this deployment strategy?

Create weighted records for the application domain to distribute traffic to the us-east-1 and eu-west-1 regions. Under each regional subdomain, create nested latency-based records pointing to the respective Application Load Balancers. Add a third top-level weighted record pointing directly to the new Application Load Balancer in us-east-1 with a weight of 5.

Change the routing policy of the primary domain from latency-based to geolocation-based routing. Route all traffic from North America to a weighted record set containing the stable and new Application Load Balancer endpoints in us-east-1 with weights of 95 and 5, respectively. Route European traffic to the stable Application Load Balancer in eu-west-1.

Create latency-based Alias records for the application domain. Point the latency record for the us-east-1 region to a nested weighted record set for a regional subdomain. Configure this subdomain with two records in the us-east-1 region: one pointing to the stable Application Load Balancer with a weight of 95, and one pointing to the new Application Load Balancer with a weight of 5.

Create a single latency-based record set for the application domain. Add a latency record for eu-west-1 pointing to the stable Application Load Balancer, a latency record for us-east-1 with a weight of 95 pointing to the stable Application Load Balancer, and a latency record for us-east-1 with a weight of 5 pointing to the new Application Load Balancer.

Cevabı ve açıklamayı göster

Cevap: Create latency-based Alias records for the application domain. Point the latency record for the us-east-1 region to a nested weighted record set for a regional subdomain. Configure this subdomain with two records in the us-east-1 region: one pointing to the stable Application Load Balancer with a weight of 95, and one pointing to the new Application Load Balancer with a weight of 5.

Cevap

The correct strategy is to nest a weighted record set under a latency-based alias record. This configuration first routes users to the nearest region using latency routing, and then distributes the US regional traffic between the stable and new Application Load Balancer endpoints using a 95/5 weight distribution.

The correct architecture uses nested Route 53 records to combine latency-based routing and weighted routing. By defining latency-based alias records at the top level pointing to regional subdomains, users are first routed to the closest region. For the US region, the traffic is directed to a nested weighted record set, which then distributes 95% of the traffic to the stable Application Load Balancer and 5% to the new canary Application Load Balancer. This preserves latency-based routing for all users while enabling a controlled canary release in a single region.

Adım Adım Çözüm

Define the top-level DNS routing configuration.

Create latency-based Alias records for the primary application domain.

This ensures that DNS requests are routed to the nearest regional endpoint based on user latency.

Configure regional traffic splitting for the canary deployment.

Point the us-east-1 latency-based record to a nested subdomain containing a weighted record set with weights of 95 and 5.

This splits traffic within the us-east-1 region, sending 5% of the users to the new version (canary) and 95% to the stable version.

Configure the stable region routing.

Point the eu-west-1 latency-based record directly to the stable ALB in eu-west-1.

This ensures that 100% of the traffic in eu-west-1 continues to use the stable version without interruption.

Anahtar Kavram

Combining Amazon Route 53 latency-based routing with weighted routing using nested records to perform a regional canary deployment.

Soru 223Soru →

A global online gaming company is launching a multiplayer battle royale game designed to support $5,000,000$ concurrent users. The architecture uses Application Load Balancers (ALBs) to route traffic to matchmaking microservices running on Amazon ECS tasks using the AWS Fargate launch type. Matchmaking state is stored in an Amazon Aurora PostgreSQL Serverless v2 database, and session tracking uses Amazon ElastiCache for Redis. During global marketing events, matchmaking traffic is projected to surge from $10,000\text{ requests/sec}$ to over $500,000\text{ requests/sec}$ in under $60\text{ seconds}$ . A solutions architect must design a highly scalable and performant solution that prevents connection failures and database bottlenecks during these sudden spikes. Which combination of actions will meet these scalability and performance requirements while minimizing connection failures and request latency? (Select TWO.)

Geçerli olan tümünü seçin

Submit a support ticket to AWS Support to pre-warm the Application Load Balancers with the expected peak traffic volume and request rate prior to the scheduled marketing events.

Configure scheduled scaling policies for the ECS Service Auto Scaling to scale out the matchmaking Fargate tasks to the estimated peak capacity before the marketing events start.

Configure the Application Load Balancers to scale out dynamically using a target tracking scaling policy based on the RequestCountPerTarget metric, allowing the load balancers to adjust to the traffic surge in real time.

Scale the matchmaking database reads by configuring the ECS Fargate tasks to route read-heavy queries directly to the Amazon RDS Multi-AZ standby instance of the database during the surge.

Migrate the session tracking cache from Amazon ElastiCache for Redis to ElastiCache for Memcached to utilize its multi-threaded engine for faster request handling, and enable multi-AZ replication across three Availability Zones.

Cevabı ve açıklamayı göster

Cevap: Submit a support ticket to AWS Support to pre-warm the Application Load Balancers with the expected peak traffic volume and request rate prior to the scheduled marketing events.; Configure scheduled scaling policies for the ECS Service Auto Scaling to scale out the matchmaking Fargate tasks to the estimated peak capacity before the marketing events start.

Cevap

Pre-warming the Application Load Balancers (ALBs) by submitting an AWS Support request and pre-scaling the Amazon ECS Fargate tasks using scheduled scaling policies prior to the events.

Pre-warming the Application Load Balancer prevents connection drops caused by the latency of the load balancer's built-in scaling algorithm when hit by sudden, massive traffic spikes. Scheduled scaling for ECS Service Auto Scaling ensures that ECS tasks are already launched, bootstrapped, and ready to receive traffic before the spike starts, avoiding container capacity exhaustion.

Adım Adım Çözüm

Address the load balancer scaling limitation.

By pre-warming the ALBs with AWS Support, the load balancers are provisioned with sufficient capacity in advance to absorb a

50\times

spike in request rate without dropping connections.

Standard ALB auto-scaling is gradual and cannot scale fast enough to meet a

50\times

traffic surge within

60\text{ seconds}

Proactively scale the ECS Fargate compute layer.

Using scheduled scaling policies for ECS Service Auto Scaling to scale out Fargate tasks ahead of the event ensures compute capacity is fully running and ready to handle requests immediately.

Target tracking scaling is reactive and introduces bootstrapping latency, which causes container resource saturation during rapid flash traffic.

Discard passive read routing options.

Avoid options suggesting routing queries to the Multi-AZ standby instance, as standby instances are replication targets that cannot accept user connections.

Only Aurora Replicas or RDS Read Replicas can be used for read scaling.

Anahtar Kavram

Handling extreme flash traffic spikes requires proactive capacity allocation at both the load balancing and compute layers, as reactive scaling mechanisms introduce too much latency.

Soru 224Soru →

An enterprise needs to migrate a $250\text{ TB}$ dataset of legacy files from an on-premises NFS file system to an Amazon S3 bucket. The enterprise has a dedicated $100\text{ Mbps}$ network connection to AWS. The migration must be completed within a $14$ -day maintenance window. The migrated data must be encrypted at rest using an AWS Key Management Service (AWS KMS) key that allows the enterprise to delegate cross-account decryption access to an external auditing team. Which strategy should a solutions architect recommend to meet these requirements?

Deploy an AWS DataSync agent on-premises to transfer the data from the NFS file system to the Amazon S3 bucket over the

100\text{ Mbps}

network connection, utilizing task scheduling and built-in compression to optimize transfer performance.

Order three AWS Snowball Edge Storage Optimized devices. Specify an AWS KMS Customer Managed Key (CMK) when creating the import jobs. Copy the data from the NFS file system to the devices using the Snowball client, and ship the devices back to AWS.

Order three AWS Snowball Edge Storage Optimized devices. Specify the default AWS-managed key (`aws/s3`) when creating the import jobs to encrypt the objects in S3, and grant cross-account read access using the S3 bucket policy.

Establish an AWS Direct Connect connection with a Hosted Connection of

100\text{ Mbps}

. Use an AWS Transit Gateway and a transit Virtual Interface (VIF) to route AWS DataSync traffic privately to an S3 interface endpoint, completing the transfer over the private network.

Cevabı ve açıklamayı göster

Cevap: Order three AWS Snowball Edge Storage Optimized devices. Specify an AWS KMS Customer Managed Key (CMK) when creating the import jobs. Copy the data from the NFS file system to the devices using the Snowball client, and ship the devices back to AWS.

Cevap

Order AWS Snowball Edge Storage Optimized devices and configure the import jobs to use an AWS KMS Customer Managed Key (CMK) to allow cross-account access.

The correct answer correctly identifies that transferring

250\text{ TB}

of data over a

100\text{ Mbps}

network connection takes too long, making offline migration with AWS Snowball Edge devices necessary. Additionally, it accurately points out that a Customer Managed Key (CMK) must be selected for encryption during the Snowball import configuration, because the key policy of default AWS-managed keys (`aws/s3`) cannot be edited to delegate decryption permissions to external AWS accounts.

Adım Adım Çözüm

Calculate the time required to migrate

250\text{ TB}

over the existing

100\text{ Mbps}

network link.

The transfer will take approximately

231

days under ideal conditions.

This shows that an online data transfer mechanism is not viable for the

14

-day timeline, necessitating an offline data transfer using AWS Snowball Edge.

Select the appropriate storage medium for offline transfer and evaluate storage limits.

Three AWS Snowball Edge Storage Optimized devices are required to store the

250\text{ TB}

dataset.

Shipping and loading three Snowball Edge devices will comfortably take

7-10

days, which fits within the

14

-day window.

Address the security requirement to delegate decryption access to an external auditing team in another account.

Select a Customer Managed Key (CMK) instead of an AWS-managed key.

Default AWS-managed keys (like `aws/s3`) do not allow key policy customization, meaning cross-account decryption cannot be configured. A CMK allows modifying the key policy to delegate cross-account access.

Anahtar Kavram

Selecting between online and offline data migration based on bandwidth constraints, and managing cross-account access for KMS-encrypted S3 objects.

Tahmini Süre:2m 0s

Soru 225Soru →

An international flight dispatch and crew scheduling platform is designing a new multi-region disaster recovery (DR) architecture. The application is deployed across VPCs in us-east-1 (Primary) and us-west-2 (Secondary). The platform has a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $1$ minute. Outbound internet communication from application servers in private subnets must remain highly available in the event of an Availability Zone (AZ) outage. The system must minimize operational costs during idle periods, while ensuring that database failover meets the target recovery metrics. Which two of the following configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy a single db.r6g.large reader instance in the secondary cluster to minimize idle database costs, and use automated scripting or AWS Application Recovery Controller to initiate failover and database promotion during a disaster event.

In both the us-east-1 and us-west-2 VPCs, deploy a NAT Gateway in each Availability Zone. Configure the route table for each private subnet to route outbound traffic to the NAT Gateway in its respective Availability Zone.

Deploy a single NAT Gateway in the primary Availability Zone of each VPC, and configure the route tables of all private subnets across all Availability Zones to route outbound internet traffic through this single NAT Gateway.

Configure Route 53 with an Active-Active Latency routing policy pointing to Application Load Balancers in both regions, and rely on Route 53 health checks to automatically redirect write traffic to us-west-2 without database promotion if us-east-1 experiences an outage.

Configure Amazon Aurora Serverless v2 in us-east-1 and set up Amazon RDS Multi-AZ replication to a standby db.r6g.large instance in us-west-2 to serve read-only queries and scale dynamically.

Create a Route 53 Private Hosted Zone (PHZ) in the primary AWS account to resolve internal service endpoints, and configure a Route 53 Resolver endpoint in the secondary account to forward DNS queries across regions without associating the PHZ to the VPC in us-west-2.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy a single db.r6g.large reader instance in the secondary cluster to minimize idle database costs, and use automated scripting or AWS Application Recovery Controller to initiate failover and database promotion during a disaster event.; In both the us-east-1 and us-west-2 VPCs, deploy a NAT Gateway in each Availability Zone. Configure the route table for each private subnet to route outbound traffic to the NAT Gateway in its respective Availability Zone.

Cevap

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 running a single db.r6g.large reader instance, while using automated scripting or AWS Application Recovery Controller to initiate failover. Additionally, deploy a NAT Gateway in each Availability Zone in both regions and configure subnet route tables to route outbound traffic locally.

The correct configurations combine Amazon Aurora Global Database for low-latency asynchronous replication (achieving RPO <

1

minute) with a single small instance in the secondary region to optimize costs, and deploy multi-AZ NAT Gateways to ensure outbound internet routes remain resilient to Availability Zone failures.

Adım Adım Çözüm

Evaluate the database replication strategy to satisfy the target recovery metrics.

Using Amazon Aurora Global Database provides cross-region replication lag of less than

1

second (meeting the

1

-minute RPO). Keeping a single small reader instance in the secondary cluster minimizes operational costs during normal operations.

An unplanned failover can be initiated programmatically within minutes, well within the

15

-minute RTO limit, without paying for duplicate primary capacity in the secondary region.

Design highly resilient outbound internet connectivity to prevent single points of failure.

A NAT Gateway must be deployed in each Availability Zone of both VPCs, with subnet route tables directing

0.0.0.0/0

traffic to the local zone's NAT Gateway.

NAT Gateways are zone-redundant resources; a single NAT Gateway deployment exposes all private subnets in other Availability Zones to outage risks if that specific zone fails.

Eliminate invalid options based on architectural limitations and cross-region DNS constraints.

Ensure Private Hosted Zones are associated directly with the target VPCs rather than relying on cross-account forwarding rules, and reject cross-region RDS Multi-AZ replication proposals since Multi-AZ does not cross regional boundaries.

This guarantees that DNS endpoints resolve correctly after failover and that database replication behaves according to AWS product capabilities.

Anahtar Kavram

Designing cost-optimized, multi-region disaster recovery (DR) architectures using Aurora Global Database combined with zone-redundant NAT Gateway topologies to achieve target RTO/RPO metrics.

Tahmini Süre:3m 0s

Soru 226Soru →

A retail enterprise is modernizing its legacy order processing system by migrating it to a serverless architecture on AWS. The new architecture uses an Amazon API Gateway API that triggers an AWS Lambda function. The Lambda function processes orders and updates an Amazon RDS for PostgreSQL database located in a private VPC subnet. The database also serves other business-critical reporting applications. During promotional sales, the system experiences high-volume, bursty traffic. The solutions architect must ensure that the order-processing Lambda functions do not exhaust the RDS database connection limit, and that these traffic bursts do not throttle other Lambda functions in the same AWS account. Which design should the solutions architect implement to satisfy these requirements?

Deploy the Lambda function in a single private subnet pointing to a single NAT Gateway. Direct the Lambda function to connect directly to the RDS database using a custom connection pooling library in the function code, and configure reserved concurrency.

Deploy Amazon RDS Proxy in the VPC to manage the database connection pool. Configure provisioned concurrency on the order-processing Lambda function without setting a reserved concurrency limit.

Deploy Amazon RDS Proxy in the VPC to manage the database connection pool. Configure reserved concurrency on the order-processing Lambda function.

Deploy Amazon RDS Proxy in the VPC. Configure the Lambda function to access database credentials using an AWS KMS AWS-managed key shared from a central security account, and configure reserved concurrency.

Cevabı ve açıklamayı göster

Cevap: Deploy Amazon RDS Proxy in the VPC to manage the database connection pool. Configure reserved concurrency on the order-processing Lambda function.

Cevap

Deploy Amazon RDS Proxy in the VPC to manage the database connection pool. Configure reserved concurrency on the order-processing Lambda function.

The correct architecture uses Amazon RDS Proxy to pool and reuse database connections, preventing the scaled Lambda instances from overwhelming the database connection limits. Furthermore, setting reserved concurrency on the Lambda function acts as a maximum limit of execution environments, preventing a spike in order processing from exhausting the regional account-level concurrency pool and throttling other functions.

Adım Adım Çözüm

Address database connection limits.

Using Amazon RDS Proxy allows pooling and sharing of database connections, protecting the PostgreSQL database from connection exhaustion caused by rapid horizontal scaling of AWS Lambda.

Serverless functions spin up rapidly and open individual connections, which can quickly exceed database connection limits.

Address Lambda concurrency sharing and throttling prevention.

Configure reserved concurrency on the order-processing Lambda function.

Reserved concurrency reserves a portion of the account's concurrency pool for this function while also acting as a concurrency ceiling. This prevents the function from scaling out of control and consuming the entire regional concurrency pool, which would otherwise throttle other functions in the same account.

Anahtar Kavram

To successfully modernize workloads with serverless architectures using AWS Lambda and API Gateway, solutions architects must manage resource scaling boundaries. This includes using Amazon RDS Proxy to shield databases from connection exhaustion and configuring reserved concurrency limits to prevent high-volume functions from starving other serverless workloads in the same AWS account.

Tahmini Süre:2m 0s

Soru 227Soru →

A real estate platform is designing a new multi-region disaster recovery (DR) and high availability architecture for its listing portal. The primary region is us-east-1 and the secondary region is us-west-2. The solution must support an RTO of 15 minutes and an RPO of 5 minutes, while minimizing baseline costs. The outbound internet connectivity from private subnets must remain operational if a single Availability Zone experiences an outage. Under normal operations, users must be routed to the region that offers the lowest latency, and failover to the backup region must occur automatically if the primary region becomes unhealthy.

Which two architectural components should a Solutions Architect select to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and deploy one NAT Gateway per Availability Zone in each region's public subnets.

Configure Route 53 Latency routing records with associated health checks pointing to the Application Load Balancers in both regions.

Configure the database using hourly Amazon RDS snapshots copied to us-west-2, and restore the database cluster in the secondary region during a failover event.

Deploy a single NAT Gateway in one public subnet per region to handle all outbound traffic across all private subnets to minimize baseline costs.

Create Route 53 Private Hosted Zones in the secondary region and associate them with all consumer VPCs in both regions to perform regional failover for external users.

Configure Amazon RDS Multi-AZ replication across both regions, and use the standby instance in the secondary region to serve low-latency read traffic.

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and deploy one NAT Gateway per Availability Zone in each region's public subnets.; Configure Route 53 Latency routing records with associated health checks pointing to the Application Load Balancers in both regions.

Cevap

To meet the RTO, RPO, and high availability requirements, the architecture must utilize Amazon Aurora Global Database for low-latency cross-region replication, deploy a NAT Gateway in each Availability Zone in both regions for outbound redundancy, and implement Route 53 Latency routing with health checks to route users to the closest healthy region.

The combination of Amazon Aurora Global Database for database replication and Route 53 Latency routing with health checks meets the requirements. Aurora Global Database replicates data continuously across regions with lag typically under one second, ensuring that the 5-minute RPO is met. If the primary region fails, the secondary cluster can be promoted to a standalone read-write database in under a minute, comfortably meeting the 15-minute RTO. Route 53 Latency routing directs clients to the region offering the best performance, and the associated health checks ensure automated routing away from a degraded region. Deploying a NAT Gateway in each Availability Zone ensures that outbound network connectivity is protected against single Availability Zone failures.

Adım Adım Çözüm

Evaluate cross-region database replication options to meet the RTO of 15 minutes and RPO of 5 minutes.

Determine that Amazon Aurora Global Database provides sub-second replication latency (meeting the 5-minute RPO) and fast promotion (meeting the 15-minute RTO), while traditional snapshot copies fail the target metrics.

Aligning data replication speed with RPO/RTO constraints is a primary driver in selecting the DR architecture pattern.

Design NAT Gateway placement in public subnets to prevent outbound traffic failure during an Availability Zone outage.

Deploy one NAT Gateway per Availability Zone rather than a single shared NAT Gateway per region.

A single NAT Gateway per region introduces a single point of failure, violating the high availability constraint for outbound traffic.

Select and configure Route 53 public routing policies for low-latency user routing and automatic regional failover.

Configure Latency-based routing records for the public domain name and associate health checks targeting the Application Load Balancer in each region.

Latency routing directs users to the closest region, and the associated health checks allow Route 53 to stop routing to a degraded region automatically.

Anahtar Kavram

Selecting proper disaster recovery patterns (Active-Passive or Active-Active) and routing mechanisms based on RTO, RPO, outbound HA, and latency constraints.

Soru 228Soru →

A gaming company is launching a highly anticipated multiplayer game. During peak tournament events, the matchmaking and session metadata service expects an instantaneous surge in traffic, scaling from a baseline of $2,000\text{ requests per second}$ to over $150,000\text{ requests per second}$ in less than $30\text{ seconds}$ . The backend architecture consists of an Application Load Balancer (ALB) routing traffic to a containerized fleet running on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The session state is stored in an Amazon Aurora PostgreSQL database. Performance during the transition must be seamless, with latency under $50\text{ ms}$ for $99\%$ of requests, and no connection failures. Which two configurations should the Solutions Architect implement to meet these requirements?

Geçerli olan tümünü seçin

Request AWS Support to pre-warm the Application Load Balancer to the anticipated throughput of

150,000\text{ requests per second}

before the tournament, and configure Amazon ECS Scheduled Scaling to scale the task count to the anticipated peak capacity ahead of the event.

Implement Amazon ElastiCache for Redis in a Multi-AZ replication group to cache session metadata, and configure the application to query the cache before accessing the Aurora database.

Configure the Application Load Balancer to scale dynamically using target tracking scaling, and set the ECS service scaling cooldown period to

15\text{ seconds}

to allow the Fargate tasks to scale out rapidly.

Enable Multi-AZ deployment for the Amazon Aurora database cluster and configure the application to route read-only queries to the standby instance in the secondary Availability Zone to handle the read volume.

Deploy Amazon ElastiCache for Memcached to store session metadata, and configure it with Multi-AZ replication to ensure high availability and automatic failover.

Cevabı ve açıklamayı göster

Cevap: Request AWS Support to pre-warm the Application Load Balancer to the anticipated throughput of $150,000\text{ requests per second}$ before the tournament, and configure Amazon ECS Scheduled Scaling to scale the task count to the anticipated peak capacity ahead of the event.; Implement Amazon ElastiCache for Redis in a Multi-AZ replication group to cache session metadata, and configure the application to query the cache before accessing the Aurora database.

Cevap

Pre-warm the Application Load Balancer via AWS Support and configure Amazon ECS Scheduled Scaling to scale out the task count before the event, and implement Amazon ElastiCache for Redis in a Multi-AZ replication group to cache session metadata.

Pre-warming the Application Load Balancer ensures that AWS allocates sufficient capacity beforehand to prevent dropped connections during the instantaneous

150,000\text{ requests per second}

surge. Using Amazon ECS Scheduled Scaling ensures that the container fleet is scaled out prior to the event, bypassing the latency associated with task provisioning and application bootstrapping. Additionally, placing Amazon ElastiCache for Redis in front of the database offloads read traffic and provides sub-millisecond latency for session metadata, satisfying the

50\text{ ms}

latency requirement while ensuring high availability through Multi-AZ replication.

Adım Adım Çözüm

Analyze load balancer scaling characteristics under extreme flash traffic.

Dynamic scaling of an Application Load Balancer takes time to provision new nodes and update DNS. A

75\times

surge in 30 seconds requires requesting ALB pre-warming from AWS Support to avoid dropped connections.

Prevents HTTP 503 errors and connection timeouts at the entry point during the instantaneous load spike.

Address ECS container fleet launch and bootstrapping latency.

Standard dynamic scaling based on CPU or request metrics cannot launch container tasks fast enough to meet a 30-second ramp-up window. Scheduled scaling must be configured to provision target capacity in advance.

Ensures that the required container capacity is active and ready to process requests before the tournament starts.

Design a high-performance database caching layer for session metadata.

Offload read queries from Aurora PostgreSQL to an in-memory caching tier that supports sub-millisecond reads, data replication, and high availability.

Reduces read load on the transactional database and ensures consistent low latency during high-concurrency periods.

Select the correct caching technology that satisfies replication and high availability constraints.

Select Amazon ElastiCache for Redis because it supports Multi-AZ replication, automatic failover, and data persistence, whereas Memcached does not support replication.

Meets high availability requirements while storing session metadata.

Anahtar Kavram

Handling instantaneous load spikes (flash traffic) through pre-warming, proactive scaling, and high-availability caching architectures.

Soru 229Soru →

A logistics corporation is designing a hybrid network connectivity solution for its multi-account AWS environment. The infrastructure consists of $60$ spoke VPCs evenly distributed across the `us-east-1` and `eu-west-1` regions. The company must connect this infrastructure to two on-premises data centers: a primary site in Frankfurt and a secondary site in Munich. The design must use two $10\text{ Gbps}$ AWS Direct Connect connections—one terminating in Frankfurt and another in Munich—to achieve high availability and active-standby failover. The architecture must minimize BGP routing complexity and administrative overhead, prevent inter-VPC traffic from crossing regions unless explicitly configured, and scale to accommodate new spoke VPCs without manual BGP updates. Which TWO network configurations should a solutions architect implement to meet these requirements?

Geçerli olan tümünü seçin

Deploy an AWS Transit Gateway in `us-east-1` and another in `eu-west-1`, then associate both Transit Gateways with a single global AWS Direct Connect Gateway.

On the Direct Connect Gateway association for each Transit Gateway, configure the allowed prefixes to advertise only the specific IP CIDR blocks of the VPCs located within that Transit Gateway's respective region.

Establish a Transit Gateway peering connection between the two regions, and configure the route tables to dynamically route on-premises destined traffic through the peered Transit Gateway if the local Direct Connect connection fails.

Create a separate AWS Direct Connect Gateway in each region, and peer the two Direct Connect Gateways to enable cross-region transitive routing between the data centers and the spoke VPCs.

Utilize AWS Resource Access Manager to share the Direct Connect private virtual interfaces (VIFs) across all AWS accounts, and configure BGP sessions directly from the on-premises routers to each spoke VPC Virtual Private Gateway.

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway in `us-east-1` and another in `eu-west-1`, then associate both Transit Gateways with a single global AWS Direct Connect Gateway.; On the Direct Connect Gateway association for each Transit Gateway, configure the allowed prefixes to advertise only the specific IP CIDR blocks of the VPCs located within that Transit Gateway's respective region.

Cevap

Deploy an AWS Transit Gateway in each region, associate both with a single global AWS Direct Connect Gateway, and configure regional allowed prefixes on each Transit Gateway association to restrict advertised routes to their respective regions.

To implement a scalable hybrid networking architecture across multiple regions and accounts, a solutions architect should deploy a regional AWS Transit Gateway in each region and attach all regional spoke VPCs to them. Associating both Transit Gateways with a single global AWS Direct Connect Gateway enables transit routing to the on-premises data centers over the shared Direct Connect connections while minimizing BGP configurations. By configuring the allowed prefixes on each Transit Gateway association to include only the local regional CIDR blocks, the architect ensures that on-premises routers only receive optimal paths for each region and prevents cross-region traffic from hair-pinning through the data centers.

Adım Adım Çözüm

Consolidate regional spoke VPCs into regional hubs.

Create one Transit Gateway in `us-east-1` and another in `eu-west-1`, attaching local spoke VPCs to their respective regional Transit Gateway.

This establishes a hub-and-spoke pattern in each region, eliminating the need to manage individual VPN or Direct Connect connections for each VPC.

Connect regional hubs to the hybrid network.

Create a single global Direct Connect Gateway and associate both Transit Gateways with it.

Direct Connect Gateways support multi-region Transit Gateway associations, allowing a single hybrid network interface to serve both regions and reducing BGP peering complexity.

Filter route advertisements for optimal path selection.

Specify only the regional VPC CIDRs in the allowed prefixes list of the Transit Gateway associations.

This prevents cross-region traffic from being routed unnecessarily through the on-premises data centers (hair-pinning) and ensures proper routing boundaries.

Anahtar Kavram

AWS Transit Gateway and Direct Connect Gateway integration for scalable, multi-region hybrid connectivity.

Soru 230Soru →

A digital learning platform offers synchronized online examination sessions for universities worldwide. During the first $5$ minutes of a scheduled exam, traffic spikes instantaneously from $100$ requests per second (RPS) to over $60,000$ RPS as thousands of students log in and fetch the exam question database. The architecture utilizes an Application Load Balancer (ALB) and an Auto Scaling group of Amazon EC2 instances, backed by a single Amazon RDS PostgreSQL database instance configured with Multi-AZ. During the initial minutes of the exam, the database experiences high CPU utilization, and the ALB returns HTTP 502 Bad Gateway and 503 Service Unavailable errors due to dropped requests.

Which two architectural improvements should a Solutions Architect implement to address these performance and scalability issues? (Select TWO.)

Geçerli olan tümünü seçin

Submit a support ticket to AWS to pre-warm the Application Load Balancer (ALB) with the expected traffic rate and volume before the exam begins.

Migrate the database to Amazon Aurora PostgreSQL and configure Aurora Auto Scaling to dynamically scale reader instances to handle the spikes in query traffic.

Configure the web application to direct read-only query traffic to the standby replica of the Amazon RDS Multi-AZ deployment to offload the primary database.

Rely on the Application Load Balancer's (ALB) default automatic scaling mechanisms to dynamically scale up its capacity in response to the sudden login surge.

Configure the Auto Scaling group to monitor the RDS Multi-AZ secondary instance's CPU utilization to determine when to launch additional EC2 instances.

Cevabı ve açıklamayı göster

Cevap: Submit a support ticket to AWS to pre-warm the Application Load Balancer (ALB) with the expected traffic rate and volume before the exam begins.; Migrate the database to Amazon Aurora PostgreSQL and configure Aurora Auto Scaling to dynamically scale reader instances to handle the spikes in query traffic.

Cevap

The correct architecture requires pre-warming the Application Load Balancer to handle the sudden surge in connection volume, and migrating the backend database to Amazon Aurora to utilize Aurora Replicas for horizontal read scaling under load.

Pre-warming the Application Load Balancer is critical for handling flash traffic spikes that exceed the rate at which the load balancer can automatically scale out. Without pre-warming, the load balancer will drop connections and return errors. Additionally, migrating from a single RDS instance to Amazon Aurora enables horizontal scaling of read capacity through Aurora Auto Scaling for reader replicas, resolving the database CPU bottleneck.

Adım Adım Çözüm

Analyze the load balancer performance characteristics under flash traffic conditions.

Identify that the Application Load Balancer cannot scale fast enough automatically to handle an instantaneous spike to

60,000

RPS without dropping connections.

Application Load Balancer auto-scaling is designed for gradual traffic changes; immediate spikes require pre-warming by AWS Support.

Analyze database bottleneck constraints in standard Amazon RDS Multi-AZ deployments.

Recognize that the standby database instance in Amazon RDS Multi-AZ is strictly passive and cannot be utilized to offload read-heavy query spikes.

To scale read queries, the database tier must support active replicas, which is not possible with passive standby RDS instances.

Select performance and scaling optimization strategies.

Choose to pre-warm the Application Load Balancer to prevent load balancer drops, and migrate the database to Amazon Aurora to dynamically scale read operations via Aurora Replicas.

Aurora Replicas are active read endpoints and can auto-scale horizontally to resolve CPU constraints during query surges.

Anahtar Kavram

Handling massive, instantaneous flash traffic requires pre-warming the load balancer and scaling the database tier horizontally using active read replicas, as standard RDS standby instances are passive.

Tahmini Süre:3m 0s

Soru 231Soru →

An enterprise is migrating a $650\text{ TB}$ dataset of unstructured media files from an on-premises NFS file system to an Amazon S3 bucket in a target AWS account (Account B). The enterprise currently has a $1\text{ Gbps}$ AWS Direct Connect connection terminated in a shared services AWS account (Account A), with a $50\text{ Mbps}$ backup internet link. The migration must be completed within a strict timeline of $21$ days. Due to regulatory compliance, all data must be encrypted at rest using an AWS KMS Customer Managed Key (CMK), and the data transfer must not traverse the public internet.

Which combination of actions will meet these requirements most efficiently? (Select TWO.)

Geçerli olan tümünü seçin

Create AWS Snowball Edge Storage Optimized import jobs in Account B specifying the target Amazon S3 bucket, and request delivery of the devices to the on-premises datacenter.

Configure a Customer Managed Key (CMK) in Account B and update its key policy to grant the Snowball import IAM role permissions to decrypt and encrypt with the key.

Deploy AWS DataSync agents on-premises and configure a task to transfer the data over the AWS Direct Connect connection directly to the Amazon S3 bucket in Account B.

Create AWS Snowball Edge import jobs in Account B using the default AWS-managed KMS key (`aws/s3`) to encrypt the data during transit and at rest.

Configure an AWS DataSync task using a Transit Gateway with a Transit VIF over the Direct Connect link to route traffic through Account A to Account B.

Cevabı ve açıklamayı göster

Cevap: Create AWS Snowball Edge Storage Optimized import jobs in Account B specifying the target Amazon S3 bucket, and request delivery of the devices to the on-premises datacenter.; Configure a Customer Managed Key (CMK) in Account B and update its key policy to grant the Snowball import IAM role permissions to decrypt and encrypt with the key.

Cevap

To migrate the data within the timeline, AWS Snowball Edge devices must be ordered from the target account (Account B). A Customer Managed Key (CMK) must be configured in Account B with its key policy updated to allow the Snowball import role to use the key.

The correct actions are to order AWS Snowball Edge Storage Optimized devices from the target account (Account B) and use a Customer Managed Key (CMK) in Account B with a key policy that trusts the Snowball import role. Since

650\text{ TB}

cannot be transferred over the

1\text{ Gbps}

link within

21

days, an offline transfer using Snowball Edge is required. Ordering the devices from the target account allows importing directly to the destination bucket. A Customer Managed Key is necessary because AWS-managed keys cannot be shared cross-account.

Adım Adım Çözüm

Calculate the time required to transfer the data over the network link.

Transferring

650\text{ TB}

over a

1\text{ Gbps}

link requires at least

60

days, which is much greater than the

21

-day limit.

To determine whether online (DataSync) or offline (Snowball) transfer is required.

Order AWS Snowball Edge Storage Optimized devices directly from the target account (Account B).

Data will be imported directly into the destination S3 bucket in Account B after the devices are returned to AWS.

To avoid the need for copying data across accounts after the physical transfer.

Configure a Customer Managed Key (CMK) in Account B and grant access to the Snowball import role.

The Snowball import process can write encrypted data to the S3 bucket.

AWS-managed keys cannot be shared cross-account, so a Customer Managed Key is required.

Anahtar Kavram

Selecting the correct large-scale data transfer mechanism based on bandwidth and timeline constraints, and configuring cross-account IAM and KMS permissions.

Tahmini Süre:2m 0s

Soru 232Soru →

A digital health enterprise is designing a new compliance archiving system on AWS. The application tier runs on Amazon ECS tasks in a Production account (Account 111122223333). These tasks must write daily clinical audit logs to a centralized Amazon S3 bucket located in a dedicated Compliance account (Account 444455556666). The compliance team requires that the S3 bucket be encrypted at rest using AWS KMS, all uploaded objects are fully owned and managed by the Compliance account, and the solution follows the principle of least privilege. Which combination of actions must the Solutions Architect perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure the S3 bucket in the Compliance account with S3 Object Ownership set to Bucket Owner Enforced, and configure a bucket policy that allows the ECS task role in the Production account to perform s3:PutObject actions.

Create a Customer Managed Key (CMK) in the Compliance account, configure its key policy to allow the ECS task role in the Production account to perform kms:GenerateDataKey and kms:Decrypt actions, and encrypt the S3 bucket using this CMK.

Encrypt the S3 bucket in the Compliance account using the default AWS-managed KMS key for S3 (aws/s3), and configure the ECS task IAM role policy in the Production account to allow access to this key.

Create a Service Control Policy (SCP) that grants the ECS task role permission to write to the Compliance account S3 bucket and use its KMS key, and attach this SCP to the Organizational Unit (OU) containing both accounts.

Configure the S3 bucket policy in the Compliance account to grant s3:PutObject permissions to a wildcard principal (*) restricted by the Organization ID condition, and configure the ECS tasks to upload logs with the bucket-owner-full-control ACL.

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket in the Compliance account with S3 Object Ownership set to Bucket Owner Enforced, and configure a bucket policy that allows the ECS task role in the Production account to perform s3:PutObject actions.; Create a Customer Managed Key (CMK) in the Compliance account, configure its key policy to allow the ECS task role in the Production account to perform kms:GenerateDataKey and kms:Decrypt actions, and encrypt the S3 bucket using this CMK.

Cevap

Configure the S3 bucket in the Compliance account with S3 Object Ownership set to Bucket Owner Enforced and configure its bucket policy to allow writes from the Production account's ECS task role; and create a Customer Managed Key (CMK) in the Compliance account with a key policy that delegates KMS usage permissions to the ECS task role.

To safely write cross-account logs, S3 Object Ownership must be configured to Bucket Owner Enforced. This automatically transfers ownership of all written objects to the bucket owner (Compliance account) and disables S3 ACLs, fulfilling the requirement that the Compliance account owns and manages all logs. Additionally, to encrypt cross-account S3 uploads, a Customer Managed Key (CMK) must be created in the Compliance account. The CMK's key policy must be updated to grant usage permissions to the ECS task role in the Production account. The S3 bucket policy must also explicitly allow the ECS task role to perform s3:PutObject.

Adım Adım Çözüm

Address object ownership requirements by disabling ACLs.

Configuring S3 Object Ownership to 'Bucket Owner Enforced' disables ACLs and automatically transfers ownership of all written objects to the bucket owner's account.

This guarantees that the Compliance account owns and can manage all clinical logs written by the Production account's ECS tasks.

Address encryption requirements for cross-account S3 uploads.

Deploying a Customer Managed Key (CMK) in the Compliance account allows editing its key policy to grant the Production account's ECS task role permissions to perform kms:GenerateDataKey and kms:Decrypt.

AWS-managed KMS keys (like aws/s3) cannot be shared cross-account, so a Customer Managed Key must be used.

Implement the resource-based access policies.

Allowing the ECS task role in the S3 bucket policy for s3:PutObject enables cross-account log delivery.

Resource-based policies in the destination account must explicitly trust the external IAM principal for cross-account access to succeed.

Anahtar Kavram

Cross-account resource access with AWS KMS encryption and S3 Object Ownership controls

Tahmini Süre:3m 0s

Soru 233Soru →

An enterprise is designing a deployment pipeline for a critical containerized microservice running on Amazon ECS with AWS Fargate behind an Application Load Balancer (ALB). The infrastructure and deployment pipelines must be managed as infrastructure as code (IaC) using AWS CloudFormation. The enterprise has established the following requirements for deployment strategy design:
- Deployments must be fully automated and must not cause any application downtime.
- A new version of the microservice must be tested with a subset of live traffic, routing exactly $10\%$ of the production traffic to the new version for a duration of $15$ minutes before shifting the remaining $90\%$ of traffic.
- The deployment must automatically roll back immediately if the new version displays any degradation in performance, specifically measured by an increase in $5\text{xx}$ response codes.

Which two configuration steps should the solutions architect combine to meet these requirements?

Geçerli olan tümünü seçin

Configure the AWS CloudFormation template to use the `AWS::CodeDeploy::BlueGreen` transform, defining an Amazon ECS service that references an AWS CodeDeploy deployment group configured with the `CodeDeployDefault.ECSCanary10Percent15Minutes` deployment configuration.

Create an Amazon CloudWatch alarm to monitor the `HTTPCode_Target_5XX_Count` metric of the replacement target group on the Application Load Balancer, and configure the CodeDeploy deployment group to perform an automatic rollback when this alarm enters the `ALARM` state.

Enable the Amazon ECS deployment circuit breaker on the service definition in the CloudFormation template, and configure the `rollback` parameter to true to automatically roll back the service if container health checks or

5\text{xx}

error counts exceed the threshold.

Configure an `UpdatePolicy` with `AutoScalingRollingUpdate` on the Amazon ECS service resource in the CloudFormation template to shift traffic progressively in increments of

10\%

every

1.5

minutes.

Create two Route

53

weighted alias records pointing to separate blue and green Application Load Balancers, and implement an AWS Lambda function triggered by a cron schedule to increment the weight of the green record by

10\%

every

1.5

minutes.

Cevabı ve açıklamayı göster

Cevap: Configure the AWS CloudFormation template to use the `AWS::CodeDeploy::BlueGreen` transform, defining an Amazon ECS service that references an AWS CodeDeploy deployment group configured with the `CodeDeployDefault.ECSCanary10Percent15Minutes` deployment configuration.; Create an Amazon CloudWatch alarm to monitor the `HTTPCode_Target_5XX_Count` metric of the replacement target group on the Application Load Balancer, and configure the CodeDeploy deployment group to perform an automatic rollback when this alarm enters the `ALARM` state.

Cevap

Configure the AWS CloudFormation template to use the `AWS::CodeDeploy::BlueGreen` transform with the `CodeDeployDefault.ECSCanary10Percent15Minutes` configuration, and create an Amazon CloudWatch alarm on the `HTTPCode_Target_5XX_Count` metric of the replacement target group to trigger automatic rollback in CodeDeploy.

Implementing a blue/green deployment for Amazon ECS with AWS CloudFormation requires using the `AWS::CodeDeploy::BlueGreen` hook. This integrates CloudFormation with AWS CodeDeploy, allowing the use of predefined deployment configurations like `CodeDeployDefault.ECSCanary10Percent15Minutes` to route

10\%

of the traffic to the replacement task set for

15

minutes before shifting the remaining

90\%

. To automate rollbacks based on application-level issues, a CloudWatch alarm must be created to track

5\text{xx}

errors on the replacement (green) target group. Linking this alarm to the CodeDeploy deployment group's automatic rollback configuration ensures that CodeDeploy will immediately revert the traffic shift if the new version exhibits failure rates during the test phase.

Adım Adım Çözüm

Define the blue/green deployment mechanism for the ECS Fargate service in CloudFormation.

Use the `AWS::CodeDeploy::BlueGreen` transform to delegate deployment management to AWS CodeDeploy.

CloudFormation alone does not natively support canary deployments for ECS; it requires integration with CodeDeploy to orchestrate traffic shifting.

Select the appropriate traffic routing configuration.

Specify the `CodeDeployDefault.ECSCanary10Percent15Minutes` deployment configuration in the CodeDeploy deployment group.

This configuration shifts

10\%

of traffic to the green task set for

15

minutes, then shifts the remaining

90\%

if no errors are detected, meeting the traffic routing requirement.

Configure the rollback trigger based on error rates.

Create a CloudWatch alarm monitoring `HTTPCode_Target_5XX_Count` on the replacement target group and configure the CodeDeploy deployment group to roll back when the alarm is in `ALARM` state.

This ensures that if the new version generates

5\text{xx}

errors during the

15

-minute test period, CodeDeploy will automatically roll back to the old version immediately.

Anahtar Kavram

Integration of AWS CloudFormation with AWS CodeDeploy for automated, alarm-backed container canary deployments.

Tahmini Süre:3m 0s

Soru 234Soru →

An energy utility company is modernizing its smart grid meter data ingestion API on AWS. The system must process high-frequency periodic telemetry reports sent from millions of IoT smart meters. During peak hours, the volume of telemetry data spikes drastically. The backend processing logic is implemented using AWS Lambda functions triggered by Amazon API Gateway endpoints. The Lambda functions perform lightweight validation and write directly to an Amazon RDS PostgreSQL database located in a private VPC subnet. The company requires a secure, highly available architecture that prevents database connection exhaustion during peak traffic periods and ensures that the smart grid ingestion workload does not starve other critical administrative workloads of Lambda compute resources in the same AWS region. Which TWO actions should the Solutions Architect take to design a solution that meets these requirements?

Geçerli olan tümünü seçin

Configure Amazon RDS Proxy between the Lambda functions and the RDS PostgreSQL database to manage and reuse the database connections.

Configure reserved concurrency on the smart grid ingestion Lambda functions to restrict the maximum number of concurrent executions they can consume.

Configure provisioned concurrency on the smart grid ingestion Lambda functions to scale dynamically up to the regional account execution limit.

Deploy a single NAT Gateway in one Availability Zone to route all outbound database traffic from the Lambda functions to the private RDS subnet.

Encrypt the database connections using the AWS-managed KMS key (aws/rds) to enable external administrative Lambda functions in a different AWS account to securely query the database.

Cevabı ve açıklamayı göster

Cevap: Configure Amazon RDS Proxy between the Lambda functions and the RDS PostgreSQL database to manage and reuse the database connections.; Configure reserved concurrency on the smart grid ingestion Lambda functions to restrict the maximum number of concurrent executions they can consume.

Cevap

Configure Amazon RDS Proxy between the Lambda functions and the database, and configure reserved concurrency on the ingestion Lambda functions.

The correct options are configuring Amazon RDS Proxy and setting reserved concurrency. Amazon RDS Proxy manages database connection scaling and reuse, preventing connection limits from being exceeded during traffic spikes. Setting reserved concurrency limits the maximum executions of the ingestion function, protecting the account-level concurrency pool so other critical administrative Lambda functions in the same region are not starved of compute capacity.

Adım Adım Çözüm

Address database connection pooling for serverless workloads.

Using Amazon RDS Proxy creates a shared database connection pool, preventing connection exhaustion during high-concurrency Lambda execution spikes.

Lambda functions scale rapidly and spin up distinct container instances, each attempting to establish a separate database connection, which can quickly saturate the RDS PostgreSQL connection limit.

Address regional Lambda resource starvation.

Setting reserved concurrency on the ingestion Lambda function limits its maximum concurrent executions.

Without reserved concurrency limits, a spike in smart grid ingestion traffic could consume the entire regional concurrency pool (default 1,000), throttling other administrative serverless workloads in the same AWS account.

Anahtar Kavram

Serverless Database Integration and Concurrency Management

Tahmini Süre:2m 0s

Soru 235Soru →

A digital learning platform is launching a real-time examination service. During school exams, the platform experiences a sudden surge in traffic. Because exams are scheduled independently by thousands of schools throughout the day, the spikes are frequent but unpredictable at the global platform level, making manual pre-warming requests impractical. When an exam starts, submission traffic spikes from $50\text{ requests/second}$ to $35,000\text{ requests/second}$ within $15\text{ seconds}$ . The system must process these submissions, save them to a relational database, and immediately update a real-time monitor dashboard for instructors. The dashboard queries are highly concurrent and read-heavy, requiring sub- $50\text{ ms}$ latency. Which architectural design will meet these scalability and performance requirements while preventing dropped requests?

Deploy a Network Load Balancer (NLB) to route incoming traffic to the application tasks. Store the data in an Amazon Aurora PostgreSQL DB cluster. Create an Aurora Auto Scaling policy for Aurora Replicas to scale out the read capacity of the cluster, and configure the dashboard to query the Aurora reader endpoint.

Deploy a Network Load Balancer (NLB) to route incoming traffic to the application tasks. Store the data in an Amazon RDS for PostgreSQL DB instance in a Multi-AZ deployment. Configure the dashboard to query the secondary standby DB instance in the secondary Availability Zone to offload read traffic from the primary instance.

Deploy an Application Load Balancer (ALB) to route incoming traffic to the application tasks. Store the data in an Amazon RDS for PostgreSQL DB instance in a Multi-AZ deployment. Configure the dashboard to query the secondary standby DB instance using its node-specific DNS endpoint to distribute the read-heavy queries.

Deploy an Application Load Balancer (ALB) to route incoming traffic to the application tasks. Store the data in an Amazon Aurora PostgreSQL DB cluster. Configure a target tracking scaling policy on the ALB to scale the database writer instance size vertically using AWS Lambda when CPU utilization exceeds

70\%

Cevabı ve açıklamayı göster

Cevap: Deploy a Network Load Balancer (NLB) to route incoming traffic to the application tasks. Store the data in an Amazon Aurora PostgreSQL DB cluster. Create an Aurora Auto Scaling policy for Aurora Replicas to scale out the read capacity of the cluster, and configure the dashboard to query the Aurora reader endpoint.

Cevap

The correct design uses a Network Load Balancer (NLB) to handle the sudden, extreme traffic spike without pre-warming, ensuring that no requests are dropped. It also scales the relational database tier horizontally using Amazon Aurora PostgreSQL Replicas configured with Auto Scaling. Read traffic is routed through the reader endpoint, which distributes queries across the replicas to maintain sub-

50\text{ ms}

latency for the dashboard.

Adım Adım Çözüm

Analyze the ingress requirements for the flash traffic spike.

Identify that traffic increases from

50\text{ requests/second}

35,000\text{ requests/second}

within

15\text{ seconds}

(a factor of

700\times

increase). Because the spikes are unpredictable globally, manual pre-warming of an Application Load Balancer is not operationally feasible. A Network Load Balancer must be selected because it can handle sudden, volatile traffic spikes of this magnitude without pre-warming.

Choosing the correct load balancer prevents dropped requests during rapid scale-up events.

Evaluate the database requirements for high-concurrency reads and writes.

Identify that the system needs to support both raw submission writes and highly concurrent dashboard read queries with sub-

50\text{ ms}

latency.

This determines the partitioning and scaling strategy for the database layer.

Select the database technology and scaling mechanism.

Choose Amazon Aurora PostgreSQL with Aurora Replicas. Implement Aurora Auto Scaling to dynamically adjust the number of read replicas, and configure the dashboard application to point to the reader endpoint.

This allows read traffic to scale out horizontally to meet the performance and latency requirements under load.

Assess and reject invalid database read-scaling methods.

Identify that Amazon RDS Multi-AZ standby instances are passive and cannot be queried for read scaling. Any architecture directing read queries to the standby instance must be rejected.

This eliminates incorrect distractors that confuse high availability with read scalability.

Anahtar Kavram

Handling unpredictable flash traffic spikes at the load balancer tier using Network Load Balancers, and scaling read-heavy relational database workloads horizontally using Amazon Aurora Replicas with Auto Scaling rather than relying on passive RDS Multi-AZ standby instances.

Tahmini Süre:2m 30s

Soru 236Soru →

A national election committee is launching a web portal to broadcast live election results. The portal is expected to experience a sudden surge in traffic, scaling from a baseline of $1,000$ concurrent users to over $1.5\text{ million}$ concurrent users within a few minutes as soon as poll results are announced. The portal's current architecture consists of a web application running on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB), and a backend Amazon RDS for PostgreSQL Multi-AZ DB instance. The workload is heavily read-intensive, with users constantly fetching the latest precinct counts. Which solution should a solutions architect recommend to ensure the application scales to meet this demand while maintaining high performance and availability?

Place an Amazon CloudFront distribution in front of the ALB to cache the election results. Request AWS Support to pre-warm the ALB prior to the election, and deploy RDS Read Replicas to offload the read query volume from the primary DB instance.

Configure an Amazon CloudFront distribution in front of the ALB. Allow the ALB to scale dynamically, and configure the application to route read queries to the standby DB instance of the RDS Multi-AZ deployment to offload the primary DB instance.

Deploy Amazon ElastiCache for Memcached with multi-AZ replication enabled to cache database queries. Contact AWS Support to pre-warm the ALB before the event, and route read queries to the replication nodes.

Configure the ALB with dynamic target tracking scaling policies. Set the Auto Scaling group cooldown period to

10\text{ seconds}

to launch EC2 instances rapidly, and migrate the database to Amazon Aurora MySQL with reader auto-scaling configured.

Cevabı ve açıklamayı göster

Cevap: Place an Amazon CloudFront distribution in front of the ALB to cache the election results. Request AWS Support to pre-warm the ALB prior to the election, and deploy RDS Read Replicas to offload the read query volume from the primary DB instance.

Cevap

The correct answer combines caching with Amazon CloudFront to reduce backend load, pre-warming the ALB to handle the immediate surge of

1.5\text{ million}

concurrent users, and deploying RDS Read Replicas to scale read queries horizontally. This ensures all layers of the application can handle the scale requirements.

Adım Adım Çözüm

Analyze the load balancer scaling needs.

Identify that traffic will surge from

1,000

1.5\text{ million}

concurrent users within a few minutes, which constitutes flash traffic.

Because standard ALB scaling is gradual, a sudden traffic spike of this magnitude will result in dropped connections. Requesting AWS Support to pre-warm the ALB ensures it has the capacity provisioned beforehand.

Evaluate caching options to offload the application tier.

Introduce Amazon CloudFront in front of the Application Load Balancer.

Caching the election results at the edge minimizes the traffic that reaches the ALB and EC2 instances, drastically improving page load times and reducing compute costs.

Determine database scaling strategy.

Deploy RDS Read Replicas and route read traffic to them, while leaving the primary DB instance for writes.

The workload is read-intensive. An RDS Multi-AZ standby database cannot serve read traffic, so Read Replicas must be added to scale reads horizontally.

Anahtar Kavram

Handling sudden flash traffic on AWS requires pre-warming load balancers, offloading read-heavy queries using read replicas rather than relying on standby DB instances, and caching content at the edge with Amazon CloudFront.

Soru 237Soru →

An educational technology company is designing a new online testing platform that will serve students globally. The application's web tier runs on Amazon EC2 instances inside private subnets across two Availability Zones in the primary region (us-east-1). Outbound internet access for grading APIs is routed through NAT Gateways. The database is hosted on Amazon Aurora PostgreSQL. The architecture must support a secondary recovery region (us-west-2) to satisfy a disaster recovery plan with a Recovery Point Objective (RPO) of $2\text{ minutes}$ and a Recovery Time Objective (RTO) of $15\text{ minutes}$ . For internal service communications, a Route 53 Private Hosted Zone (PHZ) is used to resolve internal microservice endpoints. Which of the following architectures should a solutions architect recommend to meet the RTO and RPO requirements while ensuring high availability and fault tolerance?

Deploy the EC2 web tier in both us-east-1 and us-west-2. Deploy a single NAT Gateway in us-east-1 and route outbound traffic from both Availability Zones through it. Use Amazon Aurora Global Database to replicate the database from us-east-1 to us-west-2. Associate the Route 53 Private Hosted Zone (PHZ) with the VPCs in both regions. Configure Route 53 failover routing policies with active-passive health checks to route public traffic.

Deploy the EC2 web tier in both us-east-1 and us-west-2. Deploy a NAT Gateway in each Availability Zone within each region. Use Amazon Aurora Global Database to replicate the database from us-east-1 to us-west-2. Associate the Route 53 Private Hosted Zone (PHZ) only with the us-east-1 VPC. Configure Route 53 failover routing policies with active-passive health checks to route public traffic.

Deploy the EC2 web tier in both us-east-1 and us-west-2. Deploy a NAT Gateway in each Availability Zone within each region. Use Amazon Aurora Global Database to replicate the database from us-east-1 to us-west-2. Associate the Route 53 Private Hosted Zone (PHZ) with the VPCs in both regions. Configure Route 53 failover routing policies with active-passive health checks to route public traffic to us-east-1, failing over to us-west-2 if the primary region is degraded.

Deploy the EC2 web tier in both us-east-1 and us-west-2. Deploy a NAT Gateway in each Availability Zone within each region. Implement a backup schedule using AWS Backup to create snapshots of the Aurora database in us-east-1 every

12\text{ hours}

and copy them to us-west-2. Associate the Route 53 Private Hosted Zone (PHZ) with the VPCs in both regions. Configure Route 53 failover routing policies to route public traffic, and restore the database from the copied snapshot in us-west-2 during a failover event.

Cevabı ve açıklamayı göster

Cevap: Deploy the EC2 web tier in both us-east-1 and us-west-2. Deploy a NAT Gateway in each Availability Zone within each region. Use Amazon Aurora Global Database to replicate the database from us-east-1 to us-west-2. Associate the Route 53 Private Hosted Zone (PHZ) with the VPCs in both regions. Configure Route 53 failover routing policies with active-passive health checks to route public traffic to us-east-1, failing over to us-west-2 if the primary region is degraded.

Cevap

The correct architecture replicates the database using Amazon Aurora Global Database, deploys a NAT Gateway per Availability Zone in each region for high availability, associates the Route 53 Private Hosted Zone with VPCs in both regions, and uses Route 53 failover routing policies with active-passive health checks to route public traffic.

The correct architecture replicates the database using Amazon Aurora Global Database, which offers sub-second data replication and quick failover capabilities, satisfying both the

2\text{ minutes}

RPO and

15\text{ minutes}

RTO. Deploying a NAT Gateway in each Availability Zone in both regions prevents outbound connectivity failures. Associating the Private Hosted Zone with the VPCs in both regions ensures internal DNS resolution remains functional after failover. Finally, active-passive Route 53 failover routing policies ensure traffic is dynamically redirected to the secondary region if the primary region goes down.

Adım Adım Çözüm

Evaluate the database replication strategy against RTO and RPO requirements.

Amazon Aurora Global Database provides sub-second replication lag (meeting the RPO of

2\text{ minutes}

) and managed failovers that take under

2\text{ minutes}

(meeting the RTO of

15\text{ minutes}

). Snapshot-based recovery is too slow and violates RPO.

Choosing the correct replication technology is critical to achieving near-zero recovery objectives.

Assess the routing and network redundancy requirements.

To avoid a single point of failure for outbound traffic, a NAT Gateway must be deployed in each Availability Zone of the VPC. A single NAT Gateway configuration is not highly available.

High availability requires removing single points of failure across all architectural tiers.

Configure internal DNS resolution and external failover routing.

The Route 53 Private Hosted Zone (PHZ) must be associated with the VPCs in both the primary and secondary regions to resolve internal endpoints. Public traffic failover must be handled using Route 53 active-passive failover routing policies with health checks.

DNS resolution must function correctly in both regions to support application failover.

Anahtar Kavram

Multi-region disaster recovery and high availability architecture design

Soru 238Soru →

An enterprise wants to migrate an $80\text{ TB}$ on-premises SMB file share to Amazon FSx for Windows File Server. The enterprise has a $1\text{ Gbps}$ Direct Connect connection to AWS via a Transit Gateway, but only $200\text{ Mbps}$ of network bandwidth can be allocated for the migration due to daytime production traffic. The migration must be completed within $45\text{ days}$ while fully preserving all NTFS Access Control Lists (ACLs) and metadata. The target FSx file system must be encrypted using a KMS key that supports cross-account access from the migration team's AWS account. Which of the following solutions meets these requirements with the least operational overhead?

Deploy an AWS DataSync agent on-premises, configure it to access the SMB file share, and create a task targeting the Amazon FSx for Windows File Server file system. Configure the FSx file system to be encrypted using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to grant the migration role permissions to use the key.

Order an AWS Snowball Edge Storage Optimized device, use its SMB interface to copy the

80\text{ TB}

of data locally, and ship the device to AWS to import the data into an Amazon S3 bucket. Then, use AWS DataSync to copy the files from the S3 bucket to Amazon FSx for Windows File Server.

Deploy an AWS DataSync agent on-premises, and configure a DataSync task to copy the data to a temporary VPC. Route the migration traffic directly through the Direct Connect Gateway to the destination VPC, bypassing the Transit Gateway to optimize network routing.

Deploy an AWS DataSync agent on-premises, configure it to access the SMB file share, and create a task targeting the Amazon FSx for Windows File Server file system. Encrypt the FSx file system using the default AWS managed key (aws/fsx), and modify its key policy to allow cross-account access from the migration team's AWS account.

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS DataSync agent on-premises, configure it to access the SMB file share, and create a task targeting the Amazon FSx for Windows File Server file system. Configure the FSx file system to be encrypted using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to grant the migration role permissions to use the key.

Cevap

Deploy an AWS DataSync agent on-premises to copy data directly from the SMB file share to the destination Amazon FSx for Windows File Server. Use a Customer Managed Key (CMK) in AWS KMS to encrypt the target FSx file system and update its policy to allow cross-account access.

Deploying AWS DataSync agent on-premises and copying directly to FSx for Windows File Server is the optimal solution. The transfer completes in

37\text{ days}

, which satisfies the

45\text{ days}

timeline. DataSync preserves NTFS ACLs and metadata directly when transferring from an SMB source to an FSx destination. Using a Customer Managed Key (CMK) allows cross-account key policy configurations, which satisfies the security requirements.

Adım Adım Çözüm

Calculate the transfer timeline over the allocated network bandwidth.

200\text{ Mbps}

, transferring

80\text{ TB}

of data takes approximately

37\text{ days}

(

80 \times 10^{12} \times 8 / 200,000,000 = 3,200,000\text{ seconds}

), which is within the

45\text{ days}

requirement.

To verify if online migration via DataSync is feasible or if an offline method is required.

Select the correct migration tool that preserves target metadata.

AWS DataSync preserves NTFS ACLs and permissions when transferring directly from SMB to FSx for Windows File Server. Staging through Amazon S3 via Snowball Edge would strip these ACLs.

To guarantee that NTFS permissions and metadata are fully preserved during transit.

Configure the security controls for cross-account access.

Create a Customer Managed Key (CMK) and assign it to the FSx file system, then modify the key policy to permit cross-account usage.

To satisfy the security requirement of cross-account KMS encryption, which is unsupported by AWS managed keys.

Anahtar Kavram

Online migration of SMB shares to Amazon FSx for Windows File Server using AWS DataSync while preserving NTFS ACLs, and configuring cross-account KMS permissions using Customer Managed Keys.

Soru 239Soru →

An airline is modernizing its legacy loyalty reward points redemption backend by migrating it to a serverless architecture on AWS. The solution will expose a public REST API via Amazon API Gateway, which triggers an AWS Lambda function. This function processes transactions, updates customer records in a private Amazon Aurora PostgreSQL database, and calls an external loyalty-partner API over the public internet to validate partner reward points. During promotional events, traffic is expected to spike from a baseline of $50$ requests per second to over $5000$ requests per second. The architect must ensure that database connections are managed efficiently to prevent database overload, that sudden traffic spikes do not consume the entire account-level concurrent execution pool (which would throttle other critical serverless workloads in the same AWS account), and that all outbound traffic to both the private database and the public internet remains highly available and resilient to Availability Zone outages.

Which architectural design meets these requirements?

Deploy the Lambda function across private subnets in multiple Availability Zones, routing all outbound internet traffic through a single NAT Gateway in one Availability Zone to minimize NAT Gateway costs. Configure Amazon RDS Proxy to manage connections to the Aurora PostgreSQL database, and configure a reserved concurrency limit for the Lambda function.

Deploy the Lambda function across private subnets in multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways in each Availability Zone. Configure Amazon RDS Proxy to manage connections to the Aurora PostgreSQL database, and rely on the regional unreserved concurrency pool to allow the function to scale dynamically to meet demand.

Deploy the Lambda function across private subnets in multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways in each Availability Zone. Configure Amazon RDS Proxy to manage connections to the Aurora PostgreSQL database. Store database credentials in AWS Secrets Manager and enable cross-account access using the default AWS-managed key (aws/secretsmanager) in the secrets policy. Configure a reserved concurrency limit for the Lambda function.

Cevabı ve açıklamayı göster

Cevap: Deploy the Lambda function across private subnets in multiple Availability Zones, routing outbound internet traffic through redundant NAT Gateways in each Availability Zone. Configure Amazon RDS Proxy to manage connections to the Aurora PostgreSQL database, and configure a reserved concurrency limit for the Lambda function.

Cevap

The correct option addresses all three design goals: using redundant NAT Gateways across Availability Zones ensures high availability for outbound partner API calls; Amazon RDS Proxy prevents database connection exhaustion; and reserved concurrency prevents the high-volume function from exhausting the regional concurrency pool and throttling other workloads in the account.

Adım Adım Çözüm

Analyze high availability requirements for outbound traffic.

To ensure that outbound traffic to the internet (for the partner API) is highly available and resilient to Availability Zone (AZ) outages, the Lambda function must be deployed in private subnets across multiple AZs, and each AZ's subnet route table must point to a local NAT Gateway in a public subnet of that same AZ.

If all subnets route through a single NAT Gateway, that gateway represents a single point of failure if its AZ experiences an outage.

Address database connection scaling and pooling.

Configure Amazon RDS Proxy between the Lambda function and the Aurora PostgreSQL database.

Lambda functions scale horizontally by creating new execution environments, which can quickly exhaust the database's connection pool. RDS Proxy pools and shares database connections to improve scalability.

Protect other workloads in the same AWS account from concurrency exhaustion.

Configure a reserved concurrency limit on the loyalty reward points redemption Lambda function.

By setting reserved concurrency, you limit the maximum concurrent executions for this specific function, preventing it from consuming the entire regional account-level concurrency pool (typically 1000 by default) and throttling other critical serverless applications.

Anahtar Kavram

Architecting serverless workloads with Lambda and API Gateway for high availability, connection pooling, and account-level concurrency protection.

Tahmini Süre:2m 0s

Soru 240Soru →

A financial services company is modernizing its legacy transaction auditing API by migrating it to a serverless architecture on AWS. The application consists of an Amazon API Gateway REST API backed by AWS Lambda functions. The audit records must be written to an Amazon RDS PostgreSQL database deployed in private subnets. During end-of-month processing, the API experiences massive, unpredictable traffic spikes that exhaust the database connection pool. The Solutions Architect must design a highly available, secure solution. The solution must prevent the transaction auditing Lambda functions from consuming all execution capacity in the AWS region, which would throttle other critical applications. Additionally, database credentials must be managed securely, supporting rotation triggered from a centralized deployment pipeline in a separate security AWS account. Which configuration meets these requirements while adhering to the AWS Well-Architected Framework?

Configure Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Deploy the Lambda functions in multiple private subnets across different Availability Zones with a configured reserved concurrency limit. Store database credentials in AWS Secrets Manager using a Customer Managed Key, configuring a custom key policy to allow access and rotation from the central security account. Deploy VPC interface endpoints to allow the Lambda functions to access Secrets Manager.

Configure Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Deploy the Lambda functions in multiple private subnets across different Availability Zones, and configure provisioned concurrency to handle execution spikes while leaving the regional execution limit unconstrained. Store database credentials in AWS Secrets Manager using a Customer Managed Key with a custom key policy. Deploy VPC interface endpoints to access Secrets Manager.

Configure Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Deploy the Lambda functions in multiple private subnets across different Availability Zones with a configured reserved concurrency limit. Store database credentials in AWS Secrets Manager encrypted with the default AWS-managed KMS key, and grant cross-account rotation access to the central security account by updating the AWS-managed KMS key policy. Deploy VPC interface endpoints to access Secrets Manager.

Configure Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Deploy the Lambda functions in a single private subnet to minimize networking complexity, routing all outbound internet and AWS service traffic through a single NAT Gateway in that Availability Zone. Set a configured reserved concurrency limit on the Lambda functions. Store database credentials in AWS Secrets Manager using a Customer Managed Key.

Cevabı ve açıklamayı göster

Cevap: Configure Amazon RDS Proxy between the Lambda functions and the PostgreSQL database. Deploy the Lambda functions in multiple private subnets across different Availability Zones with a configured reserved concurrency limit. Store database credentials in AWS Secrets Manager using a Customer Managed Key, configuring a custom key policy to allow access and rotation from the central security account. Deploy VPC interface endpoints to allow the Lambda functions to access Secrets Manager.

Cevap

The correct solution solves connection scalability issues using Amazon RDS Proxy, protects other workloads by capping the function's maximum scale with a reserved concurrency limit, and allows secure cross-account key management for credential rotation via a Customer Managed Key. Using multiple private subnets and VPC endpoints keeps all data paths private and highly available.

Adım Adım Çözüm

Address database connection pooling and spikes

Amazon RDS Proxy is introduced to pool and share database connections, preventing connection exhaustion.

Serverless architectures spawn many ephemeral Lambda containers during traffic spikes, which can overwhelm traditional database connection limits.

Protect account-wide Lambda concurrency limits

Configure reserved concurrency on the auditing Lambda functions.

Reserved concurrency guarantees execution capacity for this function while capping its maximum concurrent executions, preventing it from consuming the entire regional pool and throttling other functions.

Secure database credentials for cross-account rotation

Store database credentials in Secrets Manager encrypted with a Customer Managed Key, modifying the KMS key policy to permit cross-account delegation.

AWS-managed KMS keys do not allow policy modification. A Customer Managed Key is required to grant decryption and rotation permissions to a security pipeline in a separate account.

Configure secure private connectivity

Deploy VPC interface endpoints for Secrets Manager and place Lambda in multiple private subnets.

This allows the VPC-bound Lambda functions to communicate securely with AWS service endpoints without routing traffic over the public internet, satisfying security and high availability pillars.

Anahtar Kavram

Serverless database connection management, concurrency protection, and cross-account KMS key policy delegation.

ÖncekiSayfa 12 / 99Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram