Examkin

Tüm alıştırma soruları

1964 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 641Soru →

An application's database is deployed on a single Amazon RDS for MySQL Multi-AZ DB instance. Monitoring metrics indicate that high read latency during business hours is causing performance degradation, while write latency remains low. Which two actions should a solutions architect take to scale the database layer and improve query response times?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create Amazon RDS Read Replicas and update the application to route read traffic to the replica endpoints.; Deploy an Amazon ElastiCache cluster to store the results of common read queries.

Cevap

To scale the database layer for read-heavy workloads, a solutions architect should create Amazon RDS Read Replicas to offload read operations and deploy an Amazon ElastiCache cluster to cache frequently accessed query results.
The correct actions are implementing RDS Read Replicas and deploying ElastiCache. Creating RDS Read Replicas allows horizontal scaling of read operations by routing read traffic away from the primary database. Implementing an Amazon ElastiCache cluster caches frequent query results, reducing the round-trip latency to the database and saving DB CPU cycles.

Adım Adım Çözüm

1
Analyze the application performance metrics and workload characteristics.
Identify that the primary performance bottleneck is high read query latency, while write latency remains low, indicating a read-heavy workload.
Understanding the nature of the workload (read-heavy vs. write-heavy) determines the correct scaling strategy.
2
Evaluate potential scaling solutions for Amazon RDS read traffic.
Select read replicas to offload read traffic horizontally, and caching (ElastiCache) to store frequently accessed data in-memory.
RDS Read Replicas and ElastiCache are the standard, operationally efficient AWS patterns for scaling read operations on RDS MySQL.

Anahtar Kavram

Scaling read capacity for Amazon RDS databases using Read Replicas and caching.
Tahmini Süre:1m 0s
Soru 642Soru →

An enterprise is configuring identity federation using an on-premises SAML 2.0 Identity Provider (IdP) to allow database administrators to access multiple member accounts in AWS Organizations. The administrators must assume an IAM role named DB-Admin-Role in the target member accounts after authenticating. During initial testing, administrators receive an Access Denied error immediately when attempting to federate from the identity provider portal. A solutions architect reviews the trust policy configured for the DB-Admin-Role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456789012:saml-provider/ADFS-IdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

Which of the following modifications to the trust policy will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Change the Action in the trust policy from sts:AssumeRole to sts:AssumeRoleWithSAML.

Cevap

Change the Action in the trust policy from sts:AssumeRole to sts:AssumeRoleWithSAML.
The correct solution is to change the Action in the trust policy to sts:AssumeRoleWithSAML. When a federated user logs in via an enterprise SAML Identity Provider (IdP) portal, the browser receives a SAML assertion and sends it to the AWS SAML endpoint. AWS validates the assertion and calls the sts:AssumeRoleWithSAML API to obtain temporary credentials for the role. If the trust policy only permits sts:AssumeRole, the API call fails with an Access Denied error.

Adım Adım Çözüm

1
Analyze the IAM role trust policy and identify the federation mechanism.
The configuration uses a Federated principal pointing to a SAML provider, which indicates SAML 2.0 federation.
Recognizing the identity provider type dictates which STS API call must be allowed in the trust policy action.
2
Compare the configured STS action with the required action for SAML federation.
The policy currently uses sts:AssumeRole, which requires AWS principal authentication, whereas SAML federation requires sts:AssumeRoleWithSAML.
Exchanging a SAML assertion for temporary credentials requires calling the AssumeRoleWithSAML API endpoint.
3
Determine the correct modification to resolve the authentication error.
Change the Action to sts:AssumeRoleWithSAML.
This matches the API call made by the AWS Sign-In endpoint when users authenticate via the identity provider portal.

Anahtar Kavram

SAML 2.0 Identity Federation Trust Policies
Tahmini Süre:1m 30s
Soru 643Soru →

An enterprise manages its multi-account environment using AWS Organizations. The organization contains a parent Organizational Unit (OU) named Workloads, which has a child OU named Production. The security team wants to ensure that: 1. No member accounts in the Production OU can delete AWS CloudTrail trails or stop logging. 2. The security administration team, operating from a delegated administrator account for CloudTrail located under a separate Security OU, can still manage organization-level trails. An administrator attaches a Service Control Policy (SCP) to the Workloads OU that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions. Which of the following describes the impact of this policy configuration on the accounts?

Cevabı ve açıklamayı göster

Cevap: It restricts all IAM identities, including local administrators and the root user, within the Production OU member accounts from modifying CloudTrail, while leaving the delegated administrator account in the Security OU unaffected by the SCP.

Cevap

It restricts all IAM identities, including local administrators and the root user, within the Production OU member accounts from modifying CloudTrail, while leaving the delegated administrator account in the Security OU unaffected by the SCP.
The Service Control Policy (SCP) is attached to the Workloads OU, meaning it only applies to that branch of the organizational tree (including the Production OU). Because SCPs act as guardrails, they restrict all users in those accounts, including administrators and the root user. The delegated administrator account under the Security OU is outside this branch, so it remains unaffected by the SCP's deny actions.

Adım Adım Çözüm

1
Determine the scope of the Service Control Policy (SCP) attachment.
The SCP is attached to the Workloads OU, which means it applies to all accounts within the Workloads OU and its child OUs (such as the Production OU). It does not apply to the Security OU or the management account.
SCPs are inherited down the AWS Organizations hierarchy starting from the attachment point.
2
Evaluate the effect of the SCP on identities within the target accounts.
All IAM users, roles, and the account root user in the Production OU accounts are blocked from performing cloudtrail:StopLogging and cloudtrail:DeleteTrail.
SCPs act as filters that apply to all principals in a member account, including the root user and administrative roles.
3
Analyze the impact on the delegated administrator account.
Since the delegated administrator account resides under the Security OU, which is outside the Workloads OU path, it is not subject to the Workloads OU SCP constraints.
SCPs do not apply transitively to sibling OUs or accounts outside the branch of attachment.

Anahtar Kavram

AWS Organizations SCP Inheritance and Delegated Administrator Isolation
Soru 644Soru →

A financial services firm is migrating its transactional applications to a multi-account AWS environment managed via AWS Organizations. The architecture consists of a Shared Services VPC in a central infrastructure account and multiple spoke VPCs in separate member accounts, all interconnected via an AWS Transit Gateway. The firm also maintains an on-premises datacenter connected to the Transit Gateway via an AWS Direct Connect connection. A Private Hosted Zone (PHZ) for `aws.bank.internal` is created in the central infrastructure account. Applications in the spoke VPCs must resolve records in `aws.bank.internal` and on-premises domain names ending in `onprem.bank.internal`. On-premises servers must also be able to resolve records in `aws.bank.internal`. Which of the following configurations should a Solutions Architect recommend to meet these requirements with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Create Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC. Create an outbound resolver rule for `onprem.bank.internal` pointing to the on-premises DNS servers, and share it with the spoke accounts using AWS Resource Access Manager. Authorize and associate the `aws.bank.internal` private hosted zone with the spoke VPCs using the Route 53 API.

Cevap

Create Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC, configure and share the outbound rule for the on-premises domain via AWS RAM, and authorize/associate the Private Hosted Zone with the spoke VPCs using the Route 53 API.
The correct configuration leverages Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC to manage hybrid traffic, shares the outbound forwarding rules across the organization via AWS RAM to minimize configuration overhead, and uses the Route 53 API to establish the required cross-account Private Hosted Zone associations so spoke VPCs can resolve central records.

Adım Adım Çözüm

1
Set up Inbound and Outbound Endpoints in the central Shared Services VPC.
Establishes network paths for DNS queries going into AWS from on-premises (Inbound) and leaving AWS to on-premises (Outbound).
Centralizing endpoints in a single VPC minimizes deployment costs and simplifies security group management.
2
Create a Route 53 Resolver forwarding rule for the `onprem.bank.internal` domain in the Shared Services account and share it with the organization using AWS Resource Access Manager (RAM).
Spoke VPCs can associate with the shared rule to forward queries to the Outbound Endpoint.
Allows all spoke accounts to automatically inherit the DNS forwarding path to the on-premises DNS servers.
3
Submit cross-account private hosted zone association authorizations for each spoke VPC from the Shared Services account, and then accept the associations in the respective spoke accounts using the Route 53 API.
The spoke VPCs can now resolve DNS records defined inside the `aws.bank.internal` Private Hosted Zone.
Private Hosted Zones must be explicitly associated with each VPC that needs to resolve its records, even across accounts.

Anahtar Kavram

Hybrid and multi-account DNS resolution using Route 53 Resolver Endpoints, RAM rule sharing, and cross-account Private Hosted Zone association.
Tahmini Süre:2m 0s
Soru 645Soru →

A multinational insurance group uses AWS Organizations to manage a multi-account environment. The core network topology consists of a central Hub VPC in a dedicated Network account and multiple spoke VPCs in separate member accounts, all interconnected using an AWS Transit Gateway. The company also maintains a corporate on-premises data center connected to the Hub VPC via AWS Direct Connect. A Private Hosted Zone (PHZ) named insurance.internal is hosted in a Shared Services account.

The enterprise requires a hybrid DNS resolution strategy where workloads in the on-premises data center must resolve hosts in the insurance.internal zone, and workloads in the spoke VPCs must resolve hosts in the insurance.internal zone as well as on-premises DNS names ending in corp.insurance. Inbound and outbound DNS traffic must be centralized through the Hub VPC to optimize cost and enforce network security policies.

Which combination of actions must a solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the Shared Services account, authorize the association of the Private Hosted Zone with the Hub VPC and spoke VPCs. In the Hub and spoke accounts, associate the VPCs with the Private Hosted Zone.; Create Route 53 Resolver inbound endpoints and outbound endpoints in the Hub VPC. Create a Route 53 Resolver forwarding rule for the corp.insurance domain pointing to the on-premises DNS servers, and associate this rule with the Hub VPC and all spoke VPCs.

Cevap

The correct actions are to authorize and associate the Private Hosted Zone with the Hub and spoke VPCs, and to configure Route 53 Resolver inbound/outbound endpoints in the Hub VPC with a forwarding rule for the on-premises domain associated with the VPCs.
To achieve hybrid DNS resolution, a Route 53 Private Hosted Zone (PHZ) in a shared account must be associated with the consumer VPCs. Because the PHZ resides in a separate Shared Services account, the solutions architect must use cross-account authorization. Centralizing DNS resolution in the Hub VPC requires Route 53 Resolver inbound endpoints for on-premises clients to target, and outbound endpoints to forward AWS queries to on-premises servers based on a forwarding rule associated with all participating VPCs.

Adım Adım Çözüm

1
Establish cross-account Private Hosted Zone resolution for all VPCs.
The Hub VPC and all spoke VPCs are associated with the insurance.internal Private Hosted Zone.
Since the Private Hosted Zone is in a separate Shared Services account, it must be explicitly authorized and associated with the target VPCs across accounts to allow native DNS resolution.
2
Deploy centralized Route 53 Resolver endpoints.
Inbound and outbound resolver endpoints are provisioned in the Hub VPC.
Inbound endpoints provide IP addresses for on-premises DNS forwarders, and outbound endpoints allow forwarding queries from AWS to the corporate data center.
3
Configure DNS forwarding for the on-premises domain.
A Route 53 Resolver rule is created for corp.insurance and associated with the Hub and spoke VPCs.
Associating the forwarding rule ensures that any query for the on-premises domain from any VPC is directed to the outbound endpoints, which route them to the on-premises DNS servers.

Anahtar Kavram

Centralized and cross-account hybrid DNS resolution using Route 53 Resolver endpoints and cross-account Private Hosted Zone association.
Soru 646Soru →

An organization is designing a multi-region disaster recovery (DR) architecture for a critical internal inventory management system. The primary workload runs in the us-east-1 Region, and the DR environment will be established in the us-west-2 Region. The application layer runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances require outbound internet access to download vendor updates. The database tier uses Amazon RDS for PostgreSQL. The company requires a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes, while keeping standby costs minimal. During normal operations, internal client services in both Regions must resolve the application's internal endpoint, api.inventory.local. Which solution meets these requirements at the lowest cost?

Cevabı ve açıklamayı göster

Cevap: Implement a warm standby architecture in us-west-2 by deploying the application EC2 instances at minimum capacity. Configure an Amazon RDS for PostgreSQL cross-region read replica in us-west-2, and promote it during failover. Route traffic using Amazon Route 53 failover routing. Set up NAT Gateways in each Availability Zone of the VPCs in both Regions for outbound internet connectivity. Create a Route 53 Private Hosted Zone for inventory.local and associate it with the VPCs in both Regions.

Cevap

Implement a warm standby architecture in the secondary region with minimum EC2 capacity, configure an Amazon RDS cross-region read replica, set up redundant NAT Gateways in each Availability Zone of both VPCs, route traffic using Route 53 failover routing, and associate the Private Hosted Zone with both VPCs.
The correct solution uses a Warm Standby disaster recovery strategy, deploying application EC2 instances at minimum capacity to control costs while ensuring the system can scale within the 15-minute RTO. An Amazon RDS for PostgreSQL cross-region read replica satisfies the 5-minute RPO because database changes are replicated asynchronously in near-real-time. High availability is maintained by using multi-AZ NAT Gateways, and the Route 53 Private Hosted Zone is associated with both VPCs to allow internal clients in both Regions to resolve the local application endpoint.

Adım Adım Çözüm

1
Determine the database replication strategy to satisfy the 5-minute RPO.
Identify that snapshot-based copy strategies (e.g., 4-hour intervals) are too slow. Choose cross-region database replication via an Amazon RDS for PostgreSQL cross-region read replica, which operates asynchronously with a lag of seconds.
Asynchronous replication satisfies the tight RPO constraint of 5 minutes without the cost or complexity of synchronous multi-region setups.
2
Select the application deployment strategy to meet the 15-minute RTO.
Choose a Warm Standby strategy where application servers run at minimum capacity (e.g., 1 instance) in the secondary Region and scale up via Auto Scaling during a failover event.
This keeps costs minimal compared to Active-Active while ensuring the application can be online and scaled within the 15-minute RTO, which is difficult to guarantee with pure Backup & Restore.
3
Configure internal DNS resolution and redundant network access.
Associate the Route 53 Private Hosted Zone with both VPCs so that clients in both Regions can resolve the internal domain. Deploy NAT Gateways in multiple Availability Zones in both VPCs.
Failing to associate the PHZ prevents DNS resolution in the failover VPC. Deploying only a single NAT Gateway in a Region creates a single point of failure that compromises high availability.

Anahtar Kavram

High Availability and Disaster Recovery Design
Soru 647Soru →

A financial technology company is designing a disaster recovery (DR) architecture for a critical transaction ledger application. The application will be deployed across two AWS Regions: `us-east-1` as the primary region and `us-west-2` as the secondary region. The company has specified a Recovery Time Objective (RTO) of 1515 minutes and a Recovery Point Objective (RPO) of 22 minutes. The application runs on Amazon EC2 instances in Auto Scaling groups behind Application Load Balancers, and uses an Amazon Aurora PostgreSQL DB cluster. The DR strategy must minimize running costs during normal operations while meeting the RTO and RPO, and public traffic must automatically fail over to the secondary region if the primary region becomes unhealthy. Which combination of actions should the Solutions Architect select to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Aurora Global Database with the primary cluster in `us-east-1` and a secondary cluster in `us-west-2`. Deploy a minimum-size Aurora replica instance in the secondary cluster to minimize running cost, and use automation to scale up the instance class before promoting the secondary cluster during a failover event.; Configure Amazon Route 53 public DNS with active-passive failover routing. Point the primary record to the Application Load Balancer in `us-east-1` with an associated Amazon Route 53 health check, and point the secondary record to the Application Load Balancer in `us-west-2`.

Cevap

Create an Amazon Aurora Global Database with a scaled-down secondary instance and configure Route 53 active-passive failover routing.
The correct strategy combines Aurora Global Database with a scaled-down secondary instance and Route 53 active-passive failover routing. Aurora Global Database replication has a lag of less than 11 second, which easily meets the 22-minute RPO. Using a smaller instance in the secondary cluster minimizes active costs, and scaling it up during failover can be completed well within the 1515-minute RTO. Route 53 failover routing with health checks ensures that public traffic is dynamically redirected to the secondary load balancer when the primary region is down.

Adım Adım Çözüm

1
Evaluate database replication options against the RPO constraint.
Amazon Aurora Global Database is chosen because its physical replication lag is typically less than 11 second, easily satisfying the 22-minute RPO constraint, whereas snapshot-based approaches yield up to 6060 minutes of data loss.
Choosing the correct database replication method ensures data recovery aligns with business requirements.
2
Optimize database cost for the secondary region while keeping within the RTO limit.
A smaller database instance class is deployed in the secondary region to minimize costs, and an automation script is prepared to scale it up to match the primary instance size before promotion during failover. This process takes under 1010 minutes, fitting inside the 1515-minute RTO.
This maintains a cost-effective warm standby posture while preserving the ability to scale to production capacity.
3
Configure DNS routing for automated failover.
Route 53 active-passive failover routing is configured with health checks targeting the Application Load Balancer in the primary region. Traffic is redirected to the secondary region automatically when the health check fails.
This establishes automatic redirection of client traffic during an outage without manual DNS record updates.

Anahtar Kavram

Disaster recovery design involves trade-offs between cost, RTO, and RPO. Aurora Global Database provides near-zero replication lag for low RPOs, while Route 53 active-passive failover routing ensures automated application traffic redirection.
Soru 648Soru →

An enterprise is establishing a centralized compliance logging architecture for its multi-account AWS Organization. A Solutions Architect must configure an organization-wide AWS CloudTrail trail in the management account that consolidates log files into an Amazon S3 bucket located within a dedicated Security account. The security policy mandates that all logs must be encrypted at rest using SSE-KMS with a customer managed key, and access must adhere strictly to the principle of least privilege. Specifically, the configuration must prevent unauthorized access from member accounts while ensuring that CloudTrail can successfully write logs to the bucket. Which combination of configurations must the solutions architect implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket policy in the Security account to allow s3:PutObjects3:PutObject and s3:GetBucketAcls3:GetBucketAcl actions for the CloudTrail service principal (cloudtrail.amazonaws.comcloudtrail.amazonaws.com), specifying the Organization Trail ARN in the aws:SourceArnaws:SourceArn condition. Create a customer managed KMS key in the Security account with a key policy that grants kms:GenerateDataKey∗kms:GenerateDataKey* and kms:Decryptkms:Decrypt to cloudtrail.amazonaws.comcloudtrail.amazonaws.com with a condition restricting the aws:SourceArnaws:SourceArn to the organization trail ARN.

Cevap

The configuration using a customer managed KMS key in the Security account with S3 bucket and KMS key policies that grant access to the CloudTrail service principal (cloudtrail.amazonaws.comcloudtrail.amazonaws.com) under the aws:SourceArnaws:SourceArn condition matching the Organization Trail ARN.
The configuration using a customer managed KMS key in the Security account with policies allowing the CloudTrail service principal (cloudtrail.amazonaws.comcloudtrail.amazonaws.com) to perform key operations and bucket writes constrained by the aws:SourceArnaws:SourceArn is correct. It ensures secure log delivery directly by the AWS CloudTrail service, isolates access, protects against the confused deputy vulnerability, and uses a key whose policy can be customized for cross-account service access.

Adım Adım Çözüm

1
Select a customer managed KMS key for encryption
Avoids using the AWS-managed KMS key (aws/s3aws/s3) since its key policy cannot be modified to grant cross-account access to CloudTrail.
CloudTrail requires key permissions (kms:GenerateDataKey∗kms:GenerateDataKey* and kms:Decryptkms:Decrypt) which are only configurable on customer managed KMS keys.
2
Configure the S3 bucket policy in the Security account
Grants s3:PutObjects3:PutObject and s3:GetBucketAcls3:GetBucketAcl permissions to the service principal cloudtrail.amazonaws.comcloudtrail.amazonaws.com.
Allows CloudTrail to write logs directly to the centralized bucket on behalf of the organization's member accounts.
3
Add the aws:SourceArnaws:SourceArn condition to both S3 bucket and KMS key policies
Restricts the permissions to only the Organization Trail ARN from the management account.
Mitigates the confused deputy security risk by preventing other CloudTrail configurations in other accounts from writing to the bucket or using the KMS key.

Anahtar Kavram

Centralized Organization Trail log delivery requires explicit permission grants to the CloudTrail service principal (cloudtrail.amazonaws.comcloudtrail.amazonaws.com) on both the destination S3 bucket policy and a customer managed KMS key policy, securely scoped with the aws:SourceArnaws:SourceArn condition.
Soru 649Soru →

An energy management company is designing a disaster recovery (DR) architecture for a critical smart meter telemetry processing platform. The platform processes real-time data from millions of IoT devices. The company requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. The primary deployment is in the us-east-1 Region, and the DR target is the us-west-2 Region. The architecture consists of public Application Load Balancers (ALBs) routing requests to containerized backend tasks running on Amazon ECS on AWS Fargate in private subnets. The backend tasks must call an external third-party API over the internet to validate device payloads. The application's state is stored in an Amazon Aurora PostgreSQL database. The backend tasks resolve the database endpoint using a private DNS name, db.internal.telemetry. Which architecture meets these requirements with the lowest cost and operational complexity while maintaining high availability (HA) in the primary Region?

Cevabı ve açıklamayı göster

Cevap: Configure a Route 53 Active-Passive failover routing policy using Route 53 health checks on the primary ALB. Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2 running a single reader instance. In both regions, run the ECS Fargate tasks across three Availability Zones (AZs) in private subnets, with Route Tables in each private subnet pointing to a dedicated NAT Gateway in the same AZ. Create a Route 53 Private Hosted Zone (PHZ) for db.internal.telemetry containing a CNAME record pointing to the local cluster endpoint, and associate this PHZ with both the us-east-1 and us-west-2 VPCs. Keep the ECS service in us-west-2 scaled to 0 tasks, and use an AWS Step Functions workflow to promote the secondary Aurora cluster and scale up the ECS service to the required capacity during failover.

Cevap

The architecture using Route 53 Active-Passive failover, Amazon Aurora Global Database, multi-AZ ECS Fargate tasks with dedicated NAT Gateways per AZ, and a Private Hosted Zone associated with both VPCs satisfies the RTO, RPO, cost, and high availability requirements.
The correct architecture utilizes Route 53 Active-Passive failover to route external traffic to the healthy region. Aurora Global Database ensures that data is replicated continuously with sub-second latency, satisfying the 1-minute RPO. Operating the secondary region as a Warm Standby (with ECS tasks scaled to zero and a single small Aurora reader) minimizes idle resource costs. High availability in the primary region is preserved by deploying a NAT Gateway in each Availability Zone. The database private DNS name resolves correctly in both VPCs because the Route 53 Private Hosted Zone is associated with both the primary and secondary VPCs.

Adım Adım Çözüm

1
Evaluate the RTO and RPO requirements
The 1-minute RPO requires continuous database replication. Aurora Global Database provides sub-second cross-region replication. The 15-minute RTO allows for automated scale-up of container workloads (ECS Fargate tasks takes ~2-3 minutes) and DB promotion (takes <1 minute).
To choose the appropriate database replication strategy (Aurora Global Database instead of hourly snapshots) and compute model (Warm Standby instead of Active-Active).
2
Ensure High Availability for outbound traffic in the primary region
Deploying dedicated NAT Gateways in each Availability Zone in us-east-1 ensures that if an AZ fails, the remaining zones maintain outbound connectivity to the external API.
Routing outbound traffic through a single NAT Gateway creates a single point of failure, violating the high availability requirement in the primary region.
3
Configure DNS resolution for microservices in the secondary region
Associate the Route 53 Private Hosted Zone with the VPCs in both us-east-1 and us-west-2.
If the Private Hosted Zone is only associated with the primary VPC, the ECS tasks in the disaster recovery region will be unable to resolve the database's private DNS name db.internal.telemetry during failover.
4
Optimize cost for the DR region
Scale the ECS service in the secondary region to 0 tasks during normal operations, and scale it up dynamically upon failover using AWS Step Functions automation.
Keeping container resources scaled down minimizes running costs when no failover event has occurred.

Anahtar Kavram

High Availability and Disaster Recovery Design

Alternatif Yöntem

Instead of using AWS Step Functions to orchestrate database promotion and service scaling, AWS Application Recovery Controller (ARC) routing controls and Aurora Global Database managed planned failover can be configured to coordinate and automate the failover process with minimal human intervention, although at a higher service cost.
Tahmini Süre:3m 0s
Soru 650Soru →

A healthcare provider runs its research workloads in a multi-account environment managed under AWS Organizations. The provider wants to grant access to clinical research data stored in Amazon S3 buckets inside a specific member account. The researchers must authenticate using their existing credentials from an external corporate SAML 2.0-compliant Identity Provider (IdP). The solutions architect creates a SAML provider entity in the member account. However, when researchers attempt to log in and assume the designated research role, the authentication flow fails during the AWS Security Token Service (STS) call. Which configuration change is required in the member account to resolve this federation failure?

Cevabı ve açıklamayı göster

Cevap: Update the IAM role trust policy in the member account to specify the SAML identity provider as the Principal and permit the sts:AssumeRoleWithSAML action.

Cevap

Update the IAM role trust policy in the member account to specify the SAML identity provider as the Principal and permit the sts:AssumeRoleWithSAML action.
To establish federation with an external SAML 2.0 Identity Provider (IdP), the IAM role's trust policy in the target member account must explicitly specify the SAML provider's ARN as the federated principal and allow the sts:AssumeRoleWithSAML action. This trust relationship allows AWS Security Token Service (STS) to validate the SAML assertion and issue temporary security credentials.

Adım Adım Çözüm

1
Verify the IAM role's trust policy in the target member account.
The trust policy defines which entities (principals) can assume the role under what conditions.
Before an external SAML assertion can be exchanged for credentials, the target role must trust the SAML Identity Provider.
2
Check the Allowed Action in the statement of the trust policy.
The Action must be explicitly set to sts:AssumeRoleWithSAML.
The standard sts:AssumeRole action is for IAM users/services, whereas sts:AssumeRoleWithSAML is required to parse SAML assertions and authenticate federated users.

Anahtar Kavram

SAML 2.0 Identity Federation Trust Policies
Tahmini Süre:1m 30s
Soru 651Soru →

An enterprise is designing a deployment pipeline for a high-throughput microservice hosted on Amazon ECS with AWS Fargate, positioned behind an Application Load Balancer (ALB). Due to strict corporate service limits, the AWS account has a highly constrained Fargate vCPU quota that prevents the concurrent execution of two full fleets (200%200\% capacity) of the microservice.

The deployment strategy for new versions must satisfy the following criteria:
1. Route exactly 10%10\% of production traffic to the new version for an initial 15-minute15\text{-minute} evaluation period.
2. If health metrics remain stable, increase traffic to the new version by 30%30\% every 10 minutes10\text{ minutes} until it reaches 100%100\%.
3. Automatically roll back traffic to 100%100\% on the old version immediately if any Amazon CloudWatch alarms (such as HTTP 5XX5\text{XX} error rates) are triggered.
4. Keep the total running Fargate task count across both versions aligned with active traffic demands to avoid exceeding the vCPU quota.

Which combination of actions should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Register the current version and the new version of the microservice as two separate Amazon ECS services, each associated with its own Application Load Balancer (ALB) target group. Use an AWS Step Functions state machine to programmatically update the weights of the target groups in the ALB listener rule according to the deployment schedule, monitor the CloudWatch alarms, and immediately revert the weight of the current version's target group to 100%100\% if an alarm is triggered.; Enable Application Auto Scaling for both ECS services using target tracking policies based on the `ALBRequestCountPerTarget` metric. This dynamically adjusts the task count of each service in proportion to the shifting traffic weights, preventing the combined task count from exceeding the Fargate vCPU quota.

Cevap

Implement two separate Amazon ECS services registered with separate ALB target groups, orchestrate the weighted routing via an AWS Step Functions state machine, and enable Application Auto Scaling based on target tracking of request counts on both services.
The correct strategy involves registering the old and new versions as two separate ECS services and using ALB weighted target groups to perform the traffic shifting. An AWS Step Functions state machine handles the custom progression (10%10\% for 15 minutes15\text{ minutes}, then +30%+30\% every 10 minutes10\text{ minutes}) and handles immediate rollbacks by reverting ALB weights if a CloudWatch alarm triggers. To satisfy the vCPU quota constraint, enabling Application Auto Scaling with the `ALBRequestCountPerTarget` target tracking metric ensures the task counts dynamically scale in proportion to the traffic weights, keeping the aggregate capacity within bounds.

Adım Adım Çözüm

1
Analyze capacity constraints.
Standard AWS CodeDeploy blue/green deployments require provisioning a full 100%100\% duplicate task set (resulting in 200%200\% concurrency capacity) before shifting traffic, which is blocked by the tight Fargate vCPU service quota.
Understanding resource constraints is critical to ruling out standard AWS CodeDeploy blue/green mechanisms.
2
Evaluate traffic shifting options.
The requirements demand a custom multi-phase traffic-shifting pattern (10%10\% canary, followed by +30%+30\% linear steps) and instant rollback. Application Load Balancer listener rules support weighted target groups, which can route a precise percentage of traffic to separate target groups.
This establishes that ALB-level routing is needed to satisfy the custom progression and rapid rollback criteria.
3
Design orchestration and rollback logic.
An AWS Step Functions state machine can update the ALB listener rule target group weights over time, pausing for the required intervals (15 minutes15\text{ minutes} and then 10 minutes10\text{ minutes}). It can simultaneously monitor CloudWatch alarms during execution and immediately update the weights back to 100%100\% for the active version if an alarm is triggered.
An orchestrator is required to manage the custom deployment schedule and execute instantaneous rollback logic.
4
Optimize scaling to prevent quota exhaustion.
Configuring Application Auto Scaling using target tracking based on the `ALBRequestCountPerTarget` metric ensures that task counts for each service scale up and down dynamically in direct response to the volume of traffic routed to their respective target groups.
This prevents running excess idle tasks, keeping the combined task count aligned with current traffic load and staying within the vCPU quota.

Anahtar Kavram

Custom ECS deployment strategies under tight resource quotas using ALB weighted target groups, Step Functions orchestration, and request-based auto-scaling.
Soru 652Soru →

A company has an AWS Organization consisting of a management account and multiple member accounts representing distinct business units: Network, Finance, and Engineering. The company wants to implement a resource sharing and cost management strategy that satisfies the following requirements:

- The Engineering unit must deploy its application workloads into a shared VPC hosted and managed by the Network account, while maintaining control over their own application-level security groups.
- The Finance unit requires internal showback reports where their Amazon EC2 usage has a 5%5\% markup applied, without affecting the actual consolidated invoice from AWS.

Which of the following actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable resource sharing within AWS Organizations from the management account. Use AWS Resource Access Manager (RAM) in the centralized Network account to share private subnets with the Engineering unit's accounts.; Configure AWS Billing Conductor in the billing management account. Create a billing group for the Finance unit's accounts, establish a custom pricing rule with a 5%5\% markup on Amazon EC2, and apply this rule to the billing group.

Cevap

Enable resource sharing within AWS Organizations and share the private subnets from the Network account via AWS RAM, and use AWS Billing Conductor to configure a custom billing group and pricing rule with a 5%5\% markup on Amazon EC2 for the Finance unit's accounts.
The correct strategy combines sharing VPC subnets using AWS Resource Access Manager (RAM) and configuring custom billing parameters using AWS Billing Conductor. Sharing subnets allows the Engineering account to deploy workloads into the central VPC and manage its own security groups, as security groups are not shared. AWS Billing Conductor enables the creation of pro forma billing data with custom markup or discount rules for specific accounts, fulfilling the Finance unit's requirement for showback without altering the master consolidated bill.

Adım Adım Çözüm

1
Configure VPC sharing using AWS Resource Access Manager (RAM) in the Network account.
The subnets of the VPC are shared with the Engineering unit's AWS accounts within the Organization.
This allows the Engineering unit to launch resources into the shared subnet while maintaining control over their local security groups.
2
Configure AWS Billing Conductor in the management account.
A billing group is created containing the Finance unit's accounts, and a pricing rule applying a 5%5\% markup to EC2 is associated with this group.
This generates a custom billing view and pro forma invoice reflecting the markup for internal showback without changing the actual AWS billing data.

Anahtar Kavram

Implementing cross-account resource sharing using AWS Resource Access Manager (RAM) and custom billing reporting using AWS Billing Conductor.
Soru 653Soru →

A logistics company is designing a disaster recovery (DR) architecture for its mission-critical supply chain orchestrator application. The system operates on Amazon ECS on AWS Fargate and utilizes an Amazon Aurora PostgreSQL database. The primary deployment is in the `us-west-2` Region, and the secondary deployment is in the `us-east-1` Region. The business requires a Recovery Time Objective (RTO) of 1515 minutes and a Recovery Point Objective (RPO) of 55 minutes. The architecture must minimize ongoing standby costs while ensuring high availability and proper internal and outbound network connectivity in both regions. Which two configurations should the solutions architect choose to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Amazon Aurora Global Database with the primary cluster in `us-west-2` and a secondary read replica cluster in `us-east-1`. Run the ECS service in `us-east-1` with a desired task count of 00, and configure Route 53 active-passive failover routing policies with health checks configured on the primary Application Load Balancer.; Configure redundant NAT Gateways across multiple Availability Zones in both the `us-west-2` and `us-east-1` VPCs, and associate the Route 53 Private Hosted Zone for internal DNS resolution with both regional VPCs.

Cevap

Deploying Amazon Aurora Global Database with a secondary task count of 00 and active-passive Route 53 failover, along with configuring redundant NAT Gateways and associating the Private Hosted Zone with both regional VPCs.
The correct configurations are to deploy Amazon Aurora Global Database with a standby task count of 00 and active-passive Route 53 failover, and to deploy redundant NAT Gateways while associating the Private Hosted Zone with both VPCs. Aurora Global Database provides sub-second replication to meet the 55-minute RPO. Keeping the secondary ECS service task count at 00 minimizes ongoing standby costs, and Route 53 active-passive failover routes traffic within the 1515-minute RTO. Redundant NAT Gateways ensure outbound traffic is highly available during Availability Zone outages, and the Private Hosted Zone must be associated with both VPCs for internal resolution to function correctly in both regions.

Adım Adım Çözüm

1
Select a database replication strategy that achieves an RPO of less than 55 minutes.
Implement Amazon Aurora Global Database, which offers typical replication lag of under 11 second.
Traditional snapshot copying (e.g., hourly snapshots) cannot guarantee a 55-minute RPO.
2
Select a DNS failover routing configuration to manage traffic redirection within the 1515-minute RTO.
Configure Route 53 active-passive failover routing policies with health checks targeting the primary Application Load Balancer.
Active-passive failover dynamically routes client traffic to the secondary region if the primary region becomes unhealthy.
3
Design network infrastructure in both regions to maintain high availability and internal name resolution.
Deploy redundant NAT Gateways across multiple Availability Zones in both VPCs, and associate the internal Private Hosted Zone (PHZ) with both VPCs.
A single NAT Gateway in an Availability Zone represents a single point of failure. Private Hosted Zones must be explicitly associated with each VPC in order for resources in those VPCs to resolve internal DNS names.

Anahtar Kavram

Designing highly available, multi-region DR architectures that satisfy strict RTO and RPO constraints while ensuring network and DNS resolution redundancy.
Soru 654Soru →

A media conglomerate has configured an AWS Organizations structure consisting of a Security Organizational Unit (OU) and a Workloads OU. The Security OU contains a dedicated Security Operations account. A Solutions Architect must design a governance framework for AWS Config across the entire organization to satisfy the following requirements:
1. AWS Config must be active in all current and future accounts under the Workloads OU.
2. A set of mandatory compliance rules must be deployed centrally. Local administrators in member accounts must not be able to modify or delete these compliance rules.
3. Local administrators in the Workloads OU must retain the ability to deploy and manage application-specific, custom AWS Config rules.
4. No user or IAM role in the Workloads OU must be allowed to disable the configuration recorder or delete the configuration delivery channel.

Which solution should the Solutions Architect implement to meet these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Register the Security Operations account as a delegated administrator for AWS Config. Deploy organization config rules from the Security Operations account. Attach a Service Control Policy (SCP) to the Workloads OU that denies the config:StopConfigurationRecorder and config:DeleteDeliveryChannel actions.

Cevap

Register the Security Operations account as a delegated administrator for AWS Config. Deploy organization config rules from the Security Operations account. Attach a Service Control Policy (SCP) to the Workloads OU that denies the config:StopConfigurationRecorder and config:DeleteDeliveryChannel actions.
Registering the Security Operations account as a delegated administrator for AWS Config enables the central deployment of organization config rules. These rules are automatically created in all member accounts and cannot be modified or deleted by local administrators. To protect the underlying infrastructure of AWS Config, a Service Control Policy (SCP) is attached to the Workloads OU to deny the 'StopConfigurationRecorder' and 'DeleteDeliveryChannel' actions. This ensures the configuration recorder remains active, while still permitting local administrators to create and manage their own local custom rules because the SCP does not restrict 'PutConfigRule' or 'DeleteConfigRule' actions.

Adım Adım Çözüm

1
Enable delegated administration for AWS Config to separate management duties from the Organization management account.
The Security Operations account gains the ability to manage AWS Config rules organization-wide.
This establishes central governance with least operational overhead without utilizing the root organization account.
2
Deploy organization-wide AWS Config rules using the delegated administrator account.
Mandatory rules are automatically created in all member accounts.
Organization config rules cannot be modified or deleted by users in member accounts, ensuring compliance.
3
Attach a Service Control Policy (SCP) to the Workloads OU targeting configuration recorder and delivery channel management.
Users in member accounts are blocked from stopping the recorder or deleting the delivery channel, while still being able to execute other config operations.
This protects the integrity of AWS Config recording while allowing local administrators to continue creating their own custom local rules.

Anahtar Kavram

AWS Organizations delegated administration and Service Control Policies (SCPs) for multi-account governance
Tahmini Süre:3m 0s
Soru 655Soru →

A gaming company hosts a multiplayer game that uses an Amazon RDS for PostgreSQL DB instance to store player profiles. During peak hours, the game servers perform a high volume of read-only queries to retrieve player stats, causing the DB instance's CPU utilization to reach 100% and impacting gameplay. A solutions architect must scale the database to resolve the CPU bottleneck. Which database configuration should the solutions architect implement?

Cevabı ve açıklamayı göster

Cevap: Create Amazon RDS Read Replicas and update the game server configuration to direct read-only queries to the replica endpoints.

Cevap

Create Amazon RDS Read Replicas and update the game server configuration to direct read-only queries to the replica endpoints.
Creating Amazon RDS Read Replicas is the correct solution because it scales database read capacity horizontally. By routing read-only queries to the replica endpoints, the game servers offload query processing from the primary DB instance, reducing its CPU usage. The replication is asynchronous, which is suitable for player profile reads that can tolerate slight replication lag.

Adım Adım Çözüm

1
Identify the performance bottleneck on the primary database instance.
High CPU utilization is driven by a surge in read-only queries during peak hours.
Understanding the nature of the database workload (read-heavy vs. write-heavy) determines the correct scaling approach.
2
Select the appropriate scaling mechanism for read-heavy RDS databases.
RDS Read Replicas are selected to handle horizontal read scaling.
RDS Read Replicas offload read traffic from the primary database instance, reducing its CPU utilization.
3
Update the application configuration to utilize the replica endpoints.
Game servers send read queries to Read Replicas and write queries to the primary database.
Replicas operate on separate endpoints, requiring application-level routing to distribute the load.

Anahtar Kavram

Read scaling in Amazon RDS using Read Replicas versus passive high-availability standbys in Multi-AZ deployments.
Soru 656Soru →

A global biotechnology corporation is migrating its laboratory management system to AWS. The company uses AWS Organizations and has established a multi-account environment with a central Transit VPC and multiple Spoke VPCs in different member accounts, all interconnected via AWS Transit Gateway. A dedicated Shared Services account hosts a Route 53 Private Hosted Zone (PHZ) named `bio.internal`. The company also has an on-premises network connected via AWS Direct Connect to the Transit Gateway. On-premises research stations need to resolve records in `bio.internal`, while applications in the Spoke VPCs must resolve both `bio.internal` and on-premises server names in the `lab.local` domain. Which combination of steps should a Solutions Architect take to design a highly available, cost-effective hybrid DNS resolution architecture that meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy Route 53 Resolver inbound and outbound endpoints in the Transit VPC. Create an outbound resolver rule for `lab.local` pointing to the on-premises DNS servers, and share the rule with the organization using AWS Resource Access Manager (RAM). Associate this rule with the Spoke VPCs. In the Shared Services account, authorize the association of the `bio.internal` PHZ with the Transit VPC and all Spoke VPCs, and then accept the associations in the respective accounts. Configure the on-premises DNS servers to forward queries for `bio.internal` to the inbound endpoint IP addresses.

Cevap

Deploy Route 53 Resolver inbound and outbound endpoints in the Transit VPC. Create an outbound resolver rule for the on-premises domain, share it via AWS RAM, and associate it with the Spoke VPCs. Authorize and accept the cross-account association of the Private Hosted Zone with the Transit and Spoke VPCs using the Route 53 API. Configure on-premises DNS to forward queries to the inbound resolver endpoints.
The correct answer outlines a fully functional, highly available, and cost-effective hybrid DNS architecture. By centralizing the inbound and outbound Route 53 Resolver endpoints in the Transit VPC, the company avoids the high cost of deploying endpoints in every Spoke VPC. The outbound resolver rule for the on-premises domain is created once and shared via AWS Resource Access Manager (RAM) to all Spoke VPCs. Crucially, because Route 53 Private Hosted Zones cannot be shared via AWS RAM, the cross-account association workflow (authorization from the Shared Services account, followed by association from the Spoke accounts) is used to link the `bio.internal` PHZ directly to the Spoke VPCs and the Transit VPC. This allows Spoke VPCs to resolve `bio.internal` locally without querying cross-VPC endpoints, while the Transit VPC's inbound endpoint can resolve the zone for on-premises systems.

Adım Adım Çözüm

1
Deploy centralized Route 53 Resolver inbound and outbound endpoints in the Transit VPC.
Establishes the network pathway for bidirectional DNS resolution between the AWS network and the on-premises environment.
Centralizing endpoints in a dedicated transit/hub VPC minimizes costs and administrative overhead compared to deploying endpoints in every Spoke VPC.
2
Create an outbound resolver rule for `lab.local` pointing to on-premises DNS, share it via AWS RAM with the organization, and associate it with the Spoke VPCs.
Allows resources in the Spoke VPCs to resolve the on-premises `lab.local` domain by routing queries through the Transit VPC's outbound resolver endpoints.
Route 53 Resolver rules can be shared across accounts using AWS RAM, allowing multi-account configurations to leverage a single pair of outbound endpoints.
3
Authorize and create cross-account VPC associations for the `bio.internal` Private Hosted Zone (PHZ) with the Transit VPC and all Spoke VPCs.
Allows resources in all Spoke VPCs to resolve `bio.internal` locally, and allows the inbound resolver endpoint in the Transit VPC to resolve it for on-premises clients.
Route 53 PHZs cannot be shared via AWS RAM. They must be associated with each VPC. For cross-account association, the PHZ owner account must authorize the association before the target VPC owner account can associate it.
4
Configure the on-premises DNS servers to forward queries for `bio.internal` to the inbound resolver endpoint IP addresses in the Transit VPC.
Enables on-premises systems to resolve the AWS-hosted `bio.internal` domain.
The inbound endpoints receive DNS queries from on-premises and forward them to the Route 53 Resolver service inside the Transit VPC, which resolves the records from the associated PHZ.

Anahtar Kavram

Centralized Route 53 Resolver design with cross-account Private Hosted Zone association and RAM-shared Resolver Rules in a hybrid network.
Soru 657Soru →

A financial services firm is implementing single sign-on (SSO) to a multi-account AWS environment under AWS Organizations. The firm integrates its external SAML 2.0 Identity Provider (IdP) directly with the member accounts. A security engineer creates an IAM SAML identity provider in each member account and maps it to the external IdP metadata. The engineer then configures an IAM role in each member account for federated users. However, when users attempt to federate, the identity provider returns a failure during the SAML assertion phase.

A review of the configuration shows that:
1. An SCP is attached to the Organizational Unit (OU) containing these member accounts with a statement that allows `sts:AssumeRoleWithSAML` for all resources.
2. The trust policy of the IAM role in the member account is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456789012:saml-provider/CorporateIdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

Which action must the security engineer take to resolve the federation failure?

Cevabı ve açıklamayı göster

Cevap: Change the Action in the IAM role trust policy in each member account to `sts:AssumeRoleWithSAML`.

Cevap

Change the Action in the IAM role trust policy in each member account to `sts:AssumeRoleWithSAML`.
The correct action is to change the Action in the IAM role trust policy to `sts:AssumeRoleWithSAML`. For SAML 2.0 identity federation, AWS STS requires that the role's trust policy explicitly lists the `sts:AssumeRoleWithSAML` action. Since the current policy uses `sts:AssumeRole`, the request is denied because standard role assumption does not accept SAML assertions.

Adım Adım Çözüm

1
Analyze the IAM role trust policy in the member account.
Identify that the trust policy incorrectly specifies `sts:AssumeRole` in the Action block.
SAML federation requires the Security Token Service (STS) action to match the authentication protocol, which is `sts:AssumeRoleWithSAML`.
2
Evaluate the role of the Service Control Policy (SCP).
Confirm that the SCP already allows `sts:AssumeRoleWithSAML` but note that it does not grant permissions directly.
SCPs act as a filter and cannot bypass the requirement for a correct trust policy within the IAM role.
3
Update the IAM role trust policy.
Change the Action to `sts:AssumeRoleWithSAML`.
This allows the STS service to process the incoming SAML assertion and successfully issue temporary credentials.

Anahtar Kavram

SAML 2.0 identity federation requires the use of the `sts:AssumeRoleWithSAML` API action in both the client request and the IAM role's trust policy, while SCPs restrict but do not grant these permissions.
Tahmini Süre:2m 0s
Soru 658Soru →

A biotechnology company is designing a hybrid, multi-account network topology in the `us-east-1` Region. The setup includes 1515 spoke VPCs and a centralized egress VPC, all connected via an AWS Transit Gateway (TGW). The company has the following requirements:
- Establish a primary 10 Gbps10\text{ Gbps} AWS Direct Connect connection to the corporate datacenter, with an IPsec VPN over the internet serving as a backup path.
- Provide highly available and resilient outbound internet access for resources in all spoke VPCs while minimizing NAT Gateway costs.
- Centralize private DNS resolution for a private hosted zone `corp.internal` in a Shared Services VPC so that it can be resolved by resources in all spoke VPCs and the on-premises datacenter.

Which TWO options should the Solutions Architect implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate the Transit Gateway with a Direct Connect Gateway, configure a Transit Virtual Interface (Transit VIF) on the Direct Connect connection, and establish a Site-to-Site VPN connection to the Transit Gateway.; Deploy one NAT Gateway in each of two Availability Zones in the egress VPC, and associate the `corp.internal` private hosted zone with all 1515 spoke VPCs using cross-account hosted zone associations.

Cevap

The correct architecture requires associating the AWS Transit Gateway with a Direct Connect Gateway using a Transit VIF, configuring an AWS Site-to-Site VPN as the backup path, deploying one NAT Gateway in each of two Availability Zones within the egress VPC, and associating the private hosted zone with all spoke VPCs using cross-account hosted zone associations.
The correct choices involve establishing hybrid connectivity using a Transit Gateway associated with a Direct Connect Gateway and a backup Site-to-Site VPN, alongside centralizing internet egress through redundant NAT Gateways and setting up cross-account hosted zone associations. Specifically, associating the Transit Gateway with a Direct Connect Gateway using a Transit VIF allows all spoke VPCs to share the Direct Connect connection. Deploying redundant NAT Gateways in different Availability Zones inside the egress VPC ensures high availability for outbound traffic, while cross-account hosted zone authorization allows the private hosted zone to be resolved by all VPCs.

Adım Adım Çözüm

1
Establish a scalable hybrid connection architecture for the 1515 spoke VPCs.
Configure AWS Transit Gateway (TGW) to connect all spoke VPCs and associate it with a Direct Connect Gateway (DXGW) using a Transit VIF for primary traffic, and a backup Site-to-Site VPN connection.
Direct Connect Gateway supports Transit Gateway associations, allowing up to 33 Transit Gateways and routing to hundreds of VPCs, overcoming the limit of 1010 VPCs per Direct Connect Gateway.
2
Ensure highly available outbound internet access.
Deploy one NAT Gateway in each of two Availability Zones within the centralized egress VPC.
Centralizing egress traffic minimizes the number of NAT Gateways needed compared to deploying them in every VPC, while using two Availability Zones ensures no single point of failure.
3
Configure private DNS resolution across accounts.
Use cross-account hosted zone authorization to associate the `corp.internal` Private Hosted Zone (PHZ) with all 1515 spoke VPCs.
This allows resources in the spoke VPCs to resolve records in the PHZ directly via the Route 53 Resolver without relying on complex cross-VPC DNS forwarding rules.

Anahtar Kavram

Hybrid and Multi-Account Network Connectivity Design
Tahmini Süre:3m 0s
Soru 659Soru →

An enterprise is preparing to deploy an update to a critical microservice running on AWS Lambda that interacts with an Amazon Aurora PostgreSQL Serverless v2 database. The update includes a database schema modification that adds a new column to a high-throughput table, and the new Lambda version depends on this column. The deployment must achieve zero downtime, allow validation of the new database schema and the new Lambda function version with synthetic test transactions before any production users access the new code, and shift traffic gradually over a period of 1010 minutes. If any errors or latency spikes occur during the deployment, the system must automatically and immediately route 100%100\% of traffic back to the old version. Which deployment strategy and database migration pattern will meet these requirements with the lowest risk and administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Implement the database schema change using the expand/contract pattern, applying the backward-compatible schema update (adding the column as nullable) as a pre-deployment database task. Configure AWS CodeDeploy using the LambdaCanary10Percent10Minutes deployment configuration. Define a BeforeAllowTraffic lifecycle hook in the AppSpec file that executes a validation Lambda function. This function invokes the new Lambda version directly using its target version ARN to perform synthetic transaction tests. If validation succeeds, CodeDeploy shifts traffic and monitors CloudWatch alarms on error rates to trigger an automated rollback.

Cevap

Implement the database schema change using the expand/contract pattern, applying the backward-compatible schema update as a pre-deployment database task. Configure AWS CodeDeploy using the LambdaCanary10Percent10Minutes deployment configuration. Define a BeforeAllowTraffic lifecycle hook in the AppSpec file that executes a validation Lambda function to invoke the new version directly. Finally, use CloudWatch alarms on error rates to trigger an automated rollback.
The correct option properly uses the expand/contract pattern to perform a backward-compatible database schema change. It utilizes AWS CodeDeploy with the LambdaCanary10Percent10Minutes configuration to gradually shift traffic. By using the BeforeAllowTraffic lifecycle hook, the configuration ensures that validation tests are run against the new Lambda version (using its version ARN) before any production traffic is routed to it. Finally, integrating CloudWatch alarms with the CodeDeploy deployment group ensures that if errors occur during the canary phase, the deployment is automatically rolled back immediately.

Adım Adım Çözüm

1
Apply the database schema change using a backward-compatible (expand/contract) approach, adding the new column as nullable before deploying the new code.
The existing Lambda function version continues to function without errors because the database schema changes do not break its queries.
To ensure zero downtime, database schema modifications must be backward-compatible so that both old and new Lambda versions can run simultaneously.
2
Configure AWS CodeDeploy with the LambdaCanary10Percent10Minutes deployment configuration and define a BeforeAllowTraffic lifecycle hook in the AppSpec file.
The deployment process is defined to shift traffic gradually, but pauses before routing any production traffic to allow validation.
The BeforeAllowTraffic hook runs before CodeDeploy starts shifting production traffic, allowing validation of the new version beforehand.
3
Create a validation Lambda function invoked by the BeforeAllowTraffic hook that runs synthetic tests against the new Lambda version using its target version ARN.
The new Lambda version's functionality and database compatibility are verified using synthetic transactions.
Invoking the target version ARN directly allows testing the new version before it receives any production traffic.
4
Configure CloudWatch alarms for Lambda errors and latency spikes, and associate them with the CodeDeploy deployment group.
CodeDeploy monitors these alarms during the 1010-minute canary period and automatically rolls back if they are triggered.
This satisfies the requirement for an immediate, automated rollback in case of issues during the transition period.

Anahtar Kavram

Orchestrating safe Lambda deployments with CodeDeploy lifecycle hooks and backward-compatible database schema updates (expand/contract).
Soru 660Soru →

A financial services organization is setting up federated access for external compliance auditors using an on-premises SAML 2.02.0 Identity Provider (IdP). The auditors must be allowed to assume a read-only role named `ComplianceAuditorRole` directly in a target member account (111122223333111122223333).

Which configuration steps must be performed in the target member account to establish this trust and enable successful federation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a SAML Identity Provider entity in the target member account using the XML metadata document exported from the on-premises Identity Provider.; Configure the trust policy of the target IAM role with the Principal set to the ARN of the created SAML Identity Provider and the Action set to `sts:AssumeRoleWithSAML`.

Cevap

Creating a SAML Identity Provider entity in the target member account using the XML metadata document, and configuring the target IAM role's trust policy with the SAML provider as the Principal and `sts:AssumeRoleWithSAML` as the Action.
To configure SAML 2.02.0 federation for a specific member account, a SAML identity provider must be created in that member account using the IdP's metadata document. Additionally, the trust policy of the target IAM role must set the principal to that SAML provider and allow the `sts:AssumeRoleWithSAML` action.

Adım Adım Çözüm

1
Export the SAML metadata document from the on-premises Identity Provider and use it to create a SAML Identity Provider entity in the target member account (111122223333111122223333).
AWS IAM establishes a trust anchor for the external IdP, allowing it to verify incoming assertions.
AWS needs the IdP's metadata (including certificate keys) to verify the signatures of incoming SAML assertions.
2
Update the trust policy of the target IAM role to reference the newly created SAML Identity Provider.
The target IAM role allows federated users from the specific SAML IdP to assume it.
The trust policy must explicitly allow the `sts:AssumeRoleWithSAML` action and identify the SAML provider ARN as the trusted principal.

Anahtar Kavram

Establishing trust for SAML 2.0 federation inside an AWS member account
Tahmini Süre:2m 0s
ÖncekiSayfa 33 / 99Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin