Examkin

Tüm alıştırma soruları

1964 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 1121Soru →

An enterprise has a multi-account AWS architecture. The core application backends are deployed across multiple private subnets in a Spoke VPC in the us−west−2us-west-2 region. A Shared Services VPC in the us−east−1us-east-1 region hosts a centralized internal API behind an Application Load Balancer (ALB) and holds a Route 53 Private Hosted Zone (PHZ) named `api.internal.enterprise.com`.

The Spoke VPC is connected to the Shared Services VPC via AWS Transit Gateway (TGW) peering. The enterprise also replicates high-throughput database transactions from its on-premises data center to the Spoke VPC in us−west−2us-west-2 over a 10 Gbps10\text{ Gbps} AWS Direct Connect connection. The connection uses a Transit Virtual Interface (Transit VIF) terminated on a Direct Connect Gateway (DXGW) that is attached to the Spoke VPC's TGW.

The network architecture is currently experiencing the following performance and operational issues:
1. Database replication throughput is capped, and packet drops occur during peak sync periods. On-premises routers are configured with an MTU of 90009000.
2. Instances in the us−west−2us-west-2 Spoke VPC fail to resolve the hostname `api.internal.enterprise.com`.
3. Outbound internet traffic from all Availability Zones in the Spoke VPC is routed through a single NAT Gateway in one Availability Zone, which occasionally experiences localized failures, dropping all outbound connections.
4. The internal ALB in the Shared Services VPC drops connections during sudden daily flash traffic spikes.

Which combination of actions should a Solutions Architect recommend to optimize network performance, minimize latency, and resolve these issues?

Cevabı ve açıklamayı göster

Cevap: Enable jumbo frames with an MTU of 85008500 on the Direct Connect Transit VIF, the Transit Gateway, and the on-premises routers. Associate the Route 53 Private Hosted Zone `api.internal.enterprise.com` with the Spoke VPC in us−west−2us-west-2 using the Route 53 API for cross-account association. Deploy a NAT Gateway in each Availability Zone of the Spoke VPC, and configure the private route tables to direct outbound traffic to their respective local NAT Gateway. Request AWS Support to pre-warm the internal ALB in the Shared Services VPC before the daily flash traffic spikes.

Cevap

Enable jumbo frames with an MTU of 85008500 on the Direct Connect Transit VIF, the Transit Gateway, and the on-premises routers; associate the Route 53 Private Hosted Zone with the Spoke VPC; deploy redundant NAT Gateways in each Availability Zone of the Spoke VPC; and pre-warm the Application Load Balancer.
The correct solution addresses all aspects of the latency and performance issues: (1) configuring the MTU to 85008500 bytes across the entire replication path (matching the maximum supported by Transit Gateway and Direct Connect Transit VIF) avoids fragmentation and optimizes database throughput; (2) associating the Route 53 PHZ with the Spoke VPC using the Route 53 API enables native, low-latency cross-account DNS resolution; (3) deploying NAT Gateways in each Availability Zone removes the single point of failure and avoids inter-AZ transit latency; and (4) pre-warming the ALB ensures that the load balancer has enough capacity to handle sudden daily spikes in flash traffic without dropping packets.

Adım Adım Çözüm

1
Configure MTU sizes across the hybrid path.
Jumbo frames are set to 85008500 bytes on the on-premises routers, Direct Connect Transit VIF, and AWS Transit Gateway.
AWS Transit Gateway and Direct Connect Transit VIF support a maximum MTU of 85008500 bytes. Aligning the MTU sizes prevents packet fragmentation and drops, thereby optimizing replication throughput and reducing CPU overhead on network interfaces.
2
Establish cross-account Route 53 Private Hosted Zone (PHZ) association.
The Route 53 PHZ `api.internal.enterprise.com` in the Shared Services VPC account is associated with the Spoke VPC in us−west−2us-west-2.
Route 53 PHZs are only resolvable within VPCs that are explicitly associated with them. Associating the PHZ with the Spoke VPC allows Route 53 Resolver to resolve the internal domain locally, reducing latency and avoiding DNS resolution failures.
3
Design redundant NAT Gateways across Availability Zones.
A NAT Gateway is deployed in each Availability Zone, and route tables for the private subnets are updated to point to the local NAT Gateway.
A single NAT Gateway creates a single point of failure. Deploying a NAT Gateway per AZ ensures high availability and eliminates inter-AZ network latency and data transfer charges for outbound internet traffic.
4
Ensure the Application Load Balancer can handle rapid traffic spikes.
AWS Support pre-warms the ALB to support the anticipated spike in throughput.
Application Load Balancers scale dynamically but cannot handle sudden, massive flash traffic spikes instantly. Pre-warming scales the load balancer's capacity ahead of the spike to prevent dropped TCP connections.

Anahtar Kavram

Optimizing Network Performance and Latency in Hybrid and Multi-Account Architectures
Tahmini Süre:3m 0s
Soru 1122Soru →

A media company stores user-generated video assets in an Amazon S3 bucket located in a central archive AWS account. Currently, these assets are encrypted using Amazon S3 managed keys (SSE-S3). To meet new regulatory compliance requirements, the security team mandates that all assets must be encrypted using customer-managed keys (CMKs) with automatic rotation. Furthermore, an encoding application running in a separate production AWS account must be able to read and write these encrypted assets directly. Which of the following actions should a Solutions Architect perform to implement this secure configuration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a symmetric customer managed KMS key in the archive account. Modify the key policy to grant the encoding application's IAM role in the production account permissions to perform kms:Decrypt and kms:GenerateDataKey operations, and enable automatic key rotation.; Configure the S3 bucket in the archive account to use default encryption with the newly created customer managed KMS key. Update the bucket policy to grant the encoding application's IAM role in the production account permissions for s3:PutObject and s3:GetObject.

Cevap

Create a symmetric customer managed KMS key in the archive account with cross-account IAM role permissions and automatic key rotation enabled, and configure the archive account's S3 default encryption to use that key while granting s3:PutObject and s3:GetObject permissions in the bucket policy.
To set up secure cross-account S3 access with KMS encryption, a Customer Managed Key (CMK) must be created in the bucket's account (the archive account) because AWS-managed keys cannot be used cross-account. The CMK's key policy must explicitly allow the cross-account IAM role to use the key for decryption and data key generation. Additionally, the S3 bucket's default encryption must be configured to use this CMK, and the S3 bucket policy must allow the production application's IAM role to read and write objects.

Adım Adım Çözüm

1
Create and configure a Customer Managed Key (CMK) in the Archive Account.
A symmetric customer managed key is created. Its key policy is configured to delegate key usage permissions to the production account's encoding application IAM role, allowing the cross-account role to generate data keys and decrypt.
AWS-managed keys cannot be shared across accounts or modified. A customer managed key is necessary for cross-account KMS operations.
2
Configure the S3 default bucket encryption and bucket policy in the Archive Account.
The S3 bucket is updated to enforce encryption with the customer managed key. The bucket policy is updated to explicitly allow the production encoding application's IAM role to perform S3 operations.
This enforces data protection compliance for all new uploads and grants the external application access to the physical S3 bucket.

Anahtar Kavram

Cross-account KMS key access and default S3 encryption behavior using customer managed keys.
Soru 1123Soru →

A biotechnology company has eight spoke VPCs split across two AWS accounts in a single AWS Region, and one shared services VPC in a third account. The company requires all spoke VPCs to access resources in the shared services VPC and an on-premises data center, but spoke VPCs must be strictly prevented from communicating with one another. The hybrid connection to the data center is established using an AWS Direct Connect (DX) connection. Which design should a Solutions Architect recommend to meet these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Deploy an AWS Transit Gateway. Create two Transit Gateway route tables: one for the spoke VPCs and one for the shared services VPC and the Direct Connect Gateway. Associate the spoke VPC attachments with the spoke route table, propagating routes only to the shared services VPC and the Direct Connect Gateway. Associate the shared services VPC and Direct Connect Gateway attachments with the second route table, propagating routes to all spoke VPCs.

Cevap

Deploy an AWS Transit Gateway and configure two distinct Transit Gateway route tables to isolate the spoke VPCs from each other while permitting routing to the shared services VPC and the Direct Connect Gateway.
The correct design utilizes AWS Transit Gateway with two distinct route tables to create separate routing domains. The spoke route table is associated with the spoke VPC attachments and only contains routes for the shared services VPC and the on-premises network via the Direct Connect Gateway. Because it does not contain routes to other spoke VPCs, spoke-to-spoke communication is prevented. The shared services and Direct Connect Gateway attachments are associated with a second route table that contains routes to all spoke VPCs, allowing bidirectional traffic to those destinations.

Adım Adım Çözüm

1
Determine the traffic isolation and transit routing requirements between the spoke VPCs, shared services VPC, and on-premises data center.
Identify that spoke VPCs must be isolated from one another but must be able to reach the shared services VPC and the on-premises network.
This establishes the logical traffic separation and routing paths required for the network design.
2
Create separate routing domains using AWS Transit Gateway route tables.
Define one Transit Gateway route table for spoke VPCs and a separate route table for the shared services VPC and the Direct Connect Gateway.
Separating the route tables allows route advertisements and associations to be configured independently per attachment group.
3
Associate and propagate routes across the Transit Gateway route tables.
Associate spoke VPC attachments with the spoke route table, and only propagate routes from the shared services VPC and the Direct Connect Gateway. Associate the shared services and Direct Connect Gateway attachments with their own route table, propagating routes to all spoke VPCs.
This configuration ensures that spoke VPCs have no paths to reach other spokes, achieving isolation, while allowing bidirectional communication to the hub resources.

Anahtar Kavram

AWS Transit Gateway route tables can be used to establish isolated routing domains (VRFs) to control spoke-to-spoke communication in multi-account networks.
Soru 1124Soru →

A gaming company operates a real-time multiplayer game server backend on Amazon EC2 instances. The game server software writes high-throughput debug logs to a local directory at `/opt/gameserver/logs/debug.log`. These log files are rotated every 15 minutes by a custom daemon, renaming the active file to `/opt/gameserver/logs/debug.log.<timestamp>` and creating a new empty `/opt/gameserver/logs/debug.log`. The DevOps team deploys the Unified CloudWatch Agent to forward these logs to Amazon CloudWatch Logs. During peak hours, the team notices that log ingestion drops to zero for several minutes after each 15-minute rotation interval, resulting in missing critical troubleshooting data. Which configuration change should the solutions architect make to ensure continuous log collection without data loss?

Cevabı ve açıklamayı göster

Cevap: Update the CloudWatch agent configuration JSON by changing the `file_path` parameter to `/opt/gameserver/logs/debug.log*` to match the rotated file patterns, allowing the agent to continuously monitor and upload log data from both the active and rotated files.

Cevap

Update the CloudWatch agent configuration JSON by changing the `file_path` parameter to `/opt/gameserver/logs/debug.log*` to match the rotated file patterns, allowing the agent to continuously monitor and upload log data from both the active and rotated files.
The correct answer is to update the CloudWatch agent configuration file by adding a wildcard to the `file_path` parameter. This allows the CloudWatch agent to monitor the entire pattern of files, including the active log and any rotated versions. During rotation, the agent continues tracking the renamed file to its end and begins tracking the newly created active file, ensuring zero log loss.

Adım Adım Çözüm

1
Analyze the log rotation behavior of the custom daemon on the EC2 instances.
The log files are renamed every 15 minutes, which changes the file pointer and descriptor that the CloudWatch agent is tracking.
Understanding the rotation mechanism helps identify why the static path in the configuration fails to capture logs immediately after rotation.
2
Identify the proper CloudWatch agent configuration parameter to handle rotated files.
Using a wildcard pattern in the `file_path` parameter tells the agent to watch all matching files (both the active log and the renamed files).
Wildcards allow the agent to track file modifications and new files dynamically, ensuring no logs are missed during or after rotation.
3
Implement the configuration update and verify log ingestion.
The CloudWatch agent configuration is updated with the wildcard path, and log streaming remains continuous across the 15-minute rotation intervals.
Validating the configuration confirms that both active and rotated logs are processed successfully without ingestion gaps.

Anahtar Kavram

Configuring the Unified CloudWatch Agent for Log Rotation via Wildcard File Paths
Soru 1125Soru →

A media streaming company runs a critical content delivery API on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in an AWS Organization. The API logs are written to `/var/log/api/server.log` and are rotated hourly to `/var/log/api/server.log.YYYY-MM-DD-HH`. To meet compliance requirements, a solutions architect must design a centralized logging solution that aggregates these logs into an Amazon S3 bucket in a dedicated Security account. The solution must minimize log data loss during rotations and support near-real-time streaming. Which combination of steps should the solutions architect implement to achieve these operational excellence goals?

Cevabı ve açıklamayı göster

Cevap: Install the unified CloudWatch agent on the EC2 instances. In the agent configuration file, set the log path to `/var/log/api/server.log*`. Configure the agent to publish logs to a local CloudWatch Logs log group. In the Security account, create a centralized Kinesis Data Firehose delivery stream that writes to the S3 bucket, encrypted with a Customer Managed Key (CMK). In the Security account, create a CloudWatch Logs destination with a policy that grants permission to the AWS Organization ID, and associate it with the Firehose stream. In the member accounts, create a CloudWatch Logs subscription filter pointing to the Security account's destination.

Cevap

Install the unified CloudWatch agent on the EC2 instances, configuring the log path to `/var/log/api/server.log*` to match rotated logs. Stream the logs to a local CloudWatch Logs log group, and configure cross-account subscription filters targeting a CloudWatch Logs destination in the Security account. The destination will stream the logs to a Kinesis Data Firehose delivery stream writing to the destination S3 bucket encrypted with a Customer Managed Key (CMK).
The correct solution uses the wildcard path (`/var/log/api/server.log*`) in the unified CloudWatch agent configuration, which matches rotated files and prevents log loss. To achieve cross-account streaming, it uses CloudWatch Logs destinations in the Security account to receive logs from subscription filters in the member accounts, and routes them to a Kinesis Data Firehose stream. Using a Customer Managed Key (CMK) allows configuring key policy permissions for cross-account access.

Adım Adım Çözüm

1
Configure the unified CloudWatch agent log path with a wildcard pattern.
The agent matches and reads active `/var/log/api/server.log` as well as rotated files `/var/log/api/server.log.YYYY-MM-DD-HH`.
Prevents log loss during the hourly log rotation.
2
Set up a centralized Kinesis Data Firehose delivery stream and S3 bucket in the Security account using a Customer Managed Key (CMK).
Establishes the ingestion pipeline and destination storage with cross-account decryption/encryption capabilities.
AWS-managed keys do not allow cross-account access, so a CMK is required.
3
Create a CloudWatch Logs destination in the Security account and subscription filters in the member accounts.
Establishes a cross-account log streaming channel from member account log groups to the central Firehose stream.
Subscription filters cannot target cross-account Firehose streams directly; they must target a destination resource.

Anahtar Kavram

Centralized cross-account logging with dynamic log path wildcard ingestion and cross-account access controls.
Tahmini Süre:3m 0s
Soru 1126Soru →

A multinational corporation runs its workloads across multiple AWS accounts managed under AWS Organizations. As part of a security audit, a solutions architect is tasked with upgrading the data protection configuration for application access logs. These logs are pushed from member accounts to a centralized Amazon S3 bucket in a dedicated Logging Account. The S3 bucket currently uses default encryption with the AWS-managed KMS key for Amazon S3 (aws/s3). The audit requires that all logs must be encrypted at rest using a key that supports automatic rotation and allows the organization to control key access policies. The member accounts must be able to continue writing logs, and the security analysts in the Logging Account must be able to read and decrypt them. Which of the following represents the most secure and compliant way to implement this requirement?

Cevabı ve açıklamayı göster

Cevap: Provision a symmetric customer managed KMS key in the Logging Account. Update the key's policy to grant the member accounts' execution roles the permission to perform the kms:GenerateDataKey action, and grant the Logging Account's security analysts permission to perform the kms:Decrypt action. Configure the centralized S3 bucket to use this customer managed KMS key as the default encryption key, and modify the bucket's resource policy to permit cross-account s3:PutObject requests.

Cevap

Provision a symmetric customer managed KMS key in the Logging Account, granting the member accounts' roles kms:GenerateDataKey permissions and the security analysts kms:Decrypt permissions, while configuring the centralized S3 bucket policy to allow cross-account s3:PutObject writes.
The correct solution relies on a symmetric customer managed KMS key in the Logging Account. Since AWS-managed keys (like aws/s3) cannot have their key policies modified to grant permissions to external accounts, a customer managed key is required to support cross-account log delivery. The key policy of the customer managed key must explicitly grant the member accounts' roles permission to generate a data key (kms:GenerateDataKey) to encrypt the log files as they are written, while granting the Logging Account's security analysts decrypt permissions (kms:Decrypt). The bucket policy handles S3 permissions (s3:PutObject), but key permissions must be managed through the KMS key policy.

Adım Adım Çözüm

1
Identify key type constraints for cross-account access.
AWS-managed keys (such as aws/s3) cannot be shared or delegated cross-account because their key policies are immutable. A customer managed KMS key must be used.
Compliance requires a key that supports rotation and key policies that the organization can modify to permit cross-account operations.
2
Configure the KMS key policy in the Logging Account.
The key policy must explicitly allow the member accounts' write roles/services permission for kms:GenerateDataKey, and grant kms:Decrypt permission to the analysts in the Logging Account.
Since member accounts write to the S3 bucket, they must generate a data key to encrypt the payload. The analysts must decrypt it to read the logs.
3
Configure S3 bucket default encryption and resource policy.
Set default S3 bucket encryption to use the customer managed KMS key. Update the S3 bucket policy to permit s3:PutObject from the member accounts' principal ARNs.
This guarantees that all newly uploaded objects are automatically encrypted using the central customer managed key, and grants cross-account S3 write permission.

Anahtar Kavram

Cross-account KMS encryption key sharing constraints and S3 resource policies
Soru 1127Soru →

An enterprise operates a multi-region web application across us-east-1 (active) and us-west-2 (passive). The application tier consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The database tier uses an Amazon Aurora Global Database with the primary cluster in us-east-1. Traffic is routed using an Amazon Route 53 failover routing policy pointing to the primary ALB with an associated health check. During a simulated database outage in us-east-1, the application became unavailable, but Route 53 did not fail over to us-west-2 because the Route 53 health check, which points to a static HTML page on the EC2 instances, remained healthy.

Which action should a solutions architect take to resolve this issue and enhance the disaster recovery reliability?

Cevabı ve açıklamayı göster

Cevap: Update the Route 53 health check to query a dynamic health check endpoint on the application servers that verifies connectivity to the primary database cluster, returning a failure response if the database is unreachable.

Cevap

Update the Route 53 health check to query a dynamic health check endpoint on the application servers that verifies connectivity to the primary database cluster, returning a failure response if the database is unreachable.
The correct answer is to configure the health check to query a dynamic health endpoint on the EC2 instances that performs a database query, and fails if the database is unreachable. Route 53 DNS failover relies on health checks to determine the status of the endpoints. A static health check page only confirms that the web server is running. To detect a database outage, the health check must monitor an endpoint that actively validates connectivity to the database, causing Route 53 to fail over to the secondary region when the database becomes unavailable.

Adım Adım Çözüm

1
Analyze why the DNS failover failed during the simulated database outage.
The Route 53 health check was checking a static HTML page, which only verified that the web servers (EC2 instances) were running. It did not verify whether the application could connect to the database.
This explains the failure of the automated failover mechanism.
2
Design an application-aware health check endpoint.
Create a dynamic endpoint (such as /health/status) on the application servers that performs a simple test query against the Aurora database.
This ensures the health check evaluates the full application stack, including critical backend dependencies.
3
Update the Route 53 health check configuration.
Point the Route 53 health check to the newly created dynamic endpoint so that database connectivity issues will result in a health check failure, initiating failover to the standby region.
This aligns the DNS routing decisions with the actual functional status of the application stack.

Anahtar Kavram

To ensure reliable disaster recovery failover in a multi-region architecture, Route 53 health checks must monitor dynamic application endpoints that validate backend dependencies (such as database connectivity) rather than simple web server availability or static files.
Soru 1128Soru →

A medical device manufacturing company is establishing a centralized telemetry logging architecture. An application running on Amazon ECS tasks within a Production VPC in Account A (444455556666444455556666) needs to write encrypted raw patient telemetry data directly to an Amazon S3 bucket located in a dedicated Security and Auditing account, Account B (111122223333111122223333). The compliance officer requires that all data uploaded must be owned by Account B immediately upon creation to prevent Account A from deleting or modifying the logs. The data must be encrypted at rest using a customer-managed KMS key (CMK). The ECS tasks in Account A must only have the minimum permissions required to perform the write and encryption operations, with no read or delete capabilities on Account B's resources. Which two configuration steps must the Solutions Architect implement to meet these requirements securely?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In Account B, set the S3 Object Ownership to Bucket Owner Enforced to disable Access Control Lists (ACLs), and configure a bucket policy that grants s3:PutObject permissions specifically to Account A's ECS task role.; In Account B, create a Customer Managed Key (CMK) with a key policy that grants Account A's ECS task role permissions for the kms:GenerateDataKey and kms:Decrypt actions, and configure the S3 bucket to use this CMK as the default encryption key.

Cevap

In Account B, set S3 Object Ownership to Bucket Owner Enforced, configure a bucket policy that grants s3:PutObject permissions to Account A's ECS task role, create a Customer Managed Key (CMK) in Account B with a key policy allowing Account A's ECS task role to perform kms:GenerateDataKey and kms:Decrypt, and configure the S3 bucket to use this CMK by default.
To implement write-only cross-account uploads with automatic ownership transfer, the destination S3 bucket must disable ACLs by setting Object Ownership to Bucket Owner Enforced. This automatically transfers ownership of uploaded objects to Account B. A bucket policy must grant s3:PutObject permissions to the uploading role. Additionally, because default AWS-managed keys (aws/s3) cannot be shared across accounts, a Customer Managed Key (CMK) must be created in Account B. Its key policy must explicitly grant the uploading role both kms:GenerateDataKey and kms:Decrypt permissions to support S3 multipart uploads.

Adım Adım Çözüm

1
Disable S3 ACLs in the destination bucket by setting Object Ownership to Bucket Owner Enforced.
Ownership of all uploaded objects automatically transfers to the bucket owner (Account B), preventing the uploading account (Account A) from maintaining control or deleting the logs.
To satisfy the compliance requirement that Account B must own all uploaded objects immediately and prevent modification or deletion by Account A.
2
Configure the S3 bucket policy in Account B to allow cross-account write access.
Grants s3:PutObject permissions to Account A's ECS task role.
Since ACLs are disabled, IAM and S3 bucket policies are the sole mechanisms to authorize cross-account access.
3
Create a Customer Managed Key (CMK) in Account B and configure its key policy to allow cross-account access.
Grants the ECS task role in Account A permissions to generate data keys and decrypt objects (needed for multipart uploads).
AWS-managed keys (aws/s3) cannot be shared cross-account, so a CMK is required to support cross-account S3 bucket encryption.
4
Configure the S3 bucket default encryption to use the newly created Customer Managed Key (CMK).
Enforces automatic encryption at rest using the CMK for all uploaded objects.
Ensures compliance with data-at-rest encryption requirements using the shared CMK.

Anahtar Kavram

Cross-account security controls using S3 Object Ownership (Bucket Owner Enforced) and Customer Managed Keys (CMKs) key policies.
Soru 1129Soru →

A financial services company hosts its real-time market data ingestion application in VPC-A (us−east−1us-east-1) and its latency-critical analytics engine in VPC-B (us−east−1us-east-1). Currently, an AWS Transit Gateway is used to route traffic between the two VPCs. Additionally, the ingestion application in VPC-A continuously receives real-time trade feeds from an on-premises datacenter in Chicago via a 10 Gbps10\text{ Gbps} AWS Direct Connect connection. This hybrid traffic traverses an AWS Direct Connect Gateway associated with the Transit Gateway via a Transit Virtual Interface (Transit VIF).

Performance testing reveals that data transfers between VPC-A and VPC-B are bottlenecked and cannot exceed 10 Gbps10\text{ Gbps}, while latency-sensitive feeds from the on-premises datacenter to VPC-A suffer from a 2 ms2\text{ ms} routing overhead introduced by the Transit Gateway. The company requires a solution that maximizes inter-VPC throughput and reduces hybrid connectivity latency to the absolute minimum.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a VPC Peering connection between VPC-A and VPC-B, configure the instance operating systems to use a Maximum Transmission Unit (MTU) of 9001, and route the inter-VPC traffic through the peering connection.; Deploy a Direct Connect Gateway, configure a Private Virtual Interface (Private VIF) on the Direct Connect connection, and associate the Direct Connect Gateway with the Virtual Private Gateway (VGW) attached to VPC-A.

Cevap

The correct actions are to establish a VPC Peering connection between VPC-A and VPC-B with an MTU of 9001, and to deploy a Direct Connect Gateway with a Private Virtual Interface associated with the Virtual Private Gateway of VPC-A.
The correct solution involves two distinct optimizations. First, establishing a VPC Peering connection between VPC-A and VPC-B allows direct instance-to-instance communication bypassing the Transit Gateway, which eliminates routing hops and latency. VPC Peering natively supports Jumbo Frames (MTU 9001) for inter-VPC traffic within the same region, maximizing throughput. Second, since hybrid traffic from the on-premises datacenter only targets VPC-A, replacing the Transit VIF and Transit Gateway route with a Direct Connect Private VIF attached to a Direct Connect Gateway associated with VPC-A's Virtual Private Gateway (VGW) removes the Transit Gateway from the path. This eliminates the 2 ms processing latency introduced by the Transit Gateway.

Adım Adım Çözüm

1
Analyze the inter-VPC bottleneck between VPC-A and VPC-B.
Identify that Transit Gateway adds processing overhead and extra routing hops. Replacing it with a direct VPC Peering connection provides the lowest possible latency and supports Jumbo Frames (MTU 9001) for maximum throughput in the same region.
To resolve the inter-VPC throughput limit and minimize latency between the two VPCs in the same region.
2
Analyze the hybrid latency overhead between the Chicago datacenter and VPC-A.
Identify that Transit Gateway introduces a 2 ms processing overhead. Since on-premises traffic only needs to reach VPC-A, bypass the Transit Gateway by using a Direct Connect Private Virtual Interface (Private VIF) associated with a Virtual Private Gateway (VGW) on VPC-A via a Direct Connect Gateway.
To eliminate Transit Gateway latency for the hybrid path to the single target VPC.

Anahtar Kavram

Optimizing hybrid and inter-VPC network performance by choosing the correct virtual interfaces (Private VIF vs Transit VIF) and routing architectures (VPC Peering vs Transit Gateway) to minimize latency and maximize throughput using MTU configurations.
Tahmini Süre:3m 0s
Soru 1130Soru →

An advertising technology company runs a real-time bidding application with sub-millisecond processing requirements. The application's front-end bidding engines are deployed in an Ingestion VPC, while the core database cluster is hosted in a separate Processing VPC, both within the `us-east-1` Region. Under peak traffic spikes, the company experiences increased latency and connection timeouts when the bidding engines query the database. The database endpoints are resolved using an Amazon Route 53 Private Hosted Zone (PHZ). The company requires a solution that minimizes latency, avoids additional data processing fees, and ensures high availability across all Availability Zones. How should a solutions architect optimize the network configuration to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Establish a VPC Peering connection between the Ingestion VPC and the Processing VPC, configure the routing tables to route database traffic directly over the peering connection, and associate the existing Route 53 Private Hosted Zone with both VPCs.

Cevap

Establish a VPC Peering connection between the Ingestion VPC and the Processing VPC, configure the routing tables to route database traffic directly over the peering connection, and associate the existing Route 53 Private Hosted Zone with both VPCs.
Establishing a VPC Peering connection provides the lowest latency and highest throughput for inter-VPC traffic within the same region, as it routes traffic directly over the AWS network backbone without passing through intermediate gateways. It also does not charge data processing fees. Associating the Route 53 Private Hosted Zone with both VPCs ensures that resource records for the database are successfully resolved by the client instances in the Ingestion VPC.

Adım Adım Çözüm

1
Create a VPC Peering connection between the Ingestion VPC and the Processing VPC.
The two VPCs are connected directly over the AWS network backbone without routing through intermediate gateways.
VPC Peering provides the lowest latency for same-region inter-VPC traffic and does not charge data processing fees.
2
Update the route tables in both VPCs to target the VPC Peering connection for the destination CIDR blocks.
Traffic between the bidding engines and the database cluster is routed directly over the peering connection.
Route tables must be updated manually for VPC peering connections to enable the flow of traffic.
3
Associate the Route 53 Private Hosted Zone with both the Ingestion VPC and the Processing VPC.
Bidding engines in the Ingestion VPC can resolve the database DNS hostnames to their private IP addresses.
DNS resolution for Private Hosted Zones is limited to associated VPCs; setting up a peering connection does not automatically share DNS resolution.

Anahtar Kavram

Selecting the lowest-latency inter-VPC routing option and configuring cross-VPC DNS resolution.
Tahmini Süre:2m 0s
Soru 1131Soru →

A global collaborative engineering SaaS platform hosts its assembly-rendering engine in us-east-1 (VPC-A) and its archive vault in us-west-2 (VPC-B). The VPCs are connected via an inter-region VPC peering connection. The platform's on-premises development center in New York connects to VPC-A via an AWS Direct Connect (DX) connection with a Private Virtual Interface (VIF).

On-premises engineers in London experience severe latency and packet loss when accessing the vault in VPC-B over the public internet. Additionally, internal services in VPC-B cannot resolve the private DNS names of resources in VPC-A, impacting rendering times. The enterprise wants to optimize the network path, reduce latency for London-based engineers, and enable secure, private DNS resolution across both regions.

Which THREE actions should a Solutions Architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Associate the New York Direct Connect Private VIF with a Direct Connect Gateway (DXGW), and associate the DXGW with the Virtual Private Gateways (VGWs) of both VPC-A and VPC-B.; Deploy AWS Global Accelerator and associate it with a public Application Load Balancer (ALB) in VPC-B, directing London engineers to access the system via the Global Accelerator's static IP addresses.; Enable DNS resolution support for the VPC peering connection, and associate the Route 53 Private Hosted Zone of VPC-A with VPC-B.

Cevap

Associate the New York Direct Connect Private VIF with a Direct Connect Gateway (DXGW) associated with both Virtual Private Gateways; deploy AWS Global Accelerator mapped to a public Application Load Balancer in the destination region; and enable DNS resolution support on the peering connection while associating the Route 53 Private Hosted Zone with the peer VPC.
The correct solution optimizes global user access using AWS Global Accelerator to bypass the public internet, establishes hybrid connectivity to multiple regions via a Direct Connect Gateway associated with Virtual Private Gateways, and resolves name resolution latency by enabling peering DNS support and associating the Private Hosted Zone with the peer VPC.

Adım Adım Çözüm

1
Consolidate hybrid access by associating the Private VIF with a Direct Connect Gateway, and attaching the DXGW to the Virtual Private Gateways of both VPCs.
On-premises resources in New York can privately and directly access both the US-East and US-West VPCs over the Direct Connect path.
Direct Connect Gateway facilitates multi-region VPC access over a single Private VIF, eliminating the need for multiple virtual interfaces or traversing the public internet.
2
Configure AWS Global Accelerator to onboard London engineer traffic onto the AWS global network close to their location and route it to an Application Load Balancer in the US-West VPC.
Network latency and packet loss for remote engineers are minimized by bypassing the congested public internet and leveraging the AWS backbone network.
Global Accelerator uses Anycast IP addresses to ingest traffic at the edge location closest to the user, providing a more stable and high-performing network path.
3
Modify the VPC peering connection settings to enable DNS resolution support, and authorize/create the association between the Private Hosted Zone in VPC-A and the peer VPC-B.
Services in VPC-B can successfully resolve private DNS names of resources hosted in VPC-A.
Route 53 Private Hosted Zones require explicit association with target VPCs to allow resolution, and the peering connection must support DNS resolution for hostname queries to succeed across regions.

Anahtar Kavram

Optimizing hybrid and multi-region network performance, latency, and DNS resolution by leveraging Direct Connect Gateway, AWS Global Accelerator, and Private Hosted Zone cross-VPC associations.
Soru 1132Soru →

A solutions architect is designing a high-performance database strategy for a new relational OLTP workload. The application requires highly available database access across multiple Availability Zones and must dynamically scale horizontally to handle unpredictable spikes in read traffic.

Which two strategies should the solutions architect implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon Aurora MySQL database cluster with Aurora Replicas to scale read workloads.; Configure Aurora Auto Scaling to dynamically adjust the number of Aurora Replicas based on CPU utilization.

Cevap

To meet the requirements, the solutions architect should deploy an Amazon Aurora MySQL database cluster with Aurora Replicas and configure Aurora Auto Scaling to dynamically adjust the number of replicas based on CPU utilization.
Deploying an Amazon Aurora MySQL database cluster with Aurora Replicas allows the architecture to scale read workloads by directing queries to reader endpoints. When combined with Aurora Auto Scaling, the database cluster can dynamically add or remove replicas based on target metrics like average CPU utilization, ensuring the application handles sudden peaks in traffic efficiently.

Adım Adım Çözüm

1
Evaluate options for database high availability and read scaling.
Identify that Amazon Aurora MySQL with Aurora Replicas provides both Multi-AZ high availability and horizontal scaling for read traffic.
Aurora Replicas share the same storage volume as the primary instance and can act as failover targets as well as read endpoints.
2
Address the requirement for dynamic scaling during unpredictable traffic spikes.
Choose Aurora Auto Scaling.
Aurora Auto Scaling monitors CPU utilization or connection count and automatically adjusts the replica count to maintain performance and optimize cost.

Anahtar Kavram

Amazon Aurora horizontal read scaling and dynamic replica scaling capabilities.
Tahmini Süre:1m 30s
Soru 1133Soru →

A digital health platform hosts its application workloads in a production AWS account under an AWS Organizations structure. The application stores HIPAA-regulated patient health summaries in an Amazon S3 bucket. Currently, the bucket is encrypted using default server-side encryption with the AWS managed key (`aws/s3`). To comply with a new security directive, the platform's security officer requires that a compliance reporting service running in a separate, dedicated auditing AWS account must be able to read these health summaries. The encryption keys must support automatic rotation, and the policy must adhere strictly to the principle of least privilege. Which two actions should the solutions architect take to implement these changes?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a symmetric customer managed key (CMK) in the production account, enable automatic key rotation, and configure the key policy to grant the auditing account's IAM role access to the `kms:Decrypt` action.; Configure the default encryption of the S3 bucket to use the new customer managed key, and update the S3 bucket policy in the production account to grant the auditing account's IAM role access to the `s3:GetObject` action.

Cevap

The correct actions are to create a symmetric customer managed key (CMK) in the production account with automatic rotation enabled, grant decryption permissions to the auditing account's IAM role in the key policy, update the S3 bucket default encryption to use this CMK, and update the production S3 bucket policy to grant the auditing role access to get the objects.
To retrieve encrypted objects from an S3 bucket in another account, the auditing IAM role must have permission in both the S3 bucket policy (`s3:GetObject`) and the KMS key policy (`kms:Decrypt`). Because the default AWS managed key (`aws/s3`) cannot be configured with a custom policy or shared cross-account, a symmetric customer managed key (CMK) must be created in the production account. Enabling automatic rotation on this CMK satisfies security policies, and updating the key policy grants the external account decryption capability. Updating the S3 bucket default encryption to the CMK and applying the bucket policy completes the access path.

Adım Adım Çözüm

1
Analyze cross-account key sharing capabilities for AWS managed keys versus customer managed keys.
Identify that the default AWS managed key (`aws/s3`) cannot have its key policy modified and does not support cross-account sharing. Therefore, a customer managed key (CMK) is required.
AWS managed keys are locked to the local account and their policies are read-only.
2
Configure the customer managed key in the production account.
Provision a symmetric customer managed KMS key, enable annual automatic rotation, and update its key policy to explicitly grant the auditing account's IAM role permission to perform `kms:Decrypt`.
This satisfies the compliance requirement for key rotation and establishes cross-account decryption capabilities.
3
Configure the S3 bucket default encryption and access policy.
Change the default encryption settings of the S3 bucket to point to the new customer managed key, and update the S3 bucket policy in the production account to grant the auditing role the `s3:GetObject` permission.
This ensures S3 object access is granted cross-account, and that the data is encrypted with the correct key.

Anahtar Kavram

Cross-account access to encrypted Amazon S3 resources requires both S3 bucket policy permissions and KMS customer managed key (CMK) policy decryption permissions, as AWS managed KMS keys cannot be shared across accounts.
Soru 1134Soru →

An enterprise operates a critical reporting application running on Amazon EC2 instances across three Availability Zones in a single VPC within the us-west-2 Region. The instances are managed by an Auto Scaling group behind an Application Load Balancer (ALB). The application reads and writes data to a multi-AZ Amazon RDS for PostgreSQL database. Outbound reporting logs are uploaded to an external partner API via a single NAT Gateway located in one of the public subnets.

The solutions architect must enhance the disaster recovery (DR) posture and reliability of the application. The new DR strategy must support a recovery point objective (RPO) of under 15 minutes and a recovery time objective (RTO) of under 30 minutes in the us-east-1 Region, while minimizing idle resource costs. Additionally, the outbound connectivity must be highly resilient against Availability Zone outages.

Which of the following configurations will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon RDS for PostgreSQL cross-region read replica in the us-east-1 Region, and implement an AWS Lambda function to promote the replica to a standalone DB instance during a failover event.; Deploy a NAT Gateway in each public subnet across all three Availability Zones, and update the route tables of each private subnet to direct egress traffic through the NAT Gateway in its respective Availability Zone.

Cevap

The correct configurations are to create an Amazon RDS for PostgreSQL cross-region read replica in the recovery region and automate its promotion, and to deploy a NAT Gateway in each Availability Zone and update the route tables of each private subnet to route outbound traffic through its local NAT Gateway.
The correct configurations address both disaster recovery and reliability. The option to create and automate the promotion of an RDS cross-region read replica handles the database DR requirements (RPO < 15 mins, RTO < 30 mins) cost-effectively. The option to deploy a NAT Gateway in each public subnet per Availability Zone removes the egress network single point of failure, satisfying the AZ redundancy requirement.

Adım Adım Çözüm

1
Evaluate the database recovery requirements (RPO < 15 minutes, RTO < 30 minutes, minimize cost).
Identify that cross-region read replication for Amazon RDS PostgreSQL provides low-latency asynchronous replication that meets the low RPO, while promoting the replica via automation meets the RTO without incurring the high costs of active-active setups.
RDS cross-region read replicas replicate data asynchronously to the target region, maintaining a recovery point within seconds or minutes, and can be promoted to standalone instances quickly.
2
Evaluate the outbound connectivity reliability requirement.
Identify that the current single NAT Gateway is a single point of failure (SPOF) for AZ outages, and deploying a NAT Gateway in each Availability Zone removes this SPOF.
By having a NAT Gateway per Availability Zone, a failure in one AZ does not impact outbound traffic originating from the other AZs.

Anahtar Kavram

Disaster recovery planning using cross-region read replicas for low RTO/RPO database failover combined with multi-AZ NAT Gateway redundancy to prevent egress connectivity single points of failure.
Soru 1135Soru →

An enterprise financial reporting application runs on AWS. The application tier consists of a fleet of Amazon EC2 `c5.xlarge` instances in an Auto Scaling Group behind an Application Load Balancer (ALB). The application queries an Amazon RDS for PostgreSQL database (configured in a Multi-AZ deployment) to retrieve transaction logs, processes the data, and writes intermediate files to attached 300 GiB300\text{ GiB} `gp3` EBS volumes before uploading the consolidated reports to Amazon S3.

During end-of-month processing, users experience severe delays. A solutions architect reviews the Amazon CloudWatch metrics and notes the following:
* The EC2 instances show low CPU and memory utilization, but high I/O wait times.
* The `gp3` EBS volumes show `VolumeThroughput` consistently pegged at 125 MiB/s125\text{ MiB/s} and high `VolumeQueueLength`.
* The RDS database experiences high CPU utilization and read latency on the primary instance, while the standby instance CPU utilization remains near 0%0\%.

Which two actions should the solutions architect take to resolve the performance bottlenecks and optimize the system's performance? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the gp3 EBS volume configuration to increase the provisioned throughput beyond the default 125 MiB/s125\text{ MiB/s} to match the peak transfer rate of the application.; Create an Amazon RDS PostgreSQL read replica and modify the reporting application to route read-only query traffic to the read replica's endpoint.

Cevap

The solutions architect should increase the provisioned throughput on the gp3 EBS volumes beyond the default 125 MiB/s125\text{ MiB/s} and create an Amazon RDS PostgreSQL read replica to offload read-only reporting query traffic from the primary instance.
The correct approach involves identifying and addressing both the storage write bottleneck and the database read bottleneck. First, the gp3 volumes can be modified to scale throughput independently of size, resolving the baseline throughput limit of 125 MiB/s125\text{ MiB/s}. Second, creating an RDS read replica and directing read queries to it offloads the database read workload from the primary instance.

Adım Adım Çözüm

1
Analyze CloudWatch metrics for the storage layer.
Identify that the gp3 EBS volumes are pegged at the default 125 MiB/s125\text{ MiB/s} throughput limit, resulting in high I/O wait times on the EC2 instances.
This confirms that the storage throughput is the primary bottleneck for the application tier's file-writing operations.
2
Propose gp3 volume optimization.
Increase the provisioned throughput of the gp3 volumes independently without resizing the volume storage capacity.
Unlike gp2, gp3 allows independent scaling of throughput and IOPS, allowing cost-effective remediation of the throughput bottleneck.
3
Analyze database resource utilization metrics.
Observe that the primary RDS instance has high CPU and read latency, while the Multi-AZ standby instance is idle.
This indicates that read-heavy query traffic is causing resource exhaustion on the primary database instance.
4
Implement read scaling for the database.
Deploy an Amazon RDS PostgreSQL read replica and direct read-only query traffic from the application to this replica endpoint.
An RDS Multi-AZ standby instance cannot serve read traffic, so a dedicated read replica is required to scale read operations.

Anahtar Kavram

Identifying storage performance bottlenecks by looking at EBS throughput limits and offloading read traffic from RDS primary instances using read replicas rather than passive standby instances.
Soru 1136Soru →

An enterprise is designing a new cloud infrastructure in the us-west-2 Region using AWS Organizations. The architecture requires connecting two spoke VPCs, vpc-hr-app and vpc-finance-app, to a centralized shared services VPC, vpc-shared-services. Workloads in both spoke VPCs require outbound internet access to download software patches, but must not accept any inbound traffic from the internet. Additionally, these workloads must securely access a shared database hosted in vpc-shared-services and resolve private domain names in a Route 53 Private Hosted Zone (PHZ) named services.local hosted in the shared services AWS account. Outbound internet access must be highly available and resilient to Availability Zone (AZ) failures. Which two steps should the solutions architect take to design this connectivity? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In each spoke VPC, deploy a NAT Gateway in public subnets across two Availability Zones, and configure the private subnet route tables to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the local NAT Gateway in their respective Availability Zone.; Authorize the association of the Route 53 Private Hosted Zone services.local in the shared services account with the spoke VPCs using the AWS CLI or SDK, and then associate the zone from the spoke VPC accounts.

Cevap

To achieve highly available outbound connectivity and private DNS resolution, the architect should deploy redundant NAT Gateways across Availability Zones in each spoke VPC and associate the centralized Private Hosted Zone directly with all spoke VPCs using cross-account authorization.
Deploying NAT Gateways in multiple Availability Zones within each spoke VPC ensures that outbound internet traffic has local redundancy and does not experience a single point of failure or cross-AZ data transfer fees for egress. For DNS resolution, Route 53 Private Hosted Zones can be shared across multiple AWS accounts by authorizing the association from the hosting account and then completing the association from the owner accounts of the client VPCs. This provides a direct, highly available, and cost-effective resolution mechanism without the deployment overhead of Route 53 Resolver endpoints.

Adım Adım Çözüm

1
Design highly available outbound internet access.
Deploy NAT Gateways in public subnets in each Availability Zone of the spoke VPCs.
This prevents a single AZ outage from disabling internet access for all workloads and avoids cross-AZ data transfer charges.
2
Establish cross-account private DNS resolution.
Use AWS CLI/SDK to authorize the association of services.local with the spoke VPCs from the shared services account, then accept and associate it from the spoke accounts.
This eliminates the need for expensive and complex Route 53 Resolver endpoint infrastructure.

Anahtar Kavram

Cross-account Route 53 Private Hosted Zone association and AZ-redundant NAT Gateway routing design.
Tahmini Süre:3m 0s
Soru 1137Soru →

An enterprise is designing a highly resilient hybrid network architecture to connect its AWS multi-Region environment with an on-premises datacenter. The AWS deployment spans two Regions: `us-east-1` (containing `vpc-app-use1` for workloads and `vpc-sec-use1` for egress security control) and `us-west-2` (containing `vpc-app-usw2` for workloads and `vpc-sec-usw2` for egress security control). A single 10 Gbps10\text{ Gbps} AWS Direct Connect connection terminates at a Direct Connect Gateway (`dxgw-global`). The solution must satisfy the following requirements:
1. VPCs within each Region must route inter-VPC traffic via a regional AWS Transit Gateway (`tgw-use1` and `tgw-usw2`).
2. Workloads in both Regions must access the on-premises network with minimal latency and high availability.
3. Outbound internet traffic from application VPCs must route through the security VPC in their respective Region. This traffic must remain highly available even during an Availability Zone (AZ) outage, without routing across Regions.
4. Active Directory DNS queries for `corp.local` must resolve to on-premises DNS servers, while queries for the Route 53 Private Hosted Zone (PHZ) `aws.corp` (hosted in a centralized AWS account) must resolve across all VPCs.

Which of the following connectivity and DNS configurations meets these requirements while minimizing latency and single points of failure?

Cevabı ve açıklamayı göster

Cevap: Associate `dxgw-global` with both `tgw-use1` and `tgw-usw2` using transit virtual interfaces. Establish a Transit Gateway peering connection between `tgw-use1` and `tgw-usw2` for inter-Region VPC-to-VPC traffic. Deploy redundant NAT Gateways across multiple Availability Zones in both `vpc-sec-use1` and `vpc-sec-usw2`. In the route tables of the application VPCs, point the default route (0.0.0.0/00.0.0.0/0) to the local Transit Gateway, which routes to the local security VPC. Create Route 53 Resolver outbound endpoints in the security VPCs of both Regions and configure forwarding rules for `corp.local` pointing to the on-premises DNS servers. Authorize cross-account Private Hosted Zone association and associate the `aws.corp` Private Hosted Zone with all application and security VPCs in both Regions.

Cevap

The correct architecture associates the Direct Connect Gateway with both Transit Gateways, deploys redundant NAT Gateways across multiple Availability Zones in both security VPCs, configures Route 53 Resolver outbound endpoints for on-premises DNS resolution, and authorizes cross-account Private Hosted Zone association for the application and security VPCs.
The correct configuration establishes direct association between the Direct Connect Gateway and the Transit Gateways in both Regions, ensuring low-latency and compliant transit routing to the on-premises network. It ensures high availability for egress traffic by deploying redundant NAT Gateways across multiple Availability Zones in both security VPCs. For DNS resolution, it correctly configures Route 53 Resolver outbound endpoints for on-premises forwarding and utilizes cross-account PHZ association to resolve the `aws.corp` zone in all VPCs.

Adım Adım Çözüm

1
Evaluate hybrid connectivity and transit capabilities over AWS Direct Connect.
AWS Transit Gateway peering does not support transitive routing for traffic from a Direct Connect Gateway or VPN attachment. Peering Transit Gateways to route on-premises traffic from a remote Region will fail.
This establishes that the Direct Connect Gateway must be directly associated with both `tgw-use1` and `tgw-usw2` using transit virtual interfaces.
2
Analyze outbound internet routing and high availability constraints.
Deploying a single NAT Gateway in a security VPC creates a single point of failure. Redundant NAT Gateways must be placed across multiple Availability Zones in both `vpc-sec-use1` and `vpc-sec-usw2` to ensure high availability during an Availability Zone outage.
This rules out configurations that compromise egress redundancy to save costs.
3
Determine Private Hosted Zone (PHZ) resolution requirements across multiple accounts and VPCs.
Using Route 53 Resolver forwarding rules to point to inbound endpoints to resolve a Private Hosted Zone is unsupported. The PHZ must be explicitly associated with each VPC in all accounts that require name resolution.
This validates that cross-account PHZ association is mandatory for the application and security VPCs to resolve the `aws.corp` domain.
4
Configure on-premises domain resolution.
Create Route 53 Resolver outbound endpoints in the security VPCs of both Regions and associate conditional forwarding rules for `corp.local` pointing to the on-premises DNS servers.
This ensures that DNS queries for the on-premises directory resolve correctly through the Direct Connect path.

Anahtar Kavram

Multi-Region hybrid networking, Transit Gateway routing limitations, and Private Hosted Zone cross-VPC association.
Soru 1138Soru →

A digital health enterprise operates a medical imaging application across multiple AWS accounts. The primary processing workload runs on Amazon EC2 instances in a Production VPC (VPC-A) in the us-east-1 Region. A central reporting application in a Shared Services VPC (VPC-B) in the same Region needs to pull large image files from VPC-A with the lowest possible latency and maximum throughput. Currently, VPC-B accesses the images in VPC-A by routing traffic over the public internet through a NAT Gateway in VPC-B to an Application Load Balancer (ALB) in VPC-A. The network configuration uses a Route 53 Private Hosted Zone (PHZ) for DNS resolution, but resolution is failing from VPC-B.

Which combination of actions will optimize the network performance and resolve the latency and DNS issues? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a VPC Peering connection between VPC-A and VPC-B, configure the VPC route tables to route the inter-VPC traffic through the peering connection, and ensure that the EC2 instances use a Jumbo Frame MTU of 9001.; Associate the Route 53 Private Hosted Zone from the Production VPC's account with the Shared Services VPC (VPC-B), and verify that DNS resolution and DNS hostnames are enabled in both VPCs.

Cevap

Establish a VPC Peering connection between the VPCs, configure the route tables, and enable Jumbo Frames (MTU of 9001). Additionally, associate the Route 53 Private Hosted Zone from the Production VPC's account with the Shared Services VPC, ensuring DNS resolution and DNS hostnames are enabled on both VPCs.
Establishing a VPC Peering connection allows traffic to route directly over the AWS private network, bypassing the NAT Gateway and the public internet. This minimizes latency and reduces data transfer costs. Additionally, since the VPCs are in the same Region, VPC Peering supports Jumbo Frames (MTU of 9001), which maximizes throughput for large file transfers. Associating the Route 53 Private Hosted Zone from the Production VPC's account with the Shared Services VPC (VPC-B), while verifying that DNS resolution and DNS hostnames are enabled in both VPCs, allows EC2 instances in VPC-B to resolve the private DNS names of the services in VPC-A.

Adım Adım Çözüm

1
Configure VPC Peering
A direct, private network path between VPC-A and VPC-B is created, allowing traffic to bypass the public internet and NAT Gateway.
Routing traffic directly through a VPC Peering connection minimizes latency, avoids NAT Gateway bandwidth limits, and eliminates NAT Gateway data transfer charges.
2
Enable Jumbo Frames
The MTU on the EC2 instances is set to 9001.
Since the VPCs are in the same Region, VPC Peering supports Jumbo Frames (MTU of 9001), which increases the payload size per packet and maximizes throughput for large image files.
3
Associate the Route 53 Private Hosted Zone
VPC-B is associated with the Private Hosted Zone hosted in the Production VPC's account.
This allows instances in VPC-B to resolve the internal domain names of the resources in VPC-A privately, resolving the DNS resolution failure.

Anahtar Kavram

Optimizing inter-VPC network performance and latency using VPC Peering with Jumbo Frames (MTU 9001) and configuring cross-account Route 53 Private Hosted Zone associations.
Tahmini Süre:3m 0s
Soru 1139Soru →

A company operates a legacy web application on Amazon EC2 instances within an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The application queries a single Amazon RDS for PostgreSQL database instance. During a recent marketing campaign, the application suffered from severe performance degradation. Monitoring reveals that the EC2 fleet experiences delayed scale-out responses because new instances take 8 minutes to bootstrap, while the scaling cooldown is set to 2 minutes. Additionally, the RDS database is overwhelmed by read queries, and its gp3 storage volume is hitting its IOPS limit.

Which set of actions should a solutions architect recommend to optimize both compute and storage performance under these conditions?

Cevabı ve açıklamayı göster

Cevap: Create an Amazon RDS PostgreSQL Read Replica to offload read traffic, update the application to route reads to the replica, and configure an Auto Scaling Group warm pool with pre-warmed instances.

Cevap

Create an Amazon RDS PostgreSQL Read Replica to offload read traffic, update the application to route reads to the replica, and configure an Auto Scaling Group warm pool with pre-warmed instances.
The correct option addresses the storage bottleneck by offloading read queries to an RDS Read Replica, which is the standard design pattern for scaling database reads. It addresses the compute performance bottleneck by using an Auto Scaling Group warm pool to keep pre-initialized instances ready, bypassing the 8-minute bootstrap delay during scale-out events.

Adım Adım Çözüm

1
Analyze the database performance bottleneck.
Identified that RDS PostgreSQL is overwhelmed by read queries and hitting gp3 IOPS limits.
To resolve read capacity limitations on primary RDS instances, read replicas must be introduced to offload the query volume.
2
Analyze the compute scaling lag bottleneck.
Identified that the 8-minute bootstrap time is much longer than the 2-minute cooldown, causing delayed scale-out.
Using an ASG warm pool allows instances to run initialization scripts and remain in a stopped state, allowing them to join the active fleet in seconds rather than minutes.
3
Combine the optimized storage and compute configurations.
Create read replica, update application connection strings, and establish the ASG warm pool.
This dual approach directly addresses both the I/O storage bottleneck and the compute bootstrap latency.

Anahtar Kavram

Scaling read capacity using RDS Read Replicas and reducing compute initialization latency using ASG Warm Pools.
Soru 1140Soru →

An enterprise organization is migrating a legacy on-premises IBM Db2 LUW database to Amazon RDS for PostgreSQL. A solutions architect has used the AWS Schema Conversion Tool (SCT) to convert the database schema and apply it to the target RDS instance. The architect then creates an AWS Database Migration Service (DMS) replication task with replication type set to 'Full load and ongoing replication'. The full load phase completes successfully, but subsequent source database updates are not reflected in the target database. Which action must the architect perform on the source database to ensure that ongoing changes are successfully captured and replicated?

Cevabı ve açıklamayı göster

Cevap: Alter the tables on the source Db2 database to enable the DATA CAPTURE CHANGES attribute and ensure write-ahead log archiving is enabled.

Cevap

Alter the tables on the source Db2 database to enable the DATA CAPTURE CHANGES attribute and ensure write-ahead log archiving is enabled.
For an IBM Db2 LUW database to act as an AWS DMS source for ongoing replication, the tables being replicated must be modified with the DATA CAPTURE CHANGES attribute. This attribute instructs the engine to write additional change details to the transaction logs. Furthermore, log archiving must be turned on to ensure logs are not immediately deleted, allowing AWS DMS sufficient time to read them.

Adım Adım Çözüm

1
Diagnose the replication task status showing that the initial full load was successful but ongoing changes are not updating.
Identify that the issue is related to Change Data Capture (CDC) mechanisms failing to read transactional updates from the source engine.
Before performing troubleshooting on the replication instance, verification of source database logging parameters must be completed.
2
Enable the DATA CAPTURE CHANGES attribute on the tables of the source IBM Db2 LUW database.
This writes the complete details of update, insert, and delete operations into the database logs.
AWS DMS requires full log details to accurately replicate changes to a heterogeneous target database engine.
3
Ensure that the source Db2 database is configured for transaction log retention and log archiving.
The log files remain available on the disk for AWS DMS to read and process asynchronously.
If transaction logs are discarded immediately upon transaction commit, AWS DMS cannot read past transactions to catch up.

Anahtar Kavram

AWS DMS Change Data Capture (CDC) requires specific engine-dependent logging configurations on the source database (such as supplemental logging, binary logging, or data capture changes) to enable transactional change extraction.
ÖncekiSayfa 57 / 99Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin