Tüm alıştırma soruları

An enterprise is planning to establish a secure multi-account structure using AWS Organizations. The solutions architect needs to set up a new organizational structure with Service Control Policies (SCPs) to restrict unauthorized services before any member accounts begin deploying workloads. Arrange the steps in the correct order to implement this multi-account governance structure safely.

A Solutions Architect is configuring federated access to the AWS Management Console for enterprise users using an on-premises SAML 2.0 compliant Identity Provider (IdP). Which of the following configuration steps are required in AWS IAM to successfully establish this trust relationship and allow users to assume their federated roles? (Select TWO.)

A company is designing a hybrid network architecture to connect ten VPCs in the us-east-1 region to an on-premises data center. To reduce administrative overhead, the company wants to avoid establishing individual VPN connections or VPC peering connections between all VPCs and the on-premises environment. Additionally, the design must support communication between the VPCs themselves.

Which two AWS networking components should the solutions architect combine to meet these requirements? (Select TWO.)

A financial services company is implementing a centralized identity strategy for its AWS multi-account environment managed by AWS Organizations. The company uses an on-premises SAML 2.0 compliant Identity Provider (IdP) for user authentication. The security team wants to minimize administrative overhead by avoiding the creation of SAML Identity Provider resources in every member account. Instead, they want to establish trust in a single, centralized 'Identity' account, allowing authenticated corporate users to assume specific operations roles in various member accounts.

Which configuration steps must be performed to establish this identity flow while adhering to the security team's constraints? (Select TWO.)

An enterprise is planning to migrate its workloads to AWS and has deployed 8 VPCs across two AWS accounts in the eu-west-1 region. The company requires a hybrid network design to connect these VPCs to its corporate office. The primary connection must be a 1 Gbps AWS Direct Connect connection, with a backup IPsec VPN connection over the internet. The solution must allow all VPCs to communicate with each other and with the corporate office, while minimizing configuration and routing management overhead. Which two options should the solutions architect select to meet these requirements? (Select TWO.)

An enterprise is designing a secure multi-account AWS environment using AWS Organizations. The solutions architect needs to establish AWS Control Tower to govern the landing zone, apply baseline compliance controls, and deploy custom CloudFormation templates across all member accounts. Arrange the following steps in the correct chronological order to implement this multi-account governance solution.

A retail-tech enterprise has structured its multi-account environment using AWS Organizations. The network topology includes a central network account (Account A) containing a Shared Services VPC (`Shared-VPC`), which is connected to an on-premises network via AWS Transit Gateway (TGW) and AWS Direct Connect. Account B contains `Core-VPC` and hosts a Route 53 Private Hosted Zone (PHZ) named `core.aws.internal`. Account C contains `App-VPC`. The enterprise requires a hybrid DNS resolution strategy:

1. On-premises client machines must resolve resources in `core.aws.internal` via the Active Directory DNS servers ($10.50.0.10$ and $10.50.0.11$).
2. EC2 instances in `Core-VPC` and `App-VPC` must resolve on-premises services in the `.corp.local` domain.

Which actions must a Solutions Architect take to implement this architecture while minimizing administrative overhead? (Select TWO.)

An international logistics enterprise manages its multi-account AWS environment using AWS Organizations. A central Shared Services VPC in Account A hosts shared utilities and is connected to the on-premises data center via AWS Direct Connect and an AWS Transit Gateway. A Private Hosted Zone (PHZ) for ops.infra is created in Account A. Application VPCs in Account B need to resolve resources in the ops.infra domain and also resolve hostnames in the on-premises domain corp.local. Which TWO configurations are required to meet these DNS resolution requirements? (Select TWO.)

A solutions architect needs to share a Transit Gateway from a production AWS account with an external partner's AWS account that is not part of the company's AWS Organization. Which of the following approaches is required to successfully share this resource using AWS Resource Access Manager (RAM)?

A solutions architect is designing a hybrid network architecture where multiple spoke VPCs in a single AWS Region need to access the internet through a centralized egress VPC using AWS Transit Gateway. To ensure high availability and prevent a single point of failure for outbound traffic, how should the NAT Gateways be deployed in the egress VPC?

A multinational enterprise is designing a hybrid network architecture to connect two corporate offices in London and Paris to a multi-account AWS environment. The AWS infrastructure consists of 40 spoke VPCs distributed across the eu-west-1 (Ireland) and eu-west-3 (Paris) Regions. The architecture must satisfy the following requirements:
- High availability: All VPCs in both Regions must have redundant hybrid connectivity to both offices.
- Path preference: Primary traffic must use AWS Direct Connect. An IPsec VPN over the public internet must serve as a failover path.
- Traffic localization: Under normal operations, traffic from the London office to eu-west-1 must flow through the London Direct Connect connection, and traffic from the Paris office to eu-west-3 must flow through the Paris Direct Connect connection. Cross-region hybrid routing should only occur during a link failure.
- Minimal administrative overhead for routing.

Which TWO options should the solutions architect select to meet these requirements?

An enterprise is designing a multi-account structure using AWS Organizations. The architecture includes a Production Organizational Unit (OU) containing several workload accounts, and a Shared Services OU. The security team has established the following requirements:

1. Workloads in the Production OU must be restricted to deploying resources only in the `eu-west-1` and `us-east-1` Regions, with exemptions for global services such as Amazon Route 53, AWS IAM, and Amazon CloudFront.
2. Local administrators in member accounts within the Production OU must be prevented from deleting or modifying a centralized administrative IAM role named `CentralAuditRole` that is deployed in all member accounts.
3. No member account within the organization must be permitted to leave the organization.
4. The solution must minimize administrative overhead and avoid complex per-account manual configurations.

Which approach should the solutions architect recommend to meet these requirements?

A company is setting up a new multi-account environment using AWS Organizations to host its workloads. The solutions architect needs to establish basic governance and security guardrails across all accounts while organizing the accounts based on their environments (production and development). Which two actions should the solutions architect take to meet these requirements?

A media streaming company manages a multi-account AWS environment connected to its on-premises data center via AWS Transit Gateway. The Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for `media.internal` associated with the Shared Services VPC. The company is deploying new application VPCs in separate member accounts. Resources in the application VPCs must resolve names in `media.internal` and also resolve domains hosted on-premises (`onprem.local`). How should a Solutions Architect design the DNS architecture to meet these requirements with the minimum administrative overhead?

A biopharmaceutical company is migrating its clinical trial management platform to a multi-account AWS environment managed under AWS Organizations. The environment consists of a central Network Account (Account A) hosting a shared services VPC, and two separate application accounts (Account B and Account C) hosting production application VPCs. The shared services VPC is connected to the on-premises corporate network via AWS Transit Gateway and an AWS Direct Connect connection. The on-premises DNS domain is `corp.local`. The application accounts host Route 53 Private Hosted Zones (PHZs) for `clinical.aws` (Account B) and `trials.aws` (Account C). The company requires that all VPCs and the on-premises network can resolve all internal domains. DNS queries must remain private and highly available. Which TWO actions should a Solutions Architect take to implement this hybrid DNS resolution architecture? (Select TWO.)

An enterprise manages a multi-account environment using AWS Organizations. The security team is configuring federated single sign-on (SSO) to target AWS accounts using an external, SAML 2.0-compliant corporate Identity Provider (IdP). The team has created a SAML provider entity named 'CorporateIdP' in the target member accounts. In the target member accounts, they also created an IAM role named 'ReadOnlyAuditor' to be assumed by the federated users. However, during the initial testing phase, users receive access denied errors immediately after authentication at the IdP portal when redirecting to the AWS console. The security team verifies that the corporate IdP is successfully generating SAML assertions containing the user's attributes. Which of the following configurations represents the correct setup to resolve this issue and establish federated access?

A financial services company is implementing a multi-account strategy using AWS Organizations. The organization contains three main Organizational Units (OUs): CoreServicesOU, SecurityOU, and WorkloadsOU. The WorkloadsOU has two child OUs: ProductionOU and DevelopmentOU.

The security team has the following requirements:
1. No IAM user or role within any member account in the WorkloadsOU should be able to delete or modify the configurations of an IAM role named SecurityComplianceRole.
2. Developers in the DevelopmentOU must be allowed to deploy and test new AWS services freely, but they must be restricted from launching Amazon EC2 instances of any type other than the t3 or m5 families.
3. The administration of resources within the SecurityOU must not be impacted by these policies.

Which combination of Service Control Policies (SCPs) and OU attachments will meet these requirements with the least operational overhead?

A financial services company is establishing a multi-account AWS environment. A central Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) for internal service discovery. A security policy requires that database workloads running in a separate Production account VPC must be able to resolve names within this central PHZ, without deploying duplicate hosted zones.

Which TWO steps are required to associate the central Private Hosted Zone with the VPC in the Production account? (Select TWO.)

A company manages its multi-account environment using AWS Organizations. The administration wants to consolidate billing to leverage volume discounts and share VPC subnets from a central network account to application accounts. Which of the following statements are correct regarding AWS consolidated billing and resource sharing? (Select TWO.)

A multi-national corporation uses AWS Organizations to manage a multi-account structure with hundreds of member accounts. The corporation uses an external SAML 2.0 compliant Identity Provider (IdP) for federating access to the AWS Management Console and AWS CLI. The security team has implemented a tagging standard where all IAM roles in member accounts must be tagged with a Department key indicating which team owns the role. To enforce strict security boundaries, the security team requires that federated users can only assume an IAM role if their department membership in the corporate directory (sent as a SAML attribute) matches the Department tag of the IAM role. Additionally, this matching policy must be enforced centrally such that member account administrators cannot bypass it or misconfigure their local roles to allow unauthorized cross-department access. Which configuration strategy will meet these requirements while allowing successful federation?