Tüm alıştırma soruları

1964 soru

Tüm türler1,964 Çoktan seçmeli1,006 Çoklu seçim931 Sıralama27

A company is releasing a new version of an API microservice deployed on AWS Lambda. The deployment pipeline uses AWS CodeDeploy to manage traffic shifting. To minimize risk, the Solutions Architect wants to route $10\%$ of the traffic to the new Lambda version immediately, and then increase the traffic by another $10\%$ every $10$ minutes until the transition is complete. If the error rate exceeds a specified threshold, the deployment must roll back automatically. Which deployment configuration should the Solutions Architect configure in the CodeDeploy deployment group to achieve this transition?

CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

CodeDeployDefault.LambdaCanary10Percent10Minutes

CodeDeployDefault.LambdaLinear10PercentEvery1Minute

CodeDeployDefault.LambdaAllAtOnce

Cevabı ve açıklamayı göster

Cevap: CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

Cevap

CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

The configuration stating 'CodeDeployDefault.LambdaLinear10PercentEvery10Minutes' is correct because linear configurations shift traffic in equal increments at regular intervals. A

10\%

linear shift every

10

minutes matches the requirement to scale traffic by

10\%

initially and then by another

10\%

every

10

minutes.

Adım Adım Çözüm

Analyze the traffic shifting pattern requirement.

The requirement specifies shifting

10\%

of traffic initially, followed by equal increments of

10\%

at regular intervals of

10

minutes (a linear progression).

This is a linear traffic shifting strategy, not a canary or all-at-once strategy.

Identify the standard AWS CodeDeploy deployment configurations for Lambda.

Linear configurations shift traffic in equal increments at regular intervals, whereas Canary configurations shift a portion first and the rest after a delay.

Choosing the correct configuration type ensures compliance with the transition rate and timing requirements.

Select the configuration matching the specific percentage and time interval.

The Linear configuration with

10\%

shifting every

10

minutes is represented by CodeDeployDefault.LambdaLinear10PercentEvery10Minutes.

This configuration executes a linear deployment over a

90

-minute period with

10

-minute intervals.

Anahtar Kavram

AWS CodeDeploy deployment configurations define the way traffic is shifted to new versions of Lambda functions or ECS tasks. Linear deployments shift traffic in equal increments over time, while canary deployments shift a small percentage first and then shift the remainder all at once.

Soru 262Soru →

An enterprise is designing a hybrid network architecture for 15 AWS accounts, each containing a VPC in the eu-west-1 Region. The VPCs need to communicate with each other and with an on-premises data center. The primary connection must be an AWS Direct Connect link, and a Site-to-Site VPN must serve as the backup connection. Both connections will use BGP. The architecture must ensure path symmetry, automatic failover, and minimize administrative overhead. Which configuration meets these requirements?

Attach the Direct Connect Gateway and the Site-to-Site VPN to an AWS Transit Gateway. Advertise the same on-premises IP prefixes via BGP over both paths. Configure the customer gateway to assign a higher BGP local preference for routes received over the Direct Connect connection, and rely on the Transit Gateway's default path selection to prefer the Direct Connect Gateway over the VPN.

Connect the Direct Connect Gateway to each spoke VPC using private virtual interfaces, and configure the Site-to-Site VPN to terminate on the AWS Transit Gateway. Set up static routes in the spoke VPC route tables pointing to the Direct Connect Gateway as primary and the Transit Gateway as backup.

Attach the Direct Connect Gateway and the Site-to-Site VPN to the AWS Transit Gateway. Associate the on-premises Route 53 Private Hosted Zone directly with the Transit Gateway to resolve on-premises domain names from the spoke VPCs.

Attach the Direct Connect Gateway to the AWS Transit Gateway. Terminate the backup Site-to-Site VPN connection on a single NAT Gateway located in a centralized services VPC to consolidate outbound internet-bound and VPN failover traffic.

Cevabı ve açıklamayı göster

Cevap: Attach the Direct Connect Gateway and the Site-to-Site VPN to an AWS Transit Gateway. Advertise the same on-premises IP prefixes via BGP over both paths. Configure the customer gateway to assign a higher BGP local preference for routes received over the Direct Connect connection, and rely on the Transit Gateway's default path selection to prefer the Direct Connect Gateway over the VPN.

Cevap

The correct configuration uses AWS Transit Gateway to centralize connection management for the 15 accounts. By advertising identical prefixes over both BGP sessions, failover is managed dynamically. Traffic from AWS to the data center automatically prefers the Direct Connect Gateway over VPN because AWS Transit Gateway's route evaluation rules prioritize Direct Connect over VPN for matching prefix lengths. Traffic from the data center to AWS is kept symmetric by configuring the customer gateway to prefer the Direct Connect path (typically using a higher BGP local preference).

Adım Adım Çözüm

Consolidate multi-account connections by attaching the AWS Direct Connect Gateway (using a transit virtual interface) and the AWS Site-to-Site VPN to an AWS Transit Gateway.

This establishes a hub-and-spoke topology where all 15 spoke VPCs can access both hybrid paths through a centralized gateway.

Reduces administrative overhead by avoiding point-to-point connections between each VPC and the data center.

Enable dynamic routing by advertising the same on-premises IP prefixes via BGP over both the Direct Connect and the VPN paths.

Dynamic routing tables are populated on both AWS and on-premises sides, enabling automatic failover if one path becomes unavailable.

Avoids the administrative overhead of managing static routes across multiple VPCs and accounts.

Configure the customer gateway router with BGP local preference to favor the Direct Connect path for outbound traffic.

On-premises outbound traffic will utilize the Direct Connect connection under normal conditions, failing over to VPN only if the Direct Connect link goes down.

Ensures routing symmetry and control over outbound traffic from the on-premises data center.

Rely on AWS Transit Gateway's default BGP route evaluation order.

When Transit Gateway receives the same prefix from both DXGW (transit VIF) and VPN, it automatically prefers the DXGW path.

Ensures AWS-to-on-premises traffic prefers the higher-bandwidth Direct Connect path without manual intervention.

Anahtar Kavram

AWS Transit Gateway simplifies hybrid connectivity for multi-account environments. When routing identical prefixes advertised via BGP, Transit Gateway automatically prioritizes Direct Connect Gateway (transit VIF) attachments over VPN attachments. For the reverse path, customer gateways must be configured with BGP metrics (such as local preference) to ensure routing symmetry.

Soru 263Soru →

An enterprise is planning to deploy a new version of a critical monolithic web application running on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The infrastructure is managed using AWS CloudFormation. The deployment process must meet the following requirements:
- Shift exactly $10\%$ of production traffic to the new version initially.
- Route the remaining $90\%$ of traffic to the new version only after a 15-minute evaluation period.
- Perform an immediate and automatic rollback to the previous version with zero downtime if the HTTP 5xx error rate on the new version exceeds $1\%$ during the evaluation period.
- Ensure no configuration changes are made to the existing EC2 instances during the deployment, keeping the update fully immutable.

Which deployment strategy should a Solutions Architect design to meet these requirements with the least operational complexity?

Provision a new Auto Scaling group running the new application version using AWS CloudFormation. Configure the Application Load Balancer with two target groups: one pointing to the existing Auto Scaling group and one pointing to the new Auto Scaling group. Use an AWS Lambda function triggered by AWS CodePipeline to update the ALB listener rule weights, routing

10\%

of traffic to the new target group. Monitor the new target group with an Amazon CloudWatch alarm, and configure CodePipeline to revert the weights to

100\%

on the existing target group if the alarm triggers.

Configure AWS CodeDeploy to perform a Blue/Green deployment using the existing Auto Scaling group as the primary environment and a newly provisioned Auto Scaling group as the replacement environment. Create a custom deployment configuration in CodeDeploy using a canary traffic-shifting policy set to route

10\%

of traffic to the replacement environment for 15 minutes. Associate an Amazon CloudWatch alarm with the deployment group to trigger an automatic rollback if HTTP 5xx errors exceed the threshold.

Update the AWS CloudFormation template to modify the Amazon Machine Image (AMI) of the existing Auto Scaling group. Configure the CloudFormation update policy to use an AutoScalingRollingUpdate policy, setting MaxBatchSize to

10\%

and MinInstancesInService to

90\%

. Set the PauseTime to 15 minutes, and configure an Amazon CloudWatch alarm on the ALB 5xx metrics to roll back the CloudFormation stack if errors occur.

Use AWS CodeDeploy to perform an In-place deployment on the existing Auto Scaling group using the CodeDeployDefault.OneAtATime configuration. Configure the deployment group to use the Application Load Balancer to route traffic, and configure an Amazon CloudWatch alarm for ALB 5xx errors to trigger an automatic rollback. Implement a 15-minute block in the AppSpec file's AfterInstall hook to evaluate the performance of the first updated instance before proceeding.

Cevabı ve açıklamayı göster

Cevap: Provision a new Auto Scaling group running the new application version using AWS CloudFormation. Configure the Application Load Balancer with two target groups: one pointing to the existing Auto Scaling group and one pointing to the new Auto Scaling group. Use an AWS Lambda function triggered by AWS CodePipeline to update the ALB listener rule weights, routing $10\%$ of traffic to the new target group. Monitor the new target group with an Amazon CloudWatch alarm, and configure CodePipeline to revert the weights to $100\%$ on the existing target group if the alarm triggers.

Cevap

10\%

of traffic to the new target group. Monitor the new target group with an Amazon CloudWatch alarm, and configure CodePipeline to revert the weights to

100\%

on the existing target group if the alarm triggers.

The correct strategy involves provisioning a new Auto Scaling group (ensuring immutability) and using Application Load Balancer weighted target groups to perform canary traffic shifting. Since AWS CodeDeploy does not support canary or linear deployments for EC2 workloads, updating listener rule weights via a Lambda function in AWS CodePipeline is the standard, highly resilient method to route exactly

10\%

of traffic. If errors exceed the threshold, reverting the listener weights back to the old target group provides an instantaneous, zero-downtime rollback.

Adım Adım Çözüm

Analyze the service requirements and constraints.

The application runs on EC2 instances inside an Auto Scaling group behind an Application Load Balancer. The update must be immutable (no changes to existing instances), meaning a new Auto Scaling group must be provisioned (Blue/Green).

This rules out in-place deployments.

Evaluate the traffic shifting requirements.

The requirement is to shift exactly

10\%

of traffic to the new version for 15 minutes, with an immediate, zero-downtime rollback if errors occur.

Since CodeDeploy Blue/Green for EC2 only supports all-at-once traffic routing, native CodeDeploy configurations cannot satisfy the

10\%

canary requirement. An alternative routing mechanism must be used.

Select the correct ALB-level routing strategy.

By using ALB weighted target groups (one for the existing ASG and one for the new ASG), traffic can be split precisely (e.g.,

90\%

to the old version,

10\%

to the new version). AWS Lambda can automate the modification of these weights in a deployment pipeline, and a CloudWatch alarm can trigger an automatic rollback by reverting the weights back to

100\%

on the old target group.

This achieves immutable, zero-downtime canary deployment and rollback with EC2 workloads.

Anahtar Kavram

Designing Blue/Green and Canary deployment strategies for EC2 workloads using Application Load Balancer weighted target groups when native CodeDeploy traffic shifting is unavailable.

Soru 264Soru →

A financial services company is designing a mission-critical transaction reporting application that must be deployed across two AWS Regions: us-east-1 (Primary) and us-west-2 (Secondary). The architecture requires an Amazon Aurora PostgreSQL database, private EC2 instances in multiple Availability Zones (AZs) that need outbound internet connectivity to fetch compliance updates, and a Route 53 private hosted zone (PHZ) for internal name resolution across VPCs in both regions. The disaster recovery (DR) requirements specify a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. Which architecture meets these requirements while ensuring high availability and fault tolerance for all components?

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and an active read replica in us-west-2. Configure Route 53 Failover routing with health checks pointing to the Application Load Balancers (ALBs) in both regions. Deploy redundant NAT Gateways across multiple AZs in the VPC of each region. Associate the Route 53 Private Hosted Zone (PHZ) with the VPCs in both us-east-1 and us-west-2.

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and an active read replica in us-west-2. Configure Route 53 Failover routing with health checks pointing to the Application Load Balancers (ALBs) in both regions. Deploy a single NAT Gateway in the primary AZ of the VPC in each region to handle outbound internet traffic. Associate the Route 53 Private Hosted Zone (PHZ) with the VPCs in both us-east-1 and us-west-2.

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and an active read replica in us-west-2. Configure Route 53 Geolocation routing to automatically route user traffic. Deploy redundant NAT Gateways across multiple AZs in the VPC of each region. Associate the Route 53 Private Hosted Zone (PHZ) with the us-east-1 VPC, relying on Transit Gateway peering for DNS resolution from the us-west-2 VPC.

Deploy Amazon Aurora PostgreSQL in us-east-1 and configure cross-region snapshot copies to us-west-2 every 1 hour. Configure Route 53 Failover routing with health checks pointing to the Application Load Balancers (ALBs) in both regions. Deploy redundant NAT Gateways across multiple AZs in the VPC of each region. Associate the Route 53 Private Hosted Zone (PHZ) with the VPCs in both us-east-1 and us-west-2.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and an active read replica in us-west-2. Configure Route 53 Failover routing with health checks pointing to the Application Load Balancers (ALBs) in both regions. Deploy redundant NAT Gateways across multiple AZs in the VPC of each region. Associate the Route 53 Private Hosted Zone (PHZ) with the VPCs in both us-east-1 and us-west-2.

Cevap

Deploying an Aurora Global Database with an active replica in the secondary region, configuring Route 53 Failover routing, deploying redundant NAT Gateways in each Availability Zone, and associating the Private Hosted Zone with all VPCs across both regions.

The correct architecture uses Aurora Global Database to achieve low latency replication and promote the secondary cluster within the 15-minute RTO. Redundant NAT Gateways ensure outbound network paths are highly available within each region's AZs. The Route 53 Private Hosted Zone is associated with both VPCs, allowing internal resolution to succeed in both regions.

Adım Adım Çözüm

Evaluate the database tier against the RTO and RPO targets.

Aurora Global Database provides sub-second replication (meeting the 1-minute RPO) and can be promoted to primary in less than 15 minutes (meeting the RTO). In contrast, cross-region snapshots fail the RPO constraint.

Choosing the correct replication mechanism is critical to satisfying the disaster recovery bounds.

Verify high availability for outbound NAT traffic.

NAT Gateways must be deployed in each Availability Zone where private EC2 instances exist. A single NAT Gateway per region creates a single point of failure.

Ensuring no single point of failure exists in the networking path for application updates.

Assess DNS name resolution requirements for Private Hosted Zones.

The Route 53 PHZ must be associated with both the primary and secondary VPCs to allow query resolution in both regions. Peering connections do not automatically extend PHZ DNS resolution without direct association.

Ensuring internal services can resolve names correctly during a failover event.

Anahtar Kavram

Multi-region high availability and disaster recovery orchestration including database replication, network path redundancy, and cross-VPC DNS resolution.

Soru 265Soru →

A company hosts a critical production application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The architecture team is designing a deployment pipeline to release application updates. The deployment strategy must maintain $100\%$ of the required system capacity at all times during the release. Additionally, the strategy must initially route exactly $10\%$ of live production traffic to the new version for a 10-minute verification period. If a connected Amazon CloudWatch alarm is triggered during this period, traffic must immediately shift back to the old version with zero downtime. Which deployment strategy meets these requirements?

Deploy the update using AWS CodeDeploy with a blue/green deployment type. Select the EC2 Auto Scaling group and apply the CodeDeployDefault.ECSCanary10Percent10Minutes deployment configuration, using the CloudWatch alarm to trigger an automatic rollback.

Deploy the update by updating the AWS CloudFormation template of the application stack using an AutoScalingRollingUpdate policy. Set MinInstancesInService to the current desired capacity and MaxBatchSize to 10%. Configure CloudFormation rollback triggers mapped to the CloudWatch alarm.

Deploy a new Auto Scaling group containing the new version. Configure the ALB listener rule to route traffic using weighted target groups, directing 90% of traffic to the old target group and 10% of traffic to the new target group. Use an automation script to monitor the CloudWatch alarm, shifting traffic back to 100% on the old target group if the alarm fires, or completing the transition to 100% on the new target group after 10 minutes.

Deploy the update using AWS CodeDeploy with an in-place deployment type. Use the CodeDeployDefault.OneAtATime deployment configuration and configure a deployment lifecycle event hook to register new instances to a secondary target group with 10% weight.

Cevabı ve açıklamayı göster

Cevap: Deploy a new Auto Scaling group containing the new version. Configure the ALB listener rule to route traffic using weighted target groups, directing 90% of traffic to the old target group and 10% of traffic to the new target group. Use an automation script to monitor the CloudWatch alarm, shifting traffic back to 100% on the old target group if the alarm fires, or completing the transition to 100% on the new target group after 10 minutes.

Cevap

Deploy a new Auto Scaling group containing the new version, and configure the ALB listener rule with weighted target groups to route 90% of traffic to the old target group and 10% of traffic to the new target group. Use an automation script to monitor the CloudWatch alarm, reverting the weight to 100% on the old target group if the alarm fires, or transitioning 100% to the new target group after 10 minutes.

The correct answer utilizes ALB weighted target groups to perform a manual canary deployment between two separate Auto Scaling groups. This strategy satisfies the requirement to maintain

100\%

capacity because the original Auto Scaling group remains fully provisioned during the test. Since the ALB can immediately adjust routing weights, any failure detected by the CloudWatch alarm can trigger an automation script (such as an AWS Lambda function) to revert the traffic weight to

100\%

on the original target group instantly, ensuring zero downtime. This is necessary because AWS CodeDeploy does not natively support gradual traffic-shifting configurations (Canary/Linear) for EC2 workloads.

Adım Adım Çözüm

Provision a new Auto Scaling group (the green environment) and deploy the updated application version to it.

The new version is running on isolated instances with 100% of the original capacity still active and serving traffic in the old Auto Scaling group (the blue environment).

This guarantees that the active production environment remains untouched and fully capable of handling 100% load during the initial phase.

Modify the Application Load Balancer listener rules to use weighted target groups, routing

90\%

of traffic to the blue target group and

10\%

to the green target group.

Exactly

10\%

of live production traffic is directed to the new version, while

90\%

continues to go to the stable version.

This achieves the canary testing requirement under live production load without fully exposing the application to potential errors.

Monitor the environment using a CloudWatch alarm. If errors occur, immediately reset the ALB listener rule weights to send

100\%

of traffic back to the blue target group. If the 10-minute window passes successfully, shift

100\%

of traffic to the green target group and decommission the blue environment.

A failed deployment is rolled back instantly with zero downtime, or a successful deployment is completed by fully routing traffic to the green environment.

This satisfies the immediate rollback requirement with zero downtime because the blue environment remains fully provisioned and warmed up throughout the test.

Anahtar Kavram

AWS CodeDeploy does not natively support canary or linear traffic shifting for EC2/On-Premises deployments; this capability is only available for Amazon ECS and AWS Lambda. Therefore, achieving a canary deployment pattern with immediate rollback on EC2 requires using Application Load Balancer (ALB) weighted target groups to route traffic between two separate Auto Scaling groups.

Soru 266Soru →

A logistics company is designing a hybrid network to connect $20$ spoke VPCs in the `us-east-1` Region to its on-premises data center. The architecture must enable all spoke VPCs to communicate with each other and with the on-premises network. The connectivity to the on-premises data center must be redundant, using a $10\text{ Gbps}$ AWS Direct Connect connection as the primary path and an AWS Site-to-Site VPN connection over the internet as the backup path. The solution must minimize routing complexity, support automatic failover, and minimize administrative overhead. Which two configuration steps should the Solutions Architect implement to achieve this goal? (Select TWO.)

Geçerli olan tümünü seçin

Attach the

20

spoke VPCs, the Direct Connect Gateway (DXGW) using a transit virtual interface (VIF), and the Site-to-Site VPN to a central AWS Transit Gateway.

Enable BGP route propagation for both the Direct Connect Gateway attachment and the Site-to-Site VPN attachment in the Transit Gateway route table associated with the spoke VPCs.

Establish VPC peering connections between all

20

spoke VPCs, and associate the Direct Connect Gateway directly with the Virtual Private Gateways of each spoke VPC to route hybrid traffic.

Create a Route 53 Private Hosted Zone (PHZ) containing on-premises records in a centralized Shared Services VPC, and associate the PHZ directly with the AWS Transit Gateway to enable domain resolution for all spoke VPCs.

Deploy a single centralized NAT Gateway in a Shared Services VPC, and configure the spoke VPC route tables to route all hybrid traffic to this NAT Gateway to handle failover between the Direct Connect and VPN connections.

Cevabı ve açıklamayı göster

Cevap: Attach the $20$ spoke VPCs, the Direct Connect Gateway (DXGW) using a transit virtual interface (VIF), and the Site-to-Site VPN to a central AWS Transit Gateway.; Enable BGP route propagation for both the Direct Connect Gateway attachment and the Site-to-Site VPN attachment in the Transit Gateway route table associated with the spoke VPCs.

Cevap

Attach the spoke VPCs, the Direct Connect Gateway via a transit virtual interface, and the Site-to-Site VPN to a central AWS Transit Gateway, and enable BGP route propagation for both hybrid attachments in the Transit Gateway route table.

The correct architecture uses a central AWS Transit Gateway to interconnect the

20

spoke VPCs and handle hybrid connectivity. By attaching both the Direct Connect Gateway (using a transit VIF) and the Site-to-Site VPN to the Transit Gateway and enabling BGP route propagation, the Transit Gateway dynamically learns routes to the on-premises network. When identical prefixes are propagated over both paths, AWS Transit Gateway's default route selection logic prioritizes the Direct Connect Gateway attachment over the VPN attachment, ensuring that the primary path is used and that traffic automatically fails over to the VPN if the Direct Connect link drops.

Adım Adım Çözüm

Consolidate spoke VPC and hybrid connections into AWS Transit Gateway.

Created a central Transit Gateway with attachments for all

20

spoke VPCs, the Direct Connect Gateway (using a transit VIF), and the Site-to-Site VPN connection.

Transit Gateway acts as a cloud router, enabling any-to-any communication and centralizing connection points to reduce administrative overhead compared to VPC peering meshes.

Enable dynamic routing via BGP propagation.

Propagated on-premises routes from both the Direct Connect Gateway and the VPN attachments into the Transit Gateway route table.

By propagating both paths via BGP, the Transit Gateway automatically applies path selection algorithms. Direct Connect Gateway attachments are prioritized over VPN attachments by default when identical prefixes are received, facilitating automatic failover without manual route table changes.

Anahtar Kavram

AWS Transit Gateway path selection behavior for BGP-propagated routes automatically prefers Direct Connect Gateway over Site-to-Site VPN, enabling dynamic and automatic failover.

Soru 267Soru →

A medical logistics company is designing a new critical vaccine shipment tracking application. The application will run on AWS, with the primary deployment in the us-east-1 Region. The system must meet a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of 5 minutes. The database layer uses Amazon Aurora PostgreSQL. To minimize costs, the backup disaster recovery environment in the us-west-2 Region should run with minimal resource footprint during normal operations. The solution must also support secure, low-latency cross-VPC DNS resolution for private microservices. Which of the following disaster recovery and high availability architectures meets these requirements at the lowest cost?

Implement a backup and restore disaster recovery strategy by copying automated daily Aurora snapshots from us-east-1 to us-west-2. In the event of a disaster, use AWS CloudFormation to restore the database from the copied snapshot and provision the application stack in us-west-2.

Implement an active-passive disaster recovery strategy by deploying Amazon Aurora Global Database with a secondary cluster in us-west-2. Keep the secondary cluster's application Auto Scaling groups set to a desired capacity of zero during normal operations. Configure a Route 53 Failover routing policy with health checks to route public traffic to the secondary region if the primary region experiences an outage, and associate the Route 53 Private Hosted Zone with the VPCs in both regions.

Deploy the application in an active-active multi-region configuration across us-east-1 and us-west-2 using Route 53 Latency routing. To optimize NAT Gateway costs in both regions, route outbound private subnet internet traffic through a single NAT Gateway located in the primary public subnet of the first Availability Zone in each region.

Deploy Amazon RDS PostgreSQL in us-east-1 with a Multi-AZ deployment. Direct read-heavy tracking queries to the Multi-AZ standby instance to optimize CPU utilization on the primary database writer, and configure AWS Database Migration Service (DMS) continuous replication to a single-instance database in us-west-2.

Cevabı ve açıklamayı göster

Cevap: Implement an active-passive disaster recovery strategy by deploying Amazon Aurora Global Database with a secondary cluster in us-west-2. Keep the secondary cluster's application Auto Scaling groups set to a desired capacity of zero during normal operations. Configure a Route 53 Failover routing policy with health checks to route public traffic to the secondary region if the primary region experiences an outage, and associate the Route 53 Private Hosted Zone with the VPCs in both regions.

Cevap

Implement an active-passive disaster recovery strategy by deploying Amazon Aurora Global Database with a secondary cluster in us-west-2, keeping the application scaled to zero in the secondary region, utilizing Route 53 Failover routing, and associating the Private Hosted Zone with both VPCs.

The active-passive strategy using Amazon Aurora Global Database replicates data within seconds to meet the 5-minute RPO. Scaled-down application Auto Scaling groups allow resources to be provisioned within the 30-minute RTO. Associating the Route 53 Private Hosted Zone with both VPCs enables cross-VPC DNS resolution.

Adım Adım Çözüm

Analyze the RPO requirement of 5 minutes.

A backup and restore strategy using daily snapshots is ruled out because it cannot guarantee a 5-minute RPO.

Aurora Global Database provides sub-second replication, easily meeting the 5-minute RPO.

Analyze the RTO requirement of 30 minutes and the cost constraint.

An active-passive setup with application resources scaled to zero (pilot light/warm standby) is selected over active-active multi-region.

Scaling application resources to zero minimizes compute costs while still allowing the environment to scale up and become active within 30 minutes.

Evaluate the high availability and networking constraints.

Ensure redundant NAT Gateways in each Availability Zone and associate the Route 53 Private Hosted Zone with all VPCs.

Single NAT Gateways fail the HA constraint, and Route 53 Private Hosted Zone association is required for cross-VPC private DNS resolution.

Anahtar Kavram

Designing active-passive disaster recovery architectures on AWS using Route 53 failover, Aurora Global Database, and proper private DNS configuration.

Tahmini Süre:1m 30s

Soru 268Soru →

A gaming company is designing a multiplayer game backend to store user profile states and matchmaking configurations. The primary infrastructure is located in the `us-east-1` Region, consisting of an Application Load Balancer (ALB), an Auto Scaling Group (ASG) of Amazon EC2 instances in private subnets, and an Amazon Aurora MySQL database cluster. To prepare for a regional outage, the company is designing a disaster recovery (DR) solution in the `us-west-2` Region. The DR solution must achieve a Recovery Time Objective (RTO) of less than $15$ minutes and a Recovery Point Objective (RPO) of less than $2$ minutes. The design must also minimize ongoing compute costs in the disaster recovery region. Which architecture meets these requirements?

Configure an Amazon Aurora Global Database with the primary cluster in `us-east-1` and a secondary cluster in `us-west-2` containing a single reader instance. Deploy an ALB and an ASG in `us-west-2` with the capacity set to

0

. Create a Route 53 Private Hosted Zone (PHZ) for internal database endpoint resolution and associate it with the VPCs in both regions. In both regions, deploy a single NAT Gateway in

1

Availability Zone to route outbound private subnet traffic. Configure Route 53 Failover routing records with health checks pointing to the `us-east-1` ALB.

Configure Amazon Aurora database backups in `us-east-1` and schedule copies of these snapshots to `us-west-2` every

30

minutes. Deploy an ALB and an ASG in `us-west-2` with the capacity set to

0

. Create a Route 53 Private Hosted Zone (PHZ) associated with the VPCs in both regions. Configure Route 53 Failover routing records with health checks pointing to the `us-east-1` ALB. Upon failover, restore the database in `us-west-2` from the latest copied snapshot, scale up the ASG in `us-west-2` to the required capacity, and update the database endpoint in the PHZ.

0

. Create a Route 53 Private Hosted Zone (PHZ) for internal database endpoint resolution and associate it with the VPCs in both `us-east-1` and `us-west-2`. Configure Route 53 Failover routing records with health checks pointing to the `us-east-1` ALB, with the primary record targeting `us-east-1` and the secondary record targeting the `us-west-2` ALB. Upon failover, promote the secondary database cluster and scale up the ASG in `us-west-2`.

0

. Create a Route 53 Private Hosted Zone (PHZ) in `us-east-1` for database endpoint resolution, leaving it unassociated with the `us-west-2` VPC. Configure Route 53 Failover routing records with health checks pointing to the `us-east-1` ALB, with the primary record targeting `us-east-1` and the secondary record targeting the `us-west-2` ALB. Upon failover, promote the secondary database cluster and scale up the ASG in `us-west-2`.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in `us-east-1` and a secondary cluster in `us-west-2` containing a single reader instance. Deploy an ALB and an ASG in `us-west-2` with the capacity set to $0$ . Create a Route 53 Private Hosted Zone (PHZ) for internal database endpoint resolution and associate it with the VPCs in both `us-east-1` and `us-west-2`. Configure Route 53 Failover routing records with health checks pointing to the `us-east-1` ALB, with the primary record targeting `us-east-1` and the secondary record targeting the `us-west-2` ALB. Upon failover, promote the secondary database cluster and scale up the ASG in `us-west-2`.

Cevap

The architecture that configures an Aurora Global Database, sets the secondary region's Auto Scaling Group capacity to

0

, associates the Route 53 Private Hosted Zone with both region VPCs, and configures Route 53 Failover routing.

The correct architecture uses Amazon Aurora Global Database, which replicates data asynchronously to the secondary region with a typical latency of less than

1

second, easily meeting the RPO of less than

2

minutes. Setting the standby Auto Scaling Group's capacity to

0

minimizes ongoing EC2 compute costs. Route 53 Failover routing correctly detects primary region degradation via health checks and automatically redirects traffic to the standby ALB. Once failover is initiated, the secondary database cluster is promoted to primary, and the ASG is scaled up, which can be accomplished well within the

15

-minute RTO. Associating the Private Hosted Zone with VPCs in both regions ensures internal database endpoint resolution continues to work in the disaster recovery region.

Adım Adım Çözüm

Select a replication strategy that meets the RPO constraint of less than

2

minutes.

Amazon Aurora Global Database provides sub-second cross-region replication, satisfying the RPO, whereas snapshot copies fail to meet it.

Physical snapshot copying and restoration cannot guarantee sub-minute data sync.

Determine the compute configuration in the recovery region to minimize cost while meeting the RTO.

Set the Auto Scaling Group capacity in `us-west-2` to

0

and scale it up only during a failover event.

Keeping instances at

0

avoids active compute costs, and scaling up takes only a few minutes, which is well within the

15

-minute RTO.

Ensure DNS resolution for database endpoints works in both regions.

Associate the Route 53 Private Hosted Zone with the VPCs in both `us-east-1` and `us-west-2`.

Private Hosted Zones must be associated with a VPC to allow DNS queries originating from that VPC to resolve successfully.

Evaluate outbound internet routing resiliency in the VPC design.

Deploy NAT Gateways redundantly in each Availability Zone where application instances reside.

A single NAT Gateway per VPC creates a single point of failure that compromises high availability if its hosting zone experiences an outage.

Anahtar Kavram

High Availability and Disaster Recovery Design for Multi-Region Architectures

Soru 269Soru →

An online multiplayer gaming platform is preparing for a global tournament broadcast. During the broadcast, the concurrent user session count is expected to surge instantly from a steady state of $1,200$ requests per second to over $75,000$ requests per second within a $3$ -minute window. The platform's frontend is served by an Application Load Balancer (ALB), and the session metadata is stored in an Amazon Aurora PostgreSQL database. The Solutions Architect needs to optimize the architecture to ensure that the platform can scale to handle the spike without latency degradation or dropped connection requests, while maintaining a caching layer that supports replication. Which TWO actions should the Solutions Architect take to design a performant and scalable solution? (Select TWO.)

Geçerli olan tümünü seçin

Contact AWS Support to pre-warm the Application Load Balancer (ALB) prior to the tournament broadcast.

Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ enabled to cache the session metadata.

Rely on the default auto-scaling behavior of the Application Load Balancer (ALB) to handle the traffic surge.

Enable Amazon Aurora Auto Scaling and direct read requests to the database standby instance in the secondary Availability Zone.

Deploy an Amazon ElastiCache for Memcached cluster to cache the session metadata, enabling multi-AZ replication.

Cevabı ve açıklamayı göster

Cevap: Contact AWS Support to pre-warm the Application Load Balancer (ALB) prior to the tournament broadcast.; Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ enabled to cache the session metadata.

Cevap

Contact AWS Support to pre-warm the Application Load Balancer (ALB) and deploy an Amazon ElastiCache for Redis cluster with Multi-AZ.

Pre-warming the Application Load Balancer (ALB) prepares it to handle the sudden, massive traffic spike from the start, as the standard dynamic scaling of an ALB is too slow for instantaneous spikes of this magnitude and will cause dropped connections. Amazon ElastiCache for Redis with Multi-AZ enabled is the correct caching solution because it supports replication, failover, and high availability, which offloads read traffic from the primary database.

Adım Adım Çözüm

Analyze the load profile and ALB scaling behavior.

Identify that the traffic spike from

1,200

75,000

requests per second in

3

minutes is too rapid for automatic ALB scaling, necessitating pre-warming.

Standard ALB auto-scaling is reactive and cannot scale fast enough to meet instant, high-magnitude traffic spikes.

Select the appropriate caching strategy for highly available leaderboard data.

Choose ElastiCache for Redis with Multi-AZ over Memcached.

ElastiCache for Redis supports data replication and multi-AZ failover, which are necessary for high availability, unlike Memcached.

Evaluate database scaling options.

Avoid directing read traffic to a Multi-AZ standby since it cannot serve traffic.

Standard RDS Multi-AZ standbys do not accept connection endpoints for read queries.

Anahtar Kavram

Pre-warming load balancers and utilizing replication-capable caching layers to handle instant scale and offload databases.

Soru 270Soru →

A company is designing a deployment pipeline for a single-page web application (SPA) hosted on Amazon S3 and served via Amazon CloudFront. The development team wants to implement a canary deployment strategy where $10\%$ of live user traffic is routed to a new version of the frontend hosted in a separate S3 bucket. The traffic must be monitored for $30$ minutes. If no errors are detected, the deployment must complete by serving the new version to all users. If errors are detected, the traffic must immediately revert to the original version.

Which two actions should the solutions architect take to configure this deployment strategy? (Select two.)

Geçerli olan tümünü seçin

Create a staging CloudFront distribution that points to the new S3 bucket origin.

Create a continuous deployment policy on the primary CloudFront distribution to route

10\%

of live traffic to the staging distribution, and promote the staging distribution to primary once validated.

Configure an Amazon Route 53 weighted routing policy to split traffic

90/10

between the primary distribution and a new standalone primary distribution pointing to the new S3 bucket.

Configure a CloudFront origin group with the primary origin pointing to the existing S3 bucket and the secondary origin pointing to the new S3 bucket, setting failover criteria to trigger on

4\text{xx}

5\text{xx}

errors.

Create an AWS Lambda@Edge function associated with the primary distribution's Viewer Request event to randomly rewrite the request URI to the new S3 bucket for

10\%

of the incoming requests.

Cevabı ve açıklamayı göster

Cevap: Create a staging CloudFront distribution that points to the new S3 bucket origin.; Create a continuous deployment policy on the primary CloudFront distribution to route $10\%$ of live traffic to the staging distribution, and promote the staging distribution to primary once validated.

Cevap

Create a staging CloudFront distribution that points to the new S3 bucket origin, and create a continuous deployment policy on the primary CloudFront distribution to route

10\%

of live traffic to the staging distribution, promoting the staging distribution to primary once validated.

To implement a canary deployment on CloudFront, the solutions architect should use CloudFront's native continuous deployment feature. This requires creating a staging distribution pointing to the new version's S3 bucket, and then configuring a continuous deployment policy on the primary distribution to route

10\%

of traffic to the staging distribution. Once validated, promoting the staging distribution updates the primary distribution for all users.

Adım Adım Çözüm

Set up a staging CloudFront distribution.

A staging distribution is created as a child of the primary distribution, pointing to the new S3 bucket containing the updated frontend code.

CloudFront continuous deployment requires a staging distribution to hold the new configuration and origin settings for validation before promotion.

Configure the continuous deployment policy on the primary distribution.

A policy is attached to the primary distribution, specifying a

10\%

traffic weight routed to the staging distribution ID.

This establishes the canary routing pattern, safely directing a fraction of production traffic to the new version without affecting the rest of the users.

Validate the deployment and promote the staging distribution.

If validation succeeds, the staging distribution is promoted, causing its configuration to overwrite the primary distribution. If validation fails, the policy is detached or modified, immediately reverting all traffic to the original origin.

Promotion seamlessly updates the main distribution's configuration for all users, while detaching the policy provides an instantaneous rollback mechanism that bypasses DNS propagation delays.

Anahtar Kavram

CloudFront Continuous Deployment

Soru 271Soru →

A company uses AWS CloudFormation StackSets to manage infrastructure deployments across 50 production accounts and 1 staging account in an AWS Organization. The Solutions Architect needs to design a deployment strategy that updates the stacks in these accounts. The strategy must meet the following requirements:

- The stack update must be applied to the staging account and verified successfully before any production accounts are updated.
- In production, updates must be deployed to the us-east-1 Region first, and must only proceed to the eu-west-1 Region if the deployment in us-east-1 is completely successful.
- Within each Region, the deployment must update a maximum of 10 production accounts concurrently.
- If deployments fail in more than 2 production accounts in a single Region, the deployment operation for that Region must immediately stop, and the stack set must roll back.

Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Deploy the CloudFormation template to the staging account first. Once verified, execute the StackSet update operation targeting the production accounts with the RegionConcurrencyType parameter set to SEQUENTIAL and the RegionOrder parameter set to ['us-east-1', 'eu-west-1'].

Configure the StackSet update operation preferences for the production accounts with the MaxConcurrentCount parameter set to 10 and the FailureToleranceCount parameter set to 2.

Configure a single StackSet targeting an organizational unit (OU) that contains both the staging and production accounts, and set the MaxConcurrentPercentage parameter to 2% to ensure staging is updated first.

Configure the production StackSet update operation preferences with the RegionConcurrencyType parameter set to PARALLEL and set the RegionOrder parameter to ['us-east-1', 'eu-west-1'] to allow concurrent deployment across Regions.

Configure the production StackSet update operation preferences with the FailureToleranceCount parameter set to 0 to trigger immediate rollback upon any single account deployment failure.

Cevabı ve açıklamayı göster

Cevap: Deploy the CloudFormation template to the staging account first. Once verified, execute the StackSet update operation targeting the production accounts with the RegionConcurrencyType parameter set to SEQUENTIAL and the RegionOrder parameter set to ['us-east-1', 'eu-west-1'].; Configure the StackSet update operation preferences for the production accounts with the MaxConcurrentCount parameter set to 10 and the FailureToleranceCount parameter set to 2.

Cevap

Deploy the CloudFormation template to the staging account first, then execute the StackSet update targeting production accounts with the RegionConcurrencyType parameter set to SEQUENTIAL and RegionOrder set to ['us-east-1', 'eu-west-1']. Configure the StackSet update operation preferences with the MaxConcurrentCount parameter set to 10 and the FailureToleranceCount parameter set to 2.

To satisfy the deployment requirements, the staging account must be updated and verified independently before production. For the production accounts, AWS CloudFormation StackSets operational preferences must be configured to control the order, concurrency, and failure threshold. Setting the RegionConcurrencyType to SEQUENTIAL with a RegionOrder of ['us-east-1', 'eu-west-1'] ensures that us-east-1 is fully deployed before eu-west-1 is updated. Setting the MaxConcurrentCount to 10 limits the active accounts being updated per Region to 10. Setting the FailureToleranceCount to 2 allows up to 2 failures per Region; if a 3rd failure occurs, the operation immediately stops and rolls back.

Adım Adım Çözüm

Separate the deployment stages to ensure validation.

The staging account is updated first using a direct stack update or separate StackSet operation.

This guarantees staging validation is completed before production accounts are modified.

Enforce regional sequence for the production StackSet update.

The RegionConcurrencyType parameter is set to SEQUENTIAL, and the RegionOrder parameter is set to ['us-east-1', 'eu-west-1'].

This ensures the deployment in us-east-1 completes successfully before proceeding to eu-west-1.

Set the parallel execution limits and rollback triggers for production accounts.

The MaxConcurrentCount parameter is set to 10, and the FailureToleranceCount parameter is set to 2.

This limits concurrent deployments to 10 accounts and allows up to 2 failures, stopping and rolling back the operation if a 3rd failure occurs (more than 2 failures).

Anahtar Kavram

AWS CloudFormation StackSets concurrency, regional routing, and failure tolerance controls.

Tahmini Süre:3m 0s

Soru 272Soru →

A global healthcare technology enterprise manages $120$ member accounts within AWS Organizations. The security team requires a centralized auditing solution that aggregates AWS CloudTrail logs from all member accounts and regions into a single Amazon S3 bucket located in a dedicated Security account. The solution must ensure that all log data is encrypted at rest using a customer managed KMS key (KMS CMK). Additionally, member accounts must be prevented from disabling logging or modifying the trail configuration. Which TWO actions should the Solutions Architect take to implement this solution securely?

Geçerli olan tümünü seçin

Configure an organization trail from the management account, and specify a Customer Managed Key (CMK) in the Security account with a key policy that allows the 'cloudtrail.amazonaws.com' service principal to perform 'kms:GenerateDataKey*' and 'kms:DescribeKey' actions, restricted by a condition matching the organization's ID.

Apply a Service Control Policy (SCP) to the organization root that denies 'cloudtrail:DeleteTrail', 'cloudtrail:StopLogging', and 'cloudtrail:UpdateTrail' actions, unless the caller is the organization's management account.

Configure the organization trail to encrypt logs using the AWS-managed KMS key for Amazon S3 ('aws/s3') in the Security account to simplify key management across all regions.

Attach a Service Control Policy (SCP) to the organization root that explicitly allows 'cloudtrail:StartLogging' and 'cloudtrail:CreateTrail' for all member accounts to ensure that logging permissions are enforced regardless of local IAM policies.

In the Security account, configure the central S3 bucket policy to grant 's3:PutObject' permissions directly to the IAM administrative roles in each member account.

Cevabı ve açıklamayı göster

Cevap: Configure an organization trail from the management account, and specify a Customer Managed Key (CMK) in the Security account with a key policy that allows the 'cloudtrail.amazonaws.com' service principal to perform 'kms:GenerateDataKey*' and 'kms:DescribeKey' actions, restricted by a condition matching the organization's ID.; Apply a Service Control Policy (SCP) to the organization root that denies 'cloudtrail:DeleteTrail', 'cloudtrail:StopLogging', and 'cloudtrail:UpdateTrail' actions, unless the caller is the organization's management account.

Cevap

Configure an organization trail from the management account using a Customer Managed Key in the Security account with a key policy allowing the CloudTrail service principal to perform key actions restricted by the AWS Organization ID, and apply a Service Control Policy to the organization root that denies deletion, stopping, or modification of the trail by member accounts.

To implement centralized auditing securely, the Solutions Architect must configure a customer managed KMS key in the Security account with a policy allowing the CloudTrail service principal to generate data keys, restricted by the organization's ID. Additionally, a Service Control Policy (SCP) must be attached to the organization root to deny modification or deletion of the trail by member accounts.

Adım Adım Çözüm

Set up an AWS Organizations trail in the management account to capture events across all accounts.

Logs are automatically aggregated and delivered to the designated centralized S3 bucket in the Security account.

An organization trail ensures comprehensive logging across all member accounts without manual configuration in each account.

Configure a Customer Managed Key (CMK) in the Security account and update its policy to allow the CloudTrail service principal cross-account access, scoped with the Organization ID.

CloudTrail is authorized to generate data keys and encrypt log objects delivered to the S3 bucket.

AWS-managed keys cannot be shared cross-account, so a Customer Managed Key is required for cross-account logging encryption.

Deploy a Service Control Policy (SCP) at the organization root to deny modifications to CloudTrail configurations.

Member accounts cannot disable logging or delete the trail, enforcing compliance.

SCPs act as guardrails to prevent unauthorized configuration changes in member accounts.

Anahtar Kavram

Centralized Organization Trail with Cross-Account Customer Managed Keys and Service Control Policies

Soru 273Soru →

An enterprise uses AWS Organizations to manage its multi-account environment. The security team wants to establish guardrails that apply to all member accounts, including the local account administrators. Specifically, they must prevent any member account from leaving the AWS Organization, and prevent the deletion or modification of a centralized security audit IAM role named CentralSecOpsRole in any member account. Which two configurations should the Solutions Architect implement to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Apply a Service Control Policy (SCP) to the organization root that denies the organizations:LeaveOrganization action.

Apply an SCP to the organizational units containing the member accounts that denies configuration changes and deletion of the CentralSecOpsRole.

Apply an IAM permission boundary to all users and roles in the member accounts that explicitly denies organizations:LeaveOrganization and modification of CentralSecOpsRole.

Attach an SCP to the organization root that explicitly allows the CentralSecOpsRole to perform all actions and denies all other roles from modifying it.

Configure a resource-based policy on the IAM role CentralSecOpsRole in each member account that denies access to all principals except the security team's cross-account role.

Cevabı ve açıklamayı göster

Cevap: Apply a Service Control Policy (SCP) to the organization root that denies the organizations:LeaveOrganization action.; Apply an SCP to the organizational units containing the member accounts that denies configuration changes and deletion of the CentralSecOpsRole.

Cevap

The correct configurations are to apply a Service Control Policy (SCP) to the organization root that denies the organizations:LeaveOrganization action, and apply an SCP to the organizational units containing the member accounts that denies configuration changes and deletion of the CentralSecOpsRole.

Applying a Service Control Policy (SCP) at the organization root that denies the organizations:LeaveOrganization action effectively prevents any principal in a member account from removing the account from the organization. Additionally, applying an SCP to the organizational units (OUs) that denies IAM actions (such as update and delete actions) on the resource path of CentralSecOpsRole ensures that even local administrators cannot modify or delete the role, as SCPs override local administrator permissions.

Adım Adım Çözüm

Determine the proper tool for enforcing guardrails that override local administrators.

Service Control Policies (SCPs) are identified as the only mechanism that can restrict actions for all principals in a member account, including the root user and administrators.

SCPs define the maximum available permissions for member accounts in an AWS Organization, allowing global restrictions that local users cannot bypass.

Select the correct action to prevent accounts from leaving the organization.

Identify the organizations:LeaveOrganization API action and restrict it at the root of the AWS Organization.

Applying this restriction at the root ensures it applies transitively to all accounts in the organization.

Formulate a policy to protect the CentralSecOpsRole from modification.

Target the specific role ARN using an SCP that denies write actions (such as delete, update, and policy attachment) on the CentralSecOpsRole.

Denying these write actions on the specific resource prevents any administrator in the member accounts from tampering with the security auditing role.

Anahtar Kavram

Service Control Policies (SCPs) act as permission boundaries for AWS Organizations and are required to restrict actions for local administrators in member accounts.

Tahmini Süre:2m 0s

Soru 274Soru →

A company is designing a multi-region disaster recovery (DR) architecture for its customer portal. The primary infrastructure is deployed in us-east-1, and the standby infrastructure is in us-west-2. The database tier uses Amazon Aurora PostgreSQL. The business requirements state a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 2 minutes. Outbound database traffic to external APIs must be resilient to Availability Zone (AZ) failures in both regions. Which architecture should a solutions architect design to meet these requirements with the lowest operational complexity?

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy NAT Gateways in multiple Availability Zones in each region. Configure Route 53 with failover routing using active-passive health checks on the application endpoints.

Deploy Amazon RDS for PostgreSQL in us-east-1 with a Multi-AZ deployment, and configure daily cross-region snapshots to us-west-2. Configure read scaling by directing read traffic to the passive RDS standby instance. Configure Route 53 with geolocation routing.

Deploy Amazon Aurora PostgreSQL cross-region read replicas from us-east-1 to us-west-2. Deploy a single NAT Gateway in the primary Availability Zone of each region to centralize outbound traffic. Configure Route 53 with latency-based routing policies.

Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Configure a Route 53 Private Hosted Zone for private service resolution, but associate it only with the us-east-1 VPC. Keep the application servers in us-west-2 powered down under a pilot light configuration.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy NAT Gateways in multiple Availability Zones in each region. Configure Route 53 with failover routing using active-passive health checks on the application endpoints.

Cevap

The correct architecture uses Amazon Aurora Global Database to achieve low-latency replication that satisfies the sub-2-minute RPO constraint. Setting up Route 53 failover routing handles active-passive failover automatically, which allows the application to meet the 15-minute RTO constraint. Additionally, deploying NAT Gateways across multiple Availability Zones in each region ensures that outbound traffic routes are highly available and resilient to individual Availability Zone failures.

Adım Adım Çözüm

Select a cross-region replication method that meets the RPO constraint of less than 2 minutes.

Amazon Aurora Global Database provides fast, physical replication with lag typically under one second.

This satisfies the strict RPO requirement, whereas snapshot restoration would exceed the RPO limit.

Configure the DNS routing strategy to automate failover and meet the RTO constraint of less than 15 minutes.

Route 53 active-passive failover routing policy routes traffic based on health check statuses.

Active-passive configuration ensures traffic is dynamically rerouted to the secondary region if the primary region goes offline.

Verify high availability for outbound traffic paths in both regions.

Deploy NAT Gateways in multiple Availability Zones in each VPC.

Outbound API calls must not fail if a single Availability Zone experiences an outage, so redundant NAT Gateways are required.

Anahtar Kavram

High Availability and Disaster Recovery Design

Tahmini Süre:2m 0s

Soru 275Soru →

A logistics company is setting up a new multi-account AWS environment with $5$ VPCs in the `us-east-1` Region. These VPCs belong to different AWS accounts managed under a single AWS Organization. The company needs to establish any-to-any network connectivity among all $5$ VPCs and connect them to their on-premises corporate headquarters via an AWS Direct Connect connection. Additionally, a central Route 53 Private Hosted Zone (PHZ) must be resolvable from all VPCs, and all outbound internet traffic must be routed through a centralized egress VPC containing NAT Gateways. The solution must scale with minimal administrative overhead and avoid any single point of failure. Which network architecture should a solutions architect recommend to meet these requirements?

Create an AWS Transit Gateway in a central network account, share it via AWS Resource Access Manager (RAM), and attach all

5

spoke VPCs and the egress VPC. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. In the egress VPC, deploy redundant NAT Gateways across multiple Availability Zones, and configure the Transit Gateway route table to route all outbound internet traffic (

0.0.0.0/0

) to the egress VPC. Associate the Private Hosted Zone with all VPCs.

Create an AWS Transit Gateway in a central network account, share it via AWS Resource Access Manager (RAM), and attach all

5

spoke VPCs and the egress VPC. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. In the egress VPC, deploy redundant NAT Gateways across multiple Availability Zones. Associate the Private Hosted Zone only with the egress VPC and rely on Transit Gateway to route DNS queries from other VPCs.

Create a Direct Connect Gateway and associate it directly with the Virtual Private Gateways in all VPCs using private virtual interfaces. Establish a full mesh of VPC peering connections among all

5

VPCs for inter-VPC traffic. Deploy NAT Gateways in each spoke VPC for internet egress, and associate the Private Hosted Zone with all VPCs.

Create an AWS Transit Gateway in a central network account, share it via AWS Resource Access Manager (RAM), and attach all

5

spoke VPCs and the egress VPC. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. In the egress VPC, deploy a single NAT Gateway in one Availability Zone to centralize all outbound internet traffic, and associate the Private Hosted Zone with all VPCs.

Cevabı ve açıklamayı göster

Cevap: Create an AWS Transit Gateway in a central network account, share it via AWS Resource Access Manager (RAM), and attach all $5$ spoke VPCs and the egress VPC. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. In the egress VPC, deploy redundant NAT Gateways across multiple Availability Zones, and configure the Transit Gateway route table to route all outbound internet traffic ( $0.0.0.0/0$ ) to the egress VPC. Associate the Private Hosted Zone with all VPCs.

Cevap

Create an AWS Transit Gateway in a central network account, share it via AWS Resource Access Manager (RAM), and attach all spoke VPCs and the egress VPC. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. Deploy redundant NAT Gateways in the egress VPC across multiple Availability Zones, and configure routing to point outbound traffic to the egress VPC. Associate the Route 53 Private Hosted Zone with all VPCs to ensure DNS resolution.

The correct architecture uses AWS Transit Gateway shared via AWS Resource Access Manager (RAM) to act as a centralized hub, providing scalable any-to-any connectivity with minimal routing complexity. Associating the Direct Connect Gateway with Transit Gateway requires a transit virtual interface (Transit VIF), which supports transitive routing to multiple VPCs. Deploying redundant NAT Gateways across multiple Availability Zones in the egress VPC ensures high availability for outbound traffic, and associating the Private Hosted Zone directly with all VPCs ensures successful DNS resolution across accounts.

Adım Adım Çözüm

Centralize transit routing using AWS Transit Gateway.

A central Transit Gateway is deployed in a network account and shared with the AWS Organization using AWS Resource Access Manager (RAM).

This avoids the administrative complexity of full-mesh VPC peering and scales dynamically as new VPCs are added.

Connect the on-premises environment using AWS Direct Connect.

The Direct Connect Gateway is associated with the central Transit Gateway using a transit virtual interface (Transit VIF).

Transit VIF is required to enable transitive hybrid routing between the on-premises network and multiple VPCs via Transit Gateway.

Configure high availability for central internet egress.

An egress VPC is attached to the Transit Gateway, containing NAT Gateways deployed across multiple Availability Zones.

Routing outbound traffic (

0.0.0.0/0

) to redundant NAT Gateways avoids a single point of failure and ensures egress resilience.

Configure Route 53 Private Hosted Zone (PHZ) association.

The central PHZ is associated with all VPCs across the accounts.

DNS resolution for a PHZ requires explicit association with each consumer VPC, as Transit Gateway does not propagate DNS queries implicitly.

Anahtar Kavram

AWS Transit Gateway offers a hub-and-spoke architecture that simplifies multi-VPC and hybrid network routing. Direct Connect Gateway associated with a Transit Gateway requires a transit virtual interface (Transit VIF) to support multi-account transitive routing. Outbound internet egress can be centralized through an egress VPC containing redundant NAT Gateways in multiple Availability Zones to ensure high availability. Route 53 Private Hosted Zones (PHZs) must be explicitly associated with each VPC in the organization to allow DNS resolution across all accounts.

Tahmini Süre:2m 0s

Soru 276Soru →

An enterprise manages its multi-account environment under AWS Organizations. The security team has attached a Service Control Policy (SCP) to the Production Organizational Unit (OU) to ensure that all API calls are blocked unless they originate from the corporate network egress IP range of $203.0.113.0/24$ .

The enterprise uses an external SAML 2.0 compliant Identity Provider (IdP) for identity federation. A Solutions Architect is establishing federated access to a member account within the Production OU for database administrators who require administrative access to Amazon RDS resources. The SAML identity provider object has already been created in the member account.

The architect needs to configure an IAM role named `DBAdminRole` in the member account to allow these users to federate and perform their tasks.

Which configuration must the architect implement to ensure database administrators can successfully federate and manage RDS resources?

Configure the trust policy of the `DBAdminRole` with the federated SAML provider ARN as the principal and the `sts:AssumeRole` action. Rely on the Production OU SCP to grant the necessary Amazon RDS permissions to any user federating from

203.0.113.0/24

, as SCPs automatically authorize federated sessions within their scope.

Configure the trust policy of the `DBAdminRole` with the federated SAML provider ARN as the principal and the `sts:AssumeRoleWithSAML` action. Attach a local IAM permissions policy to `DBAdminRole` that explicitly grants the required Amazon RDS permissions, as the SCP restricts the maximum permissions but does not grant them.

Configure the trust policy of the `DBAdminRole` with the federated SAML provider ARN as the principal and the `sts:AssumeRoleWithWebIdentity` action. Attach a local IAM permissions policy to `DBAdminRole` that explicitly grants the required Amazon RDS permissions, and configure the Production OU SCP to explicitly allow `sts:AssumeRoleWithWebIdentity` to grant the federation privilege.

Configure the trust policy of the `DBAdminRole` with `arn:aws:iam::aws:policy/AdministratorAccess` as the principal and the `sts:AssumeRoleWithSAML` action. Leave the `DBAdminRole` permissions policy empty, since the Production OU SCP's lack of an explicit deny for the corporate network implicitly grants full RDS permissions to the federated session.

Cevabı ve açıklamayı göster

Cevap: Configure the trust policy of the `DBAdminRole` with the federated SAML provider ARN as the principal and the `sts:AssumeRoleWithSAML` action. Attach a local IAM permissions policy to `DBAdminRole` that explicitly grants the required Amazon RDS permissions, as the SCP restricts the maximum permissions but does not grant them.

Cevap

Configure the trust policy of the role with the federated SAML provider ARN as the principal and the `sts:AssumeRoleWithSAML` action, while attaching a local IAM permissions policy to the role that explicitly grants the required Amazon RDS permissions.

To set up SAML 2.0 federation, the IAM role trust policy must specify the `Federated` principal pointing to the SAML provider ARN and permit the `sts:AssumeRoleWithSAML` action. Furthermore, because Service Control Policies (SCPs) do not grant permissions but only act as filters, the role itself must have a local IAM permissions policy attached that explicitly grants the database administrators the necessary Amazon RDS access. This fulfills the security guardrails while ensuring the database administrators are granted the correct permissions.

Adım Adım Çözüm

Identify the authentication protocol and the required STS action.

Since the enterprise uses SAML 2.0, the role trust policy must specify the action `sts:AssumeRoleWithSAML` and trust the IAM SAML provider ARN.

SAML 2.0 federation relies on the direct authentication of users via a SAML assertion exchanged for temporary security credentials using the `sts:AssumeRoleWithSAML` API.

Determine how permissions are granted in a multi-account environment governed by SCPs.

SCPs act as a filter (guardrail) and do not grant permissions. A local IAM policy must be attached to the role to grant the actual database administration permissions.

An implicit deny is the default state in AWS. Even if the SCP allows traffic from the corporate IP, an explicit Allow in the local IAM policy is still required to grant access.

Ensure the trust policy principal is correctly defined.

Define the `Principal` in the IAM role's trust policy as the ARN of the SAML provider created in the account.

Trust policies must specify the identity provider entity as a federated principal to authenticate incoming SAML assertions.

Anahtar Kavram

Interaction between IAM role trust policies, local permissions, and Service Control Policies (SCPs) in multi-account SAML federation.

Tahmini Süre:3m 0s

Soru 277Soru →

An enterprise is migrating a legacy customer portal application to a member account within its AWS Organizations structure. The application requires direct SAML 2.0 federation with an external identity provider (IdP) for client authentication because the application's legacy client does not support modern OpenID Connect (OIDC) or integration with AWS IAM Identity Center. A solutions architect must configure the trust relationships so that external users can successfully authenticate and assume a role named LegacyAppFederatedRole. Which of the following actions must the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Create a SAML identity provider in the target AWS member account using the metadata document retrieved from the external identity provider.

Configure the trust policy of the IAM role in the member account to allow the sts:AssumeRoleWithSAML action, specifying the SAML identity provider as the principal.

Configure the trust policy of the IAM role in the member account to allow the sts:AssumeRole action, specifying the SAML identity provider as the principal.

Attach a Service Control Policy (SCP) at the Organizational Unit level that grants sts:AssumeRoleWithSAML to all federated identities in the member account to bypass local IAM role configurations.

Configure the trust policy of the IAM role in the member account to allow the sts:AssumeRoleWithWebIdentity action for the SAML identity provider principal.

Cevabı ve açıklamayı göster

Cevap: Create a SAML identity provider in the target AWS member account using the metadata document retrieved from the external identity provider.; Configure the trust policy of the IAM role in the member account to allow the sts:AssumeRoleWithSAML action, specifying the SAML identity provider as the principal.

Cevap

Create a SAML identity provider in the target AWS member account using the metadata document from the external identity provider, and configure the trust policy of the IAM role in the member account to allow the sts:AssumeRoleWithSAML action, specifying the SAML identity provider as the principal.

Establishing direct SAML 2.0 federation requires registering the identity provider in the destination member account's IAM. Once registered, the destination IAM role must trust that SAML provider using the sts:AssumeRoleWithSAML action in its trust policy, enabling external users to exchange their SAML assertion for AWS temporary credentials.

Adım Adım Çözüm

A SAML 2.0 identity provider object is created in the member account's IAM using the metadata document from the external IdP.

This establishes trust between the member account and the external identity provider at the account level.

Create or update the target IAM role with a federated trust policy.

The IAM role trust policy is configured with the principal pointing to the SAML provider's ARN and the action allowed is set to sts:AssumeRoleWithSAML.

This configuration allows the Security Token Service (STS) to issue temporary credentials when the external identity provider asserts the user's identity.

Anahtar Kavram

SAML 2.0 Identity Federation in IAM

Soru 278Soru →

A financial services organization is designing the resource sharing and cost optimization strategy for its AWS multi-account landing zone. The core infrastructure includes a Shared-Network account, a Central-Compliance account, and several Business-Unit accounts. The Shared-Network account contains a VPC with private subnets. The application workloads in the Business-Unit accounts must be deployed within these shared subnets to avoid duplicate NAT Gateway charges, and they must write encrypted transaction logs to a centralized S3 bucket located in the Central-Compliance account. Which of the following strategies should a solutions architect implement to satisfy these requirements securely?

Enable resource sharing within AWS Organizations. Use AWS Resource Access Manager (RAM) in the Shared-Network account to share the private subnets with the Business-Unit accounts. Create a Customer Managed Key (CMK) in the Central-Compliance account to encrypt the S3 bucket. Configure the S3 bucket policy to grant write access to the application IAM roles, and update the CMK key policy in the Central-Compliance account to allow the application IAM roles to perform kms:GenerateDataKey and kms:Decrypt operations.

Enable resource sharing within AWS Organizations. Use AWS Resource Access Manager (RAM) in the Shared-Network account to share the private subnets with the Business-Unit accounts. Use the AWS-managed KMS key (aws/s3) to encrypt the S3 bucket in the Central-Compliance account. Configure the S3 bucket policy to grant write access to the application IAM roles, and add a policy statement to the aws/s3 key policy allowing the application IAM roles cross-account access to use the key.

Enable resource sharing within AWS Organizations. Use AWS Resource Access Manager (RAM) in the Shared-Network account to share the private subnets with the Business-Unit accounts. Create a Customer Managed Key (CMK) in the Central-Compliance account to encrypt the S3 bucket. Attach a Service Control Policy (SCP) to the Business-Unit OU that explicitly allows s3:PutObject and kms:GenerateDataKey on the central logging resources, without configuring S3 bucket policies or KMS key policies.

Enable resource sharing within AWS Organizations. Use AWS Resource Access Manager (RAM) in the Shared-Network account to share the private subnets with the Business-Unit accounts. Create a Customer Managed Key (CMK) in the Central-Compliance account to encrypt the S3 bucket. Configure the IAM roles in the Business-Unit accounts to allow S3 and KMS actions, but do not configure an S3 bucket policy in the Central-Compliance account, relying instead on S3 Access Control Lists (ACLs) with bucket owner preferred settings to automatically grant write permissions.

Cevabı ve açıklamayı göster

Cevap: Enable resource sharing within AWS Organizations. Use AWS Resource Access Manager (RAM) in the Shared-Network account to share the private subnets with the Business-Unit accounts. Create a Customer Managed Key (CMK) in the Central-Compliance account to encrypt the S3 bucket. Configure the S3 bucket policy to grant write access to the application IAM roles, and update the CMK key policy in the Central-Compliance account to allow the application IAM roles to perform kms:GenerateDataKey and kms:Decrypt operations.

Cevap

Enable resource sharing within AWS Organizations, share the subnets via AWS Resource Access Manager (RAM), use a Customer Managed Key (CMK) for encryption, and configure both the S3 bucket policy and the CMK key policy to allow cross-account access for the application IAM roles.

The correct strategy uses AWS RAM to share the VPC subnets from the Network account to the Business-Unit accounts, avoiding additional NAT Gateway costs. It relies on a Customer Managed Key (CMK) rather than an AWS-managed KMS key since CMK policies can be modified to grant cross-account access. Finally, it explicitly grants the required S3 and KMS permissions via the S3 bucket policy and KMS key policy respectively to the application IAM roles.

Adım Adım Çözüm

Enable resource sharing at the AWS Organizations level and use AWS RAM in the Shared-Network account to share the VPC subnets with the Business-Unit accounts.

The application instances can be launched in the shared subnets, utilizing the existing NAT Gateways in the Shared-Network VPC, thereby avoiding duplicate NAT Gateway deployment costs.

This establishes the shared networking topology according to the organization's cost optimization goals.

Create a Customer Managed Key (CMK) in the Central-Compliance account instead of relying on the AWS-managed key.

A key is provisioned whose policy can be edited to delegate permissions to principals in other AWS accounts.

AWS-managed keys (aws/s3) cannot be shared or configured with custom resource policies to allow cross-account operations.

Configure the S3 bucket policy in the Central-Compliance account to allow s3:PutObject actions from the application IAM roles in the Business-Unit accounts.

The application workloads obtain resource-side permission to write to the centralized bucket.

Cross-account S3 writes require explicit permission in the destination bucket's policy.

Configure the CMK key policy in the Central-Compliance account to allow the application IAM roles to perform kms:GenerateDataKey and kms:Decrypt.

The application instances can successfully request a data key from KMS to encrypt the log objects before uploading them to S3.

Since the bucket is encrypted using a Customer Managed KMS Key, write operations require kms:GenerateDataKey permissions on the key.

Anahtar Kavram

Cross-account resource sharing and access control using AWS RAM, S3 bucket policies, and Customer Managed KMS Keys.

Tahmini Süre:2m 0s

Soru 279Soru →

A retail company is designing a new multi-region web application across two AWS Regions: us-east-1 (primary) and us-west-2 (secondary) to host its e-commerce portal. To maintain high availability, the architecture must support a recovery time objective (RTO) of less than 15 minutes and a recovery point objective (RPO) of less than 1 minute. Users must be routed to the closest Region to minimize latency. Additionally, backend instances in private subnets must connect to external payment gateways on the internet with maximum availability and no single point of failure in any Availability Zone. Which two actions should the solutions architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure Amazon Route 53 latency-based routing with active-active failover by associating the latency records for both Regions with Route 53 health checks that monitor the Application Load Balancers.

Deploy a NAT Gateway in each Availability Zone in both Regions, and configure the private subnet route tables to route outbound internet traffic through the local NAT Gateway in their respective zones.

Deploy a single NAT Gateway in one Availability Zone in each Region, and configure the route tables of all private subnets across all Availability Zones in that Region to route outbound internet traffic through this single NAT Gateway.

Configure Route 53 latency-based routing to the Application Load Balancers, but disable the evaluate target health setting on the records to prevent DNS routing changes during transient health check failures.

Configure Amazon Aurora PostgreSQL with a cross-Region Read Replica in the secondary Region, and set up a custom AWS Lambda function to capture daily EBS snapshots of the database to meet the 1-minute RPO.

Configure a Route 53 Private Hosted Zone for internal API resolution and associate it only with the VPC in us-east-1, relying on active transit gateways for automatic DNS propagation to the secondary Region.

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Route 53 latency-based routing with active-active failover by associating the latency records for both Regions with Route 53 health checks that monitor the Application Load Balancers.; Deploy a NAT Gateway in each Availability Zone in both Regions, and configure the private subnet route tables to route outbound internet traffic through the local NAT Gateway in their respective zones.

Cevap

Configure Amazon Route 53 latency-based routing with active-active failover using health checks for regional ALBs, and deploy zone-redundant NAT Gateways in each Availability Zone in both Regions for high availability.

To satisfy the low latency and active-active failover requirements, Route 53 latency-based routing must be paired with health checks. This ensures that users are directed to the nearest healthy Region and automatically rerouted during an outage, maintaining the RTO of under 15 minutes. To prevent outbound network single points of failure, a dedicated NAT Gateway must be configured in each Availability Zone where backend instances reside.

Adım Adım Çözüm

Evaluate the routing requirement for low latency and high availability.

Determine that Amazon Route 53 latency-based routing with health checks enabled is required to send traffic to the nearest healthy Region and automatically fail over.

This configuration meets the active-active multi-region requirement and satisfies the recovery time objective (RTO) under 15 minutes.

Evaluate the outbound connectivity requirements for high availability.

Determine that deploying a NAT Gateway in each Availability Zone within each Region is necessary to prevent a single point of failure.

If a single NAT Gateway is deployed per Region, an Availability Zone outage affecting that gateway would break outbound internet connectivity for instances in all other zones.

Analyze the data recovery objective constraints.

Identify that daily snapshots fail to meet the RPO of less than 1 minute, requiring continuous replication methods instead.

This rules out solutions that rely on manual or daily snapshot processes.

Anahtar Kavram

Designing high availability and disaster recovery architectures with multi-region routing policies and redundant networking paths.

Soru 280Soru →

An organization is designing a multi-region disaster recovery and high availability architecture for a critical web application. The primary region is us-east-1, and the secondary region is us-west-2. The application's database layer uses an Amazon Aurora PostgreSQL cluster. The business specifies a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. Additionally, outbound internet connectivity from the private application subnets in both regions must remain highly available, ensuring that an outage in a single Availability Zone does not impact outbound traffic from other zones. Which combination of actions should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and promote the secondary cluster if the primary region experiences an outage.

Deploy a NAT Gateway in each Availability Zone in both regions, and configure private subnet route tables to direct outbound internet traffic to the NAT Gateway in the same Availability Zone.

Implement daily AWS Backup copy jobs to replicate database snapshots from us-east-1 to us-west-2, and restore the database to a new instance during a failover event.

Deploy a single NAT Gateway in the primary Availability Zone of each region, and point the route tables of all private subnets across all Availability Zones to this NAT Gateway.

Create an Amazon Route 53 private hosted zone for internal domain name resolution, but associate it only with the primary region's VPC, relying on Transit Gateway to route DNS queries from the secondary region's VPC.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and promote the secondary cluster if the primary region experiences an outage.; Deploy a NAT Gateway in each Availability Zone in both regions, and configure private subnet route tables to direct outbound internet traffic to the NAT Gateway in the same Availability Zone.

Cevap

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2, and deploy a NAT Gateway in each Availability Zone in both regions.

The correct actions are promoting a secondary cluster in an Amazon Aurora Global Database and deploying a NAT Gateway in each Availability Zone. Amazon Aurora Global Database supports cross-region replication with latency of less than 1 second, fulfilling the 5-minute RPO. Promoted secondary clusters become read-write capable within minutes, satisfying the 15-minute RTO. Additionally, provisioning a NAT Gateway in every Availability Zone ensuring traffic routes to the local zone's gateway guarantees that outbound connectivity is not lost across the region if one Availability Zone suffers an outage.

Adım Adım Çözüm

Select a database replication strategy that supports near-zero RPO and low-latency failover.

Amazon Aurora Global Database provides replication latency under 1 second and quick promotion of secondary regions, fitting the 5-minute RPO and 15-minute RTO constraints.

Traditional daily backups or snapshot replication cannot guarantee a 5-minute RPO or a sub-15 minute recovery timeframe.

Ensure outbound connectivity in the private subnets is highly available across multiple Availability Zones.

A NAT Gateway must be provisioned in each Availability Zone, and private routing tables configured to direct outbound traffic to the local zone's NAT Gateway.

Deploying a single NAT Gateway per region creates a single point of failure, meaning an outage in that specific zone would disable outbound internet access for all other zones.

Anahtar Kavram

Multi-region disaster recovery with Aurora Global Database and high availability routing via redundant NAT Gateways across Availability Zones.

ÖncekiSayfa 14 / 99Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram