Tüm alıştırma soruları

A company hosts a real-time financial transaction reconciliation application on AWS. The application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The database tier utilizes an Amazon RDS for PostgreSQL Multi-AZ DB instance with 1 TB gp3 storage.

During scheduled end-of-day reconciliation events, the application experiences a massive, instantaneous surge in traffic. This results in HTTP 503 Service Unavailable errors from the ALB, high write latency on the database, and CPU utilization reaching 100% on the primary database instance due to concurrent read-heavy audit queries.

Which combination of actions should a Solutions Architect take to optimize the compute, database, and storage performance to handle the peak load?

A gaming company has a mobile application that retrieves a high volume of read-only player profile data from an Amazon Aurora MySQL database, causing high read latency during peak hours. The database administrator wants to implement an in-memory caching layer to offload the database. The caching solution must support replication across multiple Availability Zones to ensure high availability. Which caching solution should a Solutions Architect recommend to meet these requirements?

A company is reviewing the AWS WAF configuration for an existing web application hosted behind an Application Load Balancer. The security team has configured an AWS WAF Web ACL with two rules: a rule with priority 10 that allows all traffic from a partner's IP address range, and a rule with priority 20 that blocks requests containing SQL injection patterns. Developers report that malicious SQL injection attacks originating from the partner's IP address range are successfully reaching the application. Which adjustment should a solutions architect recommend to resolve this security issue?

A startup is deploying a payment processing application in a VPC across three Availability Zones. The application instances reside in private subnets and must connect to external payment APIs over the internet. The architecture must protect these instances from inbound internet traffic and survive the failure of any single Availability Zone. Which of the following networking designs should the solutions architect select?

An enterprise's primary workload runs in VPC-A within Account 1 (Production) in the us-east-1 region. The database layer uses an Amazon Aurora MySQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Centralized DNS is managed in Account 2 (Shared Services) using a Route 53 private hosted zone (PHZ) named corp.internal. A CNAME record db.corp.internal points to the primary Aurora cluster endpoint in us-east-1. VPC-A is currently associated with this PHZ.

To improve disaster recovery, the enterprise is planning a pilot light strategy. During a region-wide outage in us-east-1, the application tier must failover to VPC-B within Account 1 in the us-west-2 region. The disaster recovery requirements specify a database Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 1 minute. Additionally, all DNS queries must remain strictly private, routing privately over the AWS network without using custom DNS servers or public Route 53 health check endpoints.

Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

A company is designing a new two-tier application in a VPC across two Availability Zones (us-east-1a and us-east-1b). The application servers are located in private subnets and must access the internet to download security patches. Additionally, the application servers must resolve domain names within a Route 53 Private Hosted Zone (corp.internal) hosted in a separate administrative VPC. Which two configuration steps must the Solutions Architect perform to meet these requirements with high availability?

A financial services company runs a batch processing pipeline on Amazon EC2 instances in an Auto Scaling group. The EC2 instances process raw data and write intermediate transaction metadata to an Amazon RDS for PostgreSQL DB instance configured in a Multi-AZ deployment. The final reports are saved to an Amazon S3 bucket.

During peak processing periods, the database performance degrades significantly. CloudWatch metrics indicate a write latency ($WriteLatency$) of over $45\text{ ms}$ on the RDS DB instance, while CPU utilization remains below $25\%$. The DB instance uses General Purpose SSD (gp3) storage with default configurations.

Additionally, during sudden traffic spikes, the EC2 instances struggle to scale out quickly enough to prevent processing queues from backing up. The custom AMI used by the Auto Scaling group takes approximately $7\text{ minutes}$ to bootstrap and start application services. The Auto Scaling group uses a target tracking scaling policy based on CPU utilization with a default cooldown period of $150\text{ seconds}$.

Which two actions should a Solutions Architect take to resolve these performance bottlenecks?

A media company hosts a legacy video rendering application in the `us-west-2` Region. The architecture consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB), and a multi-AZ Amazon Aurora PostgreSQL database cluster. The company needs to implement a disaster recovery (DR) strategy in the `us-east-1` Region. The business requires a Recovery Point Objective (RPO) of less than 1 minute and a Recovery Time Objective (RTO) of less than 15 minutes. Which configuration should a Solutions Architect recommend to meet these requirements with the lowest operational overhead?

A retail company operates a multi-tier application across two AWS accounts within an AWS Organization. The primary infrastructure is located in us-east-1 (Account 1), and a disaster recovery (DR) site is set up in us-west-2 (Account 2). The database layer is an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a read-only secondary cluster in us-west-2. Internal service names and database endpoints are resolved using a Route 53 private hosted zone corp.internal managed in Account 1. The company has a Recovery Time Objective (RTO) of $15$ minutes and a Recovery Point Objective (RPO) of $1$ minute. During a DR drill, the failover fails because the secondary region's Application Load Balancer cannot resolve the database endpoints, and manual failover steps take too long. Which TWO actions should a Solutions Architect recommend to automate the failover and meet the RTO and RPO requirements?

An organization uses AWS CloudFormation to deploy and manage its web application infrastructure. A system administrator manually modifies the instance type of a production EC2 instance via the AWS Management Console to handle a temporary traffic spike. Later, when the DevOps team runs a CloudFormation stack update to deploy an unrelated security group change, the stack update fails and rolls back. Which of the following is the root cause of this update failure?

A global retail company runs its checkout application on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in an organization in AWS Organizations. The application writes transaction logs to `/var/log/checkout/app.log`. The application server rotates logs hourly, renaming the active log file to `/var/log/checkout/app.log.1` (and shifting older logs to `app.log.2`, `app.log.3`, etc.) while creating a new `app.log` file.

The company wants to centralize these logs into an Amazon S3 bucket located in a dedicated Security account. The architecture must stream logs from the EC2 instances to CloudWatch Logs, and then forward them to the centralized S3 bucket via Amazon Kinesis Data Firehose. The solution must handle hourly log rotations without log loss and enforce least-privilege cross-account access.

Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

A global logistics company hosts its central inventory tracking platform in the us-west-2 Region. The application layer runs on Amazon EC2 instances in private subnets across two Availability Zones. Outbound tracking updates are sent to third-party shipping partners over the internet via a single NAT Gateway located in one Availability Zone. Additionally, users located in Europe and South America experience high latency when accessing the platform's web interface, which is behind an Application Load Balancer (ALB).

The company requires a solution that minimizes network latency for global clients without deploying the application layer in multiple AWS Regions. The solution must also eliminate single points of failure for outbound traffic and minimize cross-Availability Zone data transfer costs.

Which combination of architectural changes should the Solutions Architect implement? (Select TWO.)

An enterprise is designing a new network architecture in the `us-east-1` region to support three spoke VPCs (`vpc-prod`, `vpc-dev`, and `vpc-test`) and a central egress VPC (`vpc-egress`). An AWS Transit Gateway (`tgw-central`) connects all four VPCs. The workloads in the spoke VPCs are distributed across two Availability Zones ($AZ-A$ and $AZ-B$) and require outbound internet access to download software updates. The design must ensure that the failure of a single Availability Zone does not disrupt outbound internet connectivity for any of the workloads, while minimizing overall NAT Gateway costs. Which of the following architectures should the Solutions Architect recommend?

An enterprise is designing a multi-account, multi-VPC architecture in the us-east-1 Region. The design includes vpc-app-prod (10.100.0.0/16) in Account A, containing business-critical application instances in private subnets across two Availability Zones (us-east-1a and us-east-1b). Account B hosts vpc-shared-dns (10.200.0.0/16) containing a Route 53 Private Hosted Zone (PHZ) app.corp.internal. Account B also contains vpc-egress-inspect (10.250.0.0/16), which handles outbound traffic via a cluster of firewalls. All VPCs are interconnected using an AWS Transit Gateway (tgw-east-hub). The application instances must resolve domain names hosted in app.corp.internal, and all outbound internet traffic must be inspected by the firewalls in vpc-egress-inspect. The network architecture must be highly resilient, cost-effective, and avoid any single points of failure. Which two configurations should the solutions architect implement to establish connectivity and name resolution while meeting these requirements?

A company is reviewing the security posture of an existing web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are currently residing in public subnets, and the ALB receives public HTTP/HTTPS traffic. The company wants to strengthen network security by restricting backend instance access and blocking common web exploits at the edge. Which two options should the solutions architect recommend to achieve this? (Select TWO.)

An enterprise is designing a centralized data processing platform across multiple AWS accounts. Application servers running in Account A ($111122223333$) must write telemetry data directly to an Amazon S3 bucket located in the central Analytics Account ($444455556666$).

The security policy mandates the following requirements:
1. All data written to the S3 bucket must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) created and managed in a dedicated Security Account ($777788889999$).
2. Separation of duties must be enforced, ensuring that Account A has no administrative control over the KMS key, and Account A's IAM administrators cannot modify the key policy.
3. Access must follow the principle of least privilege.

Which of the following combinations of actions should the Solutions Architect take to configure the permissions for this architecture? (Select TWO.)

A global SaaS platform hosts its ingestion service in a VPC in the $us-west-2$ Region and its reporting dashboard in a VPC in the $us-east-1$ Region. The ingestion service runs behind an internal Application Load Balancer (ALB) and is associated with a Route 53 Private Hosted Zone (PHZ) `ingest.local`. Currently, the two VPCs are connected via AWS Transit Gateway peering across the regions. The reporting dashboard makes millions of query requests daily to the ingestion service, resulting in high latency and significant inter-region data transfer charges due to Transit Gateway processing fees. The reporting dashboard must resolve the private DNS names of the ingestion service and connect securely over the AWS network with the lowest possible latency and cost. Which combination of actions should a Solutions Architect implement to optimize the network performance and reduce costs? (Select TWO.)

An enterprise runs a high-performance batch analytics system on AWS. The ingestion tier uses an Application Load Balancer (ALB) to distribute incoming files to a fleet of memory-optimized Amazon EC2 instances in an Auto Scaling group (ASG). These instances download raw datasets from Amazon S3, process them, and write intermediate results to attached $1\text{ TB}$ `gp3` Amazon EBS volumes. The processed metadata is then written to an Amazon RDS for PostgreSQL database, which replicates to a read replica to serve real-time dashboard queries.

During the weekly batch run, the Solutions Architect identifies the following issues:
* The EC2 instances experience significant disk I/O wait times. The `gp3` volumes are configured with the default $3,000\text{ IOPS}$ and $125\text{ MB/s}$ throughput, but CloudWatch metrics show `VolumeThroughput` regularly hitting its limit.
* The RDS PostgreSQL database experiences high replication lag on the read replica, which impacts dashboard query accuracy.
* The incoming request volume spikes instantly at the start of the batch run, causing HTTP $503$ errors at the ALB before the EC2 fleet can scale out to handle the load.

Which two actions should the Solutions Architect take to resolve these bottlenecks and optimize system performance? (Choose two.)

A financial services company hosts a latency-sensitive trading application on Amazon EC2 instances across two Availability Zones in a VPC in the `us-east-1` Region. The application requires high-throughput, low-latency connectivity to an on-premises database server via an established AWS Direct Connect connection. The application also needs to access external financial market data feeds on the internet, and resolve internal service endpoints in a shared services VPC within the same region using an Amazon Route 53 Private Hosted Zone.

During peak trading hours, the application experiences latency spikes when querying the on-premises database, and instances in the secondary Availability Zone fail to reach the internet when the primary Availability Zone experiences issues. Additionally, instances in the application VPC are unable to resolve the internal endpoints of the shared services VPC.

Which architecture optimization strategy will resolve the latency and connectivity issues while maintaining high availability?

An enterprise operates a microservices-based application running on Amazon EC2 instances across multiple member accounts in an AWS Organization. The application logs are stored locally on the instances in `/var/log/app/application.log` and undergo hourly rotation, renaming the files with a timestamp suffix (for example, `/var/log/app/application.log.2026-07-16-11`). A Solutions Architect must design a centralized logging solution to stream these logs in near real-time to an Amazon S3 bucket in a central security account. The solution must ensure that log collection is continuous and unaffected by file rotation, and it must follow the principle of least privilege, avoiding cross-account IAM role assumptions from EC2 instances where resource-based policies can be used instead. Which two actions should the Solutions Architect take to implement this solution?