Tüm alıştırma soruları

1964 soru

Tüm türler1,964 Çoktan seçmeli1,006 Çoklu seçim931 Sıralama27

An enterprise manages its multi-account environment under AWS Organizations. A central platform team uses AWS CloudFormation StackSets to deploy and update web application stacks across all member accounts. Recently, security audits revealed that local administrators in several member accounts have manually added inbound rules to their Application Load Balancer (ALB) security groups to troubleshoot connectivity, introducing security vulnerabilities and causing configuration drift.

The platform team wants to prevent unauthorized changes to the security groups while allowing CloudFormation StackSets to update them. Additionally, any existing drift on the security groups must be detected and automatically reverted without redeploying the entire application stack.

Which two actions should the Solutions Architect take to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure AWS Config in each member account with the vpc-sg-open-only-to-authorized-ports managed rule, and specify an AWS Systems Manager Automation runbook as a remediation action to automatically remove unauthorized rules.

Implement a Service Control Policy (SCP) at the organizational level that denies ec2:AuthorizeSecurityGroupIngress and ec2:RevokeSecurityGroupIngress actions unless the caller principal is the CloudFormation StackSets execution role.

Enable AWS CloudFormation drift detection on the StackSets and configure an Amazon EventBridge rule that triggers an automatic stack update using the UpdateStack API with the previously deployed template whenever drift is detected.

Apply a Service Control Policy (SCP) to the member account Organizational Units (OUs) that explicitly grants the AWS CloudFormation StackSets execution role permission to modify security groups, assuming this overrides local IAM policies.

Create a custom KMS key policy using the AWS-managed KMS key for Amazon EC2 (aws/ec2) in the management account to allow cross-account access for the CloudFormation StackSets execution role, securing the templates during deployment.

Cevabı ve açıklamayı göster

Cevap: Configure AWS Config in each member account with the vpc-sg-open-only-to-authorized-ports managed rule, and specify an AWS Systems Manager Automation runbook as a remediation action to automatically remove unauthorized rules.; Implement a Service Control Policy (SCP) at the organizational level that denies ec2:AuthorizeSecurityGroupIngress and ec2:RevokeSecurityGroupIngress actions unless the caller principal is the CloudFormation StackSets execution role.

Cevap

The correct actions are implementing an AWS Config rule with Systems Manager Automation remediation to remove unauthorized security group rules, and applying a Service Control Policy (SCP) to restrict security group modifications to the CloudFormation StackSets execution role.

Configuring AWS Config with Systems Manager Automation allows for automated detection and targeted remediation of unauthorized security group changes without full stack redeployments. Applying a Service Control Policy (SCP) that restricts security group modifications to the CloudFormation StackSets execution role establishes a preventive guardrail against manual configurations by local administrators.

Adım Adım Çözüm

Configure preventative controls at the organization level using a Service Control Policy.

Local administrators are blocked from modifying security groups, while the CloudFormation StackSets role remains permitted.

This establishes a security boundary that prevents future configuration drift without impacting automated deployments.

Deploy AWS Config managed rules across all target accounts to monitor security group compliance.

Any out-of-band changes to security groups are flagged as non-compliant.

AWS Config is designed to continuously record and evaluate AWS resource configurations.

Link an AWS Systems Manager Automation runbook to the AWS Config rule.

Non-compliant security groups are automatically remediated to their authorized state.

Targeted remediation corrects the specific configuration drift without requiring a complete stack update or redeployment.

Anahtar Kavram

Combining preventative organization-level guardrails with automated detection and remediation tools to manage configuration drift in a multi-account environment.

Tahmini Süre:2m 0s

Soru 1522Soru →

A financial technology enterprise, PayGlide, is migrating its legacy payment processing workload from on-premises virtualization hosts to AWS. The workload consists of multiple critical microservices that must be modernized using containers. The enterprise requires a fully managed serverless container platform to eliminate the operational overhead of managing underlying container hosts. The new architecture must span multiple Availability Zones to ensure high availability, and it must have resilient outbound internet access to communicate with external payment gateways. Furthermore, these microservices must resolve the internal DNS names of shared services hosted in a separate shared services VPC within their organization. Which of the following networking and container configurations meets these requirements with the least operational overhead?

Deploy the microservices on Amazon ECS using the AWS Fargate launch type with the `awsvpc` network mode. Deploy a single NAT Gateway in a single public subnet to route outbound traffic for all workload private subnets. Associate the Route 53 Private Hosted Zone of the shared services VPC with the workload VPC.

Deploy the microservices on Amazon ECS using the AWS Fargate launch type with the `bridge` network mode to share the host's network namespace. Deploy redundant NAT Gateways across multiple Availability Zones in the public subnets of the workload VPC. Associate the Route 53 Private Hosted Zone of the shared services VPC with the workload VPC.

Deploy the microservices on Amazon ECS using the AWS Fargate launch type with the `awsvpc` network mode. Deploy redundant NAT Gateways across multiple Availability Zones in the public subnets of the workload VPC. Associate the Route 53 Private Hosted Zone of the shared services VPC with the workload VPC.

Deploy the microservices on Amazon ECS using the AWS Fargate launch type with the `awsvpc` network mode. Deploy redundant NAT Gateways across multiple Availability Zones in the public subnets of the workload VPC. Route all DNS traffic from the workload VPC to the shared services VPC via an AWS Transit Gateway without associating the Route 53 Private Hosted Zone to the workload VPC.

Cevabı ve açıklamayı göster

Cevap: Deploy the microservices on Amazon ECS using the AWS Fargate launch type with the `awsvpc` network mode. Deploy redundant NAT Gateways across multiple Availability Zones in the public subnets of the workload VPC. Associate the Route 53 Private Hosted Zone of the shared services VPC with the workload VPC.

Cevap

Deploying the containerized microservices on Amazon ECS with the AWS Fargate launch type using the `awsvpc` network mode ensures a serverless compute backend where each task receives its own Elastic Network Interface (ENI). To enable high availability for outbound traffic, NAT Gateways must be deployed in each Availability Zone. For cross-VPC DNS resolution of internal services, the Route 53 Private Hosted Zone from the shared services VPC must be associated with the workload VPC.

Adım Adım Çözüm

Select the serverless container execution environment.

Amazon ECS with the AWS Fargate launch type using the `awsvpc` network mode is selected, satisfying the requirement to minimize operational overhead and run on serverless compute.

Fargate eliminates container host management, and it only supports the `awsvpc` network mode.

Configure high availability for outbound traffic.

Redundant NAT Gateways are deployed in public subnets across multiple Availability Zones.

This ensures that a failure in one Availability Zone does not disrupt outbound internet access for tasks running in other zones.

Configure DNS resolution for the shared services VPC.

The Route 53 Private Hosted Zone of the shared services VPC is associated with the workload VPC.

This allows the Fargate tasks in the workload VPC to resolve internal DNS names of services in the shared services VPC.

Anahtar Kavram

AWS Fargate network mode requirements, multi-AZ outbound routing HA, and Route 53 Private Hosted Zone cross-VPC association.

Soru 1523Soru →

An educational technology company, EduStream, is modernizing its on-premises video transcoding application by migrating the workload to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The transcoding tasks must run in private subnets, pull container images from a private Amazon Elastic Container Registry (Amazon ECR) repository, and communicate with each other using direct task-to-task IP routing. Which TWO configurations must a solutions architect implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure the Amazon ECS task definition to use the awsvpc network mode, which assigns a unique elastic network interface (ENI) to each Fargate task.

Create interface VPC endpoints (AWS PrivateLink) for Amazon ECR and Amazon ECS in the VPC to allow secure, private communication from the private subnets.

Configure the Amazon ECS task definition to use the bridge network mode to allow the containerized application to dynamically bind to host ports.

Create a Route 53 private hosted zone for the Amazon ECR service endpoint and associate it with the on-premises DNS resolvers without linking it to the VPC.

Deploy a single NAT Gateway in a public subnet to route all outbound container registration and pulling traffic from multiple private subnets across different Availability Zones.

Cevabı ve açıklamayı göster

Cevap: Configure the Amazon ECS task definition to use the awsvpc network mode, which assigns a unique elastic network interface (ENI) to each Fargate task.; Create interface VPC endpoints (AWS PrivateLink) for Amazon ECR and Amazon ECS in the VPC to allow secure, private communication from the private subnets.

Cevap

The correct configurations are configuring the Amazon ECS task definition to use the awsvpc network mode and creating interface VPC endpoints for Amazon ECR and Amazon ECS in the VPC.

The correct configuration requires using the awsvpc network mode in the ECS task definition, as AWS Fargate does not support bridge or host network modes. Additionally, interface VPC endpoints must be established for Amazon ECR and Amazon ECS within the VPC to allow tasks in private subnets to pull images and register with the ECS service control plane without public internet access.

Adım Adım Çözüm

Identify the network mode requirement for AWS Fargate tasks.

AWS Fargate only supports the awsvpc network mode, which assigns an ENI to each task.

Fargate abstracts the host EC2 instances, meaning traditional bridge and host network modes are unavailable.

Determine the private connectivity strategy for pulling images from ECR.

Interface VPC endpoints allow private routing to Amazon ECR and Amazon ECS without exposing the subnet to the internet.

This satisfies the requirement to pull images privately and securely.

Anahtar Kavram

Amazon ECS on AWS Fargate networking modes and private connectivity using VPC endpoints

Soru 1524Soru →

A logistics enterprise is designing a real-time container tracking and telemetry analytics platform. The system must ingest location updates from 500,000 global transport containers every 10 seconds (write-heavy NoSQL workload). Users require sub-second latency when querying the current status of any container. For auditing and long-term analytics, historical telemetry must be stored indefinitely with minimal storage and query costs. The disaster recovery requirements dictate a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 1 minute for the active container database. In addition, an external auditing service in a separate AWS account must be able to periodically query the historical logs. Which two database and storage strategy options should the solutions architect choose to meet these requirements?

Geçerli olan tümünü seçin

Configure Amazon DynamoDB Global Tables for the active container tracking database to achieve multi-region replication and meet the RTO and RPO objectives.

Enable a DynamoDB Stream on the active tracking table, use Amazon Kinesis Data Firehose to capture the stream and write the partitioned telemetry data to an Amazon S3 bucket, and use Amazon Athena to run ad-hoc queries on the historical data.

Deploy Amazon RDS for PostgreSQL with a Multi-AZ standby deployment, and configure the application to direct analytical read queries to the standby database instance to offload read traffic from the primary instance.

Implement a multi-region disaster recovery strategy by taking periodic snapshots of the database every 4 hours, copying the snapshots to a secondary region, and using AWS CloudFormation to automatically spin up a pilot light database environment during a failover.

Store the historical telemetry logs in an Amazon S3 bucket encrypted with the default AWS-managed KMS key (aws/s3), and modify the key policy to grant decrypt permissions to the external auditor's AWS account.

Cevabı ve açıklamayı göster

Cevap: Configure Amazon DynamoDB Global Tables for the active container tracking database to achieve multi-region replication and meet the RTO and RPO objectives.; Enable a DynamoDB Stream on the active tracking table, use Amazon Kinesis Data Firehose to capture the stream and write the partitioned telemetry data to an Amazon S3 bucket, and use Amazon Athena to run ad-hoc queries on the historical data.

Cevap

The correct strategy is to use Amazon DynamoDB Global Tables to meet the active tracking database's sub-second latency, multi-region availability, and RTO/RPO requirements. Additionally, a DynamoDB Stream should capture changes, and Kinesis Data Firehose should deliver them to Amazon S3, allowing Amazon Athena to cost-effectively run ad-hoc queries on the historical telemetry.

The correct options implement a highly available, low-latency tracking database using Amazon DynamoDB Global Tables, which meets the sub-minute RPO and sub-15-minute RTO through continuous cross-region replication. For historical analytics, streaming changes via DynamoDB Streams and Kinesis Data Firehose to Amazon S3 allows cost-effective storage. Ad-hoc analytics can then be performed using Amazon Athena without impacting the production transactional database. Furthermore, using customer-managed KMS keys allows for the modification of key policies to enable secure cross-account decryption for external auditing services.

Adım Adım Çözüm

Identify the requirements for the active tracking database, which demands high write throughput, sub-second query latency, and multi-region replication with RTO < 15 minutes and RPO < 1 minute.

Select Amazon DynamoDB Global Tables because it provides active-active replication with replica latency in seconds (meeting RPO < 1 min) and near-zero recovery time (meeting RTO < 15 min).

Standard relational database replication or backup/restore methods cannot guarantee both sub-second query latencies and a sub-minute multi-region RPO.

Evaluate the historical data retention and analytical query requirements.

Choose to stream data out of DynamoDB using DynamoDB Streams and Kinesis Data Firehose into an Amazon S3 data lake, then run queries using Amazon Athena.

This keeps storage costs low (S3) and ensures analytical query costs are pay-per-query (Athena) without degrading the performance of the active tracking database.

Evaluate the security and cross-account access requirements for encryption.

Identify that AWS-managed KMS keys cannot be modified or shared across accounts, requiring customer-managed KMS keys for the external auditor's cross-account access.

Using customer-managed KMS keys is required because policies of AWS-managed keys cannot be modified to grant external cross-account decryption permissions.

Anahtar Kavram

Designing high-performance, cost-effective global database and storage strategies using Amazon DynamoDB Global Tables, S3, Athena, and AWS KMS Customer Managed Keys.

Soru 1525Soru →

An enterprise is migrating an on-premises Microsoft SQL Server 2019 database (Enterprise Edition) configured with a two-node AlwaysOn Availability Group to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The database contains several tables with primary keys, and some tables contain large XML columns. The migration must achieve near-zero downtime. A solutions architect is setting up AWS Schema Conversion Tool (SCT) for schema conversion and AWS Database Migration Service (DMS) for continuous data replication (Change Data Capture). Which of the following actions are required to configure the source SQL Server database and the AWS DMS replication task to support ongoing replication and minimize data transfer issues? (Select two.)

Geçerli olan tümünü seçin

Enable Microsoft Change Data Capture (MS-CDC) on the source database and on the specific tables, and ensure the SQL Server Agent service is running on the active primary replica.

Configure the AWS DMS source endpoint to connect to the AlwaysOn Availability Group listener, and set the replication task to use Limited LOB mode with an appropriate maximum LOB size for the XML columns.

Configure the AWS DMS source endpoint with the ApplicationIntent=ReadOnly connection attribute to direct CDC log reader queries to the secondary replica, reducing the transaction log IOPS on the primary replica.

Enable the SQL Server Replication feature on the passive secondary replica, and configure the AWS DMS task to use the read from backup option with a shared backup folder on Amazon S3.

Install the AWS SCT extraction agents on both SQL Server host nodes, and configure them to write transaction log backups directly to the DMS replication instance local storage.

Cevabı ve açıklamayı göster

Cevap: Enable Microsoft Change Data Capture (MS-CDC) on the source database and on the specific tables, and ensure the SQL Server Agent service is running on the active primary replica.; Configure the AWS DMS source endpoint to connect to the AlwaysOn Availability Group listener, and set the replication task to use Limited LOB mode with an appropriate maximum LOB size for the XML columns.

Cevap

Enable Microsoft Change Data Capture (MS-CDC) on the source database and tables while ensuring the SQL Server Agent is running, and configure the AWS DMS source endpoint with the Availability Group listener while setting the task to use Limited LOB mode for the XML columns.

To replicate ongoing changes from a SQL Server AlwaysOn Availability Group, MS-CDC must be enabled on the source database and tables, and the SQL Server Agent must be active on the primary replica to run the CDC capture jobs. The DMS source endpoint should connect to the Availability Group listener to maintain connection state during failovers, and Limited LOB mode is required to optimize the transfer of XML columns (treated as LOBs by DMS).

Adım Adım Çözüm

Enable Change Data Capture on the source database and the tables slated for migration.

SQL Server generates the CDC system tables and capture jobs.

AWS DMS requires either MS-CDC or MS-Replication to identify and capture incremental changes for CDC migration.

Ensure the SQL Server Agent service is running on the active primary replica.

The CDC capture jobs execute and populate the change tables from the active transaction log.

If the agent is stopped, CDC change tables will not be populated, and DMS will not replicate any ongoing changes.

Configure the AWS DMS source endpoint to use the AlwaysOn Availability Group listener.

DMS connects to the active primary replica and automatically reconnects to the new primary after a failover.

Connecting directly to a node IP would break the replication task if a failover occurs.

Configure the DMS task to use Limited LOB mode for LOB columns, including the SQL Server XML data type.

DMS transfers XML data inline up to the defined maximum LOB size, enhancing throughput.

Full LOB mode is slower because it queries LOB data in a separate lookup step, while Limited LOB mode optimizes transfer speeds by pre-allocating memory.

Anahtar Kavram

Continuous replication (CDC) from SQL Server AlwaysOn Availability Groups using AWS DMS requires connecting to the primary replica, enabling MS-CDC with SQL Server Agent running, and handling XML columns as LOBs with appropriate LOB settings.

Tahmini Süre:3m 0s

Soru 1526Soru →

CloudCart, an e-commerce startup, is migrating its legacy monolithic shopping cart application to AWS. The development team has decided to containerize the application and run it on Amazon Elastic Container Service (Amazon ECS) using the AWS Fargate launch type to minimize operational overhead. During task definition configuration, the team is selecting the network mode for the task. Which network mode must the team configure in the Amazon ECS task definition to deploy this containerized application on AWS Fargate?

awsvpc

bridge

host

none

Cevabı ve açıklamayı göster

Cevap: awsvpc

Cevap

The correct network mode is awsvpc, as AWS Fargate requires the awsvpc network mode to allocate an elastic network interface (ENI) directly to each running task.

AWS Fargate only supports the awsvpc network mode. In this mode, every task execution receives its own dedicated Elastic Network Interface (ENI) and private IPv4 address, ensuring security group isolation and simple network configuration similar to EC2 instances.

Adım Adım Çözüm

Identify the hosting platform and launch type selected for the containerized application.

The application will run on Amazon ECS with the AWS Fargate launch type.

Fargate has specific architectural constraints regarding network modes.

Evaluate the supported network modes for AWS Fargate task definitions.

Fargate only supports the awsvpc network mode.

Fargate manages the underlying infrastructure and assigns a dedicated Elastic Network Interface (ENI) to each task rather than sharing a host interface.

Anahtar Kavram

AWS Fargate Networking Modes

Soru 1527Soru →

A media streaming company runs a metadata caching service on Amazon EC2 instances in an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances require a complex initialization sequence to download and cache local reference datasets, which takes approximately 8 minutes to complete. The company observes that during sudden traffic surges, the ASG launches new instances, but the CPU utilization on existing instances remains high. As a result, the ASG continuously launches more instances until the maximum group size is reached, leading to excessive costs and overall service instability. Which configuration change will prevent the ASG from launching unnecessary instances while ensuring the system can eventually scale to meet the demand?

Decrease the default cooldown period of the Auto Scaling group to 60 seconds to allow the system to respond faster to traffic surges.

Submit a support case to AWS to request pre-warming of the Application Load Balancer to handle the sudden capacity increase.

Configure a target tracking scaling policy with the instance warmup set to 540 seconds to prevent the group from launching additional instances before the new instances complete initialization.

Deploy a NAT Gateway in each Availability Zone used by the Auto Scaling group to ensure high availability of outbound connections during scaling events.

Cevabı ve açıklamayı göster

Cevap: Configure a target tracking scaling policy with the instance warmup set to 540 seconds to prevent the group from launching additional instances before the new instances complete initialization.

Cevap

Configure a target tracking scaling policy with the instance warmup set to 540 seconds to prevent the group from launching additional instances before the new instances complete initialization.

Configuring the target tracking scaling policy with an instance warmup period that exceeds the bootstrapping time (540 seconds > 480 seconds / 8 minutes) ensures that newly launched instances do not contribute to the Auto Scaling group's aggregated metric calculation until they are ready to handle traffic. This prevents the scaling policy from initiating subsequent scale-out actions while the first set of instances is still bootstrapping.

Adım Adım Çözüm

Analyze the instance lifecycle timeline and determine the time required for bootstrapping.

The instances take 8 minutes (480 seconds) to complete initialization and become operational.

Understanding the delay between instance launch and actual capacity availability is key to configuring the scale-out metric calculation.

Identify the root cause of the continuous scaling loop.

Newly launched instances are included in the group's aggregate CPU metric before they are ready, showing 0% utilization, but existing instances are still overloaded, causing the average CPU metric to remain high and trigger further scale-outs.

This explains why the Auto Scaling group continues launching instances up to its maximum capacity.

Configure the instance warmup setting on the Auto Scaling group scaling policy to exceed the bootstrapping time.

Setting the warmup to 540 seconds (9 minutes) ensures the instances are excluded from metric calculations until they are fully functional.

This stops the scaling policy from initiating new launches during the bootstrap window, preventing resource and cost bloat.

Anahtar Kavram

Auto Scaling group instance warmup configuration to accommodate instance bootstrapping time.

Soru 1528Soru →

A high-traffic digital healthcare portal uses an Amazon RDS for PostgreSQL Multi-AZ DB instance to store patient health records and doctor availability schedules. During morning booking hours, the portal experiences a massive surge in traffic. Database metrics show CPU utilization on the DB instance reaching $90\%$ due to a high volume of read-only queries searching for doctor availability. Furthermore, the portal needs to store transient user session data for appointment scheduling workflows. These session states require sub-millisecond read and write latency, and must remain highly available and survive cache node failures. Which combination of database and caching optimization strategies should the Solutions Architect recommend to improve portal performance and manage session state? (Select TWO.)

Geçerli olan tümünü seçin

Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover to store the user session data.

Create one or more Amazon RDS read replicas of the PostgreSQL DB instance, and configure the application to direct doctor availability searches to the replica endpoints.

Deploy an Amazon ElastiCache for Memcached cluster to store the user session states, configuring multi-node sharding to ensure data persistence.

Configure the application to route the read-only doctor availability search queries to the secondary standby instance of the RDS PostgreSQL Multi-AZ deployment.

Deploy an Amazon ElastiCache for Memcached cluster with automatic backup and restore enabled to secure the session states.

Cevabı ve açıklamayı göster

Cevap: Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover to store the user session data.; Create one or more Amazon RDS read replicas of the PostgreSQL DB instance, and configure the application to direct doctor availability searches to the replica endpoints.

Cevap

Deploy an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover to store the user session data, and create one or more Amazon RDS read replicas of the PostgreSQL DB instance to handle doctor availability searches.

The database read bottleneck is resolved by deploying Amazon RDS read replicas, which offload the read-heavy doctor availability searches from the primary writer instance. The transient session state requirement is addressed by deploying an Amazon ElastiCache for Redis replication group with Multi-AZ and automatic failover, which supports sub-millisecond response times, replication across availability zones, and automatic recovery if a node fails.

Adım Adım Çözüm

Analyze the database bottleneck and read replication capabilities of the database tier.

Identify that the

90\%

CPU bottleneck is caused by read-only searches. Creating RDS read replicas will scale reads horizontally, whereas the Multi-AZ standby instance is passive and cannot serve queries.

This offloads read traffic from the primary writer instance, lowering CPU utilization.

Evaluate the caching engine properties for storing transient session states that require durability.

Compare Redis and Memcached. Redis supports Multi-AZ replication groups and failover to prevent data loss on node failure, while Memcached is non-persistent and non-replicated.

Choosing ElastiCache for Redis ensures that session data is highly available and survives node failures.

Anahtar Kavram

Scaling read-heavy relational workloads with RDS Read Replicas and storing stateful, low-latency transient data using replication-enabled Amazon ElastiCache for Redis clusters.

Soru 1529Soru →

A media company runs a video processing application on Amazon EC2 instances distributed across $3$ Availability Zones (`us-west-2a`, `us-west-2b`, and `us-west-2c`) in the `us-west-2` Region. The instances mount a shared Amazon EFS file system configured with the EFS Regional storage class and Elastic throughput mode. The total volume of active files stored on the EFS file system is $40\text{ TB}$ , and the application processes approximately $100\text{ TB}$ of data monthly.

The company's monthly AWS bill shows high storage costs for the EFS file system and significant data transfer charges for $66\text{ TB}$ of inter-Availability Zone traffic. A solutions architect investigates the configuration and discovers that:
- The EC2 instances are configured to mount the EFS file system using the specific IP address of the EFS mount target located in the `us-west-2a` subnet.
- Approximately $30\text{ TB}$ of the files stored on the EFS file system have not been accessed or modified in the last $30$ days but must remain available for immediate retrieval to meet compliance requirements.

Which combination of actions will optimize both the storage and data transfer costs for this architecture while maintaining high availability?

Configure an EFS lifecycle policy to transition files to the EFS Infrequent Access (IA) storage class after

30

days of inactivity. Update the EC2 instance mounting configuration to mount the EFS file system using the EFS DNS name instead of the specific mount target IP address.

Recreate the EFS file system using the EFS One Zone storage class in the `us-west-2a` Availability Zone to reduce storage costs. Update the mounting scripts on the EC2 instances in all

3

Availability Zones to use the EFS DNS name.

Purchase Compute Savings Plans to cover the EFS storage and data transfer costs. Configure an AWS Lambda function to run daily to compress files older than

30

days into zip format on the existing EFS file system.

Order an AWS Snowball Edge device to copy the

30\text{ TB}

of inactive files from the EFS file system, ship the device to AWS to load the data into Amazon S3 Glacier Flexible Retrieval, and configure an Amazon S3 Gateway VPC Endpoint in the VPC.

Cevabı ve açıklamayı göster

Cevap: Configure an EFS lifecycle policy to transition files to the EFS Infrequent Access (IA) storage class after $30$ days of inactivity. Update the EC2 instance mounting configuration to mount the EFS file system using the EFS DNS name instead of the specific mount target IP address.

Cevap

Configure an EFS lifecycle policy to transition files to the EFS Infrequent Access (IA) storage class after

30

days of inactivity, and update the EC2 instance mounting configuration to mount the EFS file system using the EFS DNS name instead of the specific mount target IP address.

The correct option transitions infrequently accessed files to EFS Infrequent Access (IA) to reduce storage costs while maintaining immediate availability. It also changes the mounting scripts from a hardcoded IP address to the EFS DNS name, allowing Route 53 to resolve the DNS name to the local mount target IP address in the EC2 instance's Availability Zone. This keeps data transfer within the same Availability Zone and eliminates the cross-Availability Zone data transfer fees.

Adım Adım Çözüm

Configure an EFS lifecycle policy to transition files to the EFS IA storage class after

30

days of inactivity.

Lowers storage costs for the

30\text{ TB}

of infrequently accessed files while keeping them immediately available.

EFS IA offers significantly lower storage prices for files that are accessed less frequently but still require sub-millisecond access times when retrieved.

Update EC2 instance mount configuration to use the EFS DNS name instead of the specific IP address of the mount target in `us-west-2a`.

EC2 instances resolve the DNS name to the EFS mount target in their respective local Availability Zone.

Connecting to local mount targets avoids cross-Availability Zone data transfer, eliminating charges for the

66\text{ TB}

of inter-AZ traffic.

Anahtar Kavram

Optimizing Amazon EFS storage using Lifecycle Policies and resolving cross-AZ data transfer costs by using DNS-based mount targets.

Tahmini Süre:3m 0s

Soru 1530Soru →

An enterprise web application hosts a financial ledger service on Amazon EC2 instances inside an Auto Scaling group (ASG) behind an Application Load Balancer (ALB). The instances are deployed across two Availability Zones (AZ-A and AZ-B) and require exactly $6\text{ minutes}$ to bootstrap, retrieve cryptographic keys, and warm up local memory caches before passing target group health checks. Outbound internet traffic for both AZs is routed through a single NAT gateway located in AZ-A.

The application experiences two major operational issues:
1. During daily flash-sale events that cause immediate, massive traffic spikes, the ALB drops incoming requests with HTTP $503$ and $504$ errors before the ASG can respond. Additionally, the ASG experiences an "over-provisioning storm," launching far more instances than required because the scaling policy triggers additional scaling actions before the newly launched instances finish bootstrapping.
2. A recent fiber-cut outage in AZ-A caused all outbound internet traffic from instances in AZ-B to fail, disrupting transaction settlements.

Which solution resolves these issues with the lowest operational overhead?

Configure scheduled scaling policies to scale out the Auto Scaling group in advance of the daily flash-sale events, and set the default cooldown and instance warmup timers to

450\text{ seconds}

. Request Application Load Balancer pre-warming from AWS Support for the flash-sale periods. Deploy a dedicated NAT gateway in the public subnet of each Availability Zone, and update the private subnet route tables to route outbound traffic through the local NAT gateway.

Configure scheduled scaling policies to scale out the Auto Scaling group in advance of the daily flash-sale events, and set the default cooldown and instance warmup timers to

300\text{ seconds}

Configure scheduled scaling policies to scale out the Auto Scaling group in advance of the daily flash-sale events, and set the default cooldown and instance warmup timers to

450\text{ seconds}

. Request Application Load Balancer pre-warming from AWS Support for the flash-sale periods. Consolidate all outbound traffic from both Availability Zones through the existing NAT gateway in AZ-A, and configure an AWS Lambda function to automatically recreate the NAT gateway in AZ-B if AZ-A experiences an outage.

Configure target tracking scaling policies on the Auto Scaling group based on average CPU utilization with the default cooldown and instance warmup timers set to

450\text{ seconds}

. Deploy a dedicated NAT gateway in the public subnet of each Availability Zone, and update the private subnet route tables to route outbound traffic through the local NAT gateway. Rely on the Application Load Balancer's automatic scaling to handle the traffic spikes during the flash-sale events.

Cevabı ve açıklamayı göster

Cevap: Configure scheduled scaling policies to scale out the Auto Scaling group in advance of the daily flash-sale events, and set the default cooldown and instance warmup timers to $450\text{ seconds}$ . Request Application Load Balancer pre-warming from AWS Support for the flash-sale periods. Deploy a dedicated NAT gateway in the public subnet of each Availability Zone, and update the private subnet route tables to route outbound traffic through the local NAT gateway.

Cevap

Configure scheduled scaling policies to scale out the Auto Scaling group in advance of the daily flash-sale events, and set the default cooldown and instance warmup timers to

450\text{ seconds}

The correct solution addresses all three components of the problem. First, configuring scheduled scaling policies and requesting ALB pre-warming ensures that both the application instances and the load balancer are ready to handle the immediate surge of flash-sale traffic, preventing HTTP

503

and

504

errors. Second, setting the default cooldown and instance warmup periods to

450\text{ seconds}

(which is longer than the

6\text{-minute}

360\text{-second}

bootstrapping duration) ensures that the Auto Scaling group does not launch additional instances while the current batch is still bootstrapping, preventing the over-provisioning storm. Third, deploying a dedicated NAT gateway in each Availability Zone and updating the route tables ensures that outbound connectivity remains functional for AZ-B even if AZ-A suffers a failure.

Adım Adım Çözüm

Analyze the bootstrapping requirements and scaling behavior.

The instances require

6\text{ minutes}

(

360\text{ seconds}

) to bootstrap. The Auto Scaling group's cooldown and instance warmup period must be set to a value greater than

360\text{ seconds}

(e.g.,

450\text{ seconds}

) to ensure that the scaling policy waits for the newly launched instances to become active before evaluating the metrics again. This prevents the over-provisioning storm.

Setting the cooldown/warmup shorter than the bootstrapping time leads to unnecessary scaling actions because metrics remain high while instances are starting up.

Address the sudden flash-sale traffic spikes at the load balancer and application tier.

Since the traffic spike is predictable and sudden (daily flash-sale), configure scheduled scaling to provision capacity ahead of time, and request Application Load Balancer pre-warming from AWS Support to handle the immediate influx of requests.

Standard reactive scaling cannot react fast enough to instant spikes, leading to connection drops and HTTP

503

504

errors.

Resolve the single point of failure for outbound traffic.

Deploy a NAT gateway in the public subnet of each Availability Zone and update the route tables of the private subnets to point to their respective local NAT gateways.

Deploying a NAT gateway per Availability Zone ensures that an outage in one zone does not impact the internet connectivity of resources in other zones.

Anahtar Kavram

To implement fault tolerance and auto-scaling for predictable flash traffic, use scheduled scaling policies combined with load balancer pre-warming, set the instance warmup and cooldown periods to exceed the bootstrapping duration to prevent over-provisioning, and deploy zone-redundant NAT gateways to eliminate single points of failure.

Soru 1531Soru →

A manufacturing company plans to migrate its on-premises VMware vCenter environment, which hosts 500 virtual machines, to AWS. To plan the migration, the company needs to collect server configuration, CPU/memory utilization, and disk I/O performance data to estimate sizing and run cost assessments. The company also needs to track the migration progress directly within AWS Migration Hub. The company's security policy strictly prohibits the installation of any software agents on the guest operating systems of the virtual machines. Which action should a solutions architect recommend to discover the on-premises servers while complying with the security policy?

Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware vCenter environment to gather VM metadata and utilization data.

Install the AWS Application Discovery Agent on all virtual machines using a group policy object or automated shell scripts.

Deploy the AWS Application Migration Service (MGN) replication agent on the vCenter host to automatically discover the VM inventory and map dependencies.

Order an AWS Snowball Edge device to run the Discovery Connector locally and physically transfer the vCenter database to AWS.

Cevabı ve açıklamayı göster

Cevap: Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware vCenter environment to gather VM metadata and utilization data.

Cevap

Deploy the AWS Application Discovery Agentless Collector as a virtual appliance in the VMware vCenter environment to gather VM metadata and utilization data.

Deploying the AWS Application Discovery Agentless Collector as an OVA template in the VMware vCenter environment allows the solutions architect to gather VM metadata, disk I/O, and CPU/memory utilization statistics directly from vCenter APIs. This completely avoids installing any agents on the guest operating systems, adhering to the strict compliance policy while providing all necessary data for tracking and migration planning in AWS Migration Hub.

Adım Adım Çözüm

Analyze the business and compliance constraints.

Identify that installing guest OS-level software agents is prohibited by the security team.

This rules out any agent-based discovery solutions.

Evaluate the source environment and target data requirements.

The source is a VMware vCenter environment, and the required data includes server configuration, CPU/RAM utilization, and disk I/O.

This determines that an agentless solution running at the hypervisor or vCenter level is suitable.

Select the correct AWS discovery tool that integrates with AWS Migration Hub.

Select the AWS Application Discovery Agentless Collector, which runs as a VMware virtual appliance (OVA) and queries the vCenter APIs.

It collects configuration and utilization metadata without installing guest OS agents, complying with the security policy while feeding data directly into AWS Migration Hub.

Anahtar Kavram

Agentless Discovery using AWS Application Discovery Service

Soru 1532Soru →

An interactive entertainment company is designing a new global multiplayer gaming platform (NoSQL and Object storage workloads). The platform requires a database to store real-time player session state (OLTP workload requiring sub-10 millisecond read and write latency) and a storage solution for game asset downloads (Object storage workload). The session state must be replicated across two AWS Regions: us-east-1 and ap-northeast-1, with a Recovery Time Objective (RTO) of less than 1 minute and a Recovery Point Objective (RPO) of near-zero. Game assets must be replicated between these regions, and compliance dictates that all replication traffic must be encrypted using Customer Managed Keys (CMKs) with policies that allow cross-region KMS key access. Which combination of database and storage designs will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure Amazon DynamoDB global tables in us-east-1 and ap-northeast-1 to store player session state, enabling active-active replication to meet low-latency read and write requirements.

Configure Amazon S3 Cross-Region Replication (CRR) for game assets, and configure the replication rule to use a destination KMS customer managed key (CMK) that trusts the source region's replication IAM role.

Deploy Amazon RDS for PostgreSQL with Multi-AZ enabled in us-east-1, and create a cross-region read replica in ap-northeast-1, directing session writes from the Asian region to the replica to achieve low latency.

Set up Amazon S3 Cross-Region Replication (CRR) for game assets, and configure the replication settings to use the default AWS-managed KMS key (aws/s3) for cross-region encryption and decryption.

Configure an Amazon Aurora Global Database with a primary cluster in us-east-1 and a secondary cluster in ap-northeast-1 to store session state, enabling global write forwarding to the secondary region to handle local writes.

Cevabı ve açıklamayı göster

Cevap: Configure Amazon DynamoDB global tables in us-east-1 and ap-northeast-1 to store player session state, enabling active-active replication to meet low-latency read and write requirements.; Configure Amazon S3 Cross-Region Replication (CRR) for game assets, and configure the replication rule to use a destination KMS customer managed key (CMK) that trusts the source region's replication IAM role.

Cevap

The correct architecture combines Amazon DynamoDB global tables for low-latency active-active session replication, and Amazon S3 Cross-Region Replication (CRR) utilizing Customer Managed Keys (CMKs) to satisfy the compliance and cross-region key policy requirements.

DynamoDB global tables satisfy the session state performance requirements by providing active-active databases with sub-10ms local reads/writes and automated multi-region replication. Additionally, S3 Cross-Region Replication with Customer Managed Keys enables compliant, encrypted asset synchronization between regions.

Adım Adım Çözüm

Analyze database requirements

Player session state requires active-active writes in both regions with sub-10ms latency and near-zero RPO.

DynamoDB global tables offer multi-region active-active replication with single-digit millisecond local latency. Relational databases like RDS and Aurora require cross-region network round-trips for writes in secondary regions, violating latency targets.

Analyze storage encryption and replication requirements

Game assets must be replicated using S3 CRR, encrypted using Customer Managed Keys (CMKs).

AWS-managed KMS keys cannot be shared across regions or accounts. Therefore, customer-managed CMKs must be created in both source and destination regions, and the destination key policy must trust the replication role.

Anahtar Kavram

Selecting and combining multi-region database and object storage solutions while adhering to replication latency, write capability, and KMS key policy limits.

Soru 1533Soru →

An enterprise logistics company, GlobalTrack, is modernizing its legacy package tracking application by migrating it to AWS. The application will run as containerized microservices on AWS Fargate across multiple AWS accounts in an AWS Organization. The architecture consists of a Shared Services VPC in a central account and several Application VPCs in separate application accounts. To minimize costs and simplify administration, the enterprise wants to host the Amazon Elastic Container Registry (Amazon ECR) repositories and the Route 53 Private Hosted Zones centrally in the Shared Services VPC. The Fargate tasks in the Application VPCs must pull container images from the central ECR repositories and resolve ECR DNS names privately, without traversing the public internet. The Application VPCs are connected to the Shared Services VPC via an AWS Transit Gateway.

Which of the following actions should the Solutions Architect take to implement this architecture? (Select TWO.)

Geçerli olan tümünü seçin

Associate the Route 53 Private Hosted Zones for ECR created in the central Shared Services account with the Application VPCs in the application accounts.

Create an Amazon S3 VPC Gateway Endpoint in each Application VPC to allow the AWS Fargate tasks to download image layers directly.

Configure the ECS Task Definitions in the Application VPCs to use the bridge network mode to map container ports and route image pull traffic.

Configure the Transit Gateway to route S3 traffic transitively to the S3 Gateway Endpoint located in the Shared Services VPC.

Configure the DNS resolver (169.254.169.253) in the Application VPCs to forward all ECR queries transitively to the Shared Services VPC resolver over the Transit Gateway.

Cevabı ve açıklamayı göster

Cevap: Associate the Route 53 Private Hosted Zones for ECR created in the central Shared Services account with the Application VPCs in the application accounts.; Create an Amazon S3 VPC Gateway Endpoint in each Application VPC to allow the AWS Fargate tasks to download image layers directly.

Cevap

To configure the multi-account AWS Fargate and ECR architecture, the Route 53 Private Hosted Zones for ECR must be associated with the Application VPCs, and an Amazon S3 Gateway Endpoint must be created in each Application VPC.

To privately pull images from Amazon ECR in a shared services VPC, tasks running in application VPCs must resolve the ECR DNS endpoints to the interface VPC endpoints in the Shared Services VPC, which requires associating the central Private Hosted Zones with the application VPCs. Additionally, because ECR stores image layers in Amazon S3, and S3 Gateway Endpoints do not support transitive routing over Transit Gateway, an S3 Gateway Endpoint must be created in each application VPC to allow tasks to download image layers directly and privately.

Adım Adım Çözüm

Identify the network dependencies for pulling ECR images privately.

ECR requires connection to ECR API/DKR endpoints and Amazon S3 where the container image layers are actually stored.

Understanding ECR architecture is critical to routing traffic correctly.

Determine private DNS resolution requirements for cross-account VPCs.

The Route 53 Private Hosted Zones for the ECR endpoints in the Shared Services VPC must be associated with the Application VPCs.

This allows the application Fargate tasks to resolve the ECR endpoint domain names to the private IP addresses of the Shared Services VPC endpoints.

Configure Amazon S3 access for image layers.

Create an S3 Gateway Endpoint in each Application VPC.

Gateway endpoints cannot be accessed transitively over a Transit Gateway, so each Application VPC needs its own local S3 gateway endpoint to download ECR image layers.

Anahtar Kavram

Cross-account private container registry access and DNS resolution with AWS Fargate

Soru 1534Soru →

NexaSettlement Corp is modernizing its core clearing and settlement engine by migrating it from on-premises virtual machines to AWS. The settlement engine is memory-intensive and must run on AWS Fargate across three Availability Zones in a dedicated Workload account. The engine must query a real-time audit logger hosted in a Shared Services account.

The architecture must adhere to the following constraints:
1. All traffic between the settlement engine, the audit logger, and AWS services must remain within the AWS network to satisfy PCI-DSS compliance.
2. The settlement engine must pull container images from a private Amazon ECR repository located in the Shared Services account.
3. The settlement engine must resolve the audit logger's internal DNS name, which is managed in a Route 53 Private Hosted Zone (PHZ) in the Shared Services account.
4. The system must tolerate the failure of any single Availability Zone or NAT Gateway without service interruption.

Which design meets these requirements with the least operational overhead?

Deploy the settlement engine tasks in the Workload VPC using the awsvpc network mode. Create VPC interface endpoints for Amazon ECR (ecr.api and ecr.dkr) and a VPC gateway endpoint for Amazon S3 in the Workload VPC. Configure the ECR repository policy in the Shared Services account to allow access from the Workload account's ECS task execution role. Create a Route 53 Private Hosted Zone association authorization in the Shared Services account, and associate the zone with the Workload VPC using the AWS CLI.

Deploy the settlement engine tasks in the Workload VPC using the bridge network mode to simplify local port mapping. Set up an AWS Transit Gateway to route container traffic to Amazon ECR VPC endpoints located in the Shared Services VPC. Configure Route 53 Resolver outbound endpoints in the Workload VPC and inbound endpoints in the Shared Services VPC to forward DNS queries for the audit logger.

Deploy the settlement engine tasks in the Workload VPC using the awsvpc network mode. Deploy a single NAT Gateway in the public subnet of one Availability Zone to route ECR and S3 image pull requests to public endpoints. Authorize the Workload ECS tasks to assume a cross-account IAM role in the Shared Services account to perform DNS resolution against the Private Hosted Zone.

Deploy the settlement engine tasks in the Workload VPC using the awsvpc network mode. Create VPC interface endpoints for Amazon ECR and a VPC gateway endpoint for Amazon S3 in the Workload VPC, using AWS-managed KMS keys (aws/s3 and aws/ecr) for encryption. Create Route 53 Resolver outbound endpoints in the Workload VPC and inbound endpoints in the Shared Services VPC to resolve the audit logger DNS.

Cevabı ve açıklamayı göster

Cevap: Deploy the settlement engine tasks in the Workload VPC using the awsvpc network mode. Create VPC interface endpoints for Amazon ECR (ecr.api and ecr.dkr) and a VPC gateway endpoint for Amazon S3 in the Workload VPC. Configure the ECR repository policy in the Shared Services account to allow access from the Workload account's ECS task execution role. Create a Route 53 Private Hosted Zone association authorization in the Shared Services account, and associate the zone with the Workload VPC using the AWS CLI.

Cevap

Deploy the settlement engine tasks in the Workload VPC using the awsvpc network mode, create VPC interface endpoints for Amazon ECR and a gateway endpoint for Amazon S3 in the Workload VPC, configure the ECR repository policy in the Shared Services account to grant access to the Workload account's ECS task execution role, and associate the Route 53 Private Hosted Zone directly with the Workload VPC using the AWS CLI or API.

Deploying the settlement engine on AWS Fargate using the awsvpc network mode is required. Creating interface endpoints for ECR and a gateway endpoint for S3 inside the Workload VPC allows the tasks to pull container images privately without requiring public internet routing. Configuring the ECR repository policy in the Shared Services account ensures that the Workload account's ECS task execution role has appropriate permissions. Associating the Route 53 Private Hosted Zone in the Shared Services account with the Workload VPC using the AWS CLI provides direct, native private DNS resolution with minimal operational complexity.

Adım Adım Çözüm

Select the correct network mode for AWS Fargate.

Confirm that the task definitions are configured to use the awsvpc network mode, as AWS Fargate does not support other modes like host or bridge.

Ensures that the containers can be deployed successfully on the serverless compute engine.

Configure private connectivity to Amazon ECR and S3.

Provision VPC interface endpoints for ecr.api and ecr.dkr, and a VPC gateway endpoint for S3 in the Workload VPC.

Allows the ECS agent on Fargate to pull container images privately without traversing the public internet or incurring NAT Gateway costs, complying with PCI-DSS.

Establish cross-account ECR access permissions.

Attach a repository policy to the ECR repository in the Shared Services account allowing 'ecr:BatchGetImage' and 'ecr:GetDownloadUrlForLayer' to the ECS task execution role in the Workload account.

Grants the ECS tasks in the Workload account the required permissions to pull the image from the Shared Services account.

Associate the Route 53 Private Hosted Zone (PHZ) across accounts.

Submit a PHZ association authorization from the Shared Services account, and then accept the association for the Workload VPC from the Workload account using the AWS CLI or API.

Enables local tasks in the Workload VPC to resolve the internal DNS of the audit logger directly without deploying complex Route 53 Resolver architectures.

Anahtar Kavram

Modernizing legacy workloads to AWS Fargate requires leveraging the awsvpc network mode, utilizing local VPC endpoints (ECR and S3) for private image pulls from other AWS accounts, and executing cross-account Route 53 Private Hosted Zone associations for internal DNS resolution.

Soru 1535Soru →

A multinational financial corporation is migrating its legacy core transaction workloads to AWS using AWS Application Migration Service (MGN). The workload consists of 50 physical servers running a mix of Windows Server and Red Hat Enterprise Linux (RHEL). The target architecture is a multi-account environment managed by AWS Organizations, where data replication must occur privately over an AWS Direct Connect (DX) connection terminating at a Transit Gateway (TGW) in a central Network account. The staging area subnets are located in a Shared Services VPC within a central Infrastructure account, while the migrated instances must launch in the Production VPC in a separate Production account. The architecture must be resilient to Availability Zone (AZ) outages to prevent replication stalls, on-premises source servers must resolve AWS MGN API endpoints privately, and the target instances must automatically join the corporate Active Directory domain in the Production VPC post-launch.

During the pilot phase, the replication agent installation fails on-premises, staging replication stalls during AZ maintenance windows, and launched instances fail to join the Active Directory domain. Which combination of configuration steps will resolve all of these issues?

Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC. Create a Route 53 Private Hosted Zone for the MGN endpoints, associate it with both the Staging VPC and Production VPC, and deploy Route 53 Inbound Resolvers in the Staging VPC with conditional forwarders configured on-premises. Configure the MGN replication template to use staging subnets across multiple Availability Zones, each with a dedicated, redundant NAT Gateway. Ensure the Staging VPC security groups permit inbound traffic from the on-premises range on TCP port 1500. In the Production account, configure the EC2 Launch Template with an IAM instance profile containing the AmazonSSMManagedInstanceCore and directory join permissions, and enable the Active Directory integration post-launch action.

Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC, and associate a Route 53 Private Hosted Zone for the MGN endpoints with the Staging VPC. Set up Route 53 Inbound Resolvers in the Staging VPC to forward queries from on-premises. Configure the MGN replication template to deploy replication servers across multiple Availability Zones, routing all outbound traffic through a single NAT Gateway located in one primary Availability Zone. Ensure the Staging VPC security groups permit inbound traffic from the on-premises range on TCP port 1500. In the Production account, assign the AmazonSSMManagedInstanceCore and directory join permissions to the target instance launch templates, and enable the Active Directory integration post-launch action.

Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC. Create a Route 53 Private Hosted Zone for the MGN endpoints in the central Infrastructure account, but do not associate it with the Staging VPC or Production VPC, relying instead on Transit Gateway route propagation to resolve private DNS queries. Set up Route 53 Inbound Resolvers in the Staging VPC. Configure the MGN replication template to use staging subnets across multiple Availability Zones with dedicated NAT Gateways in each zone. Ensure the Staging VPC security groups permit inbound traffic from the on-premises range on TCP port 1500. In the Production account, configure the EC2 Launch Template with an IAM instance profile containing the AmazonSSMManagedInstanceCore and directory join permissions, and enable the Active Directory integration post-launch action.

Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC. Create a Route 53 Private Hosted Zone for the MGN endpoints, associate it with both the Staging VPC and Production VPC, and deploy Route 53 Inbound Resolvers in the Staging VPC. Configure the MGN replication template to use staging subnets across multiple Availability Zones, each with a dedicated NAT Gateway. Configure the Staging VPC security groups to permit inbound traffic from the on-premises range on TCP port 443 only, blocking port 1500 to enhance security. In the Production account, configure the EC2 Launch Template with an IAM instance profile containing the AmazonSSMManagedInstanceCore and directory join permissions, and enable the Active Directory integration post-launch action.

Cevabı ve açıklamayı göster

Cevap: Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC. Create a Route 53 Private Hosted Zone for the MGN endpoints, associate it with both the Staging VPC and Production VPC, and deploy Route 53 Inbound Resolvers in the Staging VPC with conditional forwarders configured on-premises. Configure the MGN replication template to use staging subnets across multiple Availability Zones, each with a dedicated, redundant NAT Gateway. Ensure the Staging VPC security groups permit inbound traffic from the on-premises range on TCP port 1500. In the Production account, configure the EC2 Launch Template with an IAM instance profile containing the AmazonSSMManagedInstanceCore and directory join permissions, and enable the Active Directory integration post-launch action.

Cevap

Configure VPC interface endpoints for the MGN and Amazon S3 services in the Staging VPC, associate the Route 53 Private Hosted Zone with the Staging and Production VPCs, deploy Route 53 Inbound Resolvers with conditional forwarding, use multi-AZ staging subnets with redundant NAT Gateways, open TCP port 1500, and ensure the target EC2 Launch Template in the Production account has the proper IAM instance profile and Active Directory post-launch action enabled.

The correct solution addresses all requirements: it enables private DNS resolution and traffic routing over Direct Connect via interface endpoints and Route 53 Inbound Resolvers; it ensures high availability of replication by distributing replication servers across multiple Availability Zones with redundant NAT Gateways; it opens TCP port 1500 to allow the replication data channel; and it attaches the correct IAM instance profile with AWS Systems Manager (SSM) permissions alongside the Active Directory integration post-launch action to automate domain-joining during cutover.

Adım Adım Çözüm

Configure private connectivity to MGN and S3 by creating VPC interface endpoints in the Staging VPC, and set up a Route 53 Private Hosted Zone associated with the Staging VPC.

Source servers can reach MGN control plane APIs and S3 securely over AWS Direct Connect without using public IP addresses.

The migration requirements specify that data replication and control plane traffic must bypass the public internet.

Deploy Route 53 Inbound Resolvers in the Staging VPC and configure conditional forwarders on the on-premises DNS servers for the MGN and S3 domain names pointing to the resolver IPs.

On-premises source servers can successfully resolve the private IP addresses of the VPC endpoints.

Without inbound resolvers and forwarding, the on-premises servers would attempt to resolve MGN endpoints via public DNS, failing to connect over the private network.

Configure the MGN replication template to allocate replication servers across multiple subnets in different Availability Zones, and ensure each subnet has a dedicated NAT Gateway.

Staging replication is protected against Availability Zone degradation or outages.

A single NAT Gateway creates a single point of failure. Deploying redundant NAT Gateways across multiple zones ensures continuous replication capabilities.

Configure the Staging VPC security group to permit inbound traffic from the on-premises subnet range on TCP port 1500.

The AWS Replication Agent can establish the data channel and stream replicated blocks to the staging replication servers.

AWS MGN uses TCP port 1500 exclusively for transferring the replicated data blocks from the source agent.

In the Production account, update the EC2 Launch Template with an IAM instance profile containing the AmazonSSMManagedInstanceCore policy and configure the MGN Active Directory post-launch action.

Launched cutover instances are registered with Systems Manager and automatically joined to the domain.

SSM post-launch actions require the instance to have appropriate IAM permissions to interact with Systems Manager and Active Directory services.

Anahtar Kavram

Designing secure, resilient, and automated enterprise infrastructure migrations using AWS Application Migration Service (MGN) in a multi-account, hybrid DNS environment.

Tahmini Süre:3m 0s

Soru 1536Soru →

A maritime freight analytics platform, VesselWave, is modernizing its containerized route-optimization application by migrating it from an on-premises Docker Swarm cluster to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The application tasks will run in private subnets and must not have any direct access to or from the public internet. The container images are stored in a private Amazon Elastic Container Registry (Amazon ECR) repository, and the application must write logs to Amazon CloudWatch. Which TWO configurations must the Solutions Architect implement to allow the Fargate tasks to securely pull images and write logs while adhering to these constraints?

Geçerli olan tümünü seçin

Create interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr in the VPC, and a gateway VPC endpoint for Amazon S3 associated with the private subnets' route tables.

Configure the Amazon ECS task definition to use the awsvpc network mode, and assign an ECS task execution IAM role that grants permissions to pull images from Amazon ECR and write logs to Amazon CloudWatch.

Configure the Amazon ECS task definition to use the bridge network mode, and deploy an Application Load Balancer to route traffic to the container hosts.

Deploy a single NAT Gateway in a public subnet, and configure the private subnets' route tables to route all outbound 0.0.0.0/0 traffic to the NAT Gateway.

Create a custom Route 53 Private Hosted Zone for ECR endpoints and manually associate it with the VPC while disabling DNS hostnames and DNS resolution features.

Cevabı ve açıklamayı göster

Cevap: Create interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr in the VPC, and a gateway VPC endpoint for Amazon S3 associated with the private subnets' route tables.; Configure the Amazon ECS task definition to use the awsvpc network mode, and assign an ECS task execution IAM role that grants permissions to pull images from Amazon ECR and write logs to Amazon CloudWatch.

Cevap

The correct configurations are to create interface VPC endpoints for ECR and a gateway VPC endpoint for S3, and to configure the task definition with the awsvpc network mode alongside an appropriate ECS task execution IAM role.

To run Amazon ECS tasks on AWS Fargate within private subnets without public internet routing, the tasks must use the awsvpc network mode. The ECS agent needs to pull images from Amazon ECR and send logs to CloudWatch. Because there is no internet route, AWS PrivateLink interface VPC endpoints for ECR (both ecr.api and ecr.dkr) must be created in the VPC. Additionally, because ECR stores its image layers in Amazon S3, a gateway VPC endpoint for S3 is required to allow tasks to download the layers. Finally, the ECS task execution IAM role must have the necessary policy permissions to authenticate with ECR, pull the image, and write to CloudWatch log streams.

Adım Adım Çözüm

Configure the network access for ECR and S3 in the isolated VPC.

Interface VPC endpoints for ECR (ecr.api and ecr.dkr) are created, and an Amazon S3 gateway VPC endpoint is attached to the route tables.

Because the tasks lack internet routes, they must connect to ECR via PrivateLink. Since ECR stores image layers in S3, a route to S3 is also required.

Configure the network mode in the task definition.

The network mode is set to awsvpc.

AWS Fargate only supports the awsvpc network mode, which assigns a dedicated Elastic Network Interface (ENI) to each task.

Configure the required IAM execution permissions.

The ECS task execution IAM role is assigned permissions to pull from ECR and write to CloudWatch Logs.

The ECS container agent requires these permissions during task initialization before the actual application container starts.

Anahtar Kavram

Configuring secure private network connectivity and execution roles for Amazon ECS tasks running on AWS Fargate in isolated subnets.

Tahmini Süre:2m 0s

Soru 1537Soru →

A financial services company runs a multi-tier application across a multi-account structure in AWS Organizations. The application consists of a web layer running on AWS Fargate in private subnets across two Availability Zones (AZs), a batch processing layer on Amazon EC2 m6i.large instances, and a reporting API built with AWS Lambda. To minimize costs, the operations team proposes deploying a single NAT Gateway in one AZ to route outbound internet traffic from the private subnets. Additionally, the company plans to share specialized network resources via AWS Resource Access Manager (RAM) to a partner's AWS account that is outside their AWS Organization. The company wants to purchase Savings Plans to reduce compute costs for EC2, Fargate, and Lambda, while keeping maximum flexibility for future microservice migrations. Which combination of actions should a Solutions Architect recommend to optimize costs, maintain high availability, and ensure successful resource sharing?

Purchase EC2 Instance Savings Plans for the m6i instance family at the AWS Organizations management account level. Deploy a NAT Gateway in each Availability Zone. Enable sharing with external accounts in the AWS Resource Access Manager settings to share resources with the partner account.

Purchase Compute Savings Plans at the AWS Organizations management account level. Deploy a NAT Gateway in each Availability Zone. Enable sharing with external accounts in the AWS Resource Access Manager settings to share resources with the partner account.

Purchase Compute Savings Plans at the AWS Organizations management account level. Keep the single NAT Gateway configuration to minimize NAT Gateway hourly fees and data processing costs. Enable sharing with external accounts in the AWS Resource Access Manager settings to share resources with the partner account.

Purchase Compute Savings Plans at the AWS Organizations management account level. Deploy a NAT Gateway in each Availability Zone. Share the resources using AWS Resource Access Manager without enabling external account sharing, relying on cross-account IAM trust relationships.

Cevabı ve açıklamayı göster

Cevap: Purchase Compute Savings Plans at the AWS Organizations management account level. Deploy a NAT Gateway in each Availability Zone. Enable sharing with external accounts in the AWS Resource Access Manager settings to share resources with the partner account.

Cevap

Purchase Compute Savings Plans at the AWS Organizations management account level, deploy a NAT Gateway in each Availability Zone, and enable sharing with external accounts in the AWS Resource Access Manager settings.

The correct option optimizes compute costs by purchasing Compute Savings Plans, which provide up to 66% savings and apply automatically to EC2, Fargate, and Lambda across all accounts in the AWS Organization. It also ensures high availability by deploying a NAT Gateway in each Availability Zone, preventing a single point of failure for outbound traffic. Finally, it enables resource sharing with a partner account outside the AWS Organization by turning on the external sharing setting in AWS Resource Access Manager.

Adım Adım Çözüm

Determine the appropriate Savings Plan type to optimize the compute resources.

Compute Savings Plans are selected.

Compute Savings Plans apply to EC2, Fargate, and Lambda, providing the required flexibility and cost coverage for all three compute types, whereas EC2 Instance Savings Plans do not cover Fargate and Lambda.

Evaluate the network architecture for cost and high availability.

Deploy a NAT Gateway in each Availability Zone instead of a single NAT Gateway.

A single NAT Gateway creates a single point of failure for resources in other Availability Zones, violating the high availability constraint.

Determine the configuration needed to share resources via AWS RAM to an external account.

Enable sharing with external accounts in the AWS Resource Access Manager settings.

AWS RAM restricts sharing outside of the AWS Organization by default; explicit permission to share with external entities is required.

Anahtar Kavram

Balancing compute cost optimization using flexible Savings Plans with high availability networking constraints and multi-account resource sharing rules.

Soru 1538Soru →

StreamVibe is modernizing its legacy document-management application by migrating it to AWS. To minimize operational overhead, a solutions architect decides to deploy the containerized application on Amazon Elastic Container Service (Amazon ECS) using the AWS Fargate launch type. The application is distributed across three Availability Zones and requires a shared, persistent file system that supports simultaneous read and write operations with full POSIX-compliant file permissions. Which configuration should the solutions architect recommend to satisfy these requirements?

Configure the ECS task definition to use the awsvpc network mode. Provision an Amazon Elastic File System (Amazon EFS) file system, and define an EFS volume in the task definition. Mount this volume to the container tasks, and utilize EFS Access Points to enforce POSIX permissions.

Configure the ECS task definition to use the bridge network mode. Provision an Amazon Elastic File System (Amazon EFS) file system, and define an EFS volume in the task definition. Mount this volume to the container tasks, and utilize EFS Access Points to enforce POSIX permissions.

Configure the ECS task definition to use the awsvpc network mode. Provision an Amazon Elastic Block Store (Amazon EBS) volume with Multi-Attach enabled. Configure the task definition to mount this EBS volume to the containers across the three Availability Zones.

Configure the ECS task definition to use the awsvpc network mode. Provision an Amazon Simple Storage Service (Amazon S3) bucket and configure the task definition to run a FUSE-based file system driver to mount the bucket. Route outbound traffic through a single NAT Gateway located in a single public subnet.

Cevabı ve açıklamayı göster

Cevap: Configure the ECS task definition to use the awsvpc network mode. Provision an Amazon Elastic File System (Amazon EFS) file system, and define an EFS volume in the task definition. Mount this volume to the container tasks, and utilize EFS Access Points to enforce POSIX permissions.

Cevap

Configure the ECS task definition to use the awsvpc network mode, provision an Amazon EFS file system, define an EFS volume in the task definition, mount this volume to the container tasks, and utilize EFS Access Points to enforce POSIX permissions.

The correct configuration uses the awsvpc network mode, which is the only network mode supported by the AWS Fargate launch type. It uses Amazon Elastic File System (Amazon EFS) to provide shared, regional storage that supports concurrent read and write operations across multiple Availability Zones. The configuration also leverages EFS Access Points to enforce specific POSIX user and group IDs, meeting the application's file permissions requirements.

Adım Adım Çözüm

Select the correct ECS launch type and networking mode.

AWS Fargate requires the awsvpc network mode, where every task receives its own Elastic Network Interface (ENI) and private IP address.

Fargate tasks do not share a host and therefore do not support host or bridge networking modes.

Determine the appropriate persistent storage type for concurrent multi-AZ access.

Select Amazon EFS, which is a regional service that allows concurrent read/write operations from multiple mounting points across multiple Availability Zones.

Amazon EBS is restricted to a single Availability Zone, and Amazon S3 does not natively support POSIX file system permissions.

Configure secure POSIX-compliant file access.

Create an EFS Access Point to enforce specific POSIX user IDs and group IDs for all application tasks mounting the file system.

EFS Access Points simplify directory permissions management for containerized workloads by overriding the user identity used to access the file system.

Anahtar Kavram

AWS Fargate network mode compatibility and regional shared persistent storage using Amazon EFS.

Soru 1539Soru →

A financial services company is designing a secure, multi-VPC networking architecture in the eu-west-1 region for a new application. The design includes two VPCs: vpc-app-prod (hosting critical production workloads across two Availability Zones) and vpc-shared-services (hosting shared monitoring tools).

The architecture must meet the following requirements:
1. Workloads in the private subnets of vpc-app-prod must have highly available outbound-only internet access, ensuring no single point of failure.
2. The monitoring tools in vpc-shared-services must be able to resolve domain names in the private hosted zone prod.corp.aws, which is managed in the production environment.

Which design architecture meets these requirements?

Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-app-prod. Update the route tables of the private subnets in each Availability Zone to route outbound internet traffic through the NAT Gateway in the same Availability Zone. Associate the Route 53 Private Hosted Zone prod.corp.aws with both vpc-app-prod and vpc-shared-services.

Deploy a single NAT Gateway in a public subnet within one Availability Zone of vpc-app-prod. Update the route tables of the private subnets in all Availability Zones of vpc-app-prod to route outbound internet traffic through this single NAT Gateway. Associate the Route 53 Private Hosted Zone prod.corp.aws with both vpc-app-prod and vpc-shared-services.

Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-app-prod. Connect vpc-app-prod and vpc-shared-services using an AWS Direct Connect Gateway to enable transitive VPC-to-VPC routing of outbound traffic and DNS requests. Associate the Route 53 Private Hosted Zone prod.corp.aws with the Direct Connect Gateway.

Cevabı ve açıklamayı göster

Cevap: Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-app-prod. Update the route tables of the private subnets in each Availability Zone to route outbound internet traffic through the NAT Gateway in the same Availability Zone. Associate the Route 53 Private Hosted Zone prod.corp.aws with both vpc-app-prod and vpc-shared-services.

Cevap

Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-app-prod, route the private subnets in each Availability Zone to their respective local NAT Gateways, and associate the Route 53 Private Hosted Zone prod.corp.aws with both VPCs.

The correct architecture deploys a NAT Gateway in a public subnet within each Availability Zone of vpc-app-prod. This ensures that outbound internet traffic from the private subnets is highly available and does not depend on a single Availability Zone. Additionally, associating the Route 53 Private Hosted Zone prod.corp.aws with both vpc-app-prod and vpc-shared-services allows resources in both VPCs to resolve DNS queries for that zone directly via the Route 53 Resolver.

Adım Adım Çözüm

Ensure high availability for internet egress in vpc-app-prod.

Deploy two NAT Gateways, one in each public subnet across the two Availability Zones, and update the route tables of the private subnets in each Availability Zone to point their default route (0.0.0.0/0) to the NAT Gateway in the same Availability Zone.

This setup prevents an outage in one Availability Zone from impacting outbound internet connectivity in the other Availability Zone.

Configure DNS resolution for the private hosted zone across both VPCs.

Associate the Route 53 Private Hosted Zone prod.corp.aws with both vpc-app-prod and vpc-shared-services.

Route 53 Private Hosted Zones must be explicitly associated with each VPC from which name resolution is required; VPC peering or transitive routing does not automatically share Private Hosted Zone resolution.

Anahtar Kavram

Multi-AZ NAT Gateway redundancy and multi-VPC Route 53 Private Hosted Zone association.

Tahmini Süre:2m 0s

Soru 1540Soru →

A company is migrating an on-premises Microsoft SQL Server database to an Amazon Aurora PostgreSQL-Compatible Edition DB cluster. The migration strategy requires a heterogeneous schema conversion followed by an initial full load and ongoing replication to minimize application downtime during the cutover window. The solutions architect is setting up the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) tasks for this migration. Which TWO actions must the solutions architect perform to ensure the schema is successfully converted and ongoing changes are replicated correctly? (Select two.)

Geçerli olan tümünü seçin

Enable Change Data Capture (CDC) on the source SQL Server database and all tables scheduled for migration, and ensure that the SQL Server Agent service is running on the source server.

Use the AWS Schema Conversion Tool (AWS SCT) to convert the source schema, apply the converted DDL to the target Aurora PostgreSQL DB cluster, and install the AWS SCT Extension Pack on the target database to emulate SQL Server features that do not have direct PostgreSQL equivalents.

Configure the AWS DMS replication task to capture changes using database transaction logs directly without enabling MS-CDC or MS-Replication, assuming AWS DMS will automatically read the transaction logs of any SQL Server configuration.

Configure AWS DMS to automatically convert the SQL Server database schema, stored procedures, and triggers on-the-fly during the Full Load phase of the replication task.

Set up an AWS DMS target endpoint with the target engine configured as Microsoft SQL Server, then use PostgreSQL compatibility mode in the DMS task settings to allow the schema to convert dynamically.

Cevabı ve açıklamayı göster

Cevap: Enable Change Data Capture (CDC) on the source SQL Server database and all tables scheduled for migration, and ensure that the SQL Server Agent service is running on the source server.; Use the AWS Schema Conversion Tool (AWS SCT) to convert the source schema, apply the converted DDL to the target Aurora PostgreSQL DB cluster, and install the AWS SCT Extension Pack on the target database to emulate SQL Server features that do not have direct PostgreSQL equivalents.

Cevap

Enable Change Data Capture (CDC) on the source SQL Server database and all tables scheduled for migration, ensure that the SQL Server Agent service is running on the source server, use the AWS Schema Conversion Tool (AWS SCT) to convert the source schema, apply the converted DDL to the target Aurora PostgreSQL DB cluster, and install the AWS SCT Extension Pack on the target database.

To migrate from Microsoft SQL Server to Aurora PostgreSQL-Compatible Edition (a heterogeneous migration), the AWS Schema Conversion Tool (AWS SCT) must be used to convert the source schema and apply it to the target database. Since PostgreSQL does not natively support some SQL Server built-in functions, the AWS SCT Extension Pack is installed on the target database to emulate these features. Additionally, for ongoing replication (CDC) using AWS DMS with a SQL Server source, you must enable MS-CDC on the source database and tables, and the SQL Server Agent must be running to process CDC logs.

Adım Adım Çözüm

Use AWS SCT to perform schema conversion and generate a migration assessment report.

Identify incompatibilities and obtain SQL DDL scripts tailored for the target Aurora PostgreSQL DB cluster.

AWS DMS does not convert schema objects like stored procedures and triggers, requiring SCT for heterogeneous migrations.

Apply the converted DDL schema to the target Aurora PostgreSQL database and install the AWS SCT Extension Pack.

Create the target schema structures and provide emulation for non-native SQL Server functions in PostgreSQL.

Ensures that application queries and database logic converted from SQL Server can execute correctly on PostgreSQL.

Enable MS-CDC on the source SQL Server database and tables, and verify the SQL Server Agent service is running.

Prepare the source database to track ongoing data changes and expose them in log tables.

AWS DMS requires Change Data Capture (CDC) or MS-Replication to capture ongoing changes from a SQL Server source.

Create and execute an AWS DMS replication task configured for Full Load and ongoing Change Data Capture (CDC).

Initial data is copied, and incremental changes are continuously replicated to the target.

Allows near-zero downtime migration by syncing the source and target databases until the cutover window.

Anahtar Kavram

Heterogeneous database migration from SQL Server to PostgreSQL using AWS SCT for schema conversion (with Extension Pack emulation) and AWS DMS for data migration (requiring MS-CDC setup on the source for ongoing replication).

ÖncekiSayfa 77 / 99Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram