Examkin

Tüm alıştırma soruları

1964 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 821Soru →

A global e-commerce corporation manages its multi-account environment using AWS Organizations. The accounts are organized into several Organizational Units (OUs), including a Production workloads OU. Local administrators in these workload accounts possess full administrative rights via the AdministratorAccess IAM policy. To maintain strict regulatory compliance, the central security team must ensure that no user or role, including the root user, within the Production workloads OU can disable Amazon GuardDuty or AWS Security Hub. This security guardrail must apply immediately to all existing workload accounts and be automatically enforced on any new accounts added to the OU. Which solution should a Solutions Architect implement to meet these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Attach a Service Control Policy (SCP) to the Production workloads OU that denies GuardDuty and Security Hub disabling and modification actions, while allowing local administrators to continue using their existing IAM policies.

Cevap

Attach a Service Control Policy (SCP) to the Production workloads OU that denies GuardDuty and Security Hub disabling and modification actions, while allowing local administrators to continue using their existing IAM policies.
The correct solution uses a Service Control Policy (SCP) attached to the workloads Organizational Unit (OU). SCPs act as guardrails that define the maximum available permissions for accounts within an OU. They apply to all users and roles, including the root user, and are automatically inherited by any new accounts added to the OU. Because local administrators retain the local AdministratorAccess IAM policy, they can perform all other administrative tasks, while the SCP prevents them from disabling or modifying the security services. This provides a preventive control with the least operational overhead.

Adım Adım Çözüm

1
Identify the organizational boundary and governance requirement.
The requirement is to prevent disabling GuardDuty and Security Hub across all accounts in the Production workloads OU, including future accounts, without restricting other admin actions.
This narrows down the solution to preventive guardrails at the AWS Organizations level rather than account-level configurations.
2
Evaluate AWS Organizations Service Control Policies (SCPs) vs local IAM controls.
An SCP attached to the OU is inherited by all accounts under it, applying to all users including the root user. Since it filters permissions, it prevents the actions even if local IAM policies allow them.
SCPs provide the necessary preventive guardrail with minimal operational overhead and apply automatically to new accounts.
3
Assess the operational impact on local administrator permissions.
By maintaining the local AdministratorAccess policy, local admins retain full privileges on other services, while the SCP blocks the specified forbidden actions.
This meets the operational requirement of keeping administrative rights for daily tasks without central intervention.

Anahtar Kavram

Service Control Policies (SCPs) as Permission Guardrails
Soru 822Soru →

A digital manufacturing enterprise operates a multi-account environment with 115115 AWS accounts organized under AWS Organizations. The compliance officer mandates that all API activity across all accounts and regions must be centrally logged and audited. The solutions architect designs a solution to consolidate AWS CloudTrail logs into an Amazon S3 bucket within a dedicated Security account. The architecture must satisfy the following constraints:
- All log data at rest must be encrypted using a Customer Managed Key (CMK) in AWS KMS.
- Member accounts must be prevented from disabling or altering the logging configuration.
- The S3 bucket policy and the KMS key policy must enforce least-privilege access, restricting delivery only to CloudTrail for accounts belonging to the organization.
- AWS-managed KMS keys must not be used due to security policies restricting cross-account key sharing.

Which configuration strategy should the solutions architect implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure an organization trail in the management account that delivers logs to the S3 bucket in the Security account, encrypted by a customer managed KMS CMK in the Security account. Configure the S3 bucket policy to allow s3:PutObject for the CloudTrail service principal with a condition for the Organization ID. Configure the KMS key policy in the Security account to allow kms:GenerateDataKey* and kms:DescribeKey for the CloudTrail service principal with a condition for the Organization ID. Apply a Service Control Policy to the organization's root that denies CloudTrail modification and deletion actions.

Cevap

Configure an organization trail in the management account that delivers logs to the S3 bucket in the Security account, encrypted by a customer managed KMS CMK in the Security account. Configure the S3 bucket policy to allow s3:PutObject for the CloudTrail service principal with a condition for the Organization ID. Configure the KMS key policy in the Security account to allow kms:GenerateDataKey* and kms:DescribeKey for the CloudTrail service principal with a condition for the Organization ID. Apply a Service Control Policy to the organization's root that denies CloudTrail modification and deletion actions.
The correct strategy leverages an organization trail, which dynamically configures logging across all current and future accounts in the organization. To support cross-account logging securely, a customer managed key is deployed in the Security account, and its key policy is modified to allow the CloudTrail service principal to use it, restricted to the organization's ID using the aws:PrincipalOrgID condition. The centralized S3 bucket policy is similarly configured to permit CloudTrail log delivery only from the organization. Finally, an SCP attached to the root of the organization enforces compliance by preventing member accounts from stopping or modifying the logging setup.

Adım Adım Çözüm

1
Deploy a centralized Amazon S3 bucket and a Customer Managed KMS CMK in the Security account.
Establishes the centralized storage and cryptographic key under the control of the security team.
Allows compliance with the requirement to use a customer managed key and store logs centrally.
2
Configure the S3 bucket policy and KMS key policy to permit the CloudTrail service principal to put objects and generate data keys, scoped using the aws:PrincipalOrgID condition matching the Organization ID.
Permits only the CloudTrail service acting on behalf of the organization's accounts to write logs and use the encryption key.
Ensures cross-account log delivery works under the principle of least privilege, blocking external delivery attempts.
3
Create an organization trail from the management account (or delegated administrator) pointing to the centralized S3 bucket and KMS CMK.
Enables log collection automatically across all existing and future member accounts within the organization.
Ensures complete coverage of API logs without manual configuration per account.
4
Attach a Service Control Policy (SCP) at the root level of the organization to deny write and delete API calls on CloudTrail resources.
Prevents administrators or users in member accounts from stopping the logging or altering the trail configuration.
Meets the security requirement to prevent tampering with logging configurations.

Anahtar Kavram

Centralized Organization Trail with S3 Bucket Policies and Customer Managed KMS CMK Policies
Soru 823Soru →

An enterprise is designing a highly available, multi-account hybrid network architecture across two AWS Regions: us−east−1us-east-1 (the primary region) and us−west−2us-west-2 (the secondary region). The enterprise has deployed spoke VPCs in multiple member accounts in both regions. The on-premises data center is connected to AWS via a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection terminating at a Direct Connect Gateway (DXGW). To ensure high availability, the enterprise plans to use an IPsec VPN connection as a backup path.

The design must satisfy the following requirements:
- All spoke VPCs in both regions must have access to the on-premises data center.
- The 10 Gbps10\text{ Gbps} DX path must be preferred for all hybrid traffic, and the VPN path must only be used in the event of a DX or regional Transit Gateway failure.
- Spoke VPCs must be able to securely resolve domain names hosted in the on-premises data center.
- The solution must minimize monthly operating costs and administrative overhead.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate the Direct Connect Gateway (DXGW) with the Transit Gateways (TGWs) in both regions. Establish backup IPsec VPN connections from the on-premises data center to the TGW in each region. Configure BGP on the customer gateway to advertise identical on-premises prefixes over both paths, utilizing AS-Path prepending on the VPN routes to ensure the DX path is preferred.; Deploy Route 53 Resolver outbound endpoints in a centralized network VPC. Create a forwarding rule for the on-premises domain pointing to the on-premises DNS servers, and share the rule across the AWS Organization using AWS Resource Access Manager (RAM). Associate the shared resolver rule and the on-premises private hosted zone with the spoke VPCs in all accounts.

Cevap

To configure a highly available and cost-effective hybrid network, associate the Direct Connect Gateway (DXGW) with the Transit Gateways (TGWs) in both regions and establish backup IPsec VPN connections on each TGW. Configure BGP on the customer gateway with AS-Path prepending on the VPN routes to ensure Direct Connect is preferred. For DNS, deploy centralized Route 53 Resolver outbound endpoints, create a forwarding rule, share the rule across the AWS Organization using AWS Resource Access Manager (RAM), and explicitly associate the rule and Private Hosted Zones with the spoke VPCs.
To establish highly available hybrid connectivity, the Direct Connect Gateway (DXGW) must be associated with the Transit Gateways (TGWs) in both regions. Establishing backup IPsec VPN connections to both TGWs and configuring AS-Path prepending on the VPN routes ensures that AWS prefers the Direct Connect path during normal operation and fails over gracefully to the VPN path. For DNS, Route 53 Resolver outbound endpoints and forwarding rules shared via AWS Resource Access Manager (RAM) allow spoke VPCs in all accounts to securely resolve on-premises domains. The forwarding rules and Private Hosted Zones must be explicitly associated with each spoke VPC to enable cross-account DNS resolution.

Adım Adım Çözüm

1
Configure the hybrid network infrastructure by associating the Direct Connect Gateway (DXGW) with the Transit Gateways in both the primary (us-east-1) and secondary (us-west-2) regions, allowing both regional TGWs to directly access the on-premises data center over the Direct Connect connection.
Direct Connect traffic routes directly from spoke VPCs in both regions to the on-premises environment without relying on transitive TGW peering routing, which is unsupported.
Direct TGW-to-DXGW associations are required because Transit Gateway peering does not support transitive routing to a DXGW attachment on a peered TGW.
2
Establish IPsec VPN connections from the customer gateway to the Transit Gateways in both regions to act as a backup path. Configure BGP routing on the customer gateway to prepended the AS-Path for all prefixes advertised over the VPN links compared to the DX links.
AWS naturally prefers the DX path over the VPN path due to BGP path attributes (specifically AS-Path length), utilizing VPN only when the DX connection or a TGW fails.
Prepending the AS-Path on the backup VPN routes ensures that the on-premises environment and AWS prefer the Direct Connect link during normal operations.
3
Set up centralized Route 53 Resolver outbound endpoints in a network VPC. Create a forwarding rule for the on-premises domain pointing to the on-premises DNS servers, share this rule using AWS RAM, and associate both the rule and any local Private Hosted Zones (PHZs) with all spoke VPCs across all member accounts.
Spoke VPCs across all accounts can successfully resolve on-premises DNS names securely and efficiently.
Private Hosted Zones and Route 53 Resolver rules are not automatically inherited at the organization level; they must be explicitly associated with each target VPC.

Anahtar Kavram

AWS Multi-Region Transit Gateway Routing and Cross-Account DNS Shared Architecture
Soru 824Soru →

A healthcare provider is deploying a centralized vulnerability scanner in a dedicated Audit account. The scanner must read raw medical record files stored in an Amazon S3 bucket within a separate Operations account. The files are encrypted with server-side encryption using AWS KMS (SSE-KMS). The scanner runs as a containerized task on AWS Fargate in the Audit account, using an IAM task role named AuditScannerRole.

Which configuration strategy should a solutions architect implement to allow AuditScannerRole to decrypt and retrieve these files?

Cevabı ve açıklamayı göster

Cevap: Set the S3 bucket in the Operations account to encrypt objects with a customer managed KMS key. Modify the key policy of this customer managed key to allow the Audit account to perform kms:Decrypt actions. Grant AuditScannerRole IAM permissions for s3:GetObject on the bucket and kms:Decrypt on the key, and update the Operations bucket policy to allow the AuditScannerRole s3:GetObject access.

Cevap

Configure the S3 bucket to use a customer managed KMS key, modify the key policy of this key to delegate kms:Decrypt access to the Audit account, grant the AuditScannerRole IAM permissions to read the bucket and decrypt using the key, and update the bucket policy in the Operations account to grant s3:GetObject permissions to the AuditScannerRole.
To decrypt and access S3 objects across accounts, you must use a customer managed KMS key. The KMS key policy in the Operations account must delegate decrypt permissions to the Audit account (or specifically the scanner role). Additionally, the resource policies (KMS key policy and S3 bucket policy) and the identity-based IAM policy in the Audit account must all align to grant the necessary read and decrypt access.

Adım Adım Çözüm

1
Ensure the S3 bucket in the Operations account is encrypted using a customer managed KMS key instead of the default AWS managed key (aws/s3).
The bucket uses a key whose policy can be modified to allow cross-account access.
AWS managed KMS keys do not allow policy modifications, making them unusable for cross-account access.
2
Update the customer managed key policy in the Operations account to grant the Audit account root principal or the specific AuditScannerRole permission to perform kms:Decrypt.
The KMS key permits cross-account decryption requests from the Audit account.
By default, KMS keys restrict cross-account access unless explicitly configured in the key policy.
3
Add an S3 bucket policy statement to the Operations account bucket that allows s3:GetObject permissions for the AuditScannerRole principal.
The S3 bucket allows cross-account read access.
For cross-account S3 access, the resource-based bucket policy must explicitly permit the external IAM principal.
4
Attach an IAM policy to the AuditScannerRole in the Audit account granting s3:GetObject permissions on the Operations bucket and kms:Decrypt permissions on the Operations KMS key.
The scanner task has the required identity-based permissions to request decryption and read the object.
Cross-account access requires permissions to be granted on both the resource side (bucket policy and KMS key policy) and the identity side (IAM policy).

Anahtar Kavram

Cross-account Amazon S3 access with KMS encryption requires a customer managed key, delegating decryption permissions in the KMS key policy, allowing read access in the S3 bucket policy, and granting identity-based permissions in the consumer account.
Soru 825Soru →

A financial services firm manages its multi-account environment using AWS Organizations. The setup includes a central Network account, a Production Organizational Unit (OU) containing several production workload accounts, and a Sandbox OU containing experimental developer accounts. The company's management account has purchased a significant pool of Compute Savings Plans.

The Solutions Architect must implement a solution that achieves the following:
1. Allows instances in the Production OU accounts to be launched into subnets managed by the central Network account.
2. Prevents the Sandbox OU accounts from consuming the Compute Savings Plans benefits, ensuring the discounts are reserved for production workloads.
3. Minimizes administrative overhead for any future accounts added to the OUs.

Which combination of actions should the Solutions Architect take to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Enable sharing within AWS Organizations in the AWS Resource Access Manager (RAM) settings of the management account. In the central Network account, use AWS RAM to share the subnets, specifying the Production OU as the principal. In the Billing console of the management account, turn off Savings Plans discount sharing for all accounts in the Sandbox OU.

Cevap

Enable sharing within AWS Organizations in the AWS Resource Access Manager (RAM) settings of the management account, share the subnets from the central Network account to the Production OU using AWS RAM, and turn off Savings Plans discount sharing for the Sandbox OU accounts in the billing preferences of the management account.
The correct approach involves enabling organization-wide sharing in AWS Resource Access Manager (RAM) at the management account level, sharing the subnets with the target Production Organizational Unit (OU) from the central Network account, and managing the Savings Plans discount sharing settings under the management account's Billing Preferences to exclude the Sandbox OU accounts. This configuration properly isolates resources, restricts discount application, and minimizes overhead by applying policies and sharing rules at the OU level rather than targeting individual accounts.

Adım Adım Çözüm

1
Enable sharing within AWS Organizations in the AWS RAM console of the management account.
Enables the ability to share resources directly with OUs and accounts within the organization without individual invitations.
This satisfies the requirement to minimize administrative overhead for any future accounts added to the OUs.
2
Create a resource share in AWS RAM from the central Network account, selecting the subnets and specifying the Production OU as the principal.
The subnets are securely shared and accessible to all accounts within the Production OU.
This allows instances in the Production OU accounts to be launched into the subnets managed by the central Network account.
3
In the management account's Billing console, access Billing Preferences and disable Savings Plans discount sharing for the Sandbox OU accounts.
Excludes sandbox accounts from consuming the purchased Compute Savings Plans.
Savings Plans application is an automated billing mechanism that must be configured from the management account's billing preferences, not via IAM or member account settings.

Anahtar Kavram

AWS Organizations billing preferences and resource sharing strategies.
Soru 826Soru →

A fleet of 10,00010,000 delivery drones upload telemetry data concurrently at the top of every hour. During these peak windows, incoming traffic spikes from a baseline of 2,0002,000 requests per second (RPS) to over 100,000100,000 RPS within a 11-minute window. The architecture consists of an Application Load Balancer (ALB) that routes requests to an Auto Scaling group (ASG) of Amazon EC2 instances. The instances process the data and store it in an Amazon Aurora MySQL DB cluster. An analytical application also queries the Aurora cluster to display real-time coordinates, but experiences severe query latencies and timeouts during the peak traffic windows. Drones also experience connection timeouts and HTTP 503 errors.

Which architectural combinations should a solutions architect implement to optimize performance and scalability during the peak windows? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Submit a support ticket to AWS to pre-warm the ALB to handle the expected instantaneous traffic spike, and configure Scheduled Scaling for the EC2 ASG to scale out before the top of the hour.; Configure Aurora Auto Scaling to dynamically provision Aurora Replicas based on reader CPU utilization, and configure the analytical application to use the Aurora reader endpoint.

Cevap

Submit a support ticket to AWS to pre-warm the ALB and configure Scheduled Scaling for the EC2 ASG; and configure Aurora Auto Scaling with Aurora Replicas using the reader endpoint.
Pre-warming the ALB is required because Application Load Balancers scale gradually, and a 50-fold instantaneous spike will result in dropped packets and HTTP 503 errors. Scheduled scaling is required for the EC2 Auto Scaling group because reactive metrics (such as CPU utilization) would take too long to detect, provision, and bootstrap instances to handle the immediate load. Offloading analytical queries to Aurora Replicas via the cluster's reader endpoint removes the read burden from the primary DB instance, while Aurora Auto Scaling dynamically manages replica count based on actual load.

Adım Adım Çözüm

1
Analyze the ingestion layer performance bottleneck.
The traffic spike increases by 50 times in under a minute, which exceeds the rate at which an Application Load Balancer (ALB) can automatically scale. Standard reactive scaling policies for the EC2 ASG will also trigger too late because instances take time to launch and bootstrap.
Requesting ALB pre-warming from AWS Support guarantees capacity is available immediately, while Scheduled Scaling ensures EC2 capacity is ready before the traffic spike begins.
2
Evaluate the database layer read scaling options.
The analytical application is causing high latency on the primary database instance because it reads from the same instance that handles ingestion writes.
By creating Aurora Replicas and routing analytical queries through the reader endpoint, the read workload is offloaded from the primary instance. Aurora Auto Scaling can then dynamically add replicas if read demand increases further.

Anahtar Kavram

Handling sudden flash traffic spikes using pre-warming and scheduled scaling, combined with horizontal read scaling of database workloads using Aurora Replicas and reader endpoints.
Soru 827Soru →

A high-growth fintech startup organizes its workloads across several AWS accounts managed under AWS Organizations. The security team has defined a strict governance posture: Sandbox accounts, grouped under a dedicated 'Sandbox' Organizational Unit (OU), must be limited to using only Amazon EC2, Amazon S3, and AWS Lambda. Local administrators in the Sandbox accounts must not be allowed to modify, delete, or bypass a centralized security monitoring IAM role named 'CentralSecurityAuditRole' deployed in each account. Additionally, developers in the Sandbox accounts must retain the ability to create and manage their own local IAM roles and policies for application testing, without the capability of elevating their permissions to modify the security monitoring role. Which design strategy should a solutions architect implement to meet these requirements with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Attach a Service Control Policy (SCP) to the Sandbox OU that denies all actions not belonging to the EC2, S3, and Lambda service namespaces, and denies all IAM modification and deletion actions where the resource matches the ARN of the 'CentralSecurityAuditRole'. Allow the default FullAWSAccess SCP to remain, and instruct developers to use local IAM policies for granting their day-to-day permissions.

Cevap

The correct strategy is to attach an SCP to the Sandbox OU that denies all actions outside the EC2, S3, and Lambda namespaces, and denies all IAM modification/deletion actions targeting the specific CentralSecurityAuditRole ARN, while using local IAM policies to grant permissions.
The correct strategy uses an SCP to restrict services and protect the centralized monitoring role. An SCP functions as a filter that restricts the maximum allowed permissions for accounts under an OU, but does not grant permissions directly. By explicitly denying IAM write or deletion operations targeting the ARN of the security auditing role, even administrators with local Full AdministratorAccess are prevented from modifying it. Developers are still permitted to create and manage local IAM roles since the deny is resource-specific. Local IAM policies are then used to grant actual operational permissions.

Adım Adım Çözüm

1
Identify the mechanism to restrict services globally for the Sandbox OU.
Determine that a Service Control Policy (SCP) attached to the Sandbox OU is the correct tool to set permission guardrails and limit API access to EC2, S3, and Lambda.
SCPs are policy-based controls used to manage permissions in an organization, defining the maximum permissions for member accounts.
2
Determine how to protect the central security role from being deleted by local administrators.
Select an SCP deny statement targeting the specific IAM role ARN to prevent modification or deletion.
A Deny statement in an SCP overrides any local administrator permissions and cannot be bypassed by local admins in the member accounts.
3
Evaluate the options for granting developers permission to manage local IAM roles.
Ensure the SCP's deny statement is resource-specific (targeting only the central security role) rather than blocking all IAM operations, and use local IAM policies for general access.
This allows developers to manage other IAM roles as required while protecting the critical auditing role.

Anahtar Kavram

Service Control Policies (SCPs) act as permission boundaries/filters for AWS Organizations member accounts and can restrict actions even for local administrator accounts.
Tahmini Süre:3m 0s
Soru 828Soru →

An enterprise uses AWS Organizations with a delegated administrator account for AWS IAM Identity Center. The organization federates with an external SAML 2.0 Identity Provider (IdP) to manage employee access. The security team must enforce a central security control: users accessing any member accounts in the 'Production' Organizational Unit (OU) must have authenticated using Multi-Factor Authentication (MFA) at the IdP. The IdP includes a SAML attribute named MFA_Verified with a value of true for sessions where MFA was completed. The security team wants to enforce this policy centrally across the Production OU without modifying individual permission sets.

Which combination of steps should a solutions architect implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Enable Attributes for Access Control (ABAC) in AWS IAM Identity Center, and map the SAML attribute MFA_Verified to the IAM session tag MFA_Status. Apply a Service Control Policy (SCP) to the Production OU that denies all actions when the principal is an IAM Identity Center role under the path /aws-reserved/sso.amazonaws.com/ and the condition aws:PrincipalTag/MFA_Status is not equal to true.

Cevap

Enable Attributes for Access Control (ABAC) in AWS IAM Identity Center to map the SAML attribute to the IAM session tag, and apply an SCP to the Production OU denying access to the IAM Identity Center roles if the session tag is not set to true.
The correct solution leverages Attribute-Based Access Control (ABAC) in AWS IAM Identity Center. By mapping the SAML attribute MFA_Verified to an IAM session tag (such as MFA_Status), the tag is automatically passed as a principal tag (aws:PrincipalTag/MFA_Status) when a user federates into a member account. Applying a Service Control Policy (SCP) to the Production OU that denies access to IAM Identity Center federated roles (which reside under the /aws-reserved/sso.amazonaws.com/ path) if the tag is not set to true ensures centralized, non-circumventable enforcement without having to modify the permissions of individual permission sets.

Adım Adım Çözüm

1
Enable Attributes for Access Control (ABAC) in the AWS IAM Identity Center console.
This allows SAML assertion attributes from the external Identity Provider (IdP) to be mapped to transient IAM session tags.
SAML attributes must be converted into IAM session tags before they can be evaluated by IAM policies or SCPs in target member accounts.
2
Map the SAML attribute 'MFA_Verified' to the IAM session tag 'MFA_Status' within the IAM Identity Center configuration.
Every federated session assumed via IAM Identity Center will automatically carry the 'aws:PrincipalTag/MFA_Status' tag with the value ('true' or 'false') passed from the IdP.
This establishes the PrincipalTag context key necessary for conditional evaluations.
3
Create a Service Control Policy (SCP) that denies all actions ('Action': '*') for IAM Identity Center roles if 'aws:PrincipalTag/MFA_Status' is not equal to 'true', and apply it to the Production Organizational Unit (OU).
Any federated user attempting to perform actions in production member accounts will be blocked unless their session tag verifies that MFA was completed at the IdP.
Applying the guardrail via an SCP ensures centralized enforcement across the Production OU without modifying individual permission sets.

Anahtar Kavram

Attribute-Based Access Control (ABAC) in IAM Identity Center combined with Service Control Policies (SCPs) for central policy enforcement.
Soru 829Soru →

A digital publishing company is preparing to launch a new global subscription portal. The company expects an immediate and massive influx of traffic—growing from a baseline of 2,0002,000 requests per second to over 800,000800,000 requests per second within a 33-minute window—during a live national broadcast.

The proposed architecture consists of:
- An Application Load Balancer (ALB) acting as the entry point.
- An Auto Scaling group of Amazon EC2 instances running a containerized, stateless application.
- A single-primary Amazon RDS for PostgreSQL database deployed across multiple Availability Zones (Multi-AZ) to handle user profiles and subscriptions. Database analysis indicates that the workload during peak traffic will be highly read-intensive, with a 10:110:1 ratio of read operations to write operations.

Which two actions should the solutions architect take to meet the performance and scalability requirements of this launch?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Open a support ticket to pre-provision capacity on the Application Load Balancer, specifying the expected peak rate of 800,000800,000 requests per second and the 33-minute ramp-up timeline.; Migrate the backend database to Amazon Aurora PostgreSQL, and configure Aurora Auto Scaling to dynamically provision Aurora Replicas based on reader instance CPU utilization.

Cevap

To ensure the application scales and performs under sudden peak load, the solutions architect must open a support ticket to pre-provision Application Load Balancer capacity, and migrate the database to Amazon Aurora PostgreSQL to utilize dynamically scaled Aurora Replicas for the heavy read workload.
To scale for an immediate spike from 2,0002,000 to 800,000800,000 requests per second, the Application Load Balancer must be pre-warmed by AWS Support to ensure the underlying nodes can handle the initial volume without dropping packets. Furthermore, offloading read queries to dynamically scaled Aurora Replicas on Amazon Aurora PostgreSQL effectively handles the 10:110:1 read-to-write ratio, ensuring the primary database instance is not overwhelmed.

Adım Adım Çözüm

1
Analyze the traffic profile and load balancer capability.
Identify that a traffic jump from 2,0002,000 to 800,000800,000 requests per second in 33 minutes exceeds the automatic scaling rate of the Application Load Balancer.
The Application Load Balancer scales in response to steady increases, but extreme, near-instantaneous spikes require pre-warming (pre-provisioning) by AWS Support to prevent connection drops.
2
Evaluate the database read scaling requirements.
Determine that a 10:110:1 read-to-write ratio requires a database engine that supports horizontal read scaling.
Amazon RDS Multi-AZ deployments use a passive standby that cannot serve read requests. Migrating to Amazon Aurora PostgreSQL allows the use of up to 1515 Aurora Replicas to offload read traffic.
3
Configure dynamic scaling for the read replicas.
Implement Aurora Auto Scaling based on CPU utilization to handle dynamic read request volume changes.
This ensures that as the read load increases during the national broadcast, new read replicas are automatically created, and as traffic subsides, they are removed to control costs.

Anahtar Kavram

Scaling load balancers for instant traffic surges and horizontal database read scaling.
Soru 830Soru →

A biotech company has a multi-account AWS environment managed under AWS Organizations. A central Network account hosts a VPC connected to the company's on-premises laboratory network via AWS Direct Connect. Multiple Workload accounts run research applications in separate VPCs. The company needs to establish a hybrid DNS resolution strategy with the following requirements:
- Instances in the Workload VPCs must resolve private records for the on-premises domain lab.local hosted on on-premises DNS servers.
- The on-premises laboratory network must resolve records in a Route 53 Private Hosted Zone (PHZ) for research.internal hosted in the Network account.
- Instances in the Workload VPCs must also resolve records in research.internal.

Which of the following configurations meets these requirements with the least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: In the Network account, create Route 53 Resolver Inbound and Outbound Endpoints in the Network VPC. Create a Resolver forwarding rule for the domain lab.local that points to the on-premises DNS servers, and share the rule with the Workload accounts using AWS Resource Access Manager (RAM). Associate the rule with all VPCs. Authorize the association of the research.internal PHZ with the Workload VPCs, and perform the associations from the Workload accounts. Configure the on-premises DNS servers to forward queries for research.internal to the Inbound Endpoint IP addresses.

Cevap

The correct configuration is to deploy Route 53 Resolver Inbound and Outbound Endpoints in the Network VPC, share the outbound rule via AWS Resource Access Manager (RAM), authorize and associate the Private Hosted Zone cross-account, and point on-premises DNS servers to the Inbound Endpoint.
The correct solution involves creating Inbound and Outbound Route 53 Resolver Endpoints in the central Network VPC. The Outbound Endpoint handles DNS forwarding from all AWS VPCs to on-premises DNS servers via a shared Resolver Rule distributed using AWS RAM. This avoids deploying endpoints in every workload VPC, saving costs. Cross-account PHZ association enables EC2 instances in the Workload VPCs to query the private hosted zone directly. Lastly, forwarding on-premises queries to the Inbound Endpoint allows the laboratory network to resolve resources in the AWS private zone.

Adım Adım Çözüm

1
Deploy Route 53 Resolver Inbound and Outbound Endpoints in the Network VPC.
Establishes physical endpoints to receive DNS queries from on-premises (Inbound) and send queries to on-premises (Outbound).
Allows resolving DNS between the on-premises network and AWS VPCs over the Direct Connect connection.
2
Create a Route 53 Resolver forwarding rule for lab.local pointing to the on-premises DNS servers and share it with the Workload accounts via AWS Resource Access Manager (RAM).
Enables all VPCs in the Workload accounts to associate with the forwarding rule.
Allows EC2 instances in the Workload VPCs to forward queries for lab.local to the central Outbound Endpoint, minimizing endpoint costs.
3
Authorize the association of the research.internal Private Hosted Zone with the Workload VPCs in the Network account, and associate them from the Workload accounts.
Enables instances in the Workload VPCs to resolve records in research.internal directly.
A Private Hosted Zone must be associated with a VPC to be queryable by resources in that VPC, and cross-account associations require authorization.
4
Configure the on-premises DNS servers to forward queries for research.internal to the Inbound Endpoint IP addresses.
Allows on-premises hosts to resolve records inside the AWS PHZ.
Directs local laboratory queries for the AWS domain to the Inbound Endpoint, which resolves them via the local Route 53 Resolver.

Anahtar Kavram

Cross-account Private Hosted Zone (PHZ) association and Route 53 Resolver Rule sharing using AWS RAM represent the standard pattern for multi-account and hybrid DNS resolution, separating VPC DNS endpoints from consumer spoke VPCs to optimize costs.
Soru 831Soru →

An enterprise is designing a secure transaction logging system. The application runs in a Production Account (Account ID: 444455556666444455556666) and needs to write transaction logs to an Amazon S3 bucket located in a centralized Logging Account (Account ID: 111122223333111122223333). The logs must be encrypted at rest using AWS KMS. The security team requires that key management remains centralized in the Logging Account and that access follows the principle of least privilege. Which of the following configurations are required to support this cross-account writing and encryption pattern? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the Logging Account, configure the S3 bucket policy to grant s3:PutObject permissions to the IAM role of the application in the Production Account.; In the Logging Account, create a customer managed KMS key and configure its key policy to grant the application's IAM role in the Production Account permissions for kms:GenerateDataKey and kms:Decrypt.

Cevap

In the Logging Account, configure the S3 bucket policy to grant s3:PutObject permissions to the IAM role of the application in the Production Account, and in the Logging Account, create a customer managed KMS key and configure its key policy to grant the application's IAM role in the Production Account permissions for kms:GenerateDataKey and kms:Decrypt.
The correct solution involves two main components for secure cross-account logging: first, modifying the destination S3 bucket policy to allow the source account's IAM role to upload objects via the s3:PutObject permission. Second, establishing a customer managed KMS key in the logging account and updating its key policy to trust the source account's application IAM role with the kms:GenerateDataKey and kms:Decrypt permissions, which are required to write encrypted objects to S3.

Adım Adım Çözüm

1
Analyze cross-account bucket access requirements.
Cross-account access to Amazon S3 requires both an IAM policy on the sender side allowing s3:PutObject and a bucket policy in the receiving account allowing the same action for the sender's identity.
By default, cross-account access is denied unless explicitly authorized on both the identity side (IAM) and the resource side (bucket policy).
2
Analyze KMS key requirements for cross-account encryption.
AWS managed keys (aws/s3) cannot be shared across accounts because their key policies cannot be modified. A customer managed key must be used instead, and its key policy must explicitly list the Production Account's IAM role as a principal allowed to perform kms:GenerateDataKey and kms:Decrypt.
Security controls require centralized key management, which is achieved by hosting the customer managed KMS key in the Logging Account and delegating access via its key policy.

Anahtar Kavram

Cross-account S3 access combined with cross-account KMS key encryption requires a customer managed key with explicit key policy delegation and an S3 bucket policy that authorizes the cross-account role principal.
Soru 832Soru →

A solutions architect is designing an integration where an application running on Amazon EC2 instances in Account A must read encrypted objects from an Amazon S3 bucket in Account B. The objects are encrypted using Server-Side Encryption with AWS KMS (SSE-KMS). Which key configuration will successfully allow the application in Account A to decrypt the objects?

Cevabı ve açıklamayı göster

Cevap: Use a Customer Managed Key in Account B, and configure its key policy to grant the IAM role in Account A decrypt permissions.

Cevap

Use a Customer Managed Key in Account B, and configure its key policy to grant the IAM role in Account A decrypt permissions.
Using a Customer Managed Key (CMK) in Account B allows you to modify its key policy. In a cross-account scenario, the key policy of the CMK in the owning account (Account B) must explicitly grant decrypt permissions to the principal (IAM role) in the reading account (Account A). The role in Account A also needs the corresponding IAM permissions to call the KMS Decrypt action.

Adım Adım Çözüm

1
Select a Customer Managed Key (CMK) rather than an AWS-managed key, as AWS-managed keys cannot be shared across accounts.
You have a key that supports custom key policies for cross-account access.
AWS-managed keys (aws/s3) do not allow policy modifications.
2
Modify the key policy of the CMK in Account B to trust the principal (IAM role) in Account A for the kms:Decrypt action.
Account A is delegated the authority to use the key.
Cross-account access to KMS requires explicit permission delegation in the key policy.
3
Configure the IAM role in Account A with a policy that allows kms:Decrypt on the CMK in Account B.
The application in Account A has both local and resource-level permissions to decrypt.
Both sides of the cross-account boundary must allow the operation.

Anahtar Kavram

Cross-account KMS key sharing requires a Customer Managed Key with a key policy that delegates access to the external account, along with matching local IAM permissions in the external account.
Tahmini Süre:1m 0s
Soru 833Soru →

A financial services company needs to establish secure, scalable, and resilient network connectivity between its on-premises database environment and three VPCs (Production, Testing, and Shared Services) distributed across two AWS accounts in the us-east-1 Region. The on-premises database must communicate with all three VPCs. Additionally, the Shared Services VPC hosts centralized monitoring tools that must communicate with the Production and Testing VPCs. The solution must minimize routing table maintenance and administrative overhead as the company expands its AWS footprint. Which network architecture best meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway in the primary account and share it with the secondary account using AWS Resource Access Manager. Attach all three VPCs to the Transit Gateway, and use an AWS Direct Connect Gateway associated with the Transit Gateway using a Transit Virtual Interface to connect to the on-premises environment.

Cevap

Deploying an AWS Transit Gateway shared via AWS Resource Access Manager (RAM), attaching all VPCs, and connecting them to on-premises via a Direct Connect Gateway using a Transit Virtual Interface (Transit VIF).
The correct architecture utilizes AWS Transit Gateway shared via AWS Resource Access Manager (RAM) to connect all VPCs across both accounts in a hub-and-spoke model. To connect the Transit Gateway to the on-premises environment using AWS Direct Connect, a Transit Virtual Interface (Transit VIF) must be established and connected to a Direct Connect Gateway. The Direct Connect Gateway is then associated with the Transit Gateway, enabling scalable, transitive routing between the on-premises database and all attached VPCs without complex configuration.

Adım Adım Çözüm

1
Evaluate the need for multi-account VPC-to-VPC and hybrid connectivity.
Identify that AWS Transit Gateway is the optimal service to act as a cloud router, supporting transitive routing between VPCs and the on-premises environment.
Direct VPC-to-VPC routing and centralized hub-and-spoke topologies are best managed by Transit Gateway to avoid complex peering meshes.
2
Determine the sharing mechanism for the multi-account architecture.
Share the AWS Transit Gateway from the primary account to the secondary account using AWS Resource Access Manager (RAM).
This allows VPCs in different AWS accounts to attach to the same Transit Gateway, centralizing management and simplifying policy control.
3
Configure the hybrid network path via AWS Direct Connect.
Establish a Transit Virtual Interface (Transit VIF) on the Direct Connect connection, associate it with a Direct Connect Gateway, and associate the Direct Connect Gateway with the Transit Gateway.
Transit VIF is the only Direct Connect interface type that supports connection to a Direct Connect Gateway associated with an AWS Transit Gateway, enabling hybrid transitive routing.

Anahtar Kavram

AWS Transit Gateway with Direct Connect Gateway and Transit VIF for multi-account hybrid routing
Soru 834Soru →

A global virtual event management company is deploying a live interactive polling application. The application will host a synchronous global event at exactly 12:00 UTC, where a baseline of 5,0005,000 concurrent HTTP connections is expected to immediately spike to 2,000,0002,000,000 concurrent connections within a 6060-second window. The application is hosted on Amazon ECS using the AWS Fargate launch type, running behind an Application Load Balancer (ALB). The containerized application reads event metadata from an Amazon Aurora PostgreSQL database cluster. The database must maintain sub-10-millisecond response times under peak load. Which combination of scaling and configuration actions should a solutions architect recommend to ensure the application scales seamlessly during the launch while maintaining performance?

Cevabı ve açıklamayı göster

Cevap: Request ALB pre-warming from AWS Support based on the expected traffic profile. Configure ECS Scheduled Scaling to provision the target number of Fargate tasks 30 minutes prior to the event. Implement Aurora Auto Scaling for the database cluster's Aurora Replicas to scale out read capacity in response to the query load.

Cevap

Request ALB pre-warming from AWS Support based on the expected traffic profile. Configure ECS Scheduled Scaling to provision the target number of Fargate tasks 30 minutes prior to the event. Implement Aurora Auto Scaling for the database cluster's Aurora Replicas to scale out read capacity in response to the query load.
The correct option addresses the scaling challenges at every layer of the architecture for a highly predictable flash-traffic event. Requesting ALB pre-warming ensures that the load balancer is scaled in advance to handle the 2,000,0002,000,000 concurrent connections. Configuring ECS Scheduled Scaling launches Fargate tasks 30 minutes early, removing the container bootstrapping delay. Finally, utilizing Aurora Auto Scaling dynamically manages database read replicas to handle query loads, ensuring sub-10ms response times.

Adım Adım Çözüm

1
Analyze the load balancer scaling characteristics.
Determine that an Application Load Balancer scales in response to traffic but requires time to provision resources. A sudden, multi-magnitude spike over a 60-second window will exceed the ALB's dynamic scaling rate, requiring manual pre-warming.
AWS Support must pre-warm the ALB based on the expected Request Per Second (RPS) and connection profile to prevent dropped packets.
2
Evaluate application-tier container provisioning latency.
Identify that dynamic Auto Scaling policies (like target tracking) take time to trigger, pull images, and bootstrap container tasks.
ECS Scheduled Scaling is required to pre-provision the ECS Fargate tasks before the peak event starts at 12:00 UTC.
3
Evaluate database horizontal scalability.
Confirm that Aurora PostgreSQL read traffic must scale horizontally using Aurora Replicas under an Auto Scaling policy.
Standard Multi-AZ standby instances do not serve read requests and cannot scale read traffic. Aurora Replicas must be scaled to maintain sub-10ms query times.

Anahtar Kavram

Handling flash traffic spikes by combining load balancer pre-warming, scheduled compute capacity scaling, and horizontal database read replicas.
Tahmini Süre:3m 0s
Soru 835Soru →

A global pharmaceutical corporation has a multi-account AWS environment spread across two AWS Regions: ap-southeast-1 and ap-northeast-1. The corporation connects its regional on-premises research facilities in Singapore and Tokyo to AWS. In each AWS Region, a Transit Gateway (TGW) connects regional VPCs. The two TGWs are peered. For hybrid connectivity, a global Direct Connect Gateway (DXGW) is associated with both TGWs. A Singapore Direct Connect Transit Virtual Interface (VIF) connects the Singapore data center to the DXGW, and a Tokyo Direct Connect Transit VIF connects the Tokyo data center to the DXGW. To ensure high availability, the solutions architect deploys AWS Site-to-Site VPN connections from each data center to its local regional TGW as a backup. The Singapore data center uses the IP prefix 10.100.0.0/1610.100.0.0/16, and the Tokyo data center uses the IP prefix 10.200.0.0/1610.200.0.0/16. The architecture must satisfy the following routing requirements: (1) Under normal operating conditions, all traffic between the Singapore data center and AWS resources in ap-southeast-1 must use the Singapore Direct Connect connection; (2) If the Singapore Direct Connect connection fails, traffic between the Singapore data center and ap-southeast-1 must fail over to the Singapore Site-to-Site VPN; (3) Transitive routing between the Singapore data center and the Tokyo data center through the AWS network must be prevented; (4) Symmetrical routing must be maintained to prevent stateful firewalls on-premises from dropping packets due to asymmetric routing. Which TWO configurations should the solutions architect implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: On the customer gateway devices in both Singapore and Tokyo, configure a higher BGP Local Preference for routes received over the Direct Connect Transit VIFs compared to routes received over the Site-to-Site VPN connections.; In each Transit Gateway, create separate route tables for the VPC attachments, the peering attachment, and the hybrid (Direct Connect and VPN) attachments. In the peering route table, associate the peering attachment and propagate routes only from the VPC attachments. In the hybrid route table, associate the Direct Connect Gateway and VPN attachments and propagate routes only from the VPC attachments.

Cevap

Configure a higher BGP Local Preference on the customer gateway devices for routes received over the Direct Connect Transit VIFs, and create separate Transit Gateway route tables for the VPC, peering, and hybrid attachments to restrict route propagation between the peered region and hybrid connections.
To establish symmetric routing under normal conditions, the outbound path from on-premises to AWS must align with the inbound path from AWS to on-premises. AWS Transit Gateway automatically prefers the Direct Connect Gateway attachment over the Site-to-Site VPN attachment for identical prefixes. Configuring a higher BGP Local Preference on the customer gateway devices for routes received via Direct Connect ensures that the on-premises routers also prefer the Direct Connect path, preventing asymmetric routing. To prevent transitive routing between the Singapore and Tokyo data centers, separate Transit Gateway route tables must be created for the peering and hybrid attachments. By only propagating VPC attachment routes into the peering and hybrid route tables, on-premises prefixes are never advertised to the peered region, and traffic from the local data center is restricted from reaching the peering connection.

Adım Adım Çözüm

1
Analyze path selection criteria for traffic from AWS to on-premises.
Identify that AWS Transit Gateway path selection prioritizes Direct Connect Gateway attachments over Site-to-Site VPN attachments when identical prefixes are advertised. This means traffic from AWS to on-premises will naturally use the Direct Connect connection under normal conditions, and fail over to VPN if Direct Connect is unavailable.
Establishes the default inbound routing behavior of AWS Transit Gateway.
2
Analyze path selection for traffic from on-premises to AWS to prevent asymmetric routing.
Configure the customer gateway (CGW) to prefer the Direct Connect path over the VPN path. This is achieved by setting a higher BGP Local Preference on the CGW for routes received via the Direct Connect Transit Virtual Interfaces (VIFs) compared to those received via the Site-to-Site VPN.
Ensures symmetric routing by making the outbound path from the data centers to AWS match the inbound path.
3
Design the Transit Gateway routing structure to isolate the Singapore and Tokyo data centers and prevent transitive routing.
Implement multiple Transit Gateway route tables (VPC, Peering, and Hybrid). Associate the hybrid attachments (DXGW and VPN) with a Hybrid Route Table that only propagates routes from VPC attachments, and associate the peering attachment with a Peering Route Table that also only propagates routes from VPC attachments.
By limiting propagations in the peering and hybrid route tables, on-premises prefixes are not advertised across the peered Transit Gateways, preventing the on-premises networks from communicating with each other through the AWS network.

Anahtar Kavram

AWS Transit Gateway hardcoded path selection rules, BGP routing configuration on customer gateways to prevent asymmetric routing, and Transit Gateway route table segregation to block transitive routing.
Tahmini Süre:4m 0s
Soru 836Soru →

A company is designing a federated identity solution to allow developers to access resources across multiple member accounts in an AWS Organization. The company has a centralized, OpenID Connect (OIDC) compliant Identity Provider (IdP) containing all developer user identities. A solutions architect needs to establish trust between the IdP and the IAM roles in each member account.

Which of the following actions must the solutions architect take in each member account to configure this federated trust relationship? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM OpenID Connect (OIDC) identity provider that uses the issuer URL of the corporate IdP and specifies the client ID as the audience.; Create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action for the IAM OIDC provider principal.

Cevap

To configure the federated trust relationship using OIDC, the solutions architect must create an IAM OIDC identity provider using the corporate IdP's issuer URL and client ID, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action for the OIDC provider principal.
To establish federation with an external OpenID Connect (OIDC) Identity Provider across multiple AWS accounts, two main steps must be taken in each target member account. First, an IAM OIDC identity provider must be created in the target account to establish trust with the corporate IdP using its issuer URL and client ID. Second, an IAM role must be created in the target account with a trust policy that allows the sts:AssumeRoleWithWebIdentity action for the OIDC provider principal. This allows the corporate IdP's users to exchange their OIDC token for temporary AWS credentials using the Security Token Service (STS).

Adım Adım Çözüm

1
Configure the OIDC provider in the member accounts.
An IAM OIDC identity provider is established in each target account to recognize tokens from the external corporate IdP.
AWS must trust the external identity provider before any federated identities can perform actions or assume roles.
2
Create the target IAM roles and set their trust policies.
IAM roles are created with trust policies specifying the OIDC provider as a principal and allowing sts:AssumeRoleWithWebIdentity.
This allows the OIDC federated users to call the AWS STS service to assume the roles using OIDC tokens.

Anahtar Kavram

Establishing OpenID Connect (OIDC) federation across a multi-account AWS environment by configuring IAM OIDC providers and role trust policies using the sts:AssumeRoleWithWebIdentity action.
Tahmini Süre:2m 0s
Soru 837Soru →

A company is designing the deployment strategy for a microservice running on Amazon ECS with the AWS Fargate launch type. The microservice requires a baseline of 10 tasks to meet performance requirements. The deployment process must adhere to the following constraints:

* The service must experience zero downtime.
* The compute cost during the deployment must not exceed 130% of the normal baseline cost.
* If a new version fails container health checks, the deployment must automatically roll back to the previous version without manual intervention.

Which two configurations should the Solutions Architect specify in the ECS service definition and deployment pipeline to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the service to use the ECS rolling update (ECS) deployment controller, and enable the deployment circuit breaker with rollback.; Set the deployment configuration parameters minimumHealthyPercent to 100 and maximumPercent to 130.

Cevap

Configure the service to use the ECS rolling update deployment controller with the deployment circuit breaker and rollback enabled, and set the deployment configuration parameters to a minimum healthy percent of 100 and a maximum percent of 130.
To achieve zero downtime without exceeding a 30% temporary increase in compute cost, the ECS service must perform a rolling update (using the ECS deployment controller) where the minimum healthy percentage is set to 100% (ensuring all 10 baseline tasks remain running) and the maximum percentage is set to 130% (limiting the maximum tasks to 13). Additionally, enabling the ECS deployment circuit breaker with the rollback feature ensures that if the new tasks fail health checks, the service automatically rolls back to the previous stable state.

Adım Adım Çözüm

1
Analyze the capacity and cost constraints during the deployment.
The baseline is 10 tasks. Zero downtime means the number of running healthy tasks must not drop below 10 (minimum healthy percent must be at least 100%). The cost must not exceed 130% of the baseline, which means the maximum running tasks during deployment must not exceed 13 (maximum percent must be at most 130%).
To determine the bounds for the ECS deployment configuration parameters.
2
Evaluate the deployment controllers against the capacity constraints.
AWS CodeDeploy blue/green deployments (using the CODE_DEPLOY controller) instantiate a full replacement task set (100% additional capacity, or 20 tasks total) before starting traffic shifting. This violates the 130% cost limit. Thus, the native ECS rolling update controller must be used.
To eliminate the CodeDeploy deployment controller option.
3
Determine the automatic rollback mechanism for the ECS rolling update controller.
The Amazon ECS deployment circuit breaker can be enabled with rollback. If the new task set fails health checks, ECS will automatically roll back to the previously successful version.
To satisfy the requirement for automatic, non-manual rollbacks.

Anahtar Kavram

ECS Rolling Updates and Deployment Circuit Breaker Capacity Management
Soru 838Soru →

A media conglomerate is designing a security and compliance architecture for a new video processing pipeline. The pipeline involves a transcoding application running on Amazon ECS tasks in the Media Processing account (Account 111122223333). The processed video files must be written directly to a centralized Amazon S3 bucket located in the Compliance Archive account (Account 444455556666). The S3 bucket is encrypted using a Customer Managed Key (CMK) in the Compliance Archive account. The regulatory team requires that all uploaded videos are owned exclusively by the Compliance Archive account, and the ECS tasks must be able to encrypt the objects during upload. Which combination of configurations will allow the ECS tasks to successfully write the files to the centralized S3 bucket? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable S3 Object Ownership with the Bucket Owner Enforced setting on the S3 bucket in the Compliance Archive account, and configure the S3 bucket policy to grant s3:PutObject permissions to the ECS task role in the Media Processing account.; Configure the KMS key policy in the Compliance Archive account to grant kms:GenerateDataKey and kms:Decrypt permissions to the ECS task role in the Media Processing account, and configure the ECS task IAM policy in the Media Processing account to grant the same KMS permissions.

Cevap

Configure Bucket Owner Enforced ownership on the destination S3 bucket along with cross-account s3:PutObject permissions on the bucket policy, and configure both the source IAM policy and the destination KMS key policy to permit kms:GenerateDataKey and kms:Decrypt on the Customer Managed Key for the ECS task role.
To achieve cross-account uploads with bucket-owner ownership and CMK encryption, the destination bucket must disable ACLs using S3 Object Ownership (Bucket Owner Enforced), and its policy must trust the source ECS task role. Additionally, the destination KMS key policy and the source IAM policy must both grant kms:GenerateDataKey and kms:Decrypt permissions to the ECS task role.

Adım Adım Çözüm

1
Address object ownership in the destination bucket.
By enabling S3 Object Ownership with the Bucket Owner Enforced setting, access control lists (ACLs) are disabled, and all objects uploaded to the bucket by external accounts automatically become owned and controlled by the bucket owner (Compliance Archive account).
This satisfies the requirement that all uploaded videos must be owned exclusively by the Compliance Archive account.
2
Set up the destination S3 bucket policy.
The bucket policy must explicitly grant s3:PutObject permissions to the ECS task role principal from the Media Processing account.
For cross-account access, trust must be established in the resource-based policy of the receiving account.
3
Configure encryption permissions on the Customer Managed Key.
Modify the KMS key policy in the Compliance Archive account to allow the ECS task role in the Media Processing account to call kms:GenerateDataKey and kms:Decrypt.
AWS S3 requires kms:GenerateDataKey to write encrypted objects and kms:Decrypt to verify the write (especially during multipart uploads) when using a Customer Managed Key.
4
Grant outbound KMS permissions to the ECS task role.
Add an IAM policy to the ECS task role in the Media Processing account allowing kms:GenerateDataKey and kms:Decrypt on the CMK ARN.
For cross-account access to KMS, both the key policy (resource-based policy) and the IAM policy (identity-based policy) must explicitly permit the actions.

Anahtar Kavram

Cross-account access and encryption control design using S3 Bucket Policies, S3 Object Ownership settings, and Customer Managed KMS Keys.
Tahmini Süre:2m 30s
Soru 839Soru →

A global smart-grid utility company is deploying a system to monitor 8,000,0008,000,000 smart meters. At exactly 00:00 UTC each day, every meter uploads a 2 KB2\text{ KB} JSON status payload via HTTPS to a telemetry endpoint. The system must process this data and store it in an Amazon Aurora PostgreSQL database for daily reporting. The telemetry ingestion endpoint experiences a sudden traffic spike, surging from a baseline of under 1010 requests per second (RPS) to over 150,000150,000 RPS within 3030 seconds. Which architecture provides the most performant and scalable design to ingest and process this data without dropping requests?

Cevabı ve açıklamayı göster

Cevap: Deploy an Application Load Balancer (ALB) that routes incoming requests to an Amazon ECS service running on AWS Fargate. Have the ECS tasks ingest the payloads directly into an Amazon Kinesis Data Stream. Configure a separate ECS service to consume data from Kinesis and perform batched writes to the Aurora PostgreSQL database. Contact AWS Support to pre-warm the ALB with the anticipated traffic profile.

Cevap

Deploy an Application Load Balancer (ALB) that routes incoming requests to an Amazon ECS service running on AWS Fargate. Have the ECS tasks ingest the payloads directly into an Amazon Kinesis Data Stream. Configure a separate ECS service to consume data from Kinesis and perform batched writes to the Aurora PostgreSQL database. Contact AWS Support to pre-warm the ALB with the anticipated traffic profile.
The correct solution addresses the network layer bottlenecks by pre-warming the Application Load Balancer (ALB) through AWS Support, ensuring it can handle the sudden 150,000150,000 RPS load. It also addresses the database layer bottleneck by introducing Amazon Kinesis Data Streams to buffer the telemetry payloads, allowing the backend tasks to perform efficient batch inserts into Aurora PostgreSQL instead of direct, high-frequency, single-record writes.

Adım Adım Çözüm

1
Evaluate the traffic spike characteristics and the capacity of the Application Load Balancer (ALB).
An instantaneous traffic surge from 1010 to 150,000150,000 RPS within 3030 seconds exceeds the rate at which an ALB can reactively scale, requiring pre-warming by AWS Support.
Standard ALB scaling requires a few minutes to scale out to support massive surges. Pre-warming configures the load balancer with enough capacity to handle the peak load immediately.
2
Analyze the database write requirements and options for buffering.
Directly writing 150,000150,000 payloads per second to Aurora PostgreSQL will overwhelm the database with write locks and connection limits.
Using Amazon Kinesis Data Streams decouples telemetry ingestion from database writes. This allows consumer tasks to read from the stream and batch the writes to Aurora, which is significantly more efficient than individual writes.
3
Review the scaling behavior of database replicas and global write forwarding features.
Aurora Replicas and Aurora Global Database write forwarding do not scale write throughput horizontally on the primary database instance.
Aurora Replicas only serve read queries, and write forwarding merely redirects writes to the single primary instance, keeping it as the bottleneck.

Anahtar Kavram

Handling flash traffic spikes requires pre-warming the load balancing layer and decoupling the database writes from the ingestion API using a message queue or data stream to buffer the load.
Soru 840Soru →

A decentralized financial services platform operates a multi-account environment on AWS with 6565 member accounts managed via AWS Organizations. The compliance team requires all AWS API activity to be logged centrally in a dedicated Logging account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS), and the solution must enforce log file integrity. Additionally, member account administrators must be prevented from disabling the logging configuration or modifying the logging resources.

Which TWO actions should a Solutions Architect perform to implement this solution?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon S3 bucket in the Logging account with a bucket policy that grants s3:PutObject and s3:GetBucketAcl permissions to the AWS CloudTrail service principal, using the aws:PrincipalOrgID condition to allow log delivery from all accounts in the organization, and enable log file integrity on the organization trail.; Create a customer managed KMS key in the Logging account with a key policy that grants the AWS CloudTrail service principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey operations, using the aws:PrincipalOrgID condition key to restrict access to the organization, and configure the organization trail to use this key.

Cevap

To implement centralized logging, the Solutions Architect must create an S3 bucket in the Logging account with a bucket policy permitting the CloudTrail service principal to write objects using the organization ID condition. Additionally, a customer managed KMS key must be created in the Logging account with a key policy allowing the CloudTrail service principal to generate data keys and describe keys, restricted by the organization ID condition.
The correct solution involves creating both the destination S3 bucket and the customer managed KMS key in the centralized Logging account. Because AWS CloudTrail delivers logs from various member accounts, it acts as a cross-account service writer. The S3 bucket policy must explicitly permit the AWS CloudTrail service principal to write logs, restricted to the AWS Organization using the principal organization ID condition. Similarly, since AWS-managed KMS keys cannot have their policies modified to authorize cross-account usage, a customer managed key is required. The customer managed KMS key policy must grant permissions to the CloudTrail service principal for key generation and description, restricted by the organization ID.

Adım Adım Çözüm

1
Set up the destination S3 bucket and a customer managed KMS key in the centralized Logging account.
The logging infrastructure is deployed in the secure Logging account.
Centralizing logs requires destination resources to reside in the designated audit/security account to restrict administrative access.
2
Configure the S3 bucket policy and KMS key policy to permit cross-account writes from the CloudTrail service principal, using the aws:PrincipalOrgID condition key.
Resource-level permissions are in place allowing the organization's member accounts to deliver logs.
AWS-managed KMS keys do not support policy alterations required for cross-account service operations, necessitating a customer managed key.
3
Create an organization trail from the management or delegated administrator account, configuring S3 delivery to the central bucket, enabling log file integrity, and linking the customer managed KMS key.
API calls across all current and future member accounts are logged, encrypted, and validated centrally.
An organization trail automates the configuration across all member accounts and ensures compliance requirements are met.

Anahtar Kavram

Centralized cross-account logging in AWS Organizations requires using a customer managed KMS key with modified key policies and S3 bucket policies tailored for the CloudTrail service principal with organizational condition keys.
Tahmini Süre:3m 0s
ÖncekiSayfa 42 / 99Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin