Tüm alıştırma soruları

A healthcare company runs a compliant web service on Amazon EC2 instances inside an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The instances must apply specific configuration baselines via an AWS Systems Manager (SSM) State Manager association before serving production traffic. During rapid scale-out events, instances are registered with the ALB target group and begin receiving client traffic before the SSM State Manager association has completed execution, resulting in intermittent compliance auditing failures. A solutions architect must design a fully automated remediation strategy that prevents instances from serving traffic until they are compliant, while minimizing operational overhead. Which strategy should the solutions architect implement?

An enterprise runs a distributed supply chain application across multiple AWS accounts in an AWS Organization. The compute layer consists of Amazon ECS tasks running on AWS Fargate inside private subnets across two Availability Zones (AZs) in the us-east-1 Region. The tasks communicate with a single-AZ Amazon Aurora PostgreSQL Serverless v2 database cluster. A single NAT Gateway in a public subnet in us-east-1 handles all outbound internet traffic from the private subnets. The database DNS name is resolved using a Route 53 Private Hosted Zone (PHZ) created in a shared services AWS account.

The enterprise wants to optimize the application's architecture to enhance reliability and establish a Disaster Recovery (DR) strategy in the us-west-2 Region. The DR target requires a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 1 minute.

Which combination of actions will enhance the platform's reliability and meet the disaster recovery requirements while aligning with AWS best practices?

A logistics enterprise is upgrading the security posture of an internal tracking application deployed in a multi-account environment. The core application runs on Amazon ECS inside private subnets of a production VPC (VPC-A) in Account-1, fronted by an internal Application Load Balancer (ALB). The DNS for the application is managed in a Route 53 Private Hosted Zone (PHZ) in Account-1. To meet new compliance requirements, the Solutions Architect must configure the following:
1. Allow consumer services running in a development VPC (VPC-B) in Account-2 to resolve the application's domain name. VPC-A and VPC-B are connected via an AWS Transit Gateway.
2. Allow consumer services in Account-2 to write application logs directly to an Amazon S3 bucket in Account-1, ensuring all data is encrypted at rest using AWS KMS.
3. Deploy an AWS WAF Web ACL on the ALB that blocks SQL injection (SQLi) attacks from all sources, while exempting a partner's whitelisted CIDR range from rate-limiting rules that apply to general traffic.
Which combination of actions represents the most secure and operationally viable configuration to meet these requirements?

An enterprise is planning to migrate a three-tier customer portal to AWS as part of a datacenter exit project that must be completed within a strict 6-month window. The architecture and business requirements are as follows:

* Presentation Layer: A stateless Java application running on Apache Tomcat. The operations team wants to eliminate operating system patching and VM management overhead without modifying the application code.
* Database Layer: A Microsoft SQL Server database with high licensing costs. The enterprise wants to migrate to Amazon Aurora PostgreSQL. A preliminary assessment shows that converting the database schema and rewriting complex T-SQL stored procedures will take at least 9 months. The migration must limit the database downtime window to less than 2 hours during the final cutover.
* Reporting Tier: A legacy third-party reporting tool running on Solaris that cannot be virtualized on x86-64 hardware, but must remain available for regulatory compliance audits for another year.

Which combination of migration strategies is the most appropriate to meet the timeline, satisfy the technical constraints, and align with the 7 Rs framework?

An international shipping organization is preparing to migrate its legacy container tracking system to AWS. The project must be completed within a strict three-month timeline before their on-premises data center lease expires.

The web tier consists of a monolithic Java application running on Apache Tomcat. The operations team wants to eliminate host-level operating system administration by moving to containerized tasks, but the development team has no capacity to modify the application codebase.

The database tier is powered by a Microsoft SQL Server database. The infrastructure team wants to eliminate operating system patching overhead and simplify license management, but they cannot convert the database engine or schema within the given timeline.

Finally, a legacy reporting service requires a specialized physical hardware security key plugged directly into a local server. This service is slated for decommissioning in nine months, and no budget is allocated for its modification.

Which combination of migration strategies should the solutions architect select to satisfy these requirements? (Select TWO.)

An enterprise operates a multi-account structure in AWS Organizations. An existing application in several member accounts stores sensitive compliance reports in Amazon S3 buckets. Currently, these S3 buckets are encrypted at rest using the AWS-managed KMS key (aws/s3). To meet new regulatory compliance requirements, a centralized auditing application running under an IAM role in a separate Security account must perform periodic read-only audits of these S3 buckets.

Which strategy should a solutions architect implement to enhance data protection and allow the auditing application to access the encrypted data?

A smart agriculture enterprise operates a telemetry data processing application on Amazon EC2 instances in an Auto Scaling group. The application writes system and sensor processing logs to `/var/log/telemetry/gateway.log`. The application rotates logs hourly, renaming the historical logs to `/var/log/telemetry/gateway.log.YYYY-MM-DD-HH`. The company's operations team has installed the CloudWatch agent on the instances, but notices that logs generated after the hourly rotation are not being sent to Amazon CloudWatch Logs.

Additionally, the enterprise wants to centralize AWS CloudTrail logs from all member accounts in their AWS Organization into a single Amazon S3 bucket located in a dedicated Security account.

Which of the following actions should the Solutions Architect take to resolve these logging issues? (Select TWO.)

An enterprise is designing a new multi-VPC application environment in the `ap-southeast-2` region. The environment consists of three VPCs: `vpc-shared-services`, `vpc-payments-prod`, and `vpc-orders-prod`. The payments and orders workloads must communicate with a shared PostgreSQL database cluster in `vpc-shared-services` and resolve its database endpoint using a Route 53 Private Hosted Zone (PHZ) named `db.prod.internal`. All three VPCs require outbound internet access to download software patches, but the enterprise wants to minimize ongoing NAT Gateway hourly charges and Transit Gateway data transfer fees while ensuring high availability. Which network architecture design meets these requirements?

A healthcare provider has a multi-account AWS environment managed under AWS Organizations. An existing application in several member accounts uploads medical imaging data to a centralized Amazon S3 bucket in a dedicated compliance account. The S3 bucket currently uses the default AWS-managed KMS key (aws/s3) for server-side encryption. A security audit requires the provider to implement cross-account access so that authorized IAM roles in the member accounts can retrieve and decrypt the objects. Additionally, the solution must adhere to the principle of least privilege. Which configuration change should the solutions architect implement to meet these requirements?

A gaming company hosts a backend platform for real-time multiplayer tournaments on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer. The ASG is distributed across two Availability Zones: us-east-1a and us-east-1b. The instances reside in private subnets, and all outbound traffic is routed through a single NAT Gateway located in us-east-1a.

The instances require approximately $6\text{ minutes}$ to download a $4\text{ GB}$ asset bundle, extract game assets, and complete custom bootstrapping before passing health checks. The company experiences two challenges:
1. During scheduled tournaments, load increases instantly. The ASG initiates scaling, but connection drops occur during the first $10\text{ minutes}$ of the event. Because the default cooldown is set to $180\text{ seconds}$, the ASG continuously launches unnecessary instances while the first batch is still bootstrapping, which dramatically increases operational costs.
2. During an outage in us-east-1a, the NAT Gateway became unavailable, causing backend instances in us-east-1b to fail outbound calls to a third-party analytics API, rendering the entire game offline.

Which combination of actions will resolve these scaling and reliability issues while minimizing costs and maintaining fault tolerance? (Choose two.)

A company plans to migrate its on-premises VMware vSphere environment to VMware Cloud on AWS. The migration must meet the following requirements:

- A group of critical database virtual machines (VMs) must be migrated with zero application downtime to satisfy a strict recovery time objective ($RTO = 0$).
- A group of legacy development VMs will be powered off and migrated during a scheduled weekend maintenance window.

Which VMware HCX migration methods should the solutions architect select to meet these requirements? (Select TWO.)

An enterprise operates a critical order-processing application in the us-east-1 Region. The application layer runs on Amazon EC2 instances distributed across three Availability Zones (AZs) in private subnets. Outbound API validation requests are routed through a single NAT Gateway located in the us-east-1a public subnet. The database layer uses an Amazon Aurora PostgreSQL Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. A Route 53 Private Hosted Zone (PHZ) is used for internal microservice resolution. The company requires a disaster recovery strategy with a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. During a recent outage in us-east-1a, outbound API validation failed for the entire application, and DNS failover did not execute correctly. Which set of actions should the Solutions Architect recommend to meet the reliability and disaster recovery requirements?

A digital banking startup is designing a new multi-region, multi-tenant core ledger system. The system consists of two primary data tiers:

1. Ledger Database: A relational Online Transaction Processing (OLTP) workload requiring sub-$20\text{ ms}$ write latencies and the ability to dynamically scale read operations to handle heavy, unpredictable reporting queries during fiscal closing. In the primary AWS Region, the database must maintain an RPO of $0$ and an RTO of less than $30\text{ seconds}$. For cross-region disaster recovery, the database must achieve an RPO of less than $1\text{ minute}$ and an RTO of less than $15\text{ minutes}$.
2. Transaction Artifacts: An object storage tier hosting signed PDF transaction records. Artifacts are generated by containerized applications running in developer accounts and uploaded to a central Amazon S3 bucket in a dedicated Archive account. All artifacts must be encrypted at rest. The Archive account security team must retain administrative control over the encryption keys, but must grant the developer accounts the ability to encrypt artifacts during the upload process.

Which storage and database architecture meets these requirements with the lowest operational complexity?

An enterprise financial services company runs a payment settlement application on a fleet of Amazon EC2 instances. The application writes transaction events to `/var/log/settlement/transactions.log`. An hourly cron job rotates the log file by renaming the current file to `/var/log/settlement/transactions.log.YYYY-MM-DD-HH` and creating a new empty `/var/log/settlement/transactions.log` file. A solutions architect is configuring the unified Amazon CloudWatch agent on these instances to publish the log data to CloudWatch Logs. Which configuration approach should the solutions architect use to ensure all log entries are collected reliably across rotations without duplicating or missing log events?

An enterprise is auditing its AWS environment to strengthen network and identity security for a data processing application. The application runs on Amazon EC2 instances in a private subnet within VPC A (Account A) and reads and writes sensitive objects in an Amazon S3 bucket located in Account B. VPC A is connected to a shared services VPC in Account B via an AWS Transit Gateway. Currently, the EC2 instances access the S3 bucket via an S3 Gateway Endpoint in VPC A. The S3 bucket is encrypted using the default AWS managed key (aws/s3). The current S3 bucket policy allows read and write access to the IAM role attached to the EC2 instances. The security architect must implement a solution to restrict S3 bucket access so that it is only reachable from VPC A, prevent the application from accessing any S3 buckets other than the designated one in Account B, and enforce encryption with a key that supports cross-account access. What is the most secure and operationally efficient configuration to meet these requirements?

An enterprise manages a multi-account environment on AWS. Account A hosts an application running on Amazon EC2 instances within a private subnet. This application must write sensitive logs and data to an Amazon S3 bucket located in Account B. The S3 bucket is encrypted using a Customer Managed Key (CMK) stored in Account B. To strengthen identity, access, and network security for this data transfer path, a solutions architect must enforce strict network isolation ensuring that data only traverses AWS private networks, and verify that only authorized IAM roles in Account A can write to the bucket and decrypt the objects. Service Control Policies (SCPs) must be utilized to maintain these guardrails. Which combination of actions will securely achieve this objective? (Select TWO.)

An enterprise operates a multi-account environment governed by AWS Organizations. Log files containing sensitive operational records are collected from all member accounts and consolidated into a centralized Amazon S3 bucket located in a dedicated Security account. The S3 bucket is currently encrypted using the default AWS-managed KMS key (aws/s3). A solutions architect must design a solution that enhances data protection and meets the following compliance requirements:
- All log objects must be encrypted at rest using a key that supports automatic annual rotation.
- The security audit team in the Security account must be able to decrypt and analyze the logs, but member accounts must be blocked from decrypting logs once they have been written.
- Member accounts must be prevented from deleting the S3 logging bucket, deleting any log objects, or modifying the bucket policy, even if users in those accounts have administrative privileges.

Which two actions should the solutions architect take to meet these requirements?

An enterprise has an existing AWS Organizations structure where member accounts upload sensitive daily transaction logs to a centralized Amazon S3 bucket in a dedicated Logging account. Currently, the bucket uses Amazon S3 managed encryption keys (SSE-S3). To comply with a new security standard, a solutions architect must improve the data protection controls. The requirements are:

* All logs stored in the bucket must be encrypted using an AWS KMS customer managed key (CMK) managed by the Logging account.
* The member accounts must be able to write to the bucket and encrypt the objects using this KMS key.
* The Logging account must have full ownership and administrative control over all uploaded objects.
* All unencrypted uploads and uploads not using the specified KMS key must be blocked.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

A company is migrating its on-premises servers to AWS using AWS Application Migration Service (MGN) over a Site-to-Site VPN. The target environment includes a staging area VPC and a target VPC. The migrated servers in the target VPC must resolve internal DNS names hosted in a Route 53 private hosted zone within a shared services VPC. Which two configurations are required to ensure successful data replication and proper name resolution?

A solutions architect is using AWS Database Migration Service (DMS) to migrate an on-premises MySQL database to Amazon Aurora MySQL. The architect configures a replication task with both full load and continuous replication (Change Data Capture) enabled. The full load phase completes successfully, and all existing data is copied to the target database. However, subsequent insert and update transactions performed on the on-premises database are not replicated, and the task status stalls. Which of the following is the most likely cause of this behavior?