Tüm alıştırma soruları

A digital publishing company hosts a content delivery and document archiving platform on AWS. The application runs on Amazon ECS tasks on AWS Fargate behind an Application Load Balancer (ALB) in a single AWS Region. The document metadata is stored in an Amazon Aurora PostgreSQL Serverless v2 database cluster. Files are uploaded directly to an Amazon S3 bucket.

Currently, the company's disaster recovery (DR) strategy relies on daily automated Aurora snapshots copied to a second region and cross-region S3 replication. The company wants to improve its reliability and disaster recovery posture to achieve a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $5$ minutes in a secondary region.

Which two actions should a solutions architect take to meet these requirements with the least operational overhead?

A digital sports media company is preparing for a live-streamed championship event that is expected to attract millions of concurrent viewers within a $5$-minute window. The application runs on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The application reads and writes user profile and viewing state data to an Amazon Aurora PostgreSQL DB cluster consisting of one writer instance in Availability Zone (AZ) A and one reader instance in AZ B.

During load testing, the following performance issues are observed:
- A sudden, massive flood of requests at the start of the event causes the ALB to drop connections and return HTTP 503 (Service Unavailable) errors before the ASG or ALB can scale out.
- The reporting and leaderboard dashboard queries, which are read-heavy, cause significant CPU utilization spikes on the primary writer instance because the application is currently configured to connect to the DB cluster endpoint for all operations.

Which combination of architectural modifications will optimize the compute and storage layers to handle the event's performance requirements?

A financial services company hosts a latency-sensitive trading application on AWS. The architecture consists of a client-facing VPC in the us-east-1 Region, a client-facing VPC in the us-west-2 Region, and a shared services VPC in us-east-1. Currently, all three VPCs are interconnected using an AWS Transit Gateway. The application developers are reporting two major issues: high network latency during database synchronization between the us-east-1 client VPC and the us-east-1 shared services VPC, and host name resolution failures when the us-west-2 application attempts to access endpoints in the shared services Private Hosted Zone (PHZ). Which two actions should a solutions architect recommend to optimize network performance, reduce latency, and resolve the DNS issues? (Select TWO.)

An enterprise is designing a new multi-account AWS architecture. The design includes two spoke VPCs (`vpc-app-a` and `vpc-app-b`) in the `us-east-1` Region, each with subnets across two Availability Zones (`us-east-1a` and `us-east-1b`). The enterprise also has an egress VPC (`vpc-egress`) in `us-east-1` to centralize internet-bound traffic, and an on-premises datacenter connected via AWS Direct Connect (DX). A Private Hosted Zone (PHZ) named `corp.internal` is hosted in a central networking account.

The architecture must meet the following requirements:
1. Spoke VPCs must be able to communicate with each other and with the on-premises datacenter.
2. All outbound internet traffic from the spoke VPCs must route through `vpc-egress` in a highly available manner that survives an Availability Zone outage.
3. Resources within the spoke VPCs must resolve DNS queries for the `corp.internal` domain.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

A technology company is designing a new multi-VPC environment in the us-east-1 Region. The architecture consists of a Shared Services VPC and three spoke VPCs (Prod-VPC, Stage-VPC, and Dev-VPC). All spoke VPCs must be able to communicate with the Shared Services VPC, but the spoke VPCs must be completely isolated from one another. Additionally, resources in all spoke VPCs must resolve private DNS records for services hosted in the Shared Services VPC. Which of the following networking designs satisfies these requirements while minimizing administrative overhead?

A financial services firm runs a core banking microservice platform across two AWS accounts in an AWS Organization: Account A hosts the Production environment in the eu-west-1 Region, and Account B hosts the Disaster Recovery (DR) environment in the eu-central-1 Region. The application tier runs on Amazon ECS tasks on AWS Fargate in private subnets, resolving local services using a Route 53 Private Hosted Zone (PHZ) (service.internal) hosted in Account A. Database access is managed via an Amazon Aurora PostgreSQL Global Database, with the primary cluster in Account A and the secondary cluster in Account B. Currently, outbound internet access for the ECS tasks in both regions is routed through a single NAT Gateway located in a single public subnet within each region's VPC. The firm wants to enhance the architecture to achieve a recovery time objective (RTO) of under 15 minutes and a recovery point objective (RPO) of under 1 minute during a regional outage. Which TWO actions should the Solutions Architect implement to enhance reliability and automate disaster recovery failover?

A financial services company runs a high-frequency trading application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances process incoming transactions and write detailed raw execution logs to attached 500 GiB Amazon EBS gp3 volumes (with default configurations of 3,000 IOPS and 125 MB/s throughput) before archiving the logs to Amazon S3. Transactional state is maintained in an Amazon Aurora MySQL DB cluster.

During weekly scheduled flash trading events, the company experiences the following performance issues:
- The ALB immediately drops a significant percentage of incoming requests, returning HTTP 503 (Service Unavailable) errors, because traffic surges from 2,000 requests/second to 150,000 requests/second within 30 seconds.
- The EC2 instances experience severe write latency and high disk queue length as the log writing throughput surges to 450 MB/s with 9,500 IOPS during peak trade processing.

Which of the following actions should the Solutions Architect recommend to resolve these performance bottlenecks? (Select TWO.)

A company runs a genomic data processing application on Amazon EC2 instances in an Auto Scaling group. The instances process large datasets downloaded from Amazon S3. The input files are written to 200 GiB Amazon EBS gp3 volumes configured with default IOPS and throughput (3,000 IOPS and 125 MiB/s). During peak processing, CloudWatch metrics show that the EBS volumes are constantly throttled at the 125 MiB/s throughput limit, causing high CPU wait times. Additionally, when the queue size increases, the Auto Scaling group launches new instances. However, because it takes 10 minutes to bootstrap the instances (downloading software and reference databases), the scaling metric remains high, causing the Auto Scaling group to continuously launch unnecessary instances during this startup period. Which two actions should the solutions architect take to resolve these performance and scaling issues?

An enterprise runs a critical medical imaging application across multiple AWS accounts in an AWS Organization. The core database is an Amazon Aurora MySQL global database, with the primary cluster in us-east-1 and a secondary cluster in us-west-2. The application layer runs on Amazon Elastic Container Service (Amazon ECS) tasks on AWS Fargate behind Application Load Balancers (ALBs) in both regions. The application's DNS domain, imaging.internal.example.com, is hosted in a Route 53 private hosted zone (PHZ) in a shared services account. The PHZ is associated with the application VPCs in both regions. A Solutions Architect needs to enhance the disaster recovery (DR) capability to achieve a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 2 minutes. The failover process must be fully automated, including the routing of internal traffic to the active region during an outage in us-east-1. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

A software company hosts a latency-sensitive API in the us-east-1 Region behind an Application Load Balancer (ALB). Users in Europe are experiencing high latency and frequent connection timeouts due to unpredictable routing and packet loss over the public internet. Which of the following solutions should the solutions architect implement to optimize network performance and reduce latency for these global users?

An enterprise is running a web application on a fleet of Amazon EC2 instances. The application writes transaction logs to a local file at /var/log/app/production.log. These logs are rotated daily, renamed with a timestamp suffix, and compressed. The solutions architect needs to design a solution that continuously collects these logs, monitors them in real-time for specific error patterns, and archives them to a centralized Amazon S3 bucket in a security account. Which combination of steps should the solutions architect recommend to meet these requirements with the least administrative overhead? (Select TWO.)

A media streaming platform runs its transaction processing workload on a fleet of Amazon EC2 instances managed by an Auto Scaling group across multiple AWS accounts in an organization. The application outputs transactional logs to `/var/log/checkout/transaction.log`. These logs are rotated hourly and renamed using the pattern `/var/log/checkout/transaction-YYYY-MM-DD-hh.log`. A Solutions Architect must design a solution to centralize these logs into a dedicated Amazon S3 bucket within a security account. The solution must ensure that log rotation does not interrupt log collection or result in duplicate log entries, and must enforce strict cross-account security controls. Which two of the following actions should the Solutions Architect perform to meet these requirements? (Select TWO.)

A government organization is launching a public service portal to process sensitive citizen applications. The architecture uses AWS Organizations and separates workloads into different accounts. A processing application runs on Amazon ECS tasks using AWS Fargate within a processing account ($111122223333$). The application must stream and archive finalized application data to an Amazon S3 bucket named `citizen-applications-archive` located in a centralized compliance account ($444455556666$). The security architecture must enforce the following security controls: (1) All archived data must be encrypted at rest using a Customer Managed Key (CMK) owned by the compliance account ($444455556666$). (2) The ECS tasks in the processing account must be write-only; they must be able to upload archives but must be strictly prevented from decrypting or deleting any archived objects once written. (3) IAM administrators within the processing account ($111122223333$) must not be able to bypass the encryption requirements or upload unencrypted data. Which combination of actions must a Solutions Architect perform to design a compliant solution? (Select TWO.)

A financial services firm runs an online transaction processing (OLTP) application using a single Amazon RDS PostgreSQL Multi-AZ DB instance. During peak hours, read-heavy reporting queries cause CPU utilization on the primary instance to reach 100%, degrading write transactions. Which solution should a solutions architect implement to optimize performance and scale read capacity?

A company is designing a new environment on AWS with a single VPC named `Production-VPC` (CIDR: $10.0.0.0/16$) to host a web application. The architecture is deployed across two Availability Zones, `us-west-2a` and `us-west-2b`. The public subnets `Public-Subnet-A` ($10.0.1.0/24$) and `Public-Subnet-B` ($10.0.2.0/24$) host Application Load Balancers. The application instances are running in the private subnets `Private-Subnet-A` ($10.0.10.0/24$) and `Private-Subnet-B` ($10.0.20.0/24$). The instances in the private subnets must be able to securely download software patches from the internet. The design must ensure that an outage of a single Availability Zone does not disrupt outbound internet connectivity for the resources in the remaining active Availability Zone. Which configuration should the solutions architect implement to meet these requirements?

A company hosts a public-facing application across two AWS Regions in an active-passive disaster recovery configuration. The primary region (us-east-1) and the secondary region (us-west-2) each have an Application Load Balancer (ALB) that routes traffic to Amazon EC2 instances. The company wants to configure Amazon Route 53 to automatically redirect client traffic to the secondary region if the primary region's application becomes unhealthy.

Which configuration should the solutions architect implement to achieve automatic failover to the secondary region?

An enterprise runs a critical web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) in the us-east-1 Region. The database tier uses an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. The company wants to improve their disaster recovery (DR) strategy to achieve a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. The company deploys a standby application tier in us-west-2. During a recent database outage in us-east-1, the application instances remained healthy but could not connect to the database. Because Route 53 was configured to only monitor the ALB endpoint health, DNS failover to us-west-2 did not trigger. Which architectural modification will meet these requirements and automate failover during database degradation?

An enterprise uses AWS Organizations to manage multiple AWS accounts. The security team needs to improve the security posture of an existing architecture. Specifically, they must address two security findings:

1. Sensitive compliance logs stored in a central Amazon S3 bucket are currently encrypted using the default AWS-managed KMS key (`aws/s3`), which prevents other accounts from decrypting the logs during audits.
2. Developers in member accounts can still configure Amazon S3 buckets to be publicly accessible, violating company policy.

Which two actions should a solutions architect take to resolve these security findings? (Select two.)

An enterprise runs a critical containerized business API across two AWS accounts in an AWS Organization. The production environment is deployed in Account A within a VPC in the us-west-2 Region. The API runs on Amazon ECS tasks on AWS Fargate behind an Application Load Balancer (ALB). The data layer uses an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-west-2 (Account A) and a secondary cluster in us-east-1 (Account B). A Route 53 Private Hosted Zone (PHZ) for api.internal is hosted in Account A and associated with the production VPC to allow internal services to resolve the backend API. The enterprise wants to establish a disaster recovery (DR) environment in us-east-1 (Account B) using a warm standby pattern to achieve an RTO of less than 15 minutes and an RPO of less than 1 minute. The DR environment must also run on ECS Fargate behind an ALB. The Fargate tasks in the DR environment require highly reliable outbound internet access to communicate with third-party payment gateways. Additionally, internal microservices in the DR environment must be able to resolve api.internal to the local DR load balancer during a failover. Which solution meets these requirements while adhering to AWS high availability and disaster recovery best practices?

An enterprise runs a high-throughput, latency-sensitive SaaS platform across three AWS accounts in the $us-east-1$ Region: a Production account, a Data Analytics account, and a Shared Services account. The Production VPC and Data Analytics VPC need to query a centralized, high-performance Amazon ElastiCache cluster hosted in the Shared Services VPC.

Currently, all VPCs are interconnected using an AWS Transit Gateway, but the application teams are reporting latency overhead and high network data processing costs. In addition, applications in the Production and Data Analytics VPCs are experiencing DNS resolution failures when attempting to resolve the cache cluster's domain name, which is managed via a Route 53 Private Hosted Zone ($cache.internal$) created in the Shared Services account.

Which of the following actions should the Solutions Architect take to optimize network performance, minimize latency, and resolve the DNS issues? (Select TWO.)