Tüm alıştırma soruları

An enterprise is designing a highly available, multi-account hybrid network architecture across two AWS Regions: `us-east-1` (the primary region with 50 spoke VPCs) and `us-west-2` (the secondary region with 30 spoke VPCs). A Shared Services VPC in `us-east-1` hosts a Route 53 Private Hosted Zone (PHZ) for `corp.internal` and an outbound Route 53 Resolver endpoint to resolve on-premises queries.

The enterprise has a 10 Gbps AWS Direct Connect (DX) connection at their on-premises data center (CIDR `$10.0.0.0/8$`). They want to use the DX connection as the primary path and deploy an AWS Site-to-Site VPN as a backup path. The solution must minimize latency for both regions under normal conditions, prevent asymmetric routing, support automatic failover, and ensure that resources in all spoke VPCs across both regions can resolve `corp.internal` and on-premises domain queries.

Which combination of steps meets these requirements?

A connected vehicle manufacturer is launching a real-time performance analytics platform for a global endurance racing event. The platform must ingest telemetry data from $50,000$ vehicles streaming $100\text{ KB}$ JSON payloads once per second, resulting in an aggregate write throughput of $5\text{ GB/s}$. During the starting lap of the race, the traffic pattern exhibits an instantaneous flash spike, rising from a baseline of $100\text{ requests/sec}$ to the peak load of $50,000\text{ requests/sec}$ within a $30\text{ second}$ window. The platform must ingest this telemetry with sub-$100\text{ ms}$ latency, update real-time leaderboards, and archive all raw payloads for post-race batch analytics. Which three architectural actions should a Solutions Architect recommend to achieve the required performance and scalability under these conditions?

An enterprise is designing a secure centralized log collection system. Application servers running on Amazon EC2 instances in a Production account ($111122223333$) must write transaction logs directly to an Amazon S3 bucket located in a central Security account ($444455556666$). The solutions architect must enforce the following security and compliance controls:

- Data Encryption: All log objects uploaded to the S3 bucket must be encrypted at rest using an AWS KMS key that supports automatic annual rotation.
- Access Control: The EC2 instance IAM role in the Production account must have permission to write objects to the S3 bucket and encrypt them, but must be prevented from reading, downloading, or decrypting any objects stored in the bucket.
- Data Loss Prevention: No users or roles within the AWS Organization, including administrators, are allowed to delete objects in the S3 bucket, with the sole exception of a central `SecurityAuditRole` in the Security account.

Which combination of configuration steps will satisfy these compliance requirements?

A financial technology company is designing a new multi-region web application for electronic contract signatures. The application requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. The primary infrastructure is located in the eu-west-2 (London) region, and the disaster recovery (DR) region is eu-west-1 (Ireland). The application tier consists of Amazon EC2 instances in private subnets that must access the internet to download software updates and contact external identity validation APIs. The database layer uses Amazon Aurora PostgreSQL. A private DNS endpoint db.internal.contract.com is managed in a Route 53 Private Hosted Zone for database connection strings. Which configuration should a Solutions Architect recommend to meet these requirements with high availability?

A logistics company is designing a hybrid network architecture to connect its on-premises inventory system with 12 spoke VPCs across three AWS accounts in the us-west-2 Region. The architecture must support dynamic routing, provide high availability with automatic failover, and minimize administrative overhead. The company has provisioned an AWS Direct Connect connection at a partner colocation facility.

Which TWO configurations must the solutions architect implement to establish this connectivity in accordance with AWS best practices? (Select TWO.)

A logistics company is launching a new real-time package tracking API. During holiday seasons, the API experiences sudden, massive spikes in traffic (increasing by $15$-fold within $2$ minutes) as users refresh their dashboards. The backend reads tracking data from an Amazon Aurora PostgreSQL database. The system must maintain low read latency during these spikes without impacting database write performance. Which strategy should the solutions architect recommend to handle these spikes at both the load balancer and database layers?

A logistics company is preparing to launch a real-time package tracking portal for a global shopping festival. The portal expects a sudden surge of up to $12\text{ million}$ tracking requests per minute from users during peak hours. Read queries checking package status account for $98\%$ of the database traffic. The architecture consists of an Application Load Balancer (ALB) routing requests to an Amazon Elastic Container Service (ECS) cluster running on AWS Fargate, backed by an Amazon RDS for MySQL database. Load testing reveals that the database CPU reaches $100\%$ utilization and the ALB drops incoming connections under the sudden surge of traffic.

Which two actions should the solutions architect take to optimize the performance and scalability of the architecture? (Select two.)

A global company is setting up federated access to multiple member accounts in an AWS Organization using an external SAML 2.0 Identity Provider (IdP) and AWS IAM Identity Center (AWS Single Sign-On). The solutions architect must automate user provisioning from the external IdP to AWS IAM Identity Center and configure attribute-based access control (ABAC) using the department user attribute. Which TWO configurations must the solutions architect implement to meet these requirements? (Select TWO.)

An enterprise is designing a new cloud infrastructure on AWS. The design consists of a central Shared Services VPC and two spoke VPCs (Spoke-A and Spoke-B) in the `us-east-1` Region, all connected via an AWS Transit Gateway. The application servers in the spoke VPCs must resolve internal domain names registered in a Route 53 Private Hosted Zone (`corp.internal`) that is hosted in the Shared Services AWS account. Additionally, all spoke VPCs must route outbound internet traffic through the Shared Services VPC, which must be highly resilient against an Availability Zone outage.

Which two configurations should a solutions architect implement to satisfy these requirements? (Select TWO.)

An enterprise is migrating its multi-account identity strategy to AWS IAM Identity Center to centralize user access management. The security team wants to ensure that all human user access to member accounts is routed exclusively through IAM Identity Center. They must prevent administrators in member accounts from establishing or using direct SAML 2.0 or OpenID Connect (OIDC) federation bypasses directly to their individual accounts. The solution must not impact normal cross-account IAM role assumption used by internal applications and AWS services. Which approach should the solutions architect implement to meet these requirements with the least administrative overhead?

A logistics corporation manages $30$ AWS accounts under a single organization in AWS Organizations. The security team needs to implement centralized aggregation of VPC Flow Logs from all VPCs in all member accounts into a single, highly secure Amazon S3 bucket located in a dedicated Security account. The solution must ensure that log transmission is encrypted in transit and at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS), and that member accounts cannot delete or modify the centralized logs or the logging configurations. Which TWO configurations must the solutions architect implement to achieve these requirements?

A healthcare organization is designing a telemetry processing system. An ingestion application running on Amazon EC2 instances in an Ingestion account (Account ID $222233334444$) must write sensitive telemetry data to an Amazon S3 bucket located in a dedicated Audit account (Account ID $555566667777$). The organization's compliance policy requires all data to be encrypted at rest using a key managed by the security team. The solutions architect must configure the cross-account permissions and encryption controls to allow this transmission. Which two actions must the solutions architect take to meet these requirements? (Select TWO.)

A logistics company is designing a new multi-region web application on AWS for real-time fleet tracking. The application must run in two AWS Regions: us-east-1 (Primary) and us-west-2 (Secondary). The business requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. The architecture must minimize ongoing running costs in the secondary region while ensuring that outbound APIs (e.g., to external GPS telemetry providers) remain highly available within the primary region.

Which architecture meets these requirements?

A global logistics corporation uses AWS Organizations with multiple member accounts. Security analysts must authenticate using the company's on-premises SAML 2.0 Identity Provider (IdP) to assume an IAM role named SecurityAuditorRole in a centralized Identity account ($111122223333$). From this role, the analysts run query analyses using Amazon Athena on regulatory compliance logs stored in an Amazon S3 bucket within a separate Security Logging account ($444455556666$). The S3 bucket requires all objects to be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Which combination of configurations must a solutions architect implement to securely grant the security analysts the access required to retrieve and decrypt the logs?

A retail company wants to share daily transaction logs stored in an Amazon S3 bucket in Account A ($111111111111$) with an analytics application running on Amazon EC2 instances in Account B ($222222222222$). The S3 bucket is configured with default encryption using AWS Key Management Service (AWS KMS). Which of the following describes a mandatory configuration for the KMS key to allow the analytics application in Account B to decrypt the log files?

A global digital publishing platform is designing a highly available, multi-region architecture to host its core subscription system on AWS. The primary environment is deployed in the us-east-1 Region, and the secondary disaster recovery (DR) environment is in the us-west-2 Region. The business requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute, while minimizing active compute costs and management overhead. The database layer utilizes Amazon Aurora PostgreSQL. The application must support outbound connections to external validation services that remain resilient during Availability Zone (AZ) outages in either Region. Furthermore, internal containerized microservices in both Regions must resolve private DNS names across the peered VPCs. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

A company is designing a deployment strategy for a stateful ingestion service running on Amazon EC2 instances within an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The service maintains long-lived WebSockets connections with millions of IoT devices. The deployment of application updates must satisfy three requirements: first, existing WebSockets connections must not be prematurely terminated and must drain naturally for up to 15 minutes; second, the maximum temporary capacity increase must not exceed 25% of the current fleet size due to strict IP address space constraints in the VPC subnets; and third, the deployment must automatically roll back if the system error rate exceeds 2% during a 30-minute validation period post-deployment. Which deployment configuration will meet these requirements?

An enterprise is designing a hybrid network architecture to connect 10 spoke VPCs in an AWS Organization to their on-premises datacenter. The primary path must use a 10 Gbps AWS Direct Connect connection associated with an AWS Transit Gateway. An IPsec VPN over the internet is configured as a backup path and terminates on the same Transit Gateway. The system must automatically fail over to the VPN if the Direct Connect link fails, and fail back to the Direct Connect link once restored. Which configuration meets these requirements with the least administrative effort?

A company is launching a new version of its monolithic web application. The application is hosted on Amazon EC2 instances inside an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The update includes minor database schema changes that are backward-compatible.

The deployment process must meet the following criteria:
1. Shift exactly 10% of the user traffic to the new version initially.
2. Monitor the new version for 15 minutes. If the HTTP 5XX error rate or instance CPU utilization exceeds predefined thresholds, the deployment must automatically roll back immediately.
3. If no alarms are triggered during the monitoring period, all traffic must be routed to the new version, and the old instances should be terminated.
4. The deployment and rollback must avoid DNS propagation delays to ensure immediate effect.

Which combination of actions should the solutions architect implement to meet these requirements with the least operational overhead? (Select TWO.)

An enterprise manages its multi-account cloud environment using AWS Organizations. The security team mandates that no IAM users or roles within the 'Workloads' Organizational Unit (OU) should be able to delete Amazon S3 buckets, with the sole exception of a specific break-glass IAM role named 'EmergencyAdmin' that exists in all member accounts. The security team wants to enforce this governance control centrally with the least operational overhead. Which solution should a Solutions Architect recommend?