Tüm alıştırma soruları

A solutions architect is designing a centralized logging architecture for a company's AWS Organization. The company wants to enable an organization-wide AWS CloudTrail trail in the management account and deliver all log files to a centralized Amazon S3 bucket located in a dedicated Security account. The security team requires all log files to be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. Which of the following configurations are required to implement this architecture? (Select TWO.)

A global container logistics company is migrating its operations to AWS, establishing a multi-account structure managed under AWS Organizations. The network topology uses a Hub-and-Spoke model where a central Network VPC is connected to multiple spoke VPCs and to the company’s on-premises data centers via AWS Transit Gateway (TGW) and AWS Direct Connect. The on-premises DNS servers manage the `onprem.cargo.internal` domain. The spoke accounts host private hosted zones (PHZs) for their respective services, such as `booking.aws.cargo.internal` and `tracking.aws.cargo.internal`.

The solution must meet the following requirements:
- On-premises clients must be able to resolve records within the `aws.cargo.internal` domain.
- Instances in all spoke VPCs must resolve records within the `onprem.cargo.internal` domain.
- Spoke VPCs must be able to resolve records in each other’s PHZs.

Which TWO steps should a solutions architect take to implement this DNS architecture? (Select TWO.)

A multinational retail conglomerate manages its AWS environment using AWS Organizations. The organization contains a Security account under a CoreServices Organizational Unit (OU), and fifty member accounts under a Production OU. To satisfy strict industry regulatory standards, the corporate security team mandates that all new Amazon Elastic Block Store (EBS) volumes created within the Production OU must be encrypted using a specific customer managed key (CMK). The security team wants to manage the key centrally within the Security account to control key rotation and audit access logs from a single location. The solution must prevent member account users from creating unencrypted volumes or using their local AWS-managed keys, while allowing production workloads to auto-scale and launch instances without manual intervention from the security team. Which of the following strategies should a solutions architect implement to meet these requirements?

A company is launching a flash sale campaign where web traffic is expected to instantly spike from 100 requests per second to 150,000 requests per second. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). Which configuration should a Solutions Architect recommend to ensure the load balancer handles this sudden traffic surge without dropping initial requests?

An organization is designing a disaster recovery (DR) architecture for a non-critical internal HR portal. The application currently runs on Amazon EC2 instances behind an Application Load Balancer, with data stored in an Amazon RDS for MySQL database. The business requires a Recovery Point Objective (RPO) of 24 hours and a Recovery Time Objective (RTO) of 4 hours. The architecture must minimize ongoing running costs in the secondary DR region. Which TWO options should the Solutions Architect implement to meet these requirements?

An enterprise is establishing a multi-account governance framework using AWS Organizations. To comply with regulatory requirements, the solutions architect must enforce a Service Control Policy (SCP) that restricts resource provisioning to a subset of approved AWS Regions without disrupting essential global services or production workloads. Arrange the following steps in the correct order to design, test, and implement this governance control.

A solutions architect is designing a multi-account environment using AWS Organizations and AWS Control Tower for a large enterprise. The architecture must enforce custom guardrails, structure accounts into business-specific Organizational Units (OUs), and automatically deploy custom local network resources (such as VPCs and security groups) during account onboarding. The solutions architect decided to use AWS Control Tower Lifecycle Events linked to an Amazon EventBridge rule that triggers an AWS Lambda function for post-enrollment customization.

Arrange the steps in the correct chronological order to establish this governed environment and ensure all target accounts are automatically customized upon enrollment.

A company is configuring passwordless deployment pipelines from an external, OpenID Connect (OIDC)-compliant CI/CD platform to deploy application stacks across multiple member accounts in AWS Organizations. Each pipeline must be able to assume a deployment role in its respective target member account. Which of the following configurations are required to establish the trust relationship and enable this federated access? (Select TWO.)

An enterprise manages a multi-account AWS environment using AWS Organizations. The organization has set up AWS IAM Identity Center in a delegated administrator security account, integrated with Okta as the external identity provider (IdP) via SAML 2.0 and SCIM. The security team is implementing Attribute-Based Access Control (ABAC) to restrict access to sensitive Amazon S3 buckets located in a Shared Services account. Corporate users must only access buckets where the bucket's CostCenter tag matches their corporate cost center, which is stored in Okta as the costCenter profile attribute.

During testing, two issues are observed:
1. Users federated through AWS IAM Identity Center are denied access to the S3 buckets in the Shared Services account, despite having the correct costCenter value in Okta and matching tags on the S3 buckets.
2. A legacy third-party auditing tool that bypasses IAM Identity Center and federates directly via a custom IAM SAML identity provider in each member account fails to assume its target role, returning an 'Access Denied' error when attempting to pass the cost center as a session tag.

Which of the following actions must the Solutions Architect take to resolve these issues? (Select TWO.)

A company is configuring single sign-on access for its database administrators to manage resources in a dedicated database member account under AWS Organizations. The database administrators authenticate using a third-party SAML 2.0 Identity Provider (IdP). A Solutions Architect needs to set up the trust relationship in the database member account to allow these users to assume an IAM role named 'DB-Admin-Role'. Which two actions must the Solutions Architect take to configure this federated trust?

A multinational retail company manages its multi-account environment on AWS using AWS Organizations. The central infrastructure is hosted in a Shared Services account, while application workloads run in multiple Spoke accounts. The company recently acquired a regional retail chain that operates an on-premises data center with a local Active Directory domain (corp.acquired.internal). A Transit Gateway connects the central Shared Services VPC, the Spoke VPCs, and the on-premises network via a Direct Connect connection.

The solutions architect must implement a hybrid DNS resolution strategy with the following requirements:
1. Instances in the Spoke VPCs must be able to resolve resources in the corp.acquired.internal domain.
2. On-premises servers must be able to resolve resources in a Route 53 Private Hosted Zone (PHZ) named prod.enterprise.aws, which is hosted in the Shared Services account.

Which TWO configuration steps must the solutions architect perform to meet these requirements? (Select TWO.)

An enterprise has a multi-account AWS environment with $30$ spoke VPCs distributed across $2$ regions: `us-east-1` ($20$ VPCs) and `us-west-2` ($10$ VPCs). The enterprise needs to connect these VPCs to two on-premises locations: a primary data center in New York and a backup data center in San Francisco.

The primary data center in New York has a $10\text{ Gbps}$ AWS Direct Connect connection. The backup data center in San Francisco has an internet connection capable of establishing IPsec VPN tunnels. The network architecture must ensure:
- High availability: If the primary New York Direct Connect connection or New York data center fails, hybrid traffic must automatically fail over to the San Francisco VPN connection.
- Symmetric routing: Traffic from AWS to the on-premises network must prefer the New York Direct Connect path under normal operations.
- Scalability: The solution must minimize administrative overhead and avoid configuring individual connections to every spoke VPC.

Which TWO configuration steps must be implemented to meet these requirements?

An enterprise manages its multi-account environment using AWS Organizations. The environment consists of a Management account, a central Infrastructure account, a Security account, a Log Archive account, and three developer accounts ($Dev1$, $Dev2$, and $Dev3$).

A solutions architect must design a resource sharing, billing, and logging strategy that meets the following requirements:
* Subnets from a VPC in the Infrastructure account must be shared with the developer accounts to allow them to deploy EC2 instances.
* VPC Flow Logs for the shared subnets must be published to an Amazon S3 bucket in the Log Archive account. These logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) stored in the Security account.
* Compute Savings Plans purchased in the Management account must apply only to $Dev1$ and $Dev2$. The $Dev3$ account must be excluded from receiving these discounts to maintain standard On-Demand pricing for external client auditing.
* Developer accounts must be restricted from sharing their own resources with external accounts outside the organization using AWS Resource Access Manager (RAM).

Which combination of actions should the solutions architect recommend to meet these requirements?

A financial services company is designing a disaster recovery (DR) architecture for a critical web application. The primary environment runs in the `us-east-1` Region, and the DR environment will be deployed in the `us-west-2` Region. The business requirements specify a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 2 minutes. The architecture must be highly available and resilient to single-zone failures in both regions while keeping ongoing standby costs as low as possible. Which solution meets these requirements?

A technology company has a multi-account structure managed via AWS Organizations. The data engineering team in the Analytics account needs to run transient Amazon EMR clusters that access a centralized Amazon Aurora PostgreSQL database cluster situated in the Shared Services account. To comply with strict security requirements, the database must not be exposed to the public internet, and cross-account network traffic must avoid the data processing charges associated with Transit Gateway or VPC peering. The finance team requires that EMR compute costs are billed directly to the Analytics account, while the database storage and instance costs are billed to the Shared Services account. Which combination of actions will meet these requirements? (Select TWO.)

A web application is deployed on AWS Elastic Beanstalk. The development team wants to update the application using a strategy that maintains full serving capacity during the deployment. Additionally, if the deployment fails, the rollback must be immediate and avoid any modification to the original running instances. Which of the following deployment policies meet these requirements? (Select TWO.)

A multinational financial corporation is designing a secure, high-availability hybrid network topology across two AWS Regions: `us-east-1` and `us-west-2`. The organization has 60 spoke VPCs distributed across multiple AWS accounts. The primary data centers are in New York and London. The architecture must satisfy the following constraints:
1. Primary connectivity must use AWS Direct Connect (DX) via two $10\text{ Gbps}$ connections (one at a DX location near `us-east-1` and one near `us-west-2`).
2. High availability must be guaranteed via automated failover to backup Site-to-Site VPN connections over the public internet to each region. The VPN paths should only carry traffic if the local DX connection is down.
3. Spoke VPCs in both regions must be able to communicate with each other over the AWS network backbone.
4. Corporate users on-premises must be able to resolve private DNS names in an AWS Route 53 Private Hosted Zone (PHZ) hosted in a centralized Shared Services account. AWS resources must also resolve on-premises DNS records.
5. All outbound internet traffic from the spoke VPCs must be inspected by AWS Network Firewall in a centralized egress VPC in each region before routing to the internet, while avoiding single points of failure and minimizing inter-AZ data transfer costs.

Which architectural design and routing configuration meets these requirements?

A company has five AWS accounts, each containing a single VPC in the us-east-1 Region. The company needs to establish hybrid connectivity between all five VPCs and their on-premises data center. The solution must minimize administrative complexity and avoid managing a full mesh of connections. Which AWS networking component should the company use as a central hub to connect the VPCs and the on-premises network?

A media streaming company uses AWS Organizations to manage a multi-account environment. A central Shared Services VPC in the `Network` account contains Route 53 Resolver inbound and outbound endpoints, connected to the on-premises network via AWS Transit Gateway and AWS Direct Connect. A Private Hosted Zone (PHZ) for `media.internal` is hosted in the `Production` account. A new Development VPC has been created in the `Development` account. Developers in the `Development` account require resolution of hostnames in `media.internal` from the Development VPC. Additionally, servers in the on-premises datacenter must resolve hostnames in `media.internal`.

Which of the following architectures will allow both the Development VPC and the on-premises network to resolve hostnames in `media.internal` with the lowest latency and administrative overhead?

An organization is designing a deployment strategy for a critical, high-volume payment processing application hosted on AWS Fargate behind an Application Load Balancer (ALB). The backend database is an Amazon Aurora PostgreSQL cluster. A new release requires updating the Fargate task definition and applying a database schema modification that introduces a new column. The deployment must guarantee zero downtime, support automatic rollback within 5 minutes based on synthetic transaction errors, and ensure that if a rollback occurs, the database remains in a consistent state without losing any transaction data captured during the deployment window. Which deployment strategy meets these requirements with the least operational complexity?