Examkin

Tüm alıştırma soruları

1964 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 681Soru →

A medical technology organization operates a multi-account structure managed via AWS Organizations. The security team is implementing single sign-on for application developers using PingFederate as an external SAML 2.0 Identity Provider (IdP). To maintain a secure architecture, the organization mandates that all user authentication occurs via a centralized Identity account. Once authenticated, developers must assume target roles in various application-specific member accounts to perform their duties. The developers also need to pass dynamic session tags (such as 'CostCenter' and 'Environment') from the SAML assertion to the target member account roles to support Attribute-Based Access Control (ABAC).

The administrator configures the SAML assertion to include the attributes for transitive session tags. During testing, developers can successfully authenticate and assume the initial federated role in the Identity account. However, when they attempt to switch roles to the application member accounts, the API call to assume the target role is denied.

Which configuration change will resolve this issue and allow developers to access the member accounts with their session tags?

Cevabı ve açıklamayı göster

Cevap: Update the trust policy of the target roles in the member accounts to trust the Identity account's federated role and explicitly permit both the 'sts:AssumeRole' and 'sts:TagSession' actions. Ensure the federated role's identity-based policy in the Identity account allows these same actions on the target roles.

Cevap

Update the trust policy of the target roles in the member accounts to trust the Identity account's federated role and explicitly permit both the 'sts:AssumeRole' and 'sts:TagSession' actions. Ensure the federated role's identity-based policy in the Identity account allows these same actions on the target roles.
For cross-account role assumption using AWS Security Token Service (STS) where session tags are passed (transitive or dynamic), both the calling identity and the target role must have the appropriate permissions. The identity-based policy of the calling role in the Identity account must grant the 'sts:AssumeRole' and 'sts:TagSession' permissions. Additionally, the trust policy of the target role in the member account must explicitly trust the calling role and allow both 'sts:AssumeRole' and 'sts:TagSession' actions. Without 'sts:TagSession' allowed in the target role's trust policy, the request is denied because the principal is attempting to apply tags during the session initialization.

Adım Adım Çözüm

1
Analyze the access flow and requirements.
Identify that the flow is centralized federation (SAML to Identity account) followed by cross-account role chaining (Identity account role to Member account role) while passing session tags for ABAC.
This establishes that the failure occurs during the second leg of the access flow: the 'sts:AssumeRole' cross-account call.
2
Determine the permissions required for passing session tags during role assumption.
Identify that both the caller and the target role trust policy must support the 'sts:TagSession' action in addition to 'sts:AssumeRole'.
AWS Security Token Service (STS) requires explicit authorization for session tagging to prevent unauthorized privilege escalation or tag tampering during cross-account access.
3
Evaluate the proposed options against the security requirements.
Select the option that configures the target role's trust policy and the federated role's identity-based policy to allow both 'sts:AssumeRole' and 'sts:TagSession'.
This satisfies the permissions requirement while adhering to the centralized federation architecture.

Anahtar Kavram

Cross-account role chaining with session tags (sts:TagSession)
Tahmini Süre:3m 0s
Soru 682Soru →

A digital health enterprise is designing a high-availability patient telemetry ingestion platform across two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). The platform must ingest real-time data from medical IoT devices.

The requirements are:
- High availability for the public ingestion API endpoints. In the event of a primary region outage, traffic must automatically fail over to the secondary region. The public DNS routing policy must evaluate endpoint health before routing.
- The database layer requires a Recovery Time Objective (RTO) of less than 10 minutes and a Recovery Point Objective (RPO) of less than 1 minute.
- Outbound internet connectivity for ingestion servers running in private subnets of multiple Availability Zones in each region must be highly resilient against Availability Zone failures.
- Internal microservices in both regions must resolve the private domain internal-telemetry.local to regional VPC endpoints locally without routing traffic over the public internet.

Which two of the following configuration options should the solutions architect select to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Route 53 with an Active-Passive Failover routing policy for the public domain using Application Load Balancer health checks. Associate the private hosted zone internal-telemetry.local with the VPCs in both us-east-1 and us-west-2.; Set up an Amazon Aurora Global Database with the primary database cluster in us-east-1 and a secondary database cluster in us-west-2. Deploy a NAT Gateway in each Availability Zone containing private subnets in both regions.

Cevap

The correct configurations are to set up Route 53 Active-Passive Failover for the public endpoint, associate the private hosted zone with the VPCs in both regions, deploy Aurora Global Database for database replication, and provision a NAT Gateway per Availability Zone in each region.
The configuration of Route 53 with an Active-Passive Failover routing policy utilizing Application Load Balancer health checks ensures automatic failover in the event of a regional outage. Associating the private hosted zone with the VPCs in both regions ensures that DNS queries for the private domain resolve locally in both environments. At the database layer, Amazon Aurora Global Database uses storage-level physical replication to replicate data to the secondary region with an RPO of less than 1 minute and allows promotion in less than 10 minutes. Deploying a NAT Gateway in each Availability Zone ensures that outbound egress traffic remains resilient to Availability Zone outages.

Adım Adım Çözüm

1
Analyze the database HA/DR requirements (RTO < 10 mins, RPO < 1 min).
Determine that Amazon Aurora Global Database satisfies these requirements via storage-level physical replication.
It provides cross-region RPO of less than 1 minute and can be promoted to a primary cluster in less than 10 minutes.
2
Evaluate the DNS resolution requirement for the private hosted zone across multiple regions.
Identify that a Route 53 Private Hosted Zone must be associated with the VPCs of both regions.
This allows resources in both regions to resolve the private DNS names locally without routing over the public internet.
3
Analyze outbound connectivity resiliency constraints.
Identify that a NAT Gateway must be deployed in each Availability Zone containing private subnets.
This avoids a single point of failure at the Availability Zone level, ensuring outbound traffic is highly available.

Anahtar Kavram

Designing highly available, resilient, and multi-region disaster recovery systems using Route 53 failover, cross-region VPC DNS association, and Aurora Global Databases.
Soru 683Soru →

A global retail enterprise is designing a multi-account, multi-region AWS network architecture to support its migration. The setup consists of 3030 spoke VPCs in the `us-east-1` Region and 3030 spoke VPCs in the `us-west-2` Region, all managed under AWS Organizations.

The enterprise has the following requirements:
- Hybrid Connectivity: Connect all spoke VPCs to the on-premises data centers in New York and San Francisco. Two 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connections terminate at a Direct Connect Gateway (DXGW) in New York, and two terminate at the same DXGW in San Francisco.
- Failover: Establish AWS Site-to-Site VPN connections over the internet from the on-premises locations to AWS as a backup. The DX path must be preferred for all hybrid traffic, failing over to VPN only during a DX outage.
- Egress Security: Route all outbound internet traffic from both Regions through a dedicated egress VPC in each Region containing transit subnets and NAT Gateways. This must minimize cross-Availability Zone (AZ) data transfer costs and avoid single points of failure.
- DNS Resolution: Allow all spoke VPCs to resolve private domain names in a Route 53 Private Hosted Zone (PHZ) `corp.internal` hosted in a centralized Shared Services account.
- Administrative Overhead: Minimize cost, provisioning complexity, and ongoing management.

Which routing and connectivity design should the Solutions Architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway (TGW) in each Region and associate both TGWs with the DXGW. Establish Site-to-Site VPN connections from the New York customer gateway to the `us-east-1` TGW, and from the San Francisco customer gateway to the `us-west-2` TGW. Configure BGP on the customer gateways to prefer routes received via DX over VPN using BGP Local Preference. In each Region, deploy a centralized egress VPC with a NAT Gateway in each AZ, attach the egress VPC to the local TGW with appliance mode enabled, and route spoke VPC egress traffic (0.0.0.0/00.0.0.0/0) to the TGW. Create VPC association authorizations for the `corp.internal` PHZ in the Shared Services account and associate the PHZ with the spoke VPCs in all accounts.

Cevap

Deploy regional Transit Gateways associated with the Direct Connect Gateway, configure customer gateways to prefer DX via BGP Local Preference, centralize egress using multi-AZ NAT Gateways, and associate the Shared Services Private Hosted Zone directly with all spoke VPCs.
The correct solution involves deploying regional Transit Gateways (TGWs) associated with a single Direct Connect Gateway (DXGW) to handle the hybrid connection. Site-to-Site VPNs are terminated on the TGWs. Since TGW routing prefers DXGW-propagated routes over VPN routes by default for identical prefixes, and BGP Local Preference on customer gateways directs on-premises traffic over DX, symmetric routing and correct failover are achieved. High availability and cost efficiency for internet egress are maintained by deploying a NAT Gateway in each AZ of the egress VPC, avoiding cross-AZ charges and single points of failure. DNS is resolved cost-effectively by authorizing and associating the Route 53 Private Hosted Zone (PHZ) in the Shared Services account directly with all spoke VPCs, avoiding the high cost of Route 53 Resolver endpoints.

Adım Adım Çözüm

1
Configure the hybrid network backbone by deploying regional Transit Gateways (TGWs) in `us-east-1` and `us-west-2`, attaching the spoke VPCs to their respective local TGW, and associating both TGWs with a central Direct Connect Gateway (DXGW) connected to the Chicago and Frankfurt DX locations.
Establishes a highly scalable hybrid network hub that supports up to 60 spoke VPCs and routes traffic to on-premises via DX.
Transit Gateway allows scaling beyond the 10-VGW limit of Direct Connect Gateway and acts as a central hub.
2
Set up Site-to-Site VPN connections terminating on the regional TGWs as a backup path. Configure BGP routing on the on-premises customer gateways to assign a higher Local Preference to routes received over DX compared to VPN, while relying on AWS TGW's default path selection to prefer DXGW routes over VPN routes for identical prefixes.
Ensures active-passive routing where the DX path is preferred for both inbound and outbound traffic, failing over to VPN only when DX is down.
Prevents asymmetric routing and ensures deterministic failover behavior.
3
Deploy a dedicated egress VPC in each Region with NAT Gateways in each Availability Zone. Attach these egress VPCs to their regional TGWs with appliance mode enabled.
Allows spoke VPCs to securely route outbound internet traffic through localized, highly available NAT Gateways.
Minimizes cross-AZ data transfer costs and prevents single-AZ outages from disrupting egress traffic for the entire Region.
4
Use AWS CLI or API to create VPC association authorizations for the `corp.internal` Private Hosted Zone in the Shared Services account, and accept these authorizations in each of the spoke VPC accounts.
Enables all 60 spoke VPCs to resolve private DNS records in `corp.internal` directly.
Eliminates the significant hourly costs and administrative complexity associated with deploying Route 53 Resolver endpoints in every spoke VPC.

Anahtar Kavram

Hybrid network design using Transit Gateway, Direct Connect Gateway, VPN failover routing, and cross-account Private Hosted Zone association.
Soru 684Soru →

A logistics company is designing a multi-account AWS environment under AWS Organizations. The security team must configure single sign-on access for 200200 system administrators using the company's on-premises Active Directory Federation Services (AD FS) as the SAML 2.02.0 Identity Provider (IdP). The administrators must be able to log in to the AWS Management Console with their existing corporate credentials and assume roles in various AWS member accounts based on their Active Directory group memberships.

Which combination of actions must the solutions architect take to establish this federated access? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a SAML Identity Provider entity in each member account using the AD FS federation metadata document, and create IAM roles with a trust policy that allows the 'sts:AssumeRoleWithSAML' action for the SAML provider principal.; Configure the AD FS assertion claims to output the 'https://aws.amazon.com/SAML/Attributes/Role' attribute mapping the user's Active Directory groups to the IAM role and SAML provider ARNs, along with the 'RoleSessionName' attribute.

Cevap

Configure a SAML Identity Provider entity in each member account with a trust policy allowing 'sts:AssumeRoleWithSAML', and configure AD FS claims to output the AWS-required SAML attributes mapped to the correct ARNs.
Establishing SAML federation requires configuring both the AWS side (creating the SAML provider and a trust policy that allows 'sts:AssumeRoleWithSAML') and the IdP side (mapping the user group to release the correct SAML attributes, specifically the Role and RoleSessionName attributes).

Adım Adım Çözüm

1
Establish trust on the AWS side by creating a SAML provider in each member account and defining IAM roles that reference this provider.
IAM roles in member accounts contain trust policies targeting the SAML provider ARN with the 'sts:AssumeRoleWithSAML' action.
This enables AWS STS to accept SAML assertions from the IDP for assuming these specific roles.
2
Configure assertion mapping on the identity provider (AD FS) side.
The identity provider outputs SAML assertions containing the 'Role' attribute (mapping to the role and provider ARNs) and 'RoleSessionName'.
AWS requires these specific SAML attributes in the assertion to map the federated user to the correct target role.

Anahtar Kavram

SAML 2.0 federation trust configuration and attribute mapping in a multi-account AWS environment
Soru 685Soru →

An international retail enterprise manages its AWS environment using AWS Organizations. The security team has designated a dedicated Security account as the delegated administrator for Amazon GuardDuty. The team needs to enforce a policy that prevents member accounts in the Workloads Organizational Unit (OU) from disabling GuardDuty or deleting its detectors. However, the dedicated Security account must retain full administrative privileges to manage GuardDuty across the entire organization. Which of the following represents the most operationally efficient method to achieve this governance requirement?

Cevabı ve açıklamayı göster

Cevap: Create a Service Control Policy (SCP) that denies guardduty:Delete* and guardduty:Update* actions. Attach this SCP to the Workloads OU, and place the delegated administrator Security account in a separate Security OU that does not have this SCP attached.

Cevap

Create a Service Control Policy (SCP) that denies guardduty:Delete* and guardduty:Update* actions. Attach this SCP to the Workloads OU, and place the delegated administrator Security account in a separate Security OU that does not have this SCP attached.
The correct option is to create a Service Control Policy (SCP) denying the relevant delete and update actions and attach it to the Workloads OU while placing the Security account in a separate OU. This utilizes AWS Organizations' hierarchical structure to restrict workload accounts while exempting the delegated administrator, satisfying all requirements with minimal administrative overhead.

Adım Adım Çözüm

1
Analyze the account structure and requirements.
Identify that the dedicated Security account needs admin permissions, while workload accounts must be restricted from deleting or disabling GuardDuty.
To determine how to apply guardrails selectively based on account function.
2
Determine the placement of the delegated administrator account.
Place the Security account in a dedicated Security OU separate from the Workloads OU.
SCPs attached to an OU do not inherit across sibling OUs, allowing selective enforcement.
3
Create and attach the SCP to the Workloads OU.
Attach an SCP denying guardduty:Delete* and guardduty:Update* to the Workloads OU.
This blocks local administrators in workload accounts from tampering with GuardDuty while leaving the Security account unaffected.

Anahtar Kavram

Delegated administration and OU-scoped Service Control Policies
Soru 686Soru →

An aerospace engineering company manages its multi-account environment on AWS using AWS Organizations. The central network infrastructure is hosted in a Shared Services account, which contains a Transit Gateway that connects multiple application VPCs in member accounts and an on-premises data center. A Route 53 Private Hosted Zone (PHZ) for corp.aero.internal is created in the Shared Services account. The company needs resources in both the member account VPCs and the on-premises data center to resolve DNS queries for corp.aero.internal. Which architecture will meet these requirements with the least administrative and operational overhead?

Cevabı ve açıklamayı göster

Cevap: Authorize and associate the corp.aero.internal private hosted zone in the Shared Services account with the member VPCs using cross-account VPC association. Deploy Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure the on-premises DNS forwarders to route queries for the internal domain to these inbound endpoint IP addresses.

Cevap

Authorize and associate the corp.aero.internal private hosted zone in the Shared Services account with the member VPCs using cross-account VPC association. Deploy Route 53 Resolver inbound endpoints in the Shared Services VPC, and configure the on-premises DNS forwarders to route queries for the internal domain to these inbound endpoint IP addresses.
The correct solution uses cross-account Private Hosted Zone (PHZ) association to allow member VPCs to natively resolve DNS queries for the zone. This avoids any additional query fees or endpoint charges for VPC-to-VPC traffic. For the on-premises hybrid DNS resolution, creating Route 53 Resolver inbound endpoints in the Shared Services VPC and configuring the on-premises DNS forwarders to target these endpoints is the standard and most efficient pattern.

Adım Adım Çözüm

1
Authorize cross-account association of the Private Hosted Zone (PHZ) from the Shared Services account to the member VPCs.
The member VPCs are permitted to associate with the PHZ hosted in the Shared Services account.
By default, a PHZ can only be associated with VPCs in the same account unless explicit authorization is granted using the AWS CLI or SDK.
2
Associate the member VPCs with the authorized PHZ from the member accounts.
Resources in the member VPCs can natively resolve domains within corp.aero.internal using the Route 53 Resolver (provided by the 169.254.169.253 IP address) without traversing endpoints.
This establishes native DNS resolution for the PHZ inside the member VPCs with zero additional hop latency or endpoint charges.
3
Create Route 53 Resolver inbound endpoints in the Shared Services VPC and configure on-premises DNS servers to forward queries for corp.aero.internal to the inbound endpoint IP addresses.
On-premises resources can resolve corp.aero.internal domains by forwarding queries over Direct Connect/VPN to the Shared Services VPC.
Inbound endpoints are required to receive DNS queries from outside AWS (such as from on-premises networks) and resolve them against Route 53.

Anahtar Kavram

Cross-Account PHZ Association and Hybrid DNS Resolution using Route 53 Resolver Inbound Endpoints
Soru 687Soru →

A financial corporation manages its AWS environment through AWS Organizations. The organization has a Management account, a dedicated Security and Logging account, a Logistics account, and a Retail account. The corporation has also recently signed a contract with an external consulting firm that operates in a separate, independent AWS account.

The Solutions Architect is tasked with designing a resource sharing, security, and cost management strategy that addresses the following requirements:
1. Compute Cost Optimization: The Retail account runs a containerized microservices platform on AWS Fargate and AWS Lambda. The corporation needs to purchase Savings Plans to cover these workloads.
2. Resource Sharing: The external consulting firm’s AWS account must access a Transit Gateway hosted in the Logistics account to enable secure network connectivity.
3. Cross-Account Logging: The Logistics account must write its CloudTrail logs to a centralized S3 bucket located in the Security and Logging account. The logs must be encrypted at rest, and the Logistics account must be able to read its own logs for local auditing.
4. Billing Demarcation: For chargeback purposes, the Logistics account’s billing reports must show costs calculated at standard AWS public rates, excluding any consolidated volume discounts or organizational Savings Plans benefits.

Which architectural strategy will satisfy all of these requirements?

Cevabı ve açıklamayı göster

Cevap: Purchase Compute Savings Plans in the Management account. In the Logistics account, enable sharing with external principals in AWS RAM and share the Transit Gateway with the external consulting firm's account. In the Security and Logging account, configure the S3 bucket with a Customer Managed Key (CMK), and update the S3 bucket and KMS key policies to allow cross-account access for the Logistics account. In the Billing Preferences of the Management account, disable Savings Plans sharing for the Logistics account, and use AWS Billing Conductor to create a billing group for the Logistics account with a custom pricing plan that applies standard public rates.

Cevap

The correct strategy requires purchasing Compute Savings Plans in the Management account, enabling sharing with external principals in AWS Resource Access Manager (RAM) to share the Transit Gateway, using a Customer Managed Key (CMK) with custom key policies for the centralized logging S3 bucket, and configuring AWS Billing Conductor alongside disabled Savings Plans sharing for the Logistics account to generate pro-forma billing reports using standard public rates.
The correct strategy uses Compute Savings Plans because they cover Fargate and Lambda workloads. It enables external sharing in AWS RAM to share the Transit Gateway with the external account. For the centralized logging S3 bucket, it uses a Customer Managed Key (CMK) because default AWS-managed keys cannot be shared cross-account. Finally, it uses AWS Billing Conductor combined with disabled Savings Plans sharing for the Logistics account to generate pro-forma billing reports at standard public rates.

Adım Adım Çözüm

1
Determine the correct Savings Plan type for serverless container and function workloads.
Compute Savings Plans are selected.
AWS Fargate and AWS Lambda are serverless compute runtimes. They are not covered by EC2 Instance Savings Plans, which only apply to EC2 instances. Compute Savings Plans are required to cover these services.
2
Select the correct resource sharing and network mechanism for the external account.
Enable sharing with external principals in AWS RAM and share the Logistics Transit Gateway.
The external consulting firm's account is outside the AWS Organization. To share resources with external accounts via AWS RAM, the external sharing configuration must be enabled. Additionally, VPC subnets cannot be shared outside the AWS Organization, so sharing the Transit Gateway is the appropriate way to establish network connectivity.
3
Configure the cross-account encryption keys and S3 bucket access for centralized logging.
Use a Customer Managed Key (CMK) in KMS and update both the bucket policy and KMS key policy.
AWS-managed KMS keys (such as aws/s3 or aws/cloudtrail) do not support policy modifications and cannot be shared across accounts. A Customer Managed Key (CMK) must be used so that its key policy can be updated to allow the Logistics account to perform KMS operations.
4
Design the billing segregation mechanism for the Logistics account chargeback requirements.
Disable Savings Plans sharing in Billing Preferences and create a billing group in AWS Billing Conductor.
To show the Logistics account its billing data at standard public rates without organization-level discounts, Savings Plans sharing must be disabled for that specific account. AWS Billing Conductor is then used to define a custom billing group and pricing plan that applies standard public rates, generating pro-forma reports.

Anahtar Kavram

Multi-account resource sharing boundaries, KMS cross-account key policies, Compute Savings Plans applicability, and AWS Billing Conductor pro-forma reporting.
Tahmini Süre:3m 0s
Soru 688Soru →

An enterprise manages its multi-account environment using AWS Organizations. The account structure includes a Security Organizational Unit (OU) and a Workloads OU. The security team has defined a policy stating that member accounts within the Workloads OU must never disable AWS Security Hub, delete Amazon GuardDuty detectors, or stop AWS Config recorders. However, during incident response operations, a centralized security role named SecurityIncidentResponseRole, which is provisioned across all member accounts, must be able to perform these administrative tasks to remediate issues. The solution must ensure these compliance guardrails are automatically applied to new accounts in the Workloads OU and cannot be bypassed by local account administrators or the root user.

Which solution meets these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Create a Service Control Policy (SCP) that denies the securityhub:DisableSecurityHub, guardduty:DeleteDetector, and config:DeleteConfigurationRecorder actions. Add a condition to the SCP using the ArnNotEquals operator to exclude arn:aws:iam::*:role/SecurityIncidentResponseRole from the restriction. Attach the SCP to the Workloads OU.

Cevap

Create a Service Control Policy (SCP) that denies the securityhub:DisableSecurityHub, guardduty:DeleteDetector, and config:DeleteConfigurationRecorder actions. Add a condition to the SCP using the ArnNotEquals operator to exclude arn:aws:iam::*:role/SecurityIncidentResponseRole from the restriction. Attach the SCP to the Workloads OU.
The correct solution uses a Service Control Policy (SCP) attached to the Workloads Organizational Unit (OU) to enforce restrictions across all member accounts. Because SCPs apply to all users and roles within member accounts, including the root user, they serve as effective administrative guardrails that cannot be bypassed by local administrators. By using the ArnNotEquals condition key on aws:PrincipalARN, the policy successfully excludes the specified incident response role from the deny statement, enabling central security teams to perform necessary remediation actions. Attaching the SCP to the OU ensures that any newly created accounts automatically inherit these restrictions, providing maximum operational efficiency.

Adım Adım Çözüm

1
Identify the governance mechanism that can restrict the root user and all administrative roles in member accounts.
Service Control Policies (SCPs) are selected because they establish permission guardrails that apply to all principals in member accounts, including the root user, and cannot be modified or bypassed by local account administrators.
IAM permissions boundaries and local IAM policies cannot restrict the root user and can be detached by local administrators with IAM privileges.
2
Determine the method to apply the restrictions automatically to new accounts.
Attach the SCP directly to the Workloads Organizational Unit (OU).
AWS Organizations supports policy inheritance, meaning any sub-OUs or child accounts added to the Workloads OU automatically inherit the attached SCP, minimizing operational overhead.
3
Configure the exclusion rule within the SCP for the centralized security role.
Add a Deny rule with a condition block using the ArnNotEquals operator, targeting aws:PrincipalARN with the wildcard pattern matching the role across all accounts.
The condition evaluates to false when the caller is the specified role, bypassing the Deny effect and allowing the role to perform the required actions, while applying the Deny to all other principals.

Anahtar Kavram

Organizational governance using Service Control Policies (SCPs) with conditional exclusions
Tahmini Süre:3m 0s
Soru 689Soru →

An enterprise is designing a multi-account AWS environment in the `us-east-1` Region. The architecture includes 1515 spoke VPCs split across two AWS accounts, and a centralized shared services VPC in a third AWS account under the same AWS Organization. The spoke VPCs need to securely access tools in the shared services VPC and communicate with each other. The solutions architect must design a highly scalable network topology that minimizes routing complexity and administrative overhead as new spoke VPCs are provisioned. Which TWO actions should the Solutions Architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision an AWS Transit Gateway in a designated network services account, share the Transit Gateway with the other accounts using AWS Resource Access Manager (RAM), and attach all spoke VPCs and the shared services VPC to the Transit Gateway.; Configure the route tables in all spoke VPCs to point traffic destined for the other VPC ranges to the Transit Gateway attachment, and use the default Transit Gateway route table to propagate and associate the VPC attachments.

Cevap

To meet the requirements with minimal administrative overhead, the Solutions Architect should provision an AWS Transit Gateway in a centralized network services account, share it using AWS Resource Access Manager (RAM) to allow other accounts to attach their VPCs, and update the route tables in all spoke VPCs to point traffic destined for the other VPC ranges to the Transit Gateway attachment.
The correct architecture uses AWS Transit Gateway to establish a hub-and-spoke network topology across accounts. Sharing the Transit Gateway via AWS Resource Access Manager (RAM) allows the spoke accounts to attach their VPCs to the Transit Gateway. By updating the spoke VPC route tables to point to the Transit Gateway attachment for cross-VPC destinations, traffic is transitively routed through the Transit Gateway to other spoke VPCs and the shared services VPC.

Adım Adım Çözüm

1
Deploy and share AWS Transit Gateway
An AWS Transit Gateway is provisioned in the central account and shared using AWS Resource Access Manager (RAM) to all accounts within the AWS Organization.
This centralizes transit network management and allows the other accounts to attach their VPCs without manual peer-to-peer setup.
2
Create VPC attachments
Each of the 1515 spoke VPCs and the shared services VPC are attached to the shared Transit Gateway.
This registers the VPC subnets with the Transit Gateway so traffic can flow into and out of the hub.
3
Configure route tables
VPC route tables are configured with routes targeting the Transit Gateway attachment for non-local VPC CIDRs, and the Transit Gateway route table handles propagation and association.
This ensures that traffic destined for other VPCs is routed to the Transit Gateway, which then dynamically routes it to the correct destination attachment.

Anahtar Kavram

AWS Transit Gateway simplifies multi-account hub-and-spoke networking by acting as a centralized cloud router, which removes the scaling and administrative limitations of point-to-point VPC peering or Direct Connect Gateway transitive routing.
Soru 690Soru →

A financial services institution manages its multi-account environment on AWS using AWS Organizations. A central Transit Gateway (TGW) in the Net-Services account interconnects all corporate VPCs, and an AWS Direct Connect (DX) connection with a Transit VIF links the TGW to the on-premises datacenter. A central Hub VPC in the Net-Services account handles centralized network services. The institution has recently acquired a fintech startup, which operates in a separate AWS Organization. The startup's application runs in a VPC (`vpc-fintech`) and utilizes a Route 53 Private Hosted Zone (PHZ) for `fintech.internal` in the startup's AWS account. The security and networking requirements are: 1) Bidirectional DNS resolution must be enabled between all AWS VPCs and the on-premises network. 2) The PHZ `fintech.internal` must remain in the startup's account due to strict governance, but must be resolvable by all corporate VPCs and on-premises. 3) No VPC Peering is allowed between the corporate accounts and the startup account; all routing must go through the Transit Gateway. Which DNS architecture strategy should a solutions architect recommend to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Submit a cross-account hosted zone association authorization from the startup's account to associate `fintech.internal` with the corporate Hub VPC and other VPCs, then associate them using the AWS CLI or SDK. Deploy Route 53 Resolver Inbound and Outbound Endpoints in the Hub VPC. Create Outbound Resolver Rules for the on-premises domain `corp.internal` pointing to the on-premises DNS servers, share them via AWS RAM with all organization accounts, and associate them with all VPCs. Configure on-premises DNS forwarders to point queries for `fintech.internal` to the Hub VPC Inbound Endpoint IPs.

Cevap

Submit a cross-account hosted zone association authorization from the startup's account to associate the Private Hosted Zone with the corporate VPCs, accept it in the corporate accounts, and configure central Route 53 Resolver Inbound and Outbound Endpoints in the Hub VPC to route queries between on-premises and AWS via RAM-shared rules.
The correct solution uses Route 53 cross-account private hosted zone (PHZ) association to allow the corporate VPCs to resolve startup domains. To make the PHZ resolvable from on-premises, the corporate Hub VPC is associated with the startup's PHZ, allowing the Route 53 Resolver Inbound Endpoint in the Hub VPC to handle incoming DNS queries for the startup domain. Route 53 Resolver Outbound Endpoints in the Hub VPC, paired with Outbound Rules shared via AWS RAM, allow the corporate VPCs to forward queries for on-premises domains to the on-premises DNS servers.

Adım Adım Çözüm

1
Authorize the cross-account association of the startup's Private Hosted Zone (`fintech.internal`) with the corporate Hub VPC and other VPCs using the startup's AWS account credentials.
An association authorization is created in Route 53 for the target VPCs.
Route 53 Private Hosted Zones cannot be shared via AWS RAM; they require a manual or scripted association authorization process across accounts.
2
Associate the Private Hosted Zone with the Hub VPC and other consumer VPCs from the Net-Services and application accounts.
The corporate VPCs are associated with the `fintech.internal` zone, enabling DNS resolution for that namespace inside those VPCs.
This allows resources in the corporate VPCs to resolve the startup's domains natively via the local Route 53 Resolver.
3
Create Route 53 Resolver Inbound and Outbound Endpoints in the Hub VPC of the Net-Services account.
Inbound and Outbound Endpoints are established with dedicated IPs in the Hub VPC.
Inbound endpoints allow the on-premises DNS servers to query AWS DNS. Outbound endpoints allow AWS VPCs to query on-premises DNS.
4
Configure Route 53 Resolver Outbound Rules for the on-premises domain `corp.internal` pointing to the on-premises DNS servers. Share these rules using AWS RAM with the corporate organization.
All corporate VPCs inherit the Outbound Rules and forward `corp.internal` queries to the on-premises DNS servers.
Sharing rules via RAM reduces administrative overhead compared to recreating endpoints and rules in every account.

Anahtar Kavram

Cross-account Route 53 Private Hosted Zone (PHZ) association paired with Route 53 Resolver endpoints for hybrid, multi-account DNS resolution.
Soru 691Soru →

A retail conglomerate is establishing a centralized compliance and security auditing solution across its multi-account AWS Organization. The architecture requires that an organization-wide AWS CloudTrail trail be deployed to consolidate management and data events from all member accounts into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using SSE-KMS with a Customer Managed Key (CMK). The solution must ensure that member accounts cannot modify the auditing infrastructure or view the logs of other accounts, and it must enforce that all logs are encrypted using the designated key. Which TWO of the following configurations must a solutions architect implement to satisfy these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket policy in the Security account to grant s3:PutObject and s3:GetBucketAcl permissions to the cloudtrail.amazonaws.com service principal, restricting access using the aws:PrincipalOrgID condition key matching the organization ID.; Configure the KMS key policy of the Customer Managed Key in the Security account to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the cloudtrail.amazonaws.com service principal, using the aws:SourceArn condition key to restrict access to the organization trail ARN.

Cevap

The correct configurations are to configure the S3 bucket policy in the Security account to allow the CloudTrail service principal with an organizational ID condition, and to configure the key policy of the KMS Customer Managed Key in the Security account to grant the CloudTrail service principal permissions for generating data keys.
The correct solution involves configuring both the S3 bucket policy and the KMS Customer Managed Key key policy to grant direct access to the CloudTrail service principal. The S3 bucket policy must allow the service to perform s3:PutObject and s3:GetBucketAcl, using the aws:PrincipalOrgID condition to restrict delivery to the organization. Additionally, since AWS-managed KMS keys cannot be shared cross-account, a Customer Managed Key must be used, and its policy must authorize the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey actions, restricted by the trail's source ARN.

Adım Adım Çözüm

1
Configure S3 Bucket Policy
The S3 bucket in the Security account is configured to accept log files from the CloudTrail service principal, restricted to the specific organization.
CloudTrail requires explicit s3:PutObject and s3:GetBucketAcl permissions on the target bucket to deliver logs cross-account.
2
Configure KMS Key Policy
The Customer Managed Key in the Security account allows the CloudTrail service principal to generate data keys for encryption.
AWS-managed keys cannot be shared cross-account, so a Customer Managed Key is required. Its key policy must grant permissions to the CloudTrail service principal.

Anahtar Kavram

Cross-account centralized auditing requires configuring resource policies (S3 bucket policy and KMS key policy) to authorize the CloudTrail service principal using organization and resource ARN constraints.
Soru 692Soru →

A public transit authority is designing a disaster recovery (DR) strategy for its new fare validation and ticketing API across two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). The application runs on EC2 instances in private subnets behind an internal Application Load Balancer (ALB) and requires redundant outbound connectivity to transit gates via NAT Gateways. The database is Amazon Aurora PostgreSQL. The system has a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. Costs in the secondary region must be minimized during normal operations. The fare validation gates in both regions must resolve the internal endpoint api.transit.internal to their respective regional ALBs. Which of the following solutions meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In the secondary VPC, deploy the application tier using an Auto Scaling group configured with a minimum capacity of 1, and deploy redundant NAT Gateways across multiple Availability Zones. Create a single Route 53 Private Hosted Zone for transit.internal and associate it with the VPCs in both regions. Configure a Route 53 Failover routing policy for api.transit.internal that uses Route 53 health checks associated with CloudWatch alarms monitoring the primary ALB. During failover, promote the secondary Aurora cluster and scale up the Auto Scaling group in us-west-2.

Cevap

Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In the secondary VPC, deploy the application tier using an Auto Scaling group configured with a minimum capacity of 1, and deploy redundant NAT Gateways across multiple Availability Zones. Create a single Route 53 Private Hosted Zone for transit.internal and associate it with the VPCs in both regions. Configure a Route 53 Failover routing policy for api.transit.internal that uses Route 53 health checks associated with CloudWatch alarms monitoring the primary ALB. During failover, promote the secondary Aurora cluster and scale up the Auto Scaling group in us-west-2.
The correct solution uses Amazon Aurora Global Database to achieve near-instantaneous cross-region replication, fitting the 1-minute RPO. The warm standby pattern (Auto Scaling group running at a minimum capacity of 1) keeps costs low while allowing the application to scale up rapidly within the 15-minute RTO during failover. Outbound high availability is maintained in the disaster recovery VPC by deploying NAT Gateways in multiple Availability Zones. Private DNS resolution for the shared domain name is achieved by creating a single Route 53 Private Hosted Zone and associating it with both VPCs, and a Route 53 Failover routing policy with health checks linked to CloudWatch alarms automates internal client-side redirection.

Adım Adım Çözüm

1
Select a database replication mechanism that meets the RPO constraint.
Aurora Global Database is selected because it replicates data continuously with latency typically under 1 second, meeting the 1-minute RPO, whereas hourly snapshots would violate this limit.
Choosing the correct replication technology is primary to meeting data loss tolerances (RPO).
2
Establish the application recovery pattern matching the RTO constraint and cost goals.
A warm standby application tier using Auto Scaling (minimum capacity of 1) in the secondary region is chosen, which can be quickly scaled up in under 15 minutes while minimizing compute cost during normal operations.
An active-active setup is too costly and backup-and-restore from scratch exceeds the 15-minute RTO.
3
Design high availability for outbound traffic in the secondary region.
NAT Gateways are deployed in multiple Availability Zones within the secondary VPC.
Using a single NAT Gateway in the secondary region would create a single point of failure, violating high availability principles.
4
Configure DNS routing and VPC associations for the private API endpoint.
A single Route 53 Private Hosted Zone is created and associated with both the primary and secondary VPCs, with failover routing records pointing to the respective regional Application Load Balancers.
A single Private Hosted Zone associated with both VPCs ensures that name resolution works internally across both regions without split-brain resolution errors or failure to resolve.

Anahtar Kavram

Designing a cost-effective warm standby disaster recovery architecture with Route 53 private failover routing and Aurora Global Database replication.
Tahmini Süre:3m 0s
Soru 693Soru →

An enterprise is designing a highly resilient hybrid network across two AWS Regions: `us-east-1` (Primary, with 3030 spoke VPCs) and `us-west-2` (Disaster Recovery, with 1515 spoke VPCs). The spoke VPCs in each region are connected to regional Transit Gateways (`TGW-East` and `TGW-West`), which are peered. The on-premises network uses the CIDR block `172.16.0.0/12172.16.0.0/12`. The enterprise has a 10 Gbps AWS Direct Connect (DX) connection terminating in `us-east-1` via a Direct Connect Gateway (`DXGW`) associated with both Transit Gateways. For redundancy, they deploy AWS Site-to-Site VPN connections from the on-premises datacenter to both `TGW-East` (`VPN-East`) and `TGW-West` (`VPN-West`). The spoke VPC CIDR ranges are `10.100.0.0/1610.100.0.0/16` for `us-east-1` and `10.200.0.0/1610.200.0.0/16` for `us-west-2`.

The architecture must satisfy the following constraints:
1. Under normal operations, all hybrid traffic must use the DX connection.
2. If the DX connection fails, traffic to and from `us-east-1` must fail over to `VPN-East`, and traffic to and from `us-west-2` must fail over to `VPN-West`.
3. Cross-region routing over the TGW peering link must not be used for hybrid traffic during a DX failure unless the local region's VPN is also down.
4. Asymmetric routing must be avoided to maintain stateful firewall inspection on-premises.

Which configuration strategy will meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Enable route propagation from the DXGW and the local VPN attachment in the TGW route tables associated with the spoke VPCs in each region. For inter-VPC traffic, add a static route for the remote region's VPC CIDR pointing to the TGW peering attachment. For last-resort hybrid failover, add a static route for a supernet of the on-premises network (such as `172.0.0.0/8172.0.0.0/8`) pointing to the TGW peering attachment. On the customer gateway, configure BGP local preference to prefer the DX connection, and configure inbound route maps to decrease the local preference of the `10.200.0.0/1610.200.0.0/16` route received via `VPN-East` and the `10.100.0.0/1610.100.0.0/16` route received via `VPN-West`.

Cevap

Enable route propagation from the DXGW and local VPN attachments. Use a static supernet route pointing to the TGW peering attachment for last-resort failover, and adjust the customer gateway's local preference for inbound routes to prevent asymmetric routing.
The correct strategy relies on route propagation for the primary paths and a less-specific static supernet route for the cross-region backup path. Under Transit Gateway routing logic, a propagated route from a local VPN (e.g., `172.16.0.0/12172.16.0.0/12`) will be preferred over a static route of a shorter prefix length (e.g., `172.0.0.0/8172.0.0.0/8`) due to Longest Prefix Match. This allows the local VPN to be preferred for failover while still maintaining the peered TGW path as a last-resort route. Adjusting BGP local preference on the customer gateway ensures symmetric routing by directing traffic to the respective local VPN tunnels.

Adım Adım Çözüm

1
Evaluate the path preference for AWS-to-on-premises traffic under normal operations.
By default, Transit Gateway path selection evaluates attachment types in the following order: VPC, DXGW, Connect, VPN, Peering. Since both DXGW and the local VPN propagate the `172.16.0.0/12172.16.0.0/12` route, the DXGW attachment is preferred, sending all outbound traffic over Direct Connect.
This satisfies the requirement to use the DX connection under normal operations.
2
Address the behavior during a DX failure and the constraint to avoid cross-region TGW peering unless necessary.
When the DX link fails, the DXGW route is withdrawn. The TGW must choose between the local VPN (propagated) and the TGW peering link. In Transit Gateway route tables, static routes are always preferred over propagated routes of the same prefix length. Therefore, adding a static route for `172.16.0.0/12172.16.0.0/12` pointing to the peering attachment would override the propagated local VPN route, forcing traffic across regions. To prevent this, a less-specific route like `172.0.0.0/8172.0.0.0/8` (a supernet) is defined for the peering attachment. Due to Longest Prefix Match (LPM), the TGW will prefer the local VPN's `172.16.0.0/12172.16.0.0/12` route over the peering attachment's `172.0.0.0/8172.0.0.0/8` route.
This guarantees that the local VPN is used for failover and the peering link acts strictly as a last-resort backup.
3
Prevent asymmetric routing for traffic originating from the on-premises datacenter.
On the customer gateway, the local preference must be set higher for routes received via the DX connection to ensure normal inbound traffic uses DX. To prevent asymmetric routing during a DX failure, the customer gateway must route `10.100.0.0/1610.100.0.0/16` via `VPN-East` and `10.200.0.0/1610.200.0.0/16` via `VPN-West`. This is accomplished by applying inbound route maps on the customer gateway that decrease the local preference of cross-region routes received over the VPN tunnels.
This ensures symmetric paths for stateful firewall inspection at the customer gateway.

Anahtar Kavram

Transit Gateway Route Selection Order and Longest Prefix Match Interaction
Tahmini Süre:3m 0s
Soru 694Soru →

A healthcare provider is designing a SaaS clinical trials management application deployed across two AWS Regions: `us-east-1` (primary) and `us-west-2` (secondary). The application uses Amazon ECS on AWS Fargate for compute and an Amazon Aurora PostgreSQL database. The architecture must achieve a recovery point objective (RPO) of 1 minute and a recovery time objective (RTO) of 15 minutes for disaster recovery. Client requests must be routed to the primary region during normal operations, and automatically failover to the secondary region if the primary region becomes unhealthy. Internally, microservices in different VPCs across both regions must resolve the database's private endpoints using a shared Route 53 Private Hosted Zone (PHZ). Outbound internet connectivity from Fargate tasks to external health registries must be resilient against Availability Zone (AZ) outages in each region.

Which two options should the Solutions Architect implement to satisfy these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Route 53 public DNS with a primary failover routing policy pointing to the Application Load Balancer (ALB) in `us-east-1` and a secondary failover routing policy pointing to the ALB in `us-west-2`, linking both to health checks. Create an Amazon Aurora Global Database with the primary cluster in `us-east-1` and a secondary cluster in `us-west-2`. Associate the shared Route 53 PHZ containing the database endpoint with all VPCs in both regions.; Deploy a NAT Gateway in each Availability Zone of the VPCs in both regions, and configure the private subnets' route tables to point outbound internet traffic to the local NAT Gateway in their respective Availability Zone.

Cevap

To meet the requirements, the Solutions Architect must implement Route 53 public DNS failover routing, Amazon Aurora Global Database with the Private Hosted Zone associated across all VPCs in both regions, and deploy redundant NAT Gateways in each Availability Zone in both regions.
The correct solution requires configuring Route 53 failover routing to direct public traffic to the active region and failover when needed, utilizing Aurora Global Database to achieve low latency replication (seconds RPO) and rapid failover (seconds/minutes RTO) to meet the 1-minute RPO and 15-minute RTO targets. Additionally, Route 53 Private Hosted Zones must be associated with each VPC in both regions to allow internal microservices to resolve the database private endpoints. To ensure high availability of outbound connections for the Fargate tasks, NAT Gateways must be deployed in each Availability Zone so that an AZ outage does not isolate the tasks running in the other AZs.

Adım Adım Çözüm

1
Set up Route 53 public DNS failover records pointing to the ALBs in the primary and secondary regions, linked to health checks.
Establishes automatic client-side regional failover (active-passive routing).
Allows traffic to be redirected from the primary region to the secondary region if the primary region goes down.
2
Provision an Amazon Aurora Global Database with the primary cluster in the primary region and the secondary cluster in the secondary region.
Enables physical cross-region storage replication with sub-minute latency.
Supports the 1-minute RPO and 15-minute RTO disaster recovery requirements.
3
Associate the Route 53 Private Hosted Zone (PHZ) containing the database endpoint with all VPCs across both regions.
Allows microservices in all VPCs to resolve the database private domain name locally.
Correctly configures private DNS resolution across VPCs and regions without relying on invalid forwarding loops.
4
Provision a NAT Gateway in each public subnet across all Availability Zones in both regions.
Provides redundant outbound paths for ECS Fargate tasks in the private subnets.
Protects against Availability Zone outages, preventing an outage in one AZ from breaking outbound internet access for resources in other AZs.

Anahtar Kavram

Designing multi-region active-passive architectures with Aurora Global Database, Private Hosted Zone VPC association, and multi-AZ NAT Gateway redundancy.
Soru 695Soru →

A global retail company is designing a multi-account AWS environment managed under AWS Organizations. The company wants to enable federated single sign-on (SSO) for its systems administrators. The administrators must authenticate using the company's existing on-premises SAML 2.0 compliant Identity Provider (IdP) to directly access and manage resources in individual member accounts. Which two of the following configuration steps must be performed in each AWS member account to establish this federation?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a SAML identity provider entity in each AWS member account using the XML metadata document exported from the corporate identity provider.; Create an IAM role in each AWS member account with a trust policy that allows the sts:AssumeRoleWithSAML action and designates the local SAML identity provider as the principal.

Cevap

To establish direct SAML federation to each AWS member account, you must create a SAML identity provider entity in each member account using the corporate IdP metadata and configure an IAM role in each member account with a trust policy permitting the sts:AssumeRoleWithSAML action for that provider.
To configure direct SAML 2.0 federation for member accounts, you must establish trust in each account by creating a SAML identity provider using the IdP's metadata. Then, you must create an IAM role in each account whose trust policy permits the sts:AssumeRoleWithSAML action, allowing the external provider to exchange SAML tokens for temporary credentials.

Adım Adım Çözüm

1
Register the Identity Provider in the AWS accounts.
A local IAM SAML identity provider is created in each target member account.
AWS needs to establish a trust relationship with the external SAML 2.0 IdP using its public keys and metadata.
2
Define the IAM roles for federated access.
An IAM role is created with the necessary permissions for administrators.
Federated users must assume a role to perform actions; the role maps SAML attributes to AWS permissions.
3
Configure the trust relationship on the IAM roles.
The role's trust policy allows the sts:AssumeRoleWithSAML action with the local SAML provider as the principal.
This configuration allows AWS STS to authenticate the SAML assertions and return temporary credentials.

Anahtar Kavram

Multi-Account SAML 2.0 Federation Setup
Soru 696Soru →

An enterprise is designing a multi-account AWS environment using AWS Organizations. The security team requires all CloudTrail logs from all member accounts to be aggregated into a centralized Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a Key Management Service (KMS) key. Additionally, member accounts must be prohibited from modifying or disabling the logging configuration. Which of the following configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an organization trail in AWS CloudTrail from the management account that sends logs to the centralized S3 bucket in the Security account, and encrypt the logs using a Customer Managed Key (CMK) in the Security account with a key policy that allows the CloudTrail service principal cross-account access.; Attach a Service Control Policy (SCP) to the organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions to prevent member accounts from altering the logging configuration.

Cevap

To secure centralized logging in a multi-account environment, the Solutions Architect must deploy an organization trail in AWS CloudTrail using a Customer Managed Key in the Security account with appropriate cross-account permissions, and enforce trail protection by attaching an SCP to the organization root that denies deletion or modification of CloudTrail configurations.
Deploying an organization trail from the management account ensures consistent logging across all member accounts. Since the logs must be encrypted, a Customer Managed Key (CMK) is required in the Security account to permit the cross-account CloudTrail service principal to write encrypted objects. To prevent member accounts from changing this setup, a Service Control Policy (SCP) must be attached to the root of the organization to deny unauthorized modifications to CloudTrail configurations.

Adım Adım Çözüm

1
Set up a centralized S3 bucket in the Security account.
An S3 bucket is prepared with a bucket policy that permits writes from the CloudTrail service principal.
Allows member accounts to centralize their logs securely.
2
Create a Customer Managed Key (CMK) in the Security account.
A CMK is created with a key policy allowing the CloudTrail service principal to perform encrypt/decrypt actions cross-account.
AWS-managed keys cannot be shared across accounts, making a Customer Managed Key necessary for cross-account log encryption.
3
Deploy an AWS CloudTrail Organization Trail.
An organization trail is created from the management account, automatically covering all member accounts.
Ensures that logging is turned on consistently for all existing and future accounts.
4
Create and attach an SCP to the organization root.
An SCP is attached to block modification or deletion of trails in member accounts.
Prevents member account administrators from tampering with or turning off logging.

Anahtar Kavram

Multi-account governance through organization trails, cross-account KMS CMK policies, and Service Control Policies as permission boundaries.
Soru 697Soru →

An enterprise is designing a deployment strategy for a stateless API service running on Amazon EC2 instances in Auto Scaling groups behind Application Load Balancers across 33 AWS Regions. The deployment must achieve zero downtime, restrict the blast radius by deploying sequentially across regions, and perform a gradual traffic shift (starting with 10%10\% of traffic) within each region to monitor for application errors. The deployment must automatically roll back immediately if the error rate or p99p99 latency exceeds defined thresholds, and the rollout to subsequent regions must be halted. Which deployment architecture meets these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Deploy updates using AWS CodePipeline to orchestrate a sequential deployment across Regions. In each Region stage, configure AWS CodeDeploy to perform a blue/green deployment. CodeDeploy shifts 10%10\% of traffic to the green Auto Scaling group using an Application Load Balancer, monitors CloudWatch alarms, and automatically rolls back traffic to the blue group if thresholds are breached.

Cevap

Deploy updates using AWS CodePipeline to orchestrate a sequential deployment across Regions. In each Region stage, configure AWS CodeDeploy to perform a blue/green deployment. CodeDeploy shifts traffic to the green Auto Scaling group using an Application Load Balancer, monitors CloudWatch alarms, and automatically rolls back traffic to the blue group if thresholds are breached.
The correct strategy uses AWS CodePipeline for sequential cross-region orchestration and AWS CodeDeploy to execute blue/green deployments. CodeDeploy handles traffic shifting at the Application Load Balancer level, which allows a precise 10%10\% traffic cutover and immediate rollback to the active blue group if CloudWatch alarms (tracking error rate and p99p99 latency) are triggered, ensuring zero downtime.

Adım Adım Çözüm

1
Define the pipeline structure for multi-region coordination and blast radius control.
AWS CodePipeline is chosen to deploy sequentially across the target Regions, ensuring that a failure in an early Region stops the pipeline.
Sequential regional stages isolate the deployment's blast radius to a single Region at a time.
2
Select the traffic shifting mechanism for fine-grained application testing.
AWS CodeDeploy is selected to perform blue/green deployments using Application Load Balancer target group weights to shift 10%10\% of traffic, rather than using Route 53 DNS weights.
Load-balancer-level traffic shifting bypasses client-side DNS caching limitations, enabling precise and immediate traffic distribution.
3
Configure the automated rollback triggers and execution flow.
CloudWatch alarms monitoring error rate and latency are integrated directly into the CodeDeploy deployment. If triggered, CodeDeploy immediately shifts 100%100\% of traffic back to the original blue Auto Scaling group and terminates the green instances.
Keeping the original Auto Scaling group active during the bake period allows for instant rollback with zero downtime.

Anahtar Kavram

AWS CodeDeploy Blue/Green deployments for EC2 utilize Application Load Balancer target group traffic shifting to enable precise, immediate traffic redirection and instant rollback, bypassing DNS caching limitations associated with Route 53 weighted routing.
Soru 698Soru →

An enterprise is integrating a newly acquired, standalone AWS account into its AWS Organizations structure managed by AWS Control Tower. The solutions architect must prepare the account for enrollment while preventing errors due to pre-existing resources and ensuring the environment conforms to the landing zone's centralized policies. Arrange the following steps in the correct chronological sequence to successfully onboard and baseline this account in AWS Control Tower.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with inviting the standalone account to join the organization, followed by creating the cross-account administrative role, removing any active AWS Config recorders and delivery channels, moving the account to a registered organizational unit, and finally triggering the AWS Control Tower enrollment.
The correct onboarding sequence ensures that the target account is first brought into the organization boundary, after which the administrative trust role (AWSControlTowerExecution) is established. Before invoking enrollment, any conflicting local AWS Config resources must be deleted to prevent StackSet failures. The account is then moved into the registered OU, and the enrollment process is triggered to apply Control Tower's baselines and guardrails.

Adım Adım Çözüm

1
Invite and accept the standalone account into the organization.
The standalone account is successfully added to the AWS Organization as a member account.
This establishes the organizational boundary and trust required for subsequent configuration.
2
Create the AWSControlTowerExecution IAM role in the member account.
An IAM role named AWSControlTowerExecution with AdministratorAccess is established, trusting the management account.
AWS Control Tower must have delegated administrative access to configure resources and establish baselines in the member account.
3
Delete existing AWS Config recorders and delivery channels.
All existing local AWS Config configuration recorders and delivery channels are removed in the target regions.
This prevents configuration duplication errors that automatically fail the AWS Control Tower stack execution during enrollment.
4
Move the member account into a governed Organizational Unit.
The account is relocated to an OU registered under AWS Control Tower control.
This step ensures that once enrollment is initiated, the correct SCPs and default configurations are inherited by the account.
5
Initiate enrollment from the AWS Control Tower console.
The enrollment process executes, setting up baselines and guardrails.
This triggers the final orchestration steps to officially enroll the account under Control Tower management.

Anahtar Kavram

AWS Control Tower Account Onboarding Workflow
Tahmini Süre:3m 0s
Soru 699Soru →

A company is planning to launch a promotion that will cause an immediate, massive traffic spike (by a factor of 100) to its web application. The application's architecture consists of an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS for MySQL Multi-AZ DB instance. Which two actions should a solutions architect recommend to optimize performance and ensure the application scales effectively to meet this demand?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Contact AWS Support to pre-warm the Application Load Balancer (ALB) before the event.; Deploy Amazon RDS Read Replicas and modify the application to direct read traffic to the read replicas.

Cevap

Contacting AWS Support to pre-warm the Application Load Balancer (ALB) and deploying Amazon RDS Read Replicas to offload read traffic are the correct actions to optimize performance and scalability.
Pre-warming the Application Load Balancer ensures it is configured with enough capacity to handle the sudden surge without dropped connections. Creating Amazon RDS Read Replicas allows the database to offload read queries from the primary instance, scaling the database tier horizontally.

Adım Adım Çözüm

1
Evaluate the database tier capability to scale reads.
Identify that the standby DB instance in a Multi-AZ deployment cannot serve read traffic, making Read Replicas the correct mechanism for scaling reads.
Ensures read queries are offloaded from the primary writer instance during peak load.
2
Evaluate the load balancer capability to handle flash traffic.
Identify that the Application Load Balancer's default scaling is too slow for an instantaneous 100x spike, requiring manual pre-warming.
Prevents dropped requests and connection timeouts at the entry point of the application.
3
Verify Auto Scaling group configuration to avoid scaling thrashing.
Ensure that the cooldown period is longer than the instance boot and configuration time.
Allows new instances to become healthy and start taking load before the Auto Scaling group decides to scale out further.

Anahtar Kavram

Scaling database reads using Read Replicas and managing sudden load balancer traffic spikes via pre-warming.
Soru 700Soru →

A health-tech corporation is migrating its clinical management platform to AWS. The infrastructure is organized under AWS Organizations with a multi-account structure:

* A central Network VPC in a Shared Services account connects to the on-premises data center via a 10 Gbps AWS Direct Connect connection terminating at an AWS Transit Gateway.
* Multiple Application VPCs in separate AWS accounts host the containerized services and are attached to the Transit Gateway.
* A Route 53 Private Hosted Zone (PHZ) for `clinical.local` is created in the Shared Services account.
* The on-premises domain is `corp.internal`, and on-premises servers host the DNS records for this domain.

To comply with health-tech security regulations, all DNS traffic must remain private. The architecture must enable resources in all Application VPCs to resolve both `clinical.local` and `corp.internal` domains, and on-premises servers must be able to resolve `clinical.local` domains.

Which of the following actions should the solutions architect perform to meet these requirements? (Select TWO).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the Shared Services account, configure a Route 53 Resolver outbound endpoint in the Network VPC. Create a forwarding rule for `corp.internal` pointing to the on-premises DNS servers, share the rule with the AWS Organization using AWS Resource Access Manager (RAM), and associate it with the Application VPCs.; In the Shared Services account, authorize the association of the `clinical.local` Private Hosted Zone with the Application VPCs in the other accounts using the AWS CLI or Route 53 API, and then create the associations in those application accounts.

Cevap

Configure a Route 53 Resolver outbound endpoint in the central Network VPC, create a forwarding rule for the on-premises domain, share it via AWS RAM, and associate it with the Application VPCs; and authorize the cross-account association of the Private Hosted Zone with the Application VPCs using the AWS CLI or Route 53 API, then create the associations in those accounts.
To establish hybrid DNS resolution, the architect must create a Route 53 Resolver outbound endpoint in the central Network VPC, define a rule forwarding queries for `corp.internal` to the on-premises DNS servers, share this rule with the organization via AWS RAM, and associate it with the application VPCs. Additionally, for the application VPCs to resolve the Private Hosted Zone `clinical.local` hosted in the Shared Services account, the architect must authorize the cross-account VPC association using the Route 53 API/CLI and then associate the VPCs in each application account.

Adım Adım Çözüm

1
Set up outbound name resolution for the on-premises domain.
Create a Route 53 Resolver outbound endpoint in the central Network VPC. Create a forwarding rule for `corp.internal` pointing to the on-premises DNS server IP addresses.
This allows Route 53 to forward queries for the on-premises domain to the on-premises DNS servers.
2
Distribute the outbound resolver rule across the AWS Organization.
Use AWS Resource Access Manager (RAM) to share the forwarding rule with the organization, and associate it with the Application VPCs.
This avoids having to create outbound endpoints in every application VPC, centralizing outbound DNS traffic and reducing costs.
3
Set up cross-account Private Hosted Zone (PHZ) resolution.
Authorize the association of the `clinical.local` PHZ with the Application VPCs from the Shared Services account, and then perform the association from each application VPC's account.
Because Private Hosted Zones cannot be shared via AWS RAM, cross-account VPC association requires Route 53 API-level authorization and association.

Anahtar Kavram

Cross-account Private Hosted Zone association and Route 53 Resolver rules configuration for hybrid environments
Tahmini Süre:2m 0s
ÖncekiSayfa 35 / 99Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin