Tüm alıştırma soruları

A company is designing a deployment pipeline using AWS CloudFormation to update a stateless API application running on Amazon EC2 instances. The instances are managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The update process must guarantee zero downtime. The new version of the API must be fully validated using synthetic test traffic in the production environment before receiving any live production traffic. If validation fails, the deployment must immediately revert to the previous version without configuration changes or downtime. Which deployment strategy should the solutions architect recommend to meet these requirements?

A media streaming company manages a multi-account environment containing $60$ AWS accounts under a single AWS Organization. The security operations team requires all VPC Flow Logs from all member accounts to be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) to satisfy compliance guidelines. The solution must minimize administrative overhead and enforce least privilege.

Which TWO configurations must a Solutions Architect implement to achieve this goal?

An enterprise is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of $30$ spoke VPCs spread across two AWS Regions: `us-east-1` and `us-west-2`. The VPCs are connected using an AWS Transit Gateway (TGW) in each region. The on-premises data center must connect to AWS with high availability and optimal performance.

The primary path is a $10$ Gbps AWS Direct Connect (DX) connection using a Transit Virtual Interface (Transit VIF) terminated at a Direct Connect Gateway (DXGW) associated with both TGWs. A backup path is established using an AWS Site-to-Site VPN connection over the internet, terminating directly on the TGWs.

During failover testing, the network team observes that traffic originating from the on-premises data center to the AWS spoke VPCs is being load-balanced across both the DX and VPN paths, causing asymmetric routing. Furthermore, outbound traffic from the AWS spoke VPCs to the on-premises network ($10.0.0.0/8$) is preferring the VPN path because the on-premises router is advertising $10.0.0.0/8$ over the DX connection and more specific subnets ($10.0.0.0/16$ and $10.1.0.0/16$) over the VPN connection.

Which combination of routing configurations will resolve these routing issues and ensure that the DX connection is prioritized for bi-directional traffic, while maintaining the VPN as a dynamic failover?

An international media broadcasting company is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of 50 spoke VPCs in a single AWS Region, which host various parts of a media processing pipeline. The company needs to establish a highly available, transitive connection between all VPCs and two on-premises sites: a primary production facility and a backup recovery center. The primary path must run over a 10 Gbps AWS Direct Connect connection. The backup path must use an IPsec VPN over the internet. The solution must minimize routing configuration complexity, automatically fail over to the backup path if the primary path is unavailable, and allow direct VPC-to-VPC communication. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

A financial services company is designing a hybrid network architecture to connect $15$ spoke VPCs in a single AWS Region to its on-premises data center. The company has a dedicated $10\text{ Gbps}$ AWS Direct Connect connection and wants to establish an AWS Site-to-Site VPN connection over the public internet as a backup. The architecture must ensure that all spoke VPCs can communicate with the data center, that the VPN is only utilized if the Direct Connect connection becomes unavailable, and that administrative overhead is minimized. Which approach should the solutions architect recommend?

A technology enterprise is designing a centralized monitoring and auditing solution for its AWS Organization, which contains $40$ member accounts. The security team requires that VPC Flow Logs from all VPCs across all member accounts be consolidated into a single Amazon S3 bucket located in a dedicated Monitoring account. The logs must be encrypted at rest using an AWS KMS key, and the transmission of logs must be secure and isolated to the organization. Which TWO configurations are required to establish this centralized log delivery architecture?

An enterprise is designing a hybrid network architecture to connect $30$ spoke VPCs in a single AWS Region to its on-premises data center. The primary connectivity must be established over a $10\text{ Gbps}$ AWS Direct Connect connection, with a backup AWS Site-to-Site VPN connection over the public internet. All outbound internet traffic from the spoke VPCs must be routed through a centralized egress VPC for security inspection. The solution must minimize routing complexity, avoid single points of failure, and support transitive routing between the VPCs.

Which of the following configuration steps should the Solutions Architect implement to meet these requirements? (Select TWO.)

A company is developing a new regulatory reporting system. The application runs on Amazon ECS tasks in an Application account (Account ID: 123456789012). The system must write weekly reports to an Amazon S3 bucket located in a dedicated Compliance account (Account ID: 987654321098). The reports must be encrypted at rest using AWS KMS. The compliance team requires that the encryption key's access policy is managed under the Compliance account, and only the reporting application is authorized to perform encryption operations. Which design should a Solutions Architect recommend to meet these requirements securely?

A company is designing the deployment pipeline for a new web application. The application will run on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer (ALB). The infrastructure is provisioned using AWS CloudFormation. The team requires a deployment strategy that can route exactly $10\%$ of user traffic to the new version for testing. If any errors are detected, the deployment must immediately roll back all traffic to the old version. If the deployment is successful, all traffic must be shifted to the new version. The strategy must minimize both the time to roll back and the cost of keeping duplicate environments running after the deployment is complete.

Which deployment strategy meets these requirements?

A software-as-a-service (SaaS) provider manages $50$ AWS accounts using AWS Organizations. The security team is setting up an organization-wide trail in AWS CloudTrail to consolidate log delivery into a centralized Amazon S3 bucket in a dedicated Logging account. They require all consolidated logs to be encrypted at rest using an AWS Key Management Service (AWS KMS) key.

Which configuration is required to successfully deliver the encrypted logs from all accounts to the centralized S3 bucket?

An organization has a multi-account AWS environment with $25$ VPCs deployed across two AWS Regions: `us-east-1` and `us-west-2`. The organization has established a hybrid network using two $10\text{ Gbps}$ AWS Direct Connect connections terminating at separate DX locations. To ensure resiliency, they want to configure a backup path using a Site-to-Site VPN over the internet. The Direct Connect connections terminate at an AWS Direct Connect Gateway associated with AWS Transit Gateways in each region. Under normal operating conditions, all hybrid traffic must use the Direct Connect connections. The Site-to-Site VPN should only be used if both Direct Connect connections fail. Which two routing configurations must the solutions architect implement on the on-premises router and within AWS to achieve this dynamic failover behavior?

An enterprise is designing a deployment pipeline for a legacy Java application hosted on Amazon EC2 instances within an Auto Scaling group behind an Application Load Balancer. The deployment must achieve zero downtime and allow for a 1-hour verification window where the old version remains active but receives no traffic, enabling rapid rollback if issues are detected. If the validation succeeds, the old instances must be automatically terminated. The deployment process must be fully managed with minimal custom configuration. Which two configurations should the Solutions Architect include in the AWS CodeDeploy deployment group to meet these requirements? (Select two.)

An enterprise is designing a hybrid network architecture to connect `$45$` spoke VPCs in the `us-east-1` Region to its on-premises corporate data center. The architecture must support a high-throughput primary path and a redundant backup path. The enterprise has provisioned a `$10\text{ Gbps}$` AWS Direct Connect connection and wants to use an IPsec Site-to-Site VPN over the public internet as the backup. The design must ensure that the Direct Connect connection is the preferred path for all bidirectional traffic under normal operating conditions, failover to the VPN is automatic, routing is symmetric to support stateful firewalls on-premises, and administrative overhead is minimized. Which architecture and routing configuration will meet these requirements?

An enterprise is designing a deployment pipeline for a critical transaction-processing application. The application runs on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The infrastructure is defined and managed using AWS CloudFormation. The application processes long-running database transactions that can take up to $12$ minutes to complete; interrupting these transactions results in data corruption. The deployment strategy must meet the following requirements:

1. Roll out updates with zero downtime.
2. Ensure that instances are never terminated while processing active transactions.
3. Automatically roll back the CloudFormation stack to the previous version if new instances fail to initialize or fail application-level health checks.
4. Minimize additional compute costs by avoiding the pre-allocation of a duplicate Auto Scaling group during the deployment.

Which configuration strategy should the Solutions Architect implement to meet these requirements?

An e-commerce company is migrating its order processing service to a containerized application running on Amazon ECS with AWS Fargate, fronted by an Application Load Balancer (ALB). The service is highly sensitive to downtime, and any deployment must ensure zero downtime. Additionally, the development team wants to test new releases under production load by routing $10\%$ of the traffic to the new version for a $15$-minute observation period. If the new version triggers any CloudWatch alarms for $5\text{xx}$ errors or high latency during this period, the deployment must automatically roll back. Which deployment strategy should the Solutions Architect design to satisfy these requirements?

A research organization is designing a genomic data processing platform. The processing applications run on Amazon EC2 instances in a dedicated Computation Account (Account A). The raw genome sequencing output files must be written directly to an Amazon S3 bucket located in a central Data Archive Account (Account B).

The organization's security policy requires:
- All data stored in the S3 bucket must be encrypted at rest using SSE-KMS with a Customer Managed Key (CMK) managed by the Data Archive Account (Account B).
- The Data Archive Account must maintain full ownership of all uploaded objects, and access control lists (ACLs) must be completely disabled.
- The EC2 instances in Account A must have the minimum necessary permissions to perform the uploads.

Which combination of configuration steps will meet these security requirements?

A multinational financial enterprise is building a regulatory reporting data pipeline. The application tier runs on Amazon EC2 instances in an Application Account (Account A: $111122223333$). The reporting logs must be delivered to an Amazon S3 bucket in a Centralized Security Account (Account B: $444455556666$). The compliance requirements mandate that all logs must be encrypted at rest using a Key Management Service (KMS) key, and the Centralized Security Account must have full ownership of all uploaded objects to prevent access delegation issues. The application tier must only have permissions to write objects and must not be allowed to decrypt the logs once written. Which combination of actions must the solutions architect take to meet these security requirements? (Select TWO.)

A healthcare provider is designing a new digital medical imaging archive and diagnostic report system. The system must store structured patient metadata logs (OLTP workload) and unstructured medical images in DICOM format (Object storage). The metadata database must support high-volume write transactions and scale read traffic to handle sudden spikes from hospital clients. The disaster recovery requirements demand a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $1$ minute. Additionally, for regulatory compliance, the medical images must be securely archived and replicated to a destination bucket in a secondary, isolated AWS account in a different AWS region, encrypted at rest using AWS KMS. Which of the following database and storage configurations should the solutions architect choose to meet these requirements? (Select TWO.)

A global online retailer is launching a flash sale platform for limited-edition merchandise drops. The system expects sudden, extreme traffic surges where active users scale from $5,000$ to over $1,500,000$ within $60\text{ seconds}$ at the start of a sale. The current architecture consists of an Application Load Balancer (ALB), an Amazon ECS on AWS Fargate service, and an Amazon Aurora PostgreSQL database cluster. During testing, the sudden influx of connection requests led to HTTP $503$ Service Unavailable errors from the ALB, and database write latency spiked, causing the Fargate tasks to exhaust their connection pools. Which combination of architectural optimizations will best resolve these performance and scalability issues? (Select TWO)

A financial technology corporation is modernizing its legacy on-premises payment settlement API by migrating it to a serverless architecture on AWS. The solution must expose a private API to consumer applications deployed across multiple AWS accounts within the same AWS Organization. The architecture must satisfy the following requirements:
- All API communication must remain strictly within the AWS network.
- Cross-account consumers must authenticate using custom tokens verified by a central security account, which signs payloads using a custom AWS KMS key.
- The backend AWS Lambda functions must access a relational database securely.
- A sudden volume spike in a secondary, non-critical reporting API must not throttle or exhaust the execution capacity of the critical payment settlement API.
- The outbound traffic from the VPC-integrated Lambda functions to external verification endpoints must be highly resilient against Availability Zone failures.

Which of the following architectures meets these requirements while adhering to AWS best practices?