Tüm alıştırma soruları

A company is designing a deployment strategy for a containerized microservice running on Amazon ECS with AWS Fargate. The infrastructure is managed using AWS CloudFormation. The microservice must meet the following requirements:

* The deployment process must be automated and roll back the service to the previous stable state if the new container version fails to launch or fails container health checks.
* The deployment must not require external deployment tools like AWS CodeDeploy.
* The service must maintain its desired capacity to handle traffic with no reduction in the number of running tasks during the update.
* The deployment must minimize cost by ensuring that no more than $50\%$ additional tasks are running at any point during the rolling update.

Which configuration should the Solutions Architect specify in the CloudFormation template to meet these requirements?

A global payment processing company is designing a real-time fraud detection platform. The system must ingest credit card transaction events from merchant terminals worldwide, processing a baseline of $200,000$ write requests per second. During promotional sales, traffic instantly surges to $3\text{ million}$ write requests per second. The application must analyze each transaction against historical user profiles stored in a backend database with sub-$10$-millisecond latency. High-volume read queries for these profiles must scale dynamically to handle concurrent validation checks. Which architecture meets these scalability and performance requirements while minimizing operational overhead?

A medical research organization, Aegis Health Group, is designing a secure cross-account data sharing solution. A research application running on Amazon EC2 instances under an IAM role in Account A needs to read sensitive clinical trial datasets stored in an Amazon S3 bucket located in Account B. The S3 bucket is encrypted using a Customer Managed Key (CMK) generated in AWS KMS within Account B. The architecture must enforce the principle of least privilege and comply with healthcare data protection standards. Which combination of configuration steps is required to successfully establish this cross-account access? (Select TWO.)

A financial technology company is designing a secure compliance monitoring solution for credit card transaction logs. The logs are generated by applications running on Amazon ECS tasks in a Production account (Account 111122223333). These logs must be stored in an Amazon S3 bucket located in a dedicated Compliance account (Account 444455556666). The compliance team requires that:

1. All logs must be encrypted at rest using a customer managed key (CMK) in AWS KMS that the compliance team controls and rotates.
2. Production application tasks must have permission to write logs directly to the S3 bucket and use the KMS key, but must not be able to read or delete any logs once written.
3. The S3 bucket policy must enforce that only encrypted logs are accepted, and all uploaded log objects must be owned by the Compliance account.

Which combination of actions should the solutions architect take to meet these security and compliance requirements? (Select TWO.)

A logistics company is modernizing its package tracking update microservice by refactoring it to a serverless architecture. The new design uses Amazon API Gateway and AWS Lambda to write tracking updates to a shared Amazon Aurora PostgreSQL database that serves multiple other critical company applications. During load testing, the backend database experiences connection exhaustion, and the API Gateway begins returning 429 Too Many Requests errors because the tracking function consumes the entire regional Lambda execution limit, impacting other serverless applications. Which of the following architectural modifications best resolves both the database connection exhaustion and the regional Lambda execution throttling?

An organization is designing a high-volume financial transaction platform (OLTP workload). The platform requires a relational database that can support up to 50,000 read requests per second and 10,000 write requests per second. The system must maintain a Recovery Point Objective (RPO) of 0 (no data loss) and a Recovery Time Objective (RTO) of less than 30 seconds during an Availability Zone outage. The database must encrypt all data at rest, and the security team in Account A must centrally manage the encryption keys and audit key usage for database instances deployed in Account B.

Which database and storage configuration meets these requirements?

CareSync Technologies is deploying a new telemedicine application. The application's core processing engine runs on Amazon ECS in the Application account (Account $111111111111$). The engine must write and read patient record files in an Amazon S3 bucket located in the Data account (Account $222222222222$). To comply with regulatory requirements, all stored data must be encrypted at rest. The security team has established the following constraints:
- All S3 objects must be encrypted using a Customer Managed Key (CMK) stored in Account $222222222222$.
- The ECS tasks in Account $111111111111$ must be able to upload and download objects to and from the S3 bucket.
- Access control lists (ACLs) must be completely disabled on the bucket, and the Data account must automatically own all uploaded objects.

Which combination of configurations will meet these requirements? (Select TWO.)

A financial service provider is designing a new compliance auditing application. The application runs on Amazon EC2 instances inside a private VPC in a Production Account. The application retrieves database credentials from AWS Secrets Manager to decrypt transaction logs. To meet regulatory compliance, the Solutions Architect must implement the following controls:
1. Prevent data exfiltration by ensuring that requests to AWS Secrets Manager from the private VPC can only access Secrets Manager secrets belonging to the company's AWS Organization.
2. Restrict access to the secrets so that only requests originating from the private VPC's endpoint are permitted, blocking any public internet access.
3. Encrypt the secrets at rest using a custom key that allows secure cross-account decryption by auditors in a separate Audit Account.

Which TWO configurations must the Solutions Architect implement to meet these security requirements? (Select TWO.)

A media company is designing a new platform to store user-uploaded video files and track viewing metadata. The platform requires:
- Storage for video files (averaging 20 MB each) with 99.999999999% durability, replicated to a secondary AWS region with an RTO of 10 minutes and an RPO of 1 minute.
- A metadata database that supports millisecond query latency, has a flexible schema, and replicates across regions to support global low-latency reads.
- Data encryption at rest using AWS KMS Customer Managed Keys that can be shared with a centralized auditing account in another AWS account.

Which two database and storage design choices should the solutions architect select to meet these requirements?

A solutions architect is planning a heterogeneous database migration from an on-premises Microsoft SQL Server database to an Amazon Aurora PostgreSQL DB cluster. The migration strategy must minimize downtime by using continuous replication. Which of the following actions must the solutions architect perform to successfully convert the schema and support continuous replication? (Select two.)

A company is implementing federated access to multiple AWS accounts within an AWS Organization using a third-party SAML 2.0 compliant corporate Identity Provider (IdP). Employees must be able to log in to the AWS Management Console using their corporate credentials and assume specific roles based on their Active Directory group memberships. Which of the following configurations are required to establish this federation and trust relationship? (Select TWO.)

A company is configuring federated single sign-on (SSO) to multiple target AWS accounts using an on-premises SAML 2.0 Identity Provider (IdP). To enable corporate users to authenticate and access the target accounts, an administrator must create IAM roles in each target account. Which action must be included in the trust policy of these IAM roles to allow users to assume them via the SAML Identity Provider?

A software development company is setting up federated access for its development teams to access multiple AWS accounts within an AWS Organization. The developer identities are managed in an external OpenID Connect (OIDC) compliant identity provider. A Solutions Architect registers the OIDC provider as an IAM Identity Provider in each target member account and creates an IAM role named DeveloperRole in those accounts with appropriate permissions. However, when developers attempt to authenticate using the OIDC provider and assume the DeveloperRole, the requests fail. Upon reviewing the configurations, the architect finds that the IAM roles cannot be assumed via OIDC. Which of the following is the most likely configuration error causing this issue?

An enterprise is implementing a multi-account strategy using AWS Organizations. The security team has attached a Service Control Policy (SCP) to a production Organizational Unit (OU) that explicitly denies the s3:DeleteBucket action. A developer operating within a member account under this OU has been assigned an IAM policy granting administrator access (*:*), but finds they are blocked from deleting any S3 buckets in their account. Which of the following statements correctly explains why the developer cannot delete S3 buckets?

A financial services company is establishing a multi-account, multi-region AWS environment. In the primary Region (`us-east-1`), they have deployed a central AWS Transit Gateway (TGW) to interconnect $15$ spoke VPCs. To connect their main on-premises data center to AWS, they deploy a $10\text{ Gbps}$ AWS Direct Connect (DX) connection terminating at a Direct Connect Gateway (DXGW) associated with the TGW. For high availability, they also configure an IPsec AWS Site-to-Site VPN terminating directly on the same TGW as a backup. The network team requires symmetric routing: all traffic between AWS and the on-premises data center must utilize the DX connection during normal operation, failing over to the VPN only if the DX link becomes unavailable. The on-premises network uses the prefix $10.0.0.0/8$, which must be reachable from AWS, and on-premises systems must reach resources in the AWS VPCs. The solution must minimize administrative overhead and rely on dynamic routing protocols where possible. Which TWO configurations will achieve this routing policy while preventing asymmetric traffic flows? (Select TWO.)

An enterprise is migrating its workforce identity management to a centralized model and needs to establish single sign-on (SSO) access for internal engineers. The engineers must be able to log into multiple AWS member accounts within their AWS Organization using their existing Active Directory credentials via a SAML 2.0 compliant Identity Provider (IdP). Which of the following configuration steps are required in the target member accounts to enable this federation? (Select TWO.)

A retail company is migrating to a multi-account AWS environment managed by AWS Organizations. The company wants to federate its on-premises Active Directory using a SAML 2.0 compliant Identity Provider (IdP) to allow administrators to access the AWS Management Console. The administrators must be able to assume a target role named SysAdminRole in various member accounts. Which of the following actions must the solutions architect take to configure the trust relationship for the federated role?

An enterprise manages its multi-account environment using AWS Organizations. The cloud architecture team is implementing a centralized networking and cost management strategy with the following requirements:
- A Transit Gateway created in a dedicated Network account must be shared with all member accounts in the organization to enable hybrid connectivity. The sharing process must be automated, avoiding manual resource share invitations.
- The company has purchased Savings Plans to lower costs for its workloads running on AWS Fargate and AWS Lambda.
- The discounts from these Savings Plans must be prioritized for production accounts, meaning dev/test accounts must be excluded from automatically absorbing these discounts.

Which TWO actions should the solutions architect take to meet these requirements?

A company is setting up federated single sign-on (SSO) using a SAML 2.0 compliant corporate identity provider (IdP). They have already created the SAML identity provider entity in AWS IAM. To allow corporate users to federate into the AWS account, they need to create an IAM role. What must be configured in the trust policy of this IAM role to allow successful federation?

A global energy enterprise is migrating its smart grid monitoring system to a multi-account AWS environment managed under AWS Organizations. The architecture consists of a central Shared Services VPC (10.10.0.0/16) connected to an on-premises datacenter (172.16.0.0/12) via AWS Direct Connect and AWS Transit Gateway. Multiple spoke VPCs in production accounts (using the range 10.50.0.0/16) are attached to the same Transit Gateway. A Route 53 Private Hosted Zone (PHZ) for grid.internal is created in the Shared Services account. The on-premises DNS servers (172.16.1.10 and 172.16.1.11) host the zone corp.internal. Spoke VPC instances must resolve domains in both grid.internal and corp.internal, and on-premises hosts must resolve domains in grid.internal. Which combination of actions should the Solutions Architect take to implement this DNS architecture? (Select TWO.)