Examkin

Tüm alıştırma soruları

1964 soru

Tüm türler1,964Çoktan seçmeli1,006Çoklu seçim931Sıralama27
Soru 1161Soru →

A global high-frequency trading SaaS platform operates its core transactional backend in the us-east-1 Region. The system connects to an on-premises colocation facility using a 10 Gbps AWS Direct Connect connection terminated on a Direct Connect Gateway (DXGW) via a Transit Virtual Interface (Transit VIF) attached to an AWS Transit Gateway in us-east-1. The platform is expanding its analytical services to the us-west-2 Region, where EC2 instances in multiple VPCs are connected via a local Transit Gateway in us-west-2. The Transit Gateways in both regions are peered.

Analytical applications in us-west-2 must transfer large, time-sensitive datasets (up to 120 GB per file) directly to the on-premises colocation facility. Currently, the team has configured routing to send traffic from the us-west-2 VPCs through their local Transit Gateway, across the inter-region Transit Gateway peering connection to the Transit Gateway in us-east-1, and then to the DXGW. However, network administrators report that traffic from us-west-2 cannot establish connectivity to the on-premises network. Furthermore, once connectivity is resolved, the company requires the configuration to deliver the highest possible throughput and lowest latency, utilizing jumbo frames.

Which combination of actions will resolve the connectivity issue while optimizing throughput and latency for the data transfers?

Cevabı ve açıklamayı göster

Cevap: Associate the existing Direct Connect Gateway directly with the Transit Gateway in us-west-2. Update the VPC route tables in us-west-2 and the us-west-2 Transit Gateway route tables to route the on-premises IP ranges directly to the Direct Connect Gateway attachment. Configure the MTU on the EC2 instances in us-west-2 to 8500 bytes.

Cevap

Associate the existing Direct Connect Gateway directly with the Transit Gateway in the us-west-2 Region, route the traffic directly to the Direct Connect Gateway attachment, and configure the EC2 instances to use an MTU of 8500 bytes.
Associating the Direct Connect Gateway directly with the Transit Gateway in the second region establishes a direct routing path over the AWS Direct Connect connection. This avoids the Transit Gateway transitive routing limitation where a peered Transit Gateway cannot route traffic to a local Direct Connect Gateway. Furthermore, configuring the EC2 instances to use an MTU of 8500 bytes matches the maximum jumbo frame MTU supported by Direct Connect Transit VIFs and Transit Gateway, avoiding packet drops and optimization issues.

Adım Adım Çözüm

1
Associate the existing Direct Connect Gateway with the Transit Gateway in us-west-2.
This creates a local attachment between the Transit Gateway in us-west-2 and the global Direct Connect Gateway, enabling a direct path to the on-premises network.
AWS Transit Gateway does not support transitive routing between peered Transit Gateways and a Direct Connect Gateway. Directly associating the Direct Connect Gateway with the local Transit Gateway resolves this connectivity limitation.
2
Update the VPC route tables in us-west-2 and the local Transit Gateway route tables to forward on-premises traffic to the Direct Connect Gateway attachment.
Traffic destined for the on-premises network is routed directly to the Direct Connect Gateway attachment rather than through the peering link.
This establishes the data path locally and avoids traversing the inter-region peering connection, reducing latency.
3
Configure the MTU on the EC2 instances in us-west-2 to 8500 bytes.
The network interface on the instances is configured to send jumbo frames up to 8500 bytes.
AWS Direct Connect Transit VIFs and Transit Gateways support a maximum MTU of 8500 bytes. Setting this value optimizes throughput by using jumbo frames without causing packet drops or fragmentation.

Anahtar Kavram

AWS Transit Gateway inter-region routing limitations and Direct Connect Gateway multi-region associations with jumbo frame (MTU) optimization.
Tahmini Süre:3m 0s
Soru 1162Soru →

A company runs a media transcoding application on a fleet of Amazon EC2 `c5.xlarge` instances. Each instance has an attached 300 GiB300\text{ GiB} Amazon EBS `gp3` volume used for caching intermediate video files during processing. During peak hours, transcoding jobs take twice as long to complete. Amazon CloudWatch metrics indicate that the EC2 instances have low CPU utilization (under 20%20\%) but high I/O wait times, and the EBS volumes are constantly operating at 125 MB/s125\text{ MB/s} throughput. A solutions architect needs to optimize the compute and storage tiers so that each instance can sustain a target throughput of 500 MB/s500\text{ MB/s}. Which of the following architectural changes will resolve the performance bottleneck and meet the throughput requirement?

Cevabı ve açıklamayı göster

Cevap: Upgrade the EC2 instances to `c5.9xlarge` to increase the dedicated EBS bandwidth, and modify the `gp3` volumes to provision 500 MB/s500\text{ MB/s} of throughput.

Cevap

Upgrade the EC2 instances to `c5.9xlarge` to increase the dedicated EBS bandwidth, and modify the `gp3` volumes to provision 500 MB/s500\text{ MB/s} of throughput.
The correct answer correctly identifies that EBS performance is bound by both the storage volume configuration and the EC2 instance's dedicated EBS bandwidth. The `c5.xlarge` instance is limited to 1,250 Mbps1,250\text{ Mbps} (~156 MB/s156\text{ MB/s}) of EBS throughput, meaning that configuring the storage volume alone cannot achieve the target performance. Upgrading the instance to a `c5.9xlarge` (7,000 Mbps7,000\text{ Mbps} / ~875 MB/s875\text{ MB/s}) provides the necessary host bandwidth, and modifying the `gp3` volume to 500 MB/s500\text{ MB/s} removes the volume-level throughput limit.

Adım Adım Çözüm

1
Identify the storage tier bottleneck.
The `gp3` volume has a default throughput baseline of 125 MB/s125\text{ MB/s}. This matches the observed performance limit in CloudWatch.
Before upgrading compute, we must determine if the storage volume itself is the primary limitation.
2
Evaluate the compute tier EBS-optimized bandwidth limit.
A `c5.xlarge` instance has a dedicated EBS bandwidth limit of 1,250 Mbps1,250\text{ Mbps} (approximately 156 MB/s156\text{ MB/s}).
Even if the `gp3` volume is provisioned to 500 MB/s500\text{ MB/s}, a `c5.xlarge` instance will throttle the storage traffic to 156 MB/s156\text{ MB/s} due to instance-level limitations.
3
Select a compatible EC2 instance type and size.
A `c5.9xlarge` instance supports a dedicated EBS bandwidth of 7,000 Mbps7,000\text{ Mbps} (approximately 875 MB/s875\text{ MB/s}), which is greater than the 500 MB/s500\text{ MB/s} (4,000 Mbps4,000\text{ Mbps}) requirement.
Upgrading the instance size is necessary to align the compute interface capability with the storage requirements.
4
Modify the EBS volume configuration.
Provision the `gp3` volume to deliver 500 MB/s500\text{ MB/s} of throughput.
This raises the volume performance limit to the target rate, which is now supported by the upgraded instance size.

Anahtar Kavram

EC2 instance-level EBS bandwidth limitations and gp3 throughput configuration
Soru 1163Soru →

A biotechnology company has an existing application running in a Production AWS account that writes sensitive genomic datasets to an Amazon S3 bucket located in a separate Compliance AWS account. The S3 bucket currently encrypts data at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). To satisfy new regulatory audits, the company must enhance its data protection posture. All datasets must be encrypted at rest using a Customer Managed Key (CMK) with automatic annual rotation enabled. Furthermore, all key usage for decryption must be auditable, and the application in the Production account must be able to perform these operations securely. Which configuration should a solutions architect implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a symmetric Customer Managed Key (CMK) in the Compliance account. Configure the CMK's key policy in the Compliance account to grant the Production account's application IAM role permissions for the kms:GenerateDataKey and kms:Decrypt actions. Grant the Production account's application IAM role permissions to perform the same actions on the CMK in its local IAM policy. Configure the S3 bucket in the Compliance account to use this CMK as the default encryption key.

Cevap

Create a symmetric Customer Managed Key (CMK) in the Compliance account, configure the CMK's key policy to trust the Production account's application IAM role, grant corresponding local IAM permissions in the Production account, and configure the S3 bucket default encryption to use this CMK.
Creating a symmetric Customer Managed Key (CMK) in the destination (Compliance) account allows the key owner to manage the key's policy, enabling secure cross-account delegation. The key policy must explicitly trust the external (Production) account's IAM role for KMS cryptographic operations (kms:GenerateDataKey and kms:Decrypt). In addition, the caller's IAM policy in the Production account must also grant permission to use the external CMK. Enabling default bucket encryption on the S3 bucket with this CMK ensures all new objects are encrypted automatically, and key access logs in CloudTrail provide the required auditing.

Adım Adım Çözüm

1
Create a Customer Managed Key (CMK) in the Compliance account.
A KMS key is generated whose policy can be fully customized by the administrator.
Unlike AWS-managed keys, CMKs support custom key policies that can be configured to delegate access to external AWS accounts.
2
Configure the CMK key policy in the Compliance account and the application's IAM policy in the Production account.
The application role is authorized to perform cryptographic operations (kms:GenerateDataKey, kms:Decrypt) using the Compliance account's CMK.
Cross-account access in AWS KMS requires trust to be configured on both sides: the key policy must grant permissions to the external principal, and the external principal's IAM policy must grant permissions to use the key.
3
Configure the S3 bucket default encryption to use the newly created CMK.
All new objects written to the S3 bucket are automatically encrypted using the Customer Managed Key.
Enabling S3 default encryption ensures compliance without requiring the application to explicitly define encryption parameters on every upload request.

Anahtar Kavram

Cross-account AWS KMS key sharing requires two-way authorization: a key policy update in the hosting account to delegate access, and an IAM policy update in the calling account to allow usage. AWS-managed keys cannot be shared cross-account because their key policies cannot be modified.
Tahmini Süre:2m 0s
Soru 1164Soru →

A digital health enterprise operates a remote patient monitoring platform. The platform ingests real-time physiological telemetry from thousands of medical devices. The telemetry ingestion service writes updates to a `patient_vitals` table in an Amazon RDS for PostgreSQL DB instance configured as a Multi-AZ deployment. The web portal for clinicians frequently queries this table to retrieve the active connection status and the most recent vital signs of patients.

During peak morning hours, the database experiences CPU utilization exceeding 92%92\% and a high rate of connection timeouts, which stalls telemetry updates. A performance audit reveals that the clinicians' portal generates thousands of repetitive read queries per second for the same patient connection status records. The telemetry updates require high write throughput and must be persisted. The active connection status reads demand sub-millisecond response times and must remain highly available with automatic failover capabilities.

Which combination of actions should the Solutions Architect take to resolve the database performance bottleneck while meeting the requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled to store patient connection status, and modify the application to implement a cache-aside strategy.; Deploy Amazon RDS Proxy between the ingestion service and the RDS DB instance, configuring the application to connect to the proxy endpoint.

Cevap

To resolve the performance bottleneck and meet the requirements, the Solutions Architect must deploy an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled to cache read-heavy connection status queries, and deploy Amazon RDS Proxy to pool database connections from the telemetry ingestion backend.
The correct strategy requires deploying an Amazon ElastiCache for Redis cluster with Multi-AZ and automatic failover enabled. Redis is necessary because the scenario demands high availability and automatic failover for cached data, features not supported by Memcached. Additionally, deploying Amazon RDS Proxy pools database connections, which directly mitigates the high CPU utilization and connection timeouts caused by the ingestion backend's connection overhead.

Adım Adım Çözüm

1
Analyze the database workload components.
Identified two primary bottlenecks: connection overhead from the ingestion service causing high CPU, and high-frequency repetitive read queries for patient connection status.
Resolving a database performance issue requires addressing both the connection management bottleneck and offloading the read queries.
2
Evaluate caching alternatives for the read-heavy connection status.
Selected Amazon ElastiCache for Redis instead of Memcached because the platform requires Multi-AZ high availability, replication, and automatic failover.
Memcached does not support replication or automatic failover, making Redis the only valid cache engine that satisfies the high availability constraint.
3
Implement a caching strategy for the read queries.
Configure a cache-aside pattern where the application reads status from the Redis cluster first, writing to the cache only on a miss.
Cache-aside reduces read latency to sub-milliseconds and offloads read queries from the RDS DB instance.
4
Address the ingestion backend connection overhead.
Deploy Amazon RDS Proxy between the application and the RDS DB instance.
RDS Proxy pools database connections, preventing the CPU exhaustion caused by the telemetry ingestion service repeatedly opening and closing database connections.

Anahtar Kavram

Selecting ElastiCache for Redis over Memcached for replication and high availability, and utilizing RDS Proxy to resolve CPU exhaustion from connection pooling issues.
Soru 1165Soru →

An enterprise uses AWS CloudFormation StackSets to deploy a baseline security configuration—consisting of an Amazon S3 bucket for security logging and AWS Systems Manager State Manager associations to enforce security agent installation on EC2 instances—across all member accounts in an AWS Organization. The baseline StackSet is deployed from a delegated administrator DevOps account. The S3 logging bucket in each member account must be encrypted using a Customer Managed Key (CMK) managed by the central security team in a dedicated Security account.

During an audit, the security team identifies that some member accounts have configuration drift: local administrators have detached the State Manager associations or manually altered the S3 bucket policies to allow external access, which went undetected. Additionally, recent deployments of the baseline StackSet to new member accounts are failing during the S3 bucket creation step with an Access Denied error.

Which two actions should a Solutions Architect take to resolve the deployment failure and automatically detect and remediate the configuration drift? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the central Security account, update the key policy of the Customer Managed Key to grant the member accounts' StackSet execution roles (AWSCloudFormationStackSetExecutionRole) permissions for kms:DescribeKey, kms:GenerateDataKey*, and kms:Decrypt operations. In the member accounts, ensure the StackSet execution role has IAM permissions to access the Security account's KMS key ARN.; Enable drift detection on the CloudFormation StackSet. Create an Amazon EventBridge rule in the delegated administrator DevOps account that triggers when a StackSet drift status changes to DRIFTED, and invokes an AWS Systems Manager Automation workflow to execute the UpdateStackInstances API targeting the drifted account and region to redeploy the baseline template.

Cevap

Update the key policy of the central Customer Managed Key in the Security account to grant the member accounts' StackSet execution roles the necessary KMS permissions, ensure the execution roles have matching IAM permissions, and enable StackSet drift detection integrated with an Amazon EventBridge rule and Systems Manager Automation workflow to trigger stack instance updates.
Resolving the cross-account StackSet deployment failure requires configuring explicit trust on the KMS Customer Managed Key in the Security account to permit the member accounts' execution roles to perform cryptographic operations, backed by local IAM permissions. To automatically detect and remediate drift, enabling StackSet drift detection generates EventBridge events. An EventBridge rule can then trigger a Systems Manager Automation workflow that updates the stack instances in the affected account and region, effectively overwriting manual changes and aligning them back to the baseline.

Adım Adım Çözüm

1
Diagnose the S3 bucket creation Access Denied error.
Identify that the baseline template tries to encrypt S3 buckets using a cross-account Customer Managed Key (CMK) without appropriate permissions delegated on both the key policy and IAM sides.
AWS KMS cross-account operations require explicit permission grants in the key policy of the owning account and the IAM policy of the calling account.
2
Establish proper cross-account KMS permissions.
Update the CMK key policy in the Security account to grant access to the StackSet execution role (AWSCloudFormationStackSetExecutionRole) in the member accounts, and configure matching IAM policies for those roles.
This allows the CloudFormation stack execution process in the member accounts to successfully generate data keys and encrypt the S3 buckets during stack deployment.
3
Implement a drift detection mechanism.
Enable drift detection on the baseline CloudFormation StackSet.
Drift detection identifies when local administrators modify stack-managed resources, such as altering S3 bucket policies or deleting Systems Manager associations.
4
Automate drift remediation.
Create an Amazon EventBridge rule that detects the StackSet drift status change to DRIFTED and triggers a Systems Manager Automation document that runs the UpdateStackInstances API against the drifted account and region.
This automatically redeploys the baseline template, overwriting any unauthorized modifications and restoring compliance.

Anahtar Kavram

Cross-account AWS KMS key management and automated CloudFormation StackSet drift detection and remediation using Amazon EventBridge and AWS Systems Manager Automation.
Soru 1166Soru →

A logistics company utilizes a multi-account AWS environment managed by AWS Organizations to host its supply chain applications. Database backups of Amazon Aurora PostgreSQL clusters in the member accounts are managed by AWS Backup. To meet strict compliance and data protection guidelines, the security team requires all database backups to be copied daily to a central, isolated disaster recovery (DR) AWS account.

During implementation, the solutions architect notes that the cross-account backup copies are failing. The Aurora clusters in the member accounts are currently encrypted using default AWS-managed keys (aws/rds). The destination backup vault in the DR account is also encrypted using the default AWS-managed key (aws/backup).

Which combination of actions will resolve the copy failures and satisfy the security requirements?

Cevabı ve açıklamayı göster

Cevap: Re-encrypt the source Aurora clusters in the member accounts using customer managed keys (CMKs). Create a destination backup vault in the DR account encrypted with a customer managed key (CMK). Configure the destination backup vault policy to allow the member accounts to perform the backup:CopyIntoBackupVault action, and modify the destination CMK key policy to grant the member accounts permissions for cryptographic operations.

Cevap

Re-encrypt the source Aurora clusters in the member accounts using customer managed keys (CMKs). Create a destination backup vault in the DR account encrypted with a customer managed key (CMK). Configure the destination backup vault policy to allow the member accounts to perform the backup:CopyIntoBackupVault action, and modify the destination CMK key policy to grant the member accounts permissions for cryptographic operations.
To successfully copy AWS Backup snapshots across accounts, both the source and target resources must be encrypted using customer managed keys (CMKs). AWS-managed keys (like aws/rds or aws/backup) cannot be shared across accounts because their key policies are managed by AWS and cannot be modified. Additionally, the destination backup vault's access policy must explicitly allow the member accounts or organization to perform the backup:CopyIntoBackupVault operation, and the destination CMK key policy must grant permissions to the source accounts' roles to perform cryptographic operations for re-encryption.

Adım Adım Çözüm

1
Migrate the database encryption to Customer Managed Keys (CMKs) in the member accounts.
The Aurora database clusters and their generated snapshots will be encrypted with CMKs rather than the default aws/rds managed key.
AWS Backup does not support copying backups encrypted with AWS-managed keys across accounts. The source backups must be encrypted with a key whose policy can be modified to grant cross-account access.
2
Create a Customer Managed Key (CMK) in the disaster recovery (DR) account and associate it with a new destination backup vault.
A destination vault is created that is encrypted with a key whose policy can be customized.
During cross-account backup copies, AWS Backup must re-encrypt the snapshot at the destination. The destination key policy must be configurable to allow access to the source account roles.
3
Configure the key policy of the destination CMK in the DR account to allow AWS Backup roles from member accounts to perform KMS actions.
The source roles receive cryptographic permissions (kms:GenerateDataKey, kms:Decrypt, kms:CreateGrant) on the destination key.
Without KMS permissions, AWS Backup in the member accounts cannot encrypt the copied recovery point with the destination key.
4
Update the destination backup vault access policy to permit the member accounts to copy backups.
Allows the backup:CopyIntoBackupVault action from member accounts or the AWS Organization principal.
By default, backup vaults are private. The destination vault policy must explicitly allow cross-account copies from authorized sources.

Anahtar Kavram

AWS Backup cross-account copy operations require that both the source resources and the destination backup vault are encrypted with Customer Managed Keys (CMKs) since AWS-managed key policies cannot be modified to grant cross-account permissions.
Soru 1167Soru →

A financial services company hosts a high-frequency trading analysis platform on Amazon EC2 in VPC A (us-east-1). The platform frequently queries a large transactional database running on EC2 in VPC B (us-east-1), retrieving large datasets. Both VPCs are connected via an AWS Transit Gateway. During peak times, the network latency between VPC A and VPC B increases, and the database query responses are throttled due to the 8500-byte Maximum Transmission Unit (MTU) limit and the extra network hop introduced by the Transit Gateway. The company requires a solution that minimizes network latency and maximizes throughput between these two VPCs. Which of the following actions should the Solutions Architect take to optimize the network performance?

Cevabı ve açıklamayı göster

Cevap: Establish a VPC Peering connection between VPC A and VPC B, update the route tables of both VPCs to route the inter-VPC traffic through the peering connection, and configure the EC2 instances to use jumbo frames with a 9001-byte MTU.

Cevap

Establish a VPC Peering connection between VPC A and VPC B, update the route tables of both VPCs to route the inter-VPC traffic through the peering connection, and configure the EC2 instances to use jumbo frames with a 9001-byte MTU.
The correct solution uses VPC Peering within the same region to establish a direct connection between VPC A and VPC B. Unlike AWS Transit Gateway, which has an MTU limit of 8500 bytes and introduces an additional routing hop, VPC Peering supports jumbo frames with an MTU up to 9001 bytes and routes traffic directly between instances, minimizing latency and maximizing single-stream throughput.

Adım Adım Çözüm

1
Analyze the source of latency and throughput constraints.
The current path using AWS Transit Gateway introduces an extra network hop (adding latency) and caps the MTU at 8500 bytes.
Understanding the limitations of the existing Transit Gateway architecture helps identify the correct optimization strategy.
2
Evaluate VPC Peering as a low-latency alternative.
VPC Peering within the same region provides a direct connection without extra hops, supports jumbo frames (up to 9001-byte MTU), and does not incur Transit Gateway data processing costs.
Replacing Transit Gateway with VPC Peering directly addresses both the latency hop and the MTU constraint.
3
Configure routing and MTU settings.
Create a VPC Peering connection, update VPC route tables to point inter-VPC CIDRs to the peering connection, and set the MTU on the EC2 instances to 9001 bytes.
This establishes the physical path and ensures the instances take advantage of the larger frame size to maximize throughput.

Anahtar Kavram

VPC Peering for latency and throughput optimization
Soru 1168Soru →

An enterprise runs a critical microservices application deployed on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in an AWS Organizations organization. The application is configured to write logs directly to dynamically named, hourly files based on a timestamp pattern (for example, `/var/log/microservice/api-2026-07-16-11.log`). The company wants to implement continuous, real-time log collection using the unified Amazon CloudWatch agent installed on the instances. The log streams are then forwarded from CloudWatch Logs via subscription filters to Amazon Kinesis Data Firehose in each member account, which must deliver the logs to a centralized Amazon S3 bucket in a dedicated logging account. A Solutions Architect observes two issues: 1. Log delivery stops after the first hour of instance execution, and logs in the newly generated files are not sent to CloudWatch Logs. 2. Even when logs are written to CloudWatch Logs, Kinesis Data Firehose is unable to deliver them to the centralized S3 bucket, resulting in delivery failures. Which combination of actions will resolve the logging issues and ensure continuous, centralized log delivery?

Cevabı ve açıklamayı göster

Cevap: Configure the CloudWatch agent's `file_path` as `/var/log/microservice/api-*.log` to match the dynamically generated log files. Update the centralized S3 bucket policy to grant `s3:PutObject` permissions to the Kinesis Data Firehose IAM roles in the member accounts, using the `aws:PrincipalOrgID` condition to restrict access to the organization.

Cevap

Configure the CloudWatch agent to use the wildcard path to match dynamically named hourly files, and update the centralized S3 bucket policy to grant write permissions to the cross-account Firehose roles restricted by the organization ID.
The correct configuration uses a wildcard pattern to capture dynamically generated log files on the instances and applies a resource-based policy to the centralized S3 bucket to allow Kinesis Data Firehose in member accounts to upload logs, restricted to the organization ID.

Adım Adım Çözüm

1
Change the `file_path` in the CloudWatch agent configuration from a static path to a wildcard pattern matching the hourly timestamp suffix.
The CloudWatch agent successfully monitors and collects logs from dynamically created hourly log files.
Because the application creates new files with timestamp suffixes hourly, a static path would only collect logs from the initial file and miss all subsequent logs.
2
Modify the centralized S3 bucket policy in the logging account to permit `s3:PutObject` operations from the Kinesis Data Firehose execution roles of the member accounts.
Kinesis Data Firehose is authorized to write log objects into the centralized S3 bucket.
Cross-account access to S3 resources requires the bucket owner to explicitly grant access in the bucket policy; user policies in the source account are not sufficient by themselves.
3
Add an `aws:PrincipalOrgID` condition to the centralized S3 bucket policy's statement.
Log writes are restricted to only member accounts within the AWS Organization, enforcing security best practices.
This ensures that only authorized accounts belonging to the organization can deliver logs to the centralized bucket.

Anahtar Kavram

Configuring unified CloudWatch agent wildcards for dynamic application log files and establishing cross-account S3 bucket policies for Kinesis Data Firehose centralization.
Soru 1169Soru →

An enterprise plans to migrate its on-premises customer portal to AWS. The application consists of a .NET web application running on Windows Server IIS VMs, a backend Microsoft SQL Server database, and a legacy compliance reporting server that relies on proprietary physical USB hardware keys connected to physical on-premises servers.

To align with their cloud migration goals, the enterprise establishes the following requirements:
* The .NET web application should be migrated to a managed platform to reduce OS patching and administration overhead, without modifying the application code.
* The Microsoft SQL Server database must be migrated to Amazon Aurora PostgreSQL to eliminate commercial licensing costs, which requires converting the database schema and rewriting legacy database queries.
* The compliance reporting server must continue running in its current environment due to the physical hardware dependencies.

Which combination of migration strategies from the 7 Rs framework should the Solutions Architect select for these components?

Cevabı ve açıklamayı göster

Cevap: Replatform the web application to AWS Elastic Beanstalk, Refactor (Re-architect) the database to Amazon Aurora PostgreSQL, and Retain the compliance reporting server on-premises.

Cevap

Replatform the web application to AWS Elastic Beanstalk, Refactor (Re-architect) the database to Amazon Aurora PostgreSQL, and Retain the compliance reporting server on-premises.
The correct option correctly maps the three components to their respective 7 Rs strategies. Moving the web application to AWS Elastic Beanstalk is a Replatform strategy because it shifts the runtime to a managed environment without modifying the code. Migrating the SQL Server database to Aurora PostgreSQL is a Refactor strategy because it involves changing database engines, using schema conversion tools, and rewriting application queries. Keeping the compliance reporting server on-premises due to physical USB hardware key requirements is a Retain strategy.

Adım Adım Çözüm

1
Analyze the migration requirements for the .NET web application.
Since the web application needs to move to a managed platform to reduce administrative and patching overhead without application code changes, the appropriate strategy is Replatform (specifically using AWS Elastic Beanstalk).
Replatforming optimizes the environment by using a managed service without changing the core application code or architecture.
2
Analyze the migration requirements for the Microsoft SQL Server database.
Migrating from SQL Server to Amazon Aurora PostgreSQL requires schema conversion and rewriting SQL queries due to the engine change. This level of modification qualifies as a Refactor (Re-architect) strategy.
Changing the database engine and rewriting application code/queries to support the new database engine represents a significant architectural change (Refactoring).
3
Analyze the migration requirements for the compliance reporting server.
The server relies on physical proprietary USB hardware keys that cannot be moved to the cloud, meaning it must stay in its current physical environment, which is a Retain strategy.
Retain is used for applications that cannot be migrated to the cloud due to technical, licensing, or hardware constraints.

Anahtar Kavram

Identifying correct 7 Rs migration strategies (Rehost, Replatform, Refactor, Retain, Retire, Relocate, Re-platform) based on workload requirements, technical constraints, and code modification needs.
Tahmini Süre:2m 0s
Soru 1170Soru →

A company operates a critical inventory management application in the us-west-2 Region across three Availability Zones. The database layer is an Amazon Aurora MySQL database cluster. To meet new compliance standards, the company needs to establish a disaster recovery site in the us-east-1 Region with a Recovery Point Objective (RPO) of under 55 minutes and a Recovery Time Objective (RTO) of under 2020 minutes. Additionally, internal administrative tools running in VPCs across both regions must be able to resolve the database cluster's endpoints privately. Which of the following strategies should a solutions architect recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Implement Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Create a Route 5353 Private Hosted Zone for database endpoint resolution, associate the zone with the VPCs in both regions, and use Route 5353 Application Recovery Controller routing controls to manage failover.

Cevap

Implement Amazon Aurora Global Database with the primary cluster in us-west-2 and a secondary cluster in us-east-1. Create a Route 5353 Private Hosted Zone for database endpoint resolution, associate the zone with the VPCs in both regions, and use Route 5353 Application Recovery Controller routing controls to manage failover.
Implementing Amazon Aurora Global Database ensures physical replication latency is typically under a second, meeting the 55-minute RPO. Promoting the secondary region takes less than a minute, satisfying the 2020-minute RTO. Associating the Route 5353 Private Hosted Zone (PHZ) with the VPCs in both regions ensures private DNS resolution works natively in both regions. Route 5353 Application Recovery Controller (ARC) routing controls allow for safe, structured regional failover management.

Adım Adım Çözüm

1
Select a cross-region replication strategy that supports sub-minute RPO and minimal RTO.
Amazon Aurora Global Database provides sub-second replication latency, meeting the 55-minute RPO and 2020-minute RTO requirements.
Traditional backup restore or read-replica promotion strategies may fail to guarantee the low RPO/RTO thresholds under disaster recovery conditions.
2
Ensure internal DNS resolution is secure and private across both regions.
Create a Route 5353 Private Hosted Zone (PHZ) and associate it with both the us-west-2 and us-east-1 VPCs.
VPC peering does not transitively allow DNS resolution of a PHZ unless the PHZ is explicitly associated with all consuming VPCs.
3
Configure a highly reliable, controlled failover mechanism.
Use Route 5353 Application Recovery Controller (ARC) routing controls to fail over the database cluster.
Relying on DNS failover without health checks or active routing controls prevents reliable detection and promotion of the secondary cluster during an outage.

Anahtar Kavram

Disaster recovery design with multi-region database replication and private DNS resolution
Tahmini Süre:2m 0s
Soru 1171Soru →

An enterprise is planning to migrate a legacy on-premises web application to AWS. The application currently uses an on-premises Oracle database. To reduce licensing costs, the solutions architect decides to migrate the database to Amazon Aurora PostgreSQL. This change will require converting the schema and rewriting several database queries in the application.

Which migration strategy from the 7 Rs framework is being applied to the database?

Cevabı ve açıklamayı göster

Cevap: Refactoring (Re-architecting)

Cevap

Refactoring (Re-architecting) is the correct migration strategy because migrating from an on-premises Oracle database to Amazon Aurora PostgreSQL requires schema conversion and code refactoring to adapt to the new database engine.
Refactoring (Re-architecting) is correct because converting the database engine from Oracle to Amazon Aurora PostgreSQL is a heterogeneous database migration that requires database schema conversion and application code modifications (e.g., rewriting SQL queries). This is a core characteristic of Refactoring.

Adım Adım Çözüm

1
Identify the source database engine and target database engine.
The source is Oracle (commercial) and the target is Amazon Aurora PostgreSQL (open-source compatible). This is a heterogeneous database migration.
Understanding the nature of the database change helps determine the extent of modification needed.
2
Determine if the application code or schema must change.
Yes, migrating across different database engines requires schema conversion and rewriting SQL queries in the application code.
Changing the database engine breaks direct compatibility, requiring modifications to both the schema and code.
3
Map the required changes to the AWS 7 Rs migration framework.
Since significant modification to the database schema and application code is required to support the new engine, the strategy is classified as Refactoring (Re-architecting).
Refactoring is defined by modifications to the application code or database schema to leverage cloud-native features and platforms.

Anahtar Kavram

Heterogeneous database migrations (e.g., Oracle to Aurora PostgreSQL) require refactoring because they involve schema conversion and application modifications.
Soru 1172Soru →

A company runs a batch processing application on Amazon EC2 instances located in private subnets within a VPC in the `us-east-1` Region. The application downloads 15 TB15\text{ TB} of data monthly from an Amazon S3 bucket located in the same Region. Currently, all outbound traffic from the private subnets is routed through a NAT Gateway, which results in significant NAT Gateway data processing charges. The company wants to eliminate these data processing charges for the Amazon S3 traffic while maintaining the existing subnet architecture. Which network configuration change is the most cost-effective solution?

Cevabı ve açıklamayı göster

Cevap: Configure a VPC gateway endpoint for Amazon S3 and associate it with the route tables of the private subnets.

Cevap

Configure a VPC gateway endpoint for Amazon S3 and associate it with the route tables of the private subnets.
Configuring a VPC gateway endpoint for Amazon S3 is the most cost-effective solution. Gateway endpoints are provided at no additional cost (no hourly or data processing charges) and allow instances in private subnets to securely connect to S3 within the same Region, completely bypassing the NAT Gateway and eliminating its data processing charges.

Adım Adım Çözüm

1
Analyze the source of the high cost.
The application downloads 15 TB15\text{ TB} of data from Amazon S3 through a NAT Gateway, which incurs data processing charges of $0.045\$0.045 per GB in the `us-east-1` Region.
Before optimizing, you must identify which component is generating the data processing charges.
2
Identify the most cost-effective private routing mechanism to Amazon S3.
A VPC gateway endpoint for Amazon S3 is a free routing destination that does not charge for data transfer or data processing.
Gateway endpoints allow private routing to S3 within the same Region without passing traffic through a NAT Gateway.
3
Configure the VPC route tables to utilize the gateway endpoint.
Traffic destined for S3 will bypass the NAT Gateway, eliminating the NAT Gateway data processing charges.
Updating the route tables ensures that traffic to S3 is directed to the gateway endpoint instead of the NAT Gateway.

Anahtar Kavram

Bypassing NAT Gateway data processing costs for Amazon S3 traffic by utilizing free VPC Gateway Endpoints.
Soru 1173Soru →

An energy management company operates a critical power-grid monitoring application on a fleet of Amazon EC2 instances across multiple AWS accounts managed by AWS Organizations. The application logs are written to `/opt/app/logs/grid-metrics.log` and are rotated hourly by a custom script into the same directory as `/opt/app/logs/grid-metrics-YYYY-MM-DD-HH.log`. After 24 hours, the rotated logs are compressed to `/opt/app/logs/grid-metrics-YYYY-MM-DD-HH.log.gz`. The company needs to centralize these logs into an Amazon S3 bucket in a dedicated security account with minimal latency, ensuring no logs are lost during rotation, and compressed files are not duplicated or corrupted during ingestion. Which configuration strategy achieves this with the highest operational efficiency and least administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Install the CloudWatch agent on the EC2 instances, and configure the file path `/opt/app/logs/grid-metrics*.log` to collect active and uncompressed rotated logs. In the central security account, create an Amazon Kinesis Data Firehose delivery stream pointing to the destination Amazon S3 bucket, and establish a CloudWatch Logs destination with an access policy that allows the source accounts to write to it. In the source accounts, configure CloudWatch Logs subscription filters to forward the collected log events to the central destination.

Cevap

The correct strategy is to install the CloudWatch agent using the file path pattern `/opt/app/logs/grid-metrics*.log` to match active and rotated uncompressed logs while ignoring compressed files, and streaming them to a central security account's Kinesis Data Firehose via CloudWatch Logs subscription filters.
The configuration utilizing the file path pattern `/opt/app/logs/grid-metrics*.log` correctly matches both the active log and the uncompressed hourly rotated logs, while ignoring the compressed archives ending in `.gz`. Forwarding these logs through CloudWatch subscription filters to a central Kinesis Data Firehose delivery stream represents a highly scalable, real-time, managed architecture that complies with operational excellence principles. It avoids the need for custom scripts, cron jobs, and direct S3 bucket permissions on the EC2 instances.

Adım Adım Çözüm

1
Select the log path pattern for the CloudWatch agent that matches uncompressed active and rotated logs.
Using the file path `/opt/app/logs/grid-metrics*.log` successfully targets both the active `grid-metrics.log` and the uncompressed rotated `grid-metrics-YYYY-MM-DD-HH.log` files, but excludes compressed `.gz` archives.
This prevents duplicate ingestion and corruption that would occur if the agent attempted to read compressed binary data as text.
2
Design the centralized destination in the security account.
An Amazon Kinesis Data Firehose delivery stream backed by the S3 bucket is established, and a CloudWatch Logs destination points to this Firehose stream.
Kinesis Data Firehose provides real-time streaming and buffered writes to S3, while the CloudWatch Logs destination acts as an ingestion endpoint.
3
Set up cross-account access and log subscription filters.
The CloudWatch Logs destination policy is configured to trust the source Organization accounts, and subscription filters in the source accounts are pointed to the destination.
This allows native, secure, and low-latency forwarding of log events directly to the centralized storage without exposing direct S3 access to EC2 instances.

Anahtar Kavram

Log rotation handling in CloudWatch agent configuration combined with cross-account subscription filters for centralized log aggregation.
Soru 1174Soru →

An enterprise financial portal hosts its application on Amazon EC2 instances inside an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The portal utilizes an Amazon RDS for PostgreSQL database for order transactions and query retrieval. During market opening daily, traffic surges by a factor of 1515 within less than 22 minutes. During these spikes, users encounter HTTP 503 Service Unavailable and HTTP 504 Gateway Timeout errors. Performance logs reveal the following:

1. Database read queries spike, leading to CPU exhaustion on the DB instance and connection pool exhaustion on the EC2 instances.
2. The ALB drops connections immediately at the start of the traffic surge.
3. The ASG launches new instances to scale out, but before these instances finish bootstrapping, the ASG launches additional instances, leading to compute resource thrashing.

Which TWO actions should the Solutions Architect take to resolve these performance issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Migrate the database to Amazon Aurora PostgreSQL, configure Aurora Replicas, and modify the application to send read queries to the reader endpoint.; Request AWS Support to pre-warm the Application Load Balancer, and increase the Auto Scaling group cooldown and warm-up periods to exceed the instance bootstrapping duration.

Cevap

Migrate the database to Amazon Aurora PostgreSQL to route reads to the reader endpoint, request AWS Support to pre-warm the Application Load Balancer, and increase the Auto Scaling group cooldown and warm-up periods to exceed the bootstrapping duration.
Migrating to Amazon Aurora PostgreSQL and leveraging Aurora Replicas resolves the database read-capacity bottleneck. Pre-warming the ALB ensures it is prepared for instantaneous traffic spikes, while increasing the ASG cooldown and warm-up periods prevents scaling thrashing by ensuring the scaling engine waits for launched instances to fully bootstrap before initiating further scale-out actions.

Adım Adım Çözüm

1
Address read-traffic database bottlenecks by migrating to an engine that supports read-scaling.
Migrating RDS PostgreSQL to Aurora PostgreSQL allows routing query reads to Aurora Replicas via the reader endpoint, freeing capacity on the primary writer.
Standard RDS PostgreSQL Multi-AZ standbys cannot serve queries, whereas Aurora Replicas actively serve reads and mitigate CPU/connection pool exhaustion.
2
Mitigate immediate connection failures at the load balancer tier during flash traffic.
Requesting ALB pre-warming from AWS Support guarantees the load balancer has sufficient capacity provisioned before the sudden traffic spike occurs.
Automatic ALB scaling is too slow for 15x traffic surges within a 2-minute window.
3
Adjust the compute tier scaling configurations to prevent instance thrashing.
Configure the ASG cooldown and warm-up periods to be longer than the bootstrapping time of the EC2 instances.
This prevents the ASG from evaluating metric alarms and scaling out prematurely while newly launched instances are still initializing.

Anahtar Kavram

Optimizing Compute and Storage Performance
Tahmini Süre:3m 0s
Soru 1175Soru →

A multinational logistics company collects shipping manifests containing customer PII in regional business unit AWS accounts. These manifests are uploaded to a centralized Amazon S3 bucket in a dedicated Data Archive AWS account under AWS Organizations. Currently, the bucket uses default server-side encryption with the AWS managed key (aws/s3).

The security team mandates that the architecture be enhanced to meet these compliance requirements:
1. All archived data must be encrypted with a key that supports automatic rotation and allows immediate revocation.
2. Regional accounts must be prevented from uploading objects unless they are encrypted using this specific key.
3. No local administrators in the Data Archive account should be able to disable encryption, delete the key, or alter these bucket access rules.

Which combination of actions will meet these requirements with the least operational complexity?

Cevabı ve açıklamayı göster

Cevap: Create a customer managed KMS key in the Data Archive account with automatic rotation enabled. Set the key policy to grant kms:GenerateDataKey and kms:Decrypt permissions to the IAM roles in the regional accounts. Update the S3 bucket to use this key for default encryption. Configure an S3 bucket policy that denies s3:PutObject if the s3:x-amz-server-side-encryption-aws-kms-key-id condition does not match the customer managed key ARN. Apply an SCP at the Organization root that denies kms:PutKeyPolicy, kms:ScheduleKeyDeletion, s3:PutEncryptionConfiguration, and s3:PutBucketPolicy actions in the Data Archive account unless the principal is the central administration role.

Cevap

Create a customer managed KMS key, configure its policy to allow the regional accounts to perform key operations, set S3 bucket default encryption to use it, apply a bucket policy denying uploads that do not use this specific key ARN, and attach an SCP restricting S3 policy and KMS key configuration changes to the central administrative role.
The correct solution involves creating a Customer Managed Key (CMK) to allow key policy modification for cross-account access and enable automatic key rotation. The S3 bucket policy must restrict uploads to only this specific key by using the s3:x-amz-server-side-encryption-aws-kms-key-id condition key. To enforce compliance and prevent local administrators in the Data Archive account from disabling encryption, modifying policies, or deleting the key, an SCP must be applied at the Organization level to deny those operations.

Adım Adım Çözüm

1
Select the correct KMS key type for the requirements.
Choose a customer managed KMS key (CMK) instead of the AWS managed key (aws/s3) because AWS managed keys do not support policy modification or rotation management for cross-account access.
Compliance requires immediate revocation and automatic rotation, which are only configurable on customer managed KMS keys, and cross-account access requires modifying the KMS key policy.
2
Configure permissions for regional accounts to write to the central bucket.
Update the KMS key policy in the Data Archive account to allow the IAM roles in the regional accounts to run kms:GenerateDataKey and kms:Decrypt. Ensure the regional accounts' IAM policies allow these actions.
For cross-account KMS-encrypted S3 uploads, the caller must have permissions on both the S3 bucket policy and the KMS key policy.
3
Enforce the use of the specific customer managed KMS key in S3.
Configure S3 default encryption to use the customer managed key, and add a bucket policy condition denying s3:PutObject if s3:x-amz-server-side-encryption-aws-kms-key-id does not match the key's ARN.
This guarantees that regional accounts cannot bypass the encryption rules by using another key (such as their own local KMS keys or the default aws/s3 key).
4
Implement governance boundaries to prevent policy drift and deletion.
Attach an SCP at the root of the organization that denies kms:PutKeyPolicy, kms:ScheduleKeyDeletion, s3:PutEncryptionConfiguration, and s3:PutBucketPolicy within the Data Archive account, except for the central administrative role.
SCPs act as fine-grained guardrails that restrict actions even for local administrators within member accounts, preventing configuration drift.

Anahtar Kavram

Cross-account S3 bucket access with custom KMS keys requires explicit configuration in both the S3 bucket policy and the KMS key policy. Enforcing a specific key is done using the s3:x-amz-server-side-encryption-aws-kms-key-id condition, while SCPs restrict policy changes and configuration drift for local administrators.
Soru 1176Soru →

An enterprise operates a critical inventory orchestration system across a multi-account AWS Organization. The compute tier runs on Amazon EC2 instances in private subnets in a primary Workload account VPC in the us-east-1 Region, spread across three Availability Zones. This tier processes messages and sends outbound API updates to external suppliers. The database tier is an Amazon Aurora MySQL DB cluster in the same VPC. The compute tier resolves the database endpoint using a Route 53 Private Hosted Zone (PHZ) (internal.inventory.local) hosted in a separate Shared Services account.

The company wants to enhance the disaster recovery (DR) posture by deploying a warm standby solution in us-west-2. The business requires a Recovery Point Objective (RPO) of under 1 minute and a Recovery Time Objective (RTO) of under 15 minutes. The outbound API connections must remain highly reliable and fault-tolerant during a regional outage.

Which combination of architectural modifications meets these requirements according to AWS best practices?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy the standby compute tier in a new VPC in us-west-2 across three Availability Zones, configuring a NAT Gateway in each Availability Zone for outbound supplier updates. Submit a VPC association authorization from the Shared Services account for the us-west-2 VPC, and associate the internal.inventory.local PHZ using the Workload account credentials. Use AWS Route 53 Application Recovery Controller routing controls to manage failover, promoting the secondary Aurora cluster to primary and redirecting application traffic.

Cevap

Configure an Amazon Aurora Global Database with cross-account Route 53 Private Hosted Zone association, redundant NAT Gateways across Availability Zones in the standby region, and AWS Route 53 Application Recovery Controller routing controls to manage failover.
The correct architecture uses Amazon Aurora Global Database for sub-second database replication, ensuring that the 1-minute RPO is met. Redundant NAT Gateways deployed across three Availability Zones ensure that there is no single point of failure for outbound API updates. The Route 53 Private Hosted Zone is correctly associated across accounts with the secondary VPC to allow database name resolution. Finally, Route 53 Application Recovery Controller routing controls orchestrate the failover process safely and within the 15-minute RTO.

Adım Adım Çözüm

1
Address the RPO requirement of under 1 minute by establishing cross-region database replication.
Amazon Aurora Global Database is configured, providing sub-second asynchronous replication from us-east-1 to us-west-2.
Traditional backup restore methods cannot meet the 1-minute RPO requirement, necessitating active database replication.
2
Address the high availability and reliability requirements for outbound connections in the standby region.
NAT Gateways are deployed in all three Availability Zones within the us-west-2 VPC.
Deploying a single NAT Gateway creates a single point of failure, violating the high-availability requirement for outbound supplier updates.
3
Set up private DNS resolution in the secondary region.
VPC association authorization is submitted from the Shared Services account and accepted in the Workload account, associating the private hosted zone with the us-west-2 VPC.
Route 53 Private Hosted Zones cannot resolve queries across VPCs in different regions over Transit Gateway without association or Route 53 Resolver endpoints.
4
Implement a failover mechanism that meets the RTO requirement of under 15 minutes.
Route 53 Application Recovery Controller routing controls are implemented to manage the application failover path and coordinate database promotion.
Standard Route 53 public health checks cannot query private VPC resources, and DNS failover alone does not promote the secondary Aurora cluster.

Anahtar Kavram

Disaster recovery failover orchestration using Aurora Global Database, redundant NAT Gateways, and cross-account Route 53 Private Hosted Zone associations.
Soru 1177Soru →

A company has a multi-account AWS environment managed via AWS Organizations. Application servers in a Production account write sensitive compliance logs to an Amazon S3 bucket located in a dedicated Security account. The security team wants to enhance data protection and ensure the logs are encrypted at rest using a customer managed key (CMK) with automated rotation, while allowing the Production account to write to the bucket. Which two actions should the solutions architect take to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the Security account, create a symmetric AWS KMS customer managed key, enable automatic key rotation, and configure the key policy to allow the Production account's IAM execution roles the kms:GenerateDataKey and kms:Decrypt actions.; In the Security account, configure the destination S3 bucket to use the newly created customer managed KMS key as the default encryption key, and configure the S3 bucket policy to allow the Production account's IAM execution roles to perform s3:PutObject actions.

Cevap

Create a symmetric AWS KMS customer managed key in the Security account with automatic rotation and a key policy allowing the Production account roles access, and configure the destination S3 bucket default encryption with this key along with a bucket policy allowing cross-account writes.
To implement secure cross-account logging with encryption, a customer managed key (CMK) must be created in the target Security account because AWS-managed keys cannot be shared across accounts. The CMK key policy must grant permissions to the Production account's execution roles so they can generate data keys to encrypt logs. Additionally, the S3 bucket default encryption must be configured to use this CMK, and the S3 bucket policy must allow the Production roles to write objects.

Adım Adım Çözüm

1
Provision a symmetric customer managed key (CMK) in the Security account.
A CMK is created which allows its key policy to be customized for cross-account usage.
AWS-managed KMS keys do not support policy modification and cannot be shared across AWS accounts.
2
Configure the key policy of the CMK and enable key rotation.
The Production account's IAM execution roles are granted permission to perform kms:GenerateDataKey and kms:Decrypt.
Enabling these permissions allows the cross-account servers to perform cryptographic operations required for writing encrypted files to S3.
3
Set up default encryption on the destination S3 bucket using the CMK, and configure the S3 bucket policy.
The S3 bucket enforces encryption via the CMK and grants cross-account write access to the Production roles.
This establishes a robust security posture where all uploaded logs are automatically encrypted with the compliant key and cross-account writes are permitted.

Anahtar Kavram

Cross-account resource sharing and data protection using customer managed KMS keys and resource policies.
Tahmini Süre:2m 0s
Soru 1178Soru →

A company runs a high-performance e-commerce platform on AWS. The web application tier runs on Amazon EC2 instances managed by an Auto Scaling group (ASG) behind an Application Load Balancer (ALB) across three Availability Zones (AZ−AAZ-A, AZ−BAZ-B, and AZ−CAZ-C). The EC2 instances are launched in private subnets, and all outbound traffic is routed through a single NAT Gateway located in AZ−AAZ-A.

During flash sale events, the platform experiences immediate traffic surges where request volume increases from 500 requests/sec500\text{ requests/sec} to over 150000 requests/sec150{}000\text{ requests/sec} within 2 minutes2\text{ minutes}. During these surges, the ALB returns HTTP 502 (Bad Gateway) and HTTP 504 (Gateway Timeout) errors. Furthermore, the EC2 instances require 8 minutes8\text{ minutes} to download application binaries and complete bootstrapping. Because the ASG is configured with a default cooldown period of 180 seconds180\text{ seconds}, the ASG launches a large number of redundant instances during scale-out, resulting in high costs and API rate-limiting from backend databases. Finally, during a recent power outage in AZ−AAZ-A, all outbound transactions failed, even though the instances in AZ−BAZ-B and AZ−CAZ-C remained healthy.

Which combination of architectural modifications will resolve the scaling, reliability, and fault tolerance issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy a NAT Gateway in each of the three Availability Zones (AZ−AAZ-A, AZ−BAZ-B, and AZ−CAZ-C) and configure the route table of each private subnet to route outbound traffic through the NAT Gateway in its respective Availability Zone.; Configure the Auto Scaling group default cooldown and dynamic scaling policy warmup periods to 600 seconds600\text{ seconds}, and request AWS Support to pre-warm the Application Load Balancer with the expected traffic profile before scheduled flash sale events.

Cevap

Deploying a dedicated NAT Gateway in each of the three Availability Zones, updating the route tables accordingly, increasing the Auto Scaling group cooldown and warmup periods to 600 seconds600\text{ seconds}, and requesting AWS Support to pre-warm the Application Load Balancer before the scheduled flash sale events.
Deploying a NAT Gateway in each Availability Zone ensures that a failure in one zone does not disrupt the outbound connectivity of instances in other healthy zones, providing high availability. Configuring the Auto Scaling group cooldown and warmup periods to 600 seconds600\text{ seconds} provides a sufficient window for the 8 minutes8\text{ minutes} required for custom AMI bootstrapping, preventing the launch of redundant instances. Finally, requesting ELB pre-warming from AWS Support prepares the Application Load Balancer to handle the sudden burst of 150000 requests/sec150{}000\text{ requests/sec} without dropping connections.

Adım Adım Çözüm

1
Analyze the fault tolerance issue regarding outbound traffic failures during Availability Zone A outage.
Identify that routing all private subnet traffic through a single NAT Gateway in AZ−AAZ-A creates a single point of failure. Deploying a dedicated NAT Gateway in each of the three Availability Zones (AZ−AAZ-A, AZ−BAZ-B, and AZ−CAZ-C) and updating subnet route tables ensures high availability and local zone isolation.
This guarantees that an outage in one zone does not impact the outbound internet access of instances running in other healthy zones.
2
Analyze the Application Load Balancer failures during sudden flash traffic surges.
Recognize that a rapid jump from 500 requests/sec500\text{ requests/sec} to 150000 requests/sec150{}000\text{ requests/sec} within 2 minutes2\text{ minutes} exceeds the default scaling rate of an Application Load Balancer. Pre-warming the Application Load Balancer via a request to AWS Support is required to pre-provision capacity before the scheduled event.
Without pre-warming, the Application Load Balancer cannot scale its load-balancing nodes quickly enough, resulting in dropped connections and HTTP 502/504 errors.
3
Analyze the Auto Scaling group redundant instance launching issue.
Compare the instance bootstrapping time (8 minutes8\text{ minutes} or 480 seconds480\text{ seconds}) against the default cooldown (180 seconds180\text{ seconds}). Because the cooldown is shorter than the boot time, the group initiates additional scaling actions before the newly launched instances start reporting metrics. Adjusting the cooldown and warmup periods to 600 seconds600\text{ seconds} resolves the scaling loop.
This allows newly launched instances sufficient time (8 minutes8\text{ minutes} to boot plus buffer) to start handling load and lower the metric average before the Auto Scaling group evaluates further scaling activities.

Anahtar Kavram

Ensuring high availability and correct scaling behaviors by deploying redundant NAT Gateways per Availability Zone, aligning Auto Scaling cooldown periods with instance boot times, and pre-warming Application Load Balancers for massive flash traffic spikes.
Soru 1179Soru →

A global maritime logistics enterprise operates its vessel tracking and telemetry ingestion system in the AWS Cloud. The ingestion workload runs on Amazon EC2 instances deployed in private subnets across three Availability Zones (us−east−1aus-east-1a, us−east−1bus-east-1b, and us−east−1cus-east-1c) in a Production VPC. The EC2 instances must frequently query a high-performance mapping and routing API hosted in a Shared Services VPC in the same region, which is resolved via an Amazon Route 53 Private Hosted Zone (PHZ) named `internal.logistics.aws` managed in a Central Network AWS account.

During peak operation windows, the operations team identifies multiple network performance issues:
- Telemetry ingestion experiences intermittent packet drops and latency spikes when downloading ocean-weather data from external public API endpoints. Currently, all private subnets route outbound traffic (0.0.0.0/00.0.0.0/0) through a single NAT Gateway located in us−east−1aus-east-1a.
- High-frequency queries to the mapping API in the Shared Services VPC experience throughput limitations of 50 Gbps50\text{ Gbps} and latency overhead due to routing through an AWS Transit Gateway.
- EC2 instances in the Production VPC occasionally fail to resolve `internal.logistics.aws` or resolve it to its public endpoint instead of the internal Network Load Balancer (NLB) IP address, leading to routing over the public internet.

The enterprise requires a highly available network architecture that optimizes inter-VPC throughput, minimizes latency, removes egress bottlenecks, and ensures correct internal DNS resolution.

Which of the following optimization strategies should a solutions architect implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Establish a local VPC Peering connection between the Production VPC and the Shared Services VPC to bypass the Transit Gateway bandwidth limits and support Jumbo Frames up to 9001 bytes9001\text{ bytes} MTU. Deploy a NAT Gateway in each of the three Availability Zones in the Production VPC, and update the private route tables to route local Availability Zone traffic through its corresponding local NAT Gateway. Associate the Route 53 Private Hosted Zone (`internal.logistics.aws`) with the Production VPC.

Cevap

The strategy that establishes a local VPC Peering connection to support Jumbo Frames, deploys a NAT Gateway in each Availability Zone for redundancy, and associates the Route 53 Private Hosted Zone with the Production VPC.
Establishing a local VPC Peering connection provides a direct path between the VPCs, bypassing the 50 Gbps Transit Gateway bandwidth constraint per VPC attachment and supporting Jumbo Frames (9001 bytes MTU), which reduces latency and serialization overhead. Deploying a NAT Gateway in each Availability Zone eliminates the single-point-of-failure and the performance bottleneck of routing all egress traffic through a single NAT Gateway. Associating the central Route 53 Private Hosted Zone with the Production VPC ensures that queries resolve locally to the internal Network Load Balancer IP address rather than routing over the public internet.

Adım Adım Çözüm

1
Establish a local VPC Peering connection between the Production VPC and the Shared Services VPC.
Provides direct, high-bandwidth (no 50 Gbps limit) and low-latency communication with Jumbo Frame support (up to 9001 bytes MTU) between the two VPCs.
Reduces latency and fragmentation by bypassing the Transit Gateway and enabling full MTU payload transmissions.
2
Deploy redundant NAT Gateways across all three Availability Zones and update subnet route tables.
Outbound internet traffic routes locally within each Availability Zone, removing cross-AZ latency and eliminating the single NAT Gateway bottleneck.
Ensures high availability and optimizes egress performance for weather API queries during peak windows.
3
Associate the Route 53 Private Hosted Zone internal.logistics.aws from the Central Network account with the Production VPC.
Enables instances in the Production VPC to natively resolve the private DNS names to the internal Network Load Balancer IP address.
Prevents name resolution failures and avoids public DNS routing over the internet.

Anahtar Kavram

VPC Peering MTU, NAT Gateway redundancy, and cross-account Route 53 PHZ association for network performance optimization.
Tahmini Süre:3m 0s
Soru 1180Soru →

A global financial technology company is setting up a new multi-account AWS environment in the eu-west-1 Region. The architecture contains:
- vpc-payment-prod and vpc-analytics-prod in separate AWS accounts hosting production workloads across two Availability Zones (AZ-A and AZ-B).
- vpc-shared-core in a shared services AWS account, which contains a Route 53 Private Hosted Zone (PHZ) named core.internal containing service endpoints.
- vpc-security-egress in a network security account, hosting a cluster of transit inspection firewalls and outbound gateways.

An AWS Transit Gateway named tgw-transit-hub is deployed in the network security account and shared with the organization. The company has the following requirements:
1. Production workloads in vpc-payment-prod and vpc-analytics-prod must be able to resolve domain names in core.internal.
2. All outbound internet traffic from the production VPCs must be inspected by the firewalls in vpc-security-egress before exiting through NAT Gateways.
3. The design must be highly resilient to Availability Zone outages and minimize cross-AZ data transfer costs.

Which two configuration steps should a solutions architect perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the vpc-security-egress VPC, deploy a NAT Gateway in a public subnet in each Availability Zone (AZ-A and AZ-B). Configure the route tables of the private firewall subnets in each AZ to route outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway in their respective AZ.; From the shared services account, associate the Route 53 Private Hosted Zone core.internal with vpc-payment-prod and vpc-analytics-prod by submitting cross-account VPC association requests and accepting them in the respective workload accounts.

Cevap

Deploy a NAT Gateway in each Availability Zone in the egress VPC and route traffic locally, and associate the Route 53 Private Hosted Zone with the workload VPCs.
The correct configuration requires deploying a NAT Gateway in each Availability Zone within the egress VPC. This eliminates cross-AZ charges for outbound traffic and prevents a single AZ outage from taking down internet connectivity. Additionally, cross-account Route 53 Private Hosted Zone association must be established by creating association authorizations in the hosted zone's account and accepting them in the workload accounts.

Adım Adım Çözüm

1
Ensure outbound resiliency and minimize cross-AZ costs by deploying redundant NAT Gateways.
Each Availability Zone in the egress VPC has its own local NAT Gateway to route outbound internet traffic (0.0.0.0/00.0.0.0/0).
This setup prevents a single point of failure and avoids cross-AZ data transfer fees for outbound traffic.
2
Establish cross-account DNS resolution for the private hosted zone.
The Route 53 Private Hosted Zone in the shared services account is associated with the production workload VPCs.
VPCs must be explicitly associated with a Private Hosted Zone to resolve its records, regardless of Transit Gateway attachments.

Anahtar Kavram

Centralized egress architectures using AWS Transit Gateway require redundant NAT Gateways per Availability Zone to prevent single points of failure and eliminate cross-AZ traffic charges. Additionally, Route 53 Private Hosted Zones require explicit VPC associations for cross-account DNS resolution.
Tahmini Süre:3m 0s
ÖncekiSayfa 59 / 99Sonraki
Tüm alıştırma soruları — AWS Certified Solutions Architect - Professional | Examkin