Tüm alıştırma soruları

1964 soru

Tüm türler1,964 Çoktan seçmeli1,006 Çoklu seçim931 Sıralama27

A logistics corporation is migrating its legacy workloads to a multi-account environment managed by AWS Organizations. The new structure consists of three organizational units (OUs): Core-Services, Workloads-Dev, and Workloads-Prod. The security team mandates the following governance controls:

* Developers in Workloads-Dev must be prohibited from deploying internet-facing Application Load Balancers (ALBs) or provisioning internet gateways, while retaining permissions to deploy private workloads.
* No entity, including the administrative role within member accounts, in Workloads-Prod may delete or modify Amazon GuardDuty configurations, AWS Security Hub settings, or AWS CloudTrail trails.
* AWS CloudTrail logs from all accounts must be aggregated into a central Amazon S3 bucket within a dedicated Log-Archive account, encrypted using a KMS key.

Which two actions should the solutions architect take to implement these controls?

Geçerli olan tümünü seçin

Attach a Service Control Policy (SCP) to the Workloads-Dev OU that denies ec2:CreateInternetGateway and ec2:AttachInternetGateway, and denies elasticloadbalancing:CreateLoadBalancer if the elasticloadbalancing:Scheme condition key is not equal to internal. Attach a separate SCP to the Workloads-Prod OU that denies guardduty:DeleteDetector, securityhub:DisableSecurityHub, and cloudtrail:DeleteTrail actions.

In the Log-Archive account, create a customer managed KMS key. Configure the key policy to grant the AWS CloudTrail service principal permission to use the key for encrypting logs, and allow cross-account access. Configure the central S3 bucket policy to allow the CloudTrail service principal from the organization to write objects, and reference this KMS key in the CloudTrail configuration for all member accounts.

Create an IAM permissions boundary and apply it to all developer roles in the Workloads-Dev accounts to prevent the creation of public load balancers and internet gateways. For the Workloads-Prod accounts, create an IAM policy that denies security service deletion and attach it directly to the local administrator roles in each member account.

In the Log-Archive account, configure the central S3 bucket to use default encryption with the AWS-managed S3 key (aws/s3). Update the bucket policy to allow the AWS Organizations ID as a principal, ensuring that CloudTrail in all member accounts can write to the bucket and use the default managed key for encryption.

Use AWS Resource Access Manager (RAM) to share the central S3 bucket in the Log-Archive account with all accounts in the organization. Configure CloudTrail in each member account to write to the local RAM resource share, ensuring secure transit and automated compliance reporting.

Cevabı ve açıklamayı göster

Cevap: Attach a Service Control Policy (SCP) to the Workloads-Dev OU that denies ec2:CreateInternetGateway and ec2:AttachInternetGateway, and denies elasticloadbalancing:CreateLoadBalancer if the elasticloadbalancing:Scheme condition key is not equal to internal. Attach a separate SCP to the Workloads-Prod OU that denies guardduty:DeleteDetector, securityhub:DisableSecurityHub, and cloudtrail:DeleteTrail actions.; In the Log-Archive account, create a customer managed KMS key. Configure the key policy to grant the AWS CloudTrail service principal permission to use the key for encrypting logs, and allow cross-account access. Configure the central S3 bucket policy to allow the CloudTrail service principal from the organization to write objects, and reference this KMS key in the CloudTrail configuration for all member accounts.

Cevap

Attach Service Control Policies (SCPs) to the Workloads-Dev and Workloads-Prod OUs to enforce resource restrictions and guardrails. Configure a central S3 bucket in the Log-Archive account and encrypt it using a Customer Managed KMS key configured for cross-account access.

Applying Service Control Policies (SCPs) to the target OUs ensures that the restrictions on public load balancers, internet gateways, and security configurations are enforced for all users, including administrators and the root user. To allow CloudTrail in other accounts to write logs to a centralized S3 bucket, a Customer Managed KMS key in the Log-Archive account must be used since AWS-managed keys do not allow cross-account permissions configuration.

Adım Adım Çözüm

Use AWS Organizations to partition accounts into dedicated OUs (Workloads-Dev, Workloads-Prod, and Core-Services) to enable target-specific policy inheritance.

Establishes a logical organizational structure where governance policies can be applied at scale.

Allows group-level control over accounts rather than configuring governance policies individually per account.

Create and attach an SCP to the Workloads-Dev OU that denies ec2:CreateInternetGateway and ec2:AttachInternetGateway, and conditionally denies elasticloadbalancing:CreateLoadBalancer when elasticloadbalancing:Scheme is not internal.

Prevents developers in the Dev accounts from exposing workloads to the public internet.

SCPs act as guardrails that apply to all roles, including administrators and the root user, ensuring compliance rules cannot be bypassed.

Create and attach an SCP to the Workloads-Prod OU that denies delete/disable API operations on GuardDuty, Security Hub, and CloudTrail.

Secures production auditing and threat detection configurations from unauthorized tampering.

Ensures that even compromised administrator roles in production accounts cannot shut down auditing and detection services.

Create a Customer Managed Key (CMK) in the Log-Archive account, update its key policy to allow cross-account access, and set up an S3 bucket with a policy allowing CloudTrail writes.

Enables multi-account log aggregation with centralized encryption controls.

AWS-managed keys (aws/s3) cannot be shared across accounts because their key policies are locked and cannot be modified.

Anahtar Kavram

Applying OUs, Service Control Policies, and Customer Managed KMS Keys to implement multi-account governance and central logging.

Soru 702Soru →

An enterprise runs a session-dependent stateful web application on Amazon ECS using AWS Fargate, positioned behind an Application Load Balancer (ALB). The application does not use a distributed caching layer; instead, it relies on ALB cookie-based session stickiness to maintain user sessions on individual containers.

A Solutions Architect is designing a deployment strategy for a major application update. The deployment must satisfy the following constraints:
- The total compute capacity provisioned at any point during the deployment must not exceed $125\%$ of the standard desired task count due to strict organizational budget limits.
- Active users must not experience session disruption and must remain routed to the same application version they started on for the duration of their sessions.
- The Solutions Architect must be able to immediately roll back all traffic to the previous version if post-deployment smoke tests fail.

Which two actions should the Solutions Architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Deploy the update by creating a second ECS service for the new version. Gradually adjust the weights of the two target groups on the ALB listener rule while scaling the desired task counts of the two ECS services in opposite directions, ensuring the total running task count never exceeds

125\%

of the standard capacity.

Configure target group-level stickiness on the ALB listener rule's weighted target groups. To execute an immediate rollback if failures are detected, set the weight of the new target group to

0

and disable target group-level stickiness on the listener rule.

Use AWS CodeDeploy to perform an ECS Blue/Green deployment using the default ECS linear traffic-shifting configuration, and configure the ECS service with a maximum percent of

125\%

Configure a single ECS service with an ECS rolling update deployment type, setting the minimum healthy percent to

100\%

and the maximum percent to

125\%

, and rely on ALB target-level stickiness to maintain sessions during the rolling replacement of tasks.

Deploy the update using AWS CloudFormation with a blue/green deployment strategy, using AWS Route 53 weighted routing policy to shift traffic between two independent Application Load Balancers, each serving one version of the ECS service.

Cevabı ve açıklamayı göster

Cevap: Deploy the update by creating a second ECS service for the new version. Gradually adjust the weights of the two target groups on the ALB listener rule while scaling the desired task counts of the two ECS services in opposite directions, ensuring the total running task count never exceeds $125\%$ of the standard capacity.; Configure target group-level stickiness on the ALB listener rule's weighted target groups. To execute an immediate rollback if failures are detected, set the weight of the new target group to $0$ and disable target group-level stickiness on the listener rule.

Cevap

Deploying the update using a second ECS service and adjusting target group weights and task counts manually to respect the

125\%

capacity limit, and enabling target group-level stickiness on the ALB listener rule while disabling it along with setting the new target group's weight to

0

to execute an immediate rollback.

Deploying the update in a second ECS service allows the architect to manually scale the desired counts of the old and new services in opposite directions, keeping the total running task count below the

125\%

limit. Enabling target group-level stickiness on the ALB weighted routing configuration ensures that active sessions remain pinned to their respective target groups (versions). To roll back immediately without waiting for sessions to naturally expire, the new target group weight must be set to

0

and target group-level stickiness must be disabled, which forces the ALB to ignore the client cookie and route all traffic to the old target group.

Adım Adım Çözüm

Analyze the capacity and rollback constraints.

CodeDeploy ECS Blue/Green cannot be used because it deploys the green task set at

100\%

capacity, resulting in

200\%

total capacity during deployment. A single ECS service rolling update cannot be used because rollback is not immediate.

To satisfy the resource constraints, a custom orchestration model using two separate ECS services must be implemented.

Orchestrate traffic shifting and capacity scaling.

Deploy the new version as a second ECS service and register it to a new ALB target group. Scale the services incrementally (e.g.,

100\%

old /

0\%

new ->

75\%

old /

25\%

new ->

50\%

old /

50\%

new) to keep the total task count within

125\%

This guarantees that the combined task count of both services never exceeds the maximum budget limits during the migration process.

Configure session stickiness on the ALB.

Enable target group-level stickiness on the ALB listener rule's weighted target groups.

Target group-level stickiness ensures that once a client is assigned to either the old or new target group based on weights, all subsequent requests are pinned to that target group for the duration of the session.

Define the rollback procedure.

Set the new target group weight to

0

and disable target group-level stickiness on the ALB listener rule.

Setting the weight to

0

stops new sessions from going to the new target group. Disabling target group-level stickiness is required because the ALB normally honors the stickiness cookie even if the weight is

0

. Disabling it forces all clients (including those stuck to the new group) back to the old target group immediately.

Anahtar Kavram

ALB weighted target groups with target group-level stickiness and custom ECS blue/green deployment orchestration.

Soru 703Soru →

A multinational financial services company is designing a multi-account governance strategy using AWS Organizations. The security team has designated a dedicated Security tooling account to aggregate AWS CloudTrail logs from all member accounts. The architecture requires that:
1. CloudTrail logs from all accounts must be encrypted using an AWS KMS key.
2. The logs must be stored in a centralized Amazon S3 bucket within the Security tooling account.
3. Individual member accounts must not be able to modify, delete, or read the logs once written.
4. The management of the Organization's CloudTrail configurations must be delegated to the Security tooling account to adhere to the principle of least privilege for the management account.
5. All operations must minimize administrative overhead.

Which of the following configurations meets these requirements while minimizing administrative overhead?

Configure the S3 bucket policy in the Security tooling account to allow s3:PutObject permissions to a wildcard principal (*) while relying on a Service Control Policy (SCP) attached to the Organization root to restrict writing to only the organization's member accounts. Use the AWS-managed KMS key aws/s3 for log encryption to avoid managing custom KMS key policies, and enable CloudTrail in each member account individually.

Configure AWS CloudTrail delegated administration in the management account, designating the Security tooling account. Create a centralized S3 bucket in the Security tooling account. Use the AWS-managed KMS key aws/cloudtrail to encrypt the logs to minimize custom key management, and configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Create an organization-level trail from the delegated administrator account.

Register the Security tooling account as a delegated administrator for AWS CloudTrail in the management account. In the Security tooling account, create a centralized S3 bucket and a symmetric customer managed KMS key. Configure the S3 bucket policy to permit the cloudtrail.amazonaws.com service principal to write objects, restricted by a condition for the Organization ID. Configure the KMS key policy to permit the cloudtrail.amazonaws.com service principal to generate data keys, restricted by the same Organization ID condition. Create an organization trail from the delegated administrator account to write to the centralized S3 bucket and encrypt with the customer managed KMS key.

Create a Service Control Policy (SCP) that grants the cloudtrail.amazonaws.com service principal the authority to write to the centralized S3 bucket in the Security tooling account, and attach this SCP to the Organization root. In the member accounts, configure local IAM policies to allow CloudTrail to write to the S3 bucket, and use the default AWS-managed KMS key aws/s3 for encryption.

Cevabı ve açıklamayı göster

Cevap: Register the Security tooling account as a delegated administrator for AWS CloudTrail in the management account. In the Security tooling account, create a centralized S3 bucket and a symmetric customer managed KMS key. Configure the S3 bucket policy to permit the cloudtrail.amazonaws.com service principal to write objects, restricted by a condition for the Organization ID. Configure the KMS key policy to permit the cloudtrail.amazonaws.com service principal to generate data keys, restricted by the same Organization ID condition. Create an organization trail from the delegated administrator account to write to the centralized S3 bucket and encrypt with the customer managed KMS key.

Cevap

Registering the Security tooling account as a delegated administrator for AWS CloudTrail, using a centralized S3 bucket with a bucket policy restricted by Organization ID, and encrypting with a customer managed KMS key containing a key policy that trusts the CloudTrail service principal restricted by the Organization ID.

Registering a delegated administrator for AWS CloudTrail allows the Security tooling account to manage logging configuration for the entire organization without accessing the management account, supporting least privilege. In cross-account logging scenarios, using a customer managed KMS key is mandatory because AWS-managed keys (like aws/s3 or aws/cloudtrail) cannot have their key policies modified to allow cross-account access. The S3 bucket policy and KMS key policy must explicitly trust the cloudtrail.amazonaws.com service principal and enforce organizational boundaries using the aws:PrincipalOrgID condition key to prevent unauthorized access.

Adım Adım Çözüm

The Security tooling account is authorized to manage Organization-level trails.

Enables central governance and adheres to least privilege by keeping the management account clear of day-to-day operations.

Create a centralized S3 bucket in the Security tooling account and configure its bucket policy.

A secure S3 bucket is created with a policy allowing the CloudTrail service principal to write logs.

Resource-based S3 policies must explicitly allow cross-account writes from the CloudTrail service principal, restricted by the AWS Organization ID to prevent external uploads.

Create and configure a symmetric customer managed KMS key in the Security tooling account.

A KMS key is created with a key policy allowing the CloudTrail service principal to perform key generation actions.

AWS-managed KMS keys cannot be shared across accounts or have their policies modified. A customer managed KMS key is required to allow cross-account encryption by CloudTrail.

Create an Organization Trail from the delegated administrator account.

An organization trail is established that automatically logs all member accounts.

A single organization trail reduces administrative overhead compared to configuring individual trails per account.

Anahtar Kavram

Delegated administration, customer managed KMS key policy management, and resource-based policies for cross-account logging in AWS Organizations.

Tahmini Süre:3m 0s

Soru 704Soru →

A media broadcasting company is designing a disaster recovery and high availability solution for its new live news video metadata catalog API. The primary infrastructure is located in the us-west-2 Region, and the secondary disaster recovery site is in the us-east-1 Region. The system uses Amazon ECS tasks in private subnets for compute, which must communicate with external licensing APIs on the internet. The backend database uses Amazon Aurora PostgreSQL. The business requires a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of 5 minutes.

Which two of the following configuration options should the Solutions Architect include in the design to meet the RTO, RPO, and high availability requirements?

Geçerli olan tümünü seçin

Configure Amazon Aurora Global Database with the primary DB cluster in us-west-2 and a read-only secondary DB cluster in us-east-1.

Deploy a NAT Gateway in each Availability Zone within the public subnets of each Region, ensuring that private subnet route tables direct internet-bound traffic to their local NAT Gateway.

Deploy a single NAT Gateway in one Availability Zone in the primary Region, routing internet-bound traffic from all private subnets across all zones through this single NAT Gateway.

Implement a Backup and Restore strategy by taking hourly snapshots of the Aurora database, copying them to us-east-1, and restoring the cluster only when a failover is initiated.

Create a Route 53 Private Hosted Zone to manage public routing between the primary and secondary regions, associating the hosted zone only with the VPC in the primary Region.

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Aurora Global Database with the primary DB cluster in us-west-2 and a read-only secondary DB cluster in us-east-1.; Deploy a NAT Gateway in each Availability Zone within the public subnets of each Region, ensuring that private subnet route tables direct internet-bound traffic to their local NAT Gateway.

Cevap

Configure Amazon Aurora Global Database with the primary DB cluster in us-west-2 and a read-only secondary DB cluster in us-east-1, and deploy a NAT Gateway in each Availability Zone within the public subnets of each Region.

The correct options ensure the replication and availability constraints are met. Amazon Aurora Global Database satisfies the 5-minute RPO and 30-minute RTO by utilizing sub-second replication. Deploying NAT Gateways redundantly in each Availability Zone avoids a single point of failure for egress traffic.

Adım Adım Çözüm

Evaluate the database replication strategy against RTO and RPO constraints.

Amazon Aurora Global Database provides sub-second replication lag (RPO < 1 second) and can be promoted to a primary cluster in minutes (RTO < 30 minutes), satisfying the target metrics.

Traditional backup and restore fails both the 5-minute RPO and 30-minute RTO requirements.

Assess the high availability of the network outbound paths.

Deploying local, zone-redundant NAT Gateways in each Region ensures that an Availability Zone outage does not disrupt outbound connectivity to external licensing APIs.

A single NAT Gateway across multiple Availability Zones introduces a single point of failure.

Verify public routing capability.

Discard the use of Private Hosted Zones for public DNS resolution as they are internal-only and cannot resolve public internet client queries.

Public client endpoints must use public DNS routing configurations.

Anahtar Kavram

High Availability and Disaster Recovery Design

Tahmini Süre:2m 0s

Soru 705Soru →

An online gaming platform is designing a federated access solution for its developers to access resources across multiple member accounts in an AWS Organization. The company has decided to use an external SAML 2.0 compliant identity provider (IdP) to authenticate developers and allow them to assume the role named DeveloperAccess in the target accounts. Which of the following configuration steps must the solutions architect perform to establish this SAML 2.0 federation and enable federated access? (Select TWO.)

Geçerli olan tümünü seçin

Create a SAML identity provider entity in each target AWS account using the metadata document retrieved from the external identity provider.

Configure a trust policy on the target IAM roles in each member account that permits the sts:AssumeRoleWithSAML action and references the SAML provider ARN as the principal.

Create a Service Control Policy (SCP) at the AWS Organizations root level to grant sts:AssumeRoleWithSAML permission to all member accounts.

Configure the external identity provider to set the SAML Audience attribute to the IAM role ARN and the SAML Subject to the sts:AssumeRole action.

Configure the trust policy of the target IAM roles to specify the AWS Organizations management account root ARN as the trusted Principal.

Cevabı ve açıklamayı göster

Cevap: Create a SAML identity provider entity in each target AWS account using the metadata document retrieved from the external identity provider.; Configure a trust policy on the target IAM roles in each member account that permits the sts:AssumeRoleWithSAML action and references the SAML provider ARN as the principal.

Cevap

The correct actions are creating a SAML identity provider in each target account using the external IdP metadata and configuring a trust policy on the target role with the sts:AssumeRoleWithSAML action.

Establishing federation requires registering the external SAML identity provider in the target accounts and configuring target roles with a trust policy that allows sts:AssumeRoleWithSAML from that provider. This enables users authenticated by the external IdP to assume the DeveloperAccess role directly in the member accounts.

Adım Adım Çözüm

Identify the authentication workflow details.

Determine that developers will authenticate via an external SAML identity provider (IdP).

Understanding the entry point allows setting up the correct identity provider entity.

Establish trust with the external IdP.

AWS needs the metadata document to trust assertions signed by the external IdP.

Configure role trust for the SAML assertions.

Update the trust policy of the target IAM role to permit sts:AssumeRoleWithSAML from the SAML provider.

The trust policy defines which identity provider can assume the role and which API action is authorized.

Anahtar Kavram

Multi-Account SAML 2.0 Federation

Soru 706Soru →

A global shipping corporation is configuring federated single sign-on (SSO) to their AWS multi-account environment managed by AWS Organizations. They have established a SAML 2.0 identity provider (IdP) connection. In each member account, they have created a SAML provider entity named CorporateIdP and an IAM role named OperatorRole.

The IAM role in the member account (Account ID: 111122223333) is configured with the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::111122223333:saml-provider/CorporateIdP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

Users are authenticated successfully by the corporate IdP but receive an Access Denied error when attempting to assume the OperatorRole in AWS. Which of the following actions will resolve this issue and allow users to federate successfully?

Update the Action in the role's trust policy to sts:AssumeRoleWithSAML instead of sts:AssumeRole.

Modify the root Service Control Policy (SCP) to explicitly allow sts:AssumeRole for the SAML provider ARN, as SCPs inherit and grant trust across accounts automatically.

Attach a permissions policy to the IAM role that allows the sts:AssumeRole action for the SAML provider principal.

Implement a Service Control Policy (SCP) at the Organizational Unit (OU) level that allows sts:AssumeRoleWithSAML to bypass the role's local trust policy.

Cevabı ve açıklamayı göster

Cevap: Update the Action in the role's trust policy to sts:AssumeRoleWithSAML instead of sts:AssumeRole.

Cevap

Update the Action in the role's trust policy to sts:AssumeRoleWithSAML instead of sts:AssumeRole.

The correct answer updates the IAM role trust policy's action to specify the correct API call. For external SAML 2.0 identity provider federation, the STS service requires the trust policy to permit the sts:AssumeRoleWithSAML action. Using sts:AssumeRole fails because that action is reserved for standard IAM cross-account and service-to-service delegation, and does not accept SAML assertions.

Adım Adım Çözüm

Analyze the federation protocol in use.

The configuration uses SAML 2.0 for external identity federation.

This determines the matching AWS Security Token Service (STS) API operation.

Verify the STS action in the IAM role's trust policy.

The policy specifies sts:AssumeRole in the Action field.

To identify why the validation fails when the SAML assertion is presented.

Correct the trust policy action to align with SAML federation specifications.

Modify the Action value to sts:AssumeRoleWithSAML.

SAML federation requires the specific sts:AssumeRoleWithSAML API to consume SAML assertions and generate temporary credentials.

Anahtar Kavram

SAML 2.0 Federation Trust Policy Action Requirements

Tahmini Süre:2m 30s

Soru 707Soru →

A logistics enterprise operates a multi-account AWS environment with $40$ spoke VPCs in the `us-east-1` Region and $20$ spoke VPCs in the `us-west-2` Region. The enterprise is designing a hybrid network to connect these VPCs to their on-premises data center. The connectivity design must meet the following requirements:

* Any-to-any VPC-to-VPC communication must be enabled within each region.
* Cross-region VPC-to-VPC traffic must be blocked.
* All VPCs in both regions must have redundant, high-bandwidth access to the on-premises data center.
* The hybrid path must utilize a primary $10\text{ Gbps}$ AWS Direct Connect connection with an IPsec VPN over the internet as a backup.
* Failover from Direct Connect to the VPN must be automatic and dynamic.
* Administrative overhead for routing configuration must be minimized.

Which TWO actions should the Solutions Architect perform to meet these requirements?

Geçerli olan tümünü seçin

Deploy an AWS Transit Gateway in `us-east-1` and another in `us-west-2`. Attach the regional spoke VPCs to their respective regional Transit Gateway. Create a single Direct Connect Gateway, associate it with both Transit Gateways, and establish Transit Virtual Interfaces (Transit VIFs) from the on-premises data center to the Direct Connect Gateway.

Establish AWS Site-to-Site VPN connections from the on-premises data center, terminating them as VPN attachments directly on each regional Transit Gateway. Configure BGP dynamic routing over both the Direct Connect and VPN connections, and utilize BGP attributes to ensure the Direct Connect path is preferred.

Create a single Direct Connect Gateway and associate all

60

spoke VPCs directly with the Direct Connect Gateway to enable VPC-to-VPC routing and on-premises connectivity, bypassing the need for Transit Gateways.

Establish an AWS Transit Gateway peering attachment between the Transit Gateway in `us-east-1` and the Transit Gateway in `us-west-2`. Route all on-premises traffic from `us-west-2` through the peered Transit Gateway in `us-east-1` to consolidate all hybrid traffic onto a single set of VPN connections.

Deploy a single non-redundant NAT Gateway in a centralized services VPC in `us-east-1` to act as the next hop for all outbound hybrid traffic from both regions, and configure static route tracking on the on-premises router to handle failover.

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway in `us-east-1` and another in `us-west-2`. Attach the regional spoke VPCs to their respective regional Transit Gateway. Create a single Direct Connect Gateway, associate it with both Transit Gateways, and establish Transit Virtual Interfaces (Transit VIFs) from the on-premises data center to the Direct Connect Gateway.; Establish AWS Site-to-Site VPN connections from the on-premises data center, terminating them as VPN attachments directly on each regional Transit Gateway. Configure BGP dynamic routing over both the Direct Connect and VPN connections, and utilize BGP attributes to ensure the Direct Connect path is preferred.

Cevap

To design a resilient hybrid network that minimizes routing complexity and enforces isolation, the architect should deploy regional Transit Gateways associated with a single Direct Connect Gateway, and configure BGP-based Site-to-Site VPN connections directly to those Transit Gateways as a dynamic failover path.

The correct approach involves using regional Transit Gateways to manage intra-region routing. Associating them with a single Direct Connect Gateway enables both regions to access the data center. Because Direct Connect Gateway does not allow routing between its associated Transit Gateways, cross-region VPC-to-VPC traffic is blocked by default. Using dynamic BGP-based Site-to-Site VPN connections attached to the Transit Gateways provides an automated backup path. In Transit Gateway route tables, the Direct Connect Gateway path is naturally preferred over the VPN path for identical routes.

Adım Adım Çözüm

Address regional any-to-any VPC connectivity.

Deploying regional Transit Gateways in `us-east-1` and `us-west-2` enables any-to-any communication within each region via VPC attachments.

Transit Gateway acts as a regional cloud router, simplifying spoke VPC management and routing compared to full-mesh peering.

Connect regional networks to on-premises while enforcing cross-region isolation.

Associate both regional Transit Gateways with a single Direct Connect Gateway using Transit VIFs.

Direct Connect Gateway does not support transitive routing between associated Transit Gateways, ensuring that cross-region VPC-to-VPC traffic is blocked while still allowing both regions to reach on-premises.

Implement a dynamic backup path.

Deploy BGP-enabled AWS Site-to-Site VPN connections terminated directly as VPN attachments on each Transit Gateway.

Using BGP ensures automatic path failover. Terminating VPN on the Transit Gateways aligns the backup path with the regional hubs.

Anahtar Kavram

Transit Gateway and Direct Connect Gateway route propagation and routing limitations (specifically, the lack of transitive routing between associated Transit Gateways on a Direct Connect Gateway).

Tahmini Süre:3m 0s

Soru 708Soru →

A company is designing a high-availability and disaster recovery solution for an internal corporate web application. The primary workload runs in a multi-AZ VPC in the us-east-1 Region, and the disaster recovery site is located in the us-west-2 Region. The system must achieve a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 4 hours.

Which two actions should the solutions architect take to meet these requirements while ensuring high availability and minimizing cost?

Geçerli olan tümünü seçin

Configure Amazon Route 53 with a failover routing policy and health checks pointing to the primary and secondary regions.

Configure Amazon RDS cross-region read replication from us-east-1 to us-west-2 to meet the database RPO.

Configure daily AWS Backup jobs in the primary region and copy the recovery points to the secondary region.

Deploy a single NAT Gateway in the primary region's public subnet to handle all outbound replication traffic for private instances across all Availability Zones.

Create an Amazon Route 53 Private Hosted Zone in us-east-1 for the application's domain and associate it with both regions to route public client traffic.

Cevabı ve açıklamayı göster

Cevap: Configure Amazon Route 53 with a failover routing policy and health checks pointing to the primary and secondary regions.; Configure Amazon RDS cross-region read replication from us-east-1 to us-west-2 to meet the database RPO.

Cevap

Configure Amazon Route 53 with a failover routing policy and health checks, and configure Amazon RDS cross-region read replication from the primary to the secondary region.

To meet the RPO of 1 hour and RTO of 4 hours cost-effectively, the architecture must utilize a Warm Standby or Pilot Light pattern. Amazon RDS cross-region read replication provides near real-time asynchronous database updates, satisfying the RPO. Amazon Route 53 failover routing with health checks monitors the primary region and automatically updates DNS records to point to the secondary region during an outage, satisfying the RTO.

Adım Adım Çözüm

Evaluate the database replication strategy to meet the RPO of 1 hour.

Asynchronous replication via Amazon RDS cross-region read replicas keeps data lag to seconds or minutes, which satisfies the RPO requirement.

Backup and restore methods using daily snapshots would result in up to 24 hours of data loss, which fails the target.

Evaluate the DNS routing strategy to support the RTO of 4 hours.

Amazon Route 53 failover routing policy with health checks allows for automatic failover to the disaster recovery region within minutes.

Active-active routing using latency or geolocation routing is more complex and costly, and Private Hosted Zones are unsuitable for public traffic.

Ensure the underlying networking infrastructure maintains high availability.

Separate NAT Gateways must be deployed in each Availability Zone.

A single NAT Gateway creates a single point of failure, violating high-availability requirements.

Anahtar Kavram

Disaster Recovery strategies (Pilot Light/Warm Standby) utilize asynchronous database replication to meet tight RPOs and Route 53 failover routing to satisfy RTOs, while local high availability requires redundant multi-AZ resources like NAT Gateways.

Soru 709Soru →

A company is designing a multi-account architecture using AWS Organizations. A central Network account manages a shared VPC and wants to share specific subnets with multiple Application accounts using AWS Resource Access Manager (RAM). The security team requires all Amazon Elastic Block Store (EBS) volumes created by the Application accounts inside these shared subnets to be encrypted using a central key managed in a dedicated Security account. Which strategy should the Solutions Architect implement to meet these requirements?

Configure AWS RAM to share the subnets with the AWS Organization. In the Security account, use the default AWS-managed key for EBS (aws/ebs) and update its key policy to allow cross-account access for the Application accounts. In the Application accounts, configure EBS encryption to reference the Security account's aws/ebs key ARN.

Enable resource sharing with external entities in AWS RAM, and share the subnets with the Application account IDs individually without enabling AWS Organizations integration. In the Security account, create a Customer Managed Key (CMK) and configure its key policy to grant the Application accounts access to the key.

Configure AWS RAM to share the subnets with the AWS Organization. In the Security account, create a Customer Managed Key (CMK), and update its key policy to grant the Application accounts' IAM roles and EC2 service-linked roles permission to use the key. In the Application accounts, configure EBS encryption to use this shared CMK.

Configure AWS RAM to share the subnets with the AWS Organization. Attach a Service Control Policy (SCP) at the organization's root level that grants the Application accounts access to the default AWS-managed key (aws/ebs) located in the Security account.

Cevabı ve açıklamayı göster

Cevap: Configure AWS RAM to share the subnets with the AWS Organization. In the Security account, create a Customer Managed Key (CMK), and update its key policy to grant the Application accounts' IAM roles and EC2 service-linked roles permission to use the key. In the Application accounts, configure EBS encryption to use this shared CMK.

Cevap

Configure AWS Resource Access Manager (RAM) to share subnets with the organization, create a Customer Managed Key (CMK) in the Security account, update the CMK key policy to allow the Application accounts' IAM roles and service-linked roles access, and configure EBS encryption in the Application accounts to use the shared CMK.

The correct strategy is to share the subnets within the AWS Organization using AWS RAM and use a Customer Managed Key (CMK) in the Security account. Since VPC subnets can only be shared inside an AWS Organization and AWS-managed keys cannot be shared cross-account, a CMK must be used with a key policy that allows the application accounts' IAM roles and EC2 service-linked roles to use it.

Adım Adım Çözüm

Evaluate subnet sharing capability using AWS Resource Access Manager (RAM).

Confirm that VPC subnets can only be shared with accounts within the same AWS Organization, requiring AWS Organizations integration to be enabled for RAM.

This determines the valid sharing boundary for VPC subnets via AWS RAM.

Determine the appropriate KMS key type for cross-account EBS encryption.

Identify that AWS-managed KMS keys (like aws/ebs) cannot be shared across accounts. A Customer Managed Key (CMK) is required in the Security account.

Only Customer Managed Keys support key policy modification to allow cross-account access.

Configure the key policy for the Customer Managed Key in the Security account.

Grant permission for the Application accounts' IAM roles and EC2 service-linked roles to use the CMK.

This allows the Application accounts' EC2 instances to perform cryptographic operations (encrypt and decrypt) on the EBS volumes using the key in the Security account.

Configure EBS encryption settings in the Application accounts.

Set the default EBS encryption key in the Application accounts to point to the shared CMK ARN from the Security account.

This ensures all newly created EBS volumes in the shared subnets are automatically encrypted with the centralized key.

Anahtar Kavram

Cross-account resource sharing with AWS RAM and Customer Managed Keys (CMKs)

Soru 710Soru →

A company is designing a disaster recovery (DR) strategy for a critical web application to achieve a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes. The production environment is in the primary region. The database is hosted on Amazon RDS for PostgreSQL. The company wants to minimize costs while ensuring that a minimal standby environment is running in a secondary recovery region. Which TWO actions should the solutions architect take to meet these requirements?

Geçerli olan tümünü seçin

Create a cross-region Read Replica of the primary database in the disaster recovery region to ensure continuous data replication.

Deploy an Auto Scaling group of application servers in the disaster recovery region with a minimum capacity of 1, configured to scale out when traffic is redirected.

Configure a single NAT Gateway in one Availability Zone in the recovery region to handle outbound traffic for all private subnets across multiple Availability Zones to ensure high availability.

Configure a Route 53 Private Hosted Zone for public client failover routing, and associate it only with the primary VPC.

Use Amazon RDS Multi-AZ standby instances in the primary region to automatically serve read traffic during normal operations to reduce query latency.

Cevabı ve açıklamayı göster

Cevap: Create a cross-region Read Replica of the primary database in the disaster recovery region to ensure continuous data replication.; Deploy an Auto Scaling group of application servers in the disaster recovery region with a minimum capacity of 1, configured to scale out when traffic is redirected.

Cevap

Create a cross-region Read Replica of the primary database in the disaster recovery region to ensure continuous data replication, and deploy an Auto Scaling group of application servers in the disaster recovery region with a minimum capacity of 1, configured to scale out when traffic is redirected.

The correct options are to create a cross-region database Read Replica and deploy a low-capacity Auto Scaling group in the recovery region. The Read Replica maintains continuous, asynchronous database replication to satisfy the 5-minute RPO constraint. Running a single application server in the recovery region that can quickly scale out meets the 15-minute RTO constraint while minimizing standby costs.

Adım Adım Çözüm

Select a replication strategy to meet the 5-minute RPO target.

Identify that a cross-region RDS Read Replica provides continuous, asynchronous data replication to the secondary region.

Nightly backups or snapshots will not satisfy a 5-minute RPO because data loss could be up to 24 hours.

Select an application hosting strategy that minimizes cost while meeting the 15-minute RTO.

Identify that running a minimal application tier (e.g., minimum capacity of 1 in an Auto Scaling group) in the recovery region satisfies the warm standby pattern.

Keeping a full-sized duplicate infrastructure is expensive, while starting from scratch (backup and restore or pilot light with zero instances) might exceed the 15-minute RTO due to bootstrapping delays.

Anahtar Kavram

Warm Standby Disaster Recovery Pattern

Soru 711Soru →

A global logistics enterprise has a multi-account structure managed under AWS Organizations with Consolidated Billing. The enterprise has three main OUs: Production, Development, and Shared Services. The enterprise has the following requirements:

1. Share subnets from a central VPC in the Shared Services account with the Production OU to enable direct network communication without VPC peering.
2. Purchase a Savings Plan to reduce costs for a mix of Amazon EC2, AWS Fargate, and AWS Lambda workloads running in the Production OU, while preventing these savings from being applied to the Development OU.
3. For a newly acquired subsidiary whose accounts are in a separate OU, the finance team requires a custom pro-forma billing view that applies a 5% markup on all AWS public rates.

Which two of the following options should the Solutions Architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable resource sharing within AWS Organizations. In the Shared Services account, create an AWS Resource Access Manager (RAM) resource share for the subnets and associate it with the Production OU. Purchase Compute Savings Plans in the Management account, and disable Savings Plans discount sharing for the Development OU in the Billing Preferences of the Management account.

In the Management account, use AWS Billing Conductor to create a billing group with the primary account of the subsidiary as the billing group owner. Create a pricing rule with a global markup of 5%, associate this pricing rule with the billing group, and configure the billing group to generate pro forma Cost and Usage Reports (CUR).

Enable resource sharing within AWS Organizations. In the Shared Services account, share the subnets with the Production OU using AWS RAM. Purchase EC2 Instance Savings Plans in the Management account, and attach a Service Control Policy (SCP) to the Development OU that denies the 'savingsplans:Apply' action to restrict discount application.

In the Shared Services account, create a subnet resource share in AWS RAM. Enable external sharing in the RAM console and share the subnets with the individual AWS account IDs of the Production OU. Use a default AWS-managed KMS key ('aws/s3') in the Shared Services account to encrypt all cross-account flow logs, and delegate access to the Production OU by modifying the KMS key policy.

Create a billing group in AWS Billing Conductor for the subsidiary accounts. Attach an SCP to the subsidiary OU that denies access to the 'aws-portal:*' actions to enforce the 5% markup. Purchase Compute Savings Plans in the Shared Services account, and use AWS RAM to share the Savings Plan resource with the Production OU.

Cevabı ve açıklamayı göster

Cevap: Enable resource sharing within AWS Organizations. In the Shared Services account, create an AWS Resource Access Manager (RAM) resource share for the subnets and associate it with the Production OU. Purchase Compute Savings Plans in the Management account, and disable Savings Plans discount sharing for the Development OU in the Billing Preferences of the Management account.; In the Management account, use AWS Billing Conductor to create a billing group with the primary account of the subsidiary as the billing group owner. Create a pricing rule with a global markup of 5%, associate this pricing rule with the billing group, and configure the billing group to generate pro forma Cost and Usage Reports (CUR).

Cevap

The Solutions Architect should enable resource sharing in AWS Organizations, share subnets via AWS RAM with the Production OU, purchase Compute Savings Plans in the Management account while disabling sharing for the Development OU under Billing Preferences, and use AWS Billing Conductor to configure a billing group with a 5% markup pricing rule for the subsidiary accounts.

The correct options involve sharing subnets using AWS RAM, purchasing Compute Savings Plans with selectively disabled sharing for the Development OU, and leveraging AWS Billing Conductor to define a custom billing group and markup rule. This configuration securely extends network sharing to the Production OU, optimizes cross-service compute costs without bleeding discounts into non-production accounts, and enforces the required custom billing rates for the subsidiary.

Adım Adım Çözüm

Determine the resource sharing method and choose the appropriate Savings Plan type.

Subnets must be shared via AWS RAM under AWS Organizations. To cover EC2, Fargate, and Lambda workloads, a Compute Savings Plan must be selected.

AWS RAM supports subnet sharing within the organization. Only Compute Savings Plans cover all three required compute services (EC2, Fargate, and Lambda).

Address the constraint to prevent Savings Plan sharing with the Development OU.

Disable Savings Plan discount sharing for the Development OU in the Billing Preferences of the Management account.

AWS Organizations consolidated billing applies Savings Plans discounts to all accounts by default. Billing Preferences is the correct mechanism to selectively restrict discount application.

Configure the pro-forma billing and custom markup for the subsidiary.

Use AWS Billing Conductor to establish a billing group for the subsidiary accounts and define a pricing rule that applies a 5% markup.

AWS Billing Conductor is specifically designed to customize pricing parameters and generate pro forma reports for internal departments and subsidiaries.

Anahtar Kavram

Selective billing discount allocation, custom billing groups with markup pricing rules, and internal multi-account subnet sharing.

Soru 712Soru →

A gaming company is deploying a global multiplayer matchmaking service. The primary application tier runs in us-east-1 across multiple Availability Zones inside a private subnet, requiring outbound internet access to contact external anti-cheat APIs. The database tier uses Amazon Aurora MySQL. The company wants to design a disaster recovery (DR) architecture in us-west-2 with a Recovery Point Objective (RPO) of 1 minute and a Recovery Time Objective (RTO) of 10 minutes. The design must ensure that the game client automatically routes to the healthy region during a regional failure. Which architecture meets these requirements while minimizing single points of failure?

Deploy an Amazon Aurora MySQL DB cluster in us-east-1. Use AWS Backup to take daily snapshots of the database and copy them to us-west-2. Deploy an Application Load Balancer (ALB) and Auto Scaling group in both regions. Configure NAT Gateways in each Availability Zone. Use Amazon Route 53 with a latency-based routing policy to automatically shift traffic based on proximity.

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a read replica cluster in us-west-2. Deploy an Application Load Balancer (ALB) and Auto Scaling group in both regions. In us-east-1, deploy a single NAT Gateway in one Availability Zone to minimize idle NAT Gateway costs across all private subnets. Use Amazon Route 53 failover routing policy with active-passive health checks on the ALBs.

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a read replica cluster in us-west-2. Deploy a Multi-AZ Application Load Balancer (ALB) and Auto Scaling group in both regions. Deploy a NAT Gateway in each Availability Zone in both VPCs. Use Amazon Route 53 failover routing policy with active-passive health checks on the ALBs to automatically manage client failover.

Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a read replica cluster in us-west-2. Deploy an Application Load Balancer (ALB) and Auto Scaling group in both regions. Deploy a NAT Gateway in each Availability Zone in both VPCs. For internal microservice DNS resolution, configure a Route 53 Private Hosted Zone but associate it only with the us-east-1 VPC. Use Route 53 public failover routing for client-facing records.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a read replica cluster in us-west-2. Deploy a Multi-AZ Application Load Balancer (ALB) and Auto Scaling group in both regions. Deploy a NAT Gateway in each Availability Zone in both VPCs. Use Amazon Route 53 failover routing policy with active-passive health checks on the ALBs to automatically manage client failover.

Cevap

The correct architecture uses Amazon Aurora Global Database to achieve near-zero replication lag, satisfying the 1-minute RPO. Setting up Route 53 failover routing with active-passive health checks ensures automatic DNS failover to the secondary region within the 10-minute RTO. Deploying NAT Gateways in each Availability Zone removes any single points of failure for outbound internet access to external APIs.

Adım Adım Çözüm

Assess database replication requirements for RPO.

Amazon Aurora Global Database is selected because it replicates data in less than 1 second, meeting the 1-minute RPO requirement, whereas backup/restore with daily snapshots fails this requirement.

To guarantee data loss is kept under 1 minute.

Evaluate NAT Gateway design for high availability.

NAT Gateways must be deployed in every Availability Zone in the VPC.

To prevent a single Availability Zone outage from disrupting outbound internet access needed for external API validation.

Verify DNS and Route 53 routing policies.

Active-passive failover routing with associated health checks is configured to route client traffic to us-west-2 if us-east-1 is unhealthy. Route 53 Private Hosted Zones must be associated with both VPCs for internal resolution.

To automate regional failover within the 10-minute RTO and ensure internal name resolution works correctly in both regions.

Anahtar Kavram

Multi-region disaster recovery and high availability design with database replication, NAT Gateway redundancy, and Route 53 failover policies.

Soru 713Soru →

A media company is setting up a multi-account AWS environment under AWS Organizations. The administrator has configured a corporate Identity Provider (IdP) to enable single sign-on into a member account using SAML 2.0. A SAML provider has been created in the member account. An IAM role has been created for the federated users, but during testing, users receive an Access Denied error when attempting to federate from the IdP portal. The administrator reviews the IAM role's trust policy and finds the following policy document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456789012:saml-provider/CorporateIDP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

Which of the following modifications to the trust policy is required to resolve this issue?

Change the Action from sts:AssumeRole to sts:AssumeRoleWithSAML.

Add sts:AssumeRoleWithSAML to a Service Control Policy (SCP) attached to the Organizational Unit (OU) containing the member account.

Change the Action from sts:AssumeRole to sts:AssumeRoleWithWebIdentity and configure an OIDC identity provider in the member account.

Change the Federated Principal from the SAML provider ARN to the ARN of the AWS Organization's management account.

Cevabı ve açıklamayı göster

Cevap: Change the Action from sts:AssumeRole to sts:AssumeRoleWithSAML.

Cevap

Change the Action from sts:AssumeRole to sts:AssumeRoleWithSAML.

The correct answer states that the trust policy action must be changed to 'sts:AssumeRoleWithSAML'. This is because SAML 2.0 federated access relies on the AWS Security Token Service (STS) validating the SAML assertion sent by the Identity Provider (IdP) and calling the AssumeRoleWithSAML API. Without this action specified in the trust policy, STS will refuse the request and return an Access Denied error.

Adım Adım Çözüm

Analyze the IAM role trust policy in the member account.

The current trust policy lists 'sts:AssumeRole' as the Action allowed for the federated SAML provider principal.

To determine why the external SAML identity provider cannot assume the target IAM role.

Identify the correct AWS Security Token Service (STS) action required for SAML 2.0 federation.

AWS STS requires 'sts:AssumeRoleWithSAML' to exchange a SAML assertion for temporary credentials.

The default 'sts:AssumeRole' action only supports cross-account or local IAM entity role assumption, not SAML federation.

Modify the Action element in the trust policy statement to allow the correct STS action.

Changing the Action value to 'sts:AssumeRoleWithSAML' allows AWS STS to process incoming SAML assertions successfully.

This establishes the necessary trust path between the external IdP and the target IAM role.

Anahtar Kavram

SAML 2.0 Trust Policy Configuration

Soru 714Soru →

An enterprise manages $200$ AWS accounts under a single organization in AWS Organizations. The Chief Information Security Officer (CISO) requires a centralized logging solution that records all AWS API activity across all member accounts. The logs must be consolidated into a centralized Amazon S3 bucket within a dedicated Log Archive account.

The design must satisfy the following strict security and operational constraints:
- All log files must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS managed by the Log Archive account.
- Member accounts must have no permission to modify or disable the logging configuration, nor should they have direct access to read or decrypt the centralized logs.
- The S3 bucket and KMS CMK policies must restrict access using the principle of least privilege, preventing unauthorized AWS accounts from writing logs or using the KMS key.

Which set of configurations should a solutions architect implement to meet these requirements?

Create the S3 bucket and a KMS CMK in the Log Archive account. Configure the KMS key policy to allow the cloudtrail.amazonaws.com principal to perform kms:GenerateDataKey* and kms:DescribeKey actions, with a condition matching the organization's ID using the aws:PrincipalOrgID key. Configure the S3 bucket policy to allow the cloudtrail.amazonaws.com principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's ID using the aws:PrincipalOrgID condition. In the AWS Organizations management account, create an organization trail configured to send logs to the centralized S3 bucket and encrypt them using the KMS CMK. Apply a Service Control Policy (SCP) to the organization's root that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and cloudtrail:UpdateTrail actions for all member accounts.

Create the S3 bucket in the Log Archive account. In the AWS Organizations management account, create an organization trail configured to send logs to the centralized S3 bucket and encrypt them using the default AWS-managed key for Amazon S3 (aws/s3). Configure the S3 bucket policy to allow the cloudtrail.amazonaws.com principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's ID using the aws:PrincipalOrgID condition. Apply a Service Control Policy (SCP) to the organization's root that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and cloudtrail:UpdateTrail actions for all member accounts.

Create the S3 bucket and a KMS CMK in the Log Archive account. Configure the KMS key policy to allow the cloudtrail.amazonaws.com principal to perform kms:GenerateDataKey* and kms:DescribeKey actions. Configure the S3 bucket policy to allow the cloudtrail.amazonaws.com principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's ID using the aws:PrincipalOrgID condition. Attach a Service Control Policy (SCP) to the organization's root that explicitly allows cloudtrail:CreateTrail, s3:PutObject, and kms:GenerateDataKey* to all member accounts to authorize local log delivery. Create local trails in each member account pointing to the centralized S3 bucket.

Create the S3 bucket and a KMS CMK in the Log Archive account. Configure the KMS key policy to allow the cloudtrail.amazonaws.com principal to perform kms:GenerateDataKey* and kms:DescribeKey actions. Configure the S3 bucket policy to allow the root principals (arn:aws:iam::<member_account_id>:root) of all member accounts in the organization to perform s3:PutObject and s3:GetBucketAcl actions. In the AWS Organizations management account, create an organization trail configured to send logs to the centralized S3 bucket and encrypt them using the KMS CMK. Apply a Service Control Policy (SCP) to the organization's root that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and cloudtrail:UpdateTrail actions.

Cevabı ve açıklamayı göster

Cevap: Create the S3 bucket and a KMS CMK in the Log Archive account. Configure the KMS key policy to allow the cloudtrail.amazonaws.com principal to perform kms:GenerateDataKey* and kms:DescribeKey actions, with a condition matching the organization's ID using the aws:PrincipalOrgID key. Configure the S3 bucket policy to allow the cloudtrail.amazonaws.com principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's ID using the aws:PrincipalOrgID condition. In the AWS Organizations management account, create an organization trail configured to send logs to the centralized S3 bucket and encrypt them using the KMS CMK. Apply a Service Control Policy (SCP) to the organization's root that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and cloudtrail:UpdateTrail actions for all member accounts.

Cevap

Create the S3 bucket and a KMS CMK in the Log Archive account, configure the KMS key policy and S3 bucket policy to grant necessary permissions to the cloudtrail.amazonaws.com service principal with the aws:PrincipalOrgID condition, create the organization trail in the management account, and restrict trail modifications in member accounts via an SCP.

The correct solution involves creating an organization trail in the management account, which guarantees that all API activity is logged across all accounts and cannot be modified by local users. By creating a Customer Managed Key (CMK) in the Log Archive account, the policy can be updated to delegate cross-account access to the CloudTrail service principal. Restricting S3 bucket access and KMS key usage to the cloudtrail.amazonaws.com principal with the aws:PrincipalOrgID condition key aligns with the principle of least privilege, ensuring that only trails within the specified organization can deliver logs and generate keys.

Adım Adım Çözüm

Configure S3 bucket and KMS CMK policies in the Log Archive account.

Resource policies are established to allow the cloudtrail.amazonaws.com service principal to write logs and generate data keys, restricted to the organization via the aws:PrincipalOrgID condition.

CloudTrail requires explicit permissions (s3:GetBucketAcl, s3:PutObject, kms:GenerateDataKey*, kms:DescribeKey) to deliver logs to a centralized S3 bucket and encrypt them using a cross-account KMS CMK.

Deploy an organization trail from the Organizations management account.

A centralized, organization-wide trail is created that automatically captures and consolidated events across all member accounts.

An organization trail ensures that management events from all current and future member accounts are logged in a standardized, tamper-resistant manner.

Implement a Service Control Policy (SCP) to protect the trail configuration.

SCPs restrict member accounts from stopping, updating, or deleting CloudTrail resources.

SCPs act as authorization guardrails, ensuring that local administrators in member accounts cannot disable logging or tamper with the organization trail configuration.

Anahtar Kavram

Cross-account AWS CloudTrail logging requires a Customer Managed Key (CMK) and resource-based policies that grant the CloudTrail service principal access, coupled with organizational Service Control Policies (SCPs) to act as configuration guardrails.

Tahmini Süre:3m 0s

Soru 715Soru →

A financial technology corporation is designing a hybrid network architecture to connect its on-premises core banking systems to a multi-account AWS environment. The AWS footprint consists of $30$ spoke VPCs in the `us-east-1` Region, containing applications that require high-throughput, low-latency access to the on-premises database.

The network architecture requirements are:
- A $10\text{ Gbps}$ AWS Direct Connect (DX) connection via a Direct Connect Gateway (DXGW) serves as the primary path.
- A Site-to-Site VPN connection over the internet serves as the backup path.
- Under normal operating conditions, all traffic between the spoke VPCs and the on-premises data center must utilize the DX connection.
- If the DX connection fails, traffic must fail over automatically and bidirectionally to the Site-to-Site VPN.
- On-premises clients must resolve the domain names of AWS resources hosted in a Route 53 Private Hosted Zone (PHZ) associated with a centralized Shared Services VPC.
- The design must minimize administrative overhead and ensure high availability of outbound internet traffic from the spokes.

A Solutions Architect deploys an AWS Transit Gateway (TGW) in `us-east-1` and attaches all spoke VPCs to it. Which of the following configuration strategies should the Solutions Architect implement to meet these requirements?

Attach the DXGW and VPN to the TGW. Configure BGP on the customer gateway to advertise a more specific subnet prefix over the VPN connection and a summary prefix over the DX connection. Deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC, and associate the PHZ with all spoke VPCs and the Shared Services VPC. Deploy a single NAT Gateway in one Availability Zone of the Shared Services VPC and direct all spoke outbound internet traffic to it.

Connect the spoke VPCs directly to the DXGW using private virtual interfaces (VIFs). Attach the Site-to-Site VPN to the TGW, and configure the spoke VPCs' route tables with a default route pointing to the TGW as the backup path. Associate the PHZ only with the Shared Services VPC. Deploy a single NAT Gateway in the Shared Services VPC to handle all outbound internet traffic from the spokes.

Attach both the DXGW (via a transit Virtual Interface) and the Site-to-Site VPN to the TGW. Configure BGP to advertise the same on-premises network prefix over both paths. On the customer gateway, configure BGP local preference to prioritize the DX path. Deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC, configure on-premises DNS to forward queries for the AWS private domain to the inbound endpoints, and associate the PHZ with the Shared Services VPC and all

30

spoke VPCs. Deploy redundant NAT Gateways across multiple Availability Zones in a centralized Egress VPC attached to the TGW.

Attach both the DXGW and the VPN to the TGW. Configure static routes in the TGW route table for the on-premises prefix pointing to the DXGW attachment with a lower administrative distance, and another pointing to the VPN attachment with a higher administrative distance. Create a PHZ in the Shared Services VPC, do not associate it with the spoke VPCs, and configure on-premises DNS forwarders to point directly to the VPC resolver IP address of `

169.254.169.253

` over the DX connection. Deploy redundant NAT Gateways in a centralized Egress VPC.

Cevabı ve açıklamayı göster

Cevap: Attach both the DXGW (via a transit Virtual Interface) and the Site-to-Site VPN to the TGW. Configure BGP to advertise the same on-premises network prefix over both paths. On the customer gateway, configure BGP local preference to prioritize the DX path. Deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC, configure on-premises DNS to forward queries for the AWS private domain to the inbound endpoints, and associate the PHZ with the Shared Services VPC and all $30$ spoke VPCs. Deploy redundant NAT Gateways across multiple Availability Zones in a centralized Egress VPC attached to the TGW.

Cevap

The correct strategy attaches both the Direct Connect Gateway and the Site-to-Site VPN to the Transit Gateway, advertising the same on-premises prefix over both paths while configuring BGP local preference on the customer gateway to prefer the Direct Connect path. Private Hosted Zones must be associated with the Shared Services VPC and all spoke VPCs, with Route 53 Resolver Inbound Endpoints deployed in the Shared Services VPC. Highly available outbound connectivity is achieved using redundant NAT Gateways in a centralized Egress VPC.

The correct configuration uses BGP route propagation over both Direct Connect and VPN with identical prefixes. AWS Transit Gateway automatically prefers the Direct Connect Gateway path over the Site-to-Site VPN path for identical prefix advertisements. To steer return traffic, BGP local preference is configured on the customer gateway. Private DNS resolution is enabled by associating the Private Hosted Zone with all spoke VPCs and utilizing Route 53 Resolver Inbound Endpoints in the Shared Services VPC for on-premises client queries. Redundant NAT Gateways across multiple Availability Zones in a centralized Egress VPC ensure highly available outbound connectivity.

Adım Adım Çözüm

Configure BGP routing on the Transit Gateway and customer gateway.

Both the DXGW and VPN attachments are configured, and identical on-premises prefixes are advertised over both. The Transit Gateway automatically selects the DX path due to default path preference (Direct Connect is preferred over VPN for identical routes), and the customer gateway selects the DX path using BGP local preference.

Establishes a resilient, high-bandwidth primary connection with automatic bidirectional failover to the VPN without manual intervention.

Configure hybrid DNS resolution and associate the Route 53 Private Hosted Zone (PHZ).

The PHZ is associated with all

30

spoke VPCs and the Shared Services VPC. Route 53 Resolver Inbound Endpoints are deployed in the Shared Services VPC, and on-premises DNS servers are configured to forward queries to the inbound endpoint IPs.

Enables both on-premises clients (via inbound endpoints) and AWS workloads in all spoke VPCs to resolve the private DNS names.

Deploy and configure centralized egress via redundant NAT Gateways.

NAT Gateways are deployed in multiple Availability Zones in a centralized Egress VPC attached to the TGW, with TGW routes directing internet-bound traffic from the spokes to this VPC.

Ensures highly available and cost-optimized outbound internet connectivity without introducing single points of failure.

Anahtar Kavram

Designing highly available hybrid connectivity with automatic routing failover, cross-account private DNS resolution, and resilient centralized internet egress in a multi-account AWS environment.

Soru 716Soru →

An enterprise is designing a deployment pipeline for a critical, low-latency microservice deployed across multiple AWS Regions. The microservice is hosted on Amazon ECS using AWS Fargate, and uses Amazon DynamoDB global tables as its data tier. The business requirements specify that any update to the application must minimize the blast radius and guarantee zero downtime. Specifically, the deployment must:

1. Deploy updates sequentially from one Region to the next.
2. Within each Region, route exactly $10\%$ of the live traffic to the new version for a $15$ -minute evaluation period before shifting the remaining traffic.
3. Automatically roll back the deployment in the current Region if the synthetic transaction success rate falls below $99.5\%$ or if regional system health alarms are triggered.
4. Immediately halt the entire global deployment pipeline if any single Region experiences a deployment failure or rollback.

Which architecture should a solutions architect recommend to satisfy these requirements?

Configure an AWS CodePipeline with sequential stages for each AWS Region. In each stage, invoke AWS CodeDeploy to execute an ECS Blue/Green deployment using the CodeDeployDefault.ECSCanary10Percent15Minutes traffic-shifting configuration. Associate Amazon CloudWatch alarms monitoring the synthetic transaction success rate and regional system health with the CodeDeploy deployment group. Configure CodeDeploy to automatically roll back the deployment if these alarms are triggered, which will transition the CodePipeline stage to a failed state and halt the pipeline.

Configure AWS CloudFormation StackSets to update the ECS service across all Regions in parallel. Set the CloudFormation UpdatePolicy on the ECS service to perform a rolling update with MinimumHealthyPercent set to

90\%

and MaximumPercent set to

100\%

. Create a CloudWatch alarm in each Region that monitors the synthetic transaction success rate, and use an AWS Lambda helper function triggered by the alarm to delete the stack and trigger a rollback if the success rate falls below the threshold.

Configure an AWS CodePipeline that deploys updates to all target Regions simultaneously. In the pipeline, use AWS CodeDeploy to perform an ECS deployment using the CodeDeployDefault.ECSLinear10PercentEvery1Minute traffic-shifting configuration. Implement Amazon Route 53 weighted routing to split traffic between the new and old target groups in each Region, and write a custom script in AWS CodeBuild to monitor CloudWatch alarms and execute a rollback if a failure is detected.

Configure AWS CloudFormation StackSets with a sequential deployment order using the MaxConcurrentCount parameter set to

1

. In the CloudFormation template, configure the ECS service to use the ECS rolling update deployment controller. Write a custom AWS Lambda task in the pipeline to monitor the synthetic transaction success rate for

15

minutes and, if the success rate is healthy, manually update Route 53 DNS records to shift the remaining

90\%

of traffic to the new task set.

Cevabı ve açıklamayı göster

Cevap: Configure an AWS CodePipeline with sequential stages for each AWS Region. In each stage, invoke AWS CodeDeploy to execute an ECS Blue/Green deployment using the CodeDeployDefault.ECSCanary10Percent15Minutes traffic-shifting configuration. Associate Amazon CloudWatch alarms monitoring the synthetic transaction success rate and regional system health with the CodeDeploy deployment group. Configure CodeDeploy to automatically roll back the deployment if these alarms are triggered, which will transition the CodePipeline stage to a failed state and halt the pipeline.

Cevap

Configure an AWS CodePipeline with sequential stages for each AWS Region, using AWS CodeDeploy in each stage to execute an ECS Blue/Green deployment with the CodeDeployDefault.ECSCanary10Percent15Minutes traffic-shifting configuration, and configuring automatic rollbacks using CloudWatch alarms integrated with CodeDeploy.

The correct answer orchestrates the deployment sequentially using AWS CodePipeline stages, executes the canary traffic-shifting natively using AWS CodeDeploy's ECS Canary configuration, and registers CloudWatch alarms directly with CodeDeploy to ensure automated rollback. A rollback in CodeDeploy will fail the pipeline stage, successfully halting the downstream deployment to other Regions.

Adım Adım Çözüm

Select the orchestration tool for multi-region coordination.

AWS CodePipeline is selected with sequential stages, ensuring that a failure in an earlier stage halts execution of subsequent stages.

Sequential execution and pipeline halting on failure are native features of CodePipeline stages.

Select the deployment controller and configuration for traffic shifting.

AWS CodeDeploy is selected to run ECS Blue/Green deployment using the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration.

This configuration shifts

10\%

of traffic to the replacement task set and waits

15

minutes before shifting the remaining

90\%

, satisfying the canary requirement.

Configure the automated rollback mechanism.

CloudWatch alarms monitoring the synthetic transaction success rate and regional system health are registered with the CodeDeploy deployment group.

CodeDeploy automatically monitors these alarms during the traffic-shifting phase and triggers an immediate rollback if they enter the ALARM state.

Anahtar Kavram

Orchestrating multi-region canary deployments with automated rollbacks using AWS CodePipeline and AWS CodeDeploy.

Soru 717Soru →

A financial services firm is designing its AWS network architecture in the `us-east-1` Region. The architecture consists of $20$ VPCs split equally between production and development accounts. The firm has an existing $1\text{ Gbps}$ AWS Direct Connect connection with a Private Virtual Interface (VIF) terminated at a Direct Connect Gateway (DXGW). All $20$ VPCs are currently associated with the DXGW via Virtual Private Gateways (VGWs) to access the on-premises network.

The firm has the following new requirements:
- All production VPCs must be able to communicate with each other, and all development VPCs must be able to communicate with each other. Production and development VPC traffic must remain isolated.
- All VPCs must resolve domain names hosted in a single Route 53 Private Hosted Zone (PHZ) managed in a centralized shared services account.
- Administrative overhead must be minimized.

Which network design solution meets these requirements?

Deploy an AWS Transit Gateway. Create a Transit VIF on the Direct Connect connection, associate the Direct Connect Gateway with the Transit Gateway, and attach all

20

VPCs to the Transit Gateway. Configure two separate Transit Gateway route tables to isolate production and development traffic. Rely on the Transit Gateway attachments to automatically forward DNS queries for the Route 53 Private Hosted Zone from all VPCs without manual VPC association.

Keep the existing Virtual Private Gateway associations with the Direct Connect Gateway. Enable transitive VPC-to-VPC routing on the Direct Connect Gateway to allow production-to-production and development-to-development communication. Authorize and associate the Route 53 Private Hosted Zone with each of the

20

VPCs.

Deploy an AWS Transit Gateway. Create a Transit VIF on the Direct Connect connection, associate the Direct Connect Gateway with the Transit Gateway, and attach all

20

VPCs to the Transit Gateway. Configure two separate Transit Gateway route tables to isolate production and development traffic. Authorize and associate the Route 53 Private Hosted Zone in the shared services account with each of the

20

VPCs.

Establish a full mesh of VPC peering connections among the

10

production VPCs and another full mesh among the

10

development VPCs. Keep the existing Direct Connect Gateway associations for hybrid connectivity. Associate the Route 53 Private Hosted Zone with only the shared services VPC, and route all DNS queries through a single NAT Gateway deployed in that shared services VPC.

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway. Create a Transit VIF on the Direct Connect connection, associate the Direct Connect Gateway with the Transit Gateway, and attach all $20$ VPCs to the Transit Gateway. Configure two separate Transit Gateway route tables to isolate production and development traffic. Authorize and associate the Route 53 Private Hosted Zone in the shared services account with each of the $20$ VPCs.

Cevap

Deploy AWS Transit Gateway, connect the VPCs using separate route tables for production and development to ensure isolation, associate the Direct Connect Gateway with the Transit Gateway using a Transit VIF, and associate the Route 53 Private Hosted Zone with all VPCs.

The correct option correctly uses AWS Transit Gateway to handle routing between the

20

VPCs. By deploying two Transit Gateway route tables, the architecture achieves complete isolation between the production and development networks while allowing all VPCs to access the on-premises data center. Additionally, it properly addresses DNS requirements by explicitly associating the Route 53 Private Hosted Zone with all

20

VPCs across the accounts.

Adım Adım Çözüm

Consolidate multi-VPC routing by deploying AWS Transit Gateway.

Simplifies connection management from

20

individual Direct Connect VGW associations to a single hub structure.

Direct Connect Gateway does not allow transitive routing between VPCs, so a Transit Gateway is required to facilitate inter-VPC communication.

Set up Transit Gateway route tables for production and development attachments.

Traffic from production VPCs can route to other production VPCs but is blocked from reaching development VPCs, and vice versa.

Multiple route tables allow network isolation without configuring complex security groups or firewalls for each VPC link.

Establish hybrid connectivity using a Transit Virtual Interface (VIF).

Connects the on-premises network to the Transit Gateway via the Direct Connect Gateway.

A Transit VIF is mandatory for attaching a Direct Connect Gateway to an AWS Transit Gateway.

Associate the centralized Route 53 Private Hosted Zone with all

20

spoke VPCs.

All production and development VPCs can resolve domains hosted in the centralized PHZ.

Route 53 PHZs require explicit association with target VPCs to answer queries originating from those VPCs, regardless of Transit Gateway connectivity.

Anahtar Kavram

AWS Transit Gateway routing isolation combined with cross-account Route 53 Private Hosted Zone association.

Tahmini Süre:2m 30s

Soru 718Soru →

A healthcare provider hosts HIPAA-compliant applications across multiple AWS accounts managed under a single organization in AWS Organizations. The security team mandates that AWS Config must remain enabled and recording in all member accounts within the Workloads Organizational Unit (OU). Individual administrators in these member accounts must retain full administrator privileges (AdministratorAccess) to deploy workloads but must be prevented from stopping the configuration recorder, deleting the delivery channel, or modifying the configuration recorder settings. Which strategy will meet these requirements with the least operational overhead?

Attach a Service Control Policy (SCP) to the Workloads Organizational Unit (OU) that denies the config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutConfigurationRecorder actions.

Attach a Service Control Policy (SCP) directly to the system administrator IAM roles in each member account that denies modifying or deleting AWS Config resources.

Use AWS Resource Access Manager (RAM) to share a standard IAM permissions boundary from the management account to all member accounts, restricting modification of AWS Config.

Configure AWS Config to encrypt all recording data using the default AWS-managed KMS key (aws/config), and update its key policy to deny access to the AWS Config APIs for member account administrators.

Cevabı ve açıklamayı göster

Cevap: Attach a Service Control Policy (SCP) to the Workloads Organizational Unit (OU) that denies the config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutConfigurationRecorder actions.

Cevap

Attaching a Service Control Policy (SCP) to the Workloads Organizational Unit (OU) that denies the config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutConfigurationRecorder actions.

Attaching a Service Control Policy (SCP) to the Workloads Organizational Unit (OU) with explicit deny actions for AWS Config modification effectively blocks all local administrators (and the root user) from disabling or tampering with AWS Config. This provides centralized governance with minimal operational effort.

Adım Adım Çözüm

Determine the appropriate governance tool to enforce organization-wide security boundaries that affect even administrators.

Identify Service Control Policies (SCPs) as the correct tool.

SCPs define the maximum available permissions for member accounts and apply to all IAM users, roles, and the root user.

Construct an SCP with explicit deny rules for the specific AWS Config modification APIs.

Define config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutConfigurationRecorder within the Deny block of the SCP statement.

An explicit deny in an SCP overrides any local administrator permissions.

Determine where to attach the SCP to restrict only the workloads accounts with minimal management effort.

Attach the SCP directly to the Workloads Organizational Unit (OU).

Attaching the policy to the OU applies the restrictions to all current and future member accounts within that OU automatically.

Anahtar Kavram

Using Service Control Policies (SCPs) in AWS Organizations as administrative guardrails to restrict member account administrators' permissions.

Soru 719Soru →

A multi-player online gaming platform hosts its workloads across hundreds of AWS accounts managed under a single organization in AWS Organizations. The company uses an external SAML 2.0-compliant Identity Provider (IdP) to manage employee identities. To simplify cross-account access, the security team is implementing direct SAML federation to each member account, allowing developers to federate directly into roles. However, during initial testing, users receive an Access Denied error after authenticating at the IdP redirect page. Simultaneously, the security team needs to ensure that no developer role can modify security logging configurations, regardless of any local IAM permissions or administrator privileges.

Which combinations of actions will resolve the federation issue and enforce the logging restriction? (Select TWO.)

Geçerli olan tümünü seçin

Modify the trust policy of the IAM roles in the member accounts to ensure the principal is the SAML provider metadata ARN and the Action is set to sts:AssumeRoleWithSAML.

Create a Service Control Policy (SCP) with an explicit Deny rule for the logging modifications and attach it to the target Organizational Units (OUs).

Modify the trust policy of the IAM roles in the member accounts to trust the external IdP domain name as a principal and allow the sts:AssumeRoleWithWebIdentity action.

Apply a Service Control Policy (SCP) to the member accounts that explicitly allows the federated roles to perform actions and relies on the SCP to grant the permissions without local IAM policies.

Configure the SAML assertion attributes in the external IdP to pass the IAM role ARN as the Subject identifier (NameID) and specify the sts:AssumeRole action in the audience restriction.

Cevabı ve açıklamayı göster

Cevap: Modify the trust policy of the IAM roles in the member accounts to ensure the principal is the SAML provider metadata ARN and the Action is set to sts:AssumeRoleWithSAML.; Create a Service Control Policy (SCP) with an explicit Deny rule for the logging modifications and attach it to the target Organizational Units (OUs).

Cevap

To resolve the federation issue, modify the trust policy of the IAM roles in the member accounts to trust the SAML provider metadata ARN and allow the sts:AssumeRoleWithSAML action. To enforce the logging restriction, apply a Service Control Policy (SCP) with an explicit Deny rule for the logging modifications to the target Organizational Units (OUs).

For SAML 2.0-based federation, the target IAM roles in the member accounts must trust the SAML provider ARN and allow the sts:AssumeRoleWithSAML action. To restrict logging modifications across all accounts regardless of local IAM or administrator permissions, a Service Control Policy (SCP) with an explicit Deny statement must be applied, as SCP Deny statements override any local permissions.

Adım Adım Çözüm

Diagnose the SAML federation Access Denied error.

Identify that the IAM roles in the member accounts must trust the SAML Identity Provider (IdP) principal and use the correct STS action.

SAML 2.0 federation requires target roles to have a trust policy allowing the sts:AssumeRoleWithSAML action from the SAML provider principal.

Configure the trust policy of the target IAM roles in member accounts.

Update the IAM role trust policies to explicitly allow the sts:AssumeRoleWithSAML action for the SAML provider ARN.

This establishes the cryptographic trust relationship necessary for external users to authenticate and federate into target roles.

Implement global administrative guardrails for logging configuration.

Draft a Service Control Policy (SCP) containing an explicit Deny statement for security logging modifications, and attach it to the appropriate OUs.

SCPs act as organizational guardrails that filter permissions across all member accounts, and an explicit Deny cannot be overridden by local administrators.

Anahtar Kavram

Multi-Account SAML 2.0 federation requires the target IAM roles to trust the SAML provider ARN with the sts:AssumeRoleWithSAML action. Service Control Policies (SCPs) serve as guardrails to enforce organization-wide restrictions but do not grant permissions directly.

Soru 720Soru →

A global logistics provider is migrating its operations management system to AWS. The company uses AWS Organizations and has configured a multi-account structure with a centralized Network Services account. The Network Services account contains a Transit Gateway that connects VPCs in multiple member accounts and an on-premises data center via an AWS Direct Connect connection. The architecture team needs to implement a DNS resolution strategy that allows resources in all VPCs to resolve domain names in an on-premises zone named logistics.corp, while also allowing on-premises servers to resolve resources in a private hosted zone named aws.logistics.corp which is hosted in a Shared Services account. Which configuration should the solutions architect implement to meet these requirements with the least administrative effort?

Configure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. In the Shared Services account, authorize the association of the aws.logistics.corp private hosted zone (PHZ) with the Network Services VPC. In the Network Services account, associate the VPC with the PHZ. Create an outbound Resolver rule for logistics.corp pointing to the on-premises DNS servers, share the rule with the organization using AWS Resource Access Manager (RAM), and associate the rule with all VPCs. Configure on-premises DNS servers to forward queries for aws.logistics.corp to the inbound endpoint IP addresses.

Configure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. Share the aws.logistics.corp private hosted zone (PHZ) from the Shared Services account to all accounts using AWS Resource Access Manager (RAM). In the Network Services account, create an outbound Resolver rule for logistics.corp pointing to on-premises DNS servers, share the rule using AWS RAM, and associate it with all VPCs. Configure on-premises DNS servers to forward queries for aws.logistics.corp to the inbound endpoint IP addresses.

Configure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. Create a Direct Connect Gateway (DXGW) and configure DNS forwarding rules directly on the DXGW to route logistics.corp queries to the on-premises DNS servers without using Route 53 Resolver outbound rules. Authorize and associate the aws.logistics.corp private hosted zone (PHZ) with the Network Services VPC, and configure on-premises DNS to forward queries to the inbound endpoint IP addresses over the Transit Gateway.

Configure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. In the Shared Services account, associate the aws.logistics.corp private hosted zone (PHZ) directly with the inbound endpoint in the Network Services VPC. Create an outbound Resolver rule for logistics.corp pointing to on-premises DNS servers, and configure a VPC Peering connection between the Shared Services VPC and the Network Services VPC to route DNS traffic.

Cevabı ve açıklamayı göster

Cevap: Configure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. In the Shared Services account, authorize the association of the aws.logistics.corp private hosted zone (PHZ) with the Network Services VPC. In the Network Services account, associate the VPC with the PHZ. Create an outbound Resolver rule for logistics.corp pointing to the on-premises DNS servers, share the rule with the organization using AWS Resource Access Manager (RAM), and associate the rule with all VPCs. Configure on-premises DNS servers to forward queries for aws.logistics.corp to the inbound endpoint IP addresses.

Cevap

Configure Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. Authorize the cross-account association of the private hosted zone in the Shared Services account with the Network Services VPC and complete the association. Share the outbound Resolver rule via AWS RAM and associate it with all VPCs. Point on-premises DNS servers to the inbound Resolver endpoint.

The correct configuration establishes centralized Route 53 Resolver inbound and outbound endpoints in the Network Services VPC. To allow the inbound endpoint to resolve the private hosted zone (PHZ) hosted in the Shared Services account, a cross-account VPC association is required. This is accomplished by authorizing the association from the Shared Services account and then associating the Network Services VPC with the PHZ. For outbound resolution, a Resolver rule for the on-premises domain is created in the Network Services account, shared across the organization using AWS RAM, and associated with all VPCs.

Adım Adım Çözüm

Deploy Route 53 Resolver endpoints in the Network Services VPC.

Inbound and outbound endpoints are established in the hub VPC, allowing query reception from on-premises and forwarding of queries to on-premises.

Centralizes hybrid DNS traffic handling within the hub network.

Authorize and create the cross-account Private Hosted Zone (PHZ) association.

The aws.logistics.corp PHZ in the Shared Services account is associated with the Network Services VPC.

Allows queries received by the inbound endpoint in the Network Services VPC to resolve names defined in the Shared Services account's PHZ.

Create and share the outbound Route 53 Resolver rule.

An outbound rule for logistics.corp is shared with the organization using AWS RAM and associated with all VPCs.

Allows resources in any VPC to forward DNS requests for the on-premises domain to the outbound endpoint, which routes them to the on-premises DNS servers.

Anahtar Kavram

Cross-account Private Hosted Zone association and centralized Route 53 Resolver endpoints for hybrid DNS resolution.

Tahmini Süre:2m 0s

ÖncekiSayfa 36 / 99Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram